@cosmicdrift/kumiko-samples 0.378.0 → 0.379.0

package/packages/bundled-features/src/document-ingest-foundation/feature.ts

@@ -4,7 +4,7 @@
 // hardcoded mime allowlist or size cap — providers register via
 // EXT_DOCUMENT_INGEST_PROVIDER (see providers.ts).
 
-import { entityEventName } from "@cosmicdrift/kumiko-framework/db";
+import { applyEntityEvent, entityEventName } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createTenantConfig,
@@ -16,8 +16,9 @@ import { normalizeMimeType } from "@cosmicdrift/kumiko-framework/files";
 import * as z from "zod";
 import { documentIngestAggregateId } from "./aggregate-id.ts";
 import { validateDocumentIngestProviderWiring } from "./boot-checks.ts";
-import { documentExtractEntity } from "./entity.ts";
+import { documentExtractEntity, documentExtractsTable } from "./entity.ts";
 import {
+  DOCUMENT_EXTRACT_AGGREGATE_TYPE,
   DOCUMENT_INGEST_AGGREGATE_TYPE,
   DOCUMENT_INGEST_REQUESTED_EVENT_QN,
   DOCUMENT_INGEST_REQUESTED_EVENT_SHORT,
@@ -44,9 +45,9 @@ const FILE_REF_CREATED = entityEventName("fileRef", "created");
 const FILE_REF_RESTORED = entityEventName("fileRef", "restored");
 const FILE_REF_DELETED = entityEventName("fileRef", "deleted");
 const FILE_REF_FORGOTTEN = entityEventName("fileRef", "forgotten");
-// Executors write under entityName "document-extract" (executor.ts), not the
+// Executors write under DOCUMENT_EXTRACT_AGGREGATE_TYPE (executor.ts), not the
 // camelCase r.entity() name — the event type follows the executor.
-const DOCUMENT_EXTRACT_CREATED = entityEventName("document-extract", "created");
+const DOCUMENT_EXTRACT_CREATED = entityEventName(DOCUMENT_EXTRACT_AGGREGATE_TYPE, "created");
 
 type MspApplyContext = Parameters<MultiStreamApplyFn>[2];
 
@@ -141,6 +142,19 @@ export function createDocumentIngestFoundationFeature() {
       r.useExtension(EXT_TENANT_DATA, "documentExtract", {
         destroy: documentExtractTenantDestroyHook,
       });
+      // The implicit projection listens for "documentExtract.*"; stored events are
+      // "document-extract.*", so a rebuild would otherwise drop every extract row.
+      r.extendEntityProjection("documentExtract", {
+        sources: [DOCUMENT_EXTRACT_AGGREGATE_TYPE],
+        apply: Object.fromEntries(
+          (["created", "updated", "deleted", "forgotten"] as const).map((verb) => [
+            entityEventName(DOCUMENT_EXTRACT_AGGREGATE_TYPE, verb),
+            async (event, tx) => {
+              await applyEntityEvent(event, documentExtractsTable, documentExtractEntity, tx);
+            },
+          ]),
+        ),
+      });
 
       // No onRegister: resolution happens at boot and per-apply, not on register.
       r.extendsRegistrar(EXT_DOCUMENT_INGEST_PROVIDER, {});

package/packages/bundled-features/src/document-ingest-foundation/index.ts

@@ -8,6 +8,7 @@ export {
   type IngestPage,
 } from "./entity.ts";
 export {
+  DOCUMENT_EXTRACT_AGGREGATE_TYPE,
   DOCUMENT_INGEST_AGGREGATE_TYPE,
   DOCUMENT_INGEST_REQUESTED_EVENT_QN,
   DOCUMENT_INGEST_REQUESTED_EVENT_SHORT,

