@cosmicdrift/kumiko-samples 0.367.0 → 0.368.0

package/packages/bundled-features/src/compliance-profiles/handlers/for-tenant.query.ts

@@ -1,9 +1,9 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   type ComplianceProfileKey,
   type EffectiveComplianceProfile,
   resolveComplianceProfile,
 } from "@cosmicdrift/kumiko-framework/compliance";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { parseComplianceProfileOverride } from "../_internal/parse-override.js";

package/packages/bundled-features/src/compliance-profiles/handlers/needs-profile.query.ts

@@ -1,6 +1,6 @@
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { ComplianceProfileKey } from "@cosmicdrift/kumiko-framework/compliance";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { tenantComplianceProfileTable } from "../schema/profile-selection.js";

package/packages/bundled-features/src/compliance-profiles/handlers/set-profile.write.ts

@@ -1,9 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   complianceProfileOverrideSchema,
   SELECTABLE_PROFILE_KEYS,
 } from "@cosmicdrift/kumiko-framework/compliance";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   UnprocessableError,

package/packages/bundled-features/src/compliance-profiles/resolve-for-tenant.ts

@@ -8,13 +8,13 @@
 // Beide Pfade nutzen `resolveComplianceProfile` aus framework/compliance,
 // also kein Drift zwischen Query-API und Worker-Pfad.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   type ComplianceProfileKey,
   type EffectiveComplianceProfile,
   resolveComplianceProfile,
 } from "@cosmicdrift/kumiko-framework/compliance";
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { isTenantDb } from "../shared/index.js";
 import { parseComplianceProfileOverride } from "./_internal/parse-override.js";

package/packages/bundled-features/src/compliance-profiles/seeding.ts

@@ -10,7 +10,6 @@
 //
 // Pattern matched seedTextBlock aus text-content.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type {
   ComplianceProfileKey,
   ComplianceProfileOverride,
@@ -19,10 +18,15 @@ import {
   createEventStoreExecutor,
   createTenantDb,
   type DbConnection,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  runEventStoreSeed,
+  type SeedIfExists,
+  TestUsers,
+} from "@cosmicdrift/kumiko-framework/seeding";
+
 import {
   tenantComplianceProfileEntity,
   tenantComplianceProfileTable,
@@ -50,7 +54,7 @@ export async function seedComplianceProfile(
   // + Projection im selben Tenant-Bucket landen (Memory:
   // feedback_event_store_tenant_consistency).
   const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
-  const tdb = createTenantDb(db, opts.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
   const overrideJson = opts.override !== undefined ? JSON.stringify(opts.override) : null;
 
   const existing = (await fetchOne(db, tenantComplianceProfileTable, {

package/packages/bundled-features/src/compliance-profiles-ops/index.ts

@@ -13,22 +13,31 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { tenantsMissingProfileQuery } from "./handlers/tenants-missing-profile.query.js";
 
-export const complianceProfilesOpsFeature = defineFeature("compliance-profiles-ops", (r) => {
-  r.describe(
-    "Platform-wide SystemAdmin counterpart to `compliance-profiles`' `needs-profile` query (#2089): `tenants-missing-profile` lists every enabled tenant with no row in `tenantComplianceProfile` at all, tenant-wide instead of scoped to the caller's own tenant. Mount alongside `compliance-profiles` and `tenant` when an operator UI needs to see which tenants still silently run on `minimal-no-region`.",
-  );
-  r.uiHints({
-    displayLabel: "Compliance Profiles · Operator Visibility",
-    category: "compliance",
-    recommended: false,
-  });
-  r.systemScope();
-  r.requires({ features: ["compliance-profiles"] });
-  r.requires({ features: ["tenant"] });
+export function createComplianceProfilesOpsFeature() {
+  return defineFeature(
+    "compliance-profiles-ops",
+    (r) => {
+      r.describe(
+        "Platform-wide SystemAdmin counterpart to `compliance-profiles`' `needs-profile` query (#2089): `tenants-missing-profile` lists every enabled tenant with no row in `tenantComplianceProfile` at all, tenant-wide instead of scoped to the caller's own tenant. Mount alongside `compliance-profiles` and `tenant` when an operator UI needs to see which tenants still silently run on `minimal-no-region`.",
+      );
+      r.uiHints({
+        displayLabel: "Compliance Profiles · Operator Visibility",
+        category: "compliance",
+        recommended: false,
+      });
+      r.systemScope();
+      r.requires({ features: ["compliance-profiles"] });
+      r.requires({ features: ["tenant"] });
+
+      const queries = {
+        tenantsMissingProfile: r.queryHandler(tenantsMissingProfileQuery),
+      };
 
