@cosmicdrift/kumiko-bundled-features 0.80.0 → 0.81.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.80.0",
+  "version": "0.81.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -41,6 +41,7 @@
     "./mail-transport-inmemory": "./src/mail-transport-inmemory/index.ts",
     "./file-foundation": "./src/file-foundation/index.ts",
     "./file-provider-s3": "./src/file-provider-s3/index.ts",
+    "./file-provider-s3-env": "./src/file-provider-s3-env/index.ts",
     "./file-provider-inmemory": "./src/file-provider-inmemory/index.ts",
     "./files": "./src/files/index.ts",
     "./user-data-rights": "./src/user-data-rights/index.ts",
@@ -84,11 +85,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.80.0",
-    "@cosmicdrift/kumiko-framework": "0.80.0",
-    "@cosmicdrift/kumiko-headless": "0.80.0",
-    "@cosmicdrift/kumiko-renderer": "0.80.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.80.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.81.1",
+    "@cosmicdrift/kumiko-framework": "0.81.1",
+    "@cosmicdrift/kumiko-headless": "0.81.1",
+    "@cosmicdrift/kumiko-renderer": "0.81.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.81.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/file-foundation/__tests__/file-foundation.integration.test.ts

@@ -27,6 +27,7 @@ import { createConfigAccessorFactory } from "../../config/feature";
 import { type ConfigResolver, createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
 import { fileProviderS3Feature, S3_SECRET_ACCESS_KEY } from "../../file-provider-s3";
+import { fileProviderS3EnvFeature } from "../../file-provider-s3-env";
 import { createSecretsContext, createSecretsFeature, tenantSecretsTable } from "../../secrets";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -90,6 +91,7 @@ beforeAll(async () => {
       createSecretsFeature(),
       fileFoundationFeature,
       fileProviderS3Feature,
+      fileProviderS3EnvFeature,
       testProbeFeature,
     ],
     masterKeyProvider: providerRef,
@@ -243,3 +245,40 @@ describe("scenario 3: tenant isolation", () => {
     expect(b["hasWrite"]).toBe(true);
   });
 });
+
+// --- Scenario 4: s3-env provider builds from env, NO per-tenant secret ---
+//
+// The "wire-into-any-app" proof for file-provider-s3-env: select the
+// "s3-env" provider, set the S3_* env vars, and the factory builds a working
+// provider WITHOUT any secrets:write:set call. This is the single-bucket /
+// Hetzner deploy path — no admin seeding, no secrets store.
+
+const S3_ENV_KEYS = ["S3_BUCKET", "S3_REGION", "S3_ACCESS_KEY", "S3_SECRET_KEY"] as const;
+
+describe("scenario 4: s3-env provider (app-wide env, no secrets)", () => {
+  test("env vars set + provider=s3-env → factory builds provider without a per-tenant secret", async () => {
+    const admin = adminFor(504);
+    const saved = S3_ENV_KEYS.map((k) => [k, process.env[k]] as const);
+    Object.assign(process.env, {
+      S3_BUCKET: "shared-bucket",
+      S3_REGION: "fsn1",
+      S3_ACCESS_KEY: "AKIAENV",
+      S3_SECRET_KEY: "env-secret-not-real",
+    });
+    try {
+      await setConfig(admin, "file-foundation:config:provider", "s3-env");
+      const result = (await stack.http.writeOk(TEST_HANDLER_QN, {}, admin)) as Record<
+        string,
+        unknown
+      >;
+      expect(result["hasWrite"]).toBe(true);
+      expect(result["hasRead"]).toBe(true);
+      expect(result["hasDelete"]).toBe(true);
+    } finally {
+      for (const [k, v] of saved) {
+        if (v === undefined) delete process.env[k];
+        else process.env[k] = v;
+      }
+    }
+  });
+});

