@cosmicdrift/kumiko-bundled-features 0.368.0 → 0.370.0

package/dist/renderer-foundation/constants.d.ts

@@ -1,4 +1,4 @@
-import type { RenderKind as RenderKindLocal } from "../template-resolver/index.js";
+import type { RenderKind as RenderKindLocal } from "../template-resolver/index.ts";
 export declare const RENDERER_EXTENSION: "renderer";
-export { CONTENT_FORMATS, type ContentFormat, RENDER_KINDS, type RenderKind, } from "../template-resolver/index.js";
+export { CONTENT_FORMATS, type ContentFormat, RENDER_KINDS, type RenderKind, } from "../template-resolver/index.ts";
 export declare const DEFAULT_PLUGIN_BY_KIND: Readonly<Record<RenderKindLocal, string>>;

package/dist/renderer-foundation/feature.d.ts

@@ -1,5 +1,5 @@
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type RendererPlugin } from "./types.js";
+import { type RendererPlugin } from "./types.ts";
 export declare function createRendererFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {};
 };

package/dist/renderer-foundation/index.d.ts

@@ -1,5 +1,5 @@
-export { attachmentFileNameSchema } from "../shared/index.js";
-export { createRendererFoundationApi, type RendererFoundationApi, requireRendererFoundation, } from "./api.js";
-export { CONTENT_FORMATS, type ContentFormat, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, type RenderKind, } from "./constants.js";
-export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.js";
-export { type DocumentPayload, type DocumentPdfDraft, type DocumentPdfPayload, type DocumentPreview, type DocumentPreviewRequest, type FileAttachmentRef, type ImageOptions, type InlineAttachmentRef, isRendererRegistrationPlugin, type MailAttachmentRef, type MailDraft, type MailPayload, type PdfOptions, type RenderedPdfAttachmentRef, type RenderedTemplateRef, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderProvenance, type RenderRequest, type RenderResponse, } from "./types.js";
+export { attachmentFileNameSchema } from "../shared/index.ts";
+export { createRendererFoundationApi, type RendererFoundationApi, requireRendererFoundation, } from "./api.ts";
+export { CONTENT_FORMATS, type ContentFormat, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, type RenderKind, } from "./constants.ts";
+export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.ts";
+export { type DocumentPayload, type DocumentPdfDraft, type DocumentPdfPayload, type DocumentPreview, type DocumentPreviewRequest, type FileAttachmentRef, type ImageOptions, type InlineAttachmentRef, isRendererRegistrationPlugin, type MailAttachmentRef, type MailChrome, type MailChromeLink, type MailChromeRequest, type MailDraft, type MailPayload, type PdfOptions, type RenderedPdfAttachmentRef, type RenderedTemplateRef, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderProvenance, type RenderRequest, type RenderResponse, } from "./types.ts";

package/dist/renderer-foundation/types.d.ts

@@ -1,8 +1,8 @@
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigAccessor, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
-import type { LinkedResourceEntry, MailTemplateMeta, PdfPageFormat, PdfTemplateMeta, TemplateScope } from "../template-resolver/index.js";
-import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.js";
+import type { LinkedResourceEntry, MailTemplateMeta, PdfPageFormat, PdfTemplateMeta, TemplateScope } from "../template-resolver/index.ts";
+import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.ts";
 export type RenderRequest = {
     kind: "mail";
     payload: MailPayload;
@@ -142,12 +142,34 @@ export type RendererContext = {
     /** Only plugins that embed resource bytes (PDF) need it; without it images are dropped. */
     readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
 };
+export type MailChromeLink = {
+    readonly label: string;
+    readonly url: string;
+};
+/** The tenant's mail look with every text resolved for one locale, for pages a
+ *  recipient reaches from a mail link. URLs are http(s) only, the logo https only,
+ *  the accent color a #rrggbb hex. */
+export type MailChrome = {
+    readonly tenantName: string;
+    readonly brandSuffix: string;
+    readonly logoUrl?: string;
+    readonly accentColor?: string;
+    readonly siteUrl?: string;
+    readonly footerText?: string;
+    readonly imprint?: MailChromeLink;
+    readonly privacy?: MailChromeLink;
+};
+export type MailChromeRequest = {
+    readonly locale: string;
+};
 export type RendererPlugin = {
     readonly name: string;
     readonly kinds: ReadonlyArray<RenderKind>;
     render(req: RenderRequest, ctx: RendererContext): Promise<RenderResponse>;
     /** Optional: plugins that print documents offer a preview that never reaches the print service. */
     previewDocument?(req: DocumentPreviewRequest, ctx: RendererContext): Promise<DocumentPreview>;
+    /** Optional: mail plugins hand out their brand row and footer for pages outside a mail. */
+    readMailChrome?(req: MailChromeRequest, ctx: RendererContext): Promise<MailChrome>;
 };
 export declare class RendererError extends Error {
     readonly code: "no_plugin_for_kind" | "invalid_payload" | "unavailable" | "other";