-  const queries = {
-    tenantsMissingProfile: r.queryHandler(tenantsMissingProfileQuery),
-  };
+      return { queries };
+    },
+    { dedupeOptions: {} },
+  );
+}
 
-  return { queries };
-});
+/** @deprecated Use createComplianceProfilesOpsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const complianceProfilesOpsFeature = createComplianceProfilesOpsFeature();

package/packages/bundled-features/src/config/db/queries/resolver.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { configValuesTable } from "../../table.js";
 

package/packages/bundled-features/src/config/handlers/reencrypt.job.ts

@@ -125,7 +125,7 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
   function tdbFor(tenantId: TenantId): TenantDb {
     let existing = tdbCache.get(tenantId);
     if (!existing) {
-      existing = createTenantDb(db, tenantId, "system");
+      existing = createTenantDb({ db, tenantId, mode: "system" });
       tdbCache.set(tenantId, existing);
     }
     return existing;
@@ -146,7 +146,7 @@ export const reencryptJob: JobHandlerFn = async (rawPayload, ctx): Promise<void>
   // tenant's writes — sharing it with sdbFor(SYSTEM_TENANT_ID) would make a
   // write-path cache entry double as the scan's ack gate.
   const scanDb = createSystemDbView(
-    createTenantDb(db, SYSTEM_TENANT_ID, "system"),
+    createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" }),
     undefined,
     reportEscapeHatchFor(SYSTEM_TENANT_ID),
   );

package/packages/bundled-features/src/config/resolver.ts

@@ -1,11 +1,11 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   decryptPiiValueForSubject,
   type KmsContext,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type {
   ConfigCascade,
   ConfigCascadeLevel,

package/packages/bundled-features/src/config/write-helpers.ts

@@ -2,9 +2,9 @@
 // Extracted from set.write.ts so reset.write.ts + values.query.ts don't
 // have to cross-import from another handler file.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   type ConfigKeyDefinition,
   type ConfigScope,

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "forget-subject closes the login door for users whose stream is already deleted",
+    "detail": "forget-subject returned 500 (\"user lifecycle update failed ... not_found\") when the user stream was deleted but the read_users status still read active, leaving sessions and PATs alive. The erasure now appends the status-deleted user.updated event to that stream too, so the login door closes, the handler returns 200 and a read_users rebuild keeps the state."
+  },
   {
     "version": "0.366.0",
     "type": "fix",

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -1,11 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import {
-  fetchOne,
-  runInSavepointIfSupported,
-  runnerCanBeginTransaction,
-  transaction,
-} from "@cosmicdrift/kumiko-framework/bun-db";
+
 import {
   computeBlindIndex,
   configuredBlindIndexKey,
@@ -16,11 +11,15 @@ import {
 } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   type DbRunner,
+  fetchOne,
   nullBlindIndexesForSubject,
   recordEventsOwnedExclusivelyByTenant,
   recordRowExistsInTenant,
   recordRowOwningTenantId,
+  runInSavepointIfSupported,
+  runnerCanBeginTransaction,
   subjectRowExistsInTenant,
+  transaction,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -365,7 +364,10 @@ async function closeUserLoginDoor(
       runner,
       userId,
       { status: USER_STATUS.Deleted },
-      { writePurpose: WritePurposes.erasure },
+      // includeDeleted: a user whose stream is already deleted but whose status
+      // still reads active would otherwise fail with not_found (500) and keep
+      // sessions and PATs alive.
+      { writePurpose: WritePurposes.erasure, includeDeleted: true },
     );
     if (ctx.registry.features.has("personal-access-tokens")) {
       await revokeAllPatTokensForUser(runner, userId);

package/packages/bundled-features/src/custom-fields/db/queries/field-access.ts

@@ -1,5 +1,5 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 
 export async function selectSerializedFieldDefinition(
   runner: DbRunner,

