@cosmicdrift/kumiko-bundled-features 0.367.0 → 0.369.0

package/dist/inbound-mail-foundation/oauth-access-token.js

@@ -15,8 +15,7 @@
 // The refresh token is re-read inside the lock via `secrets.get` without an
 // audit context. SecretsContext does not cache values (only unwrapped DEKs),
 // so the read always reflects the latest committed write.
-import { transaction } from "@cosmicdrift/kumiko-framework/bun-db";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, transaction, } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { InboundMailAuthMethods, inboundCredentialSecretKey } from "./constants.js";
 import { InboundAuthError, } from "./types.js";

package/dist/inbound-mail-foundation/projection.js

@@ -16,8 +16,7 @@
 // kommen bereits als Ciphertext an — encrypted VOR dem append im
 // write-handler. Die applies kopieren nur durch; decrypted wird erst
 // in den list-queries.
-import { insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { buildEntityTable, insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/db";
 import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
 import { inboundMessageEntity, mailAccountEntity, mailThreadEntity } from "./entities.js";
 // Drizzle-table-instances aus den entity-shapes — geteilt zwischen

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -43,8 +43,8 @@
 // as the watcher state lives, including across reconnect backoff, not
 // only while the connection is open. Losing the claim (Redis outage, TTL
 // exceeded) tears down the local watcher instead of racing a new holder.
-import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { fetchOne, insertOne, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";

package/dist/inbound-provider-imap/feature.d.ts

@@ -4,6 +4,10 @@ export { setImapMailHostLookup } from "./imap-client.js";
 /** Exportiert für den Live-Test (imap-live.integration.test.ts) —
  *  Apps nutzen das Feature, nie das Plugin direkt. */
 export declare const imapInboundMailPlugin: InboundMailProviderPlugin;
+export declare function createInboundProviderImapFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createInboundProviderImapFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const inboundProviderImapFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/inbound-provider-imap/feature.js

@@ -217,15 +217,19 @@ export const imapInboundMailPlugin = {
     // Formular (connect-account + Secret-Write); XOAUTH2-Token-Flows
     // gehören den OAuth-Providern (M365/Gmail).
 };
-export const inboundProviderImapFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Store the per-account connection JSON (host/port/secure/user/password) in the account credential secret slot before the first sync.');
-    r.uiHints({
-        displayLabel: "Inbound Mail · IMAP",
-        category: "notifications",
-        recommended: false,
-    });
-    r.requires({ features: ["inbound-mail-foundation"] });
-    r.requires({ features: ["secrets"] });
-    r.envSchema(mailAllowedPrivateHostsEnvSchema);
-    r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
-});
+export function createInboundProviderImapFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Store the per-account connection JSON (host/port/secure/user/password) in the account credential secret slot before the first sync.');
+        r.uiHints({
+            displayLabel: "Inbound Mail · IMAP",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires({ features: ["inbound-mail-foundation"] });
+        r.requires({ features: ["secrets"] });
+        r.envSchema(mailAllowedPrivateHostsEnvSchema);
+        r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createInboundProviderImapFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const inboundProviderImapFeature = createInboundProviderImapFeature();

package/dist/inbound-provider-imap/index.d.ts

@@ -1,3 +1,3 @@
 export { type ImapCredentialDocument, imapCredentialDocumentSchema, type ParseCredentialResult, parseImapCredentialDocument, } from "./credential-document.js";
-export { IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup } from "./feature.js";
+export { createInboundProviderImapFeature, IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup, } from "./feature.js";
 export { assertUidValidity, buildProviderMessageId, type ImapCursor, mapImapError, normalizeReferences, parseImapCursor, } from "./imap-client.js";

package/dist/inbound-provider-imap/index.js

@@ -1,4 +1,4 @@
 // Public API of the inbound-provider-imap bundled-feature.
 export { imapCredentialDocumentSchema, parseImapCredentialDocument, } from "./credential-document.js";
-export { IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup } from "./feature.js";
+export { createInboundProviderImapFeature, IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup, } from "./feature.js";
 export { assertUidValidity, buildProviderMessageId, mapImapError, normalizeReferences, parseImapCursor, } from "./imap-client.js";

package/dist/inbound-provider-inmemory/feature.d.ts

@@ -18,6 +18,10 @@ export declare function isWatching(accountId: string): boolean;
  *  nie zwischen Tests teilen). */
 export declare function resetInboundInMemory(): void;
 export declare const inMemoryInboundMailPlugin: InboundMailProviderPlugin;
+export declare function createInboundProviderInMemoryFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createInboundProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const inboundProviderInMemoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/inbound-provider-inmemory/feature.js

