@cosmicdrift/kumiko-samples 0.366.0 → 0.368.0

package/packages/bundled-features/src/tier-engine/handlers/get-tenant-tier.query.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createTenantDb, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
@@ -25,7 +24,7 @@ export const getTenantTierQuery = defineQueryHandler({
   },
   handler: async (query, ctx) => {
     const tenantId = query.payload.tenantId as TenantId; // @cast-boundary engine-bridge
-    const tdb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+    const tdb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
     const row = await fetchOne<TierAssignmentRow>(tdb, tierAssignmentTable, { tenantId });
     return row ?? null;
   },

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -1,5 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  buildEntityTable,
+  createEventStoreExecutor,
+  fetchOne,
+} from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";

package/packages/bundled-features/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Soft-deleted users no longer count as active principals",
+    "detail": "A user deleted through the entity executor keeps its last status (usually active) with isDeleted set. principalStatusPlugin, the session checker and the PAT role resolver only looked at the status, so existing sessions and tokens of such a user stayed valid. They now treat isDeleted as blocked (session \"blocked\", PAT 401, principal_blocked for membership resolution) through the new isPrincipalRowBlocked predicate."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/user/db/queries/stream-tenant-backfill.ts

@@ -24,8 +24,8 @@
 // the stream move: rebuildProjection("user:projection:user-entity", ...) or
 // the jobs:job:projection-rebuild job.
 
-import { asRawClient, transaction, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { asRawClient, transaction, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 
 export type UserStreamBackfillResult = {

package/packages/bundled-features/src/user/handlers/create.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineWriteHandler,
   findForbiddenRoleAssignment,

package/packages/bundled-features/src/user/handlers/find-for-auth.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/user/handlers/list.query.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   defineEntityListHandler,

package/packages/bundled-features/src/user/handlers/update-roles.ts

@@ -1,8 +1,9 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   acquireNamespacedAdvisoryLock,
   createEventStoreExecutor,
   type DbRunner,
+  fetchOne,
+  selectMany,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {

package/packages/bundled-features/src/user/index.ts

@@ -5,7 +5,11 @@ export {
   type UserStreamBackfillResult,
 } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
-export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export {
+  isPrincipalBlocked,
+  isPrincipalRowBlocked,
+  principalStatusPlugin,
+} from "./principal-status.js";
 export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export type { UserStatus } from "./schema/user.js";
 export {

package/packages/bundled-features/src/user/invited-global-roles.ts

@@ -1,8 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -45,7 +45,7 @@ export async function grantInvitedGlobalRoles(
   const updateResult = await userExecutor.update(
     { id: existing.id, version: existing.version, changes: { roles } },
     createSystemUser(SYSTEM_TENANT_ID),
-    createTenantDb(db, SYSTEM_TENANT_ID, "system"),
+    createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" }),
   );
   if (!updateResult.isSuccess) return updateResult;
   return grantedGlobalRoles(roles);

package/packages/bundled-features/src/user/principal-status.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type {
   PrincipalProfile,
   PrincipalStatus,
@@ -20,13 +20,23 @@ export function isPrincipalBlocked(status: UserStatus): boolean {
   return BLOCKED_STATUSES.has(status);
 }
 
+// A soft-deleted row (executor.delete) keeps its last status, so isDeleted must block on its own.
+export function isPrincipalRowBlocked(row: {
+  readonly status: UserStatus;
+  readonly isDeleted: boolean;
+}): boolean {
+  return row.isDeleted || isPrincipalBlocked(row.status);
+}
+
 // Registered via r.useExtension(EXT_PRINCIPAL_STATUS, "user", principalStatusPlugin)
 // so resolveActiveMembershipFn can reject a blocked principal without knowing about `user`'s table.
 export const principalStatusPlugin: PrincipalStatusPlugin = {
   async resolveStatus(userId, { db }): Promise<PrincipalStatus> {
-    const row = await fetchOne<{ status: UserStatus }>(db, userTable, { id: userId });
+    const row = await fetchOne<{ status: UserStatus; isDeleted: boolean }>(db, userTable, {
+      id: userId,
+    });
     if (!row) return "unknown";
-    return isPrincipalBlocked(row.status) ? "blocked" : "active";
+    return isPrincipalRowBlocked(row) ? "blocked" : "active";
   },
 
