@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.363.0

package/dist/ledger/recurring.js

@@ -23,9 +23,7 @@ export function scheduleReference(scheduleId, period) {
 // can't land in one call-site and drift from the other.
 export function findReversedIds(rows) {
     const ids = new Set(rows.map((r) => r.id));
-    return new Set(rows
-        .filter((r) => r.reference !== null && ids.has(r.reference))
-        .map((r) => r.reference));
+    return new Set(rows.flatMap((r) => (r.reference !== null && ids.has(r.reference) ? [r.reference] : [])));
 }
 // "YYYY-MM" ⇄ a month index (year*12 + monthOfYear), so window math is pure
 // integer arithmetic — no Date object (no-date-api guard) and no DST/timezone

package/dist/managed-pages/branding.d.ts

@@ -8,6 +8,7 @@ export declare const BRANDING_KEYS: {
     brandingSiteUrl: ConfigKeyDefinition<"text">;
     brandingAccentColor: ConfigKeyDefinition<"text">;
     brandingLogoUrl: ConfigKeyDefinition<"text">;
+    brandingLogoFile: ConfigKeyDefinition<"text">;
     brandingLayoutPreset: ConfigKeyDefinition<"select">;
 };
 export declare const CUSTOM_CSS_KEY: {
@@ -19,6 +20,7 @@ export declare const BRANDING_QN: {
     readonly siteUrl: "managed-pages:config:branding-site-url";
     readonly accentColor: "managed-pages:config:branding-accent-color";
     readonly logoUrl: "managed-pages:config:branding-logo-url";
+    readonly logoFile: "managed-pages:config:branding-logo-file";
     readonly layoutPreset: "managed-pages:config:branding-layout-preset";
     readonly customCss: "managed-pages:config:branding-custom-css";
 };

package/dist/managed-pages/branding.js

@@ -42,6 +42,10 @@ const DESCRIPTION_PATTERN = { regex: "^[\\s\\S]{0,500}$" };
 // render (page-render/css-sanitize.ts). Keep this cap in sync with MAX_CSS_LENGTH
 // there.
 const CUSTOM_CSS_PATTERN = { regex: "^[\\s\\S]{0,8000}$" };
+// Empty or a FileRef id (UUID); the upload UI that fills it ships separately.
+const FILE_REF_ID_PATTERN = {
+    regex: "^$|^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+};
 export const LAYOUT_PRESETS = ["minimal", "centered", "wide"];
 // Companion toggle feature name. managed-pages reads ctx.hasFeature() against it
 // in the branding query to per-tenant-gate custom-CSS emission. Declared as a
@@ -80,6 +84,12 @@ export const BRANDING_KEYS = {
         pattern: HTTPS_PATTERN,
         write: BRANDING_WRITE,
     }),
+    // Ownership is checked where it is read (renderer-mail-html: FileRef must belong to the rendering tenant).
+    brandingLogoFile: createTenantConfig("text", {
+        default: "",
+        pattern: FILE_REF_ID_PATTERN,
+        write: BRANDING_WRITE,
+    }),
     brandingLayoutPreset: createTenantConfig("select", {
         default: "centered",
         options: LAYOUT_PRESETS,
@@ -99,6 +109,7 @@ export const BRANDING_QN = {
     siteUrl: "managed-pages:config:branding-site-url",
     accentColor: "managed-pages:config:branding-accent-color",
     logoUrl: "managed-pages:config:branding-logo-url",
+    logoFile: "managed-pages:config:branding-logo-file",
     layoutPreset: "managed-pages:config:branding-layout-preset",
     customCss: "managed-pages:config:branding-custom-css",
 };
@@ -114,17 +125,27 @@ async function readText(config, qualifiedKey) {
 export async function readBranding(config) {
     if (!config)
         return EMPTY_BRANDING;
-    const [title, description, siteUrl, accentColor, logoUrl, layoutPreset] = await Promise.all([
+    const [title, description, siteUrl, accentColor, logoUrl, logoFile, layoutPreset] = await Promise.all([
         readText(config, BRANDING_QN.title),
         readText(config, BRANDING_QN.description),
         readText(config, BRANDING_QN.siteUrl),
         readText(config, BRANDING_QN.accentColor),
         readText(config, BRANDING_QN.logoUrl),
+        readText(config, BRANDING_QN.logoFile),
         readText(config, BRANDING_QN.layoutPreset),
     ]);
     // customCss stays "" here — it is gated (allowCustomCss + per-tenant toggle)
     // and read separately by the branding query via readCustomCss.
-    return { title, description, siteUrl, accentColor, logoUrl, layoutPreset, customCss: "" };
+    return {
+        title,
+        description,
+        siteUrl,
+        accentColor,
+        logoUrl,
+        logoFile,
+        layoutPreset,
+        customCss: "",
+    };
 }
 // Read the raw, untrusted custom CSS for the request's tenant. The caller (the
 // branding query) only invokes this once the gate has passed; the value is
@@ -150,6 +171,7 @@ export function coerceBranding(value) {
         siteUrl: stringField(source, "siteUrl"),
         accentColor: stringField(source, "accentColor"),
         logoUrl: stringField(source, "logoUrl"),
+        logoFile: stringField(source, "logoFile"),
         layoutPreset: stringField(source, "layoutPreset"),
         customCss: stringField(source, "customCss"),
     };

