@cosmicdrift/kumiko-samples 0.367.0 → 0.368.0

package/packages/bundled-features/src/tier-engine/handlers/get-tenant-tier.query.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createTenantDb, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
@@ -25,7 +24,7 @@ export const getTenantTierQuery = defineQueryHandler({
   },
   handler: async (query, ctx) => {
     const tenantId = query.payload.tenantId as TenantId; // @cast-boundary engine-bridge
-    const tdb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+    const tdb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
     const row = await fetchOne<TierAssignmentRow>(tdb, tierAssignmentTable, { tenantId });
     return row ?? null;
   },

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -1,5 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  buildEntityTable,
+  createEventStoreExecutor,
+  fetchOne,
+} from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";

package/packages/bundled-features/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Soft-deleted users no longer count as active principals",
+    "detail": "A user deleted through the entity executor keeps its last status (usually active) with isDeleted set. principalStatusPlugin, the session checker and the PAT role resolver only looked at the status, so existing sessions and tokens of such a user stayed valid. They now treat isDeleted as blocked (session \"blocked\", PAT 401, principal_blocked for membership resolution) through the new isPrincipalRowBlocked predicate."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/user/db/queries/stream-tenant-backfill.ts

@@ -24,8 +24,8 @@
 // the stream move: rebuildProjection("user:projection:user-entity", ...) or
 // the jobs:job:projection-rebuild job.
 
-import { asRawClient, transaction, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { asRawClient, transaction, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 
 export type UserStreamBackfillResult = {

package/packages/bundled-features/src/user/handlers/create.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineWriteHandler,
   findForbiddenRoleAssignment,

package/packages/bundled-features/src/user/handlers/find-for-auth.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/user/handlers/list.query.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   defineEntityListHandler,

package/packages/bundled-features/src/user/handlers/update-roles.ts

@@ -1,8 +1,9 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   acquireNamespacedAdvisoryLock,
   createEventStoreExecutor,
   type DbRunner,
+  fetchOne,
+  selectMany,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {

package/packages/bundled-features/src/user/index.ts

@@ -5,7 +5,11 @@ export {
   type UserStreamBackfillResult,
 } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
-export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export {
+  isPrincipalBlocked,
+  isPrincipalRowBlocked,
+  principalStatusPlugin,
+} from "./principal-status.js";
 export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export type { UserStatus } from "./schema/user.js";
 export {

package/packages/bundled-features/src/user/invited-global-roles.ts

@@ -1,8 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -45,7 +45,7 @@ export async function grantInvitedGlobalRoles(
   const updateResult = await userExecutor.update(
     { id: existing.id, version: existing.version, changes: { roles } },
     createSystemUser(SYSTEM_TENANT_ID),
-    createTenantDb(db, SYSTEM_TENANT_ID, "system"),
+    createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" }),
   );
   if (!updateResult.isSuccess) return updateResult;
   return grantedGlobalRoles(roles);

package/packages/bundled-features/src/user/principal-status.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type {
   PrincipalProfile,
   PrincipalStatus,
@@ -20,13 +20,23 @@ export function isPrincipalBlocked(status: UserStatus): boolean {
   return BLOCKED_STATUSES.has(status);
 }
 
+// A soft-deleted row (executor.delete) keeps its last status, so isDeleted must block on its own.
+export function isPrincipalRowBlocked(row: {
+  readonly status: UserStatus;
+  readonly isDeleted: boolean;
+}): boolean {
+  return row.isDeleted || isPrincipalBlocked(row.status);
+}
+
 // Registered via r.useExtension(EXT_PRINCIPAL_STATUS, "user", principalStatusPlugin)
 // so resolveActiveMembershipFn can reject a blocked principal without knowing about `user`'s table.
 export const principalStatusPlugin: PrincipalStatusPlugin = {
   async resolveStatus(userId, { db }): Promise<PrincipalStatus> {
-    const row = await fetchOne<{ status: UserStatus }>(db, userTable, { id: userId });
+    const row = await fetchOne<{ status: UserStatus; isDeleted: boolean }>(db, userTable, {
+      id: userId,
+    });
     if (!row) return "unknown";
-    return isPrincipalBlocked(row.status) ? "blocked" : "active";
+    return isPrincipalRowBlocked(row) ? "blocked" : "active";
   },
 
