@cosmicdrift/kumiko-samples 0.367.0 → 0.368.0

package/packages/bundled-features/src/template-resolver/handlers/reset-to-system.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/template-resolver/handlers/resource-remove.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/template-resolver/handlers/set.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineWriteHandler,
   SYSTEM_TENANT_ID,

package/packages/bundled-features/src/template-resolver/handlers/template-write.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   type HandlerContext,
   type Registry,

package/packages/bundled-features/src/template-resolver/handlers/tenant-overrides.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";

package/packages/bundled-features/src/template-resolver/handlers/toggle-status.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineWriteHandler,
   type HandlerContext,

package/packages/bundled-features/src/template-resolver/handlers/usage.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { TEMPLATE_KINDS } from "../constants.js";

package/packages/bundled-features/src/template-resolver/handlers/validate.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   type HandlerContext,

package/packages/bundled-features/src/template-resolver/seeding.ts

@@ -9,12 +9,12 @@
 // Default ifExists="skip". The actor is `createSystemUser(SYSTEM_TENANT_ID)`,
 // deliberately not TestUsers (prod seeds are not test utilities).
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createTenantDb,
   type DbConnection,
   deleteMany,
   type EntityTableMeta,
+  fetchOne,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -89,7 +89,7 @@ export async function seedSystemTemplate(
 ): Promise<{ id: string }> {
   const tenantId = SYSTEM_TENANT_ID;
   const by = opts.by ?? createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
 
   const label = `seedSystemTemplate ${opts.slug}/${opts.kind}/${opts.locale}`;
   const slug = templateSlugSchema.safeParse(opts.slug);
@@ -379,7 +379,7 @@ export async function seedTextBlock(
   opts: SeedTextBlockOptions,
 ): Promise<{ id: string }> {
   const by = opts.by ?? createSystemUser(opts.tenantId);
-  const tdb = createTenantDb(db, opts.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
 
   const existingRow = await fetchOne<TemplateResourceRow>(db, templateResourcesTable, {
     tenantId: opts.tenantId,

package/packages/bundled-features/src/template-resolver/store-template-resource.ts

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   BeforeTransactionResult,
   ConfigAccessor,

package/packages/bundled-features/src/template-resolver/template-preview.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   HandlerContext,
   SessionUser,

package/packages/bundled-features/src/template-resolver/template-resources.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type {
   HandlerContext,
   SessionUser,

package/packages/bundled-features/src/template-resolver/testing.ts

@@ -3,7 +3,7 @@
 // No bun:test here — callers register cases with their own test runner.
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { seedRow } from "@cosmicdrift/kumiko-testing/helpers";
 import type { ResolveRequest, TemplateResource } from "./api.js";
 import { TemplateNotFoundError } from "./api.js";
 import {

package/packages/bundled-features/src/template-resolver-user-data/index.ts

@@ -8,18 +8,27 @@
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { userContentDeleteHook, userContentExportHook } from "./hooks.js";
 
-export const templateResolverUserDataFeature = defineFeature("template-resolver-user-data", (r) => {
-  r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `template-resolver` feature's `user-content-entry` entity — the per-user half of the content store (mail signatures, personal reply snippets). Mounts the EXT_USER_DATA export hook so a user's own entries land in the export bundle; the delete hook is a deliberate no-op because `content` is annotated `userOwned`, so erasure runs via crypto-shredding (destroying the owner's subject key) rather than a physical delete, which would not survive an event replay. Mount this whenever `createTemplateResolverFeature` declares a collection with `ownership: \"user\"` — the boot guard otherwise refuses the entity. Requires `user-data-rights`, optionalRequires `template-resolver`.",
+export function createTemplateResolverUserDataFeature() {
+  return defineFeature(
+    "template-resolver-user-data",
+    (r) => {
+      r.describe(
+        "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `template-resolver` feature's `user-content-entry` entity — the per-user half of the content store (mail signatures, personal reply snippets). Mounts the EXT_USER_DATA export hook so a user's own entries land in the export bundle; the delete hook is a deliberate no-op because `content` is annotated `userOwned`, so erasure runs via crypto-shredding (destroying the owner's subject key) rather than a physical delete, which would not survive an event replay. Mount this whenever `createTemplateResolverFeature` declares a collection with `ownership: \"user\"` — the boot guard otherwise refuses the entity. Requires `user-data-rights`, optionalRequires `template-resolver`.",
+      );
+      // user-data-rights is the hard dependency (EXT_USER_DATA host).
+      // template-resolver is optional for the same reason as in
+      // notes-history-user-data: a toggleable mount would otherwise trip the
+      // "effectively disabled" boot warning even though the entity is there.
+      r.requires({ features: ["user-data-rights"] });
+      r.optionalRequires("template-resolver");
+      r.useExtension(EXT_USER_DATA, "user-content-entry", {
+        export: userContentExportHook,
+        delete: userContentDeleteHook,
+      });
+    },
+    { dedupeOptions: {} },
   );
-  // user-data-rights is the hard dependency (EXT_USER_DATA host).
-  // template-resolver is optional for the same reason as in
-  // notes-history-user-data: a toggleable mount would otherwise trip the
-  // "effectively disabled" boot warning even though the entity is there.
-  r.requires({ features: ["user-data-rights"] });
-  r.optionalRequires("template-resolver");
-  r.useExtension(EXT_USER_DATA, "user-content-entry", {
-    export: userContentExportHook,
-    delete: userContentDeleteHook,
-  });
-});
+}
+
+/** @deprecated Use createTemplateResolverUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const templateResolverUserDataFeature = createTemplateResolverUserDataFeature();

