@cosmicdrift/kumiko-bundled-features 0.368.0 → 0.370.0

package/dist/delivery/unsubscribe-page.js

@@ -0,0 +1,192 @@
+import { createHash } from "node:crypto";
+import { mailT } from "@cosmicdrift/kumiko-framework/i18n";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH } from "./public-names.js";
+import "./unsubscribe-page-strings.js";
+// Same values as the in-code mail layout of renderer-mail-html, so the page reads as the mail's sequel.
+const DEFAULT_ACCENT_COLOR = "#1f5468";
+const HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+const FONT_URL_PREFIX = "/assets/kumiko/fonts/ibm-plex-sans-latin-";
+function accentOf(chrome) {
+    const accent = chrome?.accentColor;
+    return accent !== undefined && HEX_COLOR.test(accent) ? accent : DEFAULT_ACCENT_COLOR;
+}
+function httpsOrigin(url) {
+    if (url === undefined)
+        return undefined;
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" ? parsed.origin : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function webHost(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.host : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const SAFE_LINK_URL = /^(https?:|mailto:)/i;
+function linkHtml(link) {
+    const url = link.url.trim();
+    if (!SAFE_LINK_URL.test(url) || link.label.trim() === "")
+        return "";
+    return `<a href="${escapeHtmlAttr(url)}">${escapeHtml(link.label)}</a>`;
+}
+// The style block is static apart from the validated hex accent and the markup carries
+// no style attributes, so the CSP admits exactly this block by its hash.
+function pageStyle(accent) {
+    return `@font-face{font-family:"IBM Plex Sans";font-style:normal;font-weight:400;font-display:swap;src:url("${FONT_URL_PREFIX}400.woff2") format("woff2")}
+@font-face{font-family:"IBM Plex Sans";font-style:normal;font-weight:600;font-display:swap;src:url("${FONT_URL_PREFIX}600.woff2") format("woff2")}
+:root{--accent:${accent}}
+*{box-sizing:border-box}
+html,body{margin:0;padding:0}
+body{background:#ecedea;color:#2a2f3a;font-family:"IBM Plex Sans",ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;font-size:16px;line-height:1.65;-webkit-font-smoothing:antialiased}
+.page{max-width:560px;margin:0 auto;padding:48px 16px}
+.card{background:#fff;border:1px solid #dcdfda;border-radius:14px;overflow:hidden}
+.accent{height:4px;background:var(--accent)}
+.brand{display:flex;align-items:center;gap:10px;padding:32px 40px 0}
+.brand img{height:28px;width:auto;max-width:140px;display:block}
+.tile{width:28px;height:28px;line-height:28px;border-radius:8px;background:var(--accent);color:#fff;font-weight:600;font-size:14px;text-align:center;flex:none}
+.name{font-size:15px;font-weight:600;color:#0b0d12}
+.suffix{font-size:13px;color:#5a6170}
+.content{padding:28px 40px 36px}
+h1{margin:0 0 8px;font-size:22px;line-height:1.3;font-weight:600;color:#0b0d12}
+p{margin:0}
+form{margin:24px 0 0}
+.button{display:inline-block;font:inherit;font-weight:600;font-size:15px;line-height:1.4;padding:10px 20px;border-radius:6px;border:1px solid var(--accent);background:var(--accent);color:#fff;cursor:pointer}
+.button.secondary{background:#fff;color:var(--accent)}
+.button:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+.hint{margin-top:24px;font-size:14px;color:#5a6170}
+.hint+form{margin-top:12px}
+.band{background:#fbfbfa;border-top:1px solid #ecedea;padding:16px 40px;font-size:13px;color:#5a6170}
+.band a{color:#4a515e}
+.footer{padding:20px 24px 0;text-align:center;font-size:12px;color:#5a6170}
+.footer a{color:#5a6170}
+@media (max-width:480px){.page{padding:24px 12px}.brand{padding:24px 20px 0}.content{padding:20px 20px 28px}.band{padding:14px 20px}h1{font-size:20px}.button{width:100%}}`;
+}
+function brandRowHtml(chrome) {
+    const name = chrome.tenantName.trim();
+    const initial = Array.from(name)[0]?.toLocaleUpperCase() ?? "";
+    const mark = httpsOrigin(chrome.logoUrl) !== undefined && chrome.logoUrl !== undefined
+        ? `<img src="${escapeHtmlAttr(chrome.logoUrl)}" alt="">`
+        : initial === ""
+            ? ""
+            : `<span class="tile" aria-hidden="true">${escapeHtml(initial)}</span>`;
+    const suffix = chrome.brandSuffix.trim();
+    if (mark === "" && name === "")
+        return "";
+    return `<div class="brand">${mark}${name === "" ? "" : `<span class="name">${escapeHtml(name)}</span>`}${suffix === "" ? "" : `<span class="suffix">${escapeHtml(suffix)}</span>`}</div>`;
+}