package/packages/bundled-features/src/feature-toggles/feature.ts

@@ -1,10 +1,4 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  FEATURE_TOGGLE_SET_EVENT_NAME,
-  FeatureToggleHandlers,
-  FeatureToggleQueries,
-  TOGGLE_ADMIN_SCREEN_ID,
-} from "./constants.ts";
 import { featureToggleSetSchema } from "./events.ts";
 import { globalFeatureStateTableMeta } from "./global-feature-state-table.ts";
 import { listQuery } from "./handlers/list.query.ts";
@@ -12,6 +6,12 @@ import { registeredQuery } from "./handlers/registered.query.ts";
 import { createSetWriteHandler } from "./handlers/set.write.ts";
 import { FEATURE_TOGGLES_I18N } from "./i18n.ts";
 import type { GlobalFeatureToggleRuntime } from "./toggle-runtime.ts";
+import {
+  FEATURE_TOGGLE_SET_EVENT_NAME,
+  FeatureToggleHandlers,
+  FeatureToggleQueries,
+  TOGGLE_ADMIN_SCREEN_ID,
+} from "./web/constants.ts";
 
 // IMPORTANT: feature-toggles itself is NOT r.toggleable. Making it
 // toggleable would brick the system — once disabled, no handler of this
@@ -157,7 +157,6 @@ export function createFeatureTogglesFeature(
   });
 }
 
-export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./constants.ts";
 export {
   globalFeatureStateTable,
   globalFeatureStateTableMeta,
@@ -170,3 +169,4 @@ export {
   type ToggleSyncSignal,
 } from "./toggle-runtime.ts";
 export { createRedisToggleSyncSignal, type RedisToggleSyncSignal } from "./toggle-sync-signal.ts";
+export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./web/constants.ts";

package/packages/bundled-features/src/feature-toggles/handlers/list.query.ts

@@ -1,7 +1,7 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../constants.ts";
 import { globalFeatureStateTable } from "../global-feature-state-table.ts";
+import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../web/constants.ts";
 
 // List every row in the global_feature_state table — i.e. every feature
 // that has ever been explicitly flipped. Features without a row aren't

package/packages/bundled-features/src/feature-toggles/handlers/registered.query.ts

@@ -1,7 +1,7 @@
 import { defineQueryHandler, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../constants.ts";
 import { globalFeatureStateTable } from "../global-feature-state-table.ts";
+import { FEATURE_TOGGLE_CROSS_TENANT_REASON } from "../web/constants.ts";
 
 // Inventory of every registered feature, annotated with toggle metadata
 // and the current effective state. This is the canonical "what's here,

package/packages/bundled-features/src/feature-toggles/handlers/set.write.ts

@@ -7,14 +7,14 @@ import {
 } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { globalFeatureStateTable } from "../global-feature-state-table.ts";
+import type { GlobalFeatureToggleRuntime } from "../toggle-runtime.ts";
 import {
   FEATURE_TOGGLE_AGGREGATE_TYPE,
   FEATURE_TOGGLE_CROSS_TENANT_REASON,
   FEATURE_TOGGLE_SET_EVENT_NAME,
   FeatureToggleErrors,
-} from "../constants.ts";
-import { globalFeatureStateTable } from "../global-feature-state-table.ts";
-import type { GlobalFeatureToggleRuntime } from "../toggle-runtime.ts";
+} from "../web/constants.ts";
 
 // Factory: binds a runtime accessor to the handler at registration time.
 // The runtime holds the in-memory snapshot that the dispatcher's gate

package/packages/bundled-features/src/feature-toggles/index.ts

@@ -1,10 +1,4 @@
 export { composeTierResolverWithGlobalToggles } from "./compose-tier-resolver.ts";
-export {
-  FEATURE_TOGGLES_FEATURE,
-  FeatureToggleHandlers,
-  FeatureToggleQueries,
-  TOGGLE_ADMIN_SCREEN_ID,
-} from "./constants.ts";
 export {
   createFeatureToggleRuntime,
   createFeatureTogglesFeature,
@@ -18,3 +12,9 @@ export {
   type RedisToggleSyncSignal,
   type ToggleSyncSignal,
 } from "./feature.ts";
+export {
+  FEATURE_TOGGLES_FEATURE,
+  FeatureToggleHandlers,
+  FeatureToggleQueries,
+  TOGGLE_ADMIN_SCREEN_ID,
+} from "./web/constants.ts";

