@cosmicdrift/kumiko-bundled-features 0.338.0 → 0.340.0

package/dist/inbound-mail-foundation/projection.js

@@ -16,51 +16,45 @@
 // kommen bereits als Ciphertext an — encrypted VOR dem append im
 // write-handler. Die applies kopieren nur durch; decrypted wird erst
 // in den list-queries.
+import { insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
-import { insertIgnoreProjectionRow, upsertProjectionRow, } from "./db/queries/inbound-projections.js";
 import { inboundMessageEntity, mailAccountEntity, mailThreadEntity } from "./entities.js";
 // Drizzle-table-instances aus den entity-shapes — geteilt zwischen
 // projection-applies und list-queries (ein column-namespace).
 export const mailAccountsProjectionTable = buildEntityTable("mail-account", mailAccountEntity);
 export const inboundMessagesProjectionTable = buildEntityTable("inbound-message", inboundMessageEntity);
 export const mailThreadsProjectionTable = buildEntityTable("mail-thread", mailThreadEntity);
-function tableNameOf(table) {
-    return table.tableName;
-}
+// Unbranded metas: the apply functions below ARE the executor of these
+// projections, so they may write through the typed helpers.
+const mailAccountsProjectionMeta = requireEntityTableMeta(mailAccountsProjectionTable, "mail-account");
+const inboundMessagesProjectionMeta = requireEntityTableMeta(inboundMessagesProjectionTable, "inbound-message");
+const mailThreadsProjectionMeta = requireEntityTableMeta(mailThreadsProjectionTable, "mail-thread");
 // =============================================================================
 // mail-account — connected/updated/disconnected teilen den payload-shape,
 // der event-type taggt was passiert ist. Alle drei UPSERT-full für
 // defensive consistency (rebuild-aus-dem-Nichts, out-of-order).
 // =============================================================================
-const ACCOUNT_SET_CLAUSES = [
-    `"provider" = EXCLUDED."provider"`,
-    `"auth_method" = EXCLUDED."auth_method"`,
-    `"owner_user_id" = EXCLUDED."owner_user_id"`,
-    `"display_name" = EXCLUDED."display_name"`,
-    `"address" = EXCLUDED."address"`,
-    `"status" = EXCLUDED."status"`,
-    `"watch_state" = EXCLUDED."watch_state"`,
-    // connected_at bewusst NICHT im SET: der Erst-Connect-Zeitpunkt
-    // bleibt stehen, updated/disconnected überschreiben ihn nicht.
-];
 const applyMailAccountUpsert = defineApply(async (event, tx) => {
     const p = event.payload;
-    const insertCols = {
-        id: event.aggregateId,
-        tenant_id: event.tenantId,
+    const mutable = {
         provider: p.provider,
-        auth_method: p.authMethod,
-        owner_user_id: p.ownerUserId,
-        display_name: p.displayName,
+        authMethod: p.authMethod,
+        ownerUserId: p.ownerUserId,
+        displayName: p.displayName,
         address: p.address,
         status: p.status,
-        watch_state: p.watchState,
-        // Insert-Pfad = Erst-Connect (bzw. Rebuild: createdAt des ersten
-        // events des Streams — fachlich derselbe Zeitpunkt).
-        connected_at: event.createdAt.toString(),
+        watchState: p.watchState,
     };
-    await upsertProjectionRow(tx, tableNameOf(mailAccountsProjectionTable), insertCols, ACCOUNT_SET_CLAUSES, Object.values(insertCols));
+    await upsertOnConflict(tx, mailAccountsProjectionMeta, {
+        id: event.aggregateId,
+        tenantId: event.tenantId,
+        ...mutable,
+        // Only the insert path is the first connect (on rebuild: createdAt of the
+        // stream's first event, the same moment). Left out of `update` so the
+        // first-connect time survives updated/disconnected events.
+        connectedAt: event.createdAt,
+    }, { conflictKeys: ["id"], update: mutable });
 });
 /** mail-account-connected → UPSERT full. */
 export const applyMailAccountConnected = applyMailAccountUpsert;
@@ -77,20 +71,20 @@ export const applyMailAccountDisconnected = applyMailAccountUpsert;
 /** inbound-message-received → INSERT ... ON CONFLICT DO NOTHING. */
 export const applyInboundMessageReceived = defineApply(async (event, tx) => {
     const p = event.payload;
-    await insertIgnoreProjectionRow(tx, tableNameOf(inboundMessagesProjectionTable), {
+    await insertOnConflictDoNothing(tx, inboundMessagesProjectionMeta, {
         id: event.aggregateId,
-        tenant_id: event.tenantId,
-        account_id: p.accountId,
-        owner_user_id: p.ownerUserId,
-        message_id_header: p.messageIdHeader,
-        thread_key: p.threadKey,
+        tenantId: event.tenantId,
+        accountId: p.accountId,
+        ownerUserId: p.ownerUserId,
+        messageIdHeader: p.messageIdHeader,
+        threadKey: p.threadKey,
         from: p.from,
         to: p.to,
         cc: p.cc,
         subject: p.subject,
         snippet: p.snippet,
-        received_at: p.receivedAtIso,
-        body_ref: p.bodyRef,
+        receivedAt: p.receivedAtIso,
+        bodyRef: p.bodyRef,
         scope: p.scope,
     });
 });
@@ -103,17 +97,15 @@ export const applyInboundMessageReceived = defineApply(async (event, tx) => {
 /** mail-thread-updated → UPSERT full mit dem Payload-Snapshot. */
 export const applyMailThreadUpdated = defineApply(async (event, tx) => {
     const p = event.payload;
-    const insertCols = {
-        id: event.aggregateId,
-        tenant_id: event.tenantId,
-        thread_key: p.threadKey,
+    const mutable = {
         subject: p.subject,
-        last_message_at: p.lastMessageAtIso,
-        message_count: p.messageCount,
+        lastMessageAt: p.lastMessageAtIso,
+        messageCount: p.messageCount,
     };
-    await upsertProjectionRow(tx, tableNameOf(mailThreadsProjectionTable), insertCols, [
-        `"subject" = EXCLUDED."subject"`,
-        `"last_message_at" = EXCLUDED."last_message_at"`,
-        `"message_count" = EXCLUDED."message_count"`,
-    ], Object.values(insertCols));
+    await upsertOnConflict(tx, mailThreadsProjectionMeta, {
+        id: event.aggregateId,
+        tenantId: event.tenantId,
+        threadKey: p.threadKey,
+        ...mutable,
+    }, { conflictKeys: ["id"], update: mutable });
 });

