@cosmicdrift/kumiko-bundled-features 0.340.0 → 0.341.0

package/dist/delivery/types.d.ts

@@ -1,6 +1,6 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { NotifyDeliveryStatus, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 export type ChannelContext = {
@@ -15,6 +15,7 @@ export type ChannelMessage = {
     readonly title: string;
     readonly body: string | undefined;
     readonly data: Readonly<Record<string, unknown>> | undefined;
+    readonly locale?: string | undefined;
 };
 export type ChannelResult = {
     readonly status: "sent" | "failed" | "skipped";
@@ -37,6 +38,7 @@ export type DeliveryChannel = {
 export type RendererInput = {
     readonly template: string;
     readonly variables: Readonly<Record<string, unknown>>;
+    readonly locale?: string | undefined;
 };
 export type NotificationRenderer = {
     readonly name: string;
@@ -48,12 +50,12 @@ export type DeliveryLogEntry = {
     readonly channel: string;
     readonly recipientId: string | null;
     readonly recipientAddress: string | null;
-    readonly status: "queued" | "sent" | "failed" | "skipped";
+    readonly status: NotifyDeliveryStatus;
     readonly error: string | null;
     readonly priority: NotifyPriority;
 };
 export type DeliveryService = {
-    notify(notificationType: string, options: NotifyOptions, user: SessionUser, tenantId: TenantId): Promise<void>;
+    notify(notificationType: string, options: NotifyOptions, user: SessionUser, tenantId: TenantId, jobDispatcher?: NotifyJobDispatcher): Promise<NotifyResult>;
 };
 export type DeliveryChannelPlugin = Omit<DeliveryChannel, "name">;
 export declare function isDeliveryChannelPlugin(o: unknown): o is DeliveryChannelPlugin;

package/dist/legal-pages/feature.d.ts

@@ -1,12 +1,8 @@
-import { type TemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type PublicPageWrapLayout } from "../page-render/index.js";
 import { type LegalPageRoute, type LegalRequiredBlock } from "./constants.js";
-export type LegalPagesWrapLayout = (opts: {
-    readonly title: string;
-    readonly bodyHtml: string;
-    readonly lang: string;
-    readonly slug?: string;
-}) => string;
+export { type LegalPagesBootCheckCtx, runLegalPagesBootCheck } from "./lib/boot-check.js";
+export type LegalPagesWrapLayout = PublicPageWrapLayout;
 export type LegalPagesOptions = {
     /** Custom Layout-Wrapper für die /legal/*-Routes. Default: minimaler
      *  HTML-Skeleton aus markdown.ts (`wrapInLayout`). Apps die ihr eigenes
@@ -27,11 +23,3 @@ export type LegalPagesOptions = {
     readonly requiredBlocks?: readonly LegalRequiredBlock[];
 };
 export declare function createLegalPagesFeature(opts?: LegalPagesOptions): FeatureDefinition;
-export type LegalPagesBootCheckCtx = {
-    readonly templateResolver?: TemplateResolverApi;
-    readonly log?: {
-        readonly info?: (msg: string) => void;
-        readonly warn?: (msg: string) => void;
-    };
-};
-export declare function runLegalPagesBootCheck(ctx: LegalPagesBootCheckCtx, requiredBlocks?: readonly LegalRequiredBlock[]): Promise<void>;

package/dist/legal-pages/feature.js

@@ -1,9 +1,11 @@
-import { requireTemplateResolver, TEXT_BLOCK_KIND, } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { cachedSecurePageResponse } from "../page-render/index.js";
+import { cachedSecurePageResponse, redirectToCanonicalPath, slashVariantOf, } from "../page-render/index.js";
 import { LEGAL_REQUIRED_BLOCKS, LEGAL_ROUTES, } from "./constants.js";
+import { runLegalPagesBootCheck } from "./lib/boot-check.js";
+import { validateRoutes } from "./lib/validate-routes.js";
 import { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
+export { runLegalPagesBootCheck } from "./lib/boot-check.js";
 // QN-Konstante als dokumentierter Public-Contract des template-resolver-
 // Features. Ein magic-string statt eines Code-Imports ist hier explizit
 // gewollt: Cross-Feature-Calls gehen nur über stable Public-API
@@ -14,23 +16,6 @@ import { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
 const TEXT_BLOCK_BY_SLUG_QN = "template-resolver:query:by-slug";
 // 60s-shared-cache saves the origin-revalidate roundtrip; legal-content edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 };
-// Validated once at feature-build time (not per-request) so a config typo
-// fails app startup instead of surfacing as a confusing 404 later.
-function validateRoutes(routes) {
-    const seenPaths = new Set();
-    for (const route of routes) {
-        if (!route.path || !route.slug || !route.lang) {
-            throw new Error(`legal-pages: route is missing a required field (path/slug/lang): ${JSON.stringify(route)}`);
-        }
-        if (!route.path.startsWith("/")) {
-            throw new Error(`legal-pages: route path must start with "/", got "${route.path}"`);
-        }
-        if (seenPaths.has(route.path)) {
-            throw new Error(`legal-pages: duplicate route path "${route.path}"`);
-        }
-        seenPaths.add(route.path);
-    }
-}
 export function createLegalPagesFeature(opts = {}) {
     const wrapLayout = opts.wrapLayout ?? wrapInLayout;
     const routes = opts.routes ?? LEGAL_ROUTES;
@@ -56,6 +41,8 @@ export function createLegalPagesFeature(opts = {}) {
                 method: "GET",
                 path: route.path,
                 anonymous: true,
+                // Public pages backed by a DB query: bound the per-IP read rate.
+                rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
                 handler: async (c, { systemQuery }) => {
                     // Architektur: 1 App = X Tenants = 1 Impressum. Egal welche
                     // Subdomain der Visitor besucht (apex, admin.*, tenant-x.*) —
@@ -113,6 +100,20 @@ export function createLegalPagesFeature(opts = {}) {
                 },
             });
         }
+        // Hono matches strictly, so "/legal/x/" would 404 for sites that link with
+        // a trailing slash. GET also serves HEAD.
+        const configuredPaths = new Set(routes.map((route) => route.path));
+        for (const route of routes) {
+            const variant = slashVariantOf(route.path);
+            if (variant === null || configuredPaths.has(variant))
+                continue;
+            r.httpRoute({
+                method: "GET",
+                path: variant,
+                anonymous: true,
+                handler: (c) => redirectToCanonicalPath(c.req.url, route.path),
+            });
+        }
         // Boot-Check via ctx.templateResolver (extraContext-Pattern, symmetrisch
         // zu requireConfigResolver in config). App-Bootstrap muss templateResolver
         // wired haben — der Helper gibt einen klaren Wiring-Hinweis wenn nicht.
@@ -132,34 +133,3 @@ export function createLegalPagesFeature(opts = {}) {
         return {};
     });
 }
-// Exportiert für direkte Tests. Wirft InternalError wenn ctx.templateResolver
-// nicht gewired ist (Hinweis auf fehlenden extraContext). Wirft Error
-// in NODE_ENV=production wenn Pflicht-Blocks fehlen, sonst log.warn.
-// Logged log.info wenn alles vorhanden ist (kein silent-skip).
-export async function runLegalPagesBootCheck(ctx, requiredBlocks = LEGAL_REQUIRED_BLOCKS) {
-    const templateResolver = requireTemplateResolver(ctx, "legal-pages-boot-check");
-    const missing = [];
-    for (const required of requiredBlocks) {
-        const block = await templateResolver.findExact({
-            tenantId: SYSTEM_TENANT_ID,
-            slug: required.slug,
-            kind: TEXT_BLOCK_KIND,
-            locale: required.lang,
-        });
-        if (!block?.content) {
-            missing.push({ slug: required.slug, lang: required.lang });
-        }
-    }
-    if (missing.length === 0) {
-        ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
-    }
-    else {
-        const message = `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
-            missing.map((m) => `${m.slug}/${m.lang}`).join(", ") +
-            ". Seed via template-resolver:write:set or the seedTextBlock helper.";
-        if (process.env["NODE_ENV"] === "production") {
-            throw new Error(`Boot-Validation failed: ${message}`);
-        }
-        ctx.log?.warn?.(message);
-    }
-}

package/dist/legal-pages/lib/boot-check.d.ts

@@ -0,0 +1,10 @@
+import { type TemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import { type LegalRequiredBlock } from "../constants.js";
+export type LegalPagesBootCheckCtx = {
+    readonly templateResolver?: TemplateResolverApi;
+    readonly log?: {
+        readonly info?: (msg: string) => void;
+        readonly warn?: (msg: string) => void;
+    };
+};
+export declare function runLegalPagesBootCheck(ctx: LegalPagesBootCheckCtx, requiredBlocks?: readonly LegalRequiredBlock[]): Promise<void>;

package/dist/legal-pages/lib/boot-check.js

@@ -0,0 +1,33 @@
+import { requireTemplateResolver, TEXT_BLOCK_KIND, } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { LEGAL_REQUIRED_BLOCKS } from "../constants.js";
+// Missing required blocks fail the boot only in production; elsewhere they warn,
+// so a dev setup without seeded legal texts still starts. A complete set logs
+// info on purpose, so a skipped check is visible.
+export async function runLegalPagesBootCheck(ctx, requiredBlocks = LEGAL_REQUIRED_BLOCKS) {
+    const templateResolver = requireTemplateResolver(ctx, "legal-pages-boot-check");
+    const missing = [];
+    for (const required of requiredBlocks) {
+        const block = await templateResolver.findExact({
+            tenantId: SYSTEM_TENANT_ID,
+            slug: required.slug,
+            kind: TEXT_BLOCK_KIND,
+            locale: required.lang,
+        });
+        if (!block?.content) {
+            missing.push({ slug: required.slug, lang: required.lang });
+        }
+    }
+    if (missing.length === 0) {
+        ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
+    }
+    else {
+        const message = `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
+            missing.map((m) => `${m.slug}/${m.lang}`).join(", ") +
+            ". Seed via template-resolver:write:set or the seedTextBlock helper.";
+        if (process.env["NODE_ENV"] === "production") {
+            throw new Error(`Boot-Validation failed: ${message}`);
+        }
+        ctx.log?.warn?.(message);
+    }
+}

package/dist/legal-pages/lib/validate-routes.d.ts

@@ -0,0 +1,2 @@
+import type { LegalPageRoute } from "../constants.js";
+export declare function validateRoutes(routes: readonly LegalPageRoute[]): void;

package/dist/legal-pages/lib/validate-routes.js

@@ -0,0 +1,17 @@
+// Validated once at feature-build time (not per-request) so a config typo
+// fails app startup instead of surfacing as a confusing 404 later.
+export function validateRoutes(routes) {
+    const seenPaths = new Set();
+    for (const route of routes) {
+        if (!route.path || !route.slug || !route.lang) {
+            throw new Error(`legal-pages: route is missing a required field (path/slug/lang): ${JSON.stringify(route)}`);
+        }
+        if (!route.path.startsWith("/")) {
+            throw new Error(`legal-pages: route path must start with "/", got "${route.path}"`);
+        }
+        if (seenPaths.has(route.path)) {
+            throw new Error(`legal-pages: duplicate route path "${route.path}"`);
+        }
+        seenPaths.add(route.path);
+    }
+}

package/dist/page-render/index.d.ts

@@ -1,6 +1,7 @@
 export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.js";
 export { type CachedSecurePageResponseInit, cachedSecurePageResponse, } from "./cached-page-response.js";
 export { sanitizeTenantCss } from "./css-sanitize.js";
-export { type SeoHeadInput, TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
+export { type PublicPageWrapLayout, type SeoHeadInput, TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
 export { renderSafeMarkdown } from "./markdown.js";
 export { securePageHeaders } from "./security-headers.js";
+export { redirectToCanonicalPath, slashVariantOf } from "./trailing-slash.js";

package/dist/page-render/index.js

@@ -4,3 +4,4 @@ export { sanitizeTenantCss } from "./css-sanitize.js";
 export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
 export { renderSafeMarkdown } from "./markdown.js";
 export { securePageHeaders } from "./security-headers.js";
+export { redirectToCanonicalPath, slashVariantOf } from "./trailing-slash.js";

package/dist/page-render/layout.d.ts

@@ -1,6 +1,13 @@
 import { type ApexHead } from "@cosmicdrift/kumiko-headless/apex";
 import { type BrandingTokens } from "./branding.js";
 export type SeoHeadInput = Omit<ApexHead, "title" | "description" | "lang">;
+export type PublicPageWrapLayout = (opts: {
+    readonly title: string;
+    readonly bodyHtml: string;
+    readonly lang: string;
+    readonly slug?: string;
+    readonly alternates?: Readonly<Record<string, string>>;
+}) => string;
 export declare const TENANT_CONTENT_ATTR = "data-tenant-content";
 export declare function tenantStyleBlock(customCss: string): string;
 export declare function wrapInLayout(opts: {

package/dist/page-render/layout.js

@@ -81,6 +81,11 @@ ${headHtml}
   a { color: var(--accent); }
   code { background: #f4f4f4; padding: 0.1rem 0.3rem; border-radius: 3px; }
   hr { border: 0; border-top: 1px solid #ddd; margin: 2rem 0; }
+  input, select, textarea, button { font: inherit; color: inherit; padding: 0.4rem 0.6rem;
+         border: 1px solid #bbb; border-radius: 4px; box-sizing: border-box; }
+  input:not([type="radio"]):not([type="checkbox"]):not([type="hidden"]), select, textarea {
+         width: 100%; max-width: 100%; }
+  button { cursor: pointer; background: #f4f4f4; }
   .brand-header { position: relative; z-index: 1; display: flex; align-items: center;
                   gap: 0.6rem; margin-bottom: 1.5rem; }
   .brand-header a { display: flex; align-items: center; gap: 0.6rem; color: inherit; text-decoration: none; }

package/dist/page-render/trailing-slash.d.ts

@@ -0,0 +1,2 @@
+export declare function slashVariantOf(path: string): string | null;
+export declare function redirectToCanonicalPath(requestUrl: string, canonicalPath: string): Response;

package/dist/page-render/trailing-slash.js

@@ -0,0 +1,15 @@
+// The other trailing-slash form of a path, or null for the root path (it has
+// no distinct variant).
+export function slashVariantOf(path) {
+    if (path === "/")
+        return null;
+    return path.endsWith("/") ? path.slice(0, -1) : `${path}/`;
+}
+// Hono matches strictly, so the slash variant of a page would 404. A 301 keeps
+// one canonical URL; the query string is carried over.
+export function redirectToCanonicalPath(requestUrl, canonicalPath) {
+    return new Response(null, {
+        status: 301,
+        headers: { location: `${canonicalPath}${new URL(requestUrl).search}` },
+    });
+}

package/dist/renderer-simple/feature.js

@@ -19,6 +19,7 @@ export async function adaptToFoundation(req, ctx, renderer = simpleRenderer) {
     const html = await renderer.render({
         template: req.payload.template ?? "",
         variables,
+        locale: req.payload.locale,
     });
     return { kind: "notification", html };
 }

package/dist/renderer-simple/index.d.ts

@@ -1,2 +1,2 @@
 export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
-export { createSimpleRenderer, type MailBranding, simpleRenderer } from "./simple-renderer.js";
+export { createSimpleRenderer, type LocalizedText, type MailBranding, simpleRenderer, } from "./simple-renderer.js";

package/dist/renderer-simple/index.js

@@ -1,2 +1,2 @@
 export { createRendererSimpleFeature } from "./feature.js";
-export { createSimpleRenderer, simpleRenderer } from "./simple-renderer.js";
+export { createSimpleRenderer, simpleRenderer, } from "./simple-renderer.js";

package/dist/renderer-simple/simple-renderer.d.ts

@@ -4,14 +4,21 @@ export type MailBranding = {
     readonly productName?: string;
     /** Hex color (#rgb, #rrggbb, #rrggbbaa); used for buttons and the header accent. */
     readonly primaryColor?: string;
-    /** Absolute http(s) URL; anything else is dropped. */
+    /** Absolute http(s) URL; anything else is dropped. Mutually exclusive with `logoPath`. */
     readonly logoUrl?: string;
-    readonly footerText?: string;
-    /** Absolute http(s) URLs only; other entries are dropped. */
+    /** Absolute path on `baseUrl` (e.g. "/logo.png"); use PNG/JPEG, mail clients block SVG. */
+    readonly logoPath?: string;
+    /** Absolute http(s) origin that `logoPath` is resolved against; same base as `auth.mail.baseUrl`. */
+    readonly baseUrl?: string;
+    /** Locale tried after the exact and language-part match when a localized field has no entry. */
+    readonly defaultLocale?: string;
+    readonly footerText?: LocalizedText;
+    /** Absolute http(s) URLs only; string URLs that are not are dropped, localized ones fail at boot. */
     readonly footerLinks?: readonly {
-        readonly label: string;
-        readonly url: string;
+        readonly label: LocalizedText;
+        readonly url: LocalizedText;
     }[];
 };
+export type LocalizedText = string | Readonly<Record<string, string>>;
 export declare function createSimpleRenderer(branding?: MailBranding): NotificationRenderer;
 export declare const simpleRenderer: NotificationRenderer;

package/dist/renderer-simple/simple-renderer.js

@@ -10,14 +10,61 @@ function isHttpUrl(value) {
         return false;
     }
 }
+function languagePart(locale) {
+    return locale.split("-")[0] ?? locale;
+}
+function pickByLocale(entries, locale) {
+    // Own keys only: a locale like "constructor" must not hit Object.prototype.
+    const ownEntry = (key) => Object.hasOwn(entries, key) ? entries[key] : undefined;
+    return ownEntry(locale) ?? ownEntry(languagePart(locale));
+}
+function resolveLocalized(value, locale, defaultLocale) {
+    if (value === undefined || typeof value === "string")
+        return value;
+    return ((locale !== undefined ? pickByLocale(value, locale) : undefined) ??
+        (defaultLocale !== undefined ? pickByLocale(value, defaultLocale) : undefined) ??
+        Object.values(value)[0]);
+}
+function assertLocalizedUrlsAreHttp(branding) {
+    for (const link of branding.footerLinks ?? []) {
+        if (typeof link.url === "string")
+            continue;
+        for (const [locale, url] of Object.entries(link.url)) {
+            if (!isHttpUrl(url)) {
+                throw new Error(`createSimpleRenderer: footerLinks url for locale "${locale}" must be an absolute http(s) URL`);
+            }
+        }
+    }
+}
+function resolveLogoUrl(branding) {
+    if (!branding)
+        return undefined;
+    const { logoUrl, logoPath, baseUrl } = branding;
+    if (logoPath === undefined) {
+        return logoUrl && isHttpUrl(logoUrl) ? logoUrl : undefined;
+    }
+    if (logoUrl !== undefined) {
+        throw new Error("createSimpleRenderer: logoPath and logoUrl are mutually exclusive");
+    }
+    if (baseUrl === undefined || !isHttpUrl(baseUrl)) {
+        throw new Error("createSimpleRenderer: logoPath requires an absolute http(s) baseUrl");
+    }
+    if (!/^\/(?![/\\])/.test(logoPath) || logoPath.includes("\\")) {
+        throw new Error('createSimpleRenderer: logoPath must start with a single "/"');
+    }
+    const resolved = new URL(logoPath, baseUrl);
+    if (resolved.origin !== new URL(baseUrl).origin) {
+        throw new Error("createSimpleRenderer: logoPath must stay on the baseUrl origin");
+    }
+    return resolved.href;
+}
 function resolvePrimaryColor(branding) {
     const color = branding?.primaryColor;
     return color && HEX_COLOR_PATTERN.test(color) ? color : DEFAULT_PRIMARY_COLOR;
 }
-function renderBrandingHeader(branding, primaryColor) {
+function renderBrandingHeader(branding, primaryColor, logoUrl) {
     if (!branding)
         return "";
-    const logoUrl = branding.logoUrl && isHttpUrl(branding.logoUrl) ? branding.logoUrl : undefined;
     if (!logoUrl && !branding.productName)
         return "";
     const logo = logoUrl
@@ -25,16 +72,20 @@ function renderBrandingHeader(branding, primaryColor) {
         : `<span style="font-size:18px;font-weight:700;color:${escapeHtmlAttr(primaryColor)}">${escapeHtml(branding.productName ?? "")}</span>`;
     return `<div style="margin:0 0 24px;padding:0 0 16px;border-bottom:3px solid ${escapeHtmlAttr(primaryColor)}">${logo}</div>`;
 }
-function renderBrandingFooter(branding) {
+function renderBrandingFooter(branding, locale) {
     if (!branding)
         return "";
-    const links = (branding.footerLinks ?? [])
-        .filter((link) => isHttpUrl(link.url))
-        .map((link) => `<a href="${escapeHtmlAttr(link.url)}" style="color:#999">${escapeHtml(link.label)}</a>`);
-    const footerPartsHtml = [
-        branding.footerText ? escapeHtml(branding.footerText) : "",
-        links.join(" · "),
-    ].filter((part) => part !== "");
+    const pick = (value) => resolveLocalized(value, locale, branding.defaultLocale);
+    const links = (branding.footerLinks ?? []).flatMap((link) => {
+        const url = pick(link.url);
+        if (url === undefined || !isHttpUrl(url))
+            return [];
+        return [
+            `<a href="${escapeHtmlAttr(url)}" style="color:#999">${escapeHtml(pick(link.label) ?? "")}</a>`,
+        ];
+    });
+    const footerText = pick(branding.footerText);
+    const footerPartsHtml = [footerText ? escapeHtml(footerText) : "", links.join(" · ")].filter((part) => part !== "");
     if (footerPartsHtml.length === 0)
         return "";
     const footerHtml = footerPartsHtml.join("<br />");
@@ -53,6 +104,9 @@ function renderSection(section, primaryColor) {
 // No external dependencies, no template engine — just string concatenation.
 export function createSimpleRenderer(branding) {
     const primaryColor = resolvePrimaryColor(branding);
+    const logoUrl = resolveLogoUrl(branding);
+    if (branding)
+        assertLocalizedUrlsAreHttp(branding);
     return {
         name: "simple",
         async render(input) {
@@ -63,7 +117,7 @@ export function createSimpleRenderer(branding) {
             const parts = [];
             parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
             parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
-            parts.push(renderBrandingHeader(branding, primaryColor));
+            parts.push(renderBrandingHeader(branding, primaryColor, logoUrl));
             if (header) {
                 parts.push(`<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`);
             }
@@ -75,7 +129,7 @@ export function createSimpleRenderer(branding) {
             if (data.footer) {
                 parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(data.footer)}</p>`);
             }
-            parts.push(renderBrandingFooter(branding));
+            parts.push(renderBrandingFooter(branding, input.locale));
             parts.push("</div></body></html>");
             return parts.join("");
         },

package/dist/secrets/announce-secret-change.d.ts

@@ -0,0 +1,8 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type CacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
+type AnnouncingContext = {
+    readonly cacheSync?: CacheSyncBus;
+    readonly scheduleAfterCommit?: (hook: () => Promise<void>) => void;
+};
+export declare function announceSecretChange(ctx: AnnouncingContext, tenantId: TenantId, key: string): void;
+export {};

package/dist/secrets/announce-secret-change.js

@@ -0,0 +1,18 @@
+import { CACHE_SYNC_TOPICS, } from "@cosmicdrift/kumiko-framework/redis";
+// Secret writes bypass config:write:*, yet provider caches (e.g. the S3 secret
+// key) depend on them: announce on the tenant-config topic, after commit so a
+// replica reloading on the message sees the new value.
+export function announceSecretChange(ctx, tenantId, key) {
+    const bus = ctx.cacheSync;
+    // skip: no bus wired (single-process setup), nothing to announce
+    if (!bus)
+        return;
+    const message = { tenantId, key };
+    const publish = async () => {
+        bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+    };
+    if (ctx.scheduleAfterCommit)
+        ctx.scheduleAfterCommit(publish);
+    else
+        bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+}

package/dist/secrets/feature.js

@@ -54,7 +54,7 @@ export function requireSecretsContext(ctx, handlerName) {
     if (!ctx.secrets) {
         throw new InternalError({
             message: `[${handlerName}] ctx.secrets missing — pass ` +
-                "createSecretsContext({db, masterKeyProvider}) via extraContext.secrets at boot.",
+                "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
         });
     }
     const raw = ctx.secrets;

package/dist/secrets/handlers/delete.write.js

@@ -1,6 +1,7 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
@@ -23,6 +24,7 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
             });
             if (!removed)
                 return failNotFound("tenant-secret", event.payload.key);
+            announceSecretChange(ctx, event.user.tenantId, event.payload.key);
             return { isSuccess: true, data: { key: event.payload.key } };
         },
     });

package/dist/secrets/handlers/set.write.js

@@ -1,8 +1,9 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
-import { checkSecretKeyWrite } from "../write-gate.js";
+import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
         name: "set",
@@ -30,6 +31,9 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
             const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, key);
             if (!gate.ok)
                 return gate.failure;
+            const invalidValue = checkSecretValue(ctx.registry, key, value);
+            if (invalidValue)
+                return invalidValue;
             const featureRedact = gate.keyDef?.redact;
             const redactFn = redactedPreview
                 ? () => redactedPreview
@@ -39,6 +43,7 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
                 ...(hint ? { hint } : {}),
                 updatedBy: event.user.id,
             });
+            announceSecretChange(ctx, event.user.tenantId, key);
             return {
                 isSuccess: true,
                 data: { key, redactedPreview: redactedPreview ?? redactFn(value) },

package/dist/secrets/i18n.d.ts

@@ -7,4 +7,8 @@ export declare const SECRETS_I18N: {
         readonly en: "You are not allowed to change this secret.";
         readonly de: "Dieses Geheimnis darf nicht geändert werden.";
     };
+    readonly "secrets.errors.invalidValue": {
+        readonly en: "This value is not valid for this secret.";
+        readonly de: "Dieser Wert ist für dieses Geheimnis nicht gültig.";
+    };
 };

package/dist/secrets/i18n.js

@@ -7,4 +7,8 @@ export const SECRETS_I18N = {
         en: "You are not allowed to change this secret.",
         de: "Dieses Geheimnis darf nicht geändert werden.",
     },
+    "secrets.errors.invalidValue": {
+        en: "This value is not valid for this secret.",
+        de: "Dieser Wert ist für dieses Geheimnis nicht gültig.",
+    },
 };

package/dist/secrets/secrets-context.d.ts

@@ -1,10 +1,12 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type DekCache, type MasterKeyProvider, type SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
+import { type SecretValueSchemaSource } from "./write-gate.js";
 export type { Secret, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 export type SecretsContextOptions = {
     readonly db: DbConnection;
     readonly masterKeyProvider: MasterKeyProvider;
+    readonly registry: SecretValueSchemaSource;
     readonly dekCache?: DekCache;
 };
 export declare const TENANT_SECRET_READ_EVENT = "secrets:event:read";

package/dist/secrets/secrets-context.js

@@ -20,6 +20,7 @@ import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { selectTenantSecretEnvelope } from "./db/queries/read.js";
 import { tenantSecretEntity, tenantSecretsTable, } from "./table.js";
+import { invalidSecretValueError, isSecretValueValid, } from "./write-gate.js";
 // Synthetic actor identity for set/delete — the executor wants a full
 // SessionUser, but the secrets-context API takes only a user-id string
 // (via opts.updatedBy / opts.deletedBy). `system`-role mirrors how jobs
@@ -114,6 +115,8 @@ export function createSecretsContext(opts) {
         },
         async set(tenantId, keyOrHandle, value, setOpts = {}) {
             const key = resolveKey(keyOrHandle);
+            if (!isSecretValueValid(opts.registry, key, value))
+                throw invalidSecretValueError();
             const envelope = await encryptValue(value, masterKeyProvider);
             const stored = encodeStoredEnvelope(envelope);
             const metadata = {

package/dist/secrets/write-gate.d.ts

@@ -1,5 +1,5 @@
 import type { Registry, SecretKeyDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { ValidationError, type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 export type SecretKeyWriteCheck = {
     readonly ok: true;
     readonly keyDef: SecretKeyDefinition | undefined;
@@ -8,3 +8,7 @@ export type SecretKeyWriteCheck = {
     readonly failure: WriteFailure;
 };
 export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;
+export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
+export declare function invalidSecretValueError(): ValidationError;
+export declare function isSecretValueValid(schemas: SecretValueSchemaSource, key: string, value: string): boolean;
+export declare function checkSecretValue(registry: SecretValueSchemaSource, key: string, value: string): WriteFailure | undefined;