@cosmicdrift/kumiko-samples 0.367.0 → 0.369.0

package/packages/bundled-features/src/mail-transport-smtp/feature.ts

@@ -47,9 +47,11 @@ import {
   type MailTransportPlugin,
 } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { SMTP_CONFIG_KEYS } from "./config-keys.js";
+import { MAIL_TRANSPORT_SMTP_I18N } from "./i18n.js";
 
 const FEATURE_NAME = "mail-transport-smtp";
 
@@ -75,89 +77,72 @@ export function setSmtpMailHostLookup(fn: typeof lookup | undefined): void {
 // =============================================================================
 // Feature-definition
 // =============================================================================
-
-export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    'Registers itself as the `"smtp"` provider for `mail-foundation` and owns the per-tenant config keys (`host`, `port`, `secure`, `from`, `authUser`) and the encrypted `smtp.password` secret. Tenants set `mail-foundation`\'s `provider` config key to `"smtp"` to activate it; set the SMTP credentials via the admin UI or a seed handler before sending the first mail.',
-  );
-  r.uiHints({
-    displayLabel: "Mail Transport · SMTP",
-    category: "notifications",
-    recommended: false,
-  });
-  r.requires({ features: ["config"] });
-  r.requires({ features: ["secrets"] });
-  r.requires({ features: ["mail-foundation"] });
-  r.envSchema(mailTransportSmtpEnvSchema);
-
-  // Provider-secret. Sensitive: redact-helper for admin-UI display.
-  const password = r.secret("smtp.password", {
-    label: { en: "SMTP password" },
-    hint: {
-      en: "Login password at the SMTP server. Brevo/Postmark/SES call it 'API key' or 'SMTP credentials'.",
-    },
-    redact: (plaintext) => {
-      if (plaintext.length < 8) return "•".repeat(plaintext.length);
-      return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
-    },
-    scope: "tenant",
-    // required: true ↔ the missing-secret throw in readPassword — keep in sync.
-    required: true,
-  });
-
-  // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
-  const configKeys = r.config({
-    keys: {
-      host: createTenantConfig("text", {
-        required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      port: createTenantConfig("number", {
-        default: 587,
-        bounds: { min: 1, max: 65535 },
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      secure: createTenantConfig("boolean", {
-        default: false,
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      from: createTenantConfig("text", {
-        required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      authUser: createTenantConfig("text", {
+export function createMailTransportSmtpFeature() {
+  return defineFeature(
+    FEATURE_NAME,
+    (r) => {
+      r.describe(
+        'Registers itself as the `"smtp"` provider for `mail-foundation` and owns the per-tenant config keys (`host`, `port`, `secure`, `from`, `authUser`) and the encrypted `smtp.password` secret. Tenants set `mail-foundation`\'s `provider` config key to `"smtp"` to activate it; set the SMTP credentials via the admin UI or a seed handler before sending the first mail.',
+      );
+      r.uiHints({
+        displayLabel: "Mail Transport · SMTP",
+        category: "notifications",
+        recommended: false,
+      });
+      r.requires({ features: ["config"] });
+      r.requires({ features: ["secrets"] });
+      r.requires({ features: ["mail-foundation"] });
+      r.envSchema(mailTransportSmtpEnvSchema);
+
+      // Provider-secret. Sensitive: redact-helper for admin-UI display.
+      const password = r.secret("smtp.password", {
+        label: { en: "SMTP password" },
+        hint: {
+          en: "Login password at the SMTP server. Brevo/Postmark/SES call it 'API key' or 'SMTP credentials'.",
+        },
+        redact: (plaintext) => {
+          if (plaintext.length < 8) return "•".repeat(plaintext.length);
+          return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
+        },
+        scope: "tenant",
+        // required: true ↔ the missing-secret throw in readPassword — keep in sync.
         required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
+      });
+
+      const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
+
+      r.translations({ keys: MAIL_TRANSPORT_SMTP_I18N });
+
+      // Plugin: register against mail-foundation's "mailTransport" extension.
+      // `entityName` "smtp" is what tenants set in mail-foundation's
+      // `provider` config-key to pick this transport.
+      const plugin: MailTransportPlugin = {
+        build: async (ctx: MailTransportContext, tenantId: string) =>
+          buildSmtpTransport(ctx, tenantId), // @wrapper-known semantic-alias
+      };
+      r.useExtension(MAIL_TRANSPORT_EXTENSION, "smtp", plugin);
+
+      return {
+        /** Config-key-handles — typed reads via `ctx.config(...)` in
+         *  consumer handlers. */
+        configKeys,
+        /** Secret-handle for the SMTP password. */
+        password,
+      };
     },
-  });
+    { dedupeOptions: {} },
+  );
+}
 