package/packages/bundled-features/src/tenant/handlers/active-tenant-ids.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   SYSTEM_ROLE,

package/packages/bundled-features/src/tenant/handlers/add-member.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineWriteHandler,
   type SessionUser,

package/packages/bundled-features/src/tenant/handlers/cancel-invitation.write.ts

@@ -10,7 +10,7 @@
 // invitation = no-op + 200. Cancelling a non-existent invitation
 // = invitation_not_found.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant/handlers/invitations.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant/handlers/me.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant/handlers/member-directory.query.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,

package/packages/bundled-features/src/tenant/handlers/members.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/tenant/handlers/memberships.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/tenant/handlers/remove-member.write.ts

@@ -1,7 +1,8 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   type DbRow,
+  fetchOne,
+  selectMany,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {

package/packages/bundled-features/src/tenant/handlers/resolve-user-ids.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, SYSTEM_ROLE } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant/handlers/team-list.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,

package/packages/bundled-features/src/tenant/handlers/tenant-directory.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   definePagedQueryHandler,

package/packages/bundled-features/src/tenant/handlers/update-member-roles.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, type DbRow } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, type DbRow, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   assignableAppRolesOf,

package/packages/bundled-features/src/tenant/invited-membership.ts

@@ -1,8 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  fetchOne,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
@@ -87,7 +87,7 @@ export async function grantInvitedMembershipRole(db: DbRunner, options: InvitedM
   const updateResult = await membershipExecutor.update(
     { id: existing.id, version: existing.version, changes: { roles: JSON.stringify(roles) } },
     createSystemUser(options.tenantId),
-    createTenantDb(db, options.tenantId, "system"),
+    createTenantDb({ db, tenantId: options.tenantId, mode: "system" }),
   );
   if (!updateResult.isSuccess) return updateResult;
   return grantedMembership(true, roles);

package/packages/bundled-features/src/tenant/last-tenant-admin.ts

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { TenantErrors } from "./constants.js";

package/packages/bundled-features/src/tenant/seeding.ts

@@ -28,11 +28,11 @@
 // a no-op on the second call. Memberships have no update-semantic — to
 // change roles, write a new event via the regular handler path.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   type AppContext,
@@ -48,7 +48,7 @@ import {
   createDeferringNotify,
   createLifecycleHooks,
 } from "@cosmicdrift/kumiko-framework/pipeline";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 import { assertAssignableMembershipRoles } from "./membership-roles.js";
 import { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table.js";
 import { tenantEntity, tenantTable } from "./schema/tenant.js";
@@ -159,14 +159,14 @@ function scopeSeedHookContext(
   // afterCommit-phase hook would be dropped: that phase must notify inline.
   notifyTiming: "deferUntilCommit" | "inline",
 ): AppContext {
-  const db = createTenantDb(
-    runner,
-    targetTenantId,
-    "system",
-    context.tracer,
-    context.meter,
-    context.signal,
-  );
+  const db = createTenantDb({
+    db: runner,
+    tenantId: targetTenantId,
+    mode: "system",
+    tracer: context.tracer,
+    meter: context.meter,
+    signal: context.signal,
+  });
 
