@cosmicdrift/kumiko-bundled-features 0.339.0 → 0.341.0

package/dist/delivery/delivery-service.js

@@ -25,7 +25,7 @@ export function collectChannels(registry) {
 // nicht aus Extension-Usages). Multi-Kind-Plugin-Pool lebt jetzt im
 // `renderer-foundation`-Bundle via `collectRendererPlugins`.
 export function createDeliveryService(options) {
-    const { db, registry, sseBroker, channels, tenantUserIdsQuery, rateLimit, isChannelKilled, idempotencyRedis, jobRunner, escapeHatchAuditSink, log, } = options;
+    const { db, registry, sseBroker, channels, tenantUserIdsQuery, rateLimit, isChannelKilled, idempotencyRedis, jobRunner, secrets, escapeHatchAuditSink, log, } = options;
     const idemRedis = idempotencyRedis ?? rateLimit?.redis;
     // Rate limit check: atomic INCR + TTL + over-limit rollback via server-side
     // Lua. Runs single-threaded in Redis, so two parallel clients can't both
@@ -119,11 +119,21 @@ export function createDeliveryService(options) {
             ...bridgeStub(),
         }));
     }
+    function recordDelivery(run, entry, deliveryAttemptId) {
+        run.deliveries.push({
+            channel: entry.channel,
+            recipientId: entry.recipientId,
+            status: entry.status,
+            error: entry.error,
+            deliveryAttemptId,
+        });
+    }
     // Single-shot terminal log (inline channels, skips, idempotency dups). Async
     // attempts instead append a queued event up front and a terminal event from
     // the send job — see deliverViaChannel + jobs.ts.
-    async function logDelivery(entry) {
-        await logAttempt(db, registry, entry);
+    async function logDelivery(run, entry) {
+        const attemptId = await logAttempt(db, registry, entry);
+        recordDelivery(run, entry, attemptId);
     }
     // Deliver one resolved (channel, address) pair. Inline channels (inApp) and
     // the no-job-runner fallback render + send synchronously and log the terminal
@@ -131,13 +141,13 @@ export function createDeliveryService(options) {
     // hand off to the delivery.render (or delivery.send) job, which appends the
     // terminal event on the same attempt stream.
     async function deliverViaChannel(args) {
-        const { channel, address, message, channelCtx, tenantId, recipientId, notificationType, priority, } = args;
-        if (channel.mode === "queued" && jobRunner) {
+        const { run, channel, address, message, channelCtx, tenantId, recipientId, notificationType, priority, } = args;
+        if (channel.mode === "queued" && run.jobDispatcher) {
             // Async hand-off: record the attempt as queued, then dispatch the
             // render/send job — the terminal sent/failed event is appended by the
             // job, not here.
             const deliveryAttemptId = generateId();
-            await appendAttemptEvent(db, registry, deliveryAttemptId, {
+            const queuedEntry = {
                 tenantId,
                 notificationType,
                 channel: channel.name,
@@ -146,8 +156,9 @@ export function createDeliveryService(options) {
                 status: "queued",
                 error: null,
                 priority,
-            });
-            await jobRunner.dispatch(channel.render ? DeliveryJobs.render : DeliveryJobs.send, {
+            };
+            await appendAttemptEvent(db, registry, deliveryAttemptId, queuedEntry);
+            await run.jobDispatcher.dispatch(channel.render ? DeliveryJobs.render : DeliveryJobs.send, {
                 channelName: channel.name,
                 address,
                 tenantId,
@@ -157,12 +168,13 @@ export function createDeliveryService(options) {
                 priority,
                 message,
             }, { priority: deliveryPriorityRank[priority] });
+            recordDelivery(run, queuedEntry, deliveryAttemptId);
         }
         else {
             // Inline (inApp) or no-job-runner fallback: render + send synchronously.
             const rendered = channel.render ? await channel.render(message, channelCtx) : undefined;
             const result = await channel.send(address, message, channelCtx, rendered);
-            await logDelivery({
+            await logDelivery(run, {
                 tenantId,
                 notificationType,
                 channel: channel.name,
@@ -174,7 +186,7 @@ export function createDeliveryService(options) {
             });
         }
     }
-    function buildMessage(notificationType, data, channelName) {
+    function buildMessage(notificationType, data, channelName, locale) {
         // Look up per-channel template from notification definition
