@cosmicdrift/kumiko-samples 0.367.0 → 0.369.0

package/packages/bundled-features/src/data-retention/run-retention-cleanup.ts

@@ -38,10 +38,10 @@
 // Rows weiter (reference bleibt alt), deshalb id-Cursor-Paging statt einer
 // einzelnen Page — sonst verstopfen erledigte Rows das batchLimit-Fenster.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   collectPiiSubjectFields,
   configuredPiiSubjectKms,
+  isRecordKeyedField,
   isSelfPiiField,
   type KmsAdapter,
   resolveSubjectForField,
@@ -53,6 +53,7 @@ import {
   createTenantDb,
   type DbRunner,
   nullBlindIndexesForSubject,
+  selectMany,
   type TenantDb,
   type WhereObject,
   WritePurposes,
@@ -160,10 +161,17 @@ async function purgeMatchingRows(
 // (purgeMatchingRows's hardDelete select) is enough; the with-files path's
 // full row works the same way.
 //
-// userOwned/tenantOwned are explicitly excluded: hardDelete only destroys
+// userOwned/tenantOwned are explicitly excluded (except a whenAbsent: "self" field
+// of an ownerless row, which resolves to this row's own record key): hardDelete only destroys
 // THIS row's own data, but the owning user's/tenant's key may still protect
 // OTHER live rows that reference the same subject — erasing it here would
 // be a silent cross-row data-loss bug, not a retention fix.
+function mayResolveToOwnRecordKey(field: EntityDefinition["fields"][string]): boolean {
+  if ("tenantOwned" in field && field.tenantOwned === true) return false;
+  if ("userOwned" in field && field.userOwned !== undefined) return isRecordKeyedField(field);
+  return ("recordOwned" in field && field.recordOwned === true) || isSelfPiiField(field);
+}
+
 function collectHardDeleteEraseSubjects(
   entity: EntityDefinition,
   entityName: string,
@@ -173,13 +181,11 @@ function collectHardDeleteEraseSubjects(
   const subjectsByKey = new Map<string, SubjectId>();
   for (const fieldName of collectPiiSubjectFields(entity)) {
     const field = entity.fields[fieldName];
-    if (!field) continue;
-    const isRecordOwned = "recordOwned" in field && field.recordOwned === true;
-    const isUserOwned = "userOwned" in field && field.userOwned !== undefined;
-    const isTenantOwned = "tenantOwned" in field && field.tenantOwned === true;
-    if (isUserOwned || isTenantOwned) continue; // never erase — see header comment
-    if (!isRecordOwned && !isSelfPiiField(field)) continue;
+    if (!field || !mayResolveToOwnRecordKey(field)) continue;
     const subject = resolveSubjectForField(entity, fieldName, row, { tenantId, entityName });
+    // whenAbsent: "self" resolves to the owner's key while the row has an owner — never erased here
+    const isUserOwned = "userOwned" in field && field.userOwned !== undefined;
+    if (isUserOwned && subject?.kind !== "record") continue;
     if (subject) subjectsByKey.set(subjectIdToKey(subject), subject);
   }
   return Array.from(subjectsByKey.values());
@@ -236,7 +242,7 @@ async function forgetRowAndEraseKeys(args: {
   readonly registry: Registry;
 }): Promise<{ readonly isSuccess: boolean }> {
   return runInSubTransaction(args.db, async (sp) => {
-    const tdb = createTenantDb(sp, args.tenantId, "system");
+    const tdb = createTenantDb({ db: sp, tenantId: args.tenantId, mode: "system" });
     const result = await args.executor.forget(
       { id: args.row["id"] as EntityId },
       args.systemUser,
@@ -666,7 +672,7 @@ export async function runRetentionCleanup(
   // the daily cron converges (hardDelete removes rows, softDelete's isDeleted
   // filter shrinks the set). A single batched forget/delete event is a follow-up.
   const systemUser = createSystemUser(tenantId);
-  const tdb = createTenantDb(db, tenantId, "system");
+  const tdb = createTenantDb({ db, tenantId, mode: "system" });
   const fileHolders = collectSingleFileHolders(registry);
 
   // Pre-load every override row for this tenant ONCE — N entities × M

package/packages/bundled-features/src/delivery/address-opt-out.ts

@@ -1,6 +1,9 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  fetchOne,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateDeterministicId } from "@cosmicdrift/kumiko-framework/utils";

package/packages/bundled-features/src/delivery/attempt-log-retention.ts

@@ -1,5 +1,5 @@
-import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/db";
 import { type PruneEventsOptions, pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
 import { deliveryAttemptsTable } from "./tables.js";
 

