@cosmicdrift/kumiko-bundled-features 0.197.1 → 0.199.0

package/src/delivery/jobs.ts

@@ -7,11 +7,12 @@
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type {
-  AppContext,
+  JobContext,
   JobHandlerFn,
   Registry,
   TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import { z } from "zod";
 import { appendAttemptEvent } from "./attempt-log";
@@ -44,13 +45,22 @@ const sendJobPayloadSchema = renderJobPayloadSchema.extend({
 
 type RenderJobPayload = z.infer<typeof renderJobPayloadSchema>;
 
-function requireDeps(ctx: AppContext): { db: DbConnection; registry: Registry } {
+function requireTenantScopedDeps(
+  ctx: JobContext,
+  tenantId: TenantId,
+): { db: DbConnection; registry: Registry } {
   const registry = ctx.registry;
   if (!registry) throw new Error("delivery job: missing registry in job context");
-  // Job context provides the raw system connection (not tenant-scoped); the
-  // append + projection layer scopes per event payload.
-  const db = ctx.db as DbConnection; // @cast-boundary engine-bridge — job ctx db is the system connection
-  if (!db) throw new Error("delivery job: missing db in job context");
+  // delivery is r.systemScope()'d (feature.ts), so JobContext.systemDb is
+  // guaranteed here. assertTenantMatch(tenantId).raw hands appendAttemptEvent/
+  // buildChannelContext the underlying DbConnection — safe because both
+  // filter by the same tenantId themselves (see JobContext.systemDb doc).
+  if (!ctx.systemDb) {
+    throw new InternalError({
+      message: "delivery job: ctx.systemDb missing on a system-scoped job",
+    });
+  }
+  const db = ctx.systemDb.assertTenantMatch(tenantId).raw as DbConnection; // @cast-boundary db-operator — TenantDb.raw is DbRunner, jobs never run inside a DbTx
   return { db, registry };
 }
 
@@ -96,9 +106,9 @@ function messageOf(err: unknown): string {
 // the send step is never reached, so a stuck render can't half-send.
 export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
   const p = renderJobPayloadSchema.parse(payload);
-  const { db, registry } = requireDeps(ctx);
-  const channel = resolveChannel(registry, p.channelName);
   const tenantId = p.tenantId as TenantId; // @cast-boundary engine-payload — stream tenant
+  const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
+  const channel = resolveChannel(registry, p.channelName);
   const channelCtx = buildChannelContext(db, registry, undefined, tenantId);
 
   try {
@@ -128,9 +138,9 @@ export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
 // the same already-rendered HTML — no re-render needed.
 export const deliverySendJob: JobHandlerFn = async (payload, ctx) => {
   const p = sendJobPayloadSchema.parse(payload);
-  const { db, registry } = requireDeps(ctx);
-  const channel = resolveChannel(registry, p.channelName);
   const tenantId = p.tenantId as TenantId; // @cast-boundary engine-payload — stream tenant
+  const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
+  const channel = resolveChannel(registry, p.channelName);
   const channelCtx = buildChannelContext(db, registry, undefined, tenantId);
 
   try {

package/src/derivatives-sharp/__tests__/render.test.ts

@@ -225,6 +225,54 @@ describe("renderImage — validation", () => {
     await expect(renderImage(input, {}, "constructor")).rejects.toThrow(/no output encoder/);
   });
 
