@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.368.0

package/dist/file-provider-s3/feature.js

@@ -11,86 +11,98 @@
 //      { build })`. file-foundation's Factory findet den Plugin via
 //      registry.
 //   3. build(ctx, tenantId) liest config + secret, ruft `createS3Provider`
-//      aus files-provider-s3 auf. Der EINZIGE Cross-Feature-Import
+//      aus ./lib auf. Der EINZIGE Cross-Feature-Import
 //      des Plugins — bewusst lokal gehalten.
 //
 // **Pattern-Vorbild:** mirrors mail-transport-smtp.
 //
 // **Boot-Dependencies:** config + secrets + file-foundation.
-import { createS3Provider } from "@cosmicdrift/kumiko-bundled-features/files-provider-s3";
 import { requireDefined, requireNonEmpty, requireSecretSet, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createFileProviderS3EnvFeature } from "./env-feature.js";
+import { createS3Provider } from "./lib/s3-provider.js";
 const FEATURE_NAME = "file-provider-s3";
 // =============================================================================
 // Feature-definition
 // =============================================================================
-export const fileProviderS3Feature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers itself as the `"s3"` provider for `file-foundation` and owns the per-tenant config keys (`bucket`, `region`, `endpoint`, `forcePathStyle`, `accessKeyId`) and the encrypted `s3.secretAccessKey` secret. Compatible with any S3-compatible object store (AWS S3, Hetzner Object Storage); set credentials via the admin UI or a seed handler before the first file operation.');
-    r.uiHints({
-        displayLabel: "File Provider · S3",
-        category: "storage",
-        recommended: false,
-    });
-    r.requires({ features: ["config"] });
-    r.requires({ features: ["secrets"] });
-    r.requires({ features: ["file-foundation"] });
-    const secretAccessKey = r.secret("s3.secretAccessKey", {
-        label: { en: "S3 secret access key" },
-        hint: {
-            en: "Private half of the S3 key pair. Hetzner calls it 'Secret Key', AWS calls it 'Secret Access Key'.",
-        },
-        redact: (plaintext) => {
-            if (plaintext.length < 8)
-                return "•".repeat(plaintext.length);
-            return `${plaintext.slice(0, 4)}...${plaintext.slice(-4)}`;
-        },
-        scope: "tenant",
-        // required: true ↔ the missing-secret throw in readSecretAccessKey — keep in sync.
-        required: true,
-    });
-    // required: true ↔ the requireNonEmpty calls in buildS3Provider — keep in sync.
-    const configKeys = r.config({
-        keys: {
-            bucket: createTenantConfig("text", {
-                required: true,
-                default: "",
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-                read: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-            region: createTenantConfig("text", {
-                required: true,
-                default: "",
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-                read: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-            endpoint: createTenantConfig("text", {
-                default: "",
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-                read: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-            forcePathStyle: createTenantConfig("boolean", {
-                default: false,
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-            accessKeyId: createTenantConfig("text", {
-                required: true,
-                default: "",
-                write: access.roles("TenantAdmin", "SystemAdmin"),
-                read: access.roles("TenantAdmin", "SystemAdmin"),
-            }),
-        },
-    });
-    // Plugin-Registration. entityName "s3" ist was tenants in
-    // file-foundation's `provider` config-key setzen.
-    const plugin = {
-        build: async (ctx, tenantId) => buildS3Provider(ctx, tenantId), // @wrapper-known semantic-alias
-    };
-    r.useExtension("fileProvider", "s3", plugin);
-    return { configKeys, secretAccessKey };
-});
+function createTenantConfigFileProviderS3Feature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers itself as the `"s3"` provider for `file-foundation` and owns the per-tenant config keys (`bucket`, `region`, `endpoint`, `forcePathStyle`, `accessKeyId`) and the encrypted `s3.secretAccessKey` secret. Compatible with any S3-compatible object store (AWS S3, Hetzner Object Storage); set credentials via the admin UI or a seed handler before the first file operation.');
+        r.uiHints({
+            displayLabel: "File Provider · S3",
+            category: "storage",
+            recommended: false,
+        });
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["secrets"] });
+        r.requires({ features: ["file-foundation"] });
+        const secretAccessKey = r.secret("s3.secretAccessKey", {
+            label: { en: "S3 secret access key" },
+            hint: {
+                en: "Private half of the S3 key pair. Hetzner calls it 'Secret Key', AWS calls it 'Secret Access Key'.",
+            },
+            redact: (plaintext) => {
+                if (plaintext.length < 8)