package/dist/renderer-pdf/feature.d.ts

@@ -1,4 +1,4 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type RenderRequest, type RenderResponse } from "../renderer-foundation/index.js";
+import { type RenderRequest, type RenderResponse } from "../renderer-foundation/index.ts";
 export declare function renderTablePdfRequest(req: RenderRequest): Promise<RenderResponse>;
 export declare function createRendererPdfFeature(): FeatureDefinition;

package/dist/renderer-pdf/index.d.ts

@@ -1,2 +1,2 @@
-export { createRendererPdfFeature } from "./feature.js";
-export { type PdfTableColumn, type PdfTableDocument, type PdfTableOptions, type PdfTableResult, pdfTableDocumentSchema, renderTablePdf, } from "./render-table-pdf.js";
+export { createRendererPdfFeature } from "./feature.ts";
+export { type PdfTableColumn, type PdfTableDocument, type PdfTableOptions, type PdfTableResult, pdfTableDocumentSchema, renderTablePdf, } from "./render-table-pdf.ts";

package/dist/renderer-pdf/render-table-pdf.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { PdfPageFormat } from "../template-resolver/index.js";
+import type { PdfPageFormat } from "../template-resolver/index.ts";
 declare const pdfTableColumnSchema: z.ZodReadonly<z.ZodObject<{
     header: z.ZodString;
     weight: z.ZodOptional<z.ZodNumber>;

package/dist/secrets/constants.d.ts

@@ -6,4 +6,11 @@ export declare const SECRETS_ERROR_KEYS: {
     readonly writeDenied: "secrets.errors.writeDenied";
     readonly invalidValue: "secrets.errors.invalidValue";
 };
+export declare const SecretsHandlers: {
+    readonly set: "secrets:write:set";
+    readonly delete: "secrets:write:delete";
+};
+export declare const SecretsQueries: {
+    readonly list: "secrets:query:list";
+};
 export declare const INVALID_SECRET_VALUE_CODE: "invalid_secret_value";

package/dist/secrets/constants.js

@@ -14,4 +14,11 @@ export const SECRETS_ERROR_KEYS = {
     writeDenied: "secrets.errors.writeDenied",
     invalidValue: "secrets.errors.invalidValue",
 };
+export const SecretsHandlers = {
+    set: "secrets:write:set",
+    delete: "secrets:write:delete",
+};
+export const SecretsQueries = {
+    list: "secrets:query:list",
+};
 export const INVALID_SECRET_VALUE_CODE = "invalid_secret_value";

package/dist/secrets/db/queries/read.d.ts

@@ -1,4 +1,4 @@
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { StoredEnvelope } from "../../table.js";
+import type { StoredEnvelope } from "../../table.ts";
 export declare function selectTenantSecretEnvelope(db: DbRunner, tenantId: TenantId, key: string): Promise<StoredEnvelope | undefined>;

package/dist/secrets/feature.d.ts

@@ -1,4 +1,5 @@
 import { type AccessRule, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
 /**
@@ -20,8 +21,9 @@ export declare const secretsEnvSchema: z.ZodObject<{
     KUMIKO_SECRETS_MASTER_KEY_V1: z.ZodString;
     KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>;
-export { createSecretsContext, type SecretsContext, type SecretsContextOptions, TENANT_SECRET_READ_EVENT, } from "./secrets-context.js";
-export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.js";
+export { createSecretsContext, type SecretsContext, type SecretsContextOptions, TENANT_SECRET_READ_EVENT, } from "./secrets-context.ts";
+export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.ts";
+export declare const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 export declare function requireSecretsContext(ctx: {
     readonly secrets?: SecretsContext;
     readonly _userId?: string | undefined;
@@ -42,4 +44,4 @@ export type SecretsFeatureOptions = {
     /** Shorthand for { access: { roles } }. Mutually exclusive with `access`. */
     readonly roles?: readonly string[];
 };
-export declare function createSecretsFeature(opts?: SecretsFeatureOptions): FeatureDefinition;
+export declare function createSecretsFeature(opts?: SecretsFeatureOptions): FeatureWithEnvSchema<FeatureDefinition, typeof secretsEnvSchema.shape>;