+  test("blurRegions beyond the cap throws instead of re-decoding the image once per region", async () => {
+    const input = await jpegFixture(50, 50);
+    const tooManyRegions = Array.from({ length: 65 }, () => ({
+      x: 0.1,
+      y: 0.1,
+      width: 0.1,
+      height: 0.1,
+    }));
+    await expect(renderImage(input, { blurRegions: tooManyRegions }, "image/jpeg")).rejects.toThrow(
+      /blurRegions/,
+    );
+  });
+
+  test("64 blurRegions (at the cap) is accepted", async () => {
+    const input = await jpegFixture(200, 200);
+    const regions = Array.from({ length: 64 }, (_, i) => ({
+      x: 0.01 * i,
+      y: 0.01 * i,
+      width: 0.01,
+      height: 0.01,
+    }));
+    await expect(renderImage(input, { blurRegions: regions }, "image/jpeg")).resolves.toBeTruthy();
+  });
+
+  test("size.width/size.height beyond MAX_OUTPUT_EDGE throws instead of allocating an oversized buffer", async () => {
+    const input = await jpegFixture(50, 50);
+    await expect(
+      renderImage(input, { size: { width: 50000, height: 50000 } }, "image/jpeg"),
+    ).rejects.toThrow(/size\.width/);
+  });
+
+  test("maxEdge beyond MAX_OUTPUT_EDGE throws", async () => {
+    const input = await jpegFixture(50, 50);
+    await expect(renderImage(input, { maxEdge: 50000 }, "image/jpeg")).rejects.toThrow(/maxEdge/);
+  });
+
+  test("maxEdge: 0 is rejected, not silently ignored by the resize branch's truthiness check", async () => {
+    const input = await jpegFixture(50, 50);
+    await expect(renderImage(input, { maxEdge: 0 }, "image/jpeg")).rejects.toThrow(/maxEdge/);
+  });
+
+  test("a non-integer size.width throws", async () => {
+    const input = await jpegFixture(50, 50);
+    await expect(
+      renderImage(input, { size: { width: 100.5, height: 100 } }, "image/jpeg"),
+    ).rejects.toThrow(/size\.width/);
+  });
+
   test("image/png ignores spec.quality instead of switching into lossy palette quantization", async () => {
     const input = await pngFixture(50, 50);
     const withQuality = await renderImage(input, { quality: 10 }, "image/png");

package/src/derivatives-sharp/render.ts

@@ -13,6 +13,23 @@ import sharp from "sharp";
 
 const MIN_SHARP_SIGMA = 0.3;
 const MAX_SHARP_SIGMA = 1000;
+// Above this, a decoded pixel buffer runs into hundreds of MB before any
+// resize even happens — sharp's own default (~268MP) is still large enough
+// to be an OOM primitive for a single request.
+const MAX_INPUT_PIXELS = 100_000_000;
+// Longest output edge a caller may request via `size`/`maxEdge`. Without a
+// cap, `{ maxEdge: 50000 }` allocates a multi-gigabyte buffer per encoder
+// step before any client sees a byte back.
+const MAX_OUTPUT_EDGE = 8192;
+// applyBlurRegions decodes the full image fresh for every region — an
+// unbounded region list is a CPU/RAM-multiplying DoS knob independent of
+// output size.
+const MAX_BLUR_REGIONS = 64;
+// sequentialRead trades random pixel access for lower peak memory on
+// streamed formats — applied at every decode entry point below since none
+// of them need non-sequential access to the *original* bytes (extract runs
+// against a single already-buffered region per call).
+const SHARP_INPUT_OPTIONS = { limitInputPixels: MAX_INPUT_PIXELS, sequentialRead: true } as const;
 
 function normalizeMimeType(mimeType: string): string {
   return mimeType.toLowerCase().split(";")[0]?.trim() ?? "";
@@ -58,7 +75,7 @@ async function applyBlurRegions(
     // input) — good enough until a caller needs to tune blur strength itself.
     const sigma = clampSigma(Math.max(4, Math.min(rectWidth, rectHeight) / 6));
 
-    const patch = await sharp(data)
+    const patch = await sharp(data, SHARP_INPUT_OPTIONS)
       .extract({ left, top, width: rectWidth, height: rectHeight })
       .blur(sigma)
       .toBuffer();
@@ -66,7 +83,7 @@ async function applyBlurRegions(
   }
 
   if (overlays.length === 0) return data;
-  return sharp(data).composite(overlays).toBuffer();
+  return sharp(data, SHARP_INPUT_OPTIONS).composite(overlays).toBuffer();
 }
 
 function buildResizeOptions(width: number, height: number, fit: VariantFit): ResizeOptions {
@@ -136,6 +153,36 @@ function applyEncoder(pipeline: Sharp, spec: VariantSpec, sourceMimeType: string
   return encode(pipeline, quality);
 }
 
