@cosmicdrift/kumiko-samples 0.367.0 → 0.369.0

package/packages/bundled-features/src/tier-engine/handlers/get-tenant-tier.query.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, createTenantDb, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
@@ -25,7 +24,7 @@ export const getTenantTierQuery = defineQueryHandler({
   },
   handler: async (query, ctx) => {
     const tenantId = query.payload.tenantId as TenantId; // @cast-boundary engine-bridge
-    const tdb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
+    const tdb = createTenantDb({ db: ctx.db.unsafeRaw(), tenantId, mode: "system" });
     const row = await fetchOne<TierAssignmentRow>(tdb, tierAssignmentTable, { tenantId });
     return row ?? null;
   },

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -1,5 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable, createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  buildEntityTable,
+  createEventStoreExecutor,
+  fetchOne,
+} from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";

package/packages/bundled-features/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.368.0",
+    "type": "fix",
+    "title": "Soft-deleted users no longer count as active principals",
+    "detail": "A user deleted through the entity executor keeps its last status (usually active) with isDeleted set. principalStatusPlugin, the session checker and the PAT role resolver only looked at the status, so existing sessions and tokens of such a user stayed valid. They now treat isDeleted as blocked (session \"blocked\", PAT 401, principal_blocked for membership resolution) through the new isPrincipalRowBlocked predicate."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/user/db/queries/stream-tenant-backfill.ts

@@ -24,8 +24,8 @@
 // the stream move: rebuildProjection("user:projection:user-entity", ...) or
 // the jobs:job:projection-rebuild job.
 
-import { asRawClient, transaction, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { asRawClient, transaction, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 
 export type UserStreamBackfillResult = {

package/packages/bundled-features/src/user/handlers/create.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineWriteHandler,
   findForbiddenRoleAssignment,

package/packages/bundled-features/src/user/handlers/find-for-auth.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/user/handlers/list.query.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   defineEntityListHandler,

package/packages/bundled-features/src/user/handlers/update-roles.ts

@@ -1,8 +1,9 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   acquireNamespacedAdvisoryLock,
   createEventStoreExecutor,
   type DbRunner,
+  fetchOne,
+  selectMany,
   type TenantDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {

package/packages/bundled-features/src/user/index.ts

@@ -5,7 +5,11 @@ export {
   type UserStreamBackfillResult,
 } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
-export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export {
+  isPrincipalBlocked,
+  isPrincipalRowBlocked,
+  principalStatusPlugin,
+} from "./principal-status.js";
 export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export type { UserStatus } from "./schema/user.js";
 export {

package/packages/bundled-features/src/user/invited-global-roles.ts

@@ -1,8 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
@@ -45,7 +45,7 @@ export async function grantInvitedGlobalRoles(
   const updateResult = await userExecutor.update(
     { id: existing.id, version: existing.version, changes: { roles } },
     createSystemUser(SYSTEM_TENANT_ID),
-    createTenantDb(db, SYSTEM_TENANT_ID, "system"),
+    createTenantDb({ db, tenantId: SYSTEM_TENANT_ID, mode: "system" }),
   );
   if (!updateResult.isSuccess) return updateResult;
   return grantedGlobalRoles(roles);

package/packages/bundled-features/src/user/principal-status.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type {
   PrincipalProfile,
   PrincipalStatus,
@@ -20,13 +20,23 @@ export function isPrincipalBlocked(status: UserStatus): boolean {
   return BLOCKED_STATUSES.has(status);
 }
 
+// A soft-deleted row (executor.delete) keeps its last status, so isDeleted must block on its own.
+export function isPrincipalRowBlocked(row: {
+  readonly status: UserStatus;
+  readonly isDeleted: boolean;
+}): boolean {
+  return row.isDeleted || isPrincipalBlocked(row.status);
+}
+
 // Registered via r.useExtension(EXT_PRINCIPAL_STATUS, "user", principalStatusPlugin)
 // so resolveActiveMembershipFn can reject a blocked principal without knowing about `user`'s table.
 export const principalStatusPlugin: PrincipalStatusPlugin = {
   async resolveStatus(userId, { db }): Promise<PrincipalStatus> {
-    const row = await fetchOne<{ status: UserStatus }>(db, userTable, { id: userId });
+    const row = await fetchOne<{ status: UserStatus; isDeleted: boolean }>(db, userTable, {
+      id: userId,
+    });
     if (!row) return "unknown";
-    return isPrincipalBlocked(row.status) ? "blocked" : "active";
+    return isPrincipalRowBlocked(row) ? "blocked" : "active";
   },
 
