@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/dist/jobs/handlers/trigger.write.d.ts

@@ -5,4 +5,4 @@ export declare const triggerWrite: import("@cosmicdrift/kumiko-types/define-hand
 }, z.core.$strip>, {
     jobName: string;
     bullJobId: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/jobs/job-run-logger.js

@@ -103,6 +103,7 @@ async function encryptStartedPayload(payload, triggeredById) {
 const TENANT_JOB_FAILURE_LOCK_NAMESPACE = 0x746a666c;
 // 'tjrl': serialises the finished-row write + prune per tenant run key.
 const TENANT_JOB_RUN_LOCK_NAMESPACE = 0x746a726c;
+const TENANT_RUN_CONFLICT_KEYS = ["tenantId", "jobName", "bullJobId"];
 // fw#3079 — which row the tenant-visible failure record lives in: one per
 // (tenant, job, subject), so the next outcome of the same work replaces or
 // clears it. `subject` is null for a job that declares no subjectFields.
@@ -156,9 +157,22 @@ async function recordTenantRunQueued(db, jobName, bullJobId, meta) {
     if (!key)
         return;
     const now = Temporal.Now.instant();
-    // DO NOTHING: a fast worker can report the start before this enqueue hook
-    // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.
-    await insertOnConflictDoNothing(db, tenantJobRunsTable, { ...key, bullJobId, status: "queued", queuedAt: now, updatedAt: now }, { conflictKeys: ["bullJobId"] });
+    await transaction(db, async (tx) => {
+        // A finished row under the same id is left over from before a Redis reset
+        // (ids restart at 1), not this job. Only rows that went through this hook
+        // (queuedAt set) qualify: a fast worker can finish before the hook runs,
+        // and that row is this job's own and must stay.
+        await deleteMany(tx, tenantJobRunsTable, {
+            tenantId: key.tenantId,
+            jobName,
+            bullJobId,
+            status: { in: ["completed", "failed"] },
+            queuedAt: { gt: Temporal.Instant.fromEpochMilliseconds(0) },
+        });
+        // DO NOTHING: a fast worker can report the start before this enqueue hook
+        // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.
+        await insertOnConflictDoNothing(tx, tenantJobRunsTable, { ...key, bullJobId, status: "queued", queuedAt: now, updatedAt: now }, { conflictKeys: [...TENANT_RUN_CONFLICT_KEYS] });
+    });
 }
 async function recordTenantRunStarted(db, jobName, bullJobId, meta) {
     // skip: job did not opt in to tenantVisibleRun
@@ -170,7 +184,7 @@ async function recordTenantRunStarted(db, jobName, bullJobId, meta) {
         return;
     const now = Temporal.Now.instant();
     await upsertOnConflict(db, tenantJobRunsTable, { ...key, bullJobId, status: "running", startedAt: now, updatedAt: now }, {
-        conflictKeys: ["bullJobId"],
+        conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
         update: { status: "running", startedAt: now, finishedAt: null, updatedAt: now },
     });
 }
@@ -186,7 +200,7 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
     // A failed attempt BullMQ will retry goes back to waiting: the tenant keeps
     // seeing pending work, not a failure the next attempt may still resolve.
     if (result === "failed" && !outcome.finalAttempt) {
-        await updateMany(db, tenantJobRunsTable, { status: "queued", startedAt: null, finishedAt: null, updatedAt: now }, { bullJobId });
+        await updateMany(db, tenantJobRunsTable, { status: "queued", startedAt: null, finishedAt: null, updatedAt: now }, { tenantId: key.tenantId, jobName, bullJobId });
         // skip: retry pending, the row stays active until the final attempt
         return;
     }
@@ -196,7 +210,10 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
     // both behind.
     await transaction(db, async (tx) => {
         await acquireNamespacedAdvisoryLock(tx, TENANT_JOB_RUN_LOCK_NAMESPACE, JSON.stringify([key.tenantId, key.jobName, key.subject]));
-        await upsertOnConflict(tx, tenantJobRunsTable, { ...key, bullJobId, status: result, finishedAt: now, updatedAt: now }, { conflictKeys: ["bullJobId"], update: { status: result, finishedAt: now, updatedAt: now } });
+        await upsertOnConflict(tx, tenantJobRunsTable, { ...key, bullJobId, status: result, finishedAt: now, updatedAt: now }, {
+            conflictKeys: [...TENANT_RUN_CONFLICT_KEYS],
+            update: { status: result, finishedAt: now, updatedAt: now },
+        });
         await deleteMany(tx, tenantJobRunsTable, {
             ...key,
             status: { in: ["completed", "failed"] },
@@ -204,8 +221,13 @@ async function recordTenantRunOutcome(db, jobName, bullJobId, outcome, result) {
         });
     });
 }
-async function dropTenantRunQueued(db, bullJobId) {
-    await deleteMany(db, tenantJobRunsTable, { bullJobId, status: "queued" });
+async function dropTenantRunQueued(db, jobName, bullJobId, meta) {
+    await deleteMany(db, tenantJobRunsTable, {
+        tenantId: meta.tenantId,
+        jobName,
+        bullJobId,
+        status: "queued",
+    });
 }
 const log = createFallbackLogger("job-run-logger");
 // The tenant run state is an optional side write: a throw here must not
@@ -287,8 +309,8 @@ export function createJobRunLogger(opts) {
         onJobQueued: async (jobName, bullJobId, meta) => {
             await isolateTenantRunWrite(() => recordTenantRunQueued(db, jobName, bullJobId, meta), jobName, bullJobId);
         },
-        onJobDropped: async (jobName, bullJobId) => {
-            await isolateTenantRunWrite(() => dropTenantRunQueued(db, bullJobId), jobName, bullJobId);
+        onJobDropped: async (jobName, bullJobId, meta) => {
+            await isolateTenantRunWrite(() => dropTenantRunQueued(db, jobName, bullJobId, meta), jobName, bullJobId);
         },
         onJobStart: async (jobName, bullJobId, meta) => {
             await isolateTenantRunWrite(() => recordTenantRunStarted(db, jobName, bullJobId, meta), jobName, bullJobId);

package/dist/jobs/tenant-job-run-table.js

@@ -8,7 +8,7 @@ import { index, instant, table as pgTable, serial, sql, text, uniqueIndex, uuid,
 // job is invisible there. This table holds no payload, error text or logs by
 // design — the tenant learns only that work is waiting, running or finished.
 //
-// One row per BullMQ job. Active rows (queued/running) are kept as they are;
+// One row per BullMQ job and (tenant, job name). Active rows (queued/running) are kept as they are;
 // a finished row replaces earlier finished rows of the same (tenant, job,
 // subject), so only the latest outcome stays. `subject` is the canonical JSON
 // of the job's declared subjectFields, or NULL for none — stored in clear, so
@@ -25,7 +25,8 @@ export const tenantJobRunsTable = pgTable("store_tenant_job_runs", {
     finishedAt: instant("finished_at"),
     updatedAt: instant("updated_at").default(sql `now()`).notNull(),
 }, (t) => [
-    uniqueIndex("store_tenant_job_runs_bull_job_id_unique").on(t.bullJobId),
+    // BullMQ ids are unique per queue only; the id alone would let two tenants collide.
+    uniqueIndex("store_tenant_job_runs_tenant_job_bull_job_id_unique").on(t.tenantId, t.jobName, t.bullJobId),
     // Finishing a run prunes older outcomes by this key; the tenant query reads by it.
     index("store_tenant_job_runs_tenant_job_subject_idx").on(t.tenantId, t.jobName, t.subject),
     // Stale sweep and retention filter on age alone.

package/dist/ledger/entity.js

@@ -160,7 +160,9 @@ export const scheduleEntity = createEntity({
     },
     // Find-then-create by sourceRef races across tabs/devices; only the DB closes
     // that gap. Partial because sourceRef is optional. A new name (not the old
-    // non-unique default) keeps the migration an in-place CREATE UNIQUE INDEX.
+    // non-unique default) keeps the migration an in-place CREATE UNIQUE INDEX;
+    // that statement, like a projection rebuild, fails on existing duplicate
+    // (tenant_id, source_ref) pairs, so duplicates must be cleaned up beforehand.
     indexes: [
         { columns: ["tenantId", "subjectType", "subjectId"] },
         {

package/dist/ledger/recurring.js

@@ -23,9 +23,7 @@ export function scheduleReference(scheduleId, period) {
 // can't land in one call-site and drift from the other.
 export function findReversedIds(rows) {
     const ids = new Set(rows.map((r) => r.id));
-    return new Set(rows
-        .filter((r) => r.reference !== null && ids.has(r.reference))
-        .map((r) => r.reference));
+    return new Set(rows.flatMap((r) => (r.reference !== null && ids.has(r.reference) ? [r.reference] : [])));
 }
 // "YYYY-MM" ⇄ a month index (year*12 + monthOfYear), so window math is pure
 // integer arithmetic — no Date object (no-date-api guard) and no DST/timezone

package/dist/managed-pages/branding.d.ts

@@ -8,6 +8,7 @@ export declare const BRANDING_KEYS: {
     brandingSiteUrl: ConfigKeyDefinition<"text">;
     brandingAccentColor: ConfigKeyDefinition<"text">;
     brandingLogoUrl: ConfigKeyDefinition<"text">;
+    brandingLogoFile: ConfigKeyDefinition<"text">;
     brandingLayoutPreset: ConfigKeyDefinition<"select">;
 };
 export declare const CUSTOM_CSS_KEY: {
@@ -19,6 +20,7 @@ export declare const BRANDING_QN: {
     readonly siteUrl: "managed-pages:config:branding-site-url";
     readonly accentColor: "managed-pages:config:branding-accent-color";
     readonly logoUrl: "managed-pages:config:branding-logo-url";
+    readonly logoFile: "managed-pages:config:branding-logo-file";
     readonly layoutPreset: "managed-pages:config:branding-layout-preset";
     readonly customCss: "managed-pages:config:branding-custom-css";
 };

package/dist/managed-pages/branding.js

@@ -42,6 +42,10 @@ const DESCRIPTION_PATTERN = { regex: "^[\\s\\S]{0,500}$" };
 // render (page-render/css-sanitize.ts). Keep this cap in sync with MAX_CSS_LENGTH
 // there.
 const CUSTOM_CSS_PATTERN = { regex: "^[\\s\\S]{0,8000}$" };
+// Empty or a FileRef id (UUID); the upload UI that fills it ships separately.
+const FILE_REF_ID_PATTERN = {
+    regex: "^$|^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+};
 export const LAYOUT_PRESETS = ["minimal", "centered", "wide"];
 // Companion toggle feature name. managed-pages reads ctx.hasFeature() against it
 // in the branding query to per-tenant-gate custom-CSS emission. Declared as a
@@ -80,6 +84,12 @@ export const BRANDING_KEYS = {
         pattern: HTTPS_PATTERN,
         write: BRANDING_WRITE,
     }),
+    // Ownership is checked where it is read (renderer-mail-html: FileRef must belong to the rendering tenant).
+    brandingLogoFile: createTenantConfig("text", {
+        default: "",
+        pattern: FILE_REF_ID_PATTERN,
+        write: BRANDING_WRITE,
+    }),
     brandingLayoutPreset: createTenantConfig("select", {
         default: "centered",
         options: LAYOUT_PRESETS,
@@ -99,6 +109,7 @@ export const BRANDING_QN = {
     siteUrl: "managed-pages:config:branding-site-url",
     accentColor: "managed-pages:config:branding-accent-color",
     logoUrl: "managed-pages:config:branding-logo-url",
+    logoFile: "managed-pages:config:branding-logo-file",
     layoutPreset: "managed-pages:config:branding-layout-preset",
     customCss: "managed-pages:config:branding-custom-css",
 };
@@ -114,17 +125,27 @@ async function readText(config, qualifiedKey) {
 export async function readBranding(config) {
     if (!config)
         return EMPTY_BRANDING;
-    const [title, description, siteUrl, accentColor, logoUrl, layoutPreset] = await Promise.all([
+    const [title, description, siteUrl, accentColor, logoUrl, logoFile, layoutPreset] = await Promise.all([
         readText(config, BRANDING_QN.title),
         readText(config, BRANDING_QN.description),
         readText(config, BRANDING_QN.siteUrl),
         readText(config, BRANDING_QN.accentColor),
         readText(config, BRANDING_QN.logoUrl),
+        readText(config, BRANDING_QN.logoFile),
         readText(config, BRANDING_QN.layoutPreset),
     ]);
     // customCss stays "" here — it is gated (allowCustomCss + per-tenant toggle)
     // and read separately by the branding query via readCustomCss.
-    return { title, description, siteUrl, accentColor, logoUrl, layoutPreset, customCss: "" };
+    return {
+        title,
+        description,
+        siteUrl,
+        accentColor,
+        logoUrl,
+        logoFile,
+        layoutPreset,
+        customCss: "",
+    };
 }
 // Read the raw, untrusted custom CSS for the request's tenant. The caller (the
 // branding query) only invokes this once the gate has passed; the value is
@@ -150,6 +171,7 @@ export function coerceBranding(value) {
         siteUrl: stringField(source, "siteUrl"),
         accentColor: stringField(source, "accentColor"),
         logoUrl: stringField(source, "logoUrl"),
+        logoFile: stringField(source, "logoFile"),
         layoutPreset: stringField(source, "layoutPreset"),
         customCss: stringField(source, "customCss"),
     };

package/dist/managed-pages/feature.js

@@ -26,6 +26,7 @@ function brandingRevisionSeed(branding) {
         branding.siteUrl,
         branding.accentColor,
         branding.logoUrl,
+        branding.logoFile,
         branding.layoutPreset,
         branding.customCss,
     ]);

package/dist/managed-pages/handlers/set.write.d.ts

@@ -12,4 +12,4 @@ export declare const setWrite: import("@cosmicdrift/kumiko-types/define-handler"
     slug: string;
     lang: string;
     isNew: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/managed-pages/i18n.js

@@ -37,6 +37,7 @@ export const MANAGED_PAGES_I18N = {
         en: "Accent color",
     },
     "managed-pages:entity:__config-edit__:field:logoUrl": { en: "Logo URL" },
+    "managed-pages:entity:__config-edit__:field:logoFile": { en: "Logo file" },
     "managed-pages:entity:__config-edit__:field:layoutPreset": { en: "Layout" },
     // Section-Header
     "managed-pages:section.meta": { en: "Metadata" },

package/dist/managed-pages/screens/branding-screen.js

@@ -1,4 +1,4 @@
-import { createSelectField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
+import { createImageField, createSelectField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
 import { BRANDING_QN, LAYOUT_PRESETS } from "../branding.js";
 // Tenant self-service branding editor. A `configEdit` screen (no entity
 // table) — the renderer loads config:query:values, maps the form fields via
@@ -27,6 +27,7 @@ export function createBrandingSettingsScreen(opts) {
             siteUrl: BRANDING_QN.siteUrl,
             accentColor: BRANDING_QN.accentColor,
             logoUrl: BRANDING_QN.logoUrl,
+            logoFile: BRANDING_QN.logoFile,
             layoutPreset: BRANDING_QN.layoutPreset,
         },
         fields: {
@@ -54,6 +55,11 @@ export function createBrandingSettingsScreen(opts) {
                 personal: false,
                 reason: "is_business_data",
             }),
+            logoFile: createImageField({
+                accept: ["image/png", "image/jpeg", "image/webp"],
+                personal: false,
+                reason: "is_business_data",
+            }),
             layoutPreset: createSelectField({ options: LAYOUT_PRESETS }),
         },
         layout: {
@@ -67,6 +73,7 @@ export function createBrandingSettingsScreen(opts) {
                         { field: "description", span: 2 },
                         { field: "siteUrl", span: 1 },
                         { field: "logoUrl", span: 1 },
+                        { field: "logoFile", span: 1 },
                         { field: "accentColor", span: 1 },
                     ],
                 },

package/dist/page-render/branding.d.ts

@@ -4,6 +4,7 @@ export type BrandingTokens = {
     readonly siteUrl: string;
     readonly accentColor: string;
     readonly logoUrl: string;
+    readonly logoFile: string;
     readonly layoutPreset: string;
     readonly customCss: string;
 };

package/dist/page-render/branding.js

@@ -5,6 +5,7 @@ export const EMPTY_BRANDING = {
     siteUrl: "",
     accentColor: "",
     logoUrl: "",
+    logoFile: "",
     layoutPreset: "",
     customCss: "",
 };

package/dist/page-render/markdown.js

@@ -23,7 +23,7 @@ safeRenderer.use({
     },
 });
 export function renderSafeMarkdown(markdown) {
-    // @cast-boundary marked.parse return-type ist `string | Promise<string>`;
+    // @cast-boundary third-party-type-gap marked.parse return-type ist `string | Promise<string>`;
     // `{ async: false }` garantiert sync (string) — Cast nur API-Vertragsfix.
     return safeRenderer.parse(markdown, { async: false });
 }

package/dist/personal-access-tokens/feature.js

@@ -27,7 +27,7 @@ export function bindPatAutoRevokeOnPasswordChangeFromFeature(feature) {
     if (exports && typeof exports === "object" && "bindAutoRevokeOnPasswordChange" in exports) {
         const { bindAutoRevokeOnPasswordChange } = exports;
         if (typeof bindAutoRevokeOnPasswordChange === "function") {
-            // @cast-boundary exports-walk — feature.exports is untyped by design
+            // @cast-boundary feature-exports — feature.exports is untyped by design
             return bindAutoRevokeOnPasswordChange;
         }
     }

package/dist/personal-access-tokens/handlers/create.write.d.ts

@@ -17,4 +17,4 @@ export declare function createPatCreateHandler(opts?: CreatePatOptions): import(
     id: string;
     token: string;
     prefix: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/personal-access-tokens/handlers/list.query.js

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
 import { isExpiredAt } from "../expiry.js";
@@ -10,7 +11,7 @@ import { apiTokenTable } from "../schema/api-token.js";
 // client sorting by tokenHash or any other non-exposed column.
 const SORTABLE_COLUMNS = ["id", "name", "createdAt", "expiresAt", "revokedAt"];
 function isSortableColumn(value) {
-    return SORTABLE_COLUMNS.includes(value);
+    return isOneOf(SORTABLE_COLUMNS, value);
 }
 function tokenStatus(row) {
     if (row.revokedAt !== null)

package/dist/personal-access-tokens/handlers/revoke.write.d.ts

@@ -3,4 +3,4 @@ export declare const revokePatWrite: import("@cosmicdrift/kumiko-types/define-ha
     id: z.ZodUUID;
 }, z.core.$strip>, {
     id: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/personal-access-tokens/revoke-for-user.js

@@ -3,11 +3,12 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN, patRevokedSchema, } from "./pat-revoked-event.js";
 import { apiTokenTable } from "./schema/api-token.js";
 // A pool has begin(); a tx/savepoint handle does not and is already atomic.
 function canBeginTransaction(db) {
-    return typeof db.begin === "function"; // @cast-boundary driver-handle-probe
+    return typeof propertyOf(db, "begin") === "function";
 }
 // Cross-tenant revoke: password-change and MFA-enable/disable are account-
 // level security events, not scoped to one tenant. Mirrors sessions'

package/dist/renderer-foundation/api.d.ts

@@ -3,21 +3,21 @@ import { type RenderKind } from "./constants.js";
 import { type RendererPlugin } from "./types.js";
 export type RendererFoundationApi = {
     /**
-     * Wählt + returnt ein RendererPlugin für (tenantId × kind). Caller
-     * rufen anschließend `plugin.render(req, ctx)`.
+     * Selects + returns a RendererPlugin for (tenantId × kind). Callers
+     * then invoke `plugin.render(req, ctx)`.
      *
-     * **Auswahl-Reihenfolge:**
-     *   1. Tenant-spezifische Config (config-Bundle: `rendererPluginByKind`)
-     *   2. DEFAULT_PLUGIN_BY_KIND aus constants
-     *   3. Erstes Plugin im Pool das das kind bedient
-     *   4. `RendererError("no_plugin_for_kind")` wenn nichts passt
+     * **Selection order:**
+     *   1. Tenant-specific config (config bundle: `rendererPluginByKind`)
+     *   2. DEFAULT_PLUGIN_BY_KIND from constants
+     *   3. First plugin in the pool that serves the kind
+     *   4. `RendererError("no_plugin_for_kind")` if nothing matches
      *
-     * **Caller-Pattern:** `tenantId` MUSS vom Server kommen (typisch
-     * `ctx.user.tenantId`). Plugins, die Service-Access brauchen (z.B.
-     * `renderer-mail-html` für Layout-Resolve via `template-resolver`),
-     * erhalten `RendererContext` als zweites Argument zu `render()` —
-     * matcht das Pattern von `DeliveryChannel.send(addr, msg, ctx)`.
-     * Plugins ohne Service-Deps (z.B. `renderer-simple`) ignorieren ctx.
+     * **Caller pattern:** `tenantId` MUST come from the server (typically
+     * `ctx.user.tenantId`). Plugins that need service access (e.g.
+     * `@cosmicdrift/kumiko-renderer-mail-html` for layout resolution via `template-resolver`)
+     * receive `RendererContext` as the second argument to `render()` —
+     * matches the pattern of `DeliveryChannel.send(addr, msg, ctx)`.
+     * Plugins without service deps ignore ctx.
      */
     readonly createRendererForTenant: (args: {
         readonly tenantId: TenantId;

package/dist/renderer-foundation/api.js

@@ -34,7 +34,7 @@ export function createRendererFoundationApi(plugins, tenantConfigLookup = () =>
             if (first)
                 return first;
             // 4. Kein Plugin → Error
-            throw new RendererError(`[renderer-foundation] no plugin registered for kind="${kind}". Mount at least one plugin (renderer-simple, renderer-mail-html, renderer-puppeteer-client) for this kind.`, "no_plugin_for_kind");
+            throw new RendererError(`[renderer-foundation] no plugin registered for kind="${kind}". Mount at least one plugin (renderer-mail-html, renderer-puppeteer-client) for this kind.`, "no_plugin_for_kind");
         },
     };
 }

package/dist/renderer-foundation/constants.js

@@ -1,12 +1,10 @@
-// Extension-point name for renderer plugins (renderer-simple,
-// renderer-mail-html, renderer-puppeteer-client, ...).
+// Extension-point name for renderer plugins (@cosmicdrift/kumiko-renderer-mail-html, @cosmicdrift/kumiko-renderer-puppeteer-client, ...).
 export const RENDERER_EXTENSION = "renderer";
 export { CONTENT_FORMATS, RENDER_KINDS, } from "../template-resolver/index.js";
 // Standard-Default-Plugin pro Kind, wenn Tenant keine explizite Config
 // gesetzt hat. App-Bootstrap kann das via TenantConfigKey überschreiben.
 export const DEFAULT_PLUGIN_BY_KIND = {
-    notification: "simple",
-    "mail-html": "mail-html",
+    mail: "mail-html",
     "document-pdf": "puppeteer",
     "image-snapshot": "puppeteer",
 };

package/dist/renderer-foundation/feature.js

@@ -1,17 +1,17 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { RENDERER_EXTENSION } from "./constants.js";
 import { isRendererRegistrationPlugin } from "./types.js";
-// renderer-foundation — Plugin-Foundation für Renderer (Notification,
-// HTML-Mail, PDF, Image). Plan-Doc:
+// renderer-foundation — plugin foundation for renderers (HTML mail, PDF,
+// image). Plan doc:
 // kumiko-platform/docs/plans/features/renderer-foundation.md
 //
-// Pattern symmetrisch zu ai-foundation: Foundation definiert den
-// Extension-Point `renderer`, Plugins (renderer-simple, renderer-mail-html,
-// renderer-puppeteer-client) registrieren sich via `r.useExtension`.
-// Konsumenten holen sich Plugin runtime via createRendererForTenant.
+// Pattern symmetric to ai-foundation: the foundation defines the
+// extension point `renderer`, plugins (@cosmicdrift/kumiko-renderer-mail-html,
+// @cosmicdrift/kumiko-renderer-puppeteer-client) register via `r.useExtension`.
+// Consumers get a plugin at runtime via createRendererForTenant.
 export function createRendererFoundationFeature() {
     return defineFeature("renderer-foundation", (r) => {
-        r.describe('Plugin registry for content rendering (notification HTML, mail HTML, PDF, images): call `foundation.createRendererForTenant({ tenantId, kind })` at render time to get the right renderer plugin selected by kind, with tenant-level overrides via the `rendererPluginByKind` config key. Requires `template-resolver` (declared via `r.requires`). Low-level building block \u2014 add `renderer-simple` (or write a custom plugin via `r.useExtension("renderer", name, { kinds, render })`) rather than using this feature alone.');
+        r.describe('Plugin registry for content rendering (mail HTML, PDF, images): call `foundation.createRendererForTenant({ tenantId, kind })` at render time to get the right renderer plugin selected by kind, with tenant-level overrides via the `rendererPluginByKind` config key. Requires `template-resolver` (declared via `r.requires`). Low-level building block \u2014 add `renderer-mail-html` (or write a custom plugin via `r.useExtension("renderer", name, { kinds, render })`) rather than using this feature alone.');
         r.uiHints({
             displayLabel: "Renderer Foundation",
             category: "notifications",

package/dist/renderer-foundation/index.d.ts

@@ -1,4 +1,5 @@
+export { attachmentFileNameSchema } from "../shared/index.js";
 export { createRendererFoundationApi, type RendererFoundationApi, requireRendererFoundation, } from "./api.js";
 export { CONTENT_FORMATS, type ContentFormat, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, type RenderKind, } from "./constants.js";
 export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.js";
-export { type DocumentPayload, type ImageOptions, isRendererRegistrationPlugin, type MailHtmlPayload, type NotificationPayload, type PdfOptions, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderRequest, type RenderResponse, } from "./types.js";
+export { type DocumentPayload, type DocumentPdfDraft, type DocumentPdfPayload, type DocumentPreview, type DocumentPreviewRequest, type FileAttachmentRef, type ImageOptions, type InlineAttachmentRef, isRendererRegistrationPlugin, type MailAttachmentRef, type MailDraft, type MailPayload, type PdfOptions, type RenderedPdfAttachmentRef, type RenderedTemplateRef, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderProvenance, type RenderRequest, type RenderResponse, } from "./types.js";

package/dist/renderer-foundation/index.js

@@ -1,3 +1,4 @@
+export { attachmentFileNameSchema } from "../shared/index.js";
 export { createRendererFoundationApi, requireRendererFoundation, } from "./api.js";
 export { CONTENT_FORMATS, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, } from "./constants.js";
 export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.js";