   // ctx.queryAsMember's global-roles/timezone/locale source — same fields

package/packages/bundled-features/src/user/resolve-display-names.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
 import { userTable } from "./schema/user.js";
 

package/packages/bundled-features/src/user/seeding.ts

@@ -10,15 +10,15 @@
 // (audit, search-index) sehen den Seed. Der Executor-Pfad emittiert
 // das Event UND schreibt die Projection-Zeile in einer TX.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbConnection,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 // kumiko-lint-ignore cross-feature-import shares the postSave-hooks fixture contract with tenant/seeding (#1478)
 import { fireEntityPostSave, type SeedTenantHooks } from "../tenant/seeding.js";
 import { userEntity, userTable } from "./schema/user.js";
@@ -65,7 +65,7 @@ export async function seedUser(
   // executor.create erwartet eine TenantDb (mit .insert()-API). User
   // ist zwar tenant-agnostic (kein tenant_id-Spalte), aber das runtime-
   // Interface braucht den Wrap.
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
 
   const existing = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
@@ -111,7 +111,7 @@ export async function reconcileSeededUserEmailVerified(
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
   // liefert die Projection-Row als Record<string, unknown>.
   const id = existingRow["id"] as string;
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
   const result = await userExecutor.update(
     { id, version: existingRow["version"] as number, changes: { emailVerified: true } },
     by,
@@ -157,7 +157,7 @@ export async function rewriteSeededUserEmail(
     // skip: the stored blind index already matches, a rewrite would only append a no-op event.
     if (indexed) return;
   }
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
   const result = await userExecutor.update({ id, version, changes: { email } }, by, tdb);
   // version_conflict: a concurrent write already changed the row — fine for a seed helper.
   // unique_violation: a duplicate row already holds the blind index; the repair

package/packages/bundled-features/src/user-data-rights/audit-download.ts

@@ -54,7 +54,7 @@ export interface RecordDownloadUseArgs {
 export async function recordDownloadUse(args: RecordDownloadUseArgs): Promise<void> {
   const { db, tokenId, tokenVersion, tokenUseCount, tenantId, now, ip, userAgent } = args;
   const executor = createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
 
   await tokenCrud
     .update(
@@ -103,7 +103,7 @@ export interface RecordInvalidAttemptArgs {
 export async function recordInvalidAttempt(args: RecordInvalidAttemptArgs): Promise<void> {
   const { db, tenantId, now } = args;
   const executor = createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
   await attemptCrud
     .create(
       {

package/packages/bundled-features/src/user-data-rights/db/queries/export-jobs.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { exportJobsTable } from "../../schema/export-job.js";

package/packages/bundled-features/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 

package/packages/bundled-features/src/user-data-rights/handlers/download-by-job.query.ts

@@ -24,7 +24,7 @@
 //   7. Return {url, expiresAt}
 
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   SYSTEM_USER_ID,

package/packages/bundled-features/src/user-data-rights/handlers/download-by-token.query.ts

@@ -26,7 +26,7 @@
 // signedUrl — User klickt 1× Email-Link, Browser folgt redirect, Download
 // startet. Dieser query-handler liefert nur das JSON.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   SYSTEM_USER_ID,

package/packages/bundled-features/src/user-data-rights/handlers/export-status.query.ts

@@ -11,7 +11,7 @@
 // **Read-Only-Endpoint:** Pollt nur, kein State-Flip. Idempotent + cache-
 // fest. UI poll-Intervall typisch 2-5s waehrend running.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";

package/packages/bundled-features/src/user-data-rights/handlers/list-download-attempts.query.ts

@@ -1,4 +1,4 @@
-import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";

package/packages/bundled-features/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -1,4 +1,4 @@
-import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/packages/bundled-features/src/user-data-rights/handlers/request-export.write.ts

@@ -20,8 +20,7 @@
 // 1. Klick — Worker liest sein Compliance-Profile aus DIESEM Tenant
 // fuer Job-TTL/Stale/Cleanup.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SaveContext } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/packages/bundled-features/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -11,7 +11,7 @@
 // Rueckgabe: Stats fuer Operator-Monitoring (processed-count, error-list).
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { access, defineWriteHandler, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
@@ -58,7 +58,7 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
         registry: ctx.registry,
         configResolver: ctx.configResolver,
         db: forgetDb,
-        userId: ctx._userId ?? SYSTEM_USER_ID,
+        userId: ctx.user.id,
       });
       const result = await runForgetCleanup({
         db: runner,
@@ -71,7 +71,7 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
           configResolver: ctx.configResolver,
           secrets: ctx.secrets,
           db: forgetDb,
-          userId: ctx._userId ?? SYSTEM_USER_ID,
+          userId: ctx.user.id,
           handlerName: "user-data-rights:run-forget-cleanup",
         }),
         ...(opts.sendDeletionExecutedEmail && {