+function bandHtml(chrome) {
+    const host = chrome.siteUrl === undefined ? undefined : webHost(chrome.siteUrl);
+    if (host === undefined || chrome.siteUrl === undefined)
+        return "";
+    return `<div class="band"><a href="${escapeHtmlAttr(chrome.siteUrl)}">${escapeHtml(host)}</a></div>`;
+}
+function footerHtml(chrome) {
+    const text = chrome.footerText?.trim() ?? "";
+    const links = [chrome.imprint, chrome.privacy]
+        .map((link) => (link === undefined ? "" : linkHtml(link)))
+        .filter((html) => html !== "");
+    const lineHtmls = [
+        ...(text === "" ? [] : [escapeHtml(text)]),
+        ...(links.length === 0 ? [] : [links.join(" · ")]),
+    ];
+    const linesHtml = lineHtmls.join("<br>");
+    return linesHtml === "" ? "" : `<footer class="footer">${linesHtml}</footer>`;
+}
+function tokenForm(action, token, label, variant) {
+    return `<form method="post" action="${escapeHtmlAttr(action)}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(token)}">
+<button type="submit" class="${escapeHtmlAttr(variant)}">${escapeHtml(label)}</button>
+</form>`;
+}
+function pageText(state, lang) {
+    const paragraph = (key) => `<p>${escapeHtml(mailT(lang, key))}</p>`;
+    switch (state.kind) {
+        case "confirm":
+            return {
+                title: mailT(lang, "mail.unsubscribe.confirmTitle"),
+                bodyHtml: `${paragraph("mail.unsubscribe.confirmQuestion")}
+${tokenForm(DELIVERY_UNSUBSCRIBE_PATH, state.token, mailT(lang, "mail.unsubscribe.confirmButton"), "button")}`,
+            };
+        case "unsubscribed":
+            return {
+                title: mailT(lang, "mail.unsubscribe.doneTitle"),
+                bodyHtml: state.resubscribeToken === undefined
+                    ? paragraph("mail.unsubscribe.doneMessage")
+                    : `${paragraph("mail.unsubscribe.doneMessage")}
+<p class="hint">${escapeHtml(mailT(lang, "mail.unsubscribe.undoHint"))}</p>
+${tokenForm(DELIVERY_RESUBSCRIBE_PATH, state.resubscribeToken, mailT(lang, "mail.unsubscribe.undoButton"), "button secondary")}`,
+            };
+        case "resubscribed":
+            return {
+                title: mailT(lang, "mail.unsubscribe.resubscribedTitle"),
+                bodyHtml: paragraph("mail.unsubscribe.resubscribedMessage"),
+            };
+        case "failed":
+            return {
+                title: mailT(lang, "mail.unsubscribe.failedTitle"),
+                bodyHtml: paragraph("mail.unsubscribe.failed"),
+            };
+        case "invalid":
+            return {
+                title: mailT(lang, "mail.unsubscribe.invalidTitle"),
+                bodyHtml: paragraph("mail.unsubscribe.invalidMessage"),
+            };
+    }
+}
+// The page loads nothing but its own style block, the same-origin font and, with
+// branding, the tenant's https logo. Forms only post back to the same origin.
+function contentSecurityPolicy(style, chrome) {
+    const styleHash = createHash("sha256").update(style).digest("base64");
+    const logoOrigin = httpsOrigin(chrome?.logoUrl);
+    return [
+        "default-src 'none'",
+        `style-src 'sha256-${styleHash}'`,
+        "font-src 'self'",
+        `img-src 'self' data:${logoOrigin === undefined ? "" : ` ${logoOrigin}`}`,
+        "form-action 'self'",
+        "base-uri 'none'",
+        "frame-ancestors 'none'",
+    ].join("; ");
+}
+export function renderUnsubscribePage(input) {
+    const { state, locale, chrome } = input;
+    const { title, bodyHtml } = pageText(state, locale);
+    const style = pageStyle(accentOf(chrome));
+    const branded = chrome !== null && chrome !== undefined;
+    // html-ok: static CSS whose only variable is the hex-validated accent; escaping would break its quotes and the CSP hash.
+    const styleBlockHtml = `<style>${style}</style>`;
+    const html = `<!doctype html>
+<html lang="${escapeHtmlAttr(locale)}">
+<head>
+<meta charset="utf-8">
+<meta name="robots" content="noindex">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+${styleBlockHtml}
+</head>
+<body>
+<main class="page">
+<div class="card">
+<div class="accent"></div>
+${branded ? brandRowHtml(chrome) : ""}
+<div class="content">
+<h1>${escapeHtml(title)}</h1>
+${bodyHtml}
+</div>
+${branded ? bandHtml(chrome) : ""}
+</div>
+${branded ? footerHtml(chrome) : ""}
+</main>
+</body>
+</html>`;
+    return { html, contentSecurityPolicy: contentSecurityPolicy(style, chrome) };
+}