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "improvement",
+    "title": "Unsubscribe links in dev and a reusable result page",
+    "detail": "runDevApp accepts unsubscribe: { secret, tenantOrigin? } like runProdApp, mounts the unsubscribe routes and signs the links (base URL from auth.mail.baseUrl or APP_BASE_URL). Both share resolveUnsubscribeWiring from server-runtime. delivery exports renderUnsubscribeResultPage({ kind: \"unsubscribed\" | \"resubscribed\" | \"failed\", locale, resubscribeToken? }), the page the unsubscribe routes answer with, for apps that serve their own (e.g. legacy) unsubscribe links; without a resubscribeToken it offers no undo button."
+  },
   {
     "version": "0.367.0",
     "type": "improvement",

package/packages/bundled-features/src/delivery/channel-context.ts

@@ -148,7 +148,7 @@ export function buildChannelContext(
   filesForTenant?: (tenantId: string) => FileContext | undefined,
 ): ChannelContext {
   return {
-    db: createTenantDb(db, tenantId),
+    db: createTenantDb({ db, tenantId }),
     registry,
     sseBroker,
     tenantId,

package/packages/bundled-features/src/delivery/db/queries/address-opt-outs.ts

@@ -1,5 +1,5 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { notificationAddressOptOutsTable } from "../../tables.js";
 

package/packages/bundled-features/src/delivery/db/queries/preferences.ts

@@ -1,5 +1,5 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
 export type NotificationPreferenceRow = {

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -15,6 +15,7 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   assertNotificationVariables,
+  bridgeStub,
   createSystemUser,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
@@ -24,7 +25,6 @@ import {
   createEscapeHatchReporter,
 } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing/handler-context";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import type { Redis } from "ioredis";
 import { fileContextFromResolver } from "../file-foundation/index.js";
@@ -273,17 +273,27 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     // path a cross-tenant read the dispatcher never allows. Cross-tenant reach only
     // exists through the grant-carrying systemDb view below.
     const isSystem = registry.isHandlerSystemScoped(tenantUserIdsQuery);
-    const tenantDb = createTenantDb(run.db, tenantId, "tenant", undefined, undefined, undefined, {
-      report,
+    const tenantDb = createTenantDb({
+      db: run.db,
+      tenantId,
+      mode: "tenant",
+      grants: {
+        report,
+      },
     });
     // The dispatcher grants a systemScope handler's ctx.systemDb.unsafeRaw() ungated —
     // the grant comes from the handler's own r.systemScope() registration, not from this
     // caller. Only the systemDb view's own source TenantDb carries the grant, so it
     // can't leak onto ctx.db.
     const systemDbSourceTenantDb = isSystem
-      ? createTenantDb(run.db, tenantId, "system", undefined, undefined, undefined, {
-          report,
-          unsafeRaw: { reason: `r.systemScope() handler "${tenantUserIdsQuery}"` },
+      ? createTenantDb({
+          db: run.db,
+          tenantId,
+          mode: "system",
+          grants: {
+            report,
+            unsafeRaw: { reason: `r.systemScope() handler "${tenantUserIdsQuery}"` },
+          },
         })
       : undefined;
     // Hand-built context, not routed through the dispatcher — this needs both

package/packages/bundled-features/src/delivery/feature.ts

@@ -1,5 +1,5 @@
-import { updateMany, upsertByPk } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { updateMany, upsertByPk } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   defineFeature,
@@ -61,7 +61,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
   const attemptLogRetentionDays = resolveAttemptLogRetentionDays(options?.attemptLogRetentionDays);
   return defineFeature("delivery", (r) => {
     r.describe(
-      "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (`runProdApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
+      "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (the `runProdApp` and `runDevApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. An app serving its own (e.g. legacy) unsubscribe links renders the same result page with `renderUnsubscribeResultPage({ kind, locale })`. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
     );
     r.uiHints({
       displayLabel: "Notifications \u00b7 Dispatch Core",

package/packages/bundled-features/src/delivery/handlers/log.query.ts

@@ -1,8 +1,9 @@
-import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   decodeKeysetCursor,
   encodeKeysetCursor,
+  selectMany,
   type TenantDb,
+  type WhereObject,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
@@ -66,7 +67,7 @@ function isDeliveryLogSortField(value: string): value is DeliveryLogSortField {
 type DeliveryLogSortColumn = (typeof DELIVERY_LOG_SORT_COLUMNS)[DeliveryLogSortField];
 