+// Input-validation for the DoS caps above — kept out of renderImage so the
+// complexity hotspot stays under the AST-guard budget.
+function assertRenderSpecBounds(spec: VariantSpec): void {
+  if (spec.quality !== undefined && (spec.quality < 1 || spec.quality > 100)) {
+    throw new Error(`derivatives-sharp: quality ${spec.quality} is out of range (1–100).`);
+  }
+  if (spec.blur !== undefined && (spec.blur < MIN_SHARP_SIGMA || spec.blur > MAX_SHARP_SIGMA)) {
+    throw new Error(
+      `derivatives-sharp: blur sigma ${spec.blur} is out of sharp's supported range (${MIN_SHARP_SIGMA}–${MAX_SHARP_SIGMA}).`,
+    );
+  }
+  if (spec.blurRegions && spec.blurRegions.length > MAX_BLUR_REGIONS) {
+    throw new Error(
+      `derivatives-sharp: blurRegions has ${spec.blurRegions.length} entries, exceeding the limit of ${MAX_BLUR_REGIONS} — each region re-decodes the full image.`,
+    );
+  }
+  for (const [dimension, value] of [
+    ["size.width", spec.size?.width],
+    ["size.height", spec.size?.height],
+    ["maxEdge", spec.maxEdge],
+  ] as const) {
+    if (value === undefined) continue;
+    if (!Number.isInteger(value) || value < 1 || value > MAX_OUTPUT_EDGE) {
+      throw new Error(
+        `derivatives-sharp: ${dimension} ${value} is out of range — must be an integer between 1 and ${MAX_OUTPUT_EDGE}.`,
+      );
+    }
+  }
+}
+
 export const renderImage: DerivativeRendererPlugin["render"] = async (
   input,
   spec,
@@ -146,38 +193,31 @@ export const renderImage: DerivativeRendererPlugin["render"] = async (
   // sourceMimeType is a client-declared upload label, not sniffed — decide
   // the SVG rejection from the actual bytes so a mislabeled upload can't
   // reach libvips as SVG.
-  const sniffed = await sharp(input).metadata();
+  const sniffed = await sharp(input, SHARP_INPUT_OPTIONS).metadata();
   if (sniffed.format === "svg") {
     throw new Error(
       "derivatives-sharp: SVG is not supported — rendering untrusted SVG through libvips is a trust boundary this renderer doesn't need to cross.",
     );
   }
 
-  if (spec.quality !== undefined && (spec.quality < 1 || spec.quality > 100)) {
-    throw new Error(`derivatives-sharp: quality ${spec.quality} is out of range (1–100).`);
-  }
-  if (spec.blur !== undefined && (spec.blur < MIN_SHARP_SIGMA || spec.blur > MAX_SHARP_SIGMA)) {
-    throw new Error(
-      `derivatives-sharp: blur sigma ${spec.blur} is out of sharp's supported range (${MIN_SHARP_SIGMA}–${MAX_SHARP_SIGMA}).`,
-    );
-  }
+  assertRenderSpecBounds(spec);
 
   // rotate() with no argument applies the EXIF orientation and normalizes it
   // away. sharp drops all other metadata by default — we never call
   // .withMetadata()/.keepExif(), which is exactly what strips GPS/EXIF from
   // the output.
-  let pipeline = sharp(input).rotate();
+  let pipeline = sharp(input, SHARP_INPUT_OPTIONS).rotate();
 
   if (spec.blurRegions && spec.blurRegions.length > 0) {
     const { data, info } = await pipeline.toBuffer({ resolveWithObject: true });
     const blurred = await applyBlurRegions(data, info.width, info.height, spec.blurRegions);
-    pipeline = sharp(blurred);
+    pipeline = sharp(blurred, SHARP_INPUT_OPTIONS);
   }
 
   const fit = spec.fit ?? "inside";
   if (spec.size) {
     pipeline = pipeline.resize(buildResizeOptions(spec.size.width, spec.size.height, fit));
-  } else if (spec.maxEdge) {
+  } else if (spec.maxEdge !== undefined) {
     pipeline = pipeline.resize(buildResizeOptions(spec.maxEdge, spec.maxEdge, fit));
   }
 