package/dist/secrets/feature.js

@@ -1,4 +1,5 @@
-import { defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, SYSTEM_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
@@ -44,6 +45,9 @@ export const secretsEnvSchema = z.object({
 });
 export { createSecretsContext, TENANT_SECRET_READ_EVENT, } from "./secrets-context.js";
 export { tenantSecretsTable } from "./table.js";
+// The settings form saves config values and secrets in one /api/batch; the secret
+// write has to join that transaction so a rejected command rolls it back too.
+export const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 // AppContext carries ctx.secrets via extraContext. requireSecretsContext
 // wraps that raw context so every `.get(...)` call auto-includes the
 // current user + handler as audit metadata — feature code can't forget
@@ -90,10 +94,19 @@ function resolveSecretsAccess(opts) {
         return { roles: opts.roles };
     return DEFAULT_SECRETS_ACCESS;
 }
+// Server-side system writes (dispatchSystemWrite, e.g. a wire hook migrating credentials) take the
+// same declared-key gate, value check and cache-sync announce as an admin instead of bypassing them
+// via SecretsContext.set. The system role is in-process only and never minted into a session.
+function withSystemWriter(rule) {
+    if (!("roles" in rule) || rule.roles.includes(SYSTEM_ROLE))
+        return rule;
+    return { ...rule, roles: [SYSTEM_ROLE, ...rule.roles] };
+}
 export function createSecretsFeature(opts = {}) {
     const access = resolveSecretsAccess(opts);
-    return defineFeature(SECRETS_FEATURE_NAME, (r) => {
-        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins).');
+    const writeAccess = withSystemWriter(access);
+    const feature = defineFeature(SECRETS_FEATURE_NAME, (r) => {
+        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: SecretsHandlers.set, payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.');
         r.uiHints({
             displayLabel: "Tenant Secrets",
             category: "infrastructure",
@@ -128,8 +141,8 @@ export function createSecretsFeature(opts = {}) {
         // The rotation job deliberately reaches for ctx.db.unsafeRaw() (raw,
         // cross-tenant) because rotation is a deployment-wide operation — no
         // feature-wide r.systemScope() needed.
-        r.writeHandler(createSetHandler(access));
-        r.writeHandler(createDeleteHandler(access));
+        r.writeHandler(createSetHandler(writeAccess));
+        r.writeHandler(createDeleteHandler(writeAccess));
         r.queryHandler(createListHandler(access));
         // Manual-only by design: ops triggers rotation after a KEK version flip.
         // BullMQ delivers to exactly one worker, so running it against a busy
@@ -149,4 +162,5 @@ export function createSecretsFeature(opts = {}) {
         // ops-tool (see docs/plans/architecture/event-dispatcher.md §retention).
         // No per-feature retention-job anymore.
     });
+    return featureWithEnvSchema(feature, secretsEnvSchema);
 }

package/dist/secrets/handlers/delete.write.js

@@ -2,8 +2,8 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { requireSecretsContext } from "../feature.js";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.js";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
 export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
@@ -14,8 +14,9 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
             key: z.string().min(1).max(100),
         }),
         access,
+        escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:delete");
+            const secrets = requireSecretsContext(ctx, SecretsHandlers.delete).withRunner(ctx.db.unsafeRaw());
             const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
                 allowUndeclared: true,
             });

package/dist/secrets/handlers/rotate.job.d.ts

@@ -1,6 +1,6 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
-import { type ChunkedMigrationStopReason } from "../../shared/index.js";
+import { type ChunkedMigrationStopReason } from "../../shared/index.ts";
 export type RotateJobPayload = {
     readonly batchSize?: number;
     readonly maxDurationMs?: number;

package/dist/secrets/handlers/set.write.js

@@ -1,8 +1,8 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { requireSecretsContext } from "../feature.js";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.js";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
@@ -21,8 +21,9 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
             hint: z.string().max(200).optional(),
         }),
         access,
+        escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:set");
+            const secrets = requireSecretsContext(ctx, SecretsHandlers.set).withRunner(ctx.db.unsafeRaw());
             const { key, value, redactedPreview, hint } = event.payload;
             // Preview-priority: explicit payload param > feature-declared redact
             // (via r.secret()) > generic default. A feature that declared a