   // HandlerContext carries `user`; AppContext only `systemUser`. Prefer the
   // live handler user when present so notify/hasFeature keep a real SessionUser.
@@ -260,7 +260,7 @@ export async function seedTenant(
   // tenant-scoped ist, braucht der Wrap-Layer für die runtime-API zu
   // existieren. by.tenantId reicht — keine Override-Semantik wie bei
   // seedTenantMembership nötig.
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
 
   const existing = await fetchOne(db, tenantTable, { id: options.id });
   if (existing) return { id: options.id };
@@ -323,7 +323,7 @@ export async function seedTenantMembership(
   const by = options.by ?? createSystemUser(options.tenantId);
   // System-scoped TenantDb: payload.tenantId may differ from an explicit
   // `by` override; stream tenant still follows `by` via streamTenantFor.
-  const tdb = createTenantDb(db, options.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: options.tenantId, mode: "system" });
 
   // Idempotency: duplicate seeds are common across beforeEach-resets where
   // only certain tables get truncated. A plain executor.create would trip

package/packages/bundled-features/src/tenant-lifecycle/handlers/cancel-destruction.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/tenant-lifecycle/handlers/request-destruction.write.ts

@@ -1,6 +1,5 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/packages/bundled-features/src/tenant-lifecycle/lib/revoke-tenant-sessions.ts

@@ -1,5 +1,5 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { userSessionTable } from "../../sessions/index.js";

package/packages/bundled-features/src/tenant-lifecycle/lifecycle-gate.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { tenantTable } from "../tenant/index.js";
 

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -1,9 +1,9 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner, TenantDb, WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEventStoreExecutor,
   createTenantDb,
+  selectMany,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -173,7 +173,7 @@ async function appendTenantStageEventIdempotent(
 
 async function markTenantDestroyFailed(db: DbRunner, tenantId: TenantId): Promise<void> {
   const user = createSystemUser(tenantId);
-  const scopedDb = createTenantDb(db, tenantId, "system");
+  const scopedDb = createTenantDb({ db, tenantId, mode: "system" });
   await tenantCrud.update(
     {
       id: tenantId,
@@ -431,7 +431,7 @@ export async function runTenantDestructionSweep(args: {
     const events = await loadAggregate(args.db, tenantId, tenantId);
     const version = lastEventVersion(events);
     const user = createSystemUser(tenantId);
-    const scopedDb = createTenantDb(args.db, tenantId, "system");
+    const scopedDb = createTenantDb({ db: args.db, tenantId, mode: "system" });
     // Version-guarded (no skipOptimisticLock): a concurrent cancel-destruction
     // between the `due` select above and this write also appends to the same
     // tenant stream, so an unguarded overwrite here would silently revert the

package/packages/bundled-features/src/tenant-lifecycle/stages.ts

@@ -1,4 +1,3 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   type SubjectId,
@@ -8,6 +7,7 @@ import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  selectMany,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -143,9 +143,14 @@ async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<StageRunOut
       log: ctx.escapeHatchAuditLog ?? createFallbackLogger("tenant-lifecycle"),
     });
     const hookCtx: TenantDataHookCtx = {
-      db: createTenantDb(ctx.db, ctx.tenantId, "tenant", undefined, undefined, undefined, {
-        unsafeRaw: reason !== undefined ? { reason } : undefined,
-        report,
+      db: createTenantDb({
+        db: ctx.db,
+        tenantId: ctx.tenantId,
+        mode: "tenant",
+        grants: {
+          unsafeRaw: reason !== undefined ? { reason } : undefined,
+          report,
+        },
       }),
       registry: ctx.registry,
       tenantId: ctx.tenantId,
@@ -202,7 +207,7 @@ async function purgeTenantCache(ctx: DestructionStageCtx): Promise<StageRunOutco
 async function tombstoneTenantRow(ctx: DestructionStageCtx): Promise<StageRunOutcome> {
   const now = getTemporal().Now.instant();
   const user = createSystemUser(ctx.tenantId);
-  const db = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const db = createTenantDb({ db: ctx.db, tenantId: ctx.tenantId, mode: "system" });
   // Per-row forget() through the executor, not a bulk deleteMany: memberships
   // are an ES-managed projection (add/remove/update-roles all go through
   // tenantMembershipCrud), so a store table write here is eventless — a future