package/packages/bundled-features/src/user-data-rights/lib/deny-if-target-outside-admin-tenant.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   AccessDeniedError,

package/packages/bundled-features/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -1,8 +1,8 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEventStoreExecutor,
   createTenantDb,
+  selectMany,
   type WritePurpose,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
@@ -34,6 +34,10 @@ export type UpdateUserLifecycleOptions = {
   // Erasure flows run after the subject key is erased; the write then stores the
   // erased sentinel instead of failing on re-encrypt.
   readonly writePurpose?: WritePurpose;
+  // Also address a row the stream has already soft-deleted. Only erasure needs
+  // this: a deleted stream with a still-`active` status must still get its
+  // status event so the login door closes.
+  readonly includeDeleted?: boolean;
 };
 
 // `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
@@ -61,7 +65,7 @@ export async function updateUserLifecycle(
   // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
   // version to pass as `payload.version`, which update() requires otherwise.
   // Callers needing a guard use `options.expect` instead.
-  const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
+  const tenantDb = createTenantDb({ db: conn, tenantId: SYSTEM_TENANT_ID, mode: "system" });
   const result = await userExecutor.update(
     { id: userId, changes },
     createSystemUser(SYSTEM_TENANT_ID),
@@ -70,6 +74,7 @@ export async function updateUserLifecycle(
       skipOptimisticLock: true,
       ...(options?.expect && { expect: options.expect }),
       ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+      ...(options?.includeDeleted && { includeDeleted: true }),
     },
   );
 

package/packages/bundled-features/src/user-data-rights/run-export-jobs.ts

@@ -45,11 +45,15 @@ import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 // (`expiresAt + exportStorageCleanupGraceHours < now`) — abgelaufene ZIPs
 // auf S3 sollen nicht ewig liegen.
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  fetchOne,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/db";
 import type {
   EscapeHatchAuditSink,
   Registry,
@@ -811,7 +815,7 @@ function reportCleanupLastRun(metrics: MetricsHandle | undefined, now: Instant):
 // Stream-Counter konsistent bleibt (Memory feedback_event_store_tenant_consistency).
 // @wrapper-known semantic-alias
 function systemTenantDb(db: DbConnection, tenantId: TenantId) {
-  return createTenantDb(db, tenantId, "system");
+  return createTenantDb({ db, tenantId, mode: "system" });
 }
 
 function buildExportStorageKey(job: JobRow): string {

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -35,7 +35,6 @@ import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework
 // gefailten Hooks bleibt im DeletionRequested-Status (next Lauf
 // retried automatisch).
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   type KmsAdapter,
@@ -46,7 +45,9 @@ import {
   type DbRunner,
   entityEventName,
   executeRawQuery,
+  fetchOne,
   nullBlindIndexesForSubject,
+  selectMany,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -225,10 +226,15 @@ function buildHookDb(
     sink: args.escapeHatchAuditSink,
     log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
   });
-  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-    unsafeRaw:
-      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-    report,
+  return createTenantDb({
+    db,
+    tenantId,
+    mode: "tenant",
+    grants: {
+      unsafeRaw:
+        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+      report,
+    },
   });
 }
 

package/packages/bundled-features/src/user-data-rights/run-user-export.ts

@@ -21,7 +21,6 @@ import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework
 // landen. user-data-rights-defaults/hooks/user.userdata-hook expose
 // expliziert KEIN passwordHash + KEINE roles (privileged columns).
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
@@ -33,6 +32,7 @@ import {
   configuredEntityFieldEncryption,
   createTenantDb,
   decryptEntityFieldValues,
+  selectMany,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   type EscapeHatchAuditSink,
@@ -121,10 +121,15 @@ function buildHookDb(
     sink: args.escapeHatchAuditSink,
     log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
   });
-  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-    unsafeRaw:
-      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-    report,
+  return createTenantDb({
+    db,
+    tenantId,
+    mode: "tenant",
+    grants: {
+      unsafeRaw:
+        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+      report,
+    },
   });
 }
 

package/packages/bundled-features/src/waitlist/handlers/invite.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,

package/packages/bundled-features/src/waitlist/handlers/reject.write.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,

package/packages/bundled-features/src/waitlist/lib.ts

@@ -1,5 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  fetchOne,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createSystemUser,

package/packages/bundled-features/src/workflow-runner/event-subscriber.ts

@@ -24,7 +24,7 @@
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
 
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   FeatureRegistrar,
   MultiStreamApplyFn,

package/packages/bundled-features/src/workflow-runner/feature.ts

@@ -35,55 +35,66 @@ import { workflowRunPendingTableMeta } from "./tables.js";
 // use-all-bundled's check-coverage matches exports to mounted features by it.
 const FEATURE_NAME = "workflow-runner";
 