package/dist/secrets/index.d.ts

@@ -1,7 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
-export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
-export { createDeleteHandler } from "./handlers/delete.write.js";
-export { createListHandler } from "./handlers/list.query.js";
-export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.js";
-export { createSetHandler } from "./handlers/set.write.js";
-export { isInvalidSecretValueError } from "./write-gate.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./constants.ts";
+export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.ts";
+export { createDeleteHandler } from "./handlers/delete.write.ts";
+export { createListHandler } from "./handlers/list.query.ts";
+export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.ts";
+export { createSetHandler } from "./handlers/set.write.ts";
+export { isInvalidSecretValueError } from "./write-gate.ts";

package/dist/secrets/index.js

@@ -1,4 +1,4 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./constants.js";
 export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
 export { createDeleteHandler } from "./handlers/delete.write.js";
 export { createListHandler } from "./handlers/list.query.js";

package/dist/secrets/secrets-context.d.ts

@@ -1,7 +1,7 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type DekCache, type MasterKeyProvider, type SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
-import { type SecretValueSchemaSource } from "./write-gate.js";
+import { type SecretValueSchemaSource } from "./write-gate.ts";
 export type { Secret, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 export type SecretsContextOptions = {
     readonly db: DbConnection;

package/dist/seo/feature.d.ts

@@ -1,7 +1,7 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { SEO_DEFAULT_PATHS } from "./constants.js";
-import { type RobotsPolicy } from "./robots-txt.js";
-import { type SitemapEntry } from "./sitemap.js";
+import { SEO_DEFAULT_PATHS } from "./constants.ts";
+import { type RobotsPolicy } from "./robots-txt.ts";
+import { type SitemapEntry } from "./sitemap.ts";
 export type ManagedPagesDiscoveryOptions = {
     /** Same per-host tenant resolver the app already passes to
      *  createManagedPagesFeature — needed to X-Tenant-scope the anonymous

package/dist/seo/index.d.ts

@@ -1,6 +1,6 @@
-export { SEO_CONFIG_KEYS, SEO_CONFIG_QN, SEO_DEFAULT_PATHS, SEO_FEATURE } from "./constants.js";
-export { createSeoFeature, type ManagedPagesDiscoveryOptions, runSeoBootCheck, type SeoBootCheckCtx, type SeoOptions, } from "./feature.js";
-export { buildLlmsTxt, type LlmsTxtInput, type LlmsTxtLink, type LlmsTxtSection, } from "./llms-txt.js";
-export { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.js";
-export { type FaqItem, faqPageSchema, type OrganizationSchemaInput, organizationSchema, type WebPageSchemaInput, webPageSchema, } from "./schema-builders.js";
-export { buildSitemapXml, type SitemapEntry } from "./sitemap.js";
+export { SEO_CONFIG_KEYS, SEO_CONFIG_QN, SEO_DEFAULT_PATHS, SEO_FEATURE } from "./constants.ts";
+export { createSeoFeature, type ManagedPagesDiscoveryOptions, runSeoBootCheck, type SeoBootCheckCtx, type SeoOptions, } from "./feature.ts";
+export { buildLlmsTxt, type LlmsTxtInput, type LlmsTxtLink, type LlmsTxtSection, } from "./llms-txt.ts";
+export { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.ts";
+export { type FaqItem, faqPageSchema, type OrganizationSchemaInput, organizationSchema, type WebPageSchemaInput, webPageSchema, } from "./schema-builders.ts";
+export { buildSitemapXml, type SitemapEntry } from "./sitemap.ts";

package/dist/sessions/feature.d.ts

@@ -1,5 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type SessionAllOthersRevoker, type SessionMassRevoker } from "./session-callbacks.js";
+import { type SessionAllOthersRevoker, type SessionMassRevoker } from "./session-callbacks.ts";
 export type SessionsFeatureOptions = {
     readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
     readonly expiresInMs?: number;