@@ -194,7 +234,7 @@ export const renderImage: DerivativeRendererPlugin["render"] = async (
 export async function imageMetadata(
   input: Uint8Array,
 ): Promise<{ width: number; height: number; format: string }> {
-  const metadata = await sharp(input).metadata();
+  const metadata = await sharp(input, SHARP_INPUT_OPTIONS).metadata();
   const width = metadata.autoOrient.width;
   const height = metadata.autoOrient.height;
   if (!Number.isFinite(width) || !Number.isFinite(height) || !metadata.format) {

package/src/feature-toggles/__tests__/acknowledge-cross-tenant.test.ts

@@ -0,0 +1,23 @@
+// framework#2076: set.write / registered.query / list.query all read/write
+// globalFeatureStateTable via ctx.systemDb.acknowledgeCrossTenant(...) instead
+// of ctx.db directly. That only resolves correctly as long as the
+// feature-toggles feature stays r.systemScope() (feature.ts) — buildHandlerContext
+// only populates ctx.systemDb for system-scoped handlers (dispatch-shared.ts).
+// This test pins that coupling so a future refactor that drops r.systemScope()
+// fails loudly here instead of surfacing as "undefined.acknowledgeCrossTenant"
+// deep inside a handler.
+
+import { describe, expect, test } from "bun:test";
+import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { FeatureToggleHandlers, FeatureToggleQueries } from "../constants";
+import { createFeatureTogglesFeature } from "../feature";
+
+describe("feature-toggles handlers stay r.systemScope()-coupled", () => {
+  const registry = createRegistry([createFeatureTogglesFeature()]);
+
+  test("set/list/registered are all system-scoped", () => {
+    expect(registry.isHandlerSystemScoped(FeatureToggleHandlers.set)).toBe(true);
+    expect(registry.isHandlerSystemScoped(FeatureToggleQueries.list)).toBe(true);
+    expect(registry.isHandlerSystemScoped(FeatureToggleQueries.registered)).toBe(true);
+  });
+});

package/src/feature-toggles/constants.ts

@@ -10,6 +10,12 @@ export const FEATURE_TOGGLE_SET_EVENT_NAME = "feature-toggles:event:toggle-set";
 // "feature-toggles" in its aggregate_type column.
 export const FEATURE_TOGGLE_AGGREGATE_TYPE = "feature-toggles";
 
+// Shared acknowledgeCrossTenant() reason across all three handlers that read
+// or write globalFeatureStateTable — one string so the three call sites
+// can't drift (framework#2076).
+export const FEATURE_TOGGLE_CROSS_TENANT_REASON =
+  "global feature-toggle state, no tenant scope by design";
+
 // Error reasons surfaced from feature-toggle handlers. Scoped to the
 // feature's namespace per the framework's reason-convention.
 export const FeatureToggleErrors = {

package/src/feature-toggles/handlers/list.query.ts

@@ -1,6 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../constants";
 import { globalFeatureStateTable } from "../global-feature-state-table";
 