package/packages/bundled-features/src/feature-toggles/web/client-plugin.tsx

@@ -1,7 +1,6 @@
-// @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
-import { FEATURE_TOGGLES_FEATURE } from "../constants.ts";
+import { FEATURE_TOGGLES_FEATURE } from "./constants.ts";
 import { defaultTranslations } from "./i18n.ts";
 
 export type FeatureTogglesClientOptions = {

package/packages/bundled-features/src/feature-toggles/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 export const FEATURE_TOGGLES_FEATURE = "feature-toggles" as const;
 
 // Fully-qualified event name for feature-toggle changes. Kept as a constant

package/packages/bundled-features/src/feature-toggles/web/i18n.ts

@@ -1,4 +1,3 @@
-// @runtime client
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
 export const defaultTranslations: TranslationsByLocale = {

package/packages/bundled-features/src/feature-toggles/web/index.ts

@@ -1,4 +1,3 @@
-// @runtime client
 export {
   type FeatureTogglesClientOptions,
   featureTogglesClient,

package/packages/bundled-features/src/files/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "File uploads in an actionForm, dropzone display for files fields",
+    "detail": "A files or images field of an actionForm screen uploads through POST /files with actionForm=<screen QN> and fieldName; the file is stored pending under the screen and the route checks the caller's access to the screen and its handler before writing bytes. New helpers resolveActionFormFileField and listActionFormFileFields (framework/files), bindPendingFileRef takes bindTo (the target entity file field, checked against its accept and maxSize) and registry, and ACTION_FORM_PSEUDO_ENTITY moves to framework/ui-types. New display \"list\" or \"dropzone\" on FilesFieldDef and ImagesFieldDef; the dropzone works in entityEdit and actionForm and maps server error codes to translated texts. Pending actionForm uploads are removed on user forget and by the forget-subject file purge. New i18n keys kumiko.widget.upload.too-large|invalid-type|max-count|remove, kumiko.field.dropzone.* and errors.file.violatesBindTarget (de, es, fr, it included).",
+    "migration": "Custom upload screens such as solon document-upload can become an actionForm with a files field and display \"dropzone\". The form's handler must bind every file it keeps: load it with loadPendingFileRef (entityName = the screen QN) and move it onto a record with bindPendingFileRef({ bindTo, registry: ctx.registry }); unbound uploads are treated as the uploader's personal data and removed on forget."
+  },
   {
     "version": "0.372.0",
     "type": "breaking",

package/packages/bundled-features/src/folders/feature.ts

@@ -26,11 +26,11 @@ import {
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.ts";
-import { DEFAULT_FOLDER_ACCESS, FOLDERS_FEATURE_NAME } from "./constants.ts";
 import { createFolderAssignmentEntity, folderEntity } from "./entity.ts";
 import { createClearFolderHandler } from "./handlers/clear-folder.write.ts";
 import { createDeleteFolderHandler } from "./handlers/delete-folder.write.ts";
 import { createSetFolderHandler } from "./handlers/set-folder.write.ts";
+import { DEFAULT_FOLDER_ACCESS, FOLDERS_FEATURE_NAME } from "./web/constants.ts";
 