-  // Plugin: register against mail-foundation's "mailTransport" extension.
-  // `entityName` "smtp" is what tenants set in mail-foundation's
-  // `provider` config-key to pick this transport.
-  const plugin: MailTransportPlugin = {
-    build: async (ctx: MailTransportContext, tenantId: string) => buildSmtpTransport(ctx, tenantId), // @wrapper-known semantic-alias
-  };
-  r.useExtension(MAIL_TRANSPORT_EXTENSION, "smtp", plugin);
+// The typed handles below come from one shared instance; each factory call builds its own handle objects.
+const sharedMailTransportSmtpFeature = createMailTransportSmtpFeature();
 
-  return {
-    /** Config-key-handles — typed reads via `ctx.config(...)` in
-     *  consumer handlers. */
-    configKeys,
-    /** Secret-handle for the SMTP password. */
-    password,
-  };
-});
+/** @deprecated Use createMailTransportSmtpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const mailTransportSmtpFeature = sharedMailTransportSmtpFeature;
 
 /** Typed handle for the SMTP password — exported so seeds + tests can
  *  set it via `secrets:write:set` with the full qualified-name. */
-export const SMTP_PASSWORD = mailTransportSmtpFeature.exports.password;
+export const SMTP_PASSWORD = sharedMailTransportSmtpFeature.exports.password;
 
 // =============================================================================
 // Internal: build the EmailTransport from tenant config + secret
@@ -188,29 +173,29 @@ async function buildSmtpTransport(
 
   const SMTP_HINT = "Set via tenant-admin UI or seed-handler before sending mail.";
   const host = requireNonEmpty(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.host),
+    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.host),
     FEATURE_NAME,
     "host",
     SMTP_HINT,
   );
   const port = requireDefined(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.port),
+    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.port),
     FEATURE_NAME,
     "port",
   ) as number; // @cast-boundary engine-payload
   const secure = requireDefined(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.secure),
+    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.secure),
     FEATURE_NAME,
     "secure",
   ) as boolean; // @cast-boundary engine-payload
   const from = requireNonEmpty(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.from),
+    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.from),
     FEATURE_NAME,
     "from",
     SMTP_HINT,
   );
   const authUser = requireNonEmpty(
-    await ctxConfig(mailTransportSmtpFeature.exports.configKeys.authUser),
+    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser),
     FEATURE_NAME,
     "authUser",
     SMTP_HINT,