   // ctx.queryAsMember's global-roles/timezone/locale source — same fields

package/packages/bundled-features/src/user/resolve-display-names.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
 import { userTable } from "./schema/user.js";
 

package/packages/bundled-features/src/user/seeding.ts

@@ -10,15 +10,15 @@
 // (audit, search-index) sehen den Seed. Der Executor-Pfad emittiert
 // das Event UND schreibt die Projection-Zeile in einer TX.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEventStoreExecutor,
   createTenantDb,
   type DbConnection,
+  fetchOne,
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 // kumiko-lint-ignore cross-feature-import shares the postSave-hooks fixture contract with tenant/seeding (#1478)
 import { fireEntityPostSave, type SeedTenantHooks } from "../tenant/seeding.js";
 import { userEntity, userTable } from "./schema/user.js";
@@ -65,7 +65,7 @@ export async function seedUser(
   // executor.create erwartet eine TenantDb (mit .insert()-API). User
   // ist zwar tenant-agnostic (kein tenant_id-Spalte), aber das runtime-
   // Interface braucht den Wrap.
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
 
   const existing = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
@@ -111,7 +111,7 @@ export async function reconcileSeededUserEmailVerified(
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
   // liefert die Projection-Row als Record<string, unknown>.
   const id = existingRow["id"] as string;
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
   const result = await userExecutor.update(
     { id, version: existingRow["version"] as number, changes: { emailVerified: true } },
     by,
@@ -157,7 +157,7 @@ export async function rewriteSeededUserEmail(
     // skip: the stored blind index already matches, a rewrite would only append a no-op event.
     if (indexed) return;
   }
-  const tdb = createTenantDb(db, by.tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId: by.tenantId, mode: "system" });
   const result = await userExecutor.update({ id, version, changes: { email } }, by, tdb);
   // version_conflict: a concurrent write already changed the row — fine for a seed helper.
   // unique_violation: a duplicate row already holds the blind index; the repair

package/packages/bundled-features/src/user-data-rights/audit-download.ts

@@ -54,7 +54,7 @@ export interface RecordDownloadUseArgs {
 export async function recordDownloadUse(args: RecordDownloadUseArgs): Promise<void> {
   const { db, tokenId, tokenVersion, tokenUseCount, tenantId, now, ip, userAgent } = args;
   const executor = createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
 
   await tokenCrud
     .update(
@@ -103,7 +103,7 @@ export interface RecordInvalidAttemptArgs {
 export async function recordInvalidAttempt(args: RecordInvalidAttemptArgs): Promise<void> {
   const { db, tenantId, now } = args;
   const executor = createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
   await attemptCrud
     .create(
       {

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "fix",
+    "title": "The \"account deleted\" mail is sent through channel-email when delivery is mounted",
+    "detail": "The default mailer for the Art. 17 deletion confirmation called createTransportForTenant directly, which threw for a tenant without its own mail provider. With delivery and channel-email mounted it now sends through the email channel like the other GDPR mails, over the app transport, without writing a delivery-attempt row for the already erased user. Without channel-email the previous path stays."
+  },
   {
     "version": "0.367.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/db/queries/export-jobs.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { exportJobsTable } from "../../schema/export-job.js";

package/packages/bundled-features/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -719,17 +719,20 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           userId: forgetUserId,
         });
 
-        // Without an app callback the default mail goes out when a mail transport and a
-        // mail renderer are mounted. The user is already erased here, so it bypasses the
-        // delivery log: an attempt row would be new personal data.
+        // Without an app callback the default mail goes out when an email channel or a
+        // mail transport, plus a mail renderer, are mounted. The user is already erased
+        // here, so it bypasses the delivery log: an attempt row would be new personal data.
         const forgetConfigResolver = ctx.configResolver;
         const sendDeletionExecutedEmail =
           opts.sendDeletionExecutedEmail ??
-          (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+          ((isGdprMailDeliveryAvailable(forgetRegistry) ||
+            isMailTransportAvailable(forgetRegistry)) &&
+          isMailRendererAvailable(forgetRegistry)
             ? makeDefaultDeletionExecutedEmail(
                 {
                   registry: forgetRegistry,
                   db: forgetDb,
+                  ...(ctx.secrets !== undefined && { secrets: ctx.secrets }),
                   resolveTransport: makeTenantMailTransportResolver({
                     registry: forgetRegistry,
                     configResolver: forgetConfigResolver,

package/packages/bundled-features/src/user-data-rights/handlers/download-by-job.query.ts

@@ -24,7 +24,7 @@
 //   7. Return {url, expiresAt}
 
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   SYSTEM_USER_ID,

package/packages/bundled-features/src/user-data-rights/handlers/download-by-token.query.ts

@@ -26,7 +26,7 @@
 // signedUrl — User klickt 1× Email-Link, Browser folgt redirect, Download
 // startet. Dieser query-handler liefert nur das JSON.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineQueryHandler,
   SYSTEM_USER_ID,

package/packages/bundled-features/src/user-data-rights/handlers/export-status.query.ts