         const notifDef = registry.getAllNotifications().get(notificationType);
         const templateFn = notifDef?.templates?.[channelName];
@@ -186,6 +198,7 @@ export function createDeliveryService(options) {
                 title: channelData["title"] ?? data["title"] ?? notificationType,
                 body: channelData["body"],
                 data: channelData,
+                locale,
             };
         }
         // @cast-boundary engine-payload — generic notification.data shape
@@ -194,6 +207,7 @@ export function createDeliveryService(options) {
             title: data?.["title"] ?? notificationType,
             body: data?.["body"],
             data,
+            locale,
         };
     }
     // Shared by deliverToUser (resolved account address) and deliverDirect (a
@@ -226,18 +240,18 @@ export function createDeliveryService(options) {
         // and conservative — DB ordering no longer decides the outcome).
         return !prefs.some((p) => p.enabled === false);
     }
-    async function deliverToUser(userId, notificationType, data, tenantId, priority) {
-        const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId);
+    async function deliverToUser(userId, notificationType, data, tenantId, priority, run) {
+        const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId, secrets);
         for (const channel of channels) {
             // Route-only channel (no per-user address): not a user-notification target.
             if (!channel.resolve)
                 continue;
-            const message = buildMessage(notificationType, data, channel.name);
+            const message = buildMessage(notificationType, data, channel.name, run.locale);
             // Kill switch: tenant admin disabled this channel entirely
             if (isChannelKilled) {
                 const killed = await isChannelKilled(tenantId, channel.name);
                 if (killed) {
-                    await logDelivery({
+                    await logDelivery(run, {
                         tenantId,
                         notificationType,
                         channel: channel.name,
@@ -254,7 +268,7 @@ export function createDeliveryService(options) {
             if (priority !== "critical") {
                 const enabled = await isChannelEnabled(userId, tenantId, notificationType, channel.name);
                 if (!enabled) {
-                    await logDelivery({
+                    await logDelivery(run, {
                         tenantId,
                         notificationType,
                         channel: channel.name,
@@ -271,7 +285,7 @@ export function createDeliveryService(options) {
             if (rateLimit) {
                 const allowed = await checkRateLimit(rateLimit, tenantId, channel.name);
                 if (!allowed) {
-                    await logDelivery({
+                    await logDelivery(run, {
                         tenantId,
                         notificationType,
                         channel: channel.name,
@@ -287,7 +301,7 @@ export function createDeliveryService(options) {
             try {
                 const address = await channel.resolve(userId, channelCtx);
                 if (!address) {
-                    await logDelivery({
+                    await logDelivery(run, {
                         tenantId,
                         notificationType,
                         channel: channel.name,
@@ -301,7 +315,7 @@ export function createDeliveryService(options) {
                 }
                 if (priority !== "critical" &&
                     (await isAddressSuppressed(address, tenantId, notificationType, channel.name))) {
-                    await logDelivery({
+                    await logDelivery(run, {
                         tenantId,
                         notificationType,
                         channel: channel.name,
@@ -314,6 +328,7 @@ export function createDeliveryService(options) {
                     continue;
                 }
                 await deliverViaChannel({
+                    run,
                     channel,
                     address,
                     message,
@@ -325,7 +340,7 @@ export function createDeliveryService(options) {
                 });
             }
             catch (err) {
-                await logDelivery({
+                await logDelivery(run, {
                     tenantId,
                     notificationType,
                     channel: channel.name,
@@ -338,20 +353,20 @@ export function createDeliveryService(options) {
             }
         }
     }