+                    return "•".repeat(plaintext.length);
+                return `${plaintext.slice(0, 4)}...${plaintext.slice(-4)}`;
+            },
+            scope: "tenant",
+            // required: true ↔ the missing-secret throw in readSecretAccessKey — keep in sync.
+            required: true,
+        });
+        // required: true ↔ the requireNonEmpty calls in buildS3Provider — keep in sync.
+        const configKeys = r.config({
+            keys: {
+                bucket: createTenantConfig("text", {
+                    required: true,
+                    default: "",
+                    write: access.roles("TenantAdmin", "SystemAdmin"),
+                    read: access.roles("TenantAdmin", "SystemAdmin"),
+                }),
+                region: createTenantConfig("text", {
+                    required: true,
+                    default: "",
+                    write: access.roles("TenantAdmin", "SystemAdmin"),
+                    read: access.roles("TenantAdmin", "SystemAdmin"),
+                }),
+                endpoint: createTenantConfig("text", {
+                    default: "",
+                    write: access.roles("TenantAdmin", "SystemAdmin"),
+                    read: access.roles("TenantAdmin", "SystemAdmin"),
+                }),
+                forcePathStyle: createTenantConfig("boolean", {
+                    default: false,
+                    write: access.roles("TenantAdmin", "SystemAdmin"),
+                }),
+                accessKeyId: createTenantConfig("text", {
+                    required: true,
+                    default: "",
+                    write: access.roles("TenantAdmin", "SystemAdmin"),
+                    read: access.roles("TenantAdmin", "SystemAdmin"),
+                }),
+            },
+        });
+        // Plugin-Registration. entityName "s3" ist was tenants in
+        // file-foundation's `provider` config-key setzen.
+        const plugin = {
+            build: async (ctx, tenantId) => buildS3Provider(ctx, tenantId), // @wrapper-known semantic-alias
+        };
+        r.useExtension("fileProvider", "s3", plugin);
+        return { configKeys, secretAccessKey };
+    }, { dedupeOptions: {} });
+}
+export function createFileProviderS3Feature(options = {}) {
+    return options.fromEnv === true
+        ? createFileProviderS3EnvFeature()
+        : createTenantConfigFileProviderS3Feature();
+}
+/** @deprecated Use createFileProviderS3Feature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const fileProviderS3Feature = createFileProviderS3Feature();
+// Typed config/secret handles are identical across instances, so one module-level instance serves them.
+const tenantConfigFeature = createTenantConfigFileProviderS3Feature();
 /** Typed handle for the S3 secret-access-key. */
-export const S3_SECRET_ACCESS_KEY = fileProviderS3Feature.exports.secretAccessKey;
+export const S3_SECRET_ACCESS_KEY = tenantConfigFeature.exports.secretAccessKey;
 // =============================================================================
 // Internal: build the FileStorageProvider from tenant config + secret
 // =============================================================================
@@ -100,12 +112,12 @@ async function buildS3Provider(ctx, tenantId) {
         throw new Error(`${FEATURE_NAME}: ctx.config is missing — feature requires the config-feature mounted in the registry`);
     }
     const FILE_HINT = "Set via tenant-admin UI or seed-handler before reading or writing files.";
-    const bucket = requireNonEmpty(await ctxConfig(fileProviderS3Feature.exports.configKeys.bucket), FEATURE_NAME, "bucket", FILE_HINT);
-    const region = requireNonEmpty(await ctxConfig(fileProviderS3Feature.exports.configKeys.region), FEATURE_NAME, "region", FILE_HINT);
-    const endpointRaw = requireDefined(await ctxConfig(fileProviderS3Feature.exports.configKeys.endpoint), FEATURE_NAME, "endpoint"); // @cast-boundary engine-payload
+    const bucket = requireNonEmpty(await ctxConfig(tenantConfigFeature.exports.configKeys.bucket), FEATURE_NAME, "bucket", FILE_HINT);
+    const region = requireNonEmpty(await ctxConfig(tenantConfigFeature.exports.configKeys.region), FEATURE_NAME, "region", FILE_HINT);
+    const endpointRaw = requireDefined(await ctxConfig(tenantConfigFeature.exports.configKeys.endpoint), FEATURE_NAME, "endpoint"); // @cast-boundary engine-payload
     const endpoint = endpointRaw.length > 0 ? endpointRaw : undefined;
-    const forcePathStyle = requireDefined(await ctxConfig(fileProviderS3Feature.exports.configKeys.forcePathStyle), FEATURE_NAME, "forcePathStyle"); // @cast-boundary engine-payload
-    const accessKeyId = requireNonEmpty(await ctxConfig(fileProviderS3Feature.exports.configKeys.accessKeyId), FEATURE_NAME, "accessKeyId", FILE_HINT);
+    const forcePathStyle = requireDefined(await ctxConfig(tenantConfigFeature.exports.configKeys.forcePathStyle), FEATURE_NAME, "forcePathStyle"); // @cast-boundary engine-payload
+    const accessKeyId = requireNonEmpty(await ctxConfig(tenantConfigFeature.exports.configKeys.accessKeyId), FEATURE_NAME, "accessKeyId", FILE_HINT);
     const secretAccessKey = await readSecretAccessKey(ctx, tenantId);
     return createS3Provider({
         bucket,