package/dist/managed-pages/feature.js

@@ -26,6 +26,7 @@ function brandingRevisionSeed(branding) {
         branding.siteUrl,
         branding.accentColor,
         branding.logoUrl,
+        branding.logoFile,
         branding.layoutPreset,
         branding.customCss,
     ]);

package/dist/managed-pages/i18n.js

@@ -37,6 +37,7 @@ export const MANAGED_PAGES_I18N = {
         en: "Accent color",
     },
     "managed-pages:entity:__config-edit__:field:logoUrl": { en: "Logo URL" },
+    "managed-pages:entity:__config-edit__:field:logoFile": { en: "Logo file" },
     "managed-pages:entity:__config-edit__:field:layoutPreset": { en: "Layout" },
     // Section-Header
     "managed-pages:section.meta": { en: "Metadata" },

package/dist/managed-pages/screens/branding-screen.js

@@ -1,4 +1,4 @@
-import { createSelectField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
+import { createImageField, createSelectField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
 import { BRANDING_QN, LAYOUT_PRESETS } from "../branding.js";
 // Tenant self-service branding editor. A `configEdit` screen (no entity
 // table) — the renderer loads config:query:values, maps the form fields via
@@ -27,6 +27,7 @@ export function createBrandingSettingsScreen(opts) {
             siteUrl: BRANDING_QN.siteUrl,
             accentColor: BRANDING_QN.accentColor,
             logoUrl: BRANDING_QN.logoUrl,
+            logoFile: BRANDING_QN.logoFile,
             layoutPreset: BRANDING_QN.layoutPreset,
         },
         fields: {
@@ -54,6 +55,11 @@ export function createBrandingSettingsScreen(opts) {
                 personal: false,
                 reason: "is_business_data",
             }),
+            logoFile: createImageField({
+                accept: ["image/png", "image/jpeg", "image/webp"],
+                personal: false,
+                reason: "is_business_data",
+            }),
             layoutPreset: createSelectField({ options: LAYOUT_PRESETS }),
         },
         layout: {
@@ -67,6 +73,7 @@ export function createBrandingSettingsScreen(opts) {
                         { field: "description", span: 2 },
                         { field: "siteUrl", span: 1 },
                         { field: "logoUrl", span: 1 },
+                        { field: "logoFile", span: 1 },
                         { field: "accentColor", span: 1 },
                     ],
                 },

package/dist/page-render/branding.d.ts

@@ -4,6 +4,7 @@ export type BrandingTokens = {
     readonly siteUrl: string;
     readonly accentColor: string;
     readonly logoUrl: string;
+    readonly logoFile: string;
     readonly layoutPreset: string;
     readonly customCss: string;
 };

package/dist/page-render/branding.js

@@ -5,6 +5,7 @@ export const EMPTY_BRANDING = {
     siteUrl: "",
     accentColor: "",
     logoUrl: "",
+    logoFile: "",
     layoutPreset: "",
     customCss: "",
 };

package/dist/page-render/markdown.js

@@ -23,7 +23,7 @@ safeRenderer.use({
     },
 });
 export function renderSafeMarkdown(markdown) {
-    // @cast-boundary marked.parse return-type ist `string | Promise<string>`;
+    // @cast-boundary third-party-type-gap marked.parse return-type ist `string | Promise<string>`;
     // `{ async: false }` garantiert sync (string) — Cast nur API-Vertragsfix.
     return safeRenderer.parse(markdown, { async: false });
 }

package/dist/personal-access-tokens/feature.js

@@ -27,7 +27,7 @@ export function bindPatAutoRevokeOnPasswordChangeFromFeature(feature) {
     if (exports && typeof exports === "object" && "bindAutoRevokeOnPasswordChange" in exports) {
         const { bindAutoRevokeOnPasswordChange } = exports;
         if (typeof bindAutoRevokeOnPasswordChange === "function") {
-            // @cast-boundary exports-walk — feature.exports is untyped by design
+            // @cast-boundary feature-exports — feature.exports is untyped by design
             return bindAutoRevokeOnPasswordChange;
         }
     }

package/dist/personal-access-tokens/handlers/list.query.js

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
 import { isExpiredAt } from "../expiry.js";
@@ -10,7 +11,7 @@ import { apiTokenTable } from "../schema/api-token.js";
 // client sorting by tokenHash or any other non-exposed column.
 const SORTABLE_COLUMNS = ["id", "name", "createdAt", "expiresAt", "revokedAt"];
 function isSortableColumn(value) {
-    return SORTABLE_COLUMNS.includes(value);
+    return isOneOf(SORTABLE_COLUMNS, value);
 }
 function tokenStatus(row) {
     if (row.revokedAt !== null)

package/dist/personal-access-tokens/revoke-for-user.js

@@ -3,11 +3,12 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN, patRevokedSchema, } from "./pat-revoked-event.js";
 import { apiTokenTable } from "./schema/api-token.js";
 // A pool has begin(); a tx/savepoint handle does not and is already atomic.
 function canBeginTransaction(db) {
-    return typeof db.begin === "function"; // @cast-boundary driver-handle-probe
+    return typeof propertyOf(db, "begin") === "function";
 }
 // Cross-tenant revoke: password-change and MFA-enable/disable are account-
 // level security events, not scoped to one tenant. Mirrors sessions'

package/dist/renderer-foundation/api.d.ts

@@ -3,21 +3,21 @@ import { type RenderKind } from "./constants.js";
 import { type RendererPlugin } from "./types.js";
 export type RendererFoundationApi = {
     /**
-     * Wählt + returnt ein RendererPlugin für (tenantId × kind). Caller
-     * rufen anschließend `plugin.render(req, ctx)`.
+     * Selects + returns a RendererPlugin for (tenantId × kind). Callers
+     * then invoke `plugin.render(req, ctx)`.
      *
-     * **Auswahl-Reihenfolge:**
-     *   1. Tenant-spezifische Config (config-Bundle: `rendererPluginByKind`)
-     *   2. DEFAULT_PLUGIN_BY_KIND aus constants
-     *   3. Erstes Plugin im Pool das das kind bedient
-     *   4. `RendererError("no_plugin_for_kind")` wenn nichts passt
+     * **Selection order:**
+     *   1. Tenant-specific config (config bundle: `rendererPluginByKind`)
+     *   2. DEFAULT_PLUGIN_BY_KIND from constants
+     *   3. First plugin in the pool that serves the kind
+     *   4. `RendererError("no_plugin_for_kind")` if nothing matches
      *
-     * **Caller-Pattern:** `tenantId` MUSS vom Server kommen (typisch
-     * `ctx.user.tenantId`). Plugins, die Service-Access brauchen (z.B.
-     * `renderer-mail-html` für Layout-Resolve via `template-resolver`),
-     * erhalten `RendererContext` als zweites Argument zu `render()` —
-     * matcht das Pattern von `DeliveryChannel.send(addr, msg, ctx)`.
-     * Plugins ohne Service-Deps (z.B. `renderer-simple`) ignorieren ctx.
+     * **Caller pattern:** `tenantId` MUST come from the server (typically
+     * `ctx.user.tenantId`). Plugins that need service access (e.g.
+     * `@cosmicdrift/kumiko-renderer-mail-html` for layout resolution via `template-resolver`)
+     * receive `RendererContext` as the second argument to `render()` —
+     * matches the pattern of `DeliveryChannel.send(addr, msg, ctx)`.
+     * Plugins without service deps ignore ctx.
      */
     readonly createRendererForTenant: (args: {
         readonly tenantId: TenantId;

package/dist/renderer-foundation/api.js

@@ -34,7 +34,7 @@ export function createRendererFoundationApi(plugins, tenantConfigLookup = () =>
             if (first)
                 return first;
             // 4. Kein Plugin → Error
-            throw new RendererError(`[renderer-foundation] no plugin registered for kind="${kind}". Mount at least one plugin (renderer-simple, renderer-mail-html, renderer-puppeteer-client) for this kind.`, "no_plugin_for_kind");
+            throw new RendererError(`[renderer-foundation] no plugin registered for kind="${kind}". Mount at least one plugin (renderer-mail-html, renderer-puppeteer-client) for this kind.`, "no_plugin_for_kind");
         },
     };
 }

package/dist/renderer-foundation/constants.js

@@ -1,12 +1,10 @@
-// Extension-point name for renderer plugins (renderer-simple,
-// renderer-mail-html, renderer-puppeteer-client, ...).
+// Extension-point name for renderer plugins (@cosmicdrift/kumiko-renderer-mail-html, @cosmicdrift/kumiko-renderer-puppeteer-client, ...).
 export const RENDERER_EXTENSION = "renderer";
 export { CONTENT_FORMATS, RENDER_KINDS, } from "../template-resolver/index.js";
 // Standard-Default-Plugin pro Kind, wenn Tenant keine explizite Config
 // gesetzt hat. App-Bootstrap kann das via TenantConfigKey überschreiben.
 export const DEFAULT_PLUGIN_BY_KIND = {
-    notification: "simple",
-    "mail-html": "mail-html",
+    mail: "mail-html",
     "document-pdf": "puppeteer",
     "image-snapshot": "puppeteer",
 };

package/dist/renderer-foundation/feature.js

@@ -1,17 +1,17 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { RENDERER_EXTENSION } from "./constants.js";
 import { isRendererRegistrationPlugin } from "./types.js";
-// renderer-foundation — Plugin-Foundation für Renderer (Notification,
-// HTML-Mail, PDF, Image). Plan-Doc:
+// renderer-foundation — plugin foundation for renderers (HTML mail, PDF,
+// image). Plan doc:
 // kumiko-platform/docs/plans/features/renderer-foundation.md
 //
-// Pattern symmetrisch zu ai-foundation: Foundation definiert den
-// Extension-Point `renderer`, Plugins (renderer-simple, renderer-mail-html,
-// renderer-puppeteer-client) registrieren sich via `r.useExtension`.
-// Konsumenten holen sich Plugin runtime via createRendererForTenant.
+// Pattern symmetric to ai-foundation: the foundation defines the
+// extension point `renderer`, plugins (@cosmicdrift/kumiko-renderer-mail-html,
+// @cosmicdrift/kumiko-renderer-puppeteer-client) register via `r.useExtension`.
+// Consumers get a plugin at runtime via createRendererForTenant.
 export function createRendererFoundationFeature() {
     return defineFeature("renderer-foundation", (r) => {
-        r.describe('Plugin registry for content rendering (notification HTML, mail HTML, PDF, images): call `foundation.createRendererForTenant({ tenantId, kind })` at render time to get the right renderer plugin selected by kind, with tenant-level overrides via the `rendererPluginByKind` config key. Requires `template-resolver` (declared via `r.requires`). Low-level building block \u2014 add `renderer-simple` (or write a custom plugin via `r.useExtension("renderer", name, { kinds, render })`) rather than using this feature alone.');
+        r.describe('Plugin registry for content rendering (mail HTML, PDF, images): call `foundation.createRendererForTenant({ tenantId, kind })` at render time to get the right renderer plugin selected by kind, with tenant-level overrides via the `rendererPluginByKind` config key. Requires `template-resolver` (declared via `r.requires`). Low-level building block \u2014 add `renderer-mail-html` (or write a custom plugin via `r.useExtension("renderer", name, { kinds, render })`) rather than using this feature alone.');
         r.uiHints({
             displayLabel: "Renderer Foundation",
             category: "notifications",

package/dist/renderer-foundation/index.d.ts

@@ -1,4 +1,5 @@
+export { attachmentFileNameSchema } from "../shared/index.js";
 export { createRendererFoundationApi, type RendererFoundationApi, requireRendererFoundation, } from "./api.js";
 export { CONTENT_FORMATS, type ContentFormat, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, type RenderKind, } from "./constants.js";
 export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.js";
-export { type DocumentPayload, type ImageOptions, isRendererRegistrationPlugin, type MailHtmlPayload, type NotificationPayload, type PdfOptions, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderRequest, type RenderResponse, } from "./types.js";
+export { type DocumentPayload, type DocumentPdfDraft, type DocumentPdfPayload, type DocumentPreview, type DocumentPreviewRequest, type FileAttachmentRef, type ImageOptions, type InlineAttachmentRef, isRendererRegistrationPlugin, type MailAttachmentRef, type MailDraft, type MailPayload, type PdfOptions, type RenderedPdfAttachmentRef, type RenderedTemplateRef, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderProvenance, type RenderRequest, type RenderResponse, } from "./types.js";

package/dist/renderer-foundation/index.js

@@ -1,3 +1,4 @@
+export { attachmentFileNameSchema } from "../shared/index.js";
 export { createRendererFoundationApi, requireRendererFoundation, } from "./api.js";
 export { CONTENT_FORMATS, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, } from "./constants.js";
 export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.js";

package/dist/renderer-foundation/types.d.ts

@@ -1,55 +1,80 @@
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { ConfigAccessor, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
+import type { LinkedResourceEntry, MailTemplateMeta, PdfPageFormat, PdfTemplateMeta, TemplateScope } from "../template-resolver/index.js";
 import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.js";
 export type RenderRequest = {
-    kind: "notification";
-    payload: NotificationPayload;
-} | {
-    kind: "mail-html";
-    payload: MailHtmlPayload;
+    kind: "mail";
+    payload: MailPayload;
 } | {
     kind: "document-pdf";
-    payload: DocumentPayload;
+    payload: DocumentPdfPayload;
     options?: PdfOptions;
 } | {
     kind: "image-snapshot";
     payload: DocumentPayload;
     options?: ImageOptions;
 };
-export type RenderResponse = {
-    kind: "notification";
-    html: string;
-    text?: string;
-} | {
-    kind: "mail-html";
+export type RenderedTemplateRef = {
+    readonly templateId: string;
+    readonly templateVersion: number;
+    readonly scope: TemplateScope;
+};
+export type RenderProvenance = {
+    readonly template?: RenderedTemplateRef;
+    readonly layout?: RenderedTemplateRef;
+};
+export type InlineAttachmentRef = {
+    readonly kind: "inline";
+    readonly cid: string;
+    readonly fileRefId: string;
+};
+export type FileAttachmentRef = {
+    readonly kind: "file";
+    readonly fileRefId: string;
+    readonly fileName: string;
+};
+export type RenderedPdfAttachmentRef = {
+    readonly kind: "rendered-pdf";
+    readonly templateSlug: string;
+    readonly variables: Readonly<Record<string, unknown>>;
+    readonly fileName: string;
+    readonly locale?: string;
+};
+export type MailAttachmentRef = InlineAttachmentRef | FileAttachmentRef | RenderedPdfAttachmentRef;
+export type RenderResponse = ({
+    kind: "mail";
+    subject: string;
     html: string;
     text: string;
+    previewText?: string;
+    attachments?: readonly MailAttachmentRef[];
 } | {
     kind: "document-pdf";
     pdfBytes: Uint8Array;
     pageCount: number;
     sizeBytes: number;
+    fileName: string;
 } | {
     kind: "image-snapshot";
     imageBytes: Uint8Array;
     format: "png" | "jpg";
     width: number;
     height: number;
+}) & RenderProvenance;
+export type MailDraft = {
+    readonly content: string;
+    readonly meta: MailTemplateMeta;
+    readonly variableSchema?: Readonly<Record<string, unknown>>;
+    /** Images and attachments of the row being edited; absent means those of the stored template. */
+    readonly linkedResources?: Readonly<Record<string, LinkedResourceEntry>>;
 };
-export type NotificationPayload = {
-    readonly template?: string;
-    readonly content?: string;
-    readonly contentFormat?: ContentFormat;
-    readonly variables?: Readonly<Record<string, unknown>>;
-    readonly locale?: string;
-};
-export type MailHtmlPayload = {
-    readonly template?: string;
-    readonly content?: string;
-    readonly contentFormat?: ContentFormat;
-    readonly variables?: Readonly<Record<string, unknown>>;
-    readonly locale?: string;
-    readonly subject?: string;
+export type MailPayload = {
+    readonly slug: string;
+    readonly locale: string;
+    readonly variables: Readonly<Record<string, unknown>>;
+    readonly unsubscribeUrl?: string;
+    readonly draft?: MailDraft;
 };
 export type DocumentPayload = {
     readonly template?: string;
@@ -58,8 +83,35 @@ export type DocumentPayload = {
     readonly variables?: Readonly<Record<string, unknown>>;
     readonly locale?: string;
 };
+export type DocumentPdfPayload = {
+    readonly slug: string;
+    readonly locale: string;
+    readonly variables: Readonly<Record<string, unknown>>;
+};
+export type DocumentPdfDraft = {
+    readonly content: string;
+    readonly meta: PdfTemplateMeta | null;
+    readonly variableSchema?: Readonly<Record<string, unknown>>;
+};
+export type DocumentPreviewRequest = DocumentPdfPayload & {
+    readonly draft?: DocumentPdfDraft;
+};
+export type DocumentPreview = {
+    readonly title: string;
+    readonly fileName: string;
+    readonly bodyHtml: string;
+    readonly layout: {
+        readonly slug: string;
+        readonly scope: TemplateScope;
+        readonly headerHtml: string;
+        readonly signatureHtml: string;
+        readonly footerHtml: string;
+    } | null;
+    /** Image keys the body or the layout asks for that no file is linked to. */
+    readonly missingResourceKeys: readonly string[];
+};
 export type PdfOptions = {
-    readonly format?: "A4" | "Letter";
+    readonly format?: PdfPageFormat;
     readonly marginMm?: {
         top?: number;
         right?: number;
@@ -70,6 +122,7 @@ export type PdfOptions = {
     readonly footerTemplate?: string;
     readonly printBackground?: boolean;
     readonly displayHeaderFooter?: boolean;
+    readonly landscape?: boolean;
 };
 export type ImageOptions = {
     readonly width?: number;
@@ -78,18 +131,25 @@ export type ImageOptions = {
     readonly quality?: number;
 };
 export type RendererContext = {
-    readonly db: DbConnection;
+    readonly db: DbRunner | TenantDb;
     readonly registry: Registry;
     readonly tenantId: TenantId;
+    /** Tenant-scoped config for plugins that read the tenant currency or
+     *  branding; plugins fall back to request defaults when absent. */
+    readonly config?: ConfigAccessor;
+    /** Only plugins that embed resource bytes (PDF) need it; without it images are dropped. */
+    readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
 };
 export type RendererPlugin = {
     readonly name: string;
     readonly kinds: ReadonlyArray<RenderKind>;
     render(req: RenderRequest, ctx: RendererContext): Promise<RenderResponse>;
+    /** Optional: plugins that print documents offer a preview that never reaches the print service. */
+    previewDocument?(req: DocumentPreviewRequest, ctx: RendererContext): Promise<DocumentPreview>;
 };
 export declare class RendererError extends Error {
-    readonly code: "no_plugin_for_kind" | "invalid_payload" | "other";
-    constructor(message: string, code: "no_plugin_for_kind" | "invalid_payload" | "other");
+    readonly code: "no_plugin_for_kind" | "invalid_payload" | "unavailable" | "other";
+    constructor(message: string, code: "no_plugin_for_kind" | "invalid_payload" | "unavailable" | "other");
 }
 export type RendererRegistrationPlugin = Omit<RendererPlugin, "name">;
 export declare function isRendererRegistrationPlugin(o: unknown): o is RendererRegistrationPlugin;

package/dist/renderer-pdf/feature.js

@@ -13,7 +13,13 @@ export async function renderTablePdfRequest(req) {
         ...(req.options?.format && { format: req.options.format }),
         ...(req.options?.marginMm && { marginMm: req.options.marginMm }),
     });
-    return { kind: "document-pdf", pdfBytes, pageCount, sizeBytes: pdfBytes.byteLength };
+    return {
+        kind: "document-pdf",
+        pdfBytes,
+        pageCount,
+        sizeBytes: pdfBytes.byteLength,
+        fileName: `${req.payload.slug}.pdf`,
+    };
 }
 export function createRendererPdfFeature() {
     return defineFeature("renderer-pdf", (r) => {

package/dist/sessions/db/queries/cleanup.js

@@ -1,12 +1,12 @@
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 export async function deleteStaleSessionsBatch(db, olderThanDays, batchSize) {
-    const rows = (await asRawClient(db).unsafe(`DELETE FROM "store_user_sessions"
+    const rows = await asRawClient(db).unsafe(`DELETE FROM "store_user_sessions"
      WHERE "id" IN (
        SELECT "id" FROM "store_user_sessions"
        WHERE "expires_at" < now() - ($1::int * interval '1 day')
           OR "revoked_at" < now() - ($1::int * interval '1 day')
        LIMIT $2
      )
-     RETURNING "id"`, [olderThanDays, batchSize]));
+     RETURNING "id"`, [olderThanDays, batchSize]);
     return rows.length;
 }

package/dist/sessions/feature.js

@@ -24,7 +24,7 @@ export function bindAutoRevokeFromFeature(feature) {
     if (exports && typeof exports === "object" && "bindAutoRevokeOnPasswordChange" in exports) {
         const { bindAutoRevokeOnPasswordChange } = exports;
         if (typeof bindAutoRevokeOnPasswordChange === "function") {
-            // @cast-boundary exports-walk — feature.exports is untyped by design
+            // @cast-boundary feature-exports — feature.exports is untyped by design
             return bindAutoRevokeOnPasswordChange;
         }
     }

package/dist/sessions/handlers/list.query.js

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
 import { userSessionTable } from "../schema/user-session.js";
@@ -10,7 +11,7 @@ import { userSessionTable } from "../schema/user-session.js";
 // non-exposed column.
 const SORTABLE_COLUMNS = ["id", "userId", "createdAt", "expiresAt", "revokedAt"];
 function isSortableColumn(value) {
-    return SORTABLE_COLUMNS.includes(value);
+    return isOneOf(SORTABLE_COLUMNS, value);
 }
 // Admin view of every session in the active tenant. ctx.db (TenantDb)
 // applies tenant-scoping automatically on selects from tables with a

package/dist/shared/attachment-file-name.d.ts

@@ -0,0 +1,3 @@
+import * as z from "zod";
+export declare const attachmentFileNameSchema: z.ZodString;
+export declare function sanitizePdfAttachmentFileName(raw: string, templateSlug: string): string;

package/dist/shared/attachment-file-name.js

@@ -0,0 +1,35 @@
+import * as z from "zod";
+const MAX_FILE_NAME_LENGTH = 255;
+function hasControlCharacter(value) {
+    return value.split("").some((char) => {
+        const code = char.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+}
+export const attachmentFileNameSchema = z
+    .string()
+    .min(1)
+    .max(MAX_FILE_NAME_LENGTH)
+    .refine((name) => !name.includes("/") && !name.includes("\\") && !hasControlCharacter(name), {
+    message: "file name must not contain path separators or control characters",
+});
+const PDF_FILE_NAME_MAX_LENGTH = 200;
+const PDF_EXTENSION = ".pdf";
+// Shared by everything that names a rendered PDF, so a mail attachment and a download of the same
+// template get the same name. The cut leaves room for the extension: the attachment schema caps
+// rendered-pdf names, and a name that only fits without ".pdf" would fail it.
+export function sanitizePdfAttachmentFileName(raw, templateSlug) {
+    const cleaned = raw
+        .split("")
+        .filter((char) => !hasControlCharacter(char))
+        .join("")
+        .replace(/[/\\";]/g, "-")
+        .replaceAll("..", "-")
+        .trim()
+        .slice(0, PDF_FILE_NAME_MAX_LENGTH - PDF_EXTENSION.length)
+        .trim();
+    const lastSegment = templateSlug.split(":").pop() ?? templateSlug;
+    if (cleaned === "")
+        return `${lastSegment}${PDF_EXTENSION}`;
+    return cleaned.toLowerCase().endsWith(PDF_EXTENSION) ? cleaned : `${cleaned}${PDF_EXTENSION}`;
+}

package/dist/shared/index.d.ts

@@ -1,5 +1,6 @@
 export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
 export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
+export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.js";
 export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";
@@ -9,6 +10,7 @@ export { isWithinGracePeriod } from "./grace-period.js";
 export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
+export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
@@ -20,6 +22,7 @@ export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } fro
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
+export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.js";
 export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.js";
 export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, type SignupHandoverBinding, type SignupHandoverProvider, } from "./signup-handover.js";
 export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.js";