   // ctx.queryAsMember's global-roles/timezone/locale source — same fields

package/packages/bundled-features/src/user/resolve-display-names.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
 import { userTable } from "./schema/user.js";
 

package/packages/bundled-features/src/user/seeding.ts

@@ -10,15 +10,15 @@
 // (audit, search-index) sehen den Seed. Der Executor-Pfad emittiert
 // das Event UND schreibt die Projection-Zeile in einer TX.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbConnection,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 // kumiko-lint-ignore cross-feature-import shares the postSave-hooks fixture contract with tenant/seeding (#1478)
 import { fireEntityPostSave, type SeedTenantHooks } from "../tenant/seeding.js";
 import { userEntity, userTable } from "./schema/user.js";
@@ -65,7 +65,7 @@ export async function seedUser(
   // executor.create erwartet eine TenantDb (mit .insert()-API). User
   // ist zwar tenant-agnostic (kein tenant_id-Spalte), aber das runtime-
   // Interface braucht den Wrap.
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
 
   const existing = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
@@ -111,7 +111,7 @@ export async function reconcileSeededUserEmailVerified(
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
   // liefert die Projection-Row als Record<string, unknown>.
   const id = existingRow["id"] as string;
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
   const result = await userExecutor.update(
     { id, version: existingRow["version"] as number, changes: { emailVerified: true } },
     by,
@@ -157,7 +157,7 @@ export async function rewriteSeededUserEmail(
     // skip: the stored blind index already matches, a rewrite would only append a no-op event.
     if (indexed) return;
   }
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
   const result = await userExecutor.update({ id, version, changes: { email } }, by, tdb);
   // version_conflict: a concurrent write already changed the row — fine for a seed helper.
   // unique_violation: a duplicate row already holds the blind index; the repair

package/packages/bundled-features/src/user-data-rights/audit-download.ts

@@ -54,7 +54,7 @@ export interface RecordDownloadUseArgs {
 export async function recordDownloadUse(args: RecordDownloadUseArgs): Promise<void> {
   const { db, tokenId, tokenVersion, tokenUseCount, tenantId, now, ip, userAgent } = args;
   const executor = createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
 
   await tokenCrud
     .update(
@@ -103,7 +103,7 @@ export interface RecordInvalidAttemptArgs {
 export async function recordInvalidAttempt(args: RecordInvalidAttemptArgs): Promise<void> {
   const { db, tenantId, now } = args;
   const executor = createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
   await attemptCrud
     .create(
       {

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Tests seed tenant memberships and events through the framework",
+    "detail": "Test-only change. Integration tests create read_tenant_memberships from tenantMembershipEntity and seed rows with seedRow instead of hand-written DDL and raw INSERTs. Fake events go through the event-store append, and backdated audit events are written with runSeedWritesAt instead of an UPDATE on created_at. No runtime behavior changes."
+  },
   {
     "version": "0.365.0",
     "type": "improvement",

package/packages/bundled-features/src/user-data-rights/db/queries/export-jobs.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { exportJobsTable } from "../../schema/export-job.js";

package/packages/bundled-features/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 

package/packages/bundled-features/src/user-data-rights/handlers/download-by-job.query.ts

@@ -24,7 +24,7 @@
 //   7. Return {url, expiresAt}
 
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   SYSTEM_USER_ID,

package/packages/bundled-features/src/user-data-rights/handlers/download-by-token.query.ts

@@ -26,7 +26,7 @@
 // signedUrl — User klickt 1× Email-Link, Browser folgt redirect, Download
 // startet. Dieser query-handler liefert nur das JSON.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   SYSTEM_USER_ID,

package/packages/bundled-features/src/user-data-rights/handlers/export-status.query.ts

@@ -11,7 +11,7 @@
 // **Read-Only-Endpoint:** Pollt nur, kein State-Flip. Idempotent + cache-
 // fest. UI poll-Intervall typisch 2-5s waehrend running.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";

package/packages/bundled-features/src/user-data-rights/handlers/list-download-attempts.query.ts

@@ -1,4 +1,4 @@
-import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";

package/packages/bundled-features/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -1,4 +1,4 @@
-import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/packages/bundled-features/src/user-data-rights/handlers/request-export.write.ts

@@ -20,8 +20,7 @@
 // 1. Klick — Worker liest sein Compliance-Profile aus DIESEM Tenant
 // fuer Job-TTL/Stale/Cleanup.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SaveContext } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/packages/bundled-features/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -11,7 +11,7 @@
 // Rueckgabe: Stats fuer Operator-Monitoring (processed-count, error-list).
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { access, defineWriteHandler, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
@@ -58,7 +58,7 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
         registry: ctx.registry,
         configResolver: ctx.configResolver,
         db: forgetDb,
-        userId: ctx._userId ?? SYSTEM_USER_ID,
+        userId: ctx.user.id,
       });
       const result = await runForgetCleanup({
         db: runner,
@@ -71,7 +71,7 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
           configResolver: ctx.configResolver,
           secrets: ctx.secrets,
           db: forgetDb,
-          userId: ctx._userId ?? SYSTEM_USER_ID,
+          userId: ctx.user.id,
           handlerName: "user-data-rights:run-forget-cleanup",
         }),
         ...(opts.sendDeletionExecutedEmail && {