 // createdAt round-trips through Temporal.Instant (matches how the WHERE
-// builder coerces timestamptz values — see bun-db/query.ts prepareValue);
+// builder coerces timestamptz values — see db/query.ts prepareValue);
 // every other whitelisted column is a plain text column. Keyed by the
 // PHYSICAL column, not the display alias — row only has the DB field names
 // (e.g. notificationType), never the alias (e.g. "type").

package/packages/bundled-features/src/delivery/handlers/preferences.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/delivery/index.ts

@@ -20,7 +20,11 @@ export {
   DEFAULT_ATTEMPT_LOG_RETENTION_DAYS,
   runAttemptLogRetention,
 } from "./attempt-log-retention.js";
-export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
+export {
+  buildChannelContext,
+  createEmailAttachmentReader,
+  createTemplateMailRenderer,
+} from "./channel-context.js";
 export {
   type ChatWebhookChannelOptions,
   chatMessageText,
@@ -67,6 +71,7 @@ export {
   type UnsubscribeAddressPayload,
   unsubscribeAddressPayloadSchema,
 } from "./handlers/unsubscribe-address.write.js";
+export { currentNotificationType } from "./notification-type-aliases.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export {
   deliveryAttemptsTable,
@@ -93,8 +98,10 @@ export {
   type AddressUnsubscribeTokenPayload,
   createUnsubscribeRoutes,
   DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
+  renderUnsubscribeResultPage,
   signAddressUnsubscribeToken,
   signUnsubscribeToken,
+  type UnsubscribeResultPage,
   type UnsubscribeRouteOptions,
   type UnsubscribeTokenPayload,
 } from "./unsubscribe.js";

package/packages/bundled-features/src/delivery/unsubscribe.ts

@@ -415,33 +415,48 @@ function confirmationPage(token: string, locale: string | undefined): string {
   );
 }
 
-function unsubscribedPage(resubscribeToken: string, locale: string | undefined): string {
-  const lang = pageLocale(locale);
-  return htmlPage(
-    lang,
-    mailT(lang, "mail.unsubscribe.doneTitle"),
-    `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>
+export type UnsubscribeResultPage =
+  // Without a resubscribeToken the page offers no undo button.
+  | { readonly kind: "unsubscribed"; readonly resubscribeToken?: string }
+  | { readonly kind: "resubscribed" }
+  | { readonly kind: "failed" };
+
+/** The plain result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`. */
+export function renderUnsubscribeResultPage(
+  page: UnsubscribeResultPage & { readonly locale?: string | undefined },
+): string {
+  const lang = pageLocale(page.locale);
+  switch (page.kind) {
+    case "unsubscribed": {
+      const undoForm =
+        page.resubscribeToken === undefined
+          ? ""
+          : `
 <form method="post" action="${DELIVERY_RESUBSCRIBE_PATH}">
-<input type="hidden" name="token" value="${escapeHtmlAttr(resubscribeToken)}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(page.resubscribeToken)}">
 <button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.undoButton"))}</button>
-</form>`,
-  );
-}
-
-function resubscribedPage(locale: string | undefined): string {
-  const lang = pageLocale(locale);
-  return htmlPage(
-    lang,
-    mailT(lang, "mail.unsubscribe.resubscribedTitle"),
-    `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`,
-  );
+</form>`;
+      return htmlPage(
+        lang,
+        mailT(lang, "mail.unsubscribe.doneTitle"),
+        `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>${undoForm}`,
+      );
+    }
+    case "resubscribed":
+      return htmlPage(
+        lang,
+        mailT(lang, "mail.unsubscribe.resubscribedTitle"),
+        `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`,
+      );
+    case "failed": {
+      const message = mailT(lang, "mail.unsubscribe.failed");
+      return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
+    }
+  }
 }
 
-function failedPage(locale: string | undefined): string {
-  const lang = pageLocale(locale);
-  const message = mailT(lang, "mail.unsubscribe.failed");
-  return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
-}
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" } as const;
 
