@cosmicdrift/kumiko-samples 0.366.0 → 0.368.0

package/packages/bundled-features/src/template-resolver/seeding.ts

@@ -9,12 +9,12 @@
 // Default ifExists="skip". The actor is `createSystemUser(SYSTEM_TENANT_ID)`,
 // deliberately not TestUsers (prod seeds are not test utilities).
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createTenantDb,
   type DbConnection,
   deleteMany,
   type EntityTableMeta,
+  fetchOne,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -28,11 +28,13 @@ import {
   getStreamVersion,
   getUnscopedStreamMaxVersionForSeed,
 } from "@cosmicdrift/kumiko-framework/event-store";
+import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { type ContentFormat, TEXT_BLOCK_KIND, type UpsertKind } from "./constants.js";
 import { executor } from "./handlers/shared.js";
 import { evaluateTemplateWrite } from "./handlers/template-gates.js";
-import { TEMPLATE_RESOLVER_FEATURE } from "./qualified-names.js";
+import { TEMPLATE_RESOLVER_FEATURE, TemplateResolverHandlers } from "./qualified-names.js";
 import { type TemplateResourceRow, templateResourcesTable } from "./table.js";
 import type { TemplateBundle } from "./template-bundle.js";
 import { activeStampChanges, servedStampChanges } from "./template-draft.js";
@@ -87,7 +89,7 @@ export async function seedSystemTemplate(
 ): Promise<{ id: string }> {
   const tenantId = SYSTEM_TENANT_ID;
   const by = opts.by ?? createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
 
   const label = `seedSystemTemplate ${opts.slug}/${opts.kind}/${opts.locale}`;
   const slug = templateSlugSchema.safeParse(opts.slug);
@@ -233,20 +235,21 @@ export async function seedSystemTemplate(
 export type SeedSystemTemplateBundleOptions = {
   readonly by?: SessionUser;
   readonly ifExists?: SeedIfExists;
+  /** Required for bundles with resources (e.g. a `logo`): the files go through the
+   *  import-bundle-system write, which needs the file provider of the system tenant. */
+  readonly dispatcher?: Dispatcher;
 };
 
-// Seeds one system row per bundle locale. Bundled resources need a file
-// provider and the system tenant's file space, which a boot seed does not
-// have, so those go through the import-bundle-system write instead.
+// Seeds one system row per bundle locale. Bundled resources need a file provider and
+// the system tenant's file space, so those bundles are written through the
+// import-bundle-system handler on the seed dispatcher instead of directly.
 export async function seedSystemTemplateBundle(
   db: DbConnection,
   bundle: TemplateBundle,
   opts: SeedSystemTemplateBundleOptions = {},
 ): Promise<{ ids: Record<string, string> }> {
   if (Object.keys(bundle.resources).length > 0) {
-    throw new Error(
-      `seedSystemTemplateBundle ${bundle.slug}/${bundle.kind}: bundles with resources cannot be seeded; use the import-bundle-system write`,
-    );
+    return seedSystemTemplateBundleWithResources(db, bundle, opts);
   }
   const ids: Record<string, string> = {};
   for (const [locale, entry] of Object.entries(bundle.locales)) {
@@ -266,6 +269,50 @@ export async function seedSystemTemplateBundle(
   return { ids };
 }
 
+async function seedSystemTemplateBundleWithResources(
+  db: DbConnection,
+  bundle: TemplateBundle,
+  opts: SeedSystemTemplateBundleOptions,
+): Promise<{ ids: Record<string, string> }> {
+  const label = `seedSystemTemplateBundle ${bundle.slug}/${bundle.kind}`;
+  const { dispatcher } = opts;
+  if (!dispatcher) {
+    throw new Error(
+      `${label}: bundles with resources need a file provider; pass opts.dispatcher (the dispatcher of the seed deps) so the files are stored through the import-bundle-system write`,
+    );
+  }
+  if ((opts.ifExists ?? "skip") === "skip") {
+    const existingIds: Record<string, string> = {};
+    for (const locale of Object.keys(bundle.locales)) {
+      const row = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
+        tenantId: SYSTEM_TENANT_ID,
+        slug: bundle.slug,
+        kind: bundle.kind,
+        locale,
+      });
+      if (row) existingIds[locale] = String(row.id);
+    }
+    if (Object.keys(existingIds).length === Object.keys(bundle.locales).length) {
+      return { ids: existingIds };
+    }
+  }
+  const result = await dispatcher.write(
+    TemplateResolverHandlers.importBundleSystem,
+    { bundle },
+    opts.by ?? createSystemUser(SYSTEM_TENANT_ID, ["SystemAdmin"]),
+  );
+  if (!result.isSuccess) {
+    throw new Error(`${label} failed: ${result.error.code}: ${result.error.message}`);
+  }
+  return { ids: importedIds(result.data) };
+}
+
+function importedIds(data: unknown): Record<string, string> {
+  const ids = isPlainObject(data) ? data["ids"] : undefined;
+  if (!isPlainObject(ids)) throw new Error("seedSystemTemplateBundle: import returned no ids");
+  return Object.fromEntries(Object.entries(ids).map(([locale, id]) => [locale, String(id)]));
+}
+
 export function hasNotificationTemplates(registry: Registry): boolean {
   return Array.from(registry.getAllNotifications().values()).some(
     (notification) => notification.template !== undefined,
@@ -332,7 +379,7 @@ export async function seedTextBlock(
   opts: SeedTextBlockOptions,
 ): Promise<{ id: string }> {
   const by = opts.by ?? createSystemUser(opts.tenantId);
-  const tdb = createTenantDb(db, opts.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
 