 // List every row in the global_feature_state table — i.e. every feature
@@ -12,6 +13,16 @@ export const listQuery = defineQueryHandler({
   schema: z.object({}),
   access: { roles: ["SystemAdmin"] },
   handler: async (_event, ctx) => {
+    // ctx.systemDb is populated for r.systemScope() handlers only (feature.ts
+    // declares it) — guarded instead of asserted, see set.write.ts Guard 0.5.
+    if (!ctx.systemDb) {
+      throw new Error(
+        "[feature-toggles] list-query requires ctx.systemDb — the feature-toggles " +
+          "feature must stay r.systemScope() (see feature.ts).",
+      );
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant(FEATURE_TOGGLE_CROSS_TENANT_REASON);
+
     type Row = {
       featureName: string;
       enabled: boolean;
@@ -19,7 +30,7 @@ export const listQuery = defineQueryHandler({
       updatedAt: Temporal.Instant;
       updatedBy: string;
     };
-    const rows = await selectMany<Row>(ctx.db.raw, globalFeatureStateTable);
+    const rows = await selectMany<Row>(db.raw, globalFeatureStateTable);
     return {
       items: rows.map((r) => ({
         featureName: r.featureName,

package/src/feature-toggles/handlers/registered.query.ts

@@ -1,6 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../constants";
 import { globalFeatureStateTable } from "../global-feature-state-table";
 
 // Inventory of every registered feature, annotated with toggle metadata
@@ -16,8 +17,18 @@ export const registeredQuery = defineQueryHandler({
   schema: z.object({}),
   access: { roles: ["SystemAdmin"] },
   handler: async (_event, ctx) => {
+    // ctx.systemDb is populated for r.systemScope() handlers only (feature.ts
+    // declares it) — guarded instead of asserted, see set.write.ts Guard 0.5.
+    if (!ctx.systemDb) {
+      throw new Error(
+        "[feature-toggles] registered-query requires ctx.systemDb — the feature-toggles " +
+          "feature must stay r.systemScope() (see feature.ts).",
+      );
+    }
+    const db = ctx.systemDb.acknowledgeCrossTenant(FEATURE_TOGGLE_CROSS_TENANT_REASON);
+
     type OverrideRow = { featureName: string; enabled: boolean };
-    const overrideRows = await selectMany<OverrideRow>(ctx.db.raw, globalFeatureStateTable);
+    const overrideRows = await selectMany<OverrideRow>(db.raw, globalFeatureStateTable);
     const overrides = new Map(overrideRows.map((r) => [r.featureName, r.enabled]));
 
     // SystemAdmin operator-tooling: das listing soll die PLATTFORM-truth

package/src/feature-toggles/handlers/set.write.ts

@@ -9,6 +9,7 @@ import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import {
   FEATURE_TOGGLE_AGGREGATE_TYPE,
+  FEATURE_TOGGLE_CROSS_TENANT_REASON,
   FEATURE_TOGGLE_SET_EVENT_NAME,
   FeatureToggleErrors,
 } from "../constants";
@@ -53,6 +54,20 @@ export function createSetWriteHandler(getRuntime: (() => GlobalFeatureToggleRunt
         );
       }
 
+      // Guard 0.5: feature-toggles is r.systemScope() (feature.ts), so
+      // ctx.systemDb is always populated by buildHandlerContext for this
+      // handler — the `?` on the type is a HandlerContext-wide optionality,
+      // not a real runtime possibility here. Guard anyway instead of a
+      // non-null assertion: an app that ever un-declares r.systemScope()
+      // gets an actionable error instead of a silent `undefined.acknowledgeCrossTenant`.
+      if (!ctx.systemDb) {
+        throw new Error(
+          "[feature-toggles] set-handler requires ctx.systemDb — the feature-toggles " +
+            "feature must stay r.systemScope() (see feature.ts).",
+        );
+      }
+      const db = ctx.systemDb.acknowledgeCrossTenant(FEATURE_TOGGLE_CROSS_TENANT_REASON);
+
       // Guard 1: featureName must be a registered feature. Otherwise we'd
       // pile up orphan rows from typos that the gate would silently apply
       // (if someone ever added a feature with that name later).
@@ -90,7 +105,7 @@ export function createSetWriteHandler(getRuntime: (() => GlobalFeatureToggleRunt
         updatedBy: string;
       };
       const [existing] = await selectMany<StateRow>(
-        ctx.db,
+        db,
         globalFeatureStateTable,
         { featureName },
         { limit: 1 },
@@ -100,7 +115,7 @@ export function createSetWriteHandler(getRuntime: (() => GlobalFeatureToggleRunt
 