package/dist/sessions/index.d.ts

@@ -1,8 +1,8 @@
-export { DEFAULT_SESSION_CACHE_TTL_MS, DEFAULT_SESSION_EXPIRY_MS, SESSION_MINE_SCREEN_ID, SESSIONS_FEATURE, SessionErrors, SessionHandlers, SessionQueries, } from "./constants.js";
-export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature.js";
-export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature.js";
-export { userSessionEntity, userSessionTable } from "./schema/user-session.js";
-export type { SessionCallbacks, SessionCallbacksOptions, SessionMassRevoker, } from "./session-callbacks.js";
-export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.js";
-export type { SessionRevokedPayload } from "./session-revoked-event.js";
-export { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, } from "./session-revoked-event.js";
+export { DEFAULT_SESSION_CACHE_TTL_MS, DEFAULT_SESSION_EXPIRY_MS, SESSION_MINE_SCREEN_ID, SESSIONS_FEATURE, SessionErrors, SessionHandlers, SessionQueries, } from "./constants.ts";
+export type { BindAutoRevokeOnPasswordChange, SessionsFeatureOptions } from "./feature.ts";
+export { bindAutoRevokeFromFeature, createSessionsFeature } from "./feature.ts";
+export { userSessionEntity, userSessionTable } from "./schema/user-session.ts";
+export type { SessionCallbacks, SessionCallbacksOptions, SessionMassRevoker, } from "./session-callbacks.ts";
+export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.ts";
+export type { SessionRevokedPayload } from "./session-revoked-event.ts";
+export { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, } from "./session-revoked-event.ts";

package/dist/sessions/session-callbacks.d.ts

@@ -1,7 +1,7 @@
 import type { SessionChecker, SessionCreator, SessionMassRevoker, SessionRevoker } from "@cosmicdrift/kumiko-framework/api";
 export type { SessionMassRevoker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { isPrincipalBlocked } from "../user/index.js";
+import { isPrincipalBlocked } from "../user/index.ts";
 export { isPrincipalBlocked };
 export type SessionAllOthersRevoker = (userId: string, currentSid: string | undefined) => Promise<number>;
 export type SessionCallbacksOptions = {

package/dist/sessions/testing.d.ts

@@ -1,7 +1,7 @@
 import type { AuthRoutesConfig, SessionCreator } from "@cosmicdrift/kumiko-framework/api";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import type { LateBoundHolder } from "@cosmicdrift/kumiko-testing/helpers";
-import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.js";
+import type { SessionCallbacks, SessionMassRevoker } from "./session-callbacks.ts";
 export type BoundSessionCallbacks = {
     /** auth-config fragment: creator + revoker + checker, all late-bound. */
     asAuthConfig(): Pick<AuthRoutesConfig, "sessionCreator" | "sessionRevoker" | "sessionChecker">;

package/dist/shared/index.d.ts

@@ -1,31 +1,31 @@
-export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
-export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.js";
-export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.js";
-export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.js";
-export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.js";
-export { decryptStoredPii } from "./decrypt-stored-pii.js";
-export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
-export { entitiesOf } from "./entities-of.js";
-export { isWithinGracePeriod } from "./grace-period.js";
-export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
-export { isTenantDb } from "./is-tenant-db.js";
-export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
-export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.js";
-export { mapWithConcurrency } from "./map-with-concurrency.js";
-export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
-export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
-export { rateLimitedTextResponse } from "./rate-limited-text-response.js";
-export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
-export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.js";
-export { requireForTenant } from "./require-for-tenant.js";
-export { extensionForResourceContentType, isResourceImageContentType, isResourceImageFormat, RESOURCE_IMAGE_FORMATS, type ResourceImageContentType, type ResourceImageFormat, } from "./resource-image-formats.js";
-export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
-export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.js";
-export { sessionTimezoneField } from "./session-timezone-field.js";
-export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.js";
-export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.js";
-export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, type SignupHandoverBinding, type SignupHandoverProvider, } from "./signup-handover.js";
-export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.js";
-export type { SystemQueryFn } from "./system-query.js";
-export { type BurnResult, burnToken, unburnToken } from "./token-burn-store.js";
+export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.ts";
+export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-ownership-write.ts";
+export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.ts";
+export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.ts";
+export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.ts";
+export { decryptStoredPii } from "./decrypt-stored-pii.ts";
+export { encryptForDirectWrite } from "./encrypt-for-direct-write.ts";
+export { entitiesOf } from "./entities-of.ts";
+export { isWithinGracePeriod } from "./grace-period.ts";
+export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.ts";
+export { isTenantDb } from "./is-tenant-db.ts";
+export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.ts";
+export { mailHeading, mailParagraph, mailRepeatedRows } from "./mail-template-body.ts";
+export { mapWithConcurrency } from "./map-with-concurrency.ts";
+export { denyUnlessJoinRowParentVisible, hostRowIsGone, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.ts";
+export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.ts";
+export { rateLimitedTextResponse } from "./rate-limited-text-response.ts";
+export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.ts";
+export { REDACTED_PII_PLACEHOLDER, redactPiiCiphertext } from "./redact-pii-ciphertext.ts";
+export { requireForTenant } from "./require-for-tenant.ts";
+export { extensionForResourceContentType, isResourceImageContentType, isResourceImageFormat, RESOURCE_IMAGE_FORMATS, type ResourceImageContentType, type ResourceImageFormat, } from "./resource-image-formats.ts";
+export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.ts";
+export { runInSubTransaction } from "./run-in-sub-transaction.ts";
+export { registrationLocaleFromRequest, sessionLocaleField } from "./session-locale-field.ts";
+export { sessionTimezoneField } from "./session-timezone-field.ts";
+export { assertNotSvg, MAX_INPUT_PIXELS, SHARP_INPUT_OPTIONS } from "./sharp-input-limits.ts";
+export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.ts";
+export { EXT_SIGNUP_HANDOVER, findSignupHandoverProvider, isSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, type SignupHandoverBinding, type SignupHandoverProvider, } from "./signup-handover.ts";
+export { createSingleUseTokenStore, hashSingleUseToken } from "./single-use-token-store.ts";
+export type { SystemQueryFn } from "./system-query.ts";
+export { type BurnResult, burnToken, unburnToken } from "./token-burn-store.ts";

