@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.368.0

package/dist/document-ingest-foundation/feature.js

@@ -81,95 +81,99 @@ async function requestIngestForFileRef(event, fileRef, ctx) {
         },
     });
 }
-export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Shared PDF/Scan/Image → normalized-text ingest primitive. Owns the `documentExtract` entity (fileRefId, storageKey, per-page text + metadata) as an implicit entity-projection, the per-tenant `ocrLanguage`/`maxPagesPerFile` config keys, the `documentIngestProvider` extension-point providers register accepted mimeTypes/size caps under, and a fileRef.created/fileRef.restored trigger that resolves the provider for a file's mimeType and requests ingest via `documentIngest.requested` tagged with the winning provider — a delete→restore round-trip re-requests ingest the same way a fresh upload does. An orphan-extract guard forgets any `documentExtract` whose fileRef is no longer live at processing time, regardless of how a provider's own write races the fileRef's delete/forget — providers should write through `writeDocumentExtractForLiveFileRef`.");
-    r.uiHints({
-        displayLabel: "Document Ingest Foundation",
-        category: "storage",
-        recommended: false,
-    });
-    // tenant-lifecycle hosts EXT_TENANT_DATA — documentExtract.pages is
-    // tenant-subject ciphertext and needs the destroy hook below.
-    r.requires({ features: ["config", "tenant-lifecycle"] });
-    r.entity({ name: "documentExtract", ...documentExtractEntity });
-    r.useExtension(EXT_TENANT_DATA, "documentExtract", {
-        destroy: documentExtractTenantDestroyHook,
-    });
-    // No onRegister: resolution happens at boot and per-apply, not on register.
-    r.extendsRegistrar(EXT_DOCUMENT_INGEST_PROVIDER, {});
-    r.bootCheck(({ features }) => validateDocumentIngestProviderWiring(features));
-    const ocrLanguageConfigKey = r.config("ocrLanguage", createTenantConfig("text", {
-        default: "deu+eng",
-        // Tesseract -l argument syntax: one or more 3-letter language codes
-        // joined by "+" (e.g. "deu+eng"). Unconstrained free text here would
-        // reach the OCR provider call unvalidated (#1501).
-        pattern: { regex: "^[a-z]{3}(\\+[a-z]{3})*$" },
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin", "User"),
-    }));
-    const maxPagesPerFileConfigKey = r.config("maxPagesPerFile", createTenantConfig("number", {
-        default: 50,
-        // Without a bound a tenant could set 0 (silently kills ingest) or an
-        // unbounded value (OCR worker runs per-file for as long as the PDF
-        // has pages — job-queue starvation) (#1501).
-        bounds: { min: 1, max: 500 },
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin", "User"),
-    }));
-    // "fileName" can carry a real person's name, but it reaches both events already as the
-    // fileRef's own self-subject ciphertext (copied from fileRef.created/restored), which
-    // append() passes through; shredding the fileRef's key shreds it here too.
-    r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema, {
-        piiFields: "none",
-        version: 2,
-        migrations: [
-            {
-                fromVersion: 1,
-                toVersion: 2,
-                // The sentinel can never match a real where.provider filter (providers
-                // may not register under it) — an upcast v1 row reads as unclaimed
-                // instead of silently misrouting to a currently mounted provider.
-                transform: { default: { provider: UNCLAIMED_PROVIDER_SENTINEL } },
-            },
-        ],
-    });
-    r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema, {
-        piiFields: "none",
-    });
-    r.multiStreamProjection({
-        name: "request-ingest",
-        apply: {
-            [FILE_REF_CREATED]: async (event, _tx, ctx) => {
-                // entity-event payloads are generic Record<string, unknown> — parse
-                // at the MSP boundary (same pattern as storage-tracking's readNumber).
-                const parsed = fileRefIngestFieldsSchema.safeParse(event.payload);
-                // skip: malformed / incomplete payload — don't poison the consumer
-                if (!parsed.success)
-                    return;
-                await requestIngestForFileRef(event, parsed.data, ctx);
+export function createDocumentIngestFoundationFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Shared PDF/Scan/Image → normalized-text ingest primitive. Owns the `documentExtract` entity (fileRefId, storageKey, per-page text + metadata) as an implicit entity-projection, the per-tenant `ocrLanguage`/`maxPagesPerFile` config keys, the `documentIngestProvider` extension-point providers register accepted mimeTypes/size caps under, and a fileRef.created/fileRef.restored trigger that resolves the provider for a file's mimeType and requests ingest via `documentIngest.requested` tagged with the winning provider — a delete→restore round-trip re-requests ingest the same way a fresh upload does. An orphan-extract guard forgets any `documentExtract` whose fileRef is no longer live at processing time, regardless of how a provider's own write races the fileRef's delete/forget — providers should write through `writeDocumentExtractForLiveFileRef`.");
+        r.uiHints({
+            displayLabel: "Document Ingest Foundation",
+            category: "storage",
+            recommended: false,
+        });
+        // tenant-lifecycle hosts EXT_TENANT_DATA — documentExtract.pages is
+        // tenant-subject ciphertext and needs the destroy hook below.
+        r.requires({ features: ["config", "tenant-lifecycle"] });
+        r.entity({ name: "documentExtract", ...documentExtractEntity });
+        r.useExtension(EXT_TENANT_DATA, "documentExtract", {