@@ -11,7 +11,7 @@
 // **Read-Only-Endpoint:** Pollt nur, kein State-Flip. Idempotent + cache-
 // fest. UI poll-Intervall typisch 2-5s waehrend running.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";

package/packages/bundled-features/src/user-data-rights/handlers/list-download-attempts.query.ts

@@ -1,4 +1,4 @@
-import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";

package/packages/bundled-features/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -1,4 +1,4 @@
-import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";

package/packages/bundled-features/src/user-data-rights/handlers/request-export.write.ts

@@ -20,8 +20,7 @@
 // 1. Klick — Worker liest sein Compliance-Profile aus DIESEM Tenant
 // fuer Job-TTL/Stale/Cleanup.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SaveContext } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";

package/packages/bundled-features/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -11,7 +11,7 @@
 // Rueckgabe: Stats fuer Operator-Monitoring (processed-count, error-list).
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { access, defineWriteHandler, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
@@ -58,7 +58,7 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
         registry: ctx.registry,
         configResolver: ctx.configResolver,
         db: forgetDb,
-        userId: ctx._userId ?? SYSTEM_USER_ID,
+        userId: ctx.user.id,
       });
       const result = await runForgetCleanup({
         db: runner,
@@ -71,7 +71,7 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
           configResolver: ctx.configResolver,
           secrets: ctx.secrets,
           db: forgetDb,
-          userId: ctx._userId ?? SYSTEM_USER_ID,
+          userId: ctx.user.id,
           handlerName: "user-data-rights:run-forget-cleanup",
         }),
         ...(opts.sendDeletionExecutedEmail && {

package/packages/bundled-features/src/user-data-rights/lib/default-mailers.ts

@@ -7,8 +7,8 @@
 // to the user, so delivery resolves the address and the attempt row carries
 // the recipientId the forget path erases. Deletion-executed cannot: the user
 // is gone by then, and an attempt row written after the erasure would be new
-// personal data. It renders the seeded template and sends over the tenant's
-// mail transport, with no delivery log.
+// personal data. It renders the seeded template and sends it straight through the
+// email channel (or, without one, the tenant's mail transport), with no delivery log.
 
 import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
@@ -21,7 +21,14 @@ import type {
   TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { hasMailTranslations, mailT } from "@cosmicdrift/kumiko-framework/i18n";
-import { DELIVERY_CHANNEL_EXTENSION } from "../../delivery/index.js";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  buildChannelContext,
+  collectChannels,
+  DELIVERY_CHANNEL_EXTENSION,
+  type DeliveryChannel,
+  EMAIL_CHANNEL_NAME,
+} from "../../delivery/index.js";
 import {
   collectRendererPlugins,
   createRendererFoundationApi,
@@ -145,10 +152,16 @@ export function makeDefaultDeletionRequestedEmail(
 export type DeletionExecutedMailDeps = {
   readonly registry: Registry;
   readonly db: DbConnection;
+  /** Used only when no email delivery channel is mounted. */
   readonly resolveTransport: (tenantId: string) => Promise<EmailTransport>;
   readonly configFor: (tenantId: TenantId) => ConfigAccessor | undefined;
+  readonly secrets?: SecretsContext;
 };
 
+function emailChannelOf(registry: Registry): DeliveryChannel | undefined {
+  return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
+
 export function makeDefaultDeletionExecutedEmail(
   deps: DeletionExecutedMailDeps,
   defaults: GdprMailDefaults = {},
@@ -190,6 +203,30 @@ export function makeDefaultDeletionExecutedEmail(
     if (rendered.kind !== "mail") {
       throw new Error(`deletion-executed mail: renderer answered with kind "${rendered.kind}"`);
     }
+    // The channel picks the same transport as every other mail of this notification
+    // (the app transport unless it is declared tenantTransport), so a tenant without
+    // its own mail provider still gets the confirmation. channel.send writes no attempt row.
+    const channel = emailChannelOf(deps.registry);
+    if (channel !== undefined) {
+      const result = await channel.send(
+        args.userEmail,
+        {
+          notificationType: type,
+          title: rendered.subject,
+          body: undefined,
+          data: undefined,
+          locale,
+        },
+        buildChannelContext(deps.db, deps.registry, undefined, tenantId, deps.secrets, config),
+        { subject: rendered.subject, html: rendered.html, text: rendered.text },
+      );
+      if (result.status !== "sent") {
+        // No address in the message: the user is already erased.
+        throw new Error(`deletion-executed mail not sent: ${result.error ?? result.status}`);
+      }
+      // skip: the channel delivered it, the transport fallback below is for apps without one
+      return;
+    }
     const transport = await deps.resolveTransport(tenantId);
     await transport.send({
       to: args.userEmail,

package/packages/bundled-features/src/user-data-rights/lib/deny-if-target-outside-admin-tenant.ts