package/src/file-provider-s3-env/feature.ts

@@ -0,0 +1,58 @@
+// kumiko-feature-version: 1
+//
+// file-provider-s3-env — S3 file provider configured entirely from
+// process.env. ONE shared bucket for ALL tenants: wire it by setting the
+// `S3_*` env vars + mounting — no per-tenant admin seeding and no
+// `secrets`-feature dependency.
+//
+// **vs file-provider-s3:** the config-based `"s3"` provider owns per-tenant
+// config keys + an encrypted `s3.secretAccessKey` secret (per-tenant
+// buckets, admin-seeded). This `"s3-env"` provider reads one credential set
+// from env and serves every tenant from one bucket — the
+// Hetzner-Object-Storage / single-bucket deploy case. Tenant isolation
+// still holds: file keys are tenant-prefixed (export ZIPs:
+// `<tenantId>/exports/<jobId>.zip`) or globally-unique UUIDs (fileRefs).
+//
+// **Pattern-Vorbild:** mirrors file-provider-inmemory (zero admin seeding,
+// only the file-foundation plugin-point required).
+//
+// **Env vars** (read by createS3ProviderFromEnv, prefix `S3_`):
+//   required — S3_BUCKET, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY
+//   optional — S3_ENDPOINT (S3-compat stores incl. Hetzner Object Storage),
+//              S3_FORCE_PATH_STYLE
+// Missing required vars throw on the FIRST file op (inside the export cron).
+// The user-data-rights boot guard surfaces that at boot instead.
+
+import type {
+  FileProviderContext,
+  FileProviderPlugin,
+} from "@cosmicdrift/kumiko-bundled-features/file-foundation";
+import { createS3ProviderFromEnv } from "@cosmicdrift/kumiko-bundled-features/files-provider-s3";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+
+const FEATURE_NAME = "file-provider-s3-env";
+
+export const fileProviderS3EnvFeature = defineFeature(FEATURE_NAME, (r) => {
+  r.describe(
+    'Registers an `"s3-env"` provider for `file-foundation` that reads one S3 credential set from `process.env` (`S3_BUCKET`/`S3_REGION`/`S3_ACCESS_KEY`/`S3_SECRET_KEY`, optional `S3_ENDPOINT`/`S3_FORCE_PATH_STYLE`) and serves every tenant from one shared bucket — no per-tenant config or secret seeding. Use this for single-bucket S3-compatible deploys (e.g. Hetzner Object Storage); use `file-provider-s3` instead when each tenant needs its own bucket/credentials.',
+  );
+  r.uiHints({
+    displayLabel: "File Provider · S3 (env)",
+    category: "storage",
+    recommended: false,
+  });
+  // No r.requires("config") / r.requires("secrets") — credentials come from
+  // env, not the per-tenant config + secrets store. Only the file-foundation
+  // plugin-extension-point must be mounted.
+  r.requires("file-foundation");
+
+  const plugin: FileProviderPlugin = {
+    // tenantId ignored: one shared bucket serves all tenants (isolation via
+    // tenant-prefixed / UUID keys). Built fresh per call like file-provider-s3;
+    // the S3 client opens no connection at construction.
+    build: async (_ctx: FileProviderContext, _tenantId: string): Promise<FileStorageProvider> =>
+      createS3ProviderFromEnv(), // @wrapper-known semantic-alias
+  };
+  r.useExtension("fileProvider", "s3-env", plugin);
+});

package/src/file-provider-s3-env/index.ts

@@ -0,0 +1,3 @@
+// Public API of the file-provider-s3-env bundled-feature.
+
+export { fileProviderS3EnvFeature } from "./feature";

package/src/user-data-rights/__tests__/file-binary-forget-cleanup.integration.test.ts

@@ -8,8 +8,10 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createInMemoryFileProvider,
+  type FileStorageProvider,
   fileRefsTable,
   type InMemoryFileProvider,
 } from "@cosmicdrift/kumiko-framework/files";
@@ -21,24 +23,36 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createConfigAccessorFactory } from "../../config/feature";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
+import { fileFoundationFeature } from "../../file-foundation";
 import { createFilesFeature } from "../../files";
 import { createSessionsFeature } from "../../sessions";
 import { createUserFeature, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { runForgetCleanup } from "../run-forget-cleanup";
 import {
   createForgetSeeders,
+  createTestFileProviderFeature,
   type ForgetSeeders,
   nowInstant,
   READ_TENANT_MEMBERSHIPS_DDL,
 } from "./forget-test-helpers";
 
+const FILE_PROVIDER_CONFIG_KEY = "file-foundation:config:provider";
+
 let stack: TestStack;
 let db: DbConnection;
 let provider: InMemoryFileProvider;
 let seed: ForgetSeeders;
+// Per-tenant resolver the forget pipeline uses — built from the stack's
+// configResolver, resolves "test" → the test provider plugin → `provider`.
+let buildStorageProvider: (tenantId: string) => Promise<FileStorageProvider>;
 
 const TENANT = "00000000-0000-4000-8000-00000000000c";
 
@@ -48,24 +62,44 @@ function uuid(suffix: number): string {
 
 beforeAll(async () => {
   provider = createInMemoryFileProvider();
+  // Forget resolves the binary store through file-foundation (the production
+  // path) — mount it + a test plugin returning THIS provider, selected app-wide
+  // via a config app-override (no admin write needed).
+  const appOverrides = new Map<string, string>([[FILE_PROVIDER_CONFIG_KEY, "test"]]);
+  const resolver = createConfigResolver({ appOverrides });
   stack = await setupTestStack({
     features: [
+      createConfigFeature(),
       createUserFeature(),
       createFilesFeature(),
+      fileFoundationFeature,
+      createTestFileProviderFeature(provider, "test"),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
       createSessionsFeature(),
       createUserDataRightsFeature(),
-      createUserDataRightsDefaultsFeature({ storageProvider: provider }),
+      createUserDataRightsDefaultsFeature(),
     ],
     files: { storageProvider: provider },
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
   });
   db = stack.db;
   seed = createForgetSeeders(db, provider);
+  buildStorageProvider = makeTenantStorageProviderResolver({
+    registry: stack.registry,
+    configResolver: resolver,
+    secrets: undefined,
+    db,
+    userId: SYSTEM_USER_ID,
+    handlerName: "test-forget-cleanup",
+  });
 
   await unsafeCreateEntityTable(db, userEntity);
   await unsafeCreateEntityTable(db, tenantRetentionOverrideEntity);
-  await unsafePushTables(db, { fileRefsTable });
+  await unsafePushTables(db, { fileRefsTable, configValuesTable });
   await asRawClient(db).unsafe(READ_TENANT_MEMBERSHIPS_DDL);
 });
 
@@ -86,7 +120,12 @@ describe("forget-binary-cleanup :: storage.delete fires before row hard-delete",
     const key = await seed.seedFile(uuid(101), TENANT, userId);
     expect(await provider.exists(key)).toBe(true);
 