package/dist/delivery/unsubscribe.d.ts

@@ -1,6 +1,6 @@
 import { type ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import "./unsubscribe-page-strings.js";
+import type { MailChrome } from "../renderer-foundation/index.ts";
 export type UnsubscribeTokenPayload = {
     readonly userId: string;
     readonly tenantId: TenantId;
@@ -34,4 +34,25 @@ export declare function signUnsubscribeToken(payload: UnsubscribeTokenPayload, s
  */
 export declare function signAddressUnsubscribeToken(payload: AddressUnsubscribeTokenPayload, secret: string): Promise<string>;
 export declare const DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE: "List-Unsubscribe=One-Click";
+export type UnsubscribeResultPage = {
+    readonly kind: "unsubscribed";
+    readonly resubscribeToken?: string;
+} | {
+    readonly kind: "resubscribed";
+} | {
+    readonly kind: "failed";
+} | {
+    readonly kind: "invalid";
+};
+/** The result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`;
+ *  `chrome` (the mail renderer's readMailChrome) adds the tenant's brand row and footer.
+ *  Served under runProdApp's default CSP the style block and the same-origin font pass;
+ *  an https logo additionally needs its origin, e.g.
+ *  `securityHeaders: { csp: { extend: { "img-src": [logoOrigin] } } }`. A hand-written CSP
+ *  needs `style-src 'unsafe-inline'` as well. */
+export declare function renderUnsubscribeResultPage(page: UnsubscribeResultPage & {
+    readonly locale?: string | undefined;
+    readonly chrome?: MailChrome | null | undefined;
+}): string;
 export declare function createUnsubscribeRoutes(options: UnsubscribeRouteOptions): readonly ExtraRouteDefinition[];