 // Opt-in tier-gating: when set, the feature declares itself r.toggleable so the
 // dispatcher gate + feature-toggles + tier-engine can switch the WHOLE feature

package/packages/bundled-features/src/folders/handlers/clear-folder.write.ts

@@ -1,9 +1,9 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.ts";
 import { folderAssignmentAggregateId } from "../aggregate-id.ts";
-import { DEFAULT_FOLDER_ACCESS } from "../constants.ts";
 import { folderAssignmentExecutor } from "../executor.ts";
 import { type ClearFolderPayload, clearFolderPayloadSchema } from "../schemas.ts";
+import { DEFAULT_FOLDER_ACCESS } from "../web/constants.ts";
 
 // clear-folder — removes a host entity from its folder (back to "unfiled").
 // Idempotent: clearing an entity that isn't in any folder is already the

package/packages/bundled-features/src/folders/handlers/delete-folder.write.ts

@@ -2,8 +2,8 @@ import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { hostRowIsGone } from "../../shared/index.ts";
-import { DEFAULT_FOLDER_ACCESS } from "../constants.ts";
 import { folderAssignmentExecutor, folderExecutor } from "../executor.ts";
+import { DEFAULT_FOLDER_ACCESS } from "../web/constants.ts";
 
 const deleteFolderPayloadSchema = z.object({ id: z.uuid() });
 

package/packages/bundled-features/src/folders/handlers/set-folder.write.ts

@@ -2,9 +2,9 @@ import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { denyUnlessJoinRowParentVisible } from "../../shared/index.ts";
 import { folderAssignmentAggregateId } from "../aggregate-id.ts";
-import { DEFAULT_FOLDER_ACCESS } from "../constants.ts";
 import { folderAssignmentExecutor, folderExecutor } from "../executor.ts";
 import { type SetFolderPayload, setFolderPayloadSchema } from "../schemas.ts";
+import { DEFAULT_FOLDER_ACCESS } from "../web/constants.ts";
 
 // set-folder — puts a host entity into a folder. Single-membership: the
 // assignment id is deterministic over (tenant, entity) WITHOUT folderId, so an

package/packages/bundled-features/src/folders/index.ts

@@ -1,12 +1,4 @@
 export { folderAssignmentAggregateId } from "./aggregate-id.ts";
-export {
-  DEFAULT_FOLDER_ACCESS,
-  DEFAULT_FOLDER_ROLES,
-  FOLDER_SECTION_EXTENSION_NAME,
-  FOLDERS_FEATURE_NAME,
-  FoldersHandlers,
-  FoldersQueries,
-} from "./constants.ts";
 export { folderAssignmentEntity, folderEntity } from "./entity.ts";
 export {
   createFoldersFeature,
@@ -20,3 +12,11 @@ export {
   type SetFolderPayload,
   setFolderPayloadSchema,
 } from "./schemas.ts";
+export {
+  DEFAULT_FOLDER_ACCESS,
+  DEFAULT_FOLDER_ROLES,
+  FOLDER_SECTION_EXTENSION_NAME,
+  FOLDERS_FEATURE_NAME,
+  FoldersHandlers,
+  FoldersQueries,
+} from "./web/constants.ts";

package/packages/bundled-features/src/folders/web/client-plugin.tsx

@@ -1,7 +1,5 @@
-// @runtime client
-
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
-import { FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME } from "../constants.ts";
+import { FOLDER_SECTION_EXTENSION_NAME, FOLDERS_FEATURE_NAME } from "./constants.ts";
 import { FolderSection } from "./folder-section.tsx";
 import { defaultTranslations } from "./i18n.ts";
 

package/packages/bundled-features/src/folders/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // folders bundle constants — feature-name + qualified handler/query names.
 //
 // Spec: kumiko-platform/docs/plans/folders-feature.md