package/dist/step-dispatcher/dispatch-payload.d.ts

@@ -1,6 +1,6 @@
 import * as z from "zod";
-import { type MailSpec } from "./mail-runner.js";
-import { type WebhookSpec } from "./webhook-runner.js";
+import { type MailSpec } from "./mail-runner.ts";
+import { type WebhookSpec } from "./webhook-runner.ts";
 export declare const dispatchRequestedPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     stepKind: z.ZodLiteral<"webhook.send">;
     url: z.ZodString;

package/dist/step-dispatcher/index.d.ts

@@ -1,3 +1,3 @@
-export { createStepDispatcherFeature, STEP_DISPATCH_AGGREGATE_TYPE, stepDispatcherEnvSchema, } from "./feature.js";
-export { type MailDispatchResult, type MailSpec, mailSpecSchema, performMailDispatch, setMailRunner, } from "./mail-runner.js";
-export { performWebhookDispatch, readAllowedPrivateWebhookHostsFromEnv, setWebhookFetch, setWebhookHostLookup, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_KEY_PREFIX, type WebhookDispatchDeps, type WebhookDispatchResult, type WebhookSpec, webhookAuthSecretKey, webhookSpecSchema, } from "./webhook-runner.js";
+export { createStepDispatcherFeature, STEP_DISPATCH_AGGREGATE_TYPE, stepDispatcherEnvSchema, } from "./feature.ts";
+export { type MailDispatchResult, type MailSpec, mailSpecSchema, performMailDispatch, setMailRunner, } from "./mail-runner.ts";
+export { performWebhookDispatch, readAllowedPrivateWebhookHostsFromEnv, setWebhookFetch, setWebhookHostLookup, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_KEY_PREFIX, type WebhookDispatchDeps, type WebhookDispatchResult, type WebhookSpec, webhookAuthSecretKey, webhookSpecSchema, } from "./webhook-runner.ts";

package/dist/subscription-mollie/feature.d.ts

@@ -1,7 +1,7 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { type MolliePriceConfig } from "./plugin-methods.js";
-import { type MollieClientShape } from "./verify-webhook.js";
+import { type MolliePriceConfig } from "./plugin-methods.ts";
+import { type MollieClientShape } from "./verify-webhook.ts";
 /**
  * Env-vars contract for the `subscription-mollie` feature.
  * Apps load `MOLLIE_API_KEY` from env and forward it to

package/dist/subscription-mollie/index.d.ts

@@ -1,3 +1,3 @@
-export { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.js";
-export { createSubscriptionMollieFeature, type SubscriptionMollieOptions, subscriptionMollieEnvSchema, } from "./feature.js";
-export type { MolliePriceConfig } from "./plugin-methods.js";
+export { MOLLIE_PROVIDER_NAME, SUBSCRIPTION_MOLLIE_FEATURE } from "./constants.ts";
+export { createSubscriptionMollieFeature, type SubscriptionMollieOptions, subscriptionMollieEnvSchema, } from "./feature.ts";
+export type { MolliePriceConfig } from "./plugin-methods.ts";