package/dist/delivery/unsubscribe.js

@@ -1,12 +1,12 @@
 import { ExtraRouteRejection, signatureRoute, } from "@cosmicdrift/kumiko-framework/api";
-import { mailT, resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
-import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as jose from "jose";
 import * as z from "zod";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
-import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, } from "./constants.js";
-import "./unsubscribe-page-strings.js";
+import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryQueries, } from "./constants.js";
+import { renderUnsubscribePage } from "./unsubscribe-page.js";
 // The mail's locale, so the pages behind the link speak the mail's language. Optional: links
 // signed before the claim existed keep verifying and fall back to English.
 const localeClaimSchema = z
@@ -59,6 +59,32 @@ function localeClaim(locale) {
 const UNSUBSCRIBE_TOKEN_INVALID_BODY = {
     error: { code: "unsubscribe_token_invalid", message: "Invalid or expired token" },
 };
+// jose checks the signature and the issuer before the expiry, so the claims of an
+// expired token are authentic: enough to dress the "link expired" page in the
+// tenant's look and language, never enough to write.
+const expiredTokenScopeSchema = z.object({
+    iss: z.literal(UNSUBSCRIBE_ISSUER),
+    tenantId: z.string().min(1),
+    locale: localeClaimSchema,
+});
+class ExpiredUnsubscribeTokenRejection extends ExtraRouteRejection {
+    tenantId;
+    locale;
+    constructor(tenantId, locale) {
+        super(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "unsubscribe token expired");
+        this.tenantId = tenantId;
+        this.locale = locale;
+    }
+}
+function expiredTokenRejection(err) {
+    if (!(err instanceof jose.errors.JWTExpired))
+        return null;
+    const scope = expiredTokenScopeSchema.safeParse(err.payload);
+    if (!scope.success)
+        return null;
+    // @cast-boundary engine-bridge — string post-zod → branded TenantId
+    return new ExpiredUnsubscribeTokenRejection(scope.data.tenantId, scope.data.locale);
+}
 export async function signUnsubscribeToken(payload, secret) {
     assertUnsubscribeSecret(secret, "signUnsubscribeToken");
     const encodedSecret = new TextEncoder().encode(secret);
@@ -108,10 +134,6 @@ export async function signAddressUnsubscribeToken(payload, secret) {
 // RFC 8058 fixed value — both the List-Unsubscribe-Post header and the body a
 // one-click client POSTs.
 export const DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE = "List-Unsubscribe=One-Click";
-const CONFIRMATION_PAGE_HEADERS = {
-    "Cache-Control": "no-store",
-    "Referrer-Policy": "no-referrer",
-};
 // Undo token, handed out only in the response of a successful unsubscribe. A
 // separate audience and a short expiry keep the long-lived mailed unsubscribe
 // link from being able to undo an opt-out (and vice versa).
@@ -193,7 +215,8 @@ async function verifyUnsubscribeToken(token, encodedSecret, purpose) {
     catch (err) {
         if (err instanceof ExtraRouteRejection)
             throw err;
-        throw new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "unsubscribe token verification failed");
+        throw (expiredTokenRejection(err) ??
+            new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "unsubscribe token verification failed"));
     }
 }
 async function dispatchUnsubscribeWrite(verified, deps) {
@@ -250,44 +273,101 @@ async function dispatchResubscribeWrite(verified, deps) {
 function pageLocale(locale) {
     return resolveMailLocale(locale ?? "en");
 }
-function htmlPage(locale, title, bodyHtml) {
-    return `<!doctype html>
-<html lang="${escapeHtmlAttr(locale)}">
-<head>
-<meta charset="utf-8">
-<meta name="robots" content="noindex">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtmlAttr(title)}</title>
-</head>
-<body>
-${bodyHtml}
-</body>
-</html>`;
+/** The result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`;
+ *  `chrome` (the mail renderer's readMailChrome) adds the tenant's brand row and footer.
+ *  Served under runProdApp's default CSP the style block and the same-origin font pass;
+ *  an https logo additionally needs its origin, e.g.
+ *  `securityHeaders: { csp: { extend: { "img-src": [logoOrigin] } } }`. A hand-written CSP
+ *  needs `style-src 'unsafe-inline'` as well. */
+export function renderUnsubscribeResultPage(page) {
+    const { locale, chrome, ...state } = page;
+    return renderUnsubscribePage({ state, locale: pageLocale(locale), chrome }).html;
+}
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
+const mailChromeLinkSchema = z.object({ label: z.string(), url: z.string() });
+const mailChromeSchema = z
+    .object({
+    tenantName: z.string(),
+    brandSuffix: z.string(),
+    logoUrl: z.string().optional(),
+    accentColor: z.string().optional(),