package/packages/bundled-features/src/folders/web/folder-manager.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // FolderManager — in-screen folder tree the user manages directly: create root
 // folders + subfolders, rename, delete, collapse/expand. KPI-agnostic: a host
 // passes `renderMeta` to hang its own per-folder badges (e.g. money-horse's
@@ -35,7 +34,7 @@ import {
 } from "@cosmicdrift/kumiko-renderer";
 import { ChevronRight, File, Folder, type LucideIcon, Pencil, Plus, Trash2 } from "lucide-react";
 import { type DragEvent, type ReactNode, useEffect, useState } from "react";
-import { FoldersHandlers, FoldersQueries } from "../constants.ts";
+import { FoldersHandlers, FoldersQueries } from "./constants.ts";
 import { buildFolderTree, type FolderNode, type FolderRow } from "./tree.ts";
 
 type FolderListResponse = { readonly rows: readonly FolderRow[] };

package/packages/bundled-features/src/folders/web/folder-section.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // FolderSection — drop-in single-folder picker for ANY entity. Unlike tags
 // (many-to-many multi-combobox), an entity lives in exactly ONE folder, so this
 // is a single-select combobox with a "no folder" option plus a compact row to
@@ -19,7 +18,7 @@ import {
   useTranslation,
 } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
-import { FoldersHandlers, FoldersQueries } from "../constants.ts";
+import { FoldersHandlers, FoldersQueries } from "./constants.ts";
 import { type FolderRow, folderPath } from "./tree.ts";
 
 type AssignmentRow = {

package/packages/bundled-features/src/folders/web/i18n.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Default translation bundle for the folders UI. foldersClient() hangs it into
 // the LocaleProvider as a fallback bundle — apps override individual keys via
 // foldersClient({ translations }). Keys follow `folders.<area>.<slug>`.

package/packages/bundled-features/src/folders/web/index.ts

@@ -1,6 +1,5 @@
-// @runtime client
-export { FOLDER_SECTION_EXTENSION_NAME, FoldersHandlers, FoldersQueries } from "../constants.ts";
 export { foldersClient } from "./client-plugin.tsx";
+export { FOLDER_SECTION_EXTENSION_NAME, FoldersHandlers, FoldersQueries } from "./constants.ts";
 export { type FolderFiling, type FolderLeaf, FolderManager } from "./folder-manager.tsx";
 export { FolderSection } from "./folder-section.tsx";
 export { buildFolderTree, type FolderNode, type FolderRow, folderPath } from "./tree.ts";

package/packages/bundled-features/src/folders/web/tree.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure tree helpers shared by FolderManager (nested render) and FolderSection
 // (path-labelled options). No React, no IO — folder rows in, structure out, so
 // both can be unit-tested without a renderer harness.

package/packages/bundled-features/src/form-draft/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "Form draft content is encrypted per owner",
+    "detail": "The jsonb field draft carries personal: { of: \"ownerId\" }, so its content is stored as ciphertext in events and in read_form_drafts; the delete event no longer keeps the plaintext in previous. The PII event backfill (jsonb-objects-v3) encrypts existing events once on the next boot and rebuilds the table. The column type stays jsonb, so there is no schema change.",
+    "migration": "Nothing to run; the backfill happens on boot. Code that reads read_form_drafts.draft with raw SQL must decrypt it (decryptPiiFieldValues) or use the form-draft lookup helpers; the get and list queries are unchanged for clients."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/packages/bundled-features/src/form-draft/db/queries/cleanup.ts

@@ -2,6 +2,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { readStoredDraft } from "../../decrypt-draft.ts";
 import type { FormDraftBlob } from "../../schemas.ts";
 
 export type StaleDraftRow = {
@@ -9,7 +10,10 @@ export type StaleDraftRow = {
   readonly tenantId: TenantId;
   readonly ownerId: string;
   readonly draftKey: string;
-  readonly draft: FormDraftBlob;
+  readonly draft: FormDraftBlob | null;
+  // Decryption failed (e.g. KMS outage): `draft: null` then does not mean "empty", so the row must
+  // not be deleted — its FileRefs could not be released.
+  readonly draftUnreadable?: true;
   readonly insertedAt: Temporal.Instant;
 };
 