package/dist/file-provider-s3/index.d.ts

@@ -1 +1 @@
-export { fileProviderS3Feature, S3_SECRET_ACCESS_KEY } from "./feature.js";
+export { createFileProviderS3Feature, type FileProviderS3FeatureOptions, fileProviderS3Feature, S3_SECRET_ACCESS_KEY, } from "./feature.js";

package/dist/file-provider-s3/index.js

@@ -1,2 +1,2 @@
 // Public API of the file-provider-s3 bundled-feature.
-export { fileProviderS3Feature, S3_SECRET_ACCESS_KEY } from "./feature.js";
+export { createFileProviderS3Feature, fileProviderS3Feature, S3_SECRET_ACCESS_KEY, } from "./feature.js";

package/dist/file-provider-s3/lib/index.d.ts

@@ -0,0 +1,3 @@
+export { createS3ProviderFromEnv, parseS3EnvConfig } from "./env-helper.js";
+export type { S3ProviderConfig } from "./s3-provider.js";
+export { createS3Provider, resolveForcePathStyle } from "./s3-provider.js";

package/dist/file-provider-s3/lib/index.js

@@ -0,0 +1,2 @@
+export { createS3ProviderFromEnv, parseS3EnvConfig } from "./env-helper.js";
+export { createS3Provider, resolveForcePathStyle } from "./s3-provider.js";

