@cosmicdrift/kumiko-samples 0.366.0 → 0.368.0

package/packages/bundled-features/src/file-provider-s3/feature.ts

@@ -11,7 +11,7 @@
 //      { build })`. file-foundation's Factory findet den Plugin via
 //      registry.
 //   3. build(ctx, tenantId) liest config + secret, ruft `createS3Provider`
-//      aus files-provider-s3 auf. Der EINZIGE Cross-Feature-Import
+//      aus ./lib auf. Der EINZIGE Cross-Feature-Import
 //      des Plugins — bewusst lokal gehalten.
 //
 // **Pattern-Vorbild:** mirrors mail-transport-smtp.
@@ -22,7 +22,6 @@ import type {
   FileProviderContext,
   FileProviderPlugin,
 } from "@cosmicdrift/kumiko-bundled-features/file-foundation";
-import { createS3Provider } from "@cosmicdrift/kumiko-bundled-features/files-provider-s3";
 import {
   requireDefined,
   requireNonEmpty,
@@ -31,85 +30,120 @@ import {
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
+import { createFileProviderS3EnvFeature } from "./env-feature.js";
+import { createS3Provider } from "./lib/s3-provider.js";
 
 const FEATURE_NAME = "file-provider-s3";
 
 // =============================================================================
 // Feature-definition
 // =============================================================================
+function createTenantConfigFileProviderS3Feature() {
+  return defineFeature(
+    FEATURE_NAME,
+    (r) => {
+      r.describe(
+        'Registers itself as the `"s3"` provider for `file-foundation` and owns the per-tenant config keys (`bucket`, `region`, `endpoint`, `forcePathStyle`, `accessKeyId`) and the encrypted `s3.secretAccessKey` secret. Compatible with any S3-compatible object store (AWS S3, Hetzner Object Storage); set credentials via the admin UI or a seed handler before the first file operation.',
+      );
+      r.uiHints({
+        displayLabel: "File Provider · S3",
+        category: "storage",
+        recommended: false,
+      });
+      r.requires({ features: ["config"] });
+      r.requires({ features: ["secrets"] });
+      r.requires({ features: ["file-foundation"] });
 