package/packages/bundled-features/src/custom-fields/db/queries/projection.ts

@@ -1,5 +1,5 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
 function quoteTable(tableName: string): string {

package/packages/bundled-features/src/custom-fields/db/queries/quota.ts

@@ -1,5 +1,5 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 
 export async function countTenantFieldDefinitions(
   runner: DbRunner,

package/packages/bundled-features/src/custom-fields/db/queries/retention.ts

@@ -1,5 +1,9 @@
-import { asRawClient, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
-import { type DbRunner, toPostgresArrayLiteral } from "@cosmicdrift/kumiko-framework/db";
+import {
+  asRawClient,
+  type DbRunner,
+  toPostgresArrayLiteral,
+  unsafeReadRetrying,
+} from "@cosmicdrift/kumiko-framework/db";
 
 export async function selectHostRowsWithCustomFields(
   db: DbRunner,

package/packages/bundled-features/src/custom-fields/db/queries/user-data-rights.ts

@@ -1,5 +1,5 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 
 function quoteTable(tableName: string): string {
   return `"${tableName.replace(/"/g, '""')}"`;

package/packages/bundled-features/src/custom-fields/feature.ts

@@ -33,7 +33,7 @@
 //   `customFieldsField()` (jsonb) deklarieren.
 //
 // **Exports-Pattern (2026-05-23 refactor)**:
-//   `customFieldsFeature.exports.{setEvent,clearedEvent,fieldDefinitionDeletedEvent}`
+//   `createCustomFieldsFeature().exports.{setEvent,clearedEvent,fieldDefinitionDeletedEvent}`
 //   liefern typed EventDef-handles. Handler + wire-for-entity nutzen
 //   `<event>.name` als compile-time-literal-typed qualified-string — keine
 //   hand-gebauten Template-Literals mehr (T1 hat den toKebab-collapse-drift
@@ -179,12 +179,9 @@ function registerCustomFields(
   return { setEvent, clearedEvent, fieldDefinitionDeletedEvent };
 }
 
-// Singleton feature-definition mit typed exports. Handler + wire-for-entity
-// importieren diesen `customFieldsFeature` und greifen lazy in ihrer
-// runtime-arrow-fn auf `.exports.<event>.name` zu — der module-cycle
-// (feature.ts -> handlers/*.write.ts -> feature.ts) löst sich auf weil
-// kein top-level-access stattfindet.
-export const customFieldsFeature = defineFeature(CUSTOM_FIELDS_FEATURE_NAME, (r) =>
+// Handlers and wire-for-entity read `.exports.<event>.name` lazily inside their runtime
+// arrow functions, which resolves the module cycle (feature.ts -> handlers/*.write.ts -> feature.ts).
+const defaultCustomFieldsFeature = defineFeature(CUSTOM_FIELDS_FEATURE_NAME, (r) =>
   registerCustomFields(r, {
     defineTenantHandler: defineTenantFieldHandler,
     updateTenantHandler: updateTenantFieldHandler,
@@ -246,21 +243,18 @@ export function resolveFieldDefinitionListRoles(
   ];
 }
 
-// Backwards-compat-wrapper. Bestehende Caller (z.B. integration-tests,
-// host-apps) nutzen weiterhin `createCustomFieldsFeature()`. Returnt den
-// module-level-Singleton — kein neuer build pro Aufruf, was für consumer
-// nicht erkennbar ist (read-only inspection). Jede gesetzte Option baut
-// eine frische Feature-Definition mit den Varianten-Handlern.
+// Without options this returns the module-level singleton (no rebuild per call); every
+// option builds a fresh feature definition with the variant handlers.
 export function createCustomFieldsFeature(
   opts: CustomFieldsFeatureOptions = {},
-): typeof customFieldsFeature {
+): typeof defaultCustomFieldsFeature {
   const hasOptions =
     opts.fieldDefinitionLimitPerTenant !== undefined ||
     opts.valueWriteRoles !== undefined ||
     opts.fieldDefinitionListRoles !== undefined ||
     opts.fieldDefinitionWriteRoles !== undefined;
   if (!hasOptions) {
-    return customFieldsFeature;
+    return defaultCustomFieldsFeature;
   }
   const limit = opts.fieldDefinitionLimitPerTenant;
   const definitionWriteRoles = opts.fieldDefinitionWriteRoles;
@@ -287,3 +281,6 @@ export function createCustomFieldsFeature(
     }),
   );
 }
+
+/** @deprecated Use createCustomFieldsFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const customFieldsFeature = createCustomFieldsFeature();

package/packages/bundled-features/src/custom-fields/handlers/clear-custom-field.write.ts