+            destroy: documentExtractTenantDestroyHook,
+        });
+        // No onRegister: resolution happens at boot and per-apply, not on register.
+        r.extendsRegistrar(EXT_DOCUMENT_INGEST_PROVIDER, {});
+        r.bootCheck(({ features }) => validateDocumentIngestProviderWiring(features));
+        const ocrLanguageConfigKey = r.config("ocrLanguage", createTenantConfig("text", {
+            default: "deu+eng",
+            // Tesseract -l argument syntax: one or more 3-letter language codes
+            // joined by "+" (e.g. "deu+eng"). Unconstrained free text here would
+            // reach the OCR provider call unvalidated (#1501).
+            pattern: { regex: "^[a-z]{3}(\\+[a-z]{3})*$" },
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+        }));
+        const maxPagesPerFileConfigKey = r.config("maxPagesPerFile", createTenantConfig("number", {
+            default: 50,
+            // Without a bound a tenant could set 0 (silently kills ingest) or an
+            // unbounded value (OCR worker runs per-file for as long as the PDF
+            // has pages — job-queue starvation) (#1501).
+            bounds: { min: 1, max: 500 },
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+        }));
+        // "fileName" can carry a real person's name, but it reaches both events already as the
+        // fileRef's own self-subject ciphertext (copied from fileRef.created/restored), which
+        // append() passes through; shredding the fileRef's key shreds it here too.
+        r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema, {
+            piiFields: "none",
+            version: 2,
+            migrations: [
+                {
+                    fromVersion: 1,
+                    toVersion: 2,
+                    // The sentinel can never match a real where.provider filter (providers
+                    // may not register under it) — an upcast v1 row reads as unclaimed
+                    // instead of silently misrouting to a currently mounted provider.
+                    transform: { default: { provider: UNCLAIMED_PROVIDER_SENTINEL } },
+                },
+            ],
+        });
+        r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema, {
+            piiFields: "none",
+        });
+        r.multiStreamProjection({
+            name: "request-ingest",
+            apply: {
+                [FILE_REF_CREATED]: async (event, _tx, ctx) => {
+                    // entity-event payloads are generic Record<string, unknown> — parse
+                    // at the MSP boundary (same pattern as storage-tracking's readNumber).
+                    const parsed = fileRefIngestFieldsSchema.safeParse(event.payload);
+                    // skip: malformed / incomplete payload — don't poison the consumer
+                    if (!parsed.success)
+                        return;
+                    await requestIngestForFileRef(event, parsed.data, ctx);
+                },
+                [FILE_REF_RESTORED]: async (event, _tx, ctx) => {
+                    // fileRef.restored carries { previous }, the pre-restore soft-deleted
+                    // row (event-store-executor-write.ts restore()) — same field shape
+                    // as fileRef.created's payload.
+                    const parsed = fileRefIngestFieldsSchema.safeParse(event.payload["previous"]);
+                    // skip: malformed / incomplete previous snapshot — don't poison the consumer
+                    if (!parsed.success)
+                        return;
+                    await requestIngestForFileRef(event, parsed.data, ctx);
+                },
             },
-            [FILE_REF_RESTORED]: async (event, _tx, ctx) => {
-                // fileRef.restored carries { previous }, the pre-restore soft-deleted
-                // row (event-store-executor-write.ts restore()) — same field shape
-                // as fileRef.created's payload.
-                const parsed = fileRefIngestFieldsSchema.safeParse(event.payload["previous"]);
-                // skip: malformed / incomplete previous snapshot — don't poison the consumer
-                if (!parsed.success)
-                    return;
-                await requestIngestForFileRef(event, parsed.data, ctx);
+        });
+        // fileRef delete/forget cleanup: documentExtract rows are derived data —
+        // once the source file is gone (soft-deleted or Art.17-forgotten), the
+        // extracted text has no reason to survive it either.
+        r.multiStreamProjection({
+            name: "forget-extract-with-file-ref",
+            apply: {
+                [FILE_REF_DELETED]: forgetExtractOnFileRefDeletedHook,
+                [FILE_REF_FORGOTTEN]: forgetExtractOnFileRefForgottenHook,
+                [DOCUMENT_EXTRACT_CREATED]: forgetOrphanedDocumentExtractHook,
             },
-        },
-    });
-    // fileRef delete/forget cleanup: documentExtract rows are derived data —
-    // once the source file is gone (soft-deleted or Art.17-forgotten), the
-    // extracted text has no reason to survive it either.
-    r.multiStreamProjection({
-        name: "forget-extract-with-file-ref",
-        apply: {
-            [FILE_REF_DELETED]: forgetExtractOnFileRefDeletedHook,
-            [FILE_REF_FORGOTTEN]: forgetExtractOnFileRefForgottenHook,
-            [DOCUMENT_EXTRACT_CREATED]: forgetOrphanedDocumentExtractHook,
-        },
-    });
-    return { ocrLanguageConfigKey, maxPagesPerFileConfigKey };
-});
+        });
+        return { ocrLanguageConfigKey, maxPagesPerFileConfigKey };
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createDocumentIngestFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const documentIngestFoundationFeature = createDocumentIngestFoundationFeature();