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import {
   AccessDeniedError,

package/packages/bundled-features/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -1,8 +1,8 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEventStoreExecutor,
   createTenantDb,
+  selectMany,
   type WritePurpose,
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
@@ -34,6 +34,10 @@ export type UpdateUserLifecycleOptions = {
   // Erasure flows run after the subject key is erased; the write then stores the
   // erased sentinel instead of failing on re-encrypt.
   readonly writePurpose?: WritePurpose;
+  // Also address a row the stream has already soft-deleted. Only erasure needs
+  // this: a deleted stream with a still-`active` status must still get its
+  // status event so the login door closes.
+  readonly includeDeleted?: boolean;
 };
 
 // `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
@@ -61,7 +65,7 @@ export async function updateUserLifecycle(
   // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
   // version to pass as `payload.version`, which update() requires otherwise.
   // Callers needing a guard use `options.expect` instead.
-  const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
+  const tenantDb = createTenantDb({ db: conn, tenantId: SYSTEM_TENANT_ID, mode: "system" });
   const result = await userExecutor.update(
     { id: userId, changes },
     createSystemUser(SYSTEM_TENANT_ID),
@@ -70,6 +74,7 @@ export async function updateUserLifecycle(
       skipOptimisticLock: true,
       ...(options?.expect && { expect: options.expect }),
       ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+      ...(options?.includeDeleted && { includeDeleted: true }),
     },
   );
 

package/packages/bundled-features/src/user-data-rights/run-export-jobs.ts

@@ -45,11 +45,15 @@ import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 // (`expiresAt + exportStorageCleanupGraceHours < now`) — abgelaufene ZIPs
 // auf S3 sollen nicht ewig liegen.
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  fetchOne,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/db";
 import type {
   EscapeHatchAuditSink,
   Registry,
@@ -811,7 +815,7 @@ function reportCleanupLastRun(metrics: MetricsHandle | undefined, now: Instant):
 // Stream-Counter konsistent bleibt (Memory feedback_event_store_tenant_consistency).
 // @wrapper-known semantic-alias
 function systemTenantDb(db: DbConnection, tenantId: TenantId) {
-  return createTenantDb(db, tenantId, "system");
+  return createTenantDb({ db, tenantId, mode: "system" });
 }
 
 function buildExportStorageKey(job: JobRow): string {

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -35,7 +35,6 @@ import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework
 // gefailten Hooks bleibt im DeletionRequested-Status (next Lauf
 // retried automatisch).
 
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   type KmsAdapter,
@@ -46,7 +45,9 @@ import {
   type DbRunner,
   entityEventName,
   executeRawQuery,
+  fetchOne,
   nullBlindIndexesForSubject,
+  selectMany,
   WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -225,10 +226,15 @@ function buildHookDb(
     sink: args.escapeHatchAuditSink,
     log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
   });
-  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-    unsafeRaw:
-      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-    report,
+  return createTenantDb({
+    db,
+    tenantId,
+    mode: "tenant",
+    grants: {
+      unsafeRaw:
+        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+      report,
+    },
   });
 }
 

package/packages/bundled-features/src/user-data-rights/run-user-export.ts

@@ -21,7 +21,6 @@ import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework
 // landen. user-data-rights-defaults/hooks/user.userdata-hook expose
 // expliziert KEIN passwordHash + KEINE roles (privileged columns).
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
@@ -33,6 +32,7 @@ import {
   configuredEntityFieldEncryption,
   createTenantDb,
   decryptEntityFieldValues,
+  selectMany,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   type EscapeHatchAuditSink,
@@ -121,10 +121,15 @@ function buildHookDb(
     sink: args.escapeHatchAuditSink,
     log: args.escapeHatchAuditLog ?? createFallbackLogger("user-data-rights"),
   });
-  return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {
-    unsafeRaw:
-      entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
-    report,
+  return createTenantDb({
+    db,
+    tenantId,
+    mode: "tenant",
+    grants: {
+      unsafeRaw:
+        entry.escapeHatchReason !== undefined ? { reason: entry.escapeHatchReason } : undefined,
+      report,
+    },
   });
 }
 

package/packages/bundled-features/src/waitlist/handlers/invite.write.ts

@@ -1,5 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,

package/packages/bundled-features/src/waitlist/handlers/reject.write.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,

package/packages/bundled-features/src/waitlist/lib.ts

@@ -1,5 +1,8 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  fetchOne,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createSystemUser,

package/packages/bundled-features/src/workflow-runner/event-subscriber.ts

@@ -24,7 +24,7 @@
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
 
-import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import type {
   FeatureRegistrar,
   MultiStreamApplyFn,