@@ -103,13 +103,17 @@ export const inMemoryInboundMailPlugin = {
 // =============================================================================
 // Feature-definition
 // =============================================================================
-export const inboundProviderInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers a scriptable in-process `"inmemory"` provider for `inbound-mail-foundation`. Seed messages with `seedInboundMessage(accountId, msg)` — an active watch pushes them immediately (IDLE simulation) and the cursor-based `fetch` re-delivers them on the reconciliation path, exercising the foundation dedup guarantee. Error injection via `failNextFetchWith`/`failNextVerifyWith`/`emitWatchError`; reset state with `resetInboundInMemory()`. For tests, demos and sample apps — not for production.');
-    r.uiHints({
-        displayLabel: "Inbound Mail · In-Memory Provider",
-        category: "notifications",
-        recommended: false,
-    });
-    r.requires({ features: ["inbound-mail-foundation"] });
-    r.useExtension("inboundMailProvider", INMEMORY_PROVIDER_KEY, inMemoryInboundMailPlugin);
-});
+export function createInboundProviderInMemoryFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers a scriptable in-process `"inmemory"` provider for `inbound-mail-foundation`. Seed messages with `seedInboundMessage(accountId, msg)` — an active watch pushes them immediately (IDLE simulation) and the cursor-based `fetch` re-delivers them on the reconciliation path, exercising the foundation dedup guarantee. Error injection via `failNextFetchWith`/`failNextVerifyWith`/`emitWatchError`; reset state with `resetInboundInMemory()`. For tests, demos and sample apps — not for production.');
+        r.uiHints({
+            displayLabel: "Inbound Mail · In-Memory Provider",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires({ features: ["inbound-mail-foundation"] });
+        r.useExtension("inboundMailProvider", INMEMORY_PROVIDER_KEY, inMemoryInboundMailPlugin);
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createInboundProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const inboundProviderInMemoryFeature = createInboundProviderInMemoryFeature();

package/dist/inbound-provider-inmemory/index.d.ts

@@ -1 +1 @@
-export { emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, inboundProviderInMemoryFeature, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";
+export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, inboundProviderInMemoryFeature, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";

package/dist/inbound-provider-inmemory/index.js

@@ -1,2 +1,2 @@
 // Public API of the inbound-provider-inmemory bundled-feature.
-export { emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, inboundProviderInMemoryFeature, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";
+export { createInboundProviderInMemoryFeature, emitWatchError, failNextFetchWith, failNextVerifyWith, INMEMORY_PROVIDER_KEY, inboundProviderInMemoryFeature, isWatching, resetInboundInMemory, seedInboundMessage, } from "./feature.js";

package/dist/jobs/db/queries/retention.js

@@ -9,7 +9,7 @@
 //
 // deleteManyBatched (typed query API, no raw SQL in this file) chunks each
 // delete so a large backlog doesn't hold one lock for the whole sweep.
-import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/db";
 import { jobRunLogsTable, jobRunsTable } from "../../job-run-table.js";
 import { tenantJobFailuresTable } from "../../tenant-job-failure-table.js";
 import { tenantJobRunsTable } from "../../tenant-job-run-table.js";

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -11,7 +11,7 @@
 // schema/migration change, no web filter-dropdown/status-enum update, and
 // the run becomes retriable via the existing jobs:write:retry gate
 // (retry.write.ts only allows retry from "failed").
-import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { mapWithConcurrency } from "../../../shared/index.js";
 import { DEFAULT_JOB_RUN_RETENTION_DAYS } from "../../handlers/retention-cleanup.job.js";
 import { encryptFailureError } from "../../job-run-logger.js";

package/dist/jobs/handlers/detail.query.js

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/jobs/handlers/list.query.js

@@ -1,5 +1,4 @@
-import { countWhere, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
+import { countWhere, decodeCursor, encodeCursor, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/dist/jobs/handlers/retry.write.js