@@ -2,7 +2,7 @@ import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { DEFAULT_VALUE_WRITE_ROLES } from "../constants.js";
-import { customFieldsFeature } from "../feature.js";
+import { createCustomFieldsFeature } from "../feature.js";
 import { checkFieldAccessForWrite } from "../lib/field-access.js";
 
 export const clearCustomFieldPayloadSchema = z.object({
@@ -62,7 +62,7 @@ export const clearCustomFieldHandler: WriteHandlerDef = {
     await ctx.unsafeAppendEvent({
       aggregateId: payload.entityId,
       aggregateType: payload.entityName,
-      type: customFieldsFeature.exports.clearedEvent.name,
+      type: createCustomFieldsFeature().exports.clearedEvent.name,
       payload: { fieldKey: payload.fieldKey },
     });
 

package/packages/bundled-features/src/custom-fields/handlers/delete-system-field.write.ts

@@ -3,7 +3,7 @@ import { requireForTenant } from "../../shared/index.js";
 import { fieldDefinitionAggregateId } from "../aggregate-id.js";
 import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
-import { customFieldsFeature } from "../feature.js";
+import { createCustomFieldsFeature } from "../feature.js";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas.js";
 
 // delete-system-field — SystemAdmin entfernt eine system-weite Field-
@@ -38,7 +38,7 @@ export const deleteSystemFieldHandler: WriteHandlerDef = {
       await ctx.unsafeAppendEvent({
         aggregateId,
         aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
-        type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
+        type: createCustomFieldsFeature().exports.fieldDefinitionDeletedEvent.name,
         payload: {
           entityName: payload.entityName,
           fieldKey: payload.fieldKey,

package/packages/bundled-features/src/custom-fields/handlers/delete-tenant-field.write.ts

@@ -5,7 +5,7 @@ import {
   FIELD_DEFINITION_AGGREGATE_TYPE,
 } from "../constants.js";
 import { fieldDefinitionExecutor } from "../executor.js";
-import { customFieldsFeature } from "../feature.js";
+import { createCustomFieldsFeature } from "../feature.js";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas.js";
 
 // delete-tenant-field — TenantAdmin löscht eigene Field-Definition.
@@ -59,7 +59,7 @@ export function createDeleteTenantFieldHandler(
         await ctx.unsafeAppendEvent({
           aggregateId,
           aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
-          type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
+          type: createCustomFieldsFeature().exports.fieldDefinitionDeletedEvent.name,
           payload: { entityName: payload.entityName, fieldKey: payload.fieldKey, tenantId },
         });
       }

package/packages/bundled-features/src/custom-fields/handlers/set-custom-field.write.ts

@@ -2,7 +2,7 @@ import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { DEFAULT_VALUE_WRITE_ROLES } from "../constants.js";
-import { customFieldsFeature } from "../feature.js";
+import { createCustomFieldsFeature } from "../feature.js";
 import { fieldWriteAccessDeniedRoles, loadFieldDefinition } from "../lib/field-access.js";
 import { buildCustomFieldValueSchema } from "../lib/value-schema.js";
 
@@ -103,7 +103,7 @@ export const setCustomFieldHandler: WriteHandlerDef = {
     await ctx.unsafeAppendEvent({
       aggregateId: payload.entityId,
       aggregateType: payload.entityName,
-      type: customFieldsFeature.exports.setEvent.name,
+      type: createCustomFieldsFeature().exports.setEvent.name,
       payload: { fieldKey: payload.fieldKey, value: payload.value },
     });
 

package/packages/bundled-features/src/custom-fields/wire-for-entity.ts

@@ -16,7 +16,7 @@ import {
 } from "./db/queries/projection.js";
 
 import type { CustomFieldClearedPayload, CustomFieldSetPayload } from "./events.js";
-import { customFieldsFeature } from "./feature.js";
+import { createCustomFieldsFeature } from "./feature.js";
 