+    siteUrl: z.string().optional(),
+    footerText: z.string().optional(),
+    imprint: mailChromeLinkSchema.optional(),
+    privacy: mailChromeLinkSchema.optional(),
+})
+    .nullable();
+// Branding is decoration: an opt-out that went through must never turn into an
+// error page because a footer resolver or the config read failed.
+async function readPageChrome(deps, tenantId, locale) {
+    try {
+        const result = await deps.dispatchSystemQuery({
+            handlerQn: DeliveryQueries.unsubscribePageChrome,
+            payload: { locale },
+            tenantId,
+        });
+        const parsed = mailChromeSchema.safeParse(result);
+        return parsed.success ? parsed.data : null;
+    }
+    catch (err) {
+        createFallbackLogger("delivery").warn("unsubscribe page shown without tenant branding", {
+            errorName: err instanceof Error ? err.name : typeof err,
+        });
+        return null;
+    }
 }
-function confirmationPage(token, locale) {
-    const lang = pageLocale(locale);
-    return htmlPage(lang, mailT(lang, "mail.unsubscribe.confirmTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.confirmQuestion"))}</p>
-<form method="post" action="${DELIVERY_UNSUBSCRIBE_PATH}">
-<input type="hidden" name="token" value="${escapeHtmlAttr(token)}">
-<button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.confirmButton"))}</button>
-</form>`);
+// no-referrer on every page: the GET page carries the token in its URL, and the
+// tenant logo and site link would otherwise receive it in the Referer header.
+const PAGE_HEADERS = {
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+};
+async function pageResponse(
+// biome-ignore lint/suspicious/noExplicitAny: Hono context generics are invisible at the framework boundary
+c, deps, state, scope, status) {
+    const locale = pageLocale(scope.locale);
+    const chrome = scope.tenantId === undefined ? null : await readPageChrome(deps, scope.tenantId, locale);
+    const page = renderUnsubscribePage({ state, locale, chrome });
+    return c.html(page.html, status, {
+        ...PAGE_HEADERS,
+        "Content-Security-Policy": page.contentSecurityPolicy,
+    });
 }
-function unsubscribedPage(resubscribeToken, locale) {
-    const lang = pageLocale(locale);
-    return htmlPage(lang, mailT(lang, "mail.unsubscribe.doneTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>
-<form method="post" action="${DELIVERY_RESUBSCRIBE_PATH}">
-<input type="hidden" name="token" value="${escapeHtmlAttr(resubscribeToken)}">
-<button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.undoButton"))}</button>
-</form>`);
+function localeFromAcceptLanguage(header) {
+    const first = header?.split(",")[0]?.split(";")[0]?.trim();
+    return first !== undefined && first !== "" && localeClaimSchema.safeParse(first).success
+        ? first
+        : undefined;
 }
-function resubscribedPage(locale) {
-    const lang = pageLocale(locale);
-    return htmlPage(lang, mailT(lang, "mail.unsubscribe.resubscribedTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`);
+// A browser lands on a page even for a dead link; API callers keep the JSON 400 from
+// verifyUnsubscribeToken. The rejected result never reaches a write.
+async function verifyForPage(token, encodedSecret, purpose, headers) {
+    try {
+        return await verifyUnsubscribeToken(token, encodedSecret, purpose);
+    }
+    catch (err) {
+        if (err instanceof ExpiredUnsubscribeTokenRejection) {
+            return {
+                kind: "rejected",
+                tenantId: err.tenantId,
+                locale: err.locale ?? localeFromAcceptLanguage(headers["accept-language"]),
+            };
+        }
+        if (err instanceof ExtraRouteRejection) {
+            return {
+                kind: "rejected",
+                tenantId: undefined,
+                locale: localeFromAcceptLanguage(headers["accept-language"]),
+            };
+        }
+        throw err;
+    }
 }
-function failedPage(locale) {
-    const lang = pageLocale(locale);
-    const message = mailT(lang, "mail.unsubscribe.failed");
-    return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
+async function verifyPost(request, token, encodedSecret, purpose) {
+    return isFormRequest(request.headers["content-type"])
+        ? verifyForPage(token, encodedSecret, purpose, request.headers)
+        : verifyUnsubscribeToken(token, encodedSecret, purpose);
 }
 function isFormRequest(contentType) {
     return contentType?.includes("application/x-www-form-urlencoded") === true;
@@ -329,30 +409,40 @@ export function createUnsubscribeRoutes(options) {
         method: "GET",
         path: DELIVERY_UNSUBSCRIBE_PATH,
         entry: "signature",
-        verify: async ({ query }) => {
+        verify: async ({ query, headers }) => {
             const token = query["token"];
-            if (!token) {