-export const fileProviderS3Feature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    'Registers itself as the `"s3"` provider for `file-foundation` and owns the per-tenant config keys (`bucket`, `region`, `endpoint`, `forcePathStyle`, `accessKeyId`) and the encrypted `s3.secretAccessKey` secret. Compatible with any S3-compatible object store (AWS S3, Hetzner Object Storage); set credentials via the admin UI or a seed handler before the first file operation.',
-  );
-  r.uiHints({
-    displayLabel: "File Provider · S3",
-    category: "storage",
-    recommended: false,
-  });
-  r.requires({ features: ["config"] });
-  r.requires({ features: ["secrets"] });
-  r.requires({ features: ["file-foundation"] });
-
-  const secretAccessKey = r.secret("s3.secretAccessKey", {
-    label: { en: "S3 secret access key" },
-    hint: {
-      en: "Private half of the S3 key pair. Hetzner calls it 'Secret Key', AWS calls it 'Secret Access Key'.",
-    },
-    redact: (plaintext) => {
-      if (plaintext.length < 8) return "•".repeat(plaintext.length);
-      return `${plaintext.slice(0, 4)}...${plaintext.slice(-4)}`;
-    },
-    scope: "tenant",
-    // required: true ↔ the missing-secret throw in readSecretAccessKey — keep in sync.
-    required: true,
-  });
-
-  // required: true ↔ the requireNonEmpty calls in buildS3Provider — keep in sync.
-  const configKeys = r.config({
-    keys: {
-      bucket: createTenantConfig("text", {
-        required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      region: createTenantConfig("text", {
-        required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      endpoint: createTenantConfig("text", {
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      forcePathStyle: createTenantConfig("boolean", {
-        default: false,
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
-      accessKeyId: createTenantConfig("text", {
+      const secretAccessKey = r.secret("s3.secretAccessKey", {
+        label: { en: "S3 secret access key" },
+        hint: {
+          en: "Private half of the S3 key pair. Hetzner calls it 'Secret Key', AWS calls it 'Secret Access Key'.",
+        },
+        redact: (plaintext) => {
+          if (plaintext.length < 8) return "•".repeat(plaintext.length);
+          return `${plaintext.slice(0, 4)}...${plaintext.slice(-4)}`;
+        },
+        scope: "tenant",
+        // required: true ↔ the missing-secret throw in readSecretAccessKey — keep in sync.
         required: true,
-        default: "",
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin"),
-      }),
+      });
+
+      // required: true ↔ the requireNonEmpty calls in buildS3Provider — keep in sync.
+      const configKeys = r.config({
+        keys: {
+          bucket: createTenantConfig("text", {
+            required: true,
+            default: "",
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin"),
+          }),
+          region: createTenantConfig("text", {
+            required: true,
+            default: "",
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin"),
+          }),
+          endpoint: createTenantConfig("text", {
+            default: "",
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin"),
+          }),
+          forcePathStyle: createTenantConfig("boolean", {
+            default: false,
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+          }),
+          accessKeyId: createTenantConfig("text", {
+            required: true,
+            default: "",
+            write: access.roles("TenantAdmin", "SystemAdmin"),
+            read: access.roles("TenantAdmin", "SystemAdmin"),
+          }),
+        },
+      });
+
+      // Plugin-Registration. entityName "s3" ist was tenants in
+      // file-foundation's `provider` config-key setzen.
+      const plugin: FileProviderPlugin = {
+        build: async (ctx: FileProviderContext, tenantId: string) => buildS3Provider(ctx, tenantId), // @wrapper-known semantic-alias
+      };
+      r.useExtension("fileProvider", "s3", plugin);
+
+      return { configKeys, secretAccessKey };
     },
-  });
+    { dedupeOptions: {} },
+  );
+}
+
+export type FileProviderS3FeatureOptions = {
+  /** Read one shared credential set from the `S3_*` env vars (provider key "s3-env", feature name "file-provider-s3-env") instead of per-tenant config and secret. */
+  readonly fromEnv?: boolean;
+};
+
+export function createFileProviderS3Feature(options: {
+  readonly fromEnv: true;
+}): ReturnType<typeof createFileProviderS3EnvFeature>;
+export function createFileProviderS3Feature(options?: {
+  readonly fromEnv?: false;
+}): ReturnType<typeof createTenantConfigFileProviderS3Feature>;
+export function createFileProviderS3Feature(
+  options: FileProviderS3FeatureOptions,
+):
+  | ReturnType<typeof createFileProviderS3EnvFeature>
+  | ReturnType<typeof createTenantConfigFileProviderS3Feature>;
+export function createFileProviderS3Feature(options: FileProviderS3FeatureOptions = {}) {
+  return options.fromEnv === true
+    ? createFileProviderS3EnvFeature()
+    : createTenantConfigFileProviderS3Feature();
+}
 
-  // Plugin-Registration. entityName "s3" ist was tenants in
-  // file-foundation's `provider` config-key setzen.
-  const plugin: FileProviderPlugin = {
-    build: async (ctx: FileProviderContext, tenantId: string) => buildS3Provider(ctx, tenantId), // @wrapper-known semantic-alias
-  };
-  r.useExtension("fileProvider", "s3", plugin);
+/** @deprecated Use createFileProviderS3Feature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const fileProviderS3Feature = createFileProviderS3Feature();
 
-  return { configKeys, secretAccessKey };
-});
+// Typed config/secret handles are identical across instances, so one module-level instance serves them.
+const tenantConfigFeature = createTenantConfigFileProviderS3Feature();
 
 /** Typed handle for the S3 secret-access-key. */
-export const S3_SECRET_ACCESS_KEY = fileProviderS3Feature.exports.secretAccessKey;
+export const S3_SECRET_ACCESS_KEY = tenantConfigFeature.exports.secretAccessKey;
 
 // =============================================================================
 // Internal: build the FileStorageProvider from tenant config + secret
@@ -128,30 +162,30 @@ async function buildS3Provider(
 