package/packages/bundled-features/src/mail-transport-smtp/i18n.ts

@@ -0,0 +1,28 @@
+export const MAIL_TRANSPORT_SMTP_I18N = {
+  // Also the option label of mail-foundation's provider select.
+  "mail-transport-smtp.settings": { en: "SMTP server" },
+  "mail-transport-smtp.settings.secrets": { en: "SMTP sign-in" },
+  "mail-transport-smtp.settings.description": {
+    en: "The connection details come from your mail provider, for example Brevo, Postmark, Amazon SES or your own server.",
+  },
+  "mail-transport-smtp.host": { en: "Server address" },
+  "mail-transport-smtp.host.description": {
+    en: "Host name of the SMTP server, for example smtp.example.com.",
+  },
+  "mail-transport-smtp.port": { en: "Port number" },
+  "mail-transport-smtp.port.description": {
+    en: "Usually 587. Use 465 when your provider asks for SSL/TLS.",
+  },
+  "mail-transport-smtp.secure": { en: "SSL/TLS from the start" },
+  "mail-transport-smtp.secure.description": {
+    en: "Turn on for port 465. Leave off for 587, which switches to encryption by itself.",
+  },
+  "mail-transport-smtp.authUser": { en: "User name" },
+  "mail-transport-smtp.authUser.description": {
+    en: "Login name at the SMTP server, often an email address.",
+  },
+  "mail-transport-smtp.from": { en: "Sender address" },
+  "mail-transport-smtp.from.description": {
+    en: "The address mails are sent from, for example status@example.com. Your provider must allow it.",
+  },
+} as const;

package/packages/bundled-features/src/mail-transport-smtp/index.ts

@@ -1,6 +1,7 @@
 // Public API of the mail-transport-smtp bundled-feature.
 
 export {
+  createMailTransportSmtpFeature,
   mailTransportSmtpEnvSchema,
   mailTransportSmtpFeature,
   SMTP_PASSWORD,

package/packages/bundled-features/src/managed-pages/handlers/by-slug.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type PageRow, pagesTable } from "../table.js";

package/packages/bundled-features/src/managed-pages/handlers/by-tenant-published.query.ts

@@ -1,5 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { castTenantRows } from "@cosmicdrift/kumiko-framework/db";
+import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type PageRow, pagesTable } from "../table.js";

package/packages/bundled-features/src/managed-pages/handlers/set.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";

package/packages/bundled-features/src/managed-pages/seeding.ts

@@ -2,15 +2,19 @@
 // Event-Store-Executor an — gleicher Pfad wie der echte set-Handler, aber
 // ohne Access-Check. Default ifExists="skip".
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbConnection,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { runEventStoreSeed, type SeedIfExists } from "@cosmicdrift/kumiko-framework/seeding";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  runEventStoreSeed,
+  type SeedIfExists,
+  TestUsers,
+} from "@cosmicdrift/kumiko-framework/seeding";
+
 import { type PageRow, pageEntity, pagesTable } from "./table.js";
 
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
@@ -33,7 +37,7 @@ export async function seedPage(db: DbConnection, opts: SeedPageOptions): Promise
   // der event-store-stream im falschen tenant-bucket → version_conflict
   // bei späteren echten writes). TestUsers.systemAdmin ist testTenantId(1).
   const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
-  const tdb = createTenantDb(db, opts.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
 
   const existing = await fetchOne<PageRow>(db, pagesTable, {
     tenantId: opts.tenantId,

package/packages/bundled-features/src/metrics/compute.ts

@@ -1,4 +1,4 @@
-import type { WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import type {
   AggregateDimension,
   AggregateKey,

package/packages/bundled-features/src/metrics/filters.ts

@@ -1,4 +1,4 @@
-import { extractTableInfo, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { extractTableInfo, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import type { MetricDefinition, MetricFilterResolver } from "./types.js";

package/packages/bundled-features/src/metrics/validate.ts

@@ -1,4 +1,4 @@
-import { extractTableInfo, isTimestamptzType } from "@cosmicdrift/kumiko-framework/bun-db";
+import { extractTableInfo, isTimestamptzType } from "@cosmicdrift/kumiko-framework/db";
 import { METRIC_RANGES } from "./constants.js";
 import { filterValueKindOf, metricFilterEntries, RESERVED_PAYLOAD_KEYS } from "./filters.js";
 import type { MetricDefinition } from "./types.js";

package/packages/bundled-features/src/notes-history/feature.ts

@@ -63,7 +63,7 @@ function registerNotesHistory(
   r.translations({ keys: NOTES_HISTORY_FEATURE_I18N });
 }
 
-export const notesHistoryFeature = defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
+const defaultNotesHistoryFeature = defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
   registerNotesHistory(r, DEFAULT_NOTES_HISTORY_ACCESS, undefined, undefined),
 );
 