@@ -1,5 +1,5 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { isPiiCiphertext, PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";

package/dist/jobs/handlers/tenant-failures.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";

package/dist/jobs/handlers/tenant-runs.query.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";

package/dist/jobs/job-run-logger.js

@@ -1,6 +1,5 @@
-import { deleteMany, fetchOne, insertMany, insertOnConflictDoNothing, insertOne, transaction, updateMany, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, KeyErasedError, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, deleteMany, fetchOne, insertMany, insertOnConflictDoNothing, insertOne, transaction, updateMany, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";

package/dist/jobs/tenant-job-failure-table.js

@@ -1,5 +1,4 @@
-import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
-import { index, instant, table as pgTable, serial, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
+import { index, instant, table as pgTable, requireEntityTableMeta, serial, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
 // The tenant's own view of a failed job (fw#3079). Direct-write store like
 // store_job_runs: job-run-logger.ts writes it from the BullMQ callbacks,
 // outside any dispatcher transaction.

package/dist/jobs/tenant-job-run-table.js

@@ -1,5 +1,4 @@
-import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
-import { index, instant, table as pgTable, serial, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
+import { index, instant, table as pgTable, requireEntityTableMeta, serial, sql, text, uniqueIndex, uuid, } from "@cosmicdrift/kumiko-framework/db";
 // The tenant's own view of a job's run state (fw#3616). Direct-write store
 // like store_job_runs, written by job-run-logger.ts from the runner callbacks.
 //

package/dist/ledger/feature.d.ts

@@ -2,7 +2,7 @@ import { type AccessRule } from "@cosmicdrift/kumiko-framework/engine";
 type LedgerToggleable = {
     readonly default: boolean;
 };
-export declare const ledgerFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+declare const defaultLedgerFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
 export type LedgerFeatureOptions = {
@@ -15,5 +15,9 @@ export type LedgerFeatureOptions = {
      *  for fail-closed gating. Omit to keep the ledger always-on (default). */
     readonly toggleable?: LedgerToggleable;
 };
-export declare function createLedgerFeature(opts?: LedgerFeatureOptions): typeof ledgerFeature;
+export declare function createLedgerFeature(opts?: LedgerFeatureOptions): typeof defaultLedgerFeature;
+/** @deprecated Use createLedgerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export declare const ledgerFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
 export {};

package/dist/ledger/feature.js

@@ -90,7 +90,7 @@ function registerLedger(r, access, toggleable) {
     r.queryHandler(createIncomeStatementHandler(access));
     r.queryHandler(createBalanceSheetHandler(access));
 }
-export const ledgerFeature = defineFeature(LEDGER_FEATURE_NAME, (r) => registerLedger(r, DEFAULT_LEDGER_ACCESS, undefined));
+const defaultLedgerFeature = defineFeature(LEDGER_FEATURE_NAME, (r) => registerLedger(r, DEFAULT_LEDGER_ACCESS, undefined));
 function resolveAccess(opts) {
     if (opts.access !== undefined)
         return opts.access;
@@ -102,8 +102,10 @@ function resolveAccess(opts) {
 // rebuild). access/roles/toggleable build a fresh feature-definition.
 export function createLedgerFeature(opts = {}) {
     if (opts.access === undefined && opts.roles === undefined && opts.toggleable === undefined) {
-        return ledgerFeature;
+        return defaultLedgerFeature;
     }
     const access = resolveAccess(opts);
     return defineFeature(LEDGER_FEATURE_NAME, (r) => registerLedger(r, access, opts.toggleable));
 }
+/** @deprecated Use createLedgerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const ledgerFeature = createLedgerFeature();

package/dist/mail-foundation/feature.d.ts

@@ -46,6 +46,10 @@ export type MailTransportContext = {
  */
 export type MailTransportPlugin = {
     readonly build: (ctx: MailTransportContext, tenantId: string) => Promise<EmailTransport>;
+    /** `false` keeps the provider out of the generated settings: it can still be set by a
+     *  seed or config write, but a tenant admin is never offered it (e.g. a test inbox
+     *  that swallows every mail). */
+    readonly selectableInSettings?: false;
 };
 export declare function isMailTransportPlugin(o: unknown): o is MailTransportPlugin;
 declare module "@cosmicdrift/kumiko-framework/engine" {
@@ -53,6 +57,13 @@ declare module "@cosmicdrift/kumiko-framework/engine" {
         [MAIL_TRANSPORT_EXTENSION]: MailTransportPlugin;
     }
 }
+export declare function createMailFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: {
+        /** Config-key-handle for the provider-selector. */
+        providerConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+    };
+};
+/** @deprecated Use createMailFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const mailFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {
         /** Config-key-handle for the provider-selector. */