package/dist/subscription-mollie/verify-webhook.d.ts

@@ -1,6 +1,6 @@
 import { type SubscriptionEvent, type SubscriptionEventType, type SubscriptionStatus } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import type { Payment as MolliePayment, Subscription as MollieSubscription } from "@mollie/api-client";
-import type { MolliePriceConfig } from "./plugin-methods.js";
+import type { MolliePriceConfig } from "./plugin-methods.ts";
 /** Minimal-Subset des Mollie-Clients, das der Plugin nutzt — separat
  *  damit Tests ohne den vollen MollieClient mocken können. Adapter in
  *  feature.ts bridged das gegen den echten SDK. */

package/dist/subscription-stripe/feature.d.ts

@@ -1,4 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
 /**
  * Env-vars contract for the `subscription-stripe` feature — now a **bridge
@@ -12,6 +13,20 @@ export declare const subscriptionStripeEnvSchema: z.ZodObject<{
     STRIPE_WEBHOOK_SECRET: z.ZodOptional<z.ZodString>;
     STRIPE_API_KEY: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+type StripePriceEnvShape<TPrice extends string> = {
+    [Key in `STRIPE_PRICE_${TPrice}`]: z.ZodOptional<z.ZodString>;
+};
+/** Stripe env block plus one `STRIPE_PRICE_<NAME>` slot per price the app
+ *  maps to a tier, e.g. `stripeEnvSchema({ prices: ["PRO", "TEAM"] })`.
+ *  Shares its bridge fields with `subscriptionStripeEnvSchema`, so spreading
+ *  it into `composeEnvSchema({ extend })` next to the mounted feature is no
+ *  key clash. */
+export declare function stripeEnvSchema<const TPrice extends string>(options: {
+    readonly prices: readonly TPrice[];
+}): z.ZodObject<{
+    STRIPE_WEBHOOK_SECRET: z.ZodOptional<z.ZodString>;
+    STRIPE_API_KEY: z.ZodOptional<z.ZodString>;
+} & StripePriceEnvShape<TPrice> extends infer T ? { -readonly [P in keyof T]: T[P]; } : never, z.core.$strip>;
 export type SubscriptionStripeOptions = {
     /** Bridge-fallback webhook-secret. Optional: v2 liest aus dem
      *  `subscription-stripe:config:webhook-secret`-Key (backing:"secrets").
@@ -47,4 +62,5 @@ export type SubscriptionStripeOptions = {
  * registriert den Plugin gegen billing-foundation's "subscriptionProvider"-
  * extension unter entityName "stripe".
  */
-export declare function createSubscriptionStripeFeature(options?: SubscriptionStripeOptions): FeatureDefinition;
+export declare function createSubscriptionStripeFeature(options?: SubscriptionStripeOptions): FeatureWithEnvSchema<FeatureDefinition, typeof subscriptionStripeEnvSchema.shape>;
+export {};