package/dist/inbound-mail-foundation/tenant-destroy-hook.js

@@ -29,7 +29,7 @@ async function archiveAndDeleteRows(ctx, table, aggregateType) {
     declareEscapeHatch({ reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON });
     const rows = await ctx.db.selectMany(table, { tenantId: ctx.tenantId });
     for (const row of rows) {
-        await archiveStream(ctx.db.unsafeRaw(INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON), {
+        await archiveStream(ctx.db.unsafeRaw(), {
             tenantId: ctx.tenantId,
             aggregateId: row.id,
             aggregateType,

package/dist/inbound-mail-foundation/types.d.ts

@@ -112,7 +112,15 @@ export type InboundOAuthFlow = {
         readonly code: string;
         readonly redirectUri: string;
     }) => Promise<OAuthTokenSet>;
-    readonly refreshAccessToken: (ctx: InboundMailContext, account: MailAccountRecord, refreshToken: string) => Promise<OAuthTokenSet>;
+    readonly refreshAccessToken: (ctx: InboundMailContext, account: MailAccountRecord, refreshToken: string, 
+    /** The foundation aborts `signal` after a hard timeout while holding a
+     *  per-account lock (a pool connection is pinned meanwhile). Providers
+     *  MUST pass it to their token-endpoint fetch; the foundation awaits the
+     *  provider's result and never drops a late one, because that could lose
+     *  a rotated refresh token. */
+    opts?: {
+        readonly signal?: AbortSignal;
+    }) => Promise<OAuthTokenSet>;
 };
 /**
  * Inbound-Mail-Provider-Plugin contract. Jedes Provider-Feature
@@ -129,6 +137,10 @@ export type InboundMailProviderPlugin = {
     readonly fetch: (ctx: InboundMailContext, account: MailAccountRecord, cursor: SyncCursorPayload | null, opts: {
         readonly backfillWindowDays: number;
         readonly maxMessages: number;
+        /** Valid OAuth access token, minted by the foundation for accounts
+         *  whose provider declares `oauth` (authMethod oauth/xoauth2). Absent
+         *  for password accounts and providers without an oauth flow. */
+        readonly accessToken?: string;
     }) => Promise<InboundFetchResult>;
     /** Nur OAuth-Provider. */
     readonly oauth?: InboundOAuthFlow;
@@ -140,6 +152,11 @@ export type InboundMailProviderPlugin = {
     readonly watch?: (ctx: InboundMailContext, account: MailAccountRecord, handlers: {
         readonly onMessages: (msgs: readonly RawInboundMessage[]) => Promise<void>;
         readonly onError: (err: unknown) => void;
+    }, 
+    /** Same `accessToken` semantics as `fetch` opts; re-minted on every
+     *  supervisor (re)start of the watch. */
+    opts?: {
+        readonly accessToken?: string;
     }) => Promise<() => Promise<void>>;
 };
 export declare function isInboundMailProviderPlugin(o: unknown): o is InboundMailProviderPlugin;

package/dist/inbound-mail-foundation/watch-supervisor.d.ts

@@ -1,5 +1,6 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { DistributedLock } from "@cosmicdrift/kumiko-framework/pipeline";
+import { type OAuthAccessTokenManager } from "./oauth-access-token.js";
 import { type InboundMailContext, type MailAccountRecord, type RawInboundMessage } from "./types.js";
 export type InboundMailSupervisorDeps = {
     /** Slim-Context für Provider-Calls (registry Pflicht, secrets für
@@ -34,6 +35,10 @@ export type InboundMailSupervisorDeps = {
      *  watcher lives. Omit for single-process deployments — every active
      *  account is watched locally, same as before #1719. */
     readonly lock?: DistributedLock;
+    /** Access-token lifecycle for OAuth accounts. Defaults to a manager built
+     *  from `db` + `providerCtx.secrets`; pass the instance shared with
+     *  `createInboundMailConnectRoutes` so a fresh connect primes this cache. */
+    readonly oauthTokens?: OAuthAccessTokenManager;
     /** TTL (seconds) for the per-account watch lease. Default 90s, renewed
      *  every ttl/3. Only used when `lock` is set. */
     readonly watchLeaseTtlSeconds?: number;