   const existingRow = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
     tenantId: opts.tenantId,

package/packages/bundled-features/src/template-resolver/store-template-resource.ts

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   BeforeTransactionResult,
   ConfigAccessor,

package/packages/bundled-features/src/template-resolver/template-preview.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   HandlerContext,
   SessionUser,
@@ -69,6 +69,8 @@ function sampleScalar(name: string, def: TemplateScalarVariableDef): unknown {
       return 0;
     case "date":
       return SAMPLE_DATE;
+    case "percent":
+      return 0;
   }
 }
 

package/packages/bundled-features/src/template-resolver/template-resources.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type {
   HandlerContext,
   SessionUser,

package/packages/bundled-features/src/template-resolver/template-system-only.ts

@@ -0,0 +1,21 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { isSystemAdmin } from "./template-draft.js";
+
+const NOTIFICATION_TEMPLATE_KIND = "mail";
+
+// A notification registered with systemOnly keeps its mail template as the system default:
+// tenants neither list nor override it, and overrides stored before the flag are ignored.
+export function isSystemOnlyTemplate(registry: Registry, slug: string, kind: string): boolean {
+  return (
+    kind === NOTIFICATION_TEMPLATE_KIND &&
+    registry.getAllNotifications().get(slug)?.systemOnly === true
+  );
+}
+
+export function isSystemOnlyTemplateHiddenFrom(
+  user: { readonly roles: readonly string[] },
+  registry: Registry,
+  row: { readonly slug: string; readonly kind: string },
+): boolean {
+  return !isSystemAdmin(user) && isSystemOnlyTemplate(registry, row.slug, row.kind);
+}

package/packages/bundled-features/src/template-resolver/template-validation.ts

@@ -6,8 +6,12 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { Element as ScanElement } from "happy-dom";
 import * as z from "zod";
-import { withParsedDocument } from "./document-sanitizer.js";
-import { isDocumentPlaceholderHref, isDocumentReferenceName } from "./document-schema.js";
+import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
+import {
+  DOCUMENT_CONDITION_ATTRIBUTE,
+  isDocumentPlaceholderHref,
+  isDocumentReferenceName,
+} from "./document-schema.js";
 import type { TemplateMeta } from "./template-meta.js";
 
 export const SYSTEM_PLACEHOLDERS: ReadonlySet<string> = new Set([
@@ -56,6 +60,7 @@ const scalarVariableSchema = z.discriminatedUnion("type", [
       .optional(),
   }),
   z.object({ ...variableCommon, type: z.literal("date"), example: textLikeExample }),
+  z.object({ ...variableCommon, type: z.literal("percent"), example: z.number().optional() }),
 ]);
 
 const variableDefSchema = z.union([
@@ -154,30 +159,49 @@ const NAME_ATTRIBUTE_BY_TAG: Readonly<Record<string, string>> = {
   div: "data-steps",
 };
 