-                throw new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "missing unsubscribe token");
-            }
-            const verified = await verifyUnsubscribeToken(token, encodedSecret, "unsubscribe");
-            return { token, locale: verified.locale };
+            const verified = await verifyForPage(token, encodedSecret, "unsubscribe", headers);
+            if (verified.kind === "rejected")
+                return verified;
+            // verifyForPage only accepts a present token, the check is for the type.
+            if (token === undefined)
+                return { kind: "rejected", tenantId: undefined, locale: undefined };
+            return { kind: "confirm", token, tenantId: verified.tenantId, locale: verified.locale };
         },
-        handler: async (c, { token, locale }) => c.html(confirmationPage(token, locale), 200, CONFIRMATION_PAGE_HEADERS),
+        handler: async (c, verified, deps) => verified.kind === "rejected"
+            ? pageResponse(c, deps, { kind: "invalid" }, verified, 400)
+            : pageResponse(c, deps, { kind: "confirm", token: verified.token }, verified, 200),
     });
     const writeRoute = signatureRoute({
         method: "POST",
         path: DELIVERY_UNSUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyUnsubscribeToken(tokenFromPostRequest(request), encodedSecret, "unsubscribe"),
+        verify: async (request) => verifyPost(request, tokenFromPostRequest(request), encodedSecret, "unsubscribe"),
         handler: async (c, verified, deps) => {
+            if (verified.kind === "rejected") {
+                return pageResponse(c, deps, { kind: "invalid" }, verified, 400);
+            }
             // Token-verify passed — everything below is a legitimate write. Don't
             // swallow write-errors as "invalid token", that would mask real bugs
             // (e.g. events-table missing, DB down) behind a misleading 400.
             const succeeded = await dispatchUnsubscribeWrite(verified, deps);
             if (!succeeded) {
-                return c.html(failedPage(verified.locale), 500, { "Cache-Control": "no-store" });
+                return pageResponse(c, deps, { kind: "failed" }, verified, 500);
             }
-            return c.html(unsubscribedPage(await signResubscribeToken(verified, encodedSecret), verified.locale), 200, { "Cache-Control": "no-store" });
+            return pageResponse(c, deps, {
+                kind: "unsubscribed",
+                resubscribeToken: await signResubscribeToken(verified, encodedSecret),
+            }, verified, 200);
         },
     });
     // Undo direction: token only from the JSON/form body, never the query
@@ -362,28 +452,25 @@ export function createUnsubscribeRoutes(options) {
         method: "POST",
         path: DELIVERY_RESUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyUnsubscribeToken(tokenFromRequestBody(request), encodedSecret, "resubscribe"),
+        verify: async (request) => verifyPost(request, tokenFromRequestBody(request), encodedSecret, "resubscribe"),
         handler: async (c, verified, deps) => {
+            if (verified.kind === "rejected") {
+                return pageResponse(c, deps, { kind: "invalid" }, verified, 400);
+            }
             const outcome = await dispatchResubscribeWrite(verified, deps);
             // The undo button on the unsubscribed page posts a form; a browser should land on a page.
             if (isFormRequest(c.req.header("content-type"))) {
                 return outcome === "success"
-                    ? c.html(resubscribedPage(verified.locale), 200, { "Cache-Control": "no-store" })
-                    : c.html(failedPage(verified.locale), outcome === "limit_reached" ? 409 : 500, {
-                        "Cache-Control": "no-store",
-                    });
+                    ? pageResponse(c, deps, { kind: "resubscribed" }, verified, 200)
+                    : pageResponse(c, deps, { kind: "failed" }, verified, outcome === "limit_reached" ? 409 : 500);
             }
             if (outcome === "limit_reached") {
-                return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, {
-                    "Cache-Control": "no-store",
-                });
+                return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, NO_STORE_HEADERS);
             }
             if (outcome === "failed") {
-                return c.json({ error: { code: "resubscribe_failed" } }, 500, {
-                    "Cache-Control": "no-store",
-                });
+                return c.json({ error: { code: "resubscribe_failed" } }, 500, NO_STORE_HEADERS);
             }
-            return c.json({ isSuccess: true }, 200, { "Cache-Control": "no-store" });
+            return c.json({ isSuccess: true }, 200, NO_STORE_HEADERS);
         },
     });
     return [confirmRoute, writeRoute, resubscribeRoute];