-    const result = await runForgetCleanup({ db, registry: stack.registry, now: nowInstant() });
+    const result = await runForgetCleanup({
+      db,
+      registry: stack.registry,
+      now: nowInstant(),
+      buildStorageProvider,
+    });
 
     expect(result.processedUserIds).toContain(userId);
     expect(await provider.exists(key)).toBe(false);
@@ -104,7 +143,12 @@ describe("forget-binary-cleanup :: storage.delete fires before row hard-delete",
     ]);
     expect(provider.keys()).toHaveLength(3);
 
-    await runForgetCleanup({ db, registry: stack.registry, now: nowInstant() });
+    await runForgetCleanup({
+      db,
+      registry: stack.registry,
+      now: nowInstant(),
+      buildStorageProvider,
+    });
 
     for (const key of keys) {
       expect(await provider.exists(key)).toBe(false);
@@ -122,7 +166,12 @@ describe("forget-binary-cleanup :: storage.delete fires before row hard-delete",
     // The other-tenant file is owned by a different user; the forget run for
     // userId must NOT touch it.
 
-    await runForgetCleanup({ db, registry: stack.registry, now: nowInstant() });
+    await runForgetCleanup({
+      db,
+      registry: stack.registry,
+      now: nowInstant(),
+      buildStorageProvider,
+    });
 
     expect(await provider.exists(myKey)).toBe(false);
     expect(await provider.exists(otherKey)).toBe(true);

package/src/user-data-rights/__tests__/file-binary-forget-failure.integration.test.ts

@@ -12,8 +12,10 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createInMemoryFileProvider,
+  type FileStorageProvider,
   fileRefsTable,
   type InMemoryFileProvider,
 } from "@cosmicdrift/kumiko-framework/files";
@@ -25,24 +27,36 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createConfigAccessorFactory } from "../../config/feature";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
+import { fileFoundationFeature } from "../../file-foundation";
 import { createFilesFeature } from "../../files";
 import { createSessionsFeature } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { runForgetCleanup } from "../run-forget-cleanup";
 import {
   createForgetSeeders,
+  createTestFileProviderFeature,
   type ForgetSeeders,
   nowInstant,
   READ_TENANT_MEMBERSHIPS_DDL,
 } from "./forget-test-helpers";
 
+const FILE_PROVIDER_CONFIG_KEY = "file-foundation:config:provider";
+
 let stack: TestStack;
 let db: DbConnection;
 let base: InMemoryFileProvider;
 let seed: ForgetSeeders;
+// Per-tenant resolver for the direct runForgetCleanup calls — resolves through
+// file-foundation to the flaky provider, same path the dispatcher handler uses.
+let buildStorageProvider: (tenantId: string) => Promise<FileStorageProvider>;
 // `delete` throws while set; flip off to simulate storage recovery on retry.
 let failDeletes = true;
 
@@ -59,26 +73,45 @@ beforeAll(async () => {
       return base.delete(key);
     },
   };
+  // Forget resolves the binary store through file-foundation (production path).
+  // The test plugin returns the flaky provider; selected app-wide via override.
+  const appOverrides = new Map<string, string>([[FILE_PROVIDER_CONFIG_KEY, "test"]]);
+  const resolver = createConfigResolver({ appOverrides });
   stack = await setupTestStack({
     features: [
+      createConfigFeature(),
       createUserFeature(),
       createFilesFeature(),
+      fileFoundationFeature,
+      createTestFileProviderFeature(flakyProvider, "test"),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
       createSessionsFeature(),
       createUserDataRightsFeature(),
-      createUserDataRightsDefaultsFeature({ storageProvider: flakyProvider }),
+      createUserDataRightsDefaultsFeature(),
     ],
     files: { storageProvider: flakyProvider },
+    extraContext: ({ registry }) => ({
+      configResolver: resolver,
+      _configAccessorFactory: createConfigAccessorFactory(registry, resolver),
+    }),
   });
   db = stack.db;
   // Seeders write binaries through the real store (`base`), not the flaky
   // wrapper — the wrapper's `delete` failure is what the test exercises.
   seed = createForgetSeeders(db, base);
+  buildStorageProvider = makeTenantStorageProviderResolver({
+    registry: stack.registry,
+    configResolver: resolver,
+    secrets: undefined,
+    db,
+    userId: SYSTEM_USER_ID,
+    handlerName: "test-forget-failure",
+  });
 
   await unsafeCreateEntityTable(db, userEntity);
   await unsafeCreateEntityTable(db, tenantRetentionOverrideEntity);
-  await unsafePushTables(db, { fileRefsTable });
+  await unsafePushTables(db, { fileRefsTable, configValuesTable });
   await asRawClient(db).unsafe(READ_TENANT_MEMBERSHIPS_DDL);
 });
 
@@ -107,7 +140,12 @@ describe("forget fail-closed :: storage.delete failure aborts the row hard-delet
     await seed.seedMembership(userId, TENANT);
     const key = await seed.seedFile("dddddddd-dddd-4ddd-8ddd-000000000001", TENANT, userId);
 
-    const result = await runForgetCleanup({ db, registry: stack.registry, now: nowInstant() });
+    const result = await runForgetCleanup({
+      db,
+      registry: stack.registry,
+      now: nowInstant(),
+      buildStorageProvider,
+    });
 