+function scanRepeatRows(root: ScanElement, scope: PlaceholderScope): void {
+  for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
+    const listName = element.getAttribute("data-each") ?? "";
+    const def = Object.hasOwn(scope.variables, listName) ? scope.variables[listName] : undefined;
+    if (def?.type === "list") scope.used.add(listName);
+    else scope.unknown.add(listName);
+  }
+}
+
+function scanConditions(root: ScanElement, scope: PlaceholderScope): void {
+  for (const element of Array.from(root.querySelectorAll(`[${DOCUMENT_CONDITION_ATTRIBUTE}]`))) {
+    const itemFields = listItemFields(
+      scope.variables,
+      enclosingEachName(conditionScopeElement(element)),
+    );
+    recordName(element.getAttribute(DOCUMENT_CONDITION_ATTRIBUTE) ?? "", itemFields, scope);
+  }
+}
+
+function scanReferences(root: ScanElement, scope: PlaceholderScope): void {
+  for (const element of Array.from(
+    root.querySelectorAll("span[data-variable], div[data-steps], a[href], img[data-resource]"),
+  )) {
+    const itemFields = listItemFields(scope.variables, enclosingEachName(element));
+    const tag = element.tagName.toLowerCase();
+    const nameAttribute = NAME_ATTRIBUTE_BY_TAG[tag];
+    if (nameAttribute !== undefined) {
+      recordName(element.getAttribute(nameAttribute) ?? "", itemFields, scope);
+    } else if (tag === "a") {
+      const href = element.getAttribute("href") ?? "";
+      if (isDocumentPlaceholderHref(href)) recordName(href.slice(2, -2), itemFields, scope);
+    } else {
+      const key = element.getAttribute("data-resource") ?? "";
+      if (!scope.resourceKeys.has(key)) scope.unknownResources.add(key);
+    }
+  }
+}
+
 function scanBodyPlaceholders(body: string, scope: PlaceholderScope): void {
   withParsedDocument(body, (root) => {
-    for (const element of Array.from(root.querySelectorAll("tr[data-each]"))) {
-      const listName = element.getAttribute("data-each") ?? "";
-      const def = Object.hasOwn(scope.variables, listName) ? scope.variables[listName] : undefined;
-      if (def?.type === "list") scope.used.add(listName);
-      else scope.unknown.add(listName);
-    }
-    for (const element of Array.from(
-      root.querySelectorAll("span[data-variable], div[data-steps], a[href], img[data-resource]"),
-    )) {
-      const itemFields = listItemFields(scope.variables, enclosingEachName(element));
-      const tag = element.tagName.toLowerCase();
-      const nameAttribute = NAME_ATTRIBUTE_BY_TAG[tag];
-      if (nameAttribute !== undefined) {
-        recordName(element.getAttribute(nameAttribute) ?? "", itemFields, scope);
-      } else if (tag === "a") {
-        const href = element.getAttribute("href") ?? "";
-        if (isDocumentPlaceholderHref(href)) recordName(href.slice(2, -2), itemFields, scope);
-      } else {
-        const key = element.getAttribute("data-resource") ?? "";
-        if (!scope.resourceKeys.has(key)) scope.unknownResources.add(key);
-      }
-    }
+    scanRepeatRows(root, scope);
+    scanConditions(root, scope);
+    scanReferences(root, scope);
   });
 }
 

package/packages/bundled-features/src/template-resolver/testing.ts

@@ -3,7 +3,7 @@
 // No bun:test here — callers register cases with their own test runner.
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { seedRow } from "@cosmicdrift/kumiko-testing/helpers";
 import type { ResolveRequest, TemplateResource } from "./api.js";
 import { TemplateNotFoundError } from "./api.js";
 import {

package/packages/bundled-features/src/template-resolver/web/i18n.ts

@@ -96,6 +96,8 @@ export const defaultTranslations: TranslationsByLocale = {
       "“{detail}” templates are written through their own editor, not through a collection.",
     "templateResolver.errors.noSystemTemplate": "There is no active system template to reset to.",
     "templateResolver.errors.noDraft": "There is no draft to discard.",
+    "templateResolver.errors.systemOnlyTemplate":
+      "Only the platform maintains this template; it cannot be overridden per tenant.",
     "templateResolver.errors.template.invalidMeta": "The template settings are invalid.",
     "templateResolver.errors.template.meta.subject.required": "The subject is missing.",
     "templateResolver.errors.template.meta.subject.invalid":

package/packages/bundled-features/src/template-resolver-user-data/index.ts

@@ -8,18 +8,27 @@
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { userContentDeleteHook, userContentExportHook } from "./hooks.js";
 