   const FILE_HINT = "Set via tenant-admin UI or seed-handler before reading or writing files.";
   const bucket = requireNonEmpty(
-    await ctxConfig(fileProviderS3Feature.exports.configKeys.bucket),
+    await ctxConfig(tenantConfigFeature.exports.configKeys.bucket),
     FEATURE_NAME,
     "bucket",
     FILE_HINT,
   );
   const region = requireNonEmpty(
-    await ctxConfig(fileProviderS3Feature.exports.configKeys.region),
+    await ctxConfig(tenantConfigFeature.exports.configKeys.region),
     FEATURE_NAME,
     "region",
     FILE_HINT,
   );
   const endpointRaw = requireDefined(
-    await ctxConfig(fileProviderS3Feature.exports.configKeys.endpoint),
+    await ctxConfig(tenantConfigFeature.exports.configKeys.endpoint),
     FEATURE_NAME,
     "endpoint",
   ) as string; // @cast-boundary engine-payload
   const endpoint = endpointRaw.length > 0 ? endpointRaw : undefined;
   const forcePathStyle = requireDefined(
-    await ctxConfig(fileProviderS3Feature.exports.configKeys.forcePathStyle),
+    await ctxConfig(tenantConfigFeature.exports.configKeys.forcePathStyle),
     FEATURE_NAME,
     "forcePathStyle",
   ) as boolean; // @cast-boundary engine-payload
   const accessKeyId = requireNonEmpty(
-    await ctxConfig(fileProviderS3Feature.exports.configKeys.accessKeyId),
+    await ctxConfig(tenantConfigFeature.exports.configKeys.accessKeyId),
     FEATURE_NAME,
     "accessKeyId",
     FILE_HINT,

package/packages/bundled-features/src/file-provider-s3/index.ts

@@ -1,3 +1,8 @@
 // Public API of the file-provider-s3 bundled-feature.
 
-export { fileProviderS3Feature, S3_SECRET_ACCESS_KEY } from "./feature.js";
+export {
+  createFileProviderS3Feature,
+  type FileProviderS3FeatureOptions,
+  fileProviderS3Feature,
+  S3_SECRET_ACCESS_KEY,
+} from "./feature.js";

package/packages/bundled-features/src/file-provider-s3/lib/index.ts

@@ -0,0 +1,3 @@
+export { createS3ProviderFromEnv, parseS3EnvConfig } from "./env-helper.js";
+export type { S3ProviderConfig } from "./s3-provider.js";
+export { createS3Provider, resolveForcePathStyle } from "./s3-provider.js";

package/packages/bundled-features/src/{files-provider-s3 → file-provider-s3/lib}/s3-provider.ts

@@ -8,12 +8,12 @@ import {
 // Operator-Pflicht-Setup (Multipart-Upload-Cleanup)
 // =============================================================================
 //
-// `writeStream` nutzt Bun's S3-Writer fuer echtes multipart-streaming. S3
-// created dabei eine Multipart-Upload-Session mit einer Upload-ID; bei
-// normaler Completion wird sie geschlossen. Wird der Export-Worker mid-write
-// gecancelt (Pod-Restart, K8s-OOM-Kill, Process-Signal), bleibt die Session
-// in S3 OFFEN und berechnet Storage-Kosten fuer die bereits hochgeladenen
-// Parts — bis sie via Lifecycle-Rule abgebrochen werden.
+// `writeStream` uses Bun's S3 writer for real multipart streaming. S3
+// creates a multipart-upload session with an upload ID for it; on normal
+// completion the session is closed. If the export worker is cancelled
+// mid-write (pod restart, K8s OOM kill, process signal), the session stays
+// OPEN in S3 and bills storage for the parts already uploaded — until a
+// lifecycle rule aborts it.
 //
 // **Pflicht-Operator-Setup auf jedem Bucket:**
 //
@@ -26,9 +26,9 @@ import {
 //     }]
 //   }
 //
-// AWS-CLI: `aws s3api put-bucket-lifecycle-configuration --bucket <name>
-// --lifecycle-configuration file://lifecycle.json`. Hetzner Object Storage
-// + R2 + Minio supporten dieselbe Syntax.
+// AWS CLI: `aws s3api put-bucket-lifecycle-configuration --bucket <name>
+// --lifecycle-configuration file://lifecycle.json`. Hetzner Object Storage,
+// R2 and Minio support the same syntax.
 //
 // =============================================================================
 // Operator-Pflicht-Setup (IAM: list permission)
@@ -117,11 +117,11 @@ export function createS3Provider(config: S3ProviderConfig): FileStorageProvider
 