@@ -114,14 +114,14 @@ function resolveAccess(opts: NotesHistoryFeatureOptions): AccessRule {
 // rebuild). access/roles/ownership build a fresh feature-definition.
 export function createNotesHistoryFeature(
   opts: NotesHistoryFeatureOptions = {},
-): typeof notesHistoryFeature {
+): typeof defaultNotesHistoryFeature {
   if (
     opts.access === undefined &&
     opts.roles === undefined &&
     opts.ownership === undefined &&
     opts.parents === undefined
   ) {
-    return notesHistoryFeature;
+    return defaultNotesHistoryFeature;
   }
   assertNoWhereRuleInOwnershipWrite("createNotesHistoryFeature", opts.ownership?.write);
   // A mount that accepts no parents at all can never take a note write —
@@ -138,3 +138,6 @@ export function createNotesHistoryFeature(
     registerNotesHistory(r, resolveAccess(opts), opts.ownership, opts.parents),
   );
 }
+
+/** @deprecated Use createNotesHistoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const notesHistoryFeature = createNotesHistoryFeature();

package/packages/bundled-features/src/notes-history/handlers/add-note.write.ts

@@ -1,4 +1,4 @@
-import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { ValidationError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { decryptStoredPii, denyUnlessJoinRowParentVisible } from "../../shared/index.js";

package/packages/bundled-features/src/notes-history-user-data/hooks.ts

@@ -4,9 +4,9 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   TenantId,
   UserDataDeleteHook,

package/packages/bundled-features/src/notes-history-user-data/index.ts

@@ -15,22 +15,31 @@ import {
 
 export { eraseNoteBodiesReachingSubject } from "./hooks.js";
 
-export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
-  r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+export function createNotesHistoryUserDataFeature() {
+  return defineFeature(
+    "notes-history-user-data",
+    (r) => {
+      r.describe(
+        "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (regardless of the host entity's retention strategy: the note text is free PII, the host's anonymize/blockDelete protects the row, not the content), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+      );
+      // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
+      // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
+      // would throw an "effectively disabled" boot warning even though the
+      // note-entry entity exists and the hooks work fine.
+      r.requires({ features: ["user-data-rights"] });
+      r.optionalRequires("notes-history");
+      r.useExtension(EXT_USER_DATA, "note-entry", {
+        export: noteEntryExportHook,
+        delete: noteEntryDeleteHook,
+      });
+      r.useExtension(EXT_USER_DATA, "note-mention", {
+        export: noteMentionExportHook,
+        delete: noteMentionDeleteHook,
+      });
+    },
+    { dedupeOptions: {} },
   );
-  // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
-  // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires
-  // would throw an "effectively disabled" boot warning even though the
-  // note-entry entity exists and the hooks work fine.
-  r.requires({ features: ["user-data-rights"] });
-  r.optionalRequires("notes-history");
-  r.useExtension(EXT_USER_DATA, "note-entry", {
-    export: noteEntryExportHook,
-    delete: noteEntryDeleteHook,
-  });
-  r.useExtension(EXT_USER_DATA, "note-mention", {
-    export: noteMentionExportHook,
-    delete: noteMentionDeleteHook,
-  });
-});
+}
+
+/** @deprecated Use createNotesHistoryUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const notesHistoryUserDataFeature = createNotesHistoryUserDataFeature();