-export const templateResolverUserDataFeature = defineFeature("template-resolver-user-data", (r) => {
-  r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `template-resolver` feature's `user-content-entry` entity — the per-user half of the content store (mail signatures, personal reply snippets). Mounts the EXT_USER_DATA export hook so a user's own entries land in the export bundle; the delete hook is a deliberate no-op because `content` is annotated `userOwned`, so erasure runs via crypto-shredding (destroying the owner's subject key) rather than a physical delete, which would not survive an event replay. Mount this whenever `createTemplateResolverFeature` declares a collection with `ownership: \"user\"` — the boot guard otherwise refuses the entity. Requires `user-data-rights`, optionalRequires `template-resolver`.",
+export function createTemplateResolverUserDataFeature() {
+  return defineFeature(
+    "template-resolver-user-data",
+    (r) => {
+      r.describe(
+        "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `template-resolver` feature's `user-content-entry` entity — the per-user half of the content store (mail signatures, personal reply snippets). Mounts the EXT_USER_DATA export hook so a user's own entries land in the export bundle; the delete hook is a deliberate no-op because `content` is annotated `userOwned`, so erasure runs via crypto-shredding (destroying the owner's subject key) rather than a physical delete, which would not survive an event replay. Mount this whenever `createTemplateResolverFeature` declares a collection with `ownership: \"user\"` — the boot guard otherwise refuses the entity. Requires `user-data-rights`, optionalRequires `template-resolver`.",
+      );
+      // user-data-rights is the hard dependency (EXT_USER_DATA host).
+      // template-resolver is optional for the same reason as in
+      // notes-history-user-data: a toggleable mount would otherwise trip the
+      // "effectively disabled" boot warning even though the entity is there.
+      r.requires({ features: ["user-data-rights"] });
+      r.optionalRequires("template-resolver");
+      r.useExtension(EXT_USER_DATA, "user-content-entry", {
+        export: userContentExportHook,
+        delete: userContentDeleteHook,
+      });
+    },
+    { dedupeOptions: {} },
   );
-  // user-data-rights is the hard dependency (EXT_USER_DATA host).
-  // template-resolver is optional for the same reason as in
-  // notes-history-user-data: a toggleable mount would otherwise trip the
-  // "effectively disabled" boot warning even though the entity is there.
-  r.requires({ features: ["user-data-rights"] });
-  r.optionalRequires("template-resolver");
-  r.useExtension(EXT_USER_DATA, "user-content-entry", {
-    export: userContentExportHook,
-    delete: userContentDeleteHook,
-  });
-});
+}
+
+/** @deprecated Use createTemplateResolverUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const templateResolverUserDataFeature = createTemplateResolverUserDataFeature();

package/packages/bundled-features/src/tenant/handlers/active-tenant-ids.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   SYSTEM_ROLE,

package/packages/bundled-features/src/tenant/handlers/add-member.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineWriteHandler,
   type SessionUser,

package/packages/bundled-features/src/tenant/handlers/cancel-invitation.write.ts

@@ -10,7 +10,7 @@
 // invitation = no-op + 200. Cancelling a non-existent invitation
 // = invitation_not_found.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant/handlers/invitations.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant/handlers/me.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant/handlers/member-directory.query.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,

package/packages/bundled-features/src/tenant/handlers/members.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/tenant/handlers/memberships.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/tenant/handlers/remove-member.write.ts

@@ -1,7 +1,8 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   type DbRow,
+  fetchOne,
+  selectMany,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {

package/packages/bundled-features/src/tenant/handlers/resolve-user-ids.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant/handlers/team-list.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,

package/packages/bundled-features/src/tenant/handlers/tenant-directory.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,

package/packages/bundled-features/src/tenant/handlers/update-member-roles.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, type DbRow } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, type DbRow, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   assignableAppRolesOf,

package/packages/bundled-features/src/tenant/invited-membership.ts

@@ -1,8 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  fetchOne,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -87,7 +87,7 @@ export async function grantInvitedMembershipRole(db: DbRunner, options: InvitedM
   const updateResult = await membershipExecutor.update(
     { id: existing.id, version: existing.version, changes: { roles: JSON.stringify(roles) } },
     createSystemUser(options.tenantId),
-    createTenantDb(db, options.tenantId, "system"),
+    createTenantDb({ db, tenantId: options.tenantId, mode: "system" }),
   );
   if (!updateResult.isSuccess) return updateResult;
   return grantedMembership(true, roles);

package/packages/bundled-features/src/tenant/last-tenant-admin.ts

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { TenantErrors } from "./constants.js";

package/packages/bundled-features/src/tenant/seeding.ts

@@ -28,11 +28,11 @@
 // a no-op on the second call. Memberships have no update-semantic — to
 // change roles, write a new event via the regular handler path.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   type AppContext,
@@ -48,7 +48,7 @@ import {
   createDeferringNotify,
   createLifecycleHooks,
 } from "@cosmicdrift/kumiko-framework/pipeline";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 import { assertAssignableMembershipRoles } from "./membership-roles.js";
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table.js";
 import { tenantEntity, tenantTable } from "./schema/tenant.js";
@@ -159,14 +159,14 @@ function scopeSeedHookContext(
   // afterCommit-phase hook would be dropped: that phase must notify inline.
   notifyTiming: "deferUntilCommit" | "inline",
 ): AppContext {
-  const db = createTenantDb(
-    runner,
-    targetTenantId,
-    "system",
-    context.tracer,
-    context.meter,
-    context.signal,
-  );
+  const db = createTenantDb({
+    db: runner,
+    tenantId: targetTenantId,
+    mode: "system",
+    tracer: context.tracer,
+    meter: context.meter,
+    signal: context.signal,
+  });
 