 function isFormRequest(contentType: string | undefined): boolean {
   return contentType?.includes("application/x-www-form-urlencoded") === true;
@@ -516,12 +531,20 @@ export function createUnsubscribeRoutes(
       // (e.g. events-table missing, DB down) behind a misleading 400.
       const succeeded = await dispatchUnsubscribeWrite(verified, deps);
       if (!succeeded) {
-        return c.html(failedPage(verified.locale), 500, { "Cache-Control": "no-store" });
+        return c.html(
+          renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }),
+          500,
+          NO_STORE_HEADERS,
+        );
       }
       return c.html(
-        unsubscribedPage(await signResubscribeToken(verified, encodedSecret), verified.locale),
+        renderUnsubscribeResultPage({
+          kind: "unsubscribed",
+          resubscribeToken: await signResubscribeToken(verified, encodedSecret),
+          locale: verified.locale,
+        }),
         200,
-        { "Cache-Control": "no-store" },
+        NO_STORE_HEADERS,
       );
     },
   });
@@ -540,22 +563,28 @@ export function createUnsubscribeRoutes(
       // The undo button on the unsubscribed page posts a form; a browser should land on a page.
       if (isFormRequest(c.req.header("content-type"))) {
         return outcome === "success"
-          ? c.html(resubscribedPage(verified.locale), 200, { "Cache-Control": "no-store" })
-          : c.html(failedPage(verified.locale), outcome === "limit_reached" ? 409 : 500, {
-              "Cache-Control": "no-store",
-            });
+          ? c.html(
+              renderUnsubscribeResultPage({ kind: "resubscribed", locale: verified.locale }),
+              200,
+              NO_STORE_HEADERS,
+            )
+          : c.html(
+              renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }),
+              outcome === "limit_reached" ? 409 : 500,
+              NO_STORE_HEADERS,
+            );
       }
       if (outcome === "limit_reached") {
-        return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, {
-          "Cache-Control": "no-store",
-        });
+        return c.json(
+          { error: { code: DeliveryErrors.resubscribeLimitReached } },
+          409,
+          NO_STORE_HEADERS,
+        );
       }
       if (outcome === "failed") {
-        return c.json({ error: { code: "resubscribe_failed" } }, 500, {
-          "Cache-Control": "no-store",
-        });
+        return c.json({ error: { code: "resubscribe_failed" } }, 500, NO_STORE_HEADERS);
       }
-      return c.json({ isSuccess: true }, 200, { "Cache-Control": "no-store" });
+      return c.json({ isSuccess: true }, 200, NO_STORE_HEADERS);
     },
   });
 

package/packages/bundled-features/src/delivery/upsert-preference.ts

@@ -13,8 +13,11 @@
 // fall through to update, or no-op if the winner already set the target
 // `enabled` state.
 
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  fetchOne,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { generateDeterministicId } from "@cosmicdrift/kumiko-framework/utils";
 import { notificationPreferenceEntity, notificationPreferencesTable } from "./tables.js";

package/packages/bundled-features/src/derivatives-sharp/feature.ts

@@ -6,17 +6,26 @@ import { renderImage } from "./render.js";
 
 const FEATURE_NAME = "derivatives-sharp";
 
-export const derivativesSharpFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    "Registers an `image/*` renderer against the `derivativeRenderer` extension point declared by `file-derivatives`, backed by sharp. Supports resize/fit (cover, inside, contain), format conversion with quality (webp, avif, jpeg), whole-image blur, and blurring individual regions burned in before resize (see BlurRegion). EXIF orientation is applied and then normalized away, and all other EXIF (including GPS) is dropped. Server-only: sharp is a native binding — never import this from client code.",
+export function createDerivativesSharpFeature() {
+  return defineFeature(
+    FEATURE_NAME,
+    (r) => {
+      r.describe(
+        "Registers an `image/*` renderer against the `derivativeRenderer` extension point declared by `file-derivatives`, backed by sharp. Supports resize/fit (cover, inside, contain), format conversion with quality (webp, avif, jpeg), whole-image blur, and blurring individual regions burned in before resize (see BlurRegion). EXIF orientation is applied and then normalized away, and all other EXIF (including GPS) is dropped. Server-only: sharp is a native binding — never import this from client code.",
+      );
+      r.uiHints({
+        displayLabel: "File Derivatives · Sharp",
+        category: "storage",
+        recommended: false,
+      });
+      r.requires({ features: ["file-derivatives"] });
+
+      const plugin: DerivativeRendererPlugin = { render: renderImage };
+      r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);
+    },
+    { dedupeOptions: {} },
   );
-  r.uiHints({
-    displayLabel: "File Derivatives · Sharp",
-    category: "storage",
-    recommended: false,
-  });
-  r.requires({ features: ["file-derivatives"] });
+}
 
-  const plugin: DerivativeRendererPlugin = { render: renderImage };
-  r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);
-});
+/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const derivativesSharpFeature = createDerivativesSharpFeature();

package/packages/bundled-features/src/derivatives-sharp/index.ts

@@ -1,2 +1,2 @@
-export { derivativesSharpFeature } from "./feature.js";
+export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
 export { imageMetadata } from "./render.js";