package/dist/document-ingest-foundation/forget-extract-with-file-ref.js

@@ -48,7 +48,7 @@ export const forgetOrphanedDocumentExtractHook = async (event, tx) => {
     // skip: malformed payload — don't poison the consumer
     if (!parsed.success)
         return;
-    const tenantDb = createTenantDb(tx, event.tenantId);
+    const tenantDb = createTenantDb({ db: tx, tenantId: event.tenantId });
     // skip: fileRef still live — the extract is legitimate
     if (await isFileRefLive(tenantDb, parsed.data.fileRefId))
         return;
@@ -60,7 +60,7 @@ export const forgetOrphanedDocumentExtractHook = async (event, tx) => {
     throw new Error(`document-ingest-foundation: failed to forget orphaned documentExtract ${event.aggregateId}: ${result.error.message}`);
 };
 export const forgetExtractOnFileRefDeletedHook = async (event, tx) => {
-    const tenantDb = createTenantDb(tx, event.tenantId);
+    const tenantDb = createTenantDb({ db: tx, tenantId: event.tenantId });
     // skip: fileRef is live again — request-ingest and this consumer poll via
     // separate cursors, so a delete→restore round-trip can finish before this
     // consumer sees fileRef.deleted; forgetting would drop the live file's extract.
@@ -69,6 +69,6 @@ export const forgetExtractOnFileRefDeletedHook = async (event, tx) => {
     await forgetExtractsForFileRef(event, tenantDb);
 };
 export const forgetExtractOnFileRefForgottenHook = async (event, tx) => {
-    const tenantDb = createTenantDb(tx, event.tenantId);
+    const tenantDb = createTenantDb({ db: tx, tenantId: event.tenantId });
     await forgetExtractsForFileRef(event, tenantDb);
 };