 // Helper für entity-definitions — fügt eine `customFields jsonb`-Spalte
 // hinzu. Consumer:
@@ -90,9 +90,9 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
   // Qualified event-type-names — sourced from typed EventDef.name handles
   // (compile-time literal-typed, no Template-Literal-Drift à la toKebab-
   // collapse-bug die T1 aufgedeckt hat).
-  const setEventType = customFieldsFeature.exports.setEvent.name;
-  const clearedEventType = customFieldsFeature.exports.clearedEvent.name;
-  const fieldDefDeletedType = customFieldsFeature.exports.fieldDefinitionDeletedEvent.name;
+  const setEventType = createCustomFieldsFeature().exports.setEvent.name;
+  const clearedEventType = createCustomFieldsFeature().exports.clearedEvent.name;
+  const fieldDefDeletedType = createCustomFieldsFeature().exports.fieldDefinitionDeletedEvent.name;
 
   // Geteilte apply-Bodies: die MSP liefert sie live (async cursor), die
   // entity-projection-extension replayt sie in rebuildProjection — gleiche

package/packages/bundled-features/src/data-retention/resolve-for-tenant.ts

@@ -2,8 +2,8 @@
 // the forget runner and the `policy-for` query all go through here, so a caller
 // cannot skip a layer (e.g. the tenant preset) by accident.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { isTenantDb } from "../shared/index.js";
 import { parseRetentionOverrideOrNull } from "./_internal/parse-override.js";

package/packages/bundled-features/src/data-retention/run-retention-cleanup.ts

@@ -38,10 +38,10 @@
 // Rows weiter (reference bleibt alt), deshalb id-Cursor-Paging statt einer
 // einzelnen Page — sonst verstopfen erledigte Rows das batchLimit-Fenster.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   collectPiiSubjectFields,
   configuredPiiSubjectKms,
+  isRecordKeyedField,
   isSelfPiiField,
   type KmsAdapter,
   resolveSubjectForField,
@@ -53,6 +53,7 @@ import {
   createTenantDb,
   type DbRunner,
   nullBlindIndexesForSubject,
+  selectMany,
   type TenantDb,
   type WhereObject,
   WritePurposes,
@@ -160,10 +161,17 @@ async function purgeMatchingRows(
 // (purgeMatchingRows's hardDelete select) is enough; the with-files path's
 // full row works the same way.
 //
-// userOwned/tenantOwned are explicitly excluded: hardDelete only destroys
+// userOwned/tenantOwned are explicitly excluded (except a whenAbsent: "self" field
+// of an ownerless row, which resolves to this row's own record key): hardDelete only destroys
 // THIS row's own data, but the owning user's/tenant's key may still protect
 // OTHER live rows that reference the same subject — erasing it here would
 // be a silent cross-row data-loss bug, not a retention fix.
+function mayResolveToOwnRecordKey(field: EntityDefinition["fields"][string]): boolean {
+  if ("tenantOwned" in field && field.tenantOwned === true) return false;
+  if ("userOwned" in field && field.userOwned !== undefined) return isRecordKeyedField(field);
+  return ("recordOwned" in field && field.recordOwned === true) || isSelfPiiField(field);
+}
+
 function collectHardDeleteEraseSubjects(
   entity: EntityDefinition,
   entityName: string,
@@ -173,13 +181,11 @@ function collectHardDeleteEraseSubjects(
   const subjectsByKey = new Map<string, SubjectId>();
   for (const fieldName of collectPiiSubjectFields(entity)) {
     const field = entity.fields[fieldName];
-    if (!field) continue;
-    const isRecordOwned = "recordOwned" in field && field.recordOwned === true;
-    const isUserOwned = "userOwned" in field && field.userOwned !== undefined;
-    const isTenantOwned = "tenantOwned" in field && field.tenantOwned === true;
-    if (isUserOwned || isTenantOwned) continue; // never erase — see header comment
-    if (!isRecordOwned && !isSelfPiiField(field)) continue;
+    if (!field || !mayResolveToOwnRecordKey(field)) continue;
     const subject = resolveSubjectForField(entity, fieldName, row, { tenantId, entityName });
+    // whenAbsent: "self" resolves to the owner's key while the row has an owner — never erased here
+    const isUserOwned = "userOwned" in field && field.userOwned !== undefined;
+    if (isUserOwned && subject?.kind !== "record") continue;
     if (subject) subjectsByKey.set(subjectIdToKey(subject), subject);
   }
   return Array.from(subjectsByKey.values());
@@ -236,7 +242,7 @@ async function forgetRowAndEraseKeys(args: {
   readonly registry: Registry;
 }): Promise<{ readonly isSuccess: boolean }> {
   return runInSubTransaction(args.db, async (sp) => {
-    const tdb = createTenantDb(sp, args.tenantId, "system");
+    const tdb = createTenantDb({ db: sp, tenantId: args.tenantId, mode: "system" });
     const result = await args.executor.forget(
       { id: args.row["id"] as EntityId },
       args.systemUser,
@@ -666,7 +672,7 @@ export async function runRetentionCleanup(
   // the daily cron converges (hardDelete removes rows, softDelete's isDeleted
   // filter shrinks the set). A single batched forget/delete event is a follow-up.
   const systemUser = createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
   const fileHolders = collectSingleFileHolders(registry);
 