       if (!existing) {
         // First-time override: insert.
-        await insertOne(ctx.db, globalFeatureStateTable, {
+        await insertOne(db, globalFeatureStateTable, {
           featureName,
           enabled,
           version: 1,
@@ -111,7 +126,7 @@ export function createSetWriteHandler(getRuntime: (() => GlobalFeatureToggleRunt
         // Upsert with optimistic lock. Two operators flipping the same
         // toggle simultaneously is rare but possible — the version-WHERE
         // ensures only one wins; the loser sees VersionConflictError.
-        const updated = await ctx.db.updateMany(
+        const updated = await db.updateMany(
           globalFeatureStateTable,
           {
             enabled,

package/src/file-derivatives/__tests__/public-variant-query-gating.integration.test.ts

@@ -11,6 +11,7 @@
 
 import { describe, expect, test } from "bun:test";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
 import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { createConfigFeature } from "../../config";
 import { fileFoundationFeature } from "../../file-foundation";
@@ -20,7 +21,12 @@ import { PUBLIC_VARIANT_QN } from "../handlers/public-variant.query";
 describe("file-derivatives :: publicVariant query gating without resolveApexTenant", () => {
   test("PUBLIC_VARIANT_QN is not dispatchable via the generic /api/query path — 404, same as any unknown query", async () => {
     const stack: TestStack = await setupTestStack({
-      features: [createConfigFeature(), fileFoundationFeature, createFileDerivativesFeature()],
+      features: [
+        createConfigFeature(),
+        fileFoundationFeature,
+        createFilesFeature(),
+        createFileDerivativesFeature(),
+      ],
       anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
     });
 

package/src/file-derivatives/feature.ts

@@ -12,6 +12,7 @@ import {
   EXT_DERIVATIVE_PUBLIC_PREDICATE,
   EXT_DERIVATIVE_RENDERER,
   type FeatureDefinition,
+  isUuid,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
@@ -19,12 +20,6 @@ import { PUBLIC_VARIANT_QN, publicVariantQuery } from "./handlers/public-variant
 
 const FEATURE_NAME = "file-derivatives";
 
-// fileRefsTable.id is a UUID column — a malformed id must fail here, not at
-// the DB. Without this, an anonymous, internet-facing caller can throw a
-// Postgres 22P02 on every request (Bun.SQL pools the failed connection),
-// a DoS primitive with no auth required.
-const FILE_REF_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-
 // Syntactic only, no registry/name-list lookup: a valid preset name plus a
 // random UUID reaches the same DB read anyway, so an allow-list of known
 // names defends nothing a determined caller can't route around — it only
@@ -88,6 +83,11 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
     // Needs a storage provider to read the original + write the variant —
     // without file-foundation there's nothing to derive from or write to.
     r.requires("file-foundation");
+    // variant() reads fileRefsTable, which "files" (not file-foundation)
+    // owns — without this, mounting file-derivatives + file-foundation
+    // alone boots fine but fails at request-time with a SQL error the first
+    // time variant() runs.
+    r.requires("files");
 
     r.extendsRegistrar(EXT_DERIVATIVE_RENDERER, {
       onRegister: () => {
@@ -129,13 +129,12 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
           const fileRefId = c.req.param("fileRefId");
           const variant = c.req.param("variant");
           // 404, not 400 — a syntactically bad name and "doesn't exist" must
-          // answer identically, no name-oracle.
-          if (
-            !fileRefId ||
-            !variant ||
-            !VARIANT_NAME_RE.test(variant) ||
-            !FILE_REF_ID_RE.test(fileRefId)
-          ) {
+          // answer identically, no name-oracle. fileRefsTable.id is a UUID
+          // column — a malformed id must fail here, not at the DB. Without
+          // this, an anonymous, internet-facing caller can throw a Postgres
+          // 22P02 on every request (Bun.SQL pools the failed connection), a
+          // DoS primitive with no auth required.
+          if (!fileRefId || !variant || !VARIANT_NAME_RE.test(variant) || !isUuid(fileRefId)) {
             return c.text("not found", 404);
           }
 