package/packages/bundled-features/src/user-data-rights/lib/deny-if-target-outside-admin-tenant.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   AccessDeniedError,

package/packages/bundled-features/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -1,8 +1,8 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEventStoreExecutor,
   createTenantDb,
+  selectMany,
   type WritePurpose,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
@@ -34,6 +34,10 @@ export type UpdateUserLifecycleOptions = {
   // Erasure flows run after the subject key is erased; the write then stores the
   // erased sentinel instead of failing on re-encrypt.
   readonly writePurpose?: WritePurpose;
+  // Also address a row the stream has already soft-deleted. Only erasure needs
+  // this: a deleted stream with a still-`active` status must still get its
+  // status event so the login door closes.
+  readonly includeDeleted?: boolean;
 };
 
 // `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
@@ -61,7 +65,7 @@ export async function updateUserLifecycle(
   // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
   // version to pass as `payload.version`, which update() requires otherwise.
   // Callers needing a guard use `options.expect` instead.
-  const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
+  const tenantDb = createTenantDb({ db: conn, tenantId: SYSTEM_TENANT_ID, mode: "system" });
   const result = await userExecutor.update(
     { id: userId, changes },
     createSystemUser(SYSTEM_TENANT_ID),
@@ -70,6 +74,7 @@ export async function updateUserLifecycle(
       skipOptimisticLock: true,
       ...(options?.expect && { expect: options.expect }),
       ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+      ...(options?.includeDeleted && { includeDeleted: true }),
     },
   );
 

package/packages/bundled-features/src/user-data-rights/run-export-jobs.ts

@@ -45,11 +45,15 @@ import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 // (`expiresAt + exportStorageCleanupGraceHours < now`) — abgelaufene ZIPs
 // auf S3 sollen nicht ewig liegen.
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  fetchOne,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/db";
 import type {
   EscapeHatchAuditSink,
   Registry,
@@ -811,7 +815,7 @@ function reportCleanupLastRun(metrics: MetricsHandle | undefined, now: Instant):
 // Stream-Counter konsistent bleibt (Memory feedback_event_store_tenant_consistency).
 // @wrapper-known semantic-alias
 function systemTenantDb(db: DbConnection, tenantId: TenantId) {
-  return createTenantDb(db, tenantId, "system");
+  return createTenantDb({ db, tenantId, mode: "system" });
 }
 
 function buildExportStorageKey(job: JobRow): string {

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -35,7 +35,6 @@ import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework
 // gefailten Hooks bleibt im DeletionRequested-Status (next Lauf
 // retried automatisch).
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   type KmsAdapter,
@@ -46,7 +45,9 @@ import {
   type DbRunner,
   entityEventName,
   executeRawQuery,
+  fetchOne,
   nullBlindIndexesForSubject,
+  selectMany,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -225,10 +226,15 @@ function buildHookDb(
     sink: args.escapeHatchAuditSink,
     log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
   });
-  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-    unsafeRaw:
-      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-    report,
+  return createTenantDb({
+    db,
+    tenantId,
+    mode: "tenant",
+    grants: {
+      unsafeRaw:
+        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+      report,
+    },
   });
 }
 

package/packages/bundled-features/src/user-data-rights/run-user-export.ts

@@ -21,7 +21,6 @@ import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework
 // landen. user-data-rights-defaults/hooks/user.userdata-hook expose
 // expliziert KEIN passwordHash + KEINE roles (privileged columns).
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
@@ -33,6 +32,7 @@ import {
   configuredEntityFieldEncryption,
   createTenantDb,
   decryptEntityFieldValues,
+  selectMany,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   type EscapeHatchAuditSink,
@@ -121,10 +121,15 @@ function buildHookDb(
     sink: args.escapeHatchAuditSink,
     log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
   });
-  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-    unsafeRaw:
-      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-    report,
+  return createTenantDb({
+    db,
+    tenantId,
+    mode: "tenant",
+    grants: {
+      unsafeRaw:
+        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+      report,
+    },
   });
 }
 

package/packages/bundled-features/src/waitlist/handlers/invite.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,

package/packages/bundled-features/src/waitlist/handlers/reject.write.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,

package/packages/bundled-features/src/waitlist/lib.ts

@@ -1,5 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  fetchOne,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createSystemUser,

package/packages/bundled-features/src/workflow-runner/event-subscriber.ts

@@ -24,7 +24,7 @@
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
 
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   FeatureRegistrar,
   MultiStreamApplyFn,