     // NOT flipped to Deleted — the sub-tx rolled back.
     expect(result.processedUserIds).not.toContain(userId);
@@ -128,13 +166,23 @@ describe("forget fail-closed :: storage.delete failure aborts the row hard-delet
     const key = await seed.seedFile("dddddddd-dddd-4ddd-8ddd-000000000002", TENANT, userId);
 
     // First run: storage down → abort.
-    const first = await runForgetCleanup({ db, registry: stack.registry, now: nowInstant() });
+    const first = await runForgetCleanup({
+      db,
+      registry: stack.registry,
+      now: nowInstant(),
+      buildStorageProvider,
+    });
     expect(first.processedUserIds).not.toContain(userId);
     expect(await base.exists(key)).toBe(true);
 
     // Storage recovers; retry converges.
     failDeletes = false;
-    const second = await runForgetCleanup({ db, registry: stack.registry, now: nowInstant() });
+    const second = await runForgetCleanup({
+      db,
+      registry: stack.registry,
+      now: nowInstant(),
+      buildStorageProvider,
+    });
 
     expect(second.processedUserIds).toContain(userId);
     expect(await base.exists(key)).toBe(false);

package/src/user-data-rights/__tests__/forget-test-helpers.ts

@@ -6,11 +6,27 @@
 
 import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { USER_STATUS, userTable } from "../../user";
 
 export const TENANT_SYSTEM = "00000000-0000-4000-8000-000000000001";
 
+// Test file-provider plugin: registers `provider` under the file-foundation
+// `fileProvider` extension point so the forget pipeline resolves THIS instance
+// through createFileProviderForTenant — the same path production uses. Set
+// `file-foundation:config:provider` to `name` to select it.
+export function createTestFileProviderFeature(
+  provider: FileStorageProvider,
+  name = "test",
+): FeatureDefinition {
+  return defineFeature(`test-file-provider-${name}`, (r) => {
+    r.requires("file-foundation");
+    r.useExtension("fileProvider", name, { build: async () => provider });
+  });
+}
+
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 export const nowInstant = (): Instant => getTemporal().Now.instant();
 export const pastInstant = (): Instant =>

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -269,6 +269,35 @@ describe("runForgetCleanup :: happy path (Cross-Tenant Account-Deletion)", () =>
   });
 });
 
+describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
+  // Beweist C1: der Forget-Cleanup ist als autonomer Cron registriert, nicht
+  // nur als manueller runForget-API. Ohne die r.job-Registrierung liefert
+  // getJob undefined und die Loeschung laeuft nach Grace-Ablauf NIE. Wir
+  // treiben den ECHTEN registrierten Job durch den echten JobContext (db +
+  // registry, kein config) — nicht den inneren runForgetCleanup-Helper.
+  test("registered job exists + erases through the real JobContext", async () => {
+    const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
+    expect(job).toBeTruthy();
+
+    const CRON_USER = uuid(7);
+    await seedUser(CRON_USER, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+      email: "cron-delete@example.com",
+      displayName: "CronDelete",
+    });
+    await seedMembership(CRON_USER, TENANT_A);
+
+    const jobCtx = { db: stack.db, registry: stack.registry };
+    await job?.handler({}, jobCtx as never);
+
+    const row = await fetchUser(CRON_USER);
+    expect(row?.status).toBe(USER_STATUS.Deleted);
+    expect(row?.email).not.toContain("cron-delete@example.com");
+    expect(row?.email).toContain("anonymized.invalid");
+  });
+});
+
 describe("runForgetCleanup :: time-window guards", () => {
   test("Future-grace User wird NICHT bearbeitet", async () => {
     await seedUser(FUTURE_USER_ID, {