package/dist/document-ingest-foundation/index.d.ts

@@ -1,7 +1,7 @@
 export { documentIngestAggregateId } from "./aggregate-id.js";
 export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.js";
 export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
-export { documentIngestFoundationFeature } from "./feature.js";
+export { createDocumentIngestFoundationFeature, documentIngestFoundationFeature, } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.js";
 export { type DocumentExtractWriteResult, writeDocumentExtractForLiveFileRef, } from "./write-document-extract.js";

package/dist/document-ingest-foundation/index.js

@@ -2,7 +2,7 @@
 export { documentIngestAggregateId } from "./aggregate-id.js";
 export { documentExtractEntity, documentExtractsTable, } from "./entity.js";
 export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
-export { documentIngestFoundationFeature } from "./feature.js";
+export { createDocumentIngestFoundationFeature, documentIngestFoundationFeature, } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, resolveDocumentIngestProviders, } from "./providers.js";
 export { writeDocumentExtractForLiveFileRef, } from "./write-document-extract.js";

package/dist/feature-toggles/global-feature-state-table.js

@@ -1,5 +1,4 @@
-import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
-import { boolean, declareGlobalTenancy, instant, integer, table as pgTable, sql, text, } from "@cosmicdrift/kumiko-framework/db";
+import { boolean, declareGlobalTenancy, instant, integer, table as pgTable, requireEntityTableMeta, sql, text, } from "@cosmicdrift/kumiko-framework/db";
 // Global feature-toggle override state. One row per feature that has ever
 // been explicitly flipped by an operator. Missing row = "no override,
 // fall back to the feature's r.toggleable({ default }) value".

package/dist/feature-toggles/handlers/set.write.js

@@ -1,4 +1,4 @@
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, VersionConflictError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -109,10 +109,8 @@ export function createSetWriteHandler(getRuntime) {
             // and filtering by payload.featureName is trivial at query time.
             // This mirrors how `config` handles the same constraint for
             // its config-changed events.
-            // unsafeAppendEvent — bundled-features ohne lokalen Wrapper. Apps
-            // mit `bun kumiko codegen` kriegen `.kumiko/define.ts` als strict-
-            // path; bundled-features bleibt bei der unsafe-Variante. Schema-
-            // Validation läuft trotzdem via r.defineEvent("toggle-set", ...).
+            // unsafeAppendEvent: the strict appendEvent is bound to an app's own event map, which
+            // bundled-features cannot see. Schema validation still runs via r.defineEvent("toggle-set", ...).
             await ctx.unsafeAppendEvent({
                 aggregateId: SYSTEM_TENANT_ID,
                 aggregateType: FEATURE_TOGGLE_AGGREGATE_TYPE,

package/dist/feature-toggles/toggle-runtime.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { computeEffectiveFeatures, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createDefaultCacheSyncBus, } from "@cosmicdrift/kumiko-framework/redis";

package/dist/file-derivatives/feature.d.ts

@@ -25,4 +25,5 @@ export type FileDerivativesOptions = {
     readonly publicTenantResolution?: PublicVariantTenantResolution;
 };
 export declare function createFileDerivativesFeature(opts?: FileDerivativesOptions): FeatureDefinition;
+/** @deprecated Use createFileDerivativesFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const fileDerivativesFeature: FeatureDefinition;

package/dist/file-derivatives/feature.js

@@ -161,6 +161,7 @@ export function createFileDerivativesFeature(opts = {}) {
                 },
             });
         }
-    });
+    }, Object.keys(opts).length === 0 ? { dedupeOptions: {} } : undefined);
 }
+/** @deprecated Use createFileDerivativesFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export const fileDerivativesFeature = createFileDerivativesFeature();

package/dist/file-derivatives/handlers/public-variant-by-file-ref.query.js

@@ -1,4 +1,4 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { createAnonymousUser, defineQueryHandler, isUuid, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { isTenantServingPublicContent, tenantTable, } from "../../tenant/index.js";

package/dist/file-derivatives/handlers/public-variant.query.js

@@ -22,7 +22,7 @@
 // publicVariantByFileRefQuery — tenantId there comes from the FileRef row,
 // but this handler's own isPublic gate runs exactly the same either way.
 import { computeRevisionEtag } from "@cosmicdrift/kumiko-framework/api";
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { resolveFieldVariant } from "@cosmicdrift/kumiko-framework/derivatives";
 import { defineQueryHandler, EXT_DERIVATIVE_PUBLIC_PREDICATE, isUuid, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";