package/src/file-derivatives/handlers/public-variant.query.ts

@@ -23,6 +23,7 @@ import {
   defineQueryHandler,
   EXT_DERIVATIVE_PUBLIC_PREDICATE,
   type HandlerContext,
+  isUuid,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
@@ -69,7 +70,10 @@ export const PUBLIC_VARIANT_QN = "file-derivatives:query:public-variant";
 export const publicVariantQuery = defineQueryHandler({
   name: "public-variant",
   schema: z.object({
-    fileRefId: z.string().uuid(),
+    // Loose, version-agnostic UUID shape (same as isUuid/TENANT_ID_REGEX in
+    // packages/types) — not zod's `.uuid()`, which is stricter than this
+    // repo's convention and would reject valid v7/nil ids the DB accepts.
+    fileRefId: z.string().refine(isUuid, "invalid fileRefId"),
     variant: z.string().min(1).max(64),
   }),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },

package/src/form-draft/__tests__/cleanup.integration.test.ts

@@ -320,4 +320,26 @@ describe("form-draft cleanup job — FileRef release (#1915)", () => {
     // The live domain entity this draft was editing still references `key`.
     expect(providerA.keys()).toContain(key);
   });
+
+  test("releases a storageKey whose file_refs row predates the draft when the draftKey is create-mode (:new:)", async () => {
+    // Create-mode mints draftId lazily on the first step-change — the very
+    // first save already carries the step-0 photo, so the file_refs row
+    // predates the draft row by construction. Unlike the edit-mode case
+    // above there is no pre-existing domain entity, so the file must still
+    // be releasable on cleanup, not leaked as an orphaned storage object.
+    const key = "tenant-a/vehicle/create-mode.jpg";
+    await providerA.write(key, new Uint8Array([1, 2, 3]), "image/jpeg");
+    await seedFileRef(key);
+    await backdateFileRef(key, 60);
+
+    await saveDraft("wizard:new:create-mode-stale", { photo: fileRefPointer(key) });
+    await backdate("wizard:new:create-mode-stale", 31);
+
+    await dispatchCleanup();
+
+    await waitFor(async () => {
+      expect(await draftExists("wizard:new:create-mode-stale")).toBe(false);
+    });
+    expect(providerA.keys()).not.toContain(key);
+  });
 });

package/src/form-draft/__tests__/discard-file-refs.integration.test.ts

@@ -146,6 +146,23 @@ describe("form-draft discard — FileRef release", () => {
     expect(provider.keys()).toContain(key);
   });
 
+  test("discarding a create-mode draft (draftKey contains :new:) releases a storageKey whose file_refs row predates the draft row", async () => {
+    // Create-mode mints draftId lazily on the first step-change (see
+    // form-draft/lookup.ts) — the very first save already carries the
+    // step-0 photo, so the file_refs row for that upload is always older
+    // than (or equal to) the draft row's own insertedAt. Unlike edit-mode,
+    // there is no pre-existing domain entity here — every FileRef the
+    // draft references is draft-owned and must remain releasable.
+    const key = "tenant/vehicle/photo/create-mode.jpg";
+    await provider.write(key, new Uint8Array([1, 2, 3]), "image/jpeg");
+    await seedFileRef(key); // file_refs row inserted before the draft row below
+    await saveDraft("wizard:new:abc-123", { photo: fileRefPointer(key) });
+
+    await discardDraft("wizard:new:abc-123", true);
+
+    expect(provider.keys()).not.toContain(key);
+  });
+
   test("discarding without releaseFiles leaves the storage binary intact (successful-submit default)", async () => {
     const key = "tenant/vehicle/photo/kept.jpg";
     await provider.write(key, new Uint8Array([1, 2, 3]), "image/jpeg");