@@ -28,30 +32,40 @@ export async function selectStaleDraftsBatch(
   db: DbConnection,
   olderThanDays: number,
   batchSize: number,
+  excludeIds: readonly string[] = [],
 ): Promise<readonly StaleDraftRow[]> {
   const rows = await unsafeReadRetrying<{
     id: string;
     tenant_id: string;
     owner_id: string;
     draft_key: string;
-    draft: FormDraftBlob;
+    draft: unknown;
     inserted_at: Date;
   }>(
     db,
     `SELECT "id", "tenant_id", "owner_id", "draft_key", "draft", "inserted_at" FROM "read_form_drafts"
      WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
+     AND NOT ("id"::text = ANY($3::text[]))
      ORDER BY COALESCE("modified_at", "inserted_at") ASC
      LIMIT $2`,
-    [olderThanDays, batchSize],
+    [olderThanDays, batchSize, [...excludeIds]],
+  );
+  return Promise.all(
+    rows.map(async (row) => {
+      const base = {
+        id: row.id,
+        tenantId: row.tenant_id as TenantId, // @cast-boundary db-row
+        ownerId: row.owner_id,
+        draftKey: row.draft_key,
+        insertedAt: Temporal.Instant.fromEpochMilliseconds(+row.inserted_at), // @cast-boundary db-row
+      };
+      try {
+        return { ...base, draft: await readStoredDraft(row.draft) };
+      } catch {
+        return { ...base, draft: null, draftUnreadable: true as const };
+      }
+    }),
   );
-  return rows.map((row) => ({
-    id: row.id,
-    tenantId: row.tenant_id as TenantId, // @cast-boundary db-row
-    ownerId: row.owner_id,
-    draftKey: row.draft_key,
-    draft: row.draft,
-    insertedAt: Temporal.Instant.fromEpochMilliseconds(+row.inserted_at), // @cast-boundary db-row
-  }));
 }
 
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */

package/packages/bundled-features/src/form-draft/decrypt-draft.ts

@@ -0,0 +1,24 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
+import {
+  configuredPiiSubjectKms,
+  decryptPiiFieldValues,
+  isPiiCiphertext,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { type FormDraftBlob, formDraftBlobSchema } from "./schemas.ts";
+
+// Raw reads (fetchOne/selectMany/SQL) return the stored column, which is
+// ciphertext once the owner's key exists. The field name is part of the AAD,
+// so it must stay "draft". An erased owner yields the sentinel string, which
+// fails the blob schema and reads as null (no usable draft).
+export async function readStoredDraft(stored: unknown): Promise<FormDraftBlob | null> {
+  let plain = stored;
+  const kms = configuredPiiSubjectKms();
+  if (isPiiCiphertext(stored) && kms) {
+    const out = await decryptPiiFieldValues({ draft: stored }, ["draft"], kms, {
+      requestId: requestContext.get()?.requestId ?? "form-draft:read",
+    });
+    plain = out["draft"];
+  }
+  const parsed = formDraftBlobSchema.safeParse(plain);
+  return parsed.success ? parsed.data : null;
+}

package/packages/bundled-features/src/form-draft/entity.ts

@@ -3,7 +3,7 @@ import {
   createJsonbField,
   createTextField,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT } from "./constants.ts";
+import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT } from "./web/constants.ts";
 