package/dist/{files-provider-s3 → file-provider-s3/lib}/s3-provider.js

@@ -3,12 +3,12 @@ import { assertSafeStorageKey, } from "@cosmicdrift/kumiko-framework/files";
 // Operator-Pflicht-Setup (Multipart-Upload-Cleanup)
 // =============================================================================
 //
-// `writeStream` nutzt Bun's S3-Writer fuer echtes multipart-streaming. S3
-// created dabei eine Multipart-Upload-Session mit einer Upload-ID; bei
-// normaler Completion wird sie geschlossen. Wird der Export-Worker mid-write
-// gecancelt (Pod-Restart, K8s-OOM-Kill, Process-Signal), bleibt die Session
-// in S3 OFFEN und berechnet Storage-Kosten fuer die bereits hochgeladenen
-// Parts — bis sie via Lifecycle-Rule abgebrochen werden.
+// `writeStream` uses Bun's S3 writer for real multipart streaming. S3
+// creates a multipart-upload session with an upload ID for it; on normal
+// completion the session is closed. If the export worker is cancelled
+// mid-write (pod restart, K8s OOM kill, process signal), the session stays
+// OPEN in S3 and bills storage for the parts already uploaded — until a
+// lifecycle rule aborts it.
 //
 // **Pflicht-Operator-Setup auf jedem Bucket:**
 //
@@ -21,9 +21,9 @@ import { assertSafeStorageKey, } from "@cosmicdrift/kumiko-framework/files";
 //     }]
 //   }
 //
-// AWS-CLI: `aws s3api put-bucket-lifecycle-configuration --bucket <name>
-// --lifecycle-configuration file://lifecycle.json`. Hetzner Object Storage
-// + R2 + Minio supporten dieselbe Syntax.
+// AWS CLI: `aws s3api put-bucket-lifecycle-configuration --bucket <name>
+// --lifecycle-configuration file://lifecycle.json`. Hetzner Object Storage,
+// R2 and Minio support the same syntax.
 //
 // =============================================================================
 // Operator-Pflicht-Setup (IAM: list permission)
@@ -82,11 +82,11 @@ export function createS3Provider(config) {
         },
         async writeStream(key, source, options) {
             assertSafeStorageKey(key);
-            // Echtes multipart-streaming via Bun's S3-Writer — partSize steuert die
-            // Part-Boundary intern (AWS/R2 verlangen non-final Parts >= 5 MiB,
-            // sonst EntityTooSmall beim CompleteMultipartUpload). Manuelles flush()
-            // hier wuerde genau diese Garantie brechen, sobald die Source-Chunks
-            // nicht auf partSize aufgehen.
+            // Real multipart streaming via Bun's S3 writer — partSize controls the
+            // part boundary internally (AWS/R2 require non-final parts >= 5 MiB,
+            // otherwise EntityTooSmall on CompleteMultipartUpload). A manual flush()
+            // here would break exactly that guarantee as soon as the source chunks
+            // do not line up with partSize.
             const writer = client.file(key).writer({
                 ...(options?.mimeType !== undefined && { type: options.mimeType }),
                 retry: 3,
@@ -94,8 +94,8 @@ export function createS3Provider(config) {
                 partSize: STREAM_PART_SIZE,
             });
             for await (const chunk of source) {
-                // Await applies Backpressure und bounded die in-flight Queue auf
-                // queueSize, statt unbegrenzt zu puffern.
+                // Await applies backpressure and bounds the in-flight queue to
+                // queueSize instead of buffering without limit.
                 await writer.write(chunk);
             }
             await writer.end();
@@ -106,9 +106,9 @@ export function createS3Provider(config) {
         },
         readStream(key) {
             assertSafeStorageKey(key);
-            // Lazy: erst beim ersten chunk-pull wird der GET-Request abgesetzt.
-            // Existiert der Key nicht, faellt der Error genau dort (nicht beim
-            // readStream-Aufruf) — gleiches Lazy-Verhalten wie inmemory + local.
+            // Lazy: the GET request is only sent on the first chunk pull. If the key
+            // does not exist, the error surfaces right there (not on the readStream
+            // call) — same lazy behavior as inmemory + local.
             return {
                 async *[Symbol.asyncIterator]() {
                     for await (const chunk of client.file(key).stream()) {

package/dist/file-provider-s3-env/index.d.ts

@@ -1 +1,8 @@
-export { fileProviderS3EnvFeature } from "./feature.js";
+/**
+ * @deprecated Use createFileProviderS3Feature({ fromEnv: true }) from
+ * `@cosmicdrift/kumiko-bundled-features/file-provider-s3`. Run `bun kumiko-upgrade --apply`.
+ * Removed in the first release after 2026-10-29.
+ */
+export declare const fileProviderS3EnvFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};