package/src/user-data-rights/feature.ts

@@ -4,8 +4,6 @@ import {
   type FeatureDefinition,
   SYSTEM_USER_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { createConfigAccessor } from "../config";
-import { createFileProviderForTenant } from "../file-foundation";
 import { PRIVACY_CENTER_SCREEN_ID } from "./constants";
 import { cancelDeletionWrite } from "./handlers/cancel-deletion.write";
 import { createConfirmDeletionByTokenHandler } from "./handlers/confirm-deletion-by-token.write";
@@ -26,12 +24,13 @@ import {
 import { requestExportWrite } from "./handlers/request-export.write";
 import { restrictAccountWrite } from "./handlers/restrict-account.write";
 import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.write";
+import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver";
 import {
   runExportJobs,
   type SendExportFailedEmailFn,
   type SendExportReadyEmailFn,
 } from "./run-export-jobs";
-import type { SendDeletionExecutedEmailFn } from "./run-forget-cleanup";
+import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "./run-forget-cleanup";
 import { downloadAttemptEntity } from "./schema/download-attempt";
 import { exportDownloadTokenEntity } from "./schema/download-token";
 import { exportJobEntity } from "./schema/export-job";
@@ -276,29 +275,18 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
         await runExportJobs({
           db: exportDb,
           registry: exportRegistry,
-          buildStorageProvider: async (tenantId) => {
-            // ctx.config (per-request ConfigAccessor) existiert nur im HTTP-
-            // Dispatcher; der Cron-Job-Kontext trägt ctx.configResolver. Den
-            // per-Tenant-Accessor daraus bauen (wie der HTTP-Pfad via
-            // _configAccessorFactory) — sonst wirft createFileProviderForTenant
-            // "ctx.config is missing" und jeder Export landet auf failed.
-            const config =
-              ctx.config ??
-              (ctx.configResolver
-                ? createConfigAccessor(
-                    exportRegistry,
-                    ctx.configResolver,
-                    tenantId as Parameters<typeof createConfigAccessor>[2],
-                    exportUserId,
-                    exportDb,
-                  )
-                : undefined);
-            return createFileProviderForTenant(
-              { config, registry: exportRegistry, secrets: ctx.secrets, _userId: exportUserId },
-              tenantId,
-              "user-data-rights:run-export-jobs",
-            );
-          },
+          // Per-tenant provider from the mounted file-foundation. The cron
+          // context carries configResolver (not the per-request ConfigAccessor),
+          // so the resolver builds a per-tenant accessor from it — otherwise
+          // createFileProviderForTenant throws and every export lands on failed.
+          buildStorageProvider: makeTenantStorageProviderResolver({
+            registry: exportRegistry,
+            configResolver: ctx.configResolver,
+            secrets: ctx.secrets,
+            db: exportDb,
+            userId: exportUserId,
+            handlerName: "user-data-rights:run-export-jobs",
+          }),
           now: T.Now.instant(),
           // Atom 5 — App-Author-Callbacks fuer Email-Notification.
           // Optional: wenn nicht gesetzt, kein Email; User pollt
@@ -315,6 +303,44 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
         });
       },
     );
+
+    // Autonomer Art.17-Forget-Cron. Spiegelt run-export-jobs: nach Ablauf der
+    // Grace-Period laeuft runForgetCleanup unbeaufsichtigt (der manuelle
+    // userDataRights.runForget-API bleibt fuer Operator-Runs). Ohne diesen
+    // Cron bleibt jeder Loesch-Antrag fuer immer in DeletionRequested haengen
+    // — Art.17 wuerde nie ausgefuehrt.
+    r.job(
+      "run-forget-cleanup",
+      { trigger: { cron: "0 * * * * *" }, concurrency: "skip" },
+      async (_payload, ctx) => {
+        if (!ctx.db || !ctx.registry) {
+          throw new Error(
+            "run-forget-cleanup: ctx.db + ctx.registry required (JobContext incomplete)",
+          );
+        }
+        const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
+        const forgetUserId = ctx._userId ?? SYSTEM_USER_ID;
+        const forgetDb = ctx.db as import("@cosmicdrift/kumiko-framework/db").DbConnection; // @cast-boundary db-operator
+        await runForgetCleanup({
+          db: forgetDb,
+          registry: ctx.registry,
+          now: T.Now.instant(),
+          // Same per-tenant provider resolution as the export cron — forget
+          // deletes binaries from the store upload + export use.
+          buildStorageProvider: makeTenantStorageProviderResolver({
+            registry: ctx.registry,
+            configResolver: ctx.configResolver,
+            secrets: ctx.secrets,
+            db: forgetDb,
+            userId: forgetUserId,
+            handlerName: "user-data-rights:run-forget-cleanup",
+          }),
+          ...(opts.sendDeletionExecutedEmail && {
+            sendDeletionExecutedEmail: opts.sendDeletionExecutedEmail,
+          }),
+        });
+      },
+    );
   });
 }
 

package/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -10,10 +10,12 @@
 //
 // Rueckgabe: Stats fuer Operator-Monitoring (processed-count, error-list).
 
-import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { access, defineWriteHandler, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver";
 import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "../run-forget-cleanup";
 
 export type RunForgetCleanupOptions = {
@@ -36,12 +38,25 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
 
       // ctx.db.raw ist DbRunner. runForgetCleanup oeffnet pro User eine
       // Sub-Tx (SAVEPOINT wenn Outer-Dispatcher-Tx aktiv) — siehe
-      // run-forget-cleanup.ts Header. Kein DbConnection-Cast noetig.
+      // run-forget-cleanup.ts Header.
       const T = getTemporal();
+      // Operator-triggered forget must also erase binaries, not just rows —
+      // it flips users to Deleted, after which the cron never re-processes
+      // them, so a row-only delete here would permanently leak the binaries.
+      // Resolve through the same file-foundation path the cron uses.
+      const forgetDb = ctx.db.raw as DbConnection; // @cast-boundary db-operator: config reads tolerate the outer tx
       const result = await runForgetCleanup({
         db: ctx.db.raw,
         registry: ctx.registry,
         now: T.Now.instant(),
+        buildStorageProvider: makeTenantStorageProviderResolver({
+          registry: ctx.registry,
+          configResolver: ctx.configResolver,
+          secrets: ctx.secrets,
+          db: forgetDb,
+          userId: ctx._userId ?? SYSTEM_USER_ID,
+          handlerName: "user-data-rights:run-forget-cleanup",
+        }),
         ...(opts.sendDeletionExecutedEmail && {
           sendDeletionExecutedEmail: opts.sendDeletionExecutedEmail,
         }),