     async writeStream(key, source, options): Promise<void> {
       assertSafeStorageKey(key);
-      // Echtes multipart-streaming via Bun's S3-Writer — partSize steuert die
-      // Part-Boundary intern (AWS/R2 verlangen non-final Parts >= 5 MiB,
-      // sonst EntityTooSmall beim CompleteMultipartUpload). Manuelles flush()
-      // hier wuerde genau diese Garantie brechen, sobald die Source-Chunks
-      // nicht auf partSize aufgehen.
+      // Real multipart streaming via Bun's S3 writer — partSize controls the
+      // part boundary internally (AWS/R2 require non-final parts >= 5 MiB,
+      // otherwise EntityTooSmall on CompleteMultipartUpload). A manual flush()
+      // here would break exactly that guarantee as soon as the source chunks
+      // do not line up with partSize.
       const writer = client.file(key).writer({
         ...(options?.mimeType !== undefined && { type: options.mimeType }),
         retry: 3,
@@ -129,8 +129,8 @@ export function createS3Provider(config: S3ProviderConfig): FileStorageProvider
         partSize: STREAM_PART_SIZE,
       });
       for await (const chunk of source) {
-        // Await applies Backpressure und bounded die in-flight Queue auf
-        // queueSize, statt unbegrenzt zu puffern.
+        // Await applies backpressure and bounds the in-flight queue to
+        // queueSize instead of buffering without limit.
         await writer.write(chunk);
       }
       await writer.end();
@@ -143,9 +143,9 @@ export function createS3Provider(config: S3ProviderConfig): FileStorageProvider
 
     readStream(key): AsyncIterable<Uint8Array> {
       assertSafeStorageKey(key);
-      // Lazy: erst beim ersten chunk-pull wird der GET-Request abgesetzt.
-      // Existiert der Key nicht, faellt der Error genau dort (nicht beim
-      // readStream-Aufruf) — gleiches Lazy-Verhalten wie inmemory + local.
+      // Lazy: the GET request is only sent on the first chunk pull. If the key
+      // does not exist, the error surfaces right there (not on the readStream
+      // call) — same lazy behavior as inmemory + local.
       return {
         async *[Symbol.asyncIterator]() {
           for await (const chunk of client.file(key).stream()) {

package/packages/bundled-features/src/file-provider-s3-env/index.ts

@@ -1,3 +1,8 @@
-// Public API of the file-provider-s3-env bundled-feature.
+import { createFileProviderS3Feature } from "../file-provider-s3/index.js";
 
-export { fileProviderS3EnvFeature } from "./feature.js";
+/**
+ * @deprecated Use createFileProviderS3Feature({ fromEnv: true }) from
+ * `@cosmicdrift/kumiko-bundled-features/file-provider-s3`. Run `bun kumiko-upgrade --apply`.
+ * Removed in the first release after 2026-10-29.
+ */
+export const fileProviderS3EnvFeature = createFileProviderS3Feature({ fromEnv: true });

package/packages/bundled-features/src/files-provider-s3/index.ts

@@ -1,3 +1,11 @@
-export { createS3ProviderFromEnv, parseS3EnvConfig } from "./env-helper.js";
-export type { S3ProviderConfig } from "./s3-provider.js";
-export { createS3Provider, resolveForcePathStyle } from "./s3-provider.js";
+/**
+ * @deprecated Moved to `@cosmicdrift/kumiko-bundled-features/file-provider-s3/lib`. Run `bun kumiko-upgrade --apply`
+ * to rewrite imports. Removed in the first release after 2026-10-29.
+ */
+export {
+  createS3Provider,
+  createS3ProviderFromEnv,
+  parseS3EnvConfig,
+  resolveForcePathStyle,
+  type S3ProviderConfig,
+} from "../file-provider-s3/lib/index.js";

package/packages/bundled-features/src/files-tenant-data/handlers/sweep-orphaned-derivatives.job.ts

@@ -18,8 +18,8 @@
 // candidates into a flat queue so the shared deadline/circuit-breaker/signal
 // handling still applies per-key.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { parseDerivativeKey } from "@cosmicdrift/kumiko-framework/derivatives";
 import type { JobContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {

package/packages/bundled-features/src/files-tenant-data/hooks.ts

@@ -46,8 +46,7 @@
 //     its original. Batched: one existence query per chunk of listed keys,
 //     not one query per key.
 
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   parseTenantId,

package/packages/bundled-features/src/folders/feature.ts

@@ -107,7 +107,7 @@ function registerFolders(
   );
 }
 
-export const foldersFeature = defineFeature(FOLDERS_FEATURE_NAME, (r) =>
+const defaultFoldersFeature = defineFeature(FOLDERS_FEATURE_NAME, (r) =>
   registerFolders(r, DEFAULT_FOLDER_ACCESS, undefined, undefined, undefined),
 );
 
@@ -156,7 +156,9 @@ function resolveAccess(opts: FoldersFeatureOptions): AccessRule {
 