package/dist/file-provider-s3-env/index.js

@@ -1,2 +1,7 @@
-// Public API of the file-provider-s3-env bundled-feature.
-export { fileProviderS3EnvFeature } from "./feature.js";
+import { createFileProviderS3Feature } from "../file-provider-s3/index.js";
+/**
+ * @deprecated Use createFileProviderS3Feature({ fromEnv: true }) from
+ * `@cosmicdrift/kumiko-bundled-features/file-provider-s3`. Run `bun kumiko-upgrade --apply`.
+ * Removed in the first release after 2026-10-29.
+ */
+export const fileProviderS3EnvFeature = createFileProviderS3Feature({ fromEnv: true });

package/dist/files-provider-s3/index.d.ts

@@ -1,3 +1,5 @@
-export { createS3ProviderFromEnv, parseS3EnvConfig } from "./env-helper.js";
-export type { S3ProviderConfig } from "./s3-provider.js";
-export { createS3Provider, resolveForcePathStyle } from "./s3-provider.js";
+/**
+ * @deprecated Moved to `@cosmicdrift/kumiko-bundled-features/file-provider-s3/lib`. Run `bun kumiko-upgrade --apply`
+ * to rewrite imports. Removed in the first release after 2026-10-29.
+ */
+export { createS3Provider, createS3ProviderFromEnv, parseS3EnvConfig, resolveForcePathStyle, type S3ProviderConfig, } from "../file-provider-s3/lib/index.js";

package/dist/files-provider-s3/index.js

@@ -1,2 +1,5 @@
-export { createS3ProviderFromEnv, parseS3EnvConfig } from "./env-helper.js";
-export { createS3Provider, resolveForcePathStyle } from "./s3-provider.js";
+/**
+ * @deprecated Moved to `@cosmicdrift/kumiko-bundled-features/file-provider-s3/lib`. Run `bun kumiko-upgrade --apply`
+ * to rewrite imports. Removed in the first release after 2026-10-29.
+ */
+export { createS3Provider, createS3ProviderFromEnv, parseS3EnvConfig, resolveForcePathStyle, } from "../file-provider-s3/lib/index.js";

package/dist/files-tenant-data/handlers/sweep-orphaned-derivatives.job.js

@@ -17,7 +17,7 @@
 // were a tenant. nextBatch pages tenants internally and buffers their
 // candidates into a flat queue so the shared deadline/circuit-breaker/signal
 // handling still applies per-key.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { parseDerivativeKey } from "@cosmicdrift/kumiko-framework/derivatives";
 import { assertSafeStorageKey, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
 import * as z from "zod";

package/dist/files-tenant-data/hooks.js

@@ -45,8 +45,7 @@
 //     matches would still delete it out from under the tenant that claimed
 //     its original. Batched: one existence query per chunk of listed keys,
 //     not one query per key.
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { assertSafeStorageKey, fileRefEntity, fileRefsTable, storageKeyStemPrefix, tenantStoragePrefixes, } from "@cosmicdrift/kumiko-framework/files";
 import { runChunkedMigration } from "../shared/index.js";

package/dist/folders/feature.d.ts

@@ -2,7 +2,7 @@ import { type AccessRule, type EntityDefinition } from "@cosmicdrift/kumiko-fram
 type FoldersToggleable = {
     readonly default: boolean;
 };
-export declare const foldersFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+declare const defaultFoldersFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
 export type FoldersFeatureOptions = {
@@ -41,5 +41,9 @@ export type FoldersFeatureOptions = {
      *  otherwise considers every registered entity as a candidate host. */
     readonly parents?: readonly string[];
 };
-export declare function createFoldersFeature(opts?: FoldersFeatureOptions): typeof foldersFeature;
+export declare function createFoldersFeature(opts?: FoldersFeatureOptions): typeof defaultFoldersFeature;
+/** @deprecated Use createFoldersFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export declare const foldersFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
 export {};