package/packages/bundled-features/src/tenant-lifecycle/testing.ts

@@ -1,11 +1,11 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { append, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
 import type { SearchAdapter } from "@cosmicdrift/kumiko-framework/search";
-import type { TestStack } from "@cosmicdrift/kumiko-framework/stack";
-import { updateRows } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { updateRows } from "@cosmicdrift/kumiko-testing/helpers";
+import type { TestStack } from "@cosmicdrift/kumiko-testing/stack";
 import { tenantTable } from "../tenant/index.js";
 import { TENANT_AGGREGATE_TYPE, TENANT_DESTRUCTION_STARTED_EVENT_QN } from "./constants.js";
 import { runTenantDestructionSweep } from "./run-tenant-destroy.js";

package/packages/bundled-features/src/tenant-settings/feature.ts

@@ -21,35 +21,40 @@ export type TenantSettingsFeatureOptions = TenantSettingsKeyOptions;
 export function createTenantSettingsFeature(
   opts: TenantSettingsFeatureOptions = {},
 ): FeatureDefinition {
-  return defineFeature(TENANT_SETTINGS_FEATURE_NAME, (r) => {
-    r.requires({ features: ["config"] });
-    r.describe(
-      "Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.",
-    );
-    r.config({ keys: buildTenantSettingsKeys(opts) });
-    r.translations({
-      keys: {
-        "tenant-settings.currency": { en: "Default currency" },
-        "tenant-settings.locale": { en: "Default locale" },
-        // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
-        // required by the i18n boot-validator whenever a feature masks config keys.
-        "screen:tenant-settings-system.title": { en: "Tenant defaults" },
-        "screen:tenant-settings-tenant.title": { en: "Tenant settings" },
-        // Settings-Hub nav label + configEdit section heading (same key, both
-        // scopes fall back here — see buildConfigFeatureSchema).
-        "tenant-settings.settings": { en: "Tenant settings" },
-        // Section heading below the page title (the page title is the same words as
-        // `.settings`, which RenderEdit would drop as a repeat).
-        "tenant-settings.settings.section": { en: "Currency and language" },
-        // Both currency/locale are tenant-home with admin write access, which
-        // cascades a SystemAdmin-only "set the platform default" screen up to
-        // the system audience — scoped override so its nav entry reads
-        // differently from the tenant-home entry instead of repeating the
-        // same words under both "Platform" and "Organization".
-        "tenant-settings.settings.system": { en: "Tenant defaults" },
-      },
-    });
-  });
+  return defineFeature(
+    TENANT_SETTINGS_FEATURE_NAME,
+    (r) => {
+      r.requires({ features: ["config"] });
+      r.describe(
+        "Per-tenant Currency + Locale defaults, exposed as two config keys (tenant-settings:config:currency, tenant-settings:config:locale) that surface in the self-populating Settings-Hub via `mask`. Pair with defineCreateWithTenantDefaults to auto-fill a money field's currency or a locale field on create instead of hard-coding a literal per entity.",
+      );
+      r.config({ keys: buildTenantSettingsKeys(opts) });
+      r.translations({
+        keys: {
+          "tenant-settings.currency": { en: "Default currency" },
+          "tenant-settings.locale": { en: "Default locale" },
+          // Settings-Hub-derived configEdit screen title (buildConfigFeatureSchema) —
+          // required by the i18n boot-validator whenever a feature masks config keys.
+          "screen:tenant-settings-system.title": { en: "Tenant defaults" },
+          "screen:tenant-settings-tenant.title": { en: "Tenant settings" },
+          // Settings-Hub nav label + configEdit section heading (same key, both
+          // scopes fall back here — see buildConfigFeatureSchema).
+          "tenant-settings.settings": { en: "Tenant settings" },
+          // Section heading below the page title (the page title is the same words as
+          // `.settings`, which RenderEdit would drop as a repeat).
+          "tenant-settings.settings.section": { en: "Currency and language" },
+          // Both currency/locale are tenant-home with admin write access, which
+          // cascades a SystemAdmin-only "set the platform default" screen up to
+          // the system audience — scoped override so its nav entry reads
+          // differently from the tenant-home entry instead of repeating the
+          // same words under both "Platform" and "Organization".
+          "tenant-settings.settings.system": { en: "Tenant defaults" },
+        },
+      });
+    },
+    Object.keys(opts).length === 0 ? { dedupeOptions: {} } : undefined,
+  );
 }
 
+/** @deprecated Use createTenantSettingsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export const tenantSettingsFeature: FeatureDefinition = createTenantSettingsFeature();