package/dist/file-foundation/feature.d.ts

@@ -1,5 +1,11 @@
 export type { FileProviderContext, FileProviderPlugin, } from "@cosmicdrift/kumiko-framework/files";
 export { createFileProviderForTenant, isFileProviderPlugin, } from "@cosmicdrift/kumiko-framework/files";
+export declare function createFileFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        providerConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+    };
+};
+/** @deprecated Use createFileFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const fileFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         providerConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;

package/dist/file-foundation/feature.js

@@ -20,28 +20,32 @@ import { access, createTenantConfig, defineFeature, EXT_FILE_PROVIDER, FILE_STOR
 // features/file-foundation` consumers (user-data-rights, app code) keep working.
 export { createFileProviderForTenant, isFileProviderPlugin, } from "@cosmicdrift/kumiko-framework/files";
 const FEATURE_NAME = "file-foundation";
-export const fileFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Defines the `fileProvider` extension point and a per-tenant `provider` config key that selects which registered storage plugin to use at runtime. Call `createFileProviderForTenant(ctx, tenantId)` to get a `FileStorageProvider` — use this feature together with at least one `file-provider-*` feature; the `files` feature builds on top of it for tracked `FileRef` entities with GDPR hooks.");
-    r.uiHints({
-        displayLabel: "File Provider Foundation",
-        category: "storage",
-        recommended: false,
-    });
-    r.requires({ features: ["config"] });
-    r.extendsRegistrar(EXT_FILE_PROVIDER, {
-        onRegister: () => {
-            // No side-effects at register-time — registry stores the usage,
-            // factory looks it up at request-time.
-        },
-    });
-    const providerConfigKey = r.config("provider", createTenantConfig("text", {
-        default: "",
-        env: FILE_STORAGE_PROVIDER_ENV,
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin", "User"),
-    }));
-    // Readiness gating: provider-plugins' required keys/secrets count only
-    // while their plugin is the one this key selects.
-    r.extensionSelector(EXT_FILE_PROVIDER, providerConfigKey);
-    return { providerConfigKey };
-});
+export function createFileFoundationFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Defines the `fileProvider` extension point and a per-tenant `provider` config key that selects which registered storage plugin to use at runtime. Call `createFileProviderForTenant(ctx, tenantId)` to get a `FileStorageProvider` — use this feature together with at least one `file-provider-*` feature; the `files` feature builds on top of it for tracked `FileRef` entities with GDPR hooks.");
+        r.uiHints({
+            displayLabel: "File Provider Foundation",
+            category: "storage",
+            recommended: false,
+        });
+        r.requires({ features: ["config"] });
+        r.extendsRegistrar(EXT_FILE_PROVIDER, {
+            onRegister: () => {
+                // No side-effects at register-time — registry stores the usage,
+                // factory looks it up at request-time.
+            },
+        });
+        const providerConfigKey = r.config("provider", createTenantConfig("text", {
+            default: "",
+            env: FILE_STORAGE_PROVIDER_ENV,
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+        }));
+        // Readiness gating: provider-plugins' required keys/secrets count only
+        // while their plugin is the one this key selects.
+        r.extensionSelector(EXT_FILE_PROVIDER, providerConfigKey);
+        return { providerConfigKey };
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createFileFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const fileFoundationFeature = createFileFoundationFeature();

package/dist/file-foundation/index.d.ts

@@ -1,2 +1,2 @@
-export { createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
+export { createFileFoundationFeature, createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
 export { type FileRefContent, FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-foundation/index.js

@@ -1,3 +1,3 @@
 // Public API of the file-foundation bundled-feature.
-export { createFileProviderForTenant, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
+export { createFileFoundationFeature, createFileProviderForTenant, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
 export { FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-foundation/read-file-ref-content.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { isUuid } from "@cosmicdrift/kumiko-framework/engine";
 import { createFileContext, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
 // Tenant-bound on purpose: without a resolver `ctx.files` only reaches the storage of the

package/dist/file-provider-inmemory/feature.d.ts

@@ -2,6 +2,10 @@
 export declare function listKeys(tenantId: string): readonly string[];
 /** Demo/Test-Helper: leere den Tenant-Storage. */
 export declare function clearStorage(tenantId: string): void;
+export declare function createFileProviderInMemoryFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createFileProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const fileProviderInMemoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/file-provider-inmemory/feature.js

@@ -42,23 +42,27 @@ export function clearStorage(tenantId) {
 // =============================================================================
 // Feature-definition
 // =============================================================================
-export const fileProviderInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers an in-process `"inmemory"` provider for `file-foundation` that stores file bytes per tenant in a module-level Map. Use `listKeys(tenantId)` and `clearStorage(tenantId)` in demo apps and tests; not for production (data is lost on restart and grows without bound).');
-    r.uiHints({
-        displayLabel: "File Provider · In-Memory",
-        category: "storage",
-        recommended: false,
-    });
-    // Kein requires auf "config" oder "secrets" — der
-    // In-Memory-Provider hat keine Config + kein Secret. Nur die
-    // file-foundation muss da sein (Plugin-extension-point).
-    r.requires({ features: ["file-foundation"] });
-    const plugin = {
-        build: async (_ctx, tenantId) => {
-            // Returnt den per-tenant Storage. Identitätsstabil zwischen calls
-            // damit accumulated state erhalten bleibt.
-            return getOrCreateProviderForTenant(tenantId);
-        }, // @wrapper-known semantic-alias
-    };
-    r.useExtension("fileProvider", "inmemory", plugin);
-});
+export function createFileProviderInMemoryFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers an in-process `"inmemory"` provider for `file-foundation` that stores file bytes per tenant in a module-level Map. Use `listKeys(tenantId)` and `clearStorage(tenantId)` in demo apps and tests; not for production (data is lost on restart and grows without bound).');
+        r.uiHints({
+            displayLabel: "File Provider · In-Memory",
+            category: "storage",
+            recommended: false,
+        });
+        // Kein requires auf "config" oder "secrets" — der
+        // In-Memory-Provider hat keine Config + kein Secret. Nur die
+        // file-foundation muss da sein (Plugin-extension-point).
+        r.requires({ features: ["file-foundation"] });
+        const plugin = {
+            build: async (_ctx, tenantId) => {
+                // Returns the per-tenant storage. Identity-stable across calls so
+                // accumulated state is kept.
+                return getOrCreateProviderForTenant(tenantId);
+            }, // @wrapper-known semantic-alias
+        };
+        r.useExtension("fileProvider", "inmemory", plugin);
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createFileProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const fileProviderInMemoryFeature = createFileProviderInMemoryFeature();

package/dist/file-provider-inmemory/index.d.ts

@@ -1 +1 @@
-export { clearStorage, fileProviderInMemoryFeature, listKeys } from "./feature.js";
+export { clearStorage, createFileProviderInMemoryFeature, fileProviderInMemoryFeature, listKeys, } from "./feature.js";

package/dist/file-provider-inmemory/index.js

@@ -1,2 +1,2 @@
 // Public API of the file-provider-inmemory bundled-feature.
-export { clearStorage, fileProviderInMemoryFeature, listKeys } from "./feature.js";
+export { clearStorage, createFileProviderInMemoryFeature, fileProviderInMemoryFeature, listKeys, } from "./feature.js";

package/dist/file-provider-s3/env-feature.d.ts

@@ -0,0 +1,3 @@
+export declare function createFileProviderS3EnvFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};

package/dist/file-provider-s3/env-feature.js

@@ -0,0 +1,46 @@
+// file-provider-s3-env — S3 file provider configured entirely from
+// process.env. ONE shared bucket for ALL tenants: wire it by setting the
+// `S3_*` env vars + mounting — no per-tenant admin seeding and no
+// `secrets`-feature dependency.
+//
+// **vs the default file-provider-s3:** the config-based `"s3"` provider owns per-tenant
+// config keys + an encrypted `s3.secretAccessKey` secret (per-tenant
+// buckets, admin-seeded). This `"s3-env"` provider reads one credential set
+// from env and serves every tenant from one bucket — the
+// Hetzner-Object-Storage / single-bucket deploy case. Tenant isolation
+// still holds: file keys carry the tenant (export ZIPs:
+// `exports/<tenantId>/<jobId>.zip`) or are globally-unique UUIDs (fileRefs).
+//
+// **Pattern-Vorbild:** mirrors file-provider-inmemory (zero admin seeding,
+// only the file-foundation plugin-point required).
+//
+// **Env vars** (read by createS3ProviderFromEnv, prefix `S3_`):
+//   required — S3_BUCKET, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY
+//   optional — S3_ENDPOINT (S3-compat stores incl. Hetzner Object Storage),
+//              S3_FORCE_PATH_STYLE
+// Missing required vars throw on the FIRST file op (inside the export cron).
+// The user-data-rights boot guard surfaces that at boot instead.
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createS3ProviderFromEnv } from "./lib/env-helper.js";
+const FEATURE_NAME = "file-provider-s3-env";
+export function createFileProviderS3EnvFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers an `"s3-env"` provider for `file-foundation` that reads one S3 credential set from `process.env` (`S3_BUCKET`/`S3_REGION`/`S3_ACCESS_KEY`/`S3_SECRET_KEY`, optional `S3_ENDPOINT`/`S3_FORCE_PATH_STYLE`) and serves every tenant from one shared bucket — no per-tenant config or secret seeding. Use this for single-bucket S3-compatible deploys (e.g. Hetzner Object Storage); use `file-provider-s3` instead when each tenant needs its own bucket/credentials.');
+        r.uiHints({
+            displayLabel: "File Provider · S3 (env)",
+            category: "storage",
+            recommended: false,
+        });
+        // No requires on "config" or "secrets" — credentials come from
+        // env, not the per-tenant config + secrets store. Only the file-foundation
+        // plugin-extension-point must be mounted.
+        r.requires({ features: ["file-foundation"] });
+        const plugin = {
+            // tenantId ignored: one shared bucket serves all tenants (isolation via
+            // tenant-prefixed / UUID keys). Built fresh per call like file-provider-s3;
+            // the S3 client opens no connection at construction.
+            build: async (_ctx, _tenantId) => createS3ProviderFromEnv(), // @wrapper-known semantic-alias
+        };
+        r.useExtension("fileProvider", "s3-env", plugin);
+    }, { dedupeOptions: {} });
+}

package/dist/file-provider-s3/feature.d.ts

@@ -1,3 +1,28 @@
+import { createFileProviderS3EnvFeature } from "./env-feature.js";
+declare function createTenantConfigFileProviderS3Feature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        configKeys: {
+            readonly bucket: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+            readonly region: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+            readonly endpoint: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+            readonly forcePathStyle: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"boolean">;
+            readonly accessKeyId: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+        };
+        secretAccessKey: import("@cosmicdrift/kumiko-types/feature").SecretKeyHandle;
+    };
+};
+export type FileProviderS3FeatureOptions = {
+    /** Read one shared credential set from the `S3_*` env vars (provider key "s3-env", feature name "file-provider-s3-env") instead of per-tenant config and secret. */
+    readonly fromEnv?: boolean;
+};
+export declare function createFileProviderS3Feature(options: {
+    readonly fromEnv: true;
+}): ReturnType<typeof createFileProviderS3EnvFeature>;
+export declare function createFileProviderS3Feature(options?: {
+    readonly fromEnv?: false;
+}): ReturnType<typeof createTenantConfigFileProviderS3Feature>;
+export declare function createFileProviderS3Feature(options: FileProviderS3FeatureOptions): ReturnType<typeof createFileProviderS3EnvFeature> | ReturnType<typeof createTenantConfigFileProviderS3Feature>;
+/** @deprecated Use createFileProviderS3Feature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const fileProviderS3Feature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         configKeys: {
@@ -12,3 +37,4 @@ export declare const fileProviderS3Feature: import("@cosmicdrift/kumiko-types/fe
 };
 /** Typed handle for the S3 secret-access-key. */
 export declare const S3_SECRET_ACCESS_KEY: import("@cosmicdrift/kumiko-types/feature").SecretKeyHandle;
+export {};