 // form-draft — a per-user, pre-submission working copy of an in-progress
 // form (e.g. a wizard-mode EditLayout). `draftKey` is caller-assigned
@@ -37,14 +37,11 @@ export const formDraftEntity = createEntity({
     // The blob shape is fixed by issue #1889, not left to the caller:
     // { values: Record<string, unknown>, stepIndex: number, savedAt: string }.
     // Free-form because `values` mirrors whatever fields the in-progress
-    // form has, so it can carry arbitrary user-entered PII. NOT given a
-    // `personal` annotation — the framework's PII field-encryption engine only
-    // accepts string values (pii-field-encryption.ts throws on a non-string
-    // field), and this is a jsonb object. Erasure instead runs as a real
-    // physical row-delete on forget (see form-draft-user-data/hooks.ts),
-    // not crypto-shredding; `ownerId`'s `subjectRef` annotation alone
-    // already satisfies the GDPR-hook-coverage boot guard.
-    draft: createJsonbField(),
+    // form has, so it can carry arbitrary user-entered PII. Encrypted under
+    // the owner's key (jsonb ciphertext scalar in the row and in every event
+    // that carries it, `previous` of delete included), so forgetting the
+    // owner shreds all copies.
+    draft: createJsonbField({ personal: { of: "ownerId" } }),
   },
   // One draft per (tenant, owner, draftKey) — save() is an upsert keyed on
   // this index (see handlers/save.write.ts); a resume query must find at

package/packages/bundled-features/src/form-draft/feature.ts

@@ -7,13 +7,13 @@
 
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_FEATURE_NAME } from "./constants.ts";
 import { formDraftEntity } from "./entity.ts";
 import { cleanupDraftsJob, formDraftRetentionDaysConfig } from "./handlers/cleanup.job.ts";
 import { discardDraftWrite } from "./handlers/discard.write.ts";
 import { getDraftQuery } from "./handlers/get.query.ts";
 import { listDraftsQuery } from "./handlers/list.query.ts";
 import { saveDraftWrite } from "./handlers/save.write.ts";
+import { FORM_DRAFT_FEATURE_NAME } from "./web/constants.ts";
 
 const CLEANUP_ESCAPE_HATCH_REASON = "purges stale drafts of every tenant";
 

package/packages/bundled-features/src/form-draft/handlers/cleanup.job.ts

@@ -126,14 +126,27 @@ export async function deleteStaleDraftsBatch(
   db: DbConnection,
   retentionDays: number,
   log: AppContext["log"],
-): Promise<{ readonly deletedRows: readonly StaleDraftRow[]; readonly skippedCount: number }> {
+): Promise<{
+  readonly deletedRows: readonly StaleDraftRow[];
+  readonly skippedCount: number;
+  readonly deferredIds: readonly string[];
+}> {
   const deletedRows: StaleDraftRow[] = [];
+  const deferredIds: string[] = [];
   let skippedCount = 0;
   const byId = new Map(batch.map((row) => [row.id, row]));
   for (const [tenantId, ids] of groupStaleDraftIdsByTenant(batch)) {
     const systemUser = createSystemUser(tenantId);
     const tenantDb = createTenantDb({ db, tenantId, mode: "system" });
     for (const id of ids) {
+      // skip: an unreadable blob hides its FileRefs; deleting now would orphan them, so the next run retries.
+      if (byId.get(id)?.draftUnreadable) {
+        log?.warn?.(
+          `[form-draft:cleanup] draft id=${id} tenant=${tenantId} could not be decrypted — kept for the next run`,
+        );
+        deferredIds.push(id);
+        continue;
+      }
       // Race: user may have saved between select and here — skip if no longer stale.
       if (!(await isDraftStillStale(db, tenantId, id, retentionDays))) {
         skippedCount++;
@@ -150,7 +163,7 @@ export async function deleteStaleDraftsBatch(
       }
     }
   }
-  return { deletedRows, skippedCount };
+  return { deletedRows, skippedCount, deferredIds };
 }
 
 export async function cleanupDraftsJob(
@@ -181,9 +194,12 @@ export async function cleanupDraftsJob(
   const fileProviderResolver = ctx._fileProviderResolver;
 
   let deleted = 0;
+  const deferred = new Set<string>();
   while (true) {
     if (ctx.signal?.aborted) break;
-    const batch = await selectStaleDraftsBatch(db, retentionDays, DEFAULT_BATCH_SIZE);
+    const batch = await selectStaleDraftsBatch(db, retentionDays, DEFAULT_BATCH_SIZE, [
+      ...deferred,
+    ]);
     if (batch.length === 0) break;
 