 // Options wrapper. Without options returns the module-level singleton (no
 // rebuild). access/roles/toggleable build a fresh feature-definition.
-export function createFoldersFeature(opts: FoldersFeatureOptions = {}): typeof foldersFeature {
+export function createFoldersFeature(
+  opts: FoldersFeatureOptions = {},
+): typeof defaultFoldersFeature {
   if (
     opts.access === undefined &&
     opts.roles === undefined &&
@@ -164,7 +166,7 @@ export function createFoldersFeature(opts: FoldersFeatureOptions = {}): typeof f
     opts.ownership === undefined &&
     opts.parents === undefined
   ) {
-    return foldersFeature;
+    return defaultFoldersFeature;
   }
   assertNoWhereRuleInOwnershipWrite("createFoldersFeature", opts.ownership?.write);
   if (opts.parents !== undefined && opts.parents.length === 0) {
@@ -180,3 +182,6 @@ export function createFoldersFeature(opts: FoldersFeatureOptions = {}): typeof f
     registerFolders(r, access, opts.toggleable, opts.ownership, opts.parents),
   );
 }
+
+/** @deprecated Use createFoldersFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const foldersFeature = createFoldersFeature();

package/packages/bundled-features/src/folders-user-data/index.ts

@@ -12,22 +12,31 @@ import {
   folderExportHook,
 } from "./hooks.js";
 
-export const foldersUserDataFeature = defineFeature("folders-user-data", (r) => {
-  r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `folders` feature's `folder` + `folder-assignment` entities. Mounts the EXT_USER_DATA export + delete hooks so a tenant's folder tree and its entity-to-folder assignments are included in the user-data export bundle and erased on a tenant-scoped forget (single-user tenants only; multi-user + anonymize are no-ops since folder rows carry no per-user PII). Kept separate from `folders` so folder consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `folders`.",
+export function createFoldersUserDataFeature() {
+  return defineFeature(
+    "folders-user-data",
+    (r) => {
+      r.describe(
+        "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `folders` feature's `folder` + `folder-assignment` entities. Mounts the EXT_USER_DATA export + delete hooks so a tenant's folder tree and its entity-to-folder assignments are included in the user-data export bundle and erased on a tenant-scoped forget (single-user tenants only; multi-user + anonymize are no-ops since folder rows carry no per-user PII). Kept separate from `folders` so folder consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `folders`.",
+      );
+      // user-data-rights is the hard dependency (EXT_USER_DATA host). `folders` is
+      // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
+      // tier), a hard r.requires would throw an "effectively disabled" boot
+      // warning even though the folder entities exist and the hooks work fine.
+      r.requires({ features: ["user-data-rights"] });
+      r.optionalRequires("folders");
+      r.useExtension(EXT_USER_DATA, "folder", {
+        export: folderExportHook,
+        delete: folderDeleteHook,
+      });
+      r.useExtension(EXT_USER_DATA, "folder-assignment", {
+        export: folderAssignmentExportHook,
+        delete: folderAssignmentDeleteHook,
+      });
+    },
+    { dedupeOptions: {} },
   );
-  // user-data-rights is the hard dependency (EXT_USER_DATA host). `folders` is
-  // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
-  // tier), a hard r.requires would throw an "effectively disabled" boot
-  // warning even though the folder entities exist and the hooks work fine.
-  r.requires({ features: ["user-data-rights"] });
-  r.optionalRequires("folders");
-  r.useExtension(EXT_USER_DATA, "folder", {
-    export: folderExportHook,
-    delete: folderDeleteHook,
-  });
-  r.useExtension(EXT_USER_DATA, "folder-assignment", {
-    export: folderAssignmentExportHook,
-    delete: folderAssignmentDeleteHook,
-  });
-});
+}
+
+/** @deprecated Use createFoldersUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const foldersUserDataFeature = createFoldersUserDataFeature();

package/packages/bundled-features/src/form-draft/db/queries/cleanup.ts

@@ -1,5 +1,5 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { FormDraftBlob } from "../../schemas.js";

package/packages/bundled-features/src/form-draft/db/queries/draft-count.ts

@@ -1,5 +1,5 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
 // COUNT(*), not selectMany(...).length — save.write.ts checks this on every

package/packages/bundled-features/src/form-draft/db/queries/owned-file-refs.ts

@@ -1,8 +1,9 @@
 import {
+  type DbRunner,
   instantToTimestamptzParam,
+  toPostgresArrayLiteral,
   unsafeReadRetrying,
-} from "@cosmicdrift/kumiko-framework/bun-db";
-import { type DbRunner, toPostgresArrayLiteral } from "@cosmicdrift/kumiko-framework/db";
+} from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 

package/packages/bundled-features/src/form-draft/feature.ts

@@ -56,4 +56,9 @@ function registerFormDraft(r: FeatureRegistrar<typeof FORM_DRAFT_FEATURE_NAME>):
   });
 }
 