-    async function deliverDirect(route, notificationType, data, tenantId, priority, recipientId) {
-        const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId);
+    async function deliverDirect(route, notificationType, data, tenantId, priority, recipientId, run) {
+        const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId, secrets);
         // Direct routing skips preferences (no user account) but NOT rate limit
         // — direct sends can still be abused (webhook replays, test harnesses).
         for (const channel of channels) {
             const address = route[channel.name];
-            const message = buildMessage(notificationType, data, channel.name);
+            const message = buildMessage(notificationType, data, channel.name, run.locale);
             if (!address)
                 continue;
             // Address opt-out (critical priority skips it, same rule as user
             // preferences).
             if (priority !== "critical" &&
                 (await isAddressSuppressed(address, tenantId, notificationType, channel.name))) {
-                await logDelivery({
+                await logDelivery(run, {
                     tenantId,
                     notificationType,
                     channel: channel.name,
@@ -367,7 +382,7 @@ export function createDeliveryService(options) {
             if (rateLimit) {
                 const allowed = await checkRateLimit(rateLimit, tenantId, channel.name);
                 if (!allowed) {
-                    await logDelivery({
+                    await logDelivery(run, {
                         tenantId,
                         notificationType,
                         channel: channel.name,
@@ -382,6 +397,7 @@ export function createDeliveryService(options) {
             }
             try {
                 await deliverViaChannel({
+                    run,
                     channel,
                     address,
                     message,
@@ -393,7 +409,7 @@ export function createDeliveryService(options) {
                 });
             }
             catch (err) {
-                await logDelivery({
+                await logDelivery(run, {
                     tenantId,
                     notificationType,
                     channel: channel.name,
@@ -407,13 +423,18 @@ export function createDeliveryService(options) {
         }
     }
     return {
-        async notify(notificationType, options, _user, tenantId) {
+        async notify(notificationType, options, _user, tenantId, jobDispatcher) {
             const { to, route, data, idempotencyKey } = options;
             const priority = options.priority ?? "normal";
+            const run = {
+                deliveries: [],
+                jobDispatcher: options.immediate ? undefined : (jobDispatcher ?? jobRunner),
+                locale: options.locale,
+            };
             if (idempotencyKey) {
                 const first = await claimIdempotency(tenantId, idempotencyKey);
                 if (!first) {
-                    await logDelivery({
+                    await logDelivery(run, {
                         tenantId,
                         notificationType,
                         channel: "*",
@@ -423,14 +444,12 @@ export function createDeliveryService(options) {
                         error: "duplicate_idempotency_key",
                         priority,
                     });
-                    // skip: duplicate send deduped via idempotency key, logged above
-                    return;
+                    return { deliveries: run.deliveries };
                 }
             }
             if (route) {
-                await deliverDirect(route, notificationType, data, tenantId, priority, options.recipientId ?? null);
-                // skip: direct route delivered, no recipient resolution needed
-                return;
+                await deliverDirect(route, notificationType, data, tenantId, priority, options.recipientId ?? null, run);
+                return { deliveries: run.deliveries };
             }
             if (to !== undefined) {
                 let userIds;
@@ -444,9 +463,10 @@ export function createDeliveryService(options) {
                     userIds = to;
                 }
                 for (const userId of userIds) {
-                    await deliverToUser(userId, notificationType, data, tenantId, priority);
+                    await deliverToUser(userId, notificationType, data, tenantId, priority, run);
                 }
             }
+            return { deliveries: run.deliveries };
         },
     };
 }