package/packages/bundled-features/src/personal-access-tokens/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "improvement",
+    "title": "The token list screen takes a description and slots via listScreen",
+    "detail": "createPersonalAccessTokensFeature({ listScreen: { description, slots } }) sets the i18n description and the slots (for example a header component) of the api-tokens list, so an app can show instructions above the list and use the bundled screen directly instead of embedding it in its own dashboard. Without the option nothing changes. Both bundled token screens are now marked agent: { expose: false }, since the mint screen reveals the token plaintext."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -4,7 +4,11 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { PAT_TOKEN_PREFIX } from "@cosmicdrift/kumiko-framework/api";
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
-import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  defineFeature,
+  type FeatureDefinition,
+  type ProjectionListScreenDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   API_TOKEN_ENTITY_NAME,
   PAT_DEFAULT_RATE_LIMIT,
@@ -68,6 +72,9 @@ export type PersonalAccessTokensOptions = {
    *  shown in place of the token screens when the tenant's tier excludes the
    *  feature, e.g. an upgrade notice. Default: the standard "unavailable" notice. */
   readonly lockedFallbackScreen?: string;
+  /** Description (i18n key) and slots rendered on the token list screen, e.g. an
+   *  explanatory text or a header component above the list. Default: neither. */
+  readonly listScreen?: Pick<ProjectionListScreenDefinition, "description" | "slots">;
   // Opt-in MFA re-auth gate for minting a token — wired via
   // mfaVerifierFromFeature (auth-mfa/feature.ts) at app-composition time. No
   // hard dependency on the optional auth-mfa feature.
@@ -176,7 +183,15 @@ export function createPersonalAccessTokensFeature(
     // places `patListScreen` via r.nav in its logged-in settings area.
     const lockedFallback =
       options.lockedFallbackScreen === undefined ? {} : { fallback: options.lockedFallbackScreen };
-    r.screen({ ...patListScreen, ...lockedFallback });
+    // Copy the two fields explicitly: a wider object passed as a variable
+    // escapes the Pick check and would override agent/access otherwise.
+    const { description, slots } = options.listScreen ?? {};
+    r.screen({
+      ...patListScreen,
+      ...(description === undefined ? {} : { description }),
+      ...(slots === undefined ? {} : { slots }),
+      ...lockedFallback,
+    });
     r.screen({ ...createPatMintScreen(scopes), ...lockedFallback });
     r.translations({ keys: { ...PAT_FEATURE_I18N, ...patScopeOptionTranslations(scopes) } });
 

package/packages/bundled-features/src/personal-access-tokens/handlers/create.write.ts

@@ -1,4 +1,4 @@
-import { insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { insertOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,

package/packages/bundled-features/src/personal-access-tokens/handlers/list.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
@@ -8,7 +8,7 @@ import { apiTokenTable } from "../schema/api-token.js";
 
 // `sort` arrives raw from the client's query string. selectMany's orderBy has
 // no column-existence check — an unrecognised field just gets snake_cased and
-// quoted as-is (bun-db/query.ts columnOf) — so this allowlist is what stops a
+// quoted as-is (db/query.ts columnOf) — so this allowlist is what stops a
 // client sorting by tokenHash or any other non-exposed column.
 const SORTABLE_COLUMNS = ["id", "name", "createdAt", "expiresAt", "revokedAt"] as const;
 type SortableColumn = (typeof SORTABLE_COLUMNS)[number];

package/packages/bundled-features/src/personal-access-tokens/handlers/revoke.write.ts

@@ -1,4 +1,4 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/personal-access-tokens/resolver.ts

@@ -1,6 +1,6 @@
 import type { TokenVerifier } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { isExpiredAt } from "./expiry.js";
 import { hashPatToken } from "./hash.js";

package/packages/bundled-features/src/personal-access-tokens/revoke-for-user.ts

@@ -1,9 +1,9 @@
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   runnerCanBeginTransaction,
   transaction,
   updateMany,
-} from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+} from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/personal-access-tokens/roles.ts

@@ -1,11 +1,9 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { buildSessionRoles } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-// kumiko-lint-ignore cross-feature-import shared lifecycle-status gate with session auth
-import { isPrincipalBlocked } from "../sessions/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
-import { type UserStatus, userTable } from "../user/index.js";
+import { isPrincipalRowBlocked, type UserStatus, userTable } from "../user/index.js";
 