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -48,9 +48,15 @@ import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/ku
 import { Temporal } from "temporal-polyfill";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
 import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
+import { createOAuthAccessTokenManager, usesFoundationManagedOAuth, } from "./oauth-access-token.js";
 import { mailAccountsProjectionTable } from "./projection.js";
 import { resolveInboundProviderForAccount } from "./provider-factory.js";
 import { isInboundAuthError, isInboundCursorInvalidError, isInboundRateLimitError, } from "./types.js";
+// Provider errors can embed token or response data in `message`; logs carry
+// only the error class.
+function describeError(err) {
+    return err instanceof Error ? err.name : typeof err;
+}
 const DEFAULT_POLL_INTERVAL_MS = 5 * 60 * 1000;
 const DEFAULT_BACKFILL_WINDOW_DAYS = 30;
 const DEFAULT_MAX_MESSAGES_PER_POLL = 200;
@@ -72,6 +78,25 @@ export function createInboundMailSupervisor(deps) {
     // configured TTL — real deployments (default 90s) never hit it.
     const renewIntervalMs = Math.max(50, Math.floor((leaseTtlSeconds * 1000) / 3));
     const log = deps.log ?? (() => { });
+    const oauthTokens = deps.oauthTokens ??
+        (deps.providerCtx.secrets
+            ? createOAuthAccessTokenManager({
+                db: deps.db,
+                secrets: deps.providerCtx.secrets,
+                providerCtx: deps.providerCtx,
+            })
+            : undefined);
+    // Undefined for non-OAuth accounts. A refresh failure propagates into the
+    // caller's handleSyncError: InboundAuthError → auth_error, anything else
+    // → transient retry.
+    async function resolveAccessToken(account, plugin) {
+        if (!usesFoundationManagedOAuth(account, plugin))
+            return undefined;
+        if (!oauthTokens) {
+            throw new Error("oauth account needs a secrets context for token refresh");
+        }
+        return oauthTokens.getAccessToken(account, plugin);
+    }
     let running = false;
     let pollTimer = null;
     let pollInFlight = null;
@@ -213,7 +238,7 @@ export function createInboundMailSupervisor(deps) {
             return true;
         }
         // Transient/unbekannt: loggen, nächster Tick retried.
-        log(`inbound-mail: account ${account.id} sync error: ${err instanceof Error ? err.message : String(err)}`);
+        log(`inbound-mail: account ${account.id} sync error: ${describeError(err)}`);
         return true;
     }
     // ---------------------------------------------------------------
@@ -225,9 +250,11 @@ export function createInboundMailSupervisor(deps) {
         try {
             // hasMore-Schleife: Pagination innerhalb eines Ticks bis Budget.
             for (;;) {
+                const accessToken = await resolveAccessToken(account, plugin);
                 const result = await plugin.fetch(deps.providerCtx, account, cursor, {
                     backfillWindowDays,
                     maxMessages: budget,
+                    ...(accessToken !== undefined && { accessToken }),
                 });
                 await ingestBatch(account, result.messages, JSON.stringify(result.nextCursor));
                 await saveCursor(account, result.nextCursor);
@@ -249,7 +276,7 @@ export function createInboundMailSupervisor(deps) {
                 plugin = resolveInboundProviderForAccount(deps.providerCtx, account);
             }
             catch (err) {
-                log(`inbound-mail: ${err instanceof Error ? err.message : String(err)}`);
+                log(`inbound-mail: ${describeError(err)}`);
                 continue;
             }
             await pollAccount(account, plugin);
@@ -290,7 +317,7 @@ export function createInboundMailSupervisor(deps) {
             renewed = await deps.lock.renew(account.id, state.lockToken, leaseTtlSeconds);
         }
         catch (err) {
-            log(`inbound-mail: watch lease renew for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+            log(`inbound-mail: watch lease renew for account ${account.id} failed: ${describeError(err)}`);
             state.renewFailures += 1;
             // After failures spanning a full lease TTL, tear down — otherwise a
             // peer can acquire the expired key while we still hold an IDLE conn.
@@ -379,7 +406,7 @@ export function createInboundMailSupervisor(deps) {
             state.stop = null;