package/dist/mail-foundation/feature.js

@@ -33,6 +33,7 @@
 import { withPiiCiphertextGuard, } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { requireDefined } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { access, createSystemUser, createTenantConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { MAIL_FOUNDATION_I18N } from "./i18n.js";
 const FEATURE_NAME = "mail-foundation";
 // Extension-point name for transport-provider plugins (mail-transport-smtp,
 // mail-transport-brevo-api, ...).
@@ -45,47 +46,56 @@ export function isMailTransportPlugin(o) {
 // =============================================================================
 // Feature-definition
 // =============================================================================
-export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe("Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature` so a tenant with a provider configured sends delivery mails through its own transport and other tenants through the app transport.");
-    r.uiHints({
-        displayLabel: "Mail Transport Foundation",
-        category: "notifications",
-        recommended: false,
-    });
-    r.requires({ features: ["config"] });
-    // Plugin extension-point. Provider-features register here. The
-    // entityName at registration time becomes the value tenants pick in
-    // `provider` config-key (e.g. "smtp", "brevo-api").
-    r.extendsRegistrar(MAIL_TRANSPORT_EXTENSION, {
-        onRegister: () => {
-            // No side-effects at register-time — the registry stores the
-            // usage, factory looks it up at request-time. Same shape as
-            // delivery's extendsRegistrar.
-        },
-    });
-    // Provider-selector. Default empty so the boot-validator throws if a
-    // tenant tries to send mail without first picking + setting up a
-    // provider — better than a silent fallback. The actual list of valid
-    // values lives in the registered plugins, not here — Designer-UI can
-    // render `getExtensionUsages("mailTransport").map(u => u.entityName)`
-    // as the option-list.
-    const providerConfigKey = r.config("provider", createTenantConfig("text", {
-        default: "",
-        // required: ohne gewählten Provider wirft createTransportForTenant —
-        // readiness meldete vorher ready:true und der erste Mail-Send
-        // lieferte den UnconfiguredError (280/1).
-        required: true,
-        write: access.roles("TenantAdmin", "SystemAdmin"),
-        read: access.roles("TenantAdmin", "SystemAdmin", "User"),
-    }));
-    // Readiness gating: transport-plugins' required keys/secrets count only
-    // while their plugin is the one this key selects.
-    r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
-    return {
-        /** Config-key-handle for the provider-selector. */
-        providerConfigKey,
-    };
-});
+export function createMailFoundationFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe("Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature`: notifications declared with `tenantTransport: true` then go through the tenant's own transport when it has a provider and through the app transport otherwise. Tenant admins pick the provider and fill in its settings on the generated Email sending settings screen; an empty provider is a valid choice and means the platform sends.");
+        r.uiHints({
+            displayLabel: "Mail Transport Foundation",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires({ features: ["config"] });
+        // Plugin extension-point. Provider-features register here. The
+        // entityName at registration time becomes the value tenants pick in
+        // `provider` config-key (e.g. "smtp", "brevo-api").
+        r.extendsRegistrar(MAIL_TRANSPORT_EXTENSION, {
+            onRegister: () => {
+                // No side-effects at register-time — the registry stores the
+                // usage, factory looks it up at request-time. Same shape as
+                // delivery's extendsRegistrar.
+            },
+        });
+        // Empty = this tenant has no own provider: tenantMailTransport yields null and
+        // channel-email uses the app transport, so empty is a valid choice a tenant can
+        // return to (reset in the settings mask) and readiness must not flag it.
+        // createTransportForTenant still throws on empty.
+        const providerConfigKey = r.config("provider", createTenantConfig("text", {
+            default: "",
+            // No SystemAdmin: a platform-level provider would be inherited by every tenant,
+            // whose own credentials (tenant secrets) are missing, and break all their mail.
+            write: access.withSystem(access.roles("TenantAdmin")),
+            read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+            mask: {
+                title: "mail-foundation.provider",
+                description: "mail-foundation.provider.description",
+                icon: "mail",
+                order: 1,
+            },
+        }));
+        // Readiness gating: transport-plugins' required keys/secrets count only
+        // while their plugin is the one this key selects.
+        r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
+        r.translations({ keys: MAIL_FOUNDATION_I18N });
+        return {
+            /** Config-key-handle for the provider-selector. */
+            providerConfigKey,
+        };
+    }, { dedupeOptions: {} });
+}
+// The typed handles below come from one shared instance; each factory call builds its own handle objects.
+const sharedMailFoundationFeature = createMailFoundationFeature();
+/** @deprecated Use createMailFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const mailFoundationFeature = sharedMailFoundationFeature;
 // =============================================================================
 // Transport-factory — looks up the registered plugin + delegates
 // =============================================================================
@@ -121,7 +131,7 @@ export async function createTransportForTenantIfConfigured(ctx, tenantId, handle
     if (!ctx.registry) {
         throw new Error(`${handlerName}: ctx.registry is missing — required to look up registered mail-transport plugins`);
     }
-    const provider = requireDefined(await ctxConfig(mailFoundationFeature.exports.providerConfigKey), FEATURE_NAME, "provider"); // @cast-boundary engine-payload
+    const provider = requireDefined(await ctxConfig(sharedMailFoundationFeature.exports.providerConfigKey), FEATURE_NAME, "provider"); // @cast-boundary engine-payload
     if (provider.length === 0)
         return null;
     const usages = ctx.registry.getExtensionUsages(MAIL_TRANSPORT_EXTENSION);

package/dist/mail-foundation/i18n.d.ts

@@ -0,0 +1,14 @@
+export declare const MAIL_FOUNDATION_I18N: {
+    readonly "screen:mail-foundation-tenant.title": {
+        readonly en: "Email sending";
+    };
+    readonly "mail-foundation.settings": {
+        readonly en: "Email sending";
+    };
+    readonly "mail-foundation.provider": {
+        readonly en: "Own mail server";
+    };
+    readonly "mail-foundation.provider.description": {
+        readonly en: "Without one, the platform sends the mails. Reset the choice to go back to that.";
+    };
+};

package/dist/mail-foundation/i18n.js

@@ -0,0 +1,8 @@
+export const MAIL_FOUNDATION_I18N = {
+    "screen:mail-foundation-tenant.title": { en: "Email sending" },
+    "mail-foundation.settings": { en: "Email sending" },
+    "mail-foundation.provider": { en: "Own mail server" },
+    "mail-foundation.provider.description": {
+        en: "Without one, the platform sends the mails. Reset the choice to go back to that.",
+    },
+};

package/dist/mail-foundation/index.d.ts

@@ -1 +1 @@
-export { createTransportForTenant, createTransportForTenantIfConfigured, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, type MailTransportContext, type MailTransportPlugin, mailFoundationFeature, type TenantMailTransportScope, tenantMailTransport, } from "./feature.js";
+export { createMailFoundationFeature, createTransportForTenant, createTransportForTenantIfConfigured, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, type MailTransportContext, type MailTransportPlugin, mailFoundationFeature, type TenantMailTransportScope, tenantMailTransport, } from "./feature.js";

package/dist/mail-foundation/index.js

@@ -6,4 +6,4 @@
 //     up the registered transport-plugin, returns its EmailTransport
 //   - `MailTransportPlugin` — type that provider-features implement
 //     when registering via `r.useExtension("mailTransport", ...)`
-export { createTransportForTenant, createTransportForTenantIfConfigured, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, mailFoundationFeature, tenantMailTransport, } from "./feature.js";
+export { createMailFoundationFeature, createTransportForTenant, createTransportForTenantIfConfigured, isMailTransportPlugin, MAIL_TRANSPORT_EXTENSION, mailFoundationFeature, tenantMailTransport, } from "./feature.js";

package/dist/mail-transport-inmemory/feature.d.ts

@@ -9,6 +9,10 @@ export declare function getInbox(tenantId: string): readonly EmailMessage[];
  * Szenarien).
  */
 export declare function clearInbox(tenantId: string): void;
+export declare function createMailTransportInMemoryFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+    readonly exports: void;
+};
+/** @deprecated Use createMailTransportInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
 export declare const mailTransportInMemoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };

package/dist/mail-transport-inmemory/feature.js

@@ -60,19 +60,29 @@ export function clearInbox(tenantId) {
 // =============================================================================
 // Feature-definition
 // =============================================================================
-export const mailTransportInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
-    r.describe('Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).');
-    // Kein requires auf "config" oder "secrets" — der
-    // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
-    // kein Secret. Der einzige hard-require ist mail-foundation, das den
-    // extension-point "mailTransport" definiert.
-    r.requires({ features: ["mail-foundation"] });
-    const plugin = {
-        build: async (_ctx, tenantId) => {
-            // Returnt den per-tenant Buffer. Identitätsstabil zwischen calls
-            // damit die Demo-Inbox accumulated bleibt.
-            return getOrCreateTransportForTenant(tenantId);
-        }, // @wrapper-known semantic-alias
-    };
-    r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
-});
+export function createMailTransportInMemoryFeature() {
+    return defineFeature(FEATURE_NAME, (r) => {
+        r.describe('Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).');
+        // Kein requires auf "config" oder "secrets" — der
+        // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
+        // kein Secret. Der einzige hard-require ist mail-foundation, das den
+        // extension-point "mailTransport" definiert.
+        r.requires({ features: ["mail-foundation"] });
+        const plugin = {
+            // Solon and studio mount it next to smtp in production; offering it there would
+            // let a tenant admin route every mail into process memory.
+            selectableInSettings: false,
+            build: async (_ctx, tenantId) => {
+                // Returns the per-tenant buffer. Identity-stable across calls so the
+                // demo inbox keeps accumulating.
+                return getOrCreateTransportForTenant(tenantId);
+            }, // @wrapper-known semantic-alias
+        };
+        r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
+        r.translations({
+            keys: { "mail-transport-inmemory.settings": { en: "Test inbox (in memory)" } },
+        });
+    }, { dedupeOptions: {} });
+}
+/** @deprecated Use createMailTransportInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const mailTransportInMemoryFeature = createMailTransportInMemoryFeature();

package/dist/mail-transport-inmemory/index.d.ts

@@ -1 +1 @@
-export { clearInbox, getInbox, mailTransportInMemoryFeature } from "./feature.js";
+export { clearInbox, createMailTransportInMemoryFeature, getInbox, mailTransportInMemoryFeature, } from "./feature.js";

package/dist/mail-transport-inmemory/index.js

@@ -1,2 +1,2 @@
 // Public API of the mail-transport-inmemory bundled-feature.
-export { clearInbox, getInbox, mailTransportInMemoryFeature } from "./feature.js";
+export { clearInbox, createMailTransportInMemoryFeature, getInbox, mailTransportInMemoryFeature, } from "./feature.js";

package/dist/mail-transport-smtp/config-keys.d.ts

@@ -0,0 +1,7 @@
+export declare const SMTP_CONFIG_KEYS: {
+    host: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"text">;
+    port: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"number">;
+    secure: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"boolean">;
+    authUser: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"text">;
+    from: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"text">;
+};

package/dist/mail-transport-smtp/config-keys.js

@@ -0,0 +1,65 @@
+import { access, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+// No SystemAdmin write: the password is a tenant secret, so platform-level SMTP keys
+// could never form a working transport (see mail-foundation's provider key).
+const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
+const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
+// required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+export const SMTP_CONFIG_KEYS = {
+    host: createTenantConfig("text", {
+        required: true,
+        default: "",
+        write: tenantAdminWrite,
+        read: tenantAdminRead,
+        mask: {
+            title: "mail-transport-smtp.host",
+            description: "mail-transport-smtp.host.description",
+            icon: "server",
+            order: 1,
+        },
+    }),
+    port: createTenantConfig("number", {
+        default: 587,
+        bounds: { min: 1, max: 65535 },
+        write: tenantAdminWrite,
+        mask: {
+            title: "mail-transport-smtp.port",
+            description: "mail-transport-smtp.port.description",
+            icon: "hash",
+            order: 2,
+        },
+    }),
+    secure: createTenantConfig("boolean", {
+        default: false,
+        write: tenantAdminWrite,
+        mask: {
+            title: "mail-transport-smtp.secure",
+            description: "mail-transport-smtp.secure.description",
+            icon: "lock",
+            order: 3,
+        },
+    }),
+    authUser: createTenantConfig("text", {
+        required: true,
+        default: "",
+        write: tenantAdminWrite,
+        read: tenantAdminRead,
+        mask: {
+            title: "mail-transport-smtp.authUser",
+            description: "mail-transport-smtp.authUser.description",
+            icon: "user",
+            order: 4,
+        },
+    }),
+    from: createTenantConfig("text", {
+        required: true,
+        default: "",
+        write: tenantAdminWrite,
+        read: tenantAdminRead,
+        mask: {
+            title: "mail-transport-smtp.from",
+            description: "mail-transport-smtp.from.description",
+            icon: "mail",
+            order: 5,
+        },
+    }),
+};