package/dist/delivery/web/index.d.ts

@@ -1,2 +1,2 @@
-export { type DeliveryClientOptions, deliveryClient } from "./client-plugin.js";
-export { DeliveryStatusCell } from "./delivery-status-cell.js";
+export { type DeliveryClientOptions, deliveryClient } from "./client-plugin.tsx";
+export { DeliveryStatusCell } from "./delivery-status-cell.tsx";

package/dist/derivatives-sharp/feature.d.ts

@@ -1,7 +1,3 @@
 export declare function createDerivativesSharpFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
-/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const derivativesSharpFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};

package/dist/derivatives-sharp/feature.js

@@ -15,5 +15,3 @@ export function createDerivativesSharpFeature() {
         r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const derivativesSharpFeature = createDerivativesSharpFeature();

package/dist/derivatives-sharp/index.d.ts

@@ -1,2 +1,2 @@
-export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
-export { imageMetadata } from "./render.js";
+export { createDerivativesSharpFeature } from "./feature.ts";
+export { imageMetadata } from "./render.ts";

package/dist/derivatives-sharp/index.js

@@ -1,2 +1,2 @@
-export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
+export { createDerivativesSharpFeature } from "./feature.js";
 export { imageMetadata } from "./render.js";

package/dist/document-ingest-foundation/feature.d.ts

@@ -4,10 +4,3 @@ export declare function createDocumentIngestFoundationFeature(): import("@cosmic
         maxPagesPerFileConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
     };
 };
-/** @deprecated Use createDocumentIngestFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const documentIngestFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: {
-        ocrLanguageConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
-        maxPagesPerFileConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
-    };
-};

package/dist/document-ingest-foundation/feature.js

@@ -175,5 +175,3 @@ export function createDocumentIngestFoundationFeature() {
         return { ocrLanguageConfigKey, maxPagesPerFileConfigKey };
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createDocumentIngestFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const documentIngestFoundationFeature = createDocumentIngestFoundationFeature();

package/dist/document-ingest-foundation/index.d.ts

@@ -1,7 +1,7 @@
-export { documentIngestAggregateId } from "./aggregate-id.js";
-export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.js";
-export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
-export { createDocumentIngestFoundationFeature, documentIngestFoundationFeature, } from "./feature.js";
-export { readIngestPages, writeIngestPages } from "./pages.js";
-export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.js";
-export { type DocumentExtractWriteResult, writeDocumentExtractForLiveFileRef, } from "./write-document-extract.js";
+export { documentIngestAggregateId } from "./aggregate-id.ts";
+export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.ts";
+export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.ts";
+export { createDocumentIngestFoundationFeature } from "./feature.ts";
+export { readIngestPages, writeIngestPages } from "./pages.ts";
+export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.ts";
+export { type DocumentExtractWriteResult, writeDocumentExtractForLiveFileRef, } from "./write-document-extract.ts";

package/dist/document-ingest-foundation/index.js

@@ -2,7 +2,7 @@
 export { documentIngestAggregateId } from "./aggregate-id.js";
 export { documentExtractEntity, documentExtractsTable, } from "./entity.js";
 export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
-export { createDocumentIngestFoundationFeature, documentIngestFoundationFeature, } from "./feature.js";
+export { createDocumentIngestFoundationFeature } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, resolveDocumentIngestProviders, } from "./providers.js";
 export { writeDocumentExtractForLiveFileRef, } from "./write-document-extract.js";

package/dist/document-ingest-foundation/pages.d.ts

@@ -1,3 +1,3 @@
-import type { IngestPage } from "./entity.js";
+import type { IngestPage } from "./entity.ts";
 export declare function writeIngestPages(pages: readonly IngestPage[]): string;
 export declare function readIngestPages(raw: unknown): IngestPage[];

package/dist/document-ingest-foundation/providers.d.ts

@@ -1,6 +1,6 @@
 import type { FeatureDefinition, Registry } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DOCUMENT_INGEST_REQUESTED_EVENT_QN } from "./events.js";
+import { DOCUMENT_INGEST_REQUESTED_EVENT_QN } from "./events.ts";
 export declare const EXT_DOCUMENT_INGEST_PROVIDER: "documentIngestProvider";
 export declare const documentIngestProviderOptionsSchema: z.ZodObject<{
     mimeTypes: z.ZodArray<z.ZodString>;

package/dist/document-ingest-foundation/write-document-extract.d.ts

@@ -1,6 +1,6 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { type DocumentExtractMeta, type IngestPage } from "./entity.js";
+import { type DocumentExtractMeta, type IngestPage } from "./entity.ts";
 export type DocumentExtractWriteResult = {
     readonly kind: "written";
     readonly documentExtractId: string;

package/dist/feature-toggles/compose-tier-resolver.d.ts

@@ -1,3 +1,3 @@
 import { type EffectiveFeaturesResolver, type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import type { GlobalFeatureToggleRuntime } from "./toggle-runtime.js";
+import type { GlobalFeatureToggleRuntime } from "./toggle-runtime.ts";
 export declare function composeTierResolverWithGlobalToggles(tierResolver: EffectiveFeaturesResolver, toggleRuntime: GlobalFeatureToggleRuntime, registry: Registry): EffectiveFeaturesResolver;