-export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    "Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.",
-  );
-  r.uiHints({
-    displayLabel: "Workflow Runner",
-    category: "infrastructure",
-    recommended: false,
-  });
-  // resume-run needs a full HandlerContext + ctx.systemDb (the pending-row
-  // scan crosses whatever tenant the row belongs to relative to the job's
-  // own tenant loop iteration) — same reasoning as tenant/feature.ts.
-  r.systemScope();
-  r.storeTable(workflowRunPendingTableMeta, {
-    reason: "resume_loop.pending_suspended_steps",
-  });
-  registerWorkflowRunPendingProjection(r);
-  r.writeHandler(resumeRunHandler);
-
-  r.job(
-    "resume-due-runs",
-    { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" },
-    async (_payload, ctx) => {
-      if (!ctx.systemDb) {
-        throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
-      }
-      const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
-      if (tenantId === undefined) {
-        // skip: cron fired without a perTenant fan-out tenant — nothing scoped
-        return;
-      }
+export function createWorkflowRunnerFeature() {
+  return defineFeature(
+    FEATURE_NAME,
+    (r) => {
+      r.describe(
+        "Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.",
+      );
+      r.uiHints({
+        displayLabel: "Workflow Runner",
+        category: "infrastructure",
+        recommended: false,
+      });
+      // resume-run needs a full HandlerContext + ctx.systemDb (the pending-row
+      // scan crosses whatever tenant the row belongs to relative to the job's
+      // own tenant loop iteration) — same reasoning as tenant/feature.ts.
+      r.systemScope();
+      r.storeTable(workflowRunPendingTableMeta, {
+        reason: "resume_loop.pending_suspended_steps",
+      });
+      registerWorkflowRunPendingProjection(r);
+      r.writeHandler(resumeRunHandler);
 
-      const dueRows = await selectDueWorkflowRunPending(ctx.systemDb.assertTenantMatch(tenantId));
+      r.job(
+        "resume-due-runs",
+        { trigger: { cron: "* * * * *" }, perTenant: true, concurrency: "skip" },
+        async (_payload, ctx) => {
+          if (!ctx.systemDb) {
+            throw new Error("resume-due-runs: ctx.systemDb required (r.systemScope() feature)");
+          }
+          const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
+          if (tenantId === undefined) {
+            // skip: cron fired without a perTenant fan-out tenant — nothing scoped
+            return;
+          }
 
-      for (const row of dueRows) {
-        try {
-          await ctx.write("workflow-runner:write:resume-run", {
-            runId: row.runId,
-            stepIndex: row.stepIndex,
-          });
-        } catch (error) {
-          // skip: one row's dispatch failing (infra hiccup, not a business
-          // outcome — resume-run itself never throws for expected cases)
-          // must not stop the rest of this tenant's due rows from resuming.
-          ctx.log.warn(
-            `[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`,
+          const dueRows = await selectDueWorkflowRunPending(
+            ctx.systemDb.assertTenantMatch(tenantId),
           );
-        }
-      }
+
+          for (const row of dueRows) {
+            try {
+              await ctx.write("workflow-runner:write:resume-run", {
+                runId: row.runId,
+                stepIndex: row.stepIndex,
+              });
+            } catch (error) {
+              // skip: one row's dispatch failing (infra hiccup, not a business
+              // outcome — resume-run itself never throws for expected cases)
+              // must not stop the rest of this tenant's due rows from resuming.
+              ctx.log.warn(
+                `[workflow-runner:resume-due-runs] runId=${row.runId} stepIndex=${row.stepIndex} dispatch failed: ${String(error)}`,
+              );
+            }
+          }
+        },
+      );
     },
+    { dedupeOptions: {} },
   );
-});
+}
+
+/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const workflowRunnerFeature = createWorkflowRunnerFeature();

package/packages/bundled-features/src/workflow-runner/handlers/resume-run.write.ts

@@ -30,7 +30,7 @@
 // resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so
 // a subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   buildPipelineSteps,
   computeDefinitionFingerprint,