             const delay = state.backoffMs;
             state.backoffMs = Math.min(state.backoffMs * 2, backoffMaxMs);
-            log(`inbound-mail: watch for account ${account.id} died (${err instanceof Error ? err.message : String(err)}) — restart in ${delay}ms`);
+            log(`inbound-mail: watch for account ${account.id} died (${describeError(err)}) — restart in ${delay}ms`);
             void markAccount(account, { watchState: `backoff:${delay}ms` }, "watch_supervisor");
             state.restartTimer = setTimeout(() => {
                 state.restartTimer = null;
@@ -388,27 +415,28 @@ export function createInboundMailSupervisor(deps) {
         };
         state.starting = true;
         try {
+            const accessToken = await resolveAccessToken(account, plugin);
             const stop = await plugin.watch(deps.providerCtx, account, {
                 onMessages: async (msgs) => {
                     try {
                         await ingestBatch(account, msgs, "watch");
                     }
                     catch (err) {
-                        // Ingest-Fehler killt den Watcher nicht — der Poll holt die
-                        // Messages beim nächsten Tick (Dedup macht's idempotent).
-                        log(`inbound-mail: watch-ingest for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+                        // An ingest failure must not kill the watcher: the next poll
+                        // tick fetches the messages again and dedup keeps it idempotent.
+                        log(`inbound-mail: watch-ingest for account ${account.id} failed: ${describeError(err)}`);
                     }
                 },
                 onError: (err) => {
                     void (async () => {
                         const keepRunning = await handleSyncError(account, err);
-                        // auth_error → stopWatcher hat die generation gebumpt,
-                        // scheduleRestart no-op't; für alle anderen: Backoff-Restart.
+                        // On auth_error stopWatcher already bumped the generation, so
+                        // scheduleRestart is a no-op; every other error restarts with backoff.
                         if (keepRunning)
                             scheduleRestart(err);
                     })();
                 },
-            });
+            }, accessToken !== undefined ? { accessToken } : undefined);
             if (state.generation !== generation || !running) {
                 await stop();
                 // skip: stop() kam während des Connects — Watcher wurde sofort wieder abgebaut.
@@ -425,7 +453,7 @@ export function createInboundMailSupervisor(deps) {
                 await markAccount(account, { watchState: "watching" }, "watch_supervisor");
             }
             catch (err) {
-                log(`inbound-mail: markAccount(watching) for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+                log(`inbound-mail: markAccount(watching) for account ${account.id} failed: ${describeError(err)}`);
             }
         }
         catch (err) {
@@ -464,7 +492,7 @@ export function createInboundMailSupervisor(deps) {
                 await stop();
             }
             catch (err) {
-                log(`inbound-mail: stop watcher ${accountId} failed: ${err instanceof Error ? err.message : String(err)}`);
+                log(`inbound-mail: stop watcher ${accountId} failed: ${describeError(err)}`);
             }
         }
         if (deps.lock && lockToken) {
@@ -472,7 +500,7 @@ export function createInboundMailSupervisor(deps) {
                 await deps.lock.release(accountId, lockToken);
             }
             catch (err) {
-                log(`inbound-mail: watch lease release for account ${accountId} failed: ${err instanceof Error ? err.message : String(err)}`);
+                log(`inbound-mail: watch lease release for account ${accountId} failed: ${describeError(err)}`);
             }
         }
     }
@@ -486,7 +514,7 @@ export function createInboundMailSupervisor(deps) {
         pollTimer = setTimeout(() => {
             pollTimer = null;
             pollInFlight = pollOnce()
-                .catch((err) => log(`inbound-mail: poll tick failed: ${err instanceof Error ? err.message : String(err)}`))
+                .catch((err) => log(`inbound-mail: poll tick failed: ${describeError(err)}`))
                 .finally(() => {
                 pollInFlight = null;
                 scheduleNextPoll();