   // Pre-load every override row for this tenant ONCE — N entities × M

package/packages/bundled-features/src/delivery/address-opt-out.ts

@@ -1,6 +1,9 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  fetchOne,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateDeterministicId } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/delivery/attempt-log-retention.ts

@@ -1,5 +1,5 @@
-import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/db";
 import { type PruneEventsOptions, pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
 import { deliveryAttemptsTable } from "./tables.js";
 

package/packages/bundled-features/src/delivery/channel-context.ts

@@ -148,7 +148,7 @@ export function buildChannelContext(
   filesForTenant?: (tenantId: string) => FileContext | undefined,
 ): ChannelContext {
   return {
-    db: createTenantDb(db, tenantId),
+    db: createTenantDb({ db, tenantId }),
     registry,
     sseBroker,
     tenantId,

package/packages/bundled-features/src/delivery/db/queries/address-opt-outs.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { notificationAddressOptOutsTable } from "../../tables.js";
 

package/packages/bundled-features/src/delivery/db/queries/preferences.ts

@@ -1,5 +1,5 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
 export type NotificationPreferenceRow = {

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -15,6 +15,7 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   assertNotificationVariables,
+  bridgeStub,
   createSystemUser,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
@@ -24,7 +25,6 @@ import {
   createEscapeHatchReporter,
 } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing/handler-context";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import type { Redis } from "ioredis";
 import { fileContextFromResolver } from "../file-foundation/index.js";
@@ -273,17 +273,27 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     // path a cross-tenant read the dispatcher never allows. Cross-tenant reach only
     // exists through the grant-carrying systemDb view below.
     const isSystem = registry.isHandlerSystemScoped(tenantUserIdsQuery);
-    const tenantDb = createTenantDb(run.db, tenantId, "tenant", undefined, undefined, undefined, {
-      report,
+    const tenantDb = createTenantDb({
+      db: run.db,
+      tenantId,
+      mode: "tenant",
+      grants: {
+        report,
+      },
     });
     // The dispatcher grants a systemScope handler's ctx.systemDb.unsafeRaw() ungated —
     // the grant comes from the handler's own r.systemScope() registration, not from this
     // caller. Only the systemDb view's own source TenantDb carries the grant, so it
     // can't leak onto ctx.db.
     const systemDbSourceTenantDb = isSystem
-      ? createTenantDb(run.db, tenantId, "system", undefined, undefined, undefined, {
-          report,
-          unsafeRaw: { reason: `r.systemScope() handler "${tenantUserIdsQuery}"` },
+      ? createTenantDb({
+          db: run.db,
+          tenantId,
+          mode: "system",
+          grants: {
+            report,
+            unsafeRaw: { reason: `r.systemScope() handler "${tenantUserIdsQuery}"` },
+          },
         })
       : undefined;
     // Hand-built context, not routed through the dispatcher — this needs both

package/packages/bundled-features/src/delivery/feature.ts

@@ -1,5 +1,5 @@
-import { updateMany, upsertByPk } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { updateMany, upsertByPk } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   defineFeature,