 // Live role resolution for a (userId, tenantId), mirroring login.write.ts:
 // global roles (users.roles) ∪ tenant-membership roles (forbidden roles
@@ -28,10 +26,14 @@ export async function resolvePatRoles(
   });
   const membership = memberships[0];
   if (!membership) return null;
-  const userRow = await fetchOne<{ roles: string | null; status: UserStatus }>(db, userTable, {
+  const userRow = await fetchOne<{
+    roles: string | null;
+    status: UserStatus;
+    isDeleted: boolean;
+  }>(db, userTable, {
     id: userId,
   });
-  if (userRow && isPrincipalBlocked(userRow.status)) return null;
+  if (userRow && isPrincipalRowBlocked(userRow)) return null;
   const globalRoles = parseRoles(userRow?.roles ?? null);
   return buildSessionRoles(globalRoles, parseRoles(membership.roles));
 }

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -35,6 +35,7 @@ const PAT_SCREEN_VISIBLE_WHEN = {
 export const patListScreen: ProjectionListScreenDefinition = {
   id: PAT_SCREEN_ID,
   type: "projectionList",
+  agent: { expose: false },
   visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
   query: PatQueries.mine,
   // The `mine` handler honours `limit` only (no offset/total), so a pager would
@@ -118,6 +119,7 @@ export function createPatMintScreen(scopes: PatScopeConfig): SecretMintScreenDef
   return {
     id: PAT_MINT_SCREEN_ID,
     type: "secretMint",
+    agent: { expose: false },
     visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
     handler: PatHandlers.create,
     fields: {

package/packages/bundled-features/src/readiness/feature.ts

@@ -11,21 +11,30 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { statusQuery } from "./handlers/status.query.js";
 
-export const readinessFeature = defineFeature("readiness", (r) => {
-  r.describe(
-    "One-call tenant-onboarding probe: `readiness:query:status` rolls up every config key and secret declared `required: true` across all mounted features and reports which still lack a usable value for the calling tenant, plus a single `ready` boolean. Provider-features under an `r.extensionSelector`-declared extension point count only while their provider is the selected one — a tenant on the inmemory mail transport is not blocked by unset SMTP keys. Mount it (together with `config` and `secrets`) when an admin UI needs a settings checklist before the first mail-send or file-write; the per-concern lists stay available via `config:query:readiness` and `secrets:query:list`.",
-  );
-  r.uiHints({
-    displayLabel: "Readiness · Onboarding Probe",
-    category: "operations",
-    recommended: false,
-  });
-  r.requires({ features: ["config"] });
-  r.requires({ features: ["secrets"] });
+export function createReadinessFeature() {
+  return defineFeature(
+    "readiness",
+    (r) => {
+      r.describe(
+        "One-call tenant-onboarding probe: `readiness:query:status` rolls up every config key and secret declared `required: true` across all mounted features and reports which still lack a usable value for the calling tenant, plus a single `ready` boolean. Provider-features under an `r.extensionSelector`-declared extension point count only while their provider is the selected one — a tenant on the inmemory mail transport is not blocked by unset SMTP keys. Mount it (together with `config` and `secrets`) when an admin UI needs a settings checklist before the first mail-send or file-write; the per-concern lists stay available via `config:query:readiness` and `secrets:query:list`.",
+      );
+      r.uiHints({
+        displayLabel: "Readiness · Onboarding Probe",
+        category: "operations",
+        recommended: false,
+      });
+      r.requires({ features: ["config"] });
+      r.requires({ features: ["secrets"] });
+
+      const queries = {
+        status: r.queryHandler(statusQuery),
+      };
 
-  const queries = {
-    status: r.queryHandler(statusQuery),
-  };
+      return { queries };
+    },
+    { dedupeOptions: {} },
+  );
+}
 
-  return { queries };
-});
+/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const readinessFeature = createReadinessFeature();

package/packages/bundled-features/src/readiness/index.ts

@@ -1,3 +1,3 @@
 export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { readinessFeature } from "./feature.js";
+export { createReadinessFeature, readinessFeature } from "./feature.js";
 export type { ReadinessMissingSecret } from "./handlers/status.query.js";