package/dist/managed-pages/handlers/set.write.js

@@ -54,7 +54,7 @@ export const setWrite = defineWriteHandler({
         // on both the existing-check and the executor's stream reads; re-scope to the target.
         // Safe: the override branch is SystemAdmin-gated above.
         const scopedDb = override !== undefined
-            ? createTenantDb(db.unsafeRaw(SET_PAGE_TENANT_OVERRIDE_REASON), override, // @cast-boundary engine-bridge
+            ? createTenantDb(db.unsafeRaw(), override, // @cast-boundary engine-bridge
             "tenant")
             : db;
         const existing = await fetchOne(scopedDb, pagesTable, {

package/dist/notes-history/handlers/add-note.write.js

@@ -54,7 +54,7 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS, entr
                 // Bun.SQL poisons the whole tx after any error inside it, even one that's
                 // caught — so the lookup runs in a savepoint where available, otherwise directly
                 // (pool statements are their own units).
-                authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(READ_AUTHOR_DISPLAY_NAME_REASON), async (sp) => {
+                authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(), async (sp) => {
                     const userRow = await fetchOne(sp, userTable, {
                         id: event.user.id,
                     });

package/dist/renderer-simple/feature.d.ts

@@ -1,4 +1,10 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { NotificationRenderer } from "../delivery/index.js";
 import { type RendererContext, type RenderRequest, type RenderResponse } from "../renderer-foundation/index.js";
-export declare function adaptToFoundation(req: RenderRequest, ctx: RendererContext): Promise<RenderResponse>;
-export declare function createRendererSimpleFeature(): FeatureDefinition;
+import { type MailBranding } from "./simple-renderer.js";
+export declare function adaptToFoundation(req: RenderRequest, ctx: RendererContext, renderer?: NotificationRenderer): Promise<RenderResponse>;
+export type RendererSimpleOptions = {
+    /** Branding applied to every notification mail, including the framework auth mails. */
+    readonly mailBranding?: MailBranding;
+};
+export declare function createRendererSimpleFeature(options?: RendererSimpleOptions): FeatureDefinition;