package/src/user-data-rights/lib/storage-provider-resolver.ts

@@ -0,0 +1,48 @@
+// Builds a per-tenant file-storage-provider resolver from a job/handler
+// context, so the export pipeline and the forget pipeline resolve binaries
+// through the SAME mounted file-foundation (delete-target == upload-target by
+// construction). Extracted from the export cron so both crons + the manual
+// forget handler share one construction site instead of inlining it three times.
+
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { ConfigResolver, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import { createConfigAccessor } from "../../config";
+import { createFileProviderForTenant } from "../../file-foundation";
+
+export interface TenantStorageResolverCtx {
+  readonly registry: Registry;
+  // Job-context carries configResolver (per-request ConfigAccessor exists only
+  // in the HTTP dispatcher); the resolver builds a per-tenant accessor from it.
+  // Undefined → the returned resolver throws (callers decide fail-loud vs skip).
+  readonly configResolver: ConfigResolver | undefined;
+  readonly secrets: SecretsContext | undefined;
+  readonly db: DbConnection;
+  readonly userId: string;
+  readonly handlerName: string;
+}
+
+export function makeTenantStorageProviderResolver(
+  ctx: TenantStorageResolverCtx,
+): (tenantId: TenantId) => Promise<FileStorageProvider> {
+  return async (tenantId) => {
+    if (!ctx.configResolver) {
+      throw new Error(
+        `${ctx.handlerName}: ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
+      );
+    }
+    const config = createConfigAccessor(
+      ctx.registry,
+      ctx.configResolver,
+      tenantId as Parameters<typeof createConfigAccessor>[2], // @cast-boundary engine-payload: TenantId brand
+      ctx.userId,
+      ctx.db,
+    );
+    return createFileProviderForTenant(
+      { config, registry: ctx.registry, secrets: ctx.secrets, _userId: ctx.userId },
+      tenantId,
+      ctx.handlerName,
+    );
+  };
+}

package/src/user-data-rights/run-forget-cleanup.ts

@@ -41,6 +41,7 @@ import {
   type TenantId,
   type UserDataDeleteHook,
   type UserDataDeleteStrategy,
+  type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { resolveRetentionPolicyForTenant } from "../data-retention";
@@ -85,6 +86,16 @@ export interface RunForgetCleanupArgs {
    *  ohne Callback laeuft Worker still (User hatte schon
    *  request-deletion-Email + grace-period-Erinnerung). */
   readonly sendDeletionExecutedEmail?: SendDeletionExecutedEmailFn;
+
+  /**
+   * Per-tenant file-storage-provider resolver (the forget cron builds it from
+   * the mounted file-foundation, mirroring the export cron). Threaded into
+   * every delete-hook's ctx so file-aware hooks erase binaries from the same
+   * store the upload/export path uses. Omitted → hooks skip binary cleanup.
+   */
+  readonly buildStorageProvider?: (
+    tenantId: TenantId,
+  ) => Promise<UserDataStorageProvider | undefined>;
 }
 
 export interface ForgetCleanupError {
@@ -119,7 +130,7 @@ const HOOK_ORDER_DEFAULT = EXT_USER_DATA_ORDER.DEFAULT;
 export async function runForgetCleanup(
   args: RunForgetCleanupArgs,
 ): Promise<RunForgetCleanupResult> {
-  const { db, registry, now, sendDeletionExecutedEmail } = args;
+  const { db, registry, now, sendDeletionExecutedEmail, buildStorageProvider } = args;
 
   // Step 1: Find users with expired grace period.
   const dueUsers = await selectUsersDueForForgetCleanup(
@@ -161,6 +172,7 @@ export async function runForgetCleanup(
       registry,
       userId: user.id,
       hookEntries,
+      buildStorageProvider,
     });
     hookCallsAttempted += userResult.hookCallsAttempted;
     errors.push(...userResult.errors);
@@ -216,8 +228,9 @@ async function processUser(args: {
   registry: Registry;
   userId: string;
   hookEntries: readonly HookEntry[];
+  buildStorageProvider?: (tenantId: TenantId) => Promise<UserDataStorageProvider | undefined>;
 }): Promise<ProcessUserResult> {
-  const { db, registry, userId, hookEntries } = args;
+  const { db, registry, userId, hookEntries, buildStorageProvider } = args;
   const errors: ForgetCleanupError[] = [];
   let hookCallsAttempted = 0;
 
@@ -274,7 +287,7 @@ async function processUser(args: {
           const strategy = policyToStrategy(policy.policy?.strategy ?? null);
 
           hookCallsAttempted++;
-          await entry.deleteHook({ db: tx, tenantId, userId }, strategy);
+          await entry.deleteHook({ db: tx, tenantId, userId, buildStorageProvider }, strategy);
         }
       }
 

package/src/user-data-rights-defaults/feature.ts

@@ -3,20 +3,9 @@ import {
   EXT_USER_DATA,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
-import { createFileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook";
+import { fileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook";
 import { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook";
 
-export interface UserDataRightsDefaultsOptions {
-  /**
-   * Wired into the fileRef delete-hook: on strategy="delete" the hook
-   * calls `storageProvider.delete(key)` per row before hard-deleting
-   * the row. Without it, file binaries leak on forget (Art. 17) — the
-   * hook logs a one-shot warning so misconfiguration stays visible.
-   */
-  readonly storageProvider?: FileStorageProvider;
-}
-
 // user-data-rights-defaults — Default-Hooks für die Core-Entities
 // `user` (S2.H1) und `fileRef` (S2.H2).
 //
@@ -34,10 +23,12 @@ export interface UserDataRightsDefaultsOptions {
 // Pattern matched file-foundation + file-provider-s3 (separate Plugin-
 // Feature), nicht user/files schreiben ihre eigenen Hooks selbst weil
 // das circular-requires waere.
-export function createUserDataRightsDefaultsFeature(
-  options: UserDataRightsDefaultsOptions = {},
-): FeatureDefinition {
-  const fileRefDeleteHook = createFileRefDeleteHook(options.storageProvider);
+// Binary storage for the fileRef delete-hook is resolved at run time from the
+// mounted file-foundation via ctx.buildStorageProvider (injected by the forget
+// orchestrator) — no provider is captured here, so a single app-wide store and
+// per-tenant stores both work, and forget deletes from the same store upload +
+// export use. See hooks/file-ref.userdata-hook.ts.
+export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
   return defineFeature("user-data-rights-defaults", (r) => {
     r.describe(
       "Registers ready-made `EXT_USER_DATA` export and delete hooks for the two core entities: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`) and `fileRef` (delete removes both the DB row and the storage binary). Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.",