package/dist/subscription-stripe/feature.js

@@ -31,6 +31,7 @@
 // scoped SecretsContext als 3. Arg durch, aus dem der Plugin api-key +
 // webhook-secret un-audited liest (sanctioned framework-internal read).
 import { access, createSystemConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import * as z from "zod";
 import { STRIPE_API_KEY_CONFIG, STRIPE_BILLING_LIVE_CONFIG, STRIPE_PROVIDER_NAME, STRIPE_WEBHOOK_SECRET_CONFIG, SUBSCRIPTION_STRIPE_FEATURE, } from "./constants.js";
 import { createStripeCancelSubscription, createStripeCheckoutSession, createStripePlanSwitchSession, createStripePortalSession, createStripePriceCache, createStripeRetrievePrices, createStripeRetrieveSubscription, } from "./plugin-methods.js";
@@ -58,6 +59,22 @@ export const subscriptionStripeEnvSchema = z.object({
         .meta({ kumiko: { pulumi: { secret: true } } })
         .optional(),
 });
+/** Stripe env block plus one `STRIPE_PRICE_<NAME>` slot per price the app
+ *  maps to a tier, e.g. `stripeEnvSchema({ prices: ["PRO", "TEAM"] })`.
+ *  Shares its bridge fields with `subscriptionStripeEnvSchema`, so spreading
+ *  it into `composeEnvSchema({ extend })` next to the mounted feature is no
+ *  key clash. */
+export function stripeEnvSchema(options) {
+    const priceShape = Object.fromEntries(options.prices.map((price) => [
+        `STRIPE_PRICE_${price}`,
+        z
+            .string()
+            .regex(/^price_/, `STRIPE_PRICE_${price} must start with 'price_'`)
+            .optional()
+            .describe(`Stripe price id (\`price_...\`) of the ${price} plan.`),
+    ]));
+    return z.object({ ...subscriptionStripeEnvSchema.shape, ...priceShape });
+}
 // Validated once at feature-build time (not per-request) so a config typo
 // (a pasted-twice priceId, a blank string from a bad env-join) fails app
 // startup instead of silently widening — or narrowing — the one-off
@@ -83,7 +100,7 @@ function validateOneOffPriceIds(priceIds) {
  */
 export function createSubscriptionStripeFeature(options = {}) {
     validateOneOffPriceIds(options.oneOffPriceIds ?? []);
-    return defineFeature(SUBSCRIPTION_STRIPE_FEATURE, (r) => {
+    const feature = defineFeature(SUBSCRIPTION_STRIPE_FEATURE, (r) => {
         r.describe('Stripe payment provider plugin for `billing-foundation`. Reads its Stripe API key + webhook secret from system config keys with `backing:"secrets"` (envelope-encrypted in the secrets store under the system tenant) and a `billingLive` **system config** flag — all at runtime, so keys rotate and prod goes live without a redeploy. The `mask` on each key derives the sysadmin settings screen + nav, so no app wires a hand-written config UI. Mount via `createSubscriptionStripeFeature({ priceToTier })`; the optional `apiKey`/`webhookSecret` options are env→secrets bridge fallbacks. The plugin always mounts — `createCheckoutSession` throws `feature_disabled` unless `billingLive` is true, so sk_test_ keys in prod never produce a live checkout. Implements webhook verify, checkout, portal, cancel, `retrievePrices` (10-minute TTL-cached price lookup for the billing-plans catalog), `createPlanSwitchSession` (auto-provisions a Customer-Portal configuration for switching an existing subscription to another plan tier — each tier needs its own Stripe product), `retrieveSubscription` (live provider-side snapshot for the `sync-subscriptions` backfill job, mapped identically to the webhook path), plus `isBillingEnabled` (billingLive + an api-key existence probe, no secret read).');
         r.uiHints({
             displayLabel: "Billing · Stripe",
@@ -176,4 +193,5 @@ export function createSubscriptionStripeFeature(options = {}) {
         r.useExtension("subscriptionProvider", STRIPE_PROVIDER_NAME, plugin);
         return { configKeys };
     });
+    return featureWithEnvSchema(feature, subscriptionStripeEnvSchema);
 }

package/dist/subscription-stripe/index.d.ts

@@ -1,2 +1,2 @@
-export { STRIPE_PROVIDER_NAME, StripeEventTypes, SUBSCRIPTION_STRIPE_FEATURE, } from "./constants.js";
-export { createSubscriptionStripeFeature, type SubscriptionStripeOptions, subscriptionStripeEnvSchema, } from "./feature.js";
+export { STRIPE_PROVIDER_NAME, StripeEventTypes, SUBSCRIPTION_STRIPE_FEATURE, } from "./constants.ts";
+export { createSubscriptionStripeFeature, type SubscriptionStripeOptions, stripeEnvSchema, subscriptionStripeEnvSchema, } from "./feature.ts";

package/dist/subscription-stripe/index.js

@@ -6,4 +6,4 @@
 //   - mapStripeEventType / mapStripeStatus (pure helpers, test-only;
 //     direct-import aus dem File wenn echt mal extern gebraucht)
 export { STRIPE_PROVIDER_NAME, StripeEventTypes, SUBSCRIPTION_STRIPE_FEATURE, } from "./constants.js";
-export { createSubscriptionStripeFeature, subscriptionStripeEnvSchema, } from "./feature.js";
+export { createSubscriptionStripeFeature, stripeEnvSchema, subscriptionStripeEnvSchema, } from "./feature.js";

package/dist/subscription-stripe/plugin-methods.d.ts

@@ -1,7 +1,7 @@
 import { type ProviderPrice, type ProviderSubscriptionSnapshot, type SubscriptionProviderPlugin } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import Stripe from "stripe";
-import type { StripeCtxRuntime } from "./runtime.js";
+import type { StripeCtxRuntime } from "./runtime.ts";
 export type StripeCheckoutOptions = Parameters<NonNullable<SubscriptionProviderPlugin["createCheckoutSession"]>>[1];
 export type StripeCheckoutSessionRuntimeOptions = {
     /** Whether a mode:"payment" checkout gets a Stripe invoice. Default true.