-export const formDraftFeature = defineFeature(FORM_DRAFT_FEATURE_NAME, registerFormDraft);
+export function createFormDraftFeature() {
+  return defineFeature(FORM_DRAFT_FEATURE_NAME, registerFormDraft, { dedupeOptions: {} });
+}
+
+/** @deprecated Use createFormDraftFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const formDraftFeature = createFormDraftFeature();

package/packages/bundled-features/src/form-draft/handlers/cleanup.job.ts

@@ -77,7 +77,7 @@ async function releaseRowFileRefs(
     isCreateMode,
   );
   const systemUser = createSystemUser(row.tenantId);
-  const tenantDb = createTenantDb(db, row.tenantId, "system");
+  const tenantDb = createTenantDb({ db, tenantId: row.tenantId, mode: "system" });
   for (const ref of ownedRefs) {
     const forgetResult = await fileRefExecutor.forget({ id: ref.id }, systemUser, tenantDb);
     if (!forgetResult.isSuccess) {
@@ -132,7 +132,7 @@ export async function deleteStaleDraftsBatch(
   const byId = new Map(batch.map((row) => [row.id, row]));
   for (const [tenantId, ids] of groupStaleDraftIdsByTenant(batch)) {
     const systemUser = createSystemUser(tenantId);
-    const tenantDb = createTenantDb(db, tenantId, "system");
+    const tenantDb = createTenantDb({ db, tenantId, mode: "system" });
     for (const id of ids) {
       // Race: user may have saved between select and here — skip if no longer stale.
       if (!(await isDraftStillStale(db, tenantId, id, retentionDays))) {

package/packages/bundled-features/src/form-draft/index.ts

@@ -8,7 +8,7 @@ export {
 } from "./constants.js";
 export { formDraftEntity } from "./entity.js";
 export { formDraftExecutor, formDraftTable } from "./executor.js";
-export { formDraftFeature } from "./feature.js";
+export { createFormDraftFeature, formDraftFeature } from "./feature.js";
 export { discardDraftWrite } from "./handlers/discard.write.js";
 export { type GetDraftResult, getDraftQuery } from "./handlers/get.query.js";
 export { type ListDraftsResult, listDraftsQuery } from "./handlers/list.query.js";

package/packages/bundled-features/src/form-draft/lookup.ts

@@ -1,5 +1,5 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { formDraftTable } from "./executor.js";

package/packages/bundled-features/src/form-draft-user-data/index.ts

@@ -8,14 +8,23 @@
 import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
 import { formDraftDeleteHook, formDraftExportHook } from "./hooks.js";
 
-export const formDraftUserDataFeature = defineFeature("form-draft-user-data", (r) => {
-  r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `form-draft` feature's `form-draft` entity. Mounts the EXT_USER_DATA export hook so a user's saved drafts are included in the user-data export bundle, and a delete hook that physically removes the user's own draft rows on forget. Kept separate from `form-draft` so form-draft consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `form-draft`.",
+export function createFormDraftUserDataFeature() {
+  return defineFeature(
+    "form-draft-user-data",
+    (r) => {
+      r.describe(
+        "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `form-draft` feature's `form-draft` entity. Mounts the EXT_USER_DATA export hook so a user's saved drafts are included in the user-data export bundle, and a delete hook that physically removes the user's own draft rows on forget. Kept separate from `form-draft` so form-draft consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `form-draft`.",
+      );
+      r.requires({ features: ["user-data-rights"] });
+      r.optionalRequires("form-draft");
+      r.useExtension(EXT_USER_DATA, "form-draft", {
+        export: formDraftExportHook,
+        delete: formDraftDeleteHook,
+      });
+    },
+    { dedupeOptions: {} },
   );
-  r.requires({ features: ["user-data-rights"] });
-  r.optionalRequires("form-draft");
-  r.useExtension(EXT_USER_DATA, "form-draft", {
-    export: formDraftExportHook,
-    delete: formDraftDeleteHook,
-  });
-});
+}
+
+/** @deprecated Use createFormDraftUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const formDraftUserDataFeature = createFormDraftUserDataFeature();