package/src/user-data-rights-defaults/hooks/file-ref.userdata-hook.ts

@@ -1,6 +1,11 @@
 import { deleteMany, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import { type FileStorageProvider, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import type {
+  UserDataDeleteHook,
+  UserDataExportHook,
+  UserDataHookCtx,
+  UserDataStorageProvider,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 
 // userData-Hook fuer fileRef-entity (S2.H2).
 //
@@ -9,29 +14,32 @@ import { type FileStorageProvider, fileRefsTable } from "@cosmicdrift/kumiko-fra
 // NICHT direkt — sie werden via signed-Download-URLs separat ins ZIP
 // gepackt (S2.U3 Export-Job-Pipeline orchestriert das).
 //
-// Delete-Hook entfernt FileRef-Zeile via factory
-// `createFileRefDeleteHook(storageProvider)`:
+// Delete-Hook entfernt FileRef-Zeile + Binary:
 //   "delete":    storageProvider.delete() pro File + Row hard-delete
 //   "anonymize": insertedById=null, Row + binary bleiben (FK-Refs
 //                koennen weiter zeigen; Personenbezug raus)
 //
-// Delete-Pfad ist FAIL-CLOSED, sobald ein Provider gewired ist: schlaegt ein
-// binary-delete fehl, wirft der Hook
-// NACH dem Loop — die per-User-Sub-Tx von runForgetCleanup rollt zurueck, der
-// User bleibt DeletionRequested, der naechste Run retried (storageProvider.delete
-// ist idempotent, schon-geloeschte Keys sind no-op). Den Fehler zu schlucken und
-// die Row trotzdem hard-zu-loeschen wuerde Art.-17-Erasure als "done" markieren
-// waehrend die Bytes auf Disk bleiben — eine falsche Compliance-Aussage. Das
-// "KEIN globaler Rollback" der Sprint-2-Atomicity-Decision bleibt gewahrt: nur
-// DIESE User-Sub-Tx rollt zurueck (= der Retry-Mechanismus), andere User des
-// Laufs committen. Der anonymize-Pfad behaelt Row+binary bewusst, hat also
-// nichts zu schlucken.
+// **Provider-Resolution:** der Provider kommt zur Lauf-Zeit aus
+// `ctx.buildStorageProvider(ctx.tenantId)` — der Forget-Orchestrator
+// (run-forget-cleanup) baut ihn aus dem gemounteten file-foundation, also aus
+// DEMSELBEN Store den Upload + Export nutzen (delete-target == upload-target by
+// construction). Kein bei-Mount captured Provider mehr.
 //
-// `storageProvider` ist optional. App-Author wired es beim
-// Feature-Mount rein (`createUserDataRightsDefaultsFeature({
-// storageProvider })`). Ohne Provider macht der Hook row-only-delete,
-// die Bytes leaken — der Caller bekommt EINEN Warn beim ersten Lauf
-// pro Process, damit die Konfiguration sichtbar fehlerhaft ist.
+// **Zwei Fehlerklassen, bewusst verschieden behandelt:**
+//   1. Resolution schlaegt fehl (kein Provider konfiguriert / configResolver
+//      fehlt) → NICHT fail-closed: EIN Warn pro Process + row-only-delete. Ein
+//      fehlkonfigurierter Store darf die Art.-17-Loeschung nicht DAUERHAFT
+//      blockieren (sonst haengt jeder User fuer immer in DeletionRequested);
+//      der Boot-Guard macht die Fehlkonfiguration sichtbar, Binaries werden
+//      nachgeholt sobald ein Provider existiert.
+//   2. Binary-DELETE schlaegt fehl, OBWOHL ein Provider da ist → FAIL-CLOSED:
+//      der Hook wirft NACH dem Loop, die per-User-Sub-Tx von runForgetCleanup
+//      rollt zurueck, der User bleibt DeletionRequested, der naechste Run
+//      retried (delete ist idempotent → konvergiert). Den Fehler zu schlucken +
+//      die Row trotzdem zu loeschen wuerde Erasure als "done" markieren waehrend
+//      die Bytes liegen bleiben — falsche Compliance-Aussage. Das "KEIN globaler
+//      Rollback" der Sprint-2-Atomicity bleibt gewahrt: nur DIESE Sub-Tx rollt
+//      zurueck. Der anonymize-Pfad behaelt Row+binary, hat nichts zu schlucken.
 //
 // Caveat: hard-delete via deleteMany emittiert KEIN fileRef.deleted —
 // die storage-tracking-MSP dekrementiert nicht. Wenn die zu loeschenden
@@ -88,61 +96,69 @@ export const fileRefExportHook: UserDataExportHook = async (ctx) => {
 
 let missingStorageWarned = false;
 
-export function createFileRefDeleteHook(
-  storageProvider: FileStorageProvider | undefined,
-): UserDataDeleteHook {
-  return async (ctx, strategy) => {
-    if (strategy === "delete") {
-      if (storageProvider) {
-        const rows = await selectMany(ctx.db, fileRefsTable, {
-          tenantId: ctx.tenantId,
-          insertedById: ctx.userId,
-        });
-        const failedKeys: string[] = [];
-        for (const row of rows) {
-          const key = (row as Record<string, unknown>)["storageKey"]; // @cast-boundary db-row
-          if (typeof key !== "string" || key.length === 0) continue;
-          try {
-            await storageProvider.delete(key);
-          } catch (err) {
-            // biome-ignore lint/suspicious/noConsole: operator-visibility for binary-cleanup-failure
-            console.warn(
-              `[user-data-rights-defaults:fileRef] storage delete failed key=${key} err=${err instanceof Error ? err.message : String(err)}`,
-            );
-            failedKeys.push(key);
-          }
-        }
-        // Fail-closed: abort before the row hard-delete so the sub-tx rolls back
-        // and the next forget run retries (delete is idempotent → converges).
-        if (failedKeys.length > 0) {
-          throw new Error(
-            `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
+// Resolve the per-tenant provider the forget orchestrator injected. A
+// resolution failure (no provider configured / configResolver absent) collapses
+// to `undefined` so the hook degrades to a row-only delete instead of throwing —
+// see error-class 1 in the header. A working-provider binary-delete failure is
+// handled separately (fail-closed) below.
+async function resolveProvider(ctx: UserDataHookCtx): Promise<UserDataStorageProvider | undefined> {
+  if (!ctx.buildStorageProvider) return undefined;
+  try {
+    return await ctx.buildStorageProvider(ctx.tenantId);
+  } catch {
+    // skip: provider unresolvable (not configured) → fall through to row-only
+    // delete; warn-once below gives operator visibility, boot guard catches it.
+    return undefined;
+  }
+}
+
+export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
+  if (strategy === "delete") {
+    const storageProvider = await resolveProvider(ctx);
+    if (storageProvider) {
+      const rows = await selectMany(ctx.db, fileRefsTable, {
+        tenantId: ctx.tenantId,
+        insertedById: ctx.userId,
+      });
+      const failedKeys: string[] = [];
+      for (const row of rows) {
+        const key = (row as Record<string, unknown>)["storageKey"]; // @cast-boundary db-row
+        if (typeof key !== "string" || key.length === 0) continue;
+        try {
+          await storageProvider.delete(key);
+        } catch (err) {
+          // biome-ignore lint/suspicious/noConsole: operator-visibility for binary-cleanup-failure
+          console.warn(
+            `[user-data-rights-defaults:fileRef] storage delete failed key=${key} err=${err instanceof Error ? err.message : String(err)}`,
           );
+          failedKeys.push(key);
         }
-      } else if (!missingStorageWarned) {
-        missingStorageWarned = true;
-        // biome-ignore lint/suspicious/noConsole: misconfiguration visibility — disk-leak in forget-flow
-        console.warn(
-          "[user-data-rights-defaults:fileRef] no storageProvider configured — file binaries are NOT deleted on forget. Pass createUserDataRightsDefaultsFeature({ storageProvider }) to fix.",
+      }
+      // Fail-closed: abort before the row hard-delete so the sub-tx rolls back
+      // and the next forget run retries (delete is idempotent → converges).
+      if (failedKeys.length > 0) {
+        throw new Error(
+          `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
         );
       }
-      await deleteMany(ctx.db, fileRefsTable, { tenantId: ctx.tenantId, insertedById: ctx.userId });
-    } else {
-      // anonymize: insertedById=null, FileRef + binary bleiben.
-      // Use-case: shared chat-Attachment in einem Multi-User-Channel —
-      // Author-Identifikation raus, Datei bleibt fuer andere User
-      // sichtbar.
-      await updateMany(
-        ctx.db,
-        fileRefsTable,
-        { insertedById: null },
-        { tenantId: ctx.tenantId, insertedById: ctx.userId },
+    } else if (!missingStorageWarned) {
+      missingStorageWarned = true;
+      // biome-ignore lint/suspicious/noConsole: misconfiguration visibility — disk-leak in forget-flow
+      console.warn(
+        "[user-data-rights-defaults:fileRef] no file provider resolvable from ctx.buildStorageProvider — file binaries are NOT deleted on forget (row-only delete). Mount file-foundation + a file-provider-* feature and set the provider config so erasure can reach the binaries.",
       );
     }
-  };
-}
-
-// Legacy export: storage-less hook for callers that haven't migrated.
-// Binaries are NOT cleaned up — disk leak. Migrate to
-// createUserDataRightsDefaultsFeature({ storageProvider }).
-export const fileRefDeleteHook: UserDataDeleteHook = createFileRefDeleteHook(undefined);
+    await deleteMany(ctx.db, fileRefsTable, { tenantId: ctx.tenantId, insertedById: ctx.userId });
+  } else {
+    // anonymize: insertedById=null, FileRef + binary bleiben.
+    // Use-case: shared chat-Attachment in einem Multi-User-Channel —
+    // Author-Identifikation raus, Datei bleibt fuer andere User
+    // sichtbar.
+    await updateMany(
+      ctx.db,
+      fileRefsTable,
+      { insertedById: null },
+      { tenantId: ctx.tenantId, insertedById: ctx.userId },
+    );
+  }
+};