package/dist/delivery/index.d.ts

@@ -1,6 +1,6 @@
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
-export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, toChannelResult, } from "./chat-webhook-channel.js";
-export { type ChatSendFailureCode, type ChatSendResult, type ChatWebhookRequest, chatConnectionNameSchema, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
+export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";
+export { type ChatSendFailureCode, type ChatSendResult, type ChatWebhookRequest, type ChatWebhookTarget, chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
 export type { DeliveryStatusValue } from "./constants.js";
 export { DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, } from "./constants.js";
 export { collectChannels, createDeliveryService, type DeliveryServiceOptions, type KillSwitchResolver, type RateLimitConfig, } from "./delivery-service.js";

package/dist/delivery/index.js

@@ -1,6 +1,6 @@
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
-export { chatMessageText, createChatWebhookChannel, toChannelResult, } from "./chat-webhook-channel.js";
-export { chatConnectionNameSchema, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
+export { chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";
+export { chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
 export { DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, } from "./constants.js";
 export { collectChannels, createDeliveryService, } from "./delivery-service.js";
 export { createDeliveryFeature } from "./feature.js";

package/dist/delivery/jobs.js

@@ -15,6 +15,7 @@ const channelMessageSchema = z.object({
     title: z.string(),
     body: z.string().optional(),
     data: z.record(z.string(), z.unknown()).optional(),
+    locale: z.string().optional(),
 });
 const renderJobPayloadSchema = z.object({
     channelName: z.string(),
@@ -56,6 +57,7 @@ function toMessage(p) {
         title: p.message.title,
         body: p.message.body,
         data: p.message.data,
+        locale: p.message.locale,
     };
 }
 function entryFor(p, status, error, address) {
@@ -81,7 +83,7 @@ export const deliveryRenderJob = async (payload, ctx) => {
     const tenantId = p.tenantId; // @cast-boundary engine-payload — stream tenant
     const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
     const channel = resolveChannel(registry, p.channelName);
-    const channelCtx = buildChannelContext(db, registry, undefined, tenantId);
+    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets);
     try {
         if (!channel.render) {
             throw new Error(`delivery.render: channel "${p.channelName}" has no render step`);

package/dist/delivery/types.d.ts

@@ -1,6 +1,6 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { NotifyDeliveryStatus, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 export type ChannelContext = {
@@ -15,6 +15,7 @@ export type ChannelMessage = {
     readonly title: string;
     readonly body: string | undefined;
     readonly data: Readonly<Record<string, unknown>> | undefined;
+    readonly locale?: string | undefined;
 };
 export type ChannelResult = {
     readonly status: "sent" | "failed" | "skipped";
@@ -37,6 +38,7 @@ export type DeliveryChannel = {
 export type RendererInput = {
     readonly template: string;
     readonly variables: Readonly<Record<string, unknown>>;
+    readonly locale?: string | undefined;
 };
 export type NotificationRenderer = {
     readonly name: string;
@@ -48,12 +50,12 @@ export type DeliveryLogEntry = {
     readonly channel: string;
     readonly recipientId: string | null;
     readonly recipientAddress: string | null;
-    readonly status: "queued" | "sent" | "failed" | "skipped";
+    readonly status: NotifyDeliveryStatus;
     readonly error: string | null;
     readonly priority: NotifyPriority;
 };
 export type DeliveryService = {
-    notify(notificationType: string, options: NotifyOptions, user: SessionUser, tenantId: TenantId): Promise<void>;
+    notify(notificationType: string, options: NotifyOptions, user: SessionUser, tenantId: TenantId, jobDispatcher?: NotifyJobDispatcher): Promise<NotifyResult>;
 };
 export type DeliveryChannelPlugin = Omit<DeliveryChannel, "name">;
 export declare function isDeliveryChannelPlugin(o: unknown): o is DeliveryChannelPlugin;

package/dist/inbound-mail-foundation/projection.js

@@ -16,51 +16,45 @@
 // kommen bereits als Ciphertext an — encrypted VOR dem append im
 // write-handler. Die applies kopieren nur durch; decrypted wird erst
 // in den list-queries.
+import { insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
-import { insertIgnoreProjectionRow, upsertProjectionRow, } from "./db/queries/inbound-projections.js";
 import { inboundMessageEntity, mailAccountEntity, mailThreadEntity } from "./entities.js";
 // Drizzle-table-instances aus den entity-shapes — geteilt zwischen
 // projection-applies und list-queries (ein column-namespace).
 export const mailAccountsProjectionTable = buildEntityTable("mail-account", mailAccountEntity);
 export const inboundMessagesProjectionTable = buildEntityTable("inbound-message", inboundMessageEntity);
 export const mailThreadsProjectionTable = buildEntityTable("mail-thread", mailThreadEntity);
-function tableNameOf(table) {
-    return table.tableName;
-}
+// Unbranded metas: the apply functions below ARE the executor of these
+// projections, so they may write through the typed helpers.
+const mailAccountsProjectionMeta = requireEntityTableMeta(mailAccountsProjectionTable, "mail-account");
+const inboundMessagesProjectionMeta = requireEntityTableMeta(inboundMessagesProjectionTable, "inbound-message");
+const mailThreadsProjectionMeta = requireEntityTableMeta(mailThreadsProjectionTable, "mail-thread");
 // =============================================================================
 // mail-account — connected/updated/disconnected teilen den payload-shape,
 // der event-type taggt was passiert ist. Alle drei UPSERT-full für
 // defensive consistency (rebuild-aus-dem-Nichts, out-of-order).
 // =============================================================================
-const ACCOUNT_SET_CLAUSES = [
-    `"provider" = EXCLUDED."provider"`,
-    `"auth_method" = EXCLUDED."auth_method"`,
-    `"owner_user_id" = EXCLUDED."owner_user_id"`,
-    `"display_name" = EXCLUDED."display_name"`,
-    `"address" = EXCLUDED."address"`,
-    `"status" = EXCLUDED."status"`,
-    `"watch_state" = EXCLUDED."watch_state"`,
-    // connected_at bewusst NICHT im SET: der Erst-Connect-Zeitpunkt
-    // bleibt stehen, updated/disconnected überschreiben ihn nicht.
-];
 const applyMailAccountUpsert = defineApply(async (event, tx) => {
     const p = event.payload;
-    const insertCols = {
-        id: event.aggregateId,
-        tenant_id: event.tenantId,
+    const mutable = {
         provider: p.provider,
-        auth_method: p.authMethod,
-        owner_user_id: p.ownerUserId,
-        display_name: p.displayName,
+        authMethod: p.authMethod,
+        ownerUserId: p.ownerUserId,
+        displayName: p.displayName,
         address: p.address,
         status: p.status,
-        watch_state: p.watchState,
-        // Insert-Pfad = Erst-Connect (bzw. Rebuild: createdAt des ersten
-        // events des Streams — fachlich derselbe Zeitpunkt).
-        connected_at: event.createdAt.toString(),
+        watchState: p.watchState,
     };
-    await upsertProjectionRow(tx, tableNameOf(mailAccountsProjectionTable), insertCols, ACCOUNT_SET_CLAUSES, Object.values(insertCols));
+    await upsertOnConflict(tx, mailAccountsProjectionMeta, {
+        id: event.aggregateId,
+        tenantId: event.tenantId,
+        ...mutable,
+        // Only the insert path is the first connect (on rebuild: createdAt of the
+        // stream's first event, the same moment). Left out of `update` so the
+        // first-connect time survives updated/disconnected events.
+        connectedAt: event.createdAt,
+    }, { conflictKeys: ["id"], update: mutable });
 });
 /** mail-account-connected → UPSERT full. */
 export const applyMailAccountConnected = applyMailAccountUpsert;
@@ -77,20 +71,20 @@ export const applyMailAccountDisconnected = applyMailAccountUpsert;
 /** inbound-message-received → INSERT ... ON CONFLICT DO NOTHING. */
 export const applyInboundMessageReceived = defineApply(async (event, tx) => {
     const p = event.payload;
-    await insertIgnoreProjectionRow(tx, tableNameOf(inboundMessagesProjectionTable), {
+    await insertOnConflictDoNothing(tx, inboundMessagesProjectionMeta, {
         id: event.aggregateId,
-        tenant_id: event.tenantId,
-        account_id: p.accountId,
-        owner_user_id: p.ownerUserId,
-        message_id_header: p.messageIdHeader,
-        thread_key: p.threadKey,
+        tenantId: event.tenantId,
+        accountId: p.accountId,
+        ownerUserId: p.ownerUserId,
+        messageIdHeader: p.messageIdHeader,
+        threadKey: p.threadKey,
         from: p.from,
         to: p.to,
         cc: p.cc,
         subject: p.subject,
         snippet: p.snippet,
-        received_at: p.receivedAtIso,
-        body_ref: p.bodyRef,
+        receivedAt: p.receivedAtIso,
+        bodyRef: p.bodyRef,
         scope: p.scope,
     });
 });
@@ -103,17 +97,15 @@ export const applyInboundMessageReceived = defineApply(async (event, tx) => {
 /** mail-thread-updated → UPSERT full mit dem Payload-Snapshot. */
 export const applyMailThreadUpdated = defineApply(async (event, tx) => {
     const p = event.payload;
-    const insertCols = {
-        id: event.aggregateId,
-        tenant_id: event.tenantId,
-        thread_key: p.threadKey,
+    const mutable = {
         subject: p.subject,
-        last_message_at: p.lastMessageAtIso,
-        message_count: p.messageCount,
+        lastMessageAt: p.lastMessageAtIso,
+        messageCount: p.messageCount,
     };
-    await upsertProjectionRow(tx, tableNameOf(mailThreadsProjectionTable), insertCols, [
-        `"subject" = EXCLUDED."subject"`,
-        `"last_message_at" = EXCLUDED."last_message_at"`,
-        `"message_count" = EXCLUDED."message_count"`,
-    ], Object.values(insertCols));
+    await upsertOnConflict(tx, mailThreadsProjectionMeta, {
+        id: event.aggregateId,
+        tenantId: event.tenantId,
+        threadKey: p.threadKey,
+        ...mutable,
+    }, { conflictKeys: ["id"], update: mutable });
 });

package/dist/legal-pages/feature.d.ts

@@ -1,12 +1,8 @@
-import { type TemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type PublicPageWrapLayout } from "../page-render/index.js";
 import { type LegalPageRoute, type LegalRequiredBlock } from "./constants.js";
-export type LegalPagesWrapLayout = (opts: {
-    readonly title: string;
-    readonly bodyHtml: string;
-    readonly lang: string;
-    readonly slug?: string;
-}) => string;
+export { type LegalPagesBootCheckCtx, runLegalPagesBootCheck } from "./lib/boot-check.js";
+export type LegalPagesWrapLayout = PublicPageWrapLayout;
 export type LegalPagesOptions = {
     /** Custom Layout-Wrapper für die /legal/*-Routes. Default: minimaler
      *  HTML-Skeleton aus markdown.ts (`wrapInLayout`). Apps die ihr eigenes
@@ -27,11 +23,3 @@ export type LegalPagesOptions = {
     readonly requiredBlocks?: readonly LegalRequiredBlock[];
 };
 export declare function createLegalPagesFeature(opts?: LegalPagesOptions): FeatureDefinition;
-export type LegalPagesBootCheckCtx = {
-    readonly templateResolver?: TemplateResolverApi;
-    readonly log?: {
-        readonly info?: (msg: string) => void;
-        readonly warn?: (msg: string) => void;
-    };
-};
-export declare function runLegalPagesBootCheck(ctx: LegalPagesBootCheckCtx, requiredBlocks?: readonly LegalRequiredBlock[]): Promise<void>;

package/dist/legal-pages/feature.js

@@ -1,9 +1,11 @@
-import { requireTemplateResolver, TEXT_BLOCK_KIND, } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { cachedSecurePageResponse } from "../page-render/index.js";
+import { cachedSecurePageResponse, redirectToCanonicalPath, slashVariantOf, } from "../page-render/index.js";
 import { LEGAL_REQUIRED_BLOCKS, LEGAL_ROUTES, } from "./constants.js";
+import { runLegalPagesBootCheck } from "./lib/boot-check.js";
+import { validateRoutes } from "./lib/validate-routes.js";
 import { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
+export { runLegalPagesBootCheck } from "./lib/boot-check.js";
 // QN-Konstante als dokumentierter Public-Contract des template-resolver-
 // Features. Ein magic-string statt eines Code-Imports ist hier explizit
 // gewollt: Cross-Feature-Calls gehen nur über stable Public-API
@@ -14,23 +16,6 @@ import { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
 const TEXT_BLOCK_BY_SLUG_QN = "template-resolver:query:by-slug";
 // 60s-shared-cache saves the origin-revalidate roundtrip; legal-content edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 };
-// Validated once at feature-build time (not per-request) so a config typo
-// fails app startup instead of surfacing as a confusing 404 later.
-function validateRoutes(routes) {
-    const seenPaths = new Set();
-    for (const route of routes) {
-        if (!route.path || !route.slug || !route.lang) {
-            throw new Error(`legal-pages: route is missing a required field (path/slug/lang): ${JSON.stringify(route)}`);
-        }
-        if (!route.path.startsWith("/")) {
-            throw new Error(`legal-pages: route path must start with "/", got "${route.path}"`);
-        }
-        if (seenPaths.has(route.path)) {
-            throw new Error(`legal-pages: duplicate route path "${route.path}"`);
-        }
-        seenPaths.add(route.path);
-    }
-}
 export function createLegalPagesFeature(opts = {}) {
     const wrapLayout = opts.wrapLayout ?? wrapInLayout;
     const routes = opts.routes ?? LEGAL_ROUTES;
@@ -56,6 +41,8 @@ export function createLegalPagesFeature(opts = {}) {
                 method: "GET",
                 path: route.path,
                 anonymous: true,
+                // Public pages backed by a DB query: bound the per-IP read rate.
+                rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
                 handler: async (c, { systemQuery }) => {
                     // Architektur: 1 App = X Tenants = 1 Impressum. Egal welche
                     // Subdomain der Visitor besucht (apex, admin.*, tenant-x.*) —
@@ -113,6 +100,20 @@ export function createLegalPagesFeature(opts = {}) {
                 },
             });
         }
+        // Hono matches strictly, so "/legal/x/" would 404 for sites that link with
+        // a trailing slash. GET also serves HEAD.
+        const configuredPaths = new Set(routes.map((route) => route.path));
+        for (const route of routes) {
+            const variant = slashVariantOf(route.path);
+            if (variant === null || configuredPaths.has(variant))
+                continue;
+            r.httpRoute({
+                method: "GET",
+                path: variant,
+                anonymous: true,
+                handler: (c) => redirectToCanonicalPath(c.req.url, route.path),
+            });
+        }
         // Boot-Check via ctx.templateResolver (extraContext-Pattern, symmetrisch
         // zu requireConfigResolver in config). App-Bootstrap muss templateResolver
         // wired haben — der Helper gibt einen klaren Wiring-Hinweis wenn nicht.
@@ -132,34 +133,3 @@ export function createLegalPagesFeature(opts = {}) {
         return {};
     });
 }
-// Exportiert für direkte Tests. Wirft InternalError wenn ctx.templateResolver
-// nicht gewired ist (Hinweis auf fehlenden extraContext). Wirft Error
-// in NODE_ENV=production wenn Pflicht-Blocks fehlen, sonst log.warn.
-// Logged log.info wenn alles vorhanden ist (kein silent-skip).
-export async function runLegalPagesBootCheck(ctx, requiredBlocks = LEGAL_REQUIRED_BLOCKS) {
-    const templateResolver = requireTemplateResolver(ctx, "legal-pages-boot-check");
-    const missing = [];
-    for (const required of requiredBlocks) {
-        const block = await templateResolver.findExact({
-            tenantId: SYSTEM_TENANT_ID,
-            slug: required.slug,
-            kind: TEXT_BLOCK_KIND,
-            locale: required.lang,
-        });
-        if (!block?.content) {
-            missing.push({ slug: required.slug, lang: required.lang });
-        }
-    }
-    if (missing.length === 0) {
-        ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
-    }
-    else {
-        const message = `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
-            missing.map((m) => `${m.slug}/${m.lang}`).join(", ") +
-            ". Seed via template-resolver:write:set or the seedTextBlock helper.";
-        if (process.env["NODE_ENV"] === "production") {
-            throw new Error(`Boot-Validation failed: ${message}`);
-        }
-        ctx.log?.warn?.(message);
-    }
-}

package/dist/legal-pages/lib/boot-check.d.ts

@@ -0,0 +1,10 @@
+import { type TemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import { type LegalRequiredBlock } from "../constants.js";
+export type LegalPagesBootCheckCtx = {
+    readonly templateResolver?: TemplateResolverApi;
+    readonly log?: {
+        readonly info?: (msg: string) => void;
+        readonly warn?: (msg: string) => void;
+    };
+};
+export declare function runLegalPagesBootCheck(ctx: LegalPagesBootCheckCtx, requiredBlocks?: readonly LegalRequiredBlock[]): Promise<void>;