package/dist/renderer-simple/feature.js

@@ -1,7 +1,7 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { RENDERER_EXTENSION, RendererError, } from "../renderer-foundation/index.js";
 import { resolveNotificationVariables } from "./resolve-variables.js";
-import { simpleRenderer } from "./simple-renderer.js";
+import { createSimpleRenderer, simpleRenderer } from "./simple-renderer.js";
 // Adapter: simpleRenderer.render hat `Promise<string>`-Signatur (Legacy
 // NotificationRenderer-Contract), renderer-foundation erwartet
 // `Promise<RenderResponse>` mit discriminated union. Mapper bewahrt
@@ -9,20 +9,23 @@ import { simpleRenderer } from "./simple-renderer.js";
 // Inline-CSS) und packt sie in den RendererPlugin-Contract.
 //
 // Exported damit der Adapter-Pfad direkt testbar ist (unit-test).
-export async function adaptToFoundation(req, ctx) {
+export async function adaptToFoundation(req, ctx, renderer = simpleRenderer) {
     if (req.kind !== "notification") {
         // Defensiver Guard — Foundation wählt Plugins nur für matching kinds,
         // dieser Pfad sollte unter normalen Umständen nie erreicht werden.
         throw new RendererError(`renderer-simple supports only kind="notification", got "${req.kind}"`, "invalid_payload");
     }
     const variables = await resolveNotificationVariables(req, ctx);
-    const html = await simpleRenderer.render({
+    const html = await renderer.render({
         template: req.payload.template ?? "",
         variables,
     });
     return { kind: "notification", html };
 }
-export function createRendererSimpleFeature() {
+export function createRendererSimpleFeature(options) {
+    const renderer = options?.mailBranding
+        ? createSimpleRenderer(options.mailBranding)
+        : simpleRenderer;
     return defineFeature("renderer-simple", (r) => {
         r.describe('Default renderer plugin for `kind="notification"`: takes a structured `EmailTemplateData` variable map (with `header`, `sections[]` of text/button objects, and optional `footer`; falls back to `title`/`body` if no structured fields are present) and returns rendered HTML with inline CSS. Requires `renderer-foundation`; sufficient for plain notification emails \u2014 swap it for `renderer-mail-html` if you need MJML/Markdown layouts.');
         r.uiHints({
@@ -34,7 +37,7 @@ export function createRendererSimpleFeature() {
         r.optionalRequires("template-resolver");
         r.useExtension(RENDERER_EXTENSION, "simple", {
             kinds: ["notification"],
-            render: adaptToFoundation,
+            render: (req, ctx) => adaptToFoundation(req, ctx, renderer),
         });
     });
 }

package/dist/renderer-simple/index.d.ts

@@ -1,2 +1,2 @@
-export { createRendererSimpleFeature } from "./feature.js";
-export { simpleRenderer } from "./simple-renderer.js";
+export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
+export { createSimpleRenderer, type MailBranding, simpleRenderer } from "./simple-renderer.js";

package/dist/renderer-simple/index.js

@@ -1,2 +1,2 @@
 export { createRendererSimpleFeature } from "./feature.js";
-export { simpleRenderer } from "./simple-renderer.js";
+export { createSimpleRenderer, simpleRenderer } from "./simple-renderer.js";

package/dist/renderer-simple/simple-renderer.d.ts

@@ -1,2 +1,17 @@
 import type { NotificationRenderer } from "../delivery/index.js";
+export type MailBranding = {
+    /** Shown as text when there is no logo, and as the logo alt text. */
+    readonly productName?: string;
+    /** Hex color (#rgb, #rrggbb, #rrggbbaa); used for buttons and the header accent. */
+    readonly primaryColor?: string;
+    /** Absolute http(s) URL; anything else is dropped. */
+    readonly logoUrl?: string;
+    readonly footerText?: string;
+    /** Absolute http(s) URLs only; other entries are dropped. */
+    readonly footerLinks?: readonly {
+        readonly label: string;
+        readonly url: string;
+    }[];
+};
+export declare function createSimpleRenderer(branding?: MailBranding): NotificationRenderer;
 export declare const simpleRenderer: NotificationRenderer;

package/dist/renderer-simple/simple-renderer.js

@@ -1,37 +1,84 @@
-import { escapeHtml } from "@cosmicdrift/kumiko-headless";
-function renderSection(section) {
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+const DEFAULT_PRIMARY_COLOR = "#2563eb";
+const HEX_COLOR_PATTERN = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
+function isHttpUrl(value) {
+    try {
+        const { protocol } = new URL(value);
+        return protocol === "http:" || protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+function resolvePrimaryColor(branding) {
+    const color = branding?.primaryColor;
+    return color && HEX_COLOR_PATTERN.test(color) ? color : DEFAULT_PRIMARY_COLOR;
+}
+function renderBrandingHeader(branding, primaryColor) {
+    if (!branding)
+        return "";
+    const logoUrl = branding.logoUrl && isHttpUrl(branding.logoUrl) ? branding.logoUrl : undefined;
+    if (!logoUrl && !branding.productName)
+        return "";
+    const logo = logoUrl
+        ? `<img src="${escapeHtmlAttr(logoUrl)}" alt="${escapeHtmlAttr(branding.productName ?? "")}" style="display:block;max-height:40px;max-width:200px;border:0" />`
+        : `<span style="font-size:18px;font-weight:700;color:${escapeHtmlAttr(primaryColor)}">${escapeHtml(branding.productName ?? "")}</span>`;
+    return `<div style="margin:0 0 24px;padding:0 0 16px;border-bottom:3px solid ${escapeHtmlAttr(primaryColor)}">${logo}</div>`;
+}
+function renderBrandingFooter(branding) {
+    if (!branding)
+        return "";
+    const links = (branding.footerLinks ?? [])
+        .filter((link) => isHttpUrl(link.url))
+        .map((link) => `<a href="${escapeHtmlAttr(link.url)}" style="color:#999">${escapeHtml(link.label)}</a>`);
+    const footerPartsHtml = [
+        branding.footerText ? escapeHtml(branding.footerText) : "",
+        links.join(" · "),
+    ].filter((part) => part !== "");
+    if (footerPartsHtml.length === 0)
+        return "";
+    const footerHtml = footerPartsHtml.join("<br />");
+    return `<p style="margin:16px 0 0;color:#999;font-size:12px">${footerHtml}</p>`;
+}
+function renderSection(section, primaryColor) {
     if ("text" in section) {
         return `<p style="margin:0 0 16px;color:#333;font-size:14px;line-height:1.5">${escapeHtml(section.text)}</p>`;
     }
     if ("button" in section) {
-        return `<p style="margin:0 0 16px"><a href="${escapeHtml(section.button.url)}" style="display:inline-block;padding:10px 24px;background:#2563eb;color:#fff;text-decoration:none;border-radius:4px;font-size:14px">${escapeHtml(section.button.label)}</a></p>`;
+        return `<p style="margin:0 0 16px"><a href="${escapeHtml(section.button.url)}" style="display:inline-block;padding:10px 24px;background:${escapeHtmlAttr(primaryColor)};color:#fff;text-decoration:none;border-radius:4px;font-size:14px">${escapeHtml(section.button.label)}</a></p>`;
     }
     return "";
 }
 // Simple Renderer: turns structured email template data into HTML with inline CSS.
 // No external dependencies, no template engine — just string concatenation.
-export const simpleRenderer = {
-    name: "simple",
-    async render(input) {
-        const data = input.variables; // @cast-boundary render-helper
-        // Fallback: if no structured fields, use title + body as header + single text section
-        const header = data.header ?? data.title;
-        const sections = data.sections ?? (data.body ? [{ text: data.body }] : undefined);
-        const parts = [];
-        parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
-        parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
-        if (header) {
-            parts.push(`<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`);
-        }
-        if (sections) {
-            for (const section of sections) {
-                parts.push(renderSection(section));
+export function createSimpleRenderer(branding) {
+    const primaryColor = resolvePrimaryColor(branding);
+    return {
+        name: "simple",
+        async render(input) {
+            const data = input.variables; // @cast-boundary render-helper
+            // Fallback: if no structured fields, use title + body as header + single text section
+            const header = data.header ?? data.title;
+            const sections = data.sections ?? (data.body ? [{ text: data.body }] : undefined);
+            const parts = [];
+            parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
+            parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
+            parts.push(renderBrandingHeader(branding, primaryColor));
+            if (header) {
+                parts.push(`<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`);
+            }
+            if (sections) {
+                for (const section of sections) {
+                    parts.push(renderSection(section, primaryColor));
+                }
             }
-        }
-        if (data.footer) {
-            parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(data.footer)}</p>`);
-        }
-        parts.push("</div></body></html>");
-        return parts.join("");
-    },
-};
+            if (data.footer) {
+                parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(data.footer)}</p>`);
+            }
+            parts.push(renderBrandingFooter(branding));
+            parts.push("</div></body></html>");
+            return parts.join("");
+        },
+    };
+}
+export const simpleRenderer = createSimpleRenderer();