   // HandlerContext carries `user`; AppContext only `systemUser`. Prefer the
   // live handler user when present so notify/hasFeature keep a real SessionUser.
@@ -260,7 +260,7 @@ export async function seedTenant(
   // tenant-scoped ist, braucht der Wrap-Layer für die runtime-API zu
   // existieren. by.tenantId reicht — keine Override-Semantik wie bei
   // seedTenantMembership nötig.
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
 
   const existing = await fetchOne(db, tenantTable, { id: options.id });
   if (existing) return { id: options.id };
@@ -323,7 +323,7 @@ export async function seedTenantMembership(
   const by = options.by ?? createSystemUser(options.tenantId);
   // System-scoped TenantDb: payload.tenantId may differ from an explicit
   // `by` override; stream tenant still follows `by` via streamTenantFor.
-  const tdb = createTenantDb(db, options.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: options.tenantId, mode: "system" });
 
   // Idempotency: duplicate seeds are common across beforeEach-resets where
   // only certain tables get truncated. A plain executor.create would trip

package/packages/bundled-features/src/tenant-lifecycle/handlers/cancel-destruction.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant-lifecycle/handlers/request-destruction.write.ts

@@ -1,6 +1,5 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/packages/bundled-features/src/tenant-lifecycle/lib/revoke-tenant-sessions.ts

@@ -1,5 +1,5 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { userSessionTable } from "../../sessions/index.js";

package/packages/bundled-features/src/tenant-lifecycle/lifecycle-gate.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { tenantTable } from "../tenant/index.js";
 

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -1,9 +1,9 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner, TenantDb, WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEventStoreExecutor,
   createTenantDb,
+  selectMany,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -173,7 +173,7 @@ async function appendTenantStageEventIdempotent(
 
 async function markTenantDestroyFailed(db: DbRunner, tenantId: TenantId): Promise<void> {
   const user = createSystemUser(tenantId);
-  const scopedDb = createTenantDb(db, tenantId, "system");
+  const scopedDb = createTenantDb({ db, tenantId, mode: "system" });
   await tenantCrud.update(
     {
       id: tenantId,
@@ -431,7 +431,7 @@ export async function runTenantDestructionSweep(args: {
     const events = await loadAggregate(args.db, tenantId, tenantId);
     const version = lastEventVersion(events);
     const user = createSystemUser(tenantId);
-    const scopedDb = createTenantDb(args.db, tenantId, "system");
+    const scopedDb = createTenantDb({ db: args.db, tenantId, mode: "system" });
     // Version-guarded (no skipOptimisticLock): a concurrent cancel-destruction
     // between the `due` select above and this write also appends to the same
     // tenant stream, so an unguarded overwrite here would silently revert the

package/packages/bundled-features/src/tenant-lifecycle/stages.ts

@@ -1,4 +1,3 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   type SubjectId,
@@ -8,6 +7,7 @@ import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  selectMany,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -143,9 +143,14 @@ async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<StageRunOut
       log: ctx.escapeHatchAuditLog ?? createFallbackLogger("tenant-lifecycle"),
     });
     const hookCtx: TenantDataHookCtx = {
-      db: createTenantDb(ctx.db, ctx.tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: reason !== undefined ? { reason } : undefined,
-        report,
+      db: createTenantDb({
+        db: ctx.db,
+        tenantId: ctx.tenantId,
+        mode: "tenant",
+        grants: {
+          unsafeRaw: reason !== undefined ? { reason } : undefined,
+          report,
+        },
       }),
       registry: ctx.registry,
       tenantId: ctx.tenantId,
@@ -202,7 +207,7 @@ async function purgeTenantCache(ctx: DestructionStageCtx): Promise<StageRunOutco
 async function tombstoneTenantRow(ctx: DestructionStageCtx): Promise<StageRunOutcome> {
   const now = getTemporal().Now.instant();
   const user = createSystemUser(ctx.tenantId);
-  const db = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const db = createTenantDb({ db: ctx.db, tenantId: ctx.tenantId, mode: "system" });
   // Per-row forget() through the executor, not a bulk deleteMany: memberships
   // are an ES-managed projection (add/remove/update-roles all go through
   // tenantMembershipCrud), so a store table write here is eventless — a future