     // Rows span arbitrary tenants (this job sweeps the whole table under
@@ -193,12 +209,13 @@ export async function cleanupDraftsJob(
     // entirely for rows with no FileRefs in the blob, the common case.
     // Delete first (with staleness re-check), then release binaries from rows
     // that actually disappeared — never release a draft the user just saved.
-    const { deletedRows, skippedCount } = await deleteStaleDraftsBatch(
+    const { deletedRows, skippedCount, deferredIds } = await deleteStaleDraftsBatch(
       batch,
       db,
       retentionDays,
       ctx.log,
     );
+    for (const id of deferredIds) deferred.add(id);
     for (const row of deletedRows) {
       await releaseRowFileRefs(row, db, fileProviderResolver, ctx.log);
     }
@@ -206,7 +223,11 @@ export async function cleanupDraftsJob(
     // A skipped row is no longer stale, so the next select drops it — a fully
     // skipped batch still makes progress. Only a batch with neither deletes nor
     // skips (all failed) would reselect the same rows forever.
-    if (deletedRows.length + skippedCount === 0 || batch.length < DEFAULT_BATCH_SIZE) break;
+    if (
+      deletedRows.length + skippedCount + deferredIds.length === 0 ||
+      batch.length < DEFAULT_BATCH_SIZE
+    )
+      break;
   }
   ctx.log?.info?.(`[form-draft:cleanup] deleted=${deleted} retentionDays=${retentionDays}`);
 }

package/packages/bundled-features/src/form-draft/handlers/discard.write.ts

@@ -1,12 +1,12 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
-import { FORM_DRAFT_ACCESS } from "../constants.ts";
 import { filterOwnedFileRefs } from "../db/queries/owned-file-refs.ts";
 import { formDraftExecutor } from "../executor.ts";
 import { lookupDraft } from "../lookup.ts";
 import { collectDraftFileRefKeys, releaseDraftFileRefs } from "../release-file-refs.ts";
 import { discardDraftPayloadSchema } from "../schemas.ts";
+import { FORM_DRAFT_ACCESS } from "../web/constants.ts";
 
 // Same construction as file-routes.ts/user-data-rights-defaults' fileRef
 // hook — self-contained (table + entity), no registry needed. `.forget()`

package/packages/bundled-features/src/form-draft/handlers/get.query.ts

@@ -1,8 +1,8 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { FORM_DRAFT_ACCESS } from "../constants.ts";
 import { lookupDraft } from "../lookup.ts";
 import type { FormDraftBlob } from "../schemas.ts";
-import { formDraftBlobSchema, getDraftPayloadSchema } from "../schemas.ts";
+import { getDraftPayloadSchema } from "../schemas.ts";
+import { FORM_DRAFT_ACCESS } from "../web/constants.ts";
 
 export type GetDraftResult = { readonly draft: FormDraftBlob | null };
 
@@ -24,15 +24,14 @@ export const getDraftQuery = defineQueryHandler({
       query.payload.draftKey,
     );
     if (!row) return { draft: null };
-    const parsed = formDraftBlobSchema.safeParse(row.draft);
-    if (!parsed.success) {
-      // Schema evolution or a corrupt jsonb row: surface it to operators
+    if (!row.draft) {
+      // Schema evolution or a corrupt/erased row: surface it to operators
       // instead of silently making the user's draft vanish.
       ctx.log?.warn?.(
-        `[form-draft:get] stored blob for draftKey=${query.payload.draftKey} failed schema, treating as absent: ${parsed.error.message}`,
+        `[form-draft:get] stored blob for draftKey=${query.payload.draftKey} failed schema or decryption, treating as absent`,
       );
       return { draft: null };
     }
-    return { draft: parsed.data };
+    return { draft: row.draft };
   },
 });