package/dist/folders/feature.js

@@ -62,7 +62,7 @@ function registerFolders(r, access, toggleable, ownership, parents) {
         description: "Lists the folder-membership rows of the caller's tenant; filter on entityId to learn which folder one entity sits in, or on folderId to list everything filed into a folder.",
     }));
 }
-export const foldersFeature = defineFeature(FOLDERS_FEATURE_NAME, (r) => registerFolders(r, DEFAULT_FOLDER_ACCESS, undefined, undefined, undefined));
+const defaultFoldersFeature = defineFeature(FOLDERS_FEATURE_NAME, (r) => registerFolders(r, DEFAULT_FOLDER_ACCESS, undefined, undefined, undefined));
 function resolveAccess(opts) {
     if (opts.access !== undefined)
         return opts.access;
@@ -78,7 +78,7 @@ export function createFoldersFeature(opts = {}) {
         opts.toggleable === undefined &&
         opts.ownership === undefined &&
         opts.parents === undefined) {
-        return foldersFeature;
+        return defaultFoldersFeature;
     }
     assertNoWhereRuleInOwnershipWrite("createFoldersFeature", opts.ownership?.write);
     if (opts.parents !== undefined && opts.parents.length === 0) {
@@ -90,3 +90,5 @@ export function createFoldersFeature(opts = {}) {
     const access = resolveAccess(opts);
     return defineFeature(FOLDERS_FEATURE_NAME, (r) => registerFolders(r, access, opts.toggleable, opts.ownership, opts.parents));
 }
+/** @deprecated Use createFoldersFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const foldersFeature = createFoldersFeature();

package/dist/folders-user-data/index.d.ts

@@ -1,3 +1,7 @@
+export declare function createFoldersUserDataFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createFoldersUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const foldersUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/folders-user-data/index.js

@@ -5,20 +5,24 @@
 // folders stays usable without the user-data-rights stack. Mirrors credit-user-data.
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { folderAssignmentDeleteHook, folderAssignmentExportHook, folderDeleteHook, folderExportHook, } from "./hooks.js";
-export const foldersUserDataFeature = defineFeature("folders-user-data", (r) => {
-    r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `folders` feature's `folder` + `folder-assignment` entities. Mounts the EXT_USER_DATA export + delete hooks so a tenant's folder tree and its entity-to-folder assignments are included in the user-data export bundle and erased on a tenant-scoped forget (single-user tenants only; multi-user + anonymize are no-ops since folder rows carry no per-user PII). Kept separate from `folders` so folder consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `folders`.");
-    // user-data-rights is the hard dependency (EXT_USER_DATA host). `folders` is
-    // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
-    // tier), a hard r.requires would throw an "effectively disabled" boot
-    // warning even though the folder entities exist and the hooks work fine.
-    r.requires({ features: ["user-data-rights"] });
-    r.optionalRequires("folders");
-    r.useExtension(EXT_USER_DATA, "folder", {
-        export: folderExportHook,
-        delete: folderDeleteHook,
-    });
-    r.useExtension(EXT_USER_DATA, "folder-assignment", {
-        export: folderAssignmentExportHook,
-        delete: folderAssignmentDeleteHook,
-    });
-});
+export function createFoldersUserDataFeature() {
+    return defineFeature("folders-user-data", (r) => {
+        r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `folders` feature's `folder` + `folder-assignment` entities. Mounts the EXT_USER_DATA export + delete hooks so a tenant's folder tree and its entity-to-folder assignments are included in the user-data export bundle and erased on a tenant-scoped forget (single-user tenants only; multi-user + anonymize are no-ops since folder rows carry no per-user PII). Kept separate from `folders` so folder consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `folders`.");
+        // user-data-rights is the hard dependency (EXT_USER_DATA host). `folders` is
+        // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
+        // tier), a hard r.requires would throw an "effectively disabled" boot
+        // warning even though the folder entities exist and the hooks work fine.
+        r.requires({ features: ["user-data-rights"] });
+        r.optionalRequires("folders");
+        r.useExtension(EXT_USER_DATA, "folder", {
+            export: folderExportHook,
+            delete: folderDeleteHook,
+        });
+        r.useExtension(EXT_USER_DATA, "folder-assignment", {
+            export: folderAssignmentExportHook,
+            delete: folderAssignmentDeleteHook,
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createFoldersUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const foldersUserDataFeature = createFoldersUserDataFeature();

