@cosmicdrift/kumiko-bundled-features 0.369.0 → 0.370.0

package/dist/delivery/unsubscribe.js

@@ -1,12 +1,12 @@
 import { ExtraRouteRejection, signatureRoute, } from "@cosmicdrift/kumiko-framework/api";
-import { mailT, resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
-import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as jose from "jose";
 import * as z from "zod";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
-import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, } from "./constants.js";
-import "./unsubscribe-page-strings.js";
+import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryQueries, } from "./constants.js";
+import { renderUnsubscribePage } from "./unsubscribe-page.js";
 // The mail's locale, so the pages behind the link speak the mail's language. Optional: links
 // signed before the claim existed keep verifying and fall back to English.
 const localeClaimSchema = z
@@ -59,6 +59,32 @@ function localeClaim(locale) {
 const UNSUBSCRIBE_TOKEN_INVALID_BODY = {
     error: { code: "unsubscribe_token_invalid", message: "Invalid or expired token" },
 };
+// jose checks the signature and the issuer before the expiry, so the claims of an
+// expired token are authentic: enough to dress the "link expired" page in the
+// tenant's look and language, never enough to write.
+const expiredTokenScopeSchema = z.object({
+    iss: z.literal(UNSUBSCRIBE_ISSUER),
+    tenantId: z.string().min(1),
+    locale: localeClaimSchema,
+});
+class ExpiredUnsubscribeTokenRejection extends ExtraRouteRejection {
+    tenantId;
+    locale;
+    constructor(tenantId, locale) {
+        super(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "unsubscribe token expired");
+        this.tenantId = tenantId;
+        this.locale = locale;
+    }
+}
+function expiredTokenRejection(err) {
+    if (!(err instanceof jose.errors.JWTExpired))
+        return null;
+    const scope = expiredTokenScopeSchema.safeParse(err.payload);
+    if (!scope.success)
+        return null;
+    // @cast-boundary engine-bridge — string post-zod → branded TenantId
+    return new ExpiredUnsubscribeTokenRejection(scope.data.tenantId, scope.data.locale);
+}
 export async function signUnsubscribeToken(payload, secret) {
     assertUnsubscribeSecret(secret, "signUnsubscribeToken");
     const encodedSecret = new TextEncoder().encode(secret);
@@ -108,10 +134,6 @@ export async function signAddressUnsubscribeToken(payload, secret) {
 // RFC 8058 fixed value — both the List-Unsubscribe-Post header and the body a
 // one-click client POSTs.
 export const DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE = "List-Unsubscribe=One-Click";
-const CONFIRMATION_PAGE_HEADERS = {
-    "Cache-Control": "no-store",
-    "Referrer-Policy": "no-referrer",
-};
 // Undo token, handed out only in the response of a successful unsubscribe. A
 // separate audience and a short expiry keep the long-lived mailed unsubscribe
 // link from being able to undo an opt-out (and vice versa).
@@ -193,7 +215,8 @@ async function verifyUnsubscribeToken(token, encodedSecret, purpose) {
     catch (err) {
         if (err instanceof ExtraRouteRejection)
             throw err;
-        throw new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "unsubscribe token verification failed");
+        throw (expiredTokenRejection(err) ??
+            new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "unsubscribe token verification failed"));
     }
 }
 async function dispatchUnsubscribeWrite(verified, deps) {
@@ -250,52 +273,102 @@ async function dispatchResubscribeWrite(verified, deps) {
 function pageLocale(locale) {
     return resolveMailLocale(locale ?? "en");
 }
-function htmlPage(locale, title, bodyHtml) {
-    return `<!doctype html>
-<html lang="${escapeHtmlAttr(locale)}">
-<head>
-<meta charset="utf-8">
-<meta name="robots" content="noindex">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escapeHtmlAttr(title)}</title>
-</head>
-<body>
-${bodyHtml}
-</body>
-</html>`;
+/** The result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`;
+ *  `chrome` (the mail renderer's readMailChrome) adds the tenant's brand row and footer.
+ *  Served under runProdApp's default CSP the style block and the same-origin font pass;
+ *  an https logo additionally needs its origin, e.g.
+ *  `securityHeaders: { csp: { extend: { "img-src": [logoOrigin] } } }`. A hand-written CSP
+ *  needs `style-src 'unsafe-inline'` as well. */
+export function renderUnsubscribeResultPage(page) {
+    const { locale, chrome, ...state } = page;
+    return renderUnsubscribePage({ state, locale: pageLocale(locale), chrome }).html;
 }
-function confirmationPage(token, locale) {
-    const lang = pageLocale(locale);
-    return htmlPage(lang, mailT(lang, "mail.unsubscribe.confirmTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.confirmQuestion"))}</p>
-<form method="post" action="${DELIVERY_UNSUBSCRIBE_PATH}">
-<input type="hidden" name="token" value="${escapeHtmlAttr(token)}">
-<button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.confirmButton"))}</button>
-</form>`);
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
+const mailChromeLinkSchema = z.object({ label: z.string(), url: z.string() });
+const mailChromeSchema = z
+    .object({
+    tenantName: z.string(),
+    brandSuffix: z.string(),
+    logoUrl: z.string().optional(),
+    accentColor: z.string().optional(),
+    siteUrl: z.string().optional(),
+    footerText: z.string().optional(),
+    imprint: mailChromeLinkSchema.optional(),
+    privacy: mailChromeLinkSchema.optional(),
+})
+    .nullable();
+// Branding is decoration: an opt-out that went through must never turn into an
+// error page because a footer resolver or the config read failed.
+async function readPageChrome(deps, tenantId, locale) {
+    try {
+        const result = await deps.dispatchSystemQuery({
+            handlerQn: DeliveryQueries.unsubscribePageChrome,
+            payload: { locale },
+            tenantId,
+        });
+        const parsed = mailChromeSchema.safeParse(result);
+        return parsed.success ? parsed.data : null;
+    }
+    catch (err) {
+        createFallbackLogger("delivery").warn("unsubscribe page shown without tenant branding", {
+            errorName: err instanceof Error ? err.name : typeof err,
+        });
+        return null;
+    }
 }
-/** The plain result page the unsubscribe routes answer with, for apps serving their own
- *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`. */
-export function renderUnsubscribeResultPage(page) {
-    const lang = pageLocale(page.locale);
-    switch (page.kind) {
-        case "unsubscribed": {
-            const undoForm = page.resubscribeToken === undefined
-                ? ""
-                : `
-<form method="post" action="${DELIVERY_RESUBSCRIBE_PATH}">
-<input type="hidden" name="token" value="${escapeHtmlAttr(page.resubscribeToken)}">
-<button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.undoButton"))}</button>
-</form>`;
-            return htmlPage(lang, mailT(lang, "mail.unsubscribe.doneTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>${undoForm}`);
+// no-referrer on every page: the GET page carries the token in its URL, and the
+// tenant logo and site link would otherwise receive it in the Referer header.
+const PAGE_HEADERS = {
+    "Cache-Control": "no-store",
+    "Referrer-Policy": "no-referrer",
+};
+async function pageResponse(
+// biome-ignore lint/suspicious/noExplicitAny: Hono context