package/dist/secrets/feature.js

@@ -135,7 +135,7 @@ export function createSecretsFeature(opts = {}) {
             escapeHatch: {
                 reason: ROTATE_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => rotateJob(payload, ctx, ctx.db.unsafeRaw(ROTATE_ESCAPE_HATCH_REASON)),
+            handler: (payload, ctx) => rotateJob(payload, ctx, ctx.db.unsafeRaw()),
         });
         // Pre-ES had a separate `retention-cleanup` job scrubbing the audit
         // table on a compliance-driven schedule (90d default). Post-ES the

package/dist/sessions/feature.js

@@ -121,7 +121,7 @@ export function createSessionsFeature(options) {
             name: "cleanup",
             trigger: { manual: true },
             escapeHatch: { reason: CLEANUP_ESCAPE_HATCH_REASON },
-            handler: (payload, ctx) => cleanupJob(payload, ctx, ctx.db.unsafeRaw(CLEANUP_ESCAPE_HATCH_REASON)),
+            handler: (payload, ctx) => cleanupJob(payload, ctx, ctx.db.unsafeRaw()),
         });
         // Cross-feature entity hook on "user". `r.entityHook` (NOT `r.hook`) is
         // the supported cross-feature path: entity-keyed, not prefixed by the

package/dist/sessions/handlers/revoke-all-for-user.write.js

@@ -41,7 +41,7 @@ export const revokeAllForUserWrite = defineWriteHandler({
         reason: REVOKE_ALL_SESSIONS_REASON,
     },
     handler: async (event, ctx) => {
-        const runner = ctx.db.unsafeRaw(REVOKE_ALL_SESSIONS_REASON);
+        const runner = ctx.db.unsafeRaw();
         const updated = await updateMany(runner, userSessionTable, { revokedAt: Temporal.Now.instant() }, {
             userId: event.payload.userId,
             revokedAt: null,

package/dist/tenant-handover/handlers/claim.write.js

@@ -36,8 +36,7 @@ export function createClaimTenantHandoverHandler(opts = {}) {
         agent: { expose: false },
         rateLimit: { per: "user", limit: 10, windowSeconds: 60 },
         handler: async (event, ctx) => {
-            const db = ctx.db.unsafeRaw("tenant-handover claim: cross-tenant read + ownership write, legitimized by the " +
-                "row-bound grant redeemed below");
+            const db = ctx.db.unsafeRaw();
             const rootLocation = resolveRootAnchorLocation(ctx.registry, db, event.payload.entityType);
             if (!rootLocation)
                 return notTransferable(event.payload.entityType);

package/dist/tenant-lifecycle/feature.js

@@ -74,7 +74,7 @@ export function createTenantLifecycleFeature() {
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
                 await runTenantDestructionSweep({
-                    db: ctx.db.unsafeRaw(RUN_TENANT_DESTRUCTION_REASON), // @cast-boundary db-operator — jobs never run inside a DbTx
+                    db: ctx.db.unsafeRaw(), // @cast-boundary db-operator — jobs never run inside a DbTx
                     registry: ctx.registry,
                     now: T.Now.instant(),
                     log: (message) => ctx.log?.warn(message),