package/dist/form-draft/db/queries/cleanup.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 // COALESCE(modified_at, inserted_at) — a draft's "last touched" timestamp is
 // modified_at once the upsert path (save.write.ts) has updated it at least

package/dist/form-draft/db/queries/draft-count.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 // COUNT(*), not selectMany(...).length — save.write.ts checks this on every
 // create, and a draft's `values` blob can be up to FORM_DRAFT_VALUES_MAX_BYTES
 // (64KB); loading up to FORM_DRAFT_MAX_PER_OWNER full rows just to count them

package/dist/form-draft/db/queries/owned-file-refs.js

@@ -1,5 +1,4 @@
-import { instantToTimestamptzParam, unsafeReadRetrying, } from "@cosmicdrift/kumiko-framework/bun-db";
-import { toPostgresArrayLiteral } from "@cosmicdrift/kumiko-framework/db";
+import { instantToTimestamptzParam, toPostgresArrayLiteral, unsafeReadRetrying, } from "@cosmicdrift/kumiko-framework/db";
 // Narrows a draft blob's raw FileRef-shaped storageKeys (collectDraftFileRefKeys
 // output — extracted from free-form, client-supplied JSON, issue #1889) down to
 // the ones with a real, non-deleted file_refs row owned by this exact

package/dist/form-draft/feature.d.ts

@@ -1,3 +1,7 @@
+export declare function createFormDraftFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createFormDraftFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const formDraftFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/form-draft/feature.js

@@ -41,4 +41,8 @@ function registerFormDraft(r) {
         handler: (payload, ctx) => cleanupDraftsJob(payload, ctx, ctx.db.unsafeRaw()),
     });
 }
-export const formDraftFeature = defineFeature(FORM_DRAFT_FEATURE_NAME, registerFormDraft);
+export function createFormDraftFeature() {
+    return defineFeature(FORM_DRAFT_FEATURE_NAME, registerFormDraft, { dedupeOptions: {} });
+}
+/** @deprecated Use createFormDraftFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const formDraftFeature = createFormDraftFeature();

package/dist/form-draft/handlers/cleanup.job.js

@@ -37,7 +37,7 @@ async function releaseRowFileRefs(row, db, fileProviderResolver, log) {
     const isCreateMode = row.draftKey.includes(":new:");
     const ownedRefs = await filterOwnedFileRefs(db, row.tenantId, row.ownerId, keys, row.insertedAt, isCreateMode);
     const systemUser = createSystemUser(row.tenantId);
-    const tenantDb = createTenantDb(db, row.tenantId, "system");
+    const tenantDb = createTenantDb({ db, tenantId: row.tenantId, mode: "system" });
     for (const ref of ownedRefs) {
         const forgetResult = await fileRefExecutor.forget({ id: ref.id }, systemUser, tenantDb);
         if (!forgetResult.isSuccess) {
@@ -78,7 +78,7 @@ export async function deleteStaleDraftsBatch(batch, db, retentionDays, log) {
     const byId = new Map(batch.map((row) => [row.id, row]));
     for (const [tenantId, ids] of groupStaleDraftIdsByTenant(batch)) {
         const systemUser = createSystemUser(tenantId);
-        const tenantDb = createTenantDb(db, tenantId, "system");
+        const tenantDb = createTenantDb({ db, tenantId, mode: "system" });
         for (const id of ids) {
             // Race: user may have saved between select and here — skip if no longer stale.
             if (!(await isDraftStillStale(db, tenantId, id, retentionDays))) {

package/dist/form-draft/index.d.ts

@@ -1,7 +1,7 @@
 export { FORM_DRAFT_ACCESS, FORM_DRAFT_FEATURE_NAME, FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT, FormDraftHandlers, FormDraftQueries, } from "./constants.js";
 export { formDraftEntity } from "./entity.js";
 export { formDraftExecutor, formDraftTable } from "./executor.js";
-export { formDraftFeature } from "./feature.js";
+export { createFormDraftFeature, formDraftFeature } from "./feature.js";
 export { discardDraftWrite } from "./handlers/discard.write.js";
 export { type GetDraftResult, getDraftQuery } from "./handlers/get.query.js";
 export { type ListDraftsResult, listDraftsQuery } from "./handlers/list.query.js";

package/dist/form-draft/index.js

@@ -1,7 +1,7 @@
 export { FORM_DRAFT_ACCESS, FORM_DRAFT_FEATURE_NAME, FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT, FormDraftHandlers, FormDraftQueries, } from "./constants.js";
 export { formDraftEntity } from "./entity.js";
 export { formDraftExecutor, formDraftTable } from "./executor.js";
-export { formDraftFeature } from "./feature.js";
+export { createFormDraftFeature, formDraftFeature } from "./feature.js";
 export { discardDraftWrite } from "./handlers/discard.write.js";
 export { getDraftQuery } from "./handlers/get.query.js";
 export { listDraftsQuery } from "./handlers/list.query.js";

package/dist/form-draft/lookup.js

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { formDraftTable } from "./executor.js";
 // Shared by save (upsert lookup + race re-lookup), discard, and get — always
 // scoped by tenantId + ownerId + draftKey, tenantId included explicitly

package/dist/form-draft-user-data/index.d.ts

@@ -1,3 +1,7 @@
+export declare function createFormDraftUserDataFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createFormDraftUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const formDraftUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/form-draft-user-data/index.js

@@ -6,12 +6,16 @@
 // pull a hard dependency. Mirrors notes-history-user-data.
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { formDraftDeleteHook, formDraftExportHook } from "./hooks.js";
-export const formDraftUserDataFeature = defineFeature("form-draft-user-data", (r) => {
-    r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `form-draft` feature's `form-draft` entity. Mounts the EXT_USER_DATA export hook so a user's saved drafts are included in the user-data export bundle, and a delete hook that physically removes the user's own draft rows on forget. Kept separate from `form-draft` so form-draft consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `form-draft`.");
-    r.requires({ features: ["user-data-rights"] });
-    r.optionalRequires("form-draft");
-    r.useExtension(EXT_USER_DATA, "form-draft", {
-        export: formDraftExportHook,
-        delete: formDraftDeleteHook,
-    });
-});
+export function createFormDraftUserDataFeature() {
+    return defineFeature("form-draft-user-data", (r) => {
+        r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `form-draft` feature's `form-draft` entity. Mounts the EXT_USER_DATA export hook so a user's saved drafts are included in the user-data export bundle, and a delete hook that physically removes the user's own draft rows on forget. Kept separate from `form-draft` so form-draft consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `form-draft`.");
+        r.requires({ features: ["user-data-rights"] });
+        r.optionalRequires("form-draft");
+        r.useExtension(EXT_USER_DATA, "form-draft", {
+            export: formDraftExportHook,
+            delete: formDraftDeleteHook,
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createFormDraftUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const formDraftUserDataFeature = createFormDraftUserDataFeature();

package/dist/inbound-mail-foundation/feature.d.ts

@@ -1,3 +1,7 @@
+export declare function createInboundMailFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createInboundMailFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const inboundMailFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };