@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.363.0

package/dist/billing-foundation/consumer-protection/termination-mail.d.ts

@@ -1,13 +1,22 @@
 import type { ContractTerminationDeclarationType, ContractTerminationKind, ProviderCancelOutcome } from "../events.js";
 import type { ConsentLocale } from "./consent-text.js";
 import { type OperatorNoticeReason } from "./termination-texts.js";
-export type TerminationMailContent = {
+type TextRow = {
+    readonly text: string;
+};
+/** Variables of the termination receipt template. */
+export type TerminationReceiptVariables = {
+    readonly subject: string;
+    readonly receivedAt: string;
+    readonly requestId: string;
+    readonly details: readonly TextRow[];
+    readonly operatorEmail: string;
+};
+/** Variables of the operator notice template. */
+export type OperatorNoticeVariables = {
     readonly subject: string;
-    readonly header: string;
-    readonly sections: readonly {
-        readonly text: string;
-    }[];
-    readonly footer: string;
+    readonly lines: readonly TextRow[];
+    readonly operatorEmail: string;
 };
 /** What the declarant entered; the only input of the receipt. */
 export type TerminationDeclaration = {
@@ -21,7 +30,7 @@ export type TerminationDeclaration = {
 /** The operator notice for a provider problem has no declarant data at all. */
 export type OperatorNoticeDeclaration = Pick<TerminationDeclaration, "declarationType" | "terminationKind"> & Partial<Omit<TerminationDeclaration, "declarationType" | "terminationKind">>;
 export declare function formatReceivedAt(iso: string, locale: ConsentLocale): string;
-export type RenderTerminationReceiptArgs = {
+export type TerminationReceiptArgs = {
     readonly locale: ConsentLocale;
     readonly requestId: string;
     readonly receivedAtIso: string;
@@ -30,8 +39,8 @@ export type RenderTerminationReceiptArgs = {
 };
 /** Built from the declarant's own input only: the content must not depend on
  *  whether (or how) the declaration matched a contract. */
-export declare function renderTerminationReceipt(args: RenderTerminationReceiptArgs): TerminationMailContent;
-export type RenderOperatorNoticeArgs = {
+export declare function terminationReceiptVariables(args: TerminationReceiptArgs): TerminationReceiptVariables;
+export type OperatorNoticeArgs = {
     readonly locale: ConsentLocale;
     readonly requestId: string;
     readonly receivedAtIso: string;
@@ -42,4 +51,5 @@ export type RenderOperatorNoticeArgs = {
     readonly providerCancel?: ProviderCancelOutcome;
     readonly operatorEmail: string;
 };
-export declare function renderOperatorNotice(args: RenderOperatorNoticeArgs): TerminationMailContent;
+export declare function operatorNoticeVariables(args: OperatorNoticeArgs): OperatorNoticeVariables;
+export {};

package/dist/billing-foundation/consumer-protection/termination-mail.js

@@ -34,32 +34,21 @@ function declarationLines(declaration, locale) {
 }
 /** Built from the declarant's own input only: the content must not depend on
  *  whether (or how) the declaration matched a contract. */
-export function renderTerminationReceipt(args) {
+export function terminationReceiptVariables(args) {
     const texts = TERMINATION_TEXTS[args.locale];
-    const subject = texts.receiptSubject[args.declaration.declarationType];
     return {
-        subject,
-        header: subject,
-        sections: [
-            { text: texts.receiptGreeting },
-            { text: texts.receiptIntro },
-            { text: `${texts.receivedAt}: ${formatReceivedAt(args.receivedAtIso, args.locale)}` },
-            { text: `${texts.requestId}: ${args.requestId}` },
-            ...declarationLines(args.declaration, args.locale),
-            { text: texts.receiptNextSteps },
-            { text: texts.receiptRevoke(args.operatorEmail) },
-        ],
-        footer: `${texts.contact} ${args.operatorEmail}`,
+        subject: texts.receiptSubject[args.declaration.declarationType],
+        receivedAt: formatReceivedAt(args.receivedAtIso, args.locale),
+        requestId: args.requestId,
+        details: declarationLines(args.declaration, args.locale),
+        operatorEmail: args.operatorEmail,
     };
 }
-export function renderOperatorNotice(args) {
+export function operatorNoticeVariables(args) {
     const texts = TERMINATION_TEXTS[args.locale];
-    const subject = texts.operatorSubject[args.declaration.declarationType];
     return {
-        subject,
-        header: subject,
-        sections: [
-            { text: texts.operatorIntro },
+        subject: texts.operatorSubject[args.declaration.declarationType],
+        lines: [
             ...args.reasons.map((reason) => ({
                 text: `${texts.noticeReasons}: ${texts.operatorReasons[reason]}`,
             })),
@@ -72,6 +61,6 @@ export function renderOperatorNotice(args) {
                 : []),
             ...declarationLines(args.declaration, args.locale),
         ],
-        footer: args.operatorEmail,
+        operatorEmail: args.operatorEmail,
     };
 }

package/dist/billing-foundation/consumer-protection/termination-notify.js

@@ -1,6 +1,6 @@
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE } from "../constants.js";
-import { renderOperatorNotice } from "./termination-mail.js";
+import { operatorNoticeVariables } from "./termination-mail.js";
 export function requireNotify(ctx) {
     if (!ctx.notify) {
         throw new InternalError({
@@ -12,7 +12,7 @@ export function requireNotify(ctx) {
 export async function notifyOperator(ctx, consumerProtection, plan) {
     await requireNotify(ctx)(CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE, {
         route: { email: consumerProtection.operatorEmail },
-        data: renderOperatorNotice({
+        data: operatorNoticeVariables({
             ...plan,
             operatorEmail: consumerProtection.operatorEmail,
         }),

package/dist/billing-foundation/consumer-protection/termination-pages.js

@@ -2,6 +2,7 @@
 // no JavaScript. Every echoed value goes through escapeHtml/escapeHtmlAttr.
 import { getSessionCookies } from "@cosmicdrift/kumiko-framework/api";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { getCookie } from "hono/cookie";
 import { redirectToCanonicalPath, securePageHeaders, slashVariantOf, wrapInLayout, } from "../../page-render/index.js";
 import { SubscriptionFoundationHandlers } from "../constants.js";
@@ -54,9 +55,6 @@ function htmlResponse(ctx, title, bodyHtml, status) {
         alternates: ctx.alternates,
     }), { status, headers: pageHeaders() });
 }
-function isOneOf(options, value) {
-    return options.includes(value);
-}
 async function readForm(c) {
     const body = await c.req.parseBody();
     const text = (key) => {

package/dist/billing-foundation/consumer-protection/termination-request.js

@@ -12,7 +12,7 @@ import { CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, SubscriptionCancelTimin
 import { CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS, } from "../events.js";
 import { purchaseRolesOf } from "../plan-catalog.js";
 import { resolveConsentLocale } from "./consent-text.js";
-import { renderTerminationReceipt } from "./termination-mail.js";
+import { terminationReceiptVariables } from "./termination-mail.js";
 import { notifyOperator, requireNotify } from "./termination-notify.js";
 const TENANT_ADMIN_ROLE = "TenantAdmin";
 const EXTRAORDINARY_REASON_MESSAGE = "reason is required for an extraordinary termination";
@@ -55,7 +55,7 @@ function needsOperatorNotice(declaration) {
 async function sendTerminationMails(ctx, consumerProtection, plan) {
     await requireNotify(ctx)(CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, {
         route: { email: plan.declaration.email },
-        data: renderTerminationReceipt({
+        data: terminationReceiptVariables({
             locale: plan.locale,
             requestId: plan.requestId,
             receivedAtIso: plan.receivedAtIso,

package/dist/billing-foundation/handlers/process-event.write.js

@@ -124,8 +124,8 @@ export async function appendSubscriptionEvent(ctx, tenantId, payload) {
     // ---------------------------------------------------------------
     const eventPayload = {
         providerName: payload.providerName,
-        providerCustomerId: encryptedFields["providerCustomerId"],
-        providerSubscriptionId: encryptedFields["providerSubscriptionId"],
+        providerCustomerId: encryptedFields.providerCustomerId,
+        providerSubscriptionId: encryptedFields.providerSubscriptionId,
         status: payload.status,
         tier: payload.tier,
         currentPeriodEndIso: payload.currentPeriodEndIso,

package/dist/billing-foundation/handlers/process-payment-event.write.js

@@ -70,7 +70,7 @@ export const processPaymentEventHandler = {
         // ---------------------------------------------------------------
         const eventPayload = {
             providerName: payload.providerName,
-            providerCustomerId: encryptedFields["providerCustomerId"],
+            providerCustomerId: encryptedFields.providerCustomerId,
             priceId: payload.priceId,
             ...(payload.consentId !== undefined && { consentId: payload.consentId }),
         };

package/dist/billing-foundation/subscription-tier-sync.js

@@ -3,6 +3,7 @@
 // (infra#446) — the only per-app variables were the TierName union/default,
 // so it is now a factory parameter.
 import { TierAssignmentSources, TierEngineHandlers, TierEngineQueries, tierAssignmentAggregateId, } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { subscriptionAggregateId } from "./aggregate-id.js";
 import { SubscriptionFoundationQueries, SubscriptionStatuses } from "./constants.js";
 import { createSubscriptionWebhookRoute } from "./webhook-handler.js";
@@ -18,10 +19,8 @@ export function effectiveTierFromSubscription(status, tier, isTierName, defaultT
 // (handler bug, or the handlerQn resolving to a non-list query) fails
 // loudly instead of crashing on `.find` against `undefined`.
 function asRows(result) {
-    if (typeof result === "object" &&
-        result !== null &&
-        Array.isArray(result.rows)) {
-        return result.rows;
+    if (isPlainObject(result) && Array.isArray(result["rows"])) {
+        return result["rows"];
     }
     throw new Error("expected a { rows: [...] } list-query result");
 }

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -2,6 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable, decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { subscriptionsProjectionTable } from "../../billing-foundation/index.js";
 import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
@@ -34,7 +35,7 @@ async function resolveLimitsByTenantAndCap(caps, tenants, configFor) {
     return new Map(entries);
 }
 function isSortableField(field) {
-    return SORTABLE_FIELDS.includes(field);
+    return isOneOf(SORTABLE_FIELDS, field);
 }
 // tier is a plain string with no defined ordering — lt/gt have no meaning
 // on it and are rejected rather than silently treated as "no filter".

package/dist/cap-overview/web/cap-usage-cell.js

@@ -1,13 +1,14 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { CapUsageBar } from "./cap-usage-bar.js";
 function isCapUsage(value) {
-    if (typeof value !== "object" || value === null)
+    if (!isPlainObject(value))
         return false;
-    const used = value.used;
-    const limit = value.limit;
+    const used = value["used"];
+    const limit = value["limit"];
     return ((typeof used === "number" || used === null) &&
         (typeof limit === "number" || limit === null) &&
-        typeof value.fraction === "number");
+        typeof value["fraction"] === "number");
 }
 export function CapUsageCell({ value }) {
     if (!isCapUsage(value))

package/dist/channel-email/email-channel.d.ts

@@ -1,9 +1,9 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { type DeliveryChannel, type NotificationRenderer } from "../delivery/index.js";
+import { type DeliveryChannel, type EmailAttachmentRef } from "../delivery/index.js";
 import type { EmailTransport } from "./types.js";
+export declare function fileAttachmentsFrom(data: Readonly<Record<string, unknown>> | undefined, messageLocale?: string): readonly EmailAttachmentRef[];
 export type EmailChannelOptions = {
     readonly transport: EmailTransport;
-    readonly renderer: NotificationRenderer;
     readonly resolveEmail: (userId: string, ctx: {
         db: unknown;
         tenantId: TenantId;

package/dist/channel-email/email-channel.js

@@ -1,5 +1,6 @@
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
-import { DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, DELIVERY_UNSUBSCRIBE_PATH, } from "../delivery/index.js";
+import * as z from "zod";
+import { DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, DELIVERY_UNSUBSCRIBE_PATH, EMAIL_CHANNEL_NAME, fileAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, renderedPdfAttachmentRefSchema, } from "../delivery/index.js";
 import { decryptStoredPii } from "../shared/index.js";
 import { guardEmailMessage } from "./pii-guard.js";
 // Envelope (From / Reply-To / threading headers) rides on the channel data —
@@ -65,31 +66,88 @@ function emailEnvelopeFrom(data) {
         ...(headers && { headers }),
     };
 }
+const fileAttachmentsSchema = z
+    .array(z.discriminatedUnion("kind", [fileAttachmentRefSchema, renderedPdfAttachmentRefSchema]))
+    .max(MAX_EMAIL_ATTACHMENTS);
+// Only kinds "file" and "rendered-pdf" may come from notify data; inline images are created by the renderer alone.
+// Invalid input throws instead of dropping the attachment silently.
+export function fileAttachmentsFrom(data, messageLocale) {
+    const raw = data?.["attachments"];
+    if (raw === undefined)
+        return [];
+    return fileAttachmentsSchema
+        .parse(raw)
+        .map((ref) => ref.kind === "rendered-pdf" && ref.locale === undefined && messageLocale !== undefined
+        ? { ...ref, locale: messageLocale }
+        : ref);
+}
+const INLINE_EXTENSION_BY_CONTENT_TYPE = {
+    "image/png": "png",
+    "image/jpeg": "jpg",
+    "image/gif": "gif",
+    "image/webp": "webp",
+};
+async function resolveAttachments(sources, ctx) {
+    if (sources.length === 0)
+        return [];
+    if (ctx.readAttachment === undefined) {
+        throw new Error("email channel: the message has attachments but the channel context cannot read files");
+    }
+    const resolved = [];
+    for (const { ref, origin } of sources) {
+        const found = await ctx.readAttachment(ref, origin);
+        if (ref.kind === "rendered-pdf") {
+            if (found === null) {
+                throw new Error(`email channel: rendering attachment "${ref.fileName}" returned nothing`);
+            }
+            resolved.push({
+                kind: "rendered-pdf",
+                templateSlug: ref.templateSlug,
+                fileName: ref.fileName,
+                content: found.content,
+                contentType: found.contentType,
+            });
+            continue;
+        }
+        if (found === null) {
+            // A missing inline image only degrades the look; a missing file is content the recipient expects.
+            if (ref.kind === "inline")
+                continue;
+            throw new Error(`email channel: attachment file ${ref.fileRefId} was not found`);
+        }
+        const fileName = ref.kind === "file"
+            ? ref.fileName
+            : INLINE_EXTENSION_BY_CONTENT_TYPE[found.contentType]
+                ? `${ref.cid}.${INLINE_EXTENSION_BY_CONTENT_TYPE[found.contentType]}`
+                : ref.cid;
+        resolved.push({ ...ref, fileName, content: found.content, contentType: found.contentType });
+    }
+    return resolved;
+}
 export function createEmailChannel(options) {
-    const { transport, renderer, resolveEmail } = options;
-    // Render is the expensive step (template engine, possibly a remote service)
-    // and runs in the delivery.render job, decoupled from the SMTP send so each
-    // can retry independently. Extracted so the inline fallback (no job runner)
+    const { transport, resolveEmail } = options;
+    // Render runs in the delivery.render job, decoupled from the SMTP send so
+    // each can retry independently. Extracted so the inline path (no job runner)
     // can reuse it without going through the channel's own render() indirection.
-    async function renderMessage(message) {
-        // Build renderer input: per-channel template data (if any) or fall back
-        // to title/body from the message. Renderer handles both cases.
-        const variables = message.data ?? {
-            title: message.title,
-            body: message.body,
-        };
-        const rendererInput = {
-            template: message.notificationType,
-            variables,
-            locale: message.locale,
-        };
-        const html = await renderer.render(rendererInput);
-        const text = renderer.renderText ? await renderer.renderText(rendererInput) : undefined;
-        const subject = variables["subject"] ?? message.title; // @cast-boundary dynamic-key
-        return { html, subject, ...(text !== undefined && { text }) };
+    async function renderMessage(message, ctx) {
+        const notificationType = message.notificationType;
+        if (ctx.registry.getAllNotifications().get(notificationType)?.template === undefined) {
+            throw new Error(`email channel: notification "${notificationType}" has no mail template, declare template + meta on r.notification`);
+        }
+        if (ctx.renderMail === undefined) {
+            throw new Error(`email channel: notification "${notificationType}" has a mail template but the channel context carries no renderMail`);
+        }
+        const unsubscribeUrl = message.data?.["unsubscribeUrl"];
+        const { subject, html, text, attachments } = await ctx.renderMail({
+            slug: notificationType,
+            locale: message.locale ?? "en",
+            variables: message.data ?? {},
+            ...(typeof unsubscribeUrl === "string" && { unsubscribeUrl }),
+        });
+        return { html, subject, text, ...(attachments !== undefined && { attachments }) };
     }
     return {
-        name: "email",
+        name: EMAIL_CHANNEL_NAME,
         mode: "queued",
         // resolveEmail typically returns the raw stored user.email, which is ciphertext under an active KMS.
         async resolve(userId, ctx) {
@@ -99,18 +157,23 @@ export function createEmailChannel(options) {
             const address = await decryptStoredPii(stored, "email", "channel-email:resolve");
             return address === PII_ERASED_SENTINEL ? null : address;
         },
-        render(message, _ctx) {
-            return renderMessage(message);
+        render(message, ctx) {
+            return renderMessage(message, ctx);
         },
-        async send(address, message, _ctx, rendered) {
-            const { html, subject, text } = rendered ?? (await renderMessage(message));
+        async send(address, message, ctx, rendered) {
+            const { html, subject, text, attachments } = rendered ?? (await renderMessage(message, ctx));
             const envelope = emailEnvelopeFrom(message.data);
+            const resolvedAttachments = await resolveAttachments([
+                ...(attachments ?? []).map((ref) => ({ ref, origin: "template" })),
+                ...fileAttachmentsFrom(message.data, message.locale).map((ref) => ({ ref, origin: "message" })),
+            ], ctx);
             await transport.send(guardEmailMessage({
                 to: address,
                 subject,
                 html,
                 ...(text !== undefined && { text }),
                 ...envelope,
+                ...(resolvedAttachments.length > 0 && { attachments: resolvedAttachments }),
             }));
             return { status: "sent", address };
         },

package/dist/channel-email/feature.js

@@ -1,10 +1,10 @@
-import { DELIVERY_CHANNEL_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEmailChannel } from "./email-channel.js";
 export function createChannelEmailFeature(options) {
     const channel = createEmailChannel(options);
     return defineFeature("channel-email", (r) => {
-        r.describe("Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport`, a `renderer: NotificationRenderer` (e.g. backed by `renderer-simple`), and a `resolveEmail` function that maps a user ID to their email address.");
+        r.describe("Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails.");
         r.uiHints({
             displayLabel: "Email Channel",
             category: "notifications",
@@ -12,7 +12,7 @@ export function createChannelEmailFeature(options) {
         });
         r.requires("delivery");
         r.translations({ keys: { "delivery.channel.email": { en: "Email" } } });
-        r.useExtension(DELIVERY_CHANNEL_EXTENSION, "email", {
+        r.useExtension(DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, {
             mode: channel.mode,
             resolve: channel.resolve,
             render: channel.render,

package/dist/channel-email/index.d.ts

@@ -2,4 +2,4 @@ export { createEmailChannel, type EmailChannelOptions } from "./email-channel.js
 export { createChannelEmailFeature } from "./feature.js";
 export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.js";
 export { createSmtpTransport, createSmtpTransportFromEnv, type SmtpEnv, type SmtpTransportOptions, } from "./smtp-transport.js";
-export { createInMemoryTransport, type EmailMessage, type EmailTransport } from "./types.js";
+export { createInMemoryTransport, type EmailAttachment, type EmailAttachmentRef, type EmailMessage, type EmailTransport, } from "./types.js";

package/dist/channel-email/index.js

@@ -2,4 +2,4 @@ export { createEmailChannel } from "./email-channel.js";
 export { createChannelEmailFeature } from "./feature.js";
 export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.js";
 export { createSmtpTransport, createSmtpTransportFromEnv, } from "./smtp-transport.js";
-export { createInMemoryTransport } from "./types.js";
+export { createInMemoryTransport, } from "./types.js";

package/dist/channel-email/pii-guard.js

@@ -8,6 +8,15 @@ const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
 // is always refused (the address is garbage — better no mail than a leaked
 // blob); ciphertext in subject/body fails loud in dev and is redacted+logged
 // in prod.
+function assertAttachmentNamesArePlain(message) {
+    for (const attachment of message.attachments ?? []) {
+        const fields = [attachment.fileName, attachment.kind === "inline" ? attachment.cid : undefined];
+        if (fields.some((field) => field?.includes(CIPHERTEXT_MARKER))) {
+            throw new Error(`[channel-email] refusing to send: attachment file name is a PII ciphertext ` +
+                `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`);
+        }
+    }
+}
 export function guardEmailMessage(message) {
     // Every envelope address, not just `to`: a ciphertext From, From-Name or Reply-To is
     // the same garbage as a ciphertext recipient — refuse rather than mail it.
@@ -28,6 +37,7 @@ export function guardEmailMessage(message) {
                 `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`);
         }
     }
+    assertAttachmentNamesArePlain(message);
     const leaking = message.subject.includes(CIPHERTEXT_MARKER) ||
         message.html.includes(CIPHERTEXT_MARKER) ||
         message.text?.includes(CIPHERTEXT_MARKER) === true;

package/dist/channel-email/smtp-transport.js

@@ -37,6 +37,16 @@ function fromHeader(address, fromName) {
     const [parsed] = addressparser(address, { flatten: true });
     return parsed?.address ? { name, address: parsed.address } : address;
 }
+function toNodemailerAttachment(attachment) {
+    const base = {
+        filename: attachment.fileName,
+        content: Buffer.from(attachment.content),
+        contentType: attachment.contentType,
+    };
+    return attachment.kind === "inline"
+        ? { ...base, cid: attachment.cid, contentDisposition: "inline" }
+        : base;
+}
 export function createSmtpTransport(options) {
     const transporter = createTransport({
         host: options.host,
@@ -57,6 +67,9 @@ export function createSmtpTransport(options) {
                 ...(message.text !== undefined && { text: message.text }),
                 ...(message.replyTo && { replyTo: message.replyTo }),
                 ...(message.headers && { headers: message.headers }),
+                ...(message.attachments && {
+                    attachments: message.attachments.map(toNodemailerAttachment),
+                }),
             });
         },
     };

package/dist/channel-email/types.d.ts

@@ -1,3 +1,10 @@
+import type { EmailAttachmentRef, FileAttachmentRef, InlineAttachmentRef, RenderedPdfAttachmentRef } from "../delivery/index.js";
+export type { EmailAttachmentRef };
+export type EmailAttachment = (InlineAttachmentRef | FileAttachmentRef | Pick<RenderedPdfAttachmentRef, "kind" | "templateSlug">) & {
+    readonly content: Uint8Array;
+    readonly contentType: string;
+    readonly fileName: string;
+};
 export type EmailMessage = {
     readonly to: string;
     readonly subject: string;
@@ -7,6 +14,7 @@ export type EmailMessage = {
     readonly fromName?: string;
     readonly replyTo?: string;
     readonly headers?: Readonly<Record<string, string>>;
+    readonly attachments?: readonly EmailAttachment[];
 };
 export type EmailTransport = {
     send(message: EmailMessage): Promise<void>;

package/dist/config/handlers/set.write.js

@@ -120,8 +120,7 @@ export const setWrite = defineWriteHandler({
                 });
             }
             // scope="system" was already rejected above — narrow accordingly.
-            const subject = resolvePiiSubject(scope, // @cast-boundary runtime-checked above
-            tenantId, userId);
+            const subject = resolvePiiSubject(scope, tenantId, userId);
             const kmsCtx = {
                 requestId: requestContext.get()?.requestId ?? "config:write:set",
                 tenantId,

package/dist/custom-fields/lib/value-schema.js

@@ -1,4 +1,5 @@
 import { DEFAULT_CURRENCIES, fieldToZod, } from "@cosmicdrift/kumiko-framework/engine";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { SUPPORTED_FIELD_TYPES } from "../constants.js";
 // Builds a Zod schema that validates a custom-field VALUE against its
 // fieldDefinition. Reuses the framework's `fieldToZod` (Builder-Reuse /
@@ -29,10 +30,9 @@ const SUPPORTED_EMBEDDED_SUB_TYPES = new Set([
 // resulting schema validates the type-shape only, not the constraint.
 const CONSTRAINT_KEYS = ["required", "maxLength", "format", "default"];
 export function buildCustomFieldValueSchema(parsedField) {
-    if (!parsedField || typeof parsedField !== "object")
+    if (!isPlainObject(parsedField))
         return null;
-    const obj = parsedField;
-    const rawType = obj["type"];
+    const rawType = parsedField["type"];
     if (typeof rawType !== "string")
         return null;
     if (!SUPPORTED_TYPES_SET.has(rawType))
@@ -47,37 +47,36 @@ export function buildCustomFieldValueSchema(parsedField) {
     // drops everywhere else.
     let strippedSubSchema;
     if (rawType === "embedded") {
-        const schema = obj["schema"];
+        const schema = parsedField["schema"];
         if (!schema || typeof schema !== "object")
             return null;
         strippedSubSchema = {};
         for (const [subKey, sub] of Object.entries(schema)) {
-            if (!sub || typeof sub !== "object")
+            if (!isPlainObject(sub))
                 return null;
-            const subObj = sub;
-            const subType = subObj["type"];
+            const subType = sub["type"];
             if (typeof subType !== "string" || !SUPPORTED_EMBEDDED_SUB_TYPES.has(subType)) {
                 return null;
             }
-            const strippedSub = { ...subObj };
+            const strippedSub = { ...sub };
             for (const k of CONSTRAINT_KEYS)
                 delete strippedSub[k];
             strippedSubSchema[subKey] = strippedSub;
         }
     }
-    const fieldDef = { ...obj };
+    const fieldDef = { ...parsedField };
     for (const k of CONSTRAINT_KEYS)
         delete fieldDef[k];
     if (strippedSubSchema !== undefined)
         fieldDef["schema"] = strippedSubSchema;
     if (rawType === "enum") {
         fieldDef["type"] = "select";
-        fieldDef["options"] = obj["values"] ?? obj["options"] ?? [];
+        fieldDef["options"] = parsedField["values"] ?? parsedField["options"] ?? [];
     }
     // fieldToZod's money case validates `currency` against the passed list, not
     // a field-level key — so surface the field's own currency when it declares
     // one, else fall back to the framework defaults.
-    const currencies = typeof obj["currency"] === "string" ? [obj["currency"]] : DEFAULT_CURRENCIES;
+    const currencies = typeof parsedField["currency"] === "string" ? [parsedField["currency"]] : DEFAULT_CURRENCIES;
     // @cast-boundary serialized-field is the dehydrated r.field.X() output =
     // a FieldDefinition; fieldToZod reads only its type-specific keys (the
     // extra fieldAccess/retention/label keys are ignored).

package/dist/custom-fields/wire-user-data-rights.js

@@ -1,21 +1,22 @@
 // T1.5c — user-data-rights wiring for custom-fields.
 import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { selectCustomFieldsHostRows } from "./db/queries/user-data-rights.js";
 function asCustomFieldsHostRow(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
+    if (!isPlainObject(value))
         return null;
-    if (!("id" in value) || typeof value.id !== "string")
+    const id = value["id"];
+    if (typeof id !== "string")
         return null;
-    const record = value;
-    const cf = record["custom_fields"] ?? record["customFields"];
+    const cf = value["custom_fields"] ?? value["customFields"];
     if (cf === undefined)
         return null;
     if (cf === null)
-        return { id: value.id, customFields: null };
+        return { id, customFields: null };
     if (!cf || typeof cf !== "object" || Array.isArray(cf))
         return null;
-    return { id: value.id, customFields: Object.fromEntries(Object.entries(cf)) };
+    return { id, customFields: Object.fromEntries(Object.entries(cf)) };
 }
 // fw#2914 — selectCustomFieldsHostRows runs raw SQL against a dynamic host
 // table name (opts.entityTable varies per call site), so it can't go through

package/dist/data-retention/index.d.ts

@@ -1,2 +1,3 @@
 export type { EffectiveRetentionPolicy, ResolveForTenantArgs, ResolveRetentionPolicyArgs, ResolveTenantPresetArgs, RetentionOverride, RetentionPreset, RetentionPresetKey, } from "./feature.js";
 export { createDataRetentionFeature, RETENTION_PRESETS, resolveRetentionPolicy, resolveRetentionPolicyForTenant, resolveTenantRetentionPreset, retentionOverrideSchema, SELECTABLE_RETENTION_PRESETS, tenantRetentionOverrideEntity, tenantRetentionOverrideTable, } from "./feature.js";
+export { computeCutoff, type Instant } from "./keep-for.js";

package/dist/data-retention/index.js

@@ -1 +1,2 @@
 export { createDataRetentionFeature, RETENTION_PRESETS, resolveRetentionPolicy, resolveRetentionPolicyForTenant, resolveTenantRetentionPreset, retentionOverrideSchema, SELECTABLE_RETENTION_PRESETS, tenantRetentionOverrideEntity, tenantRetentionOverrideTable, } from "./feature.js";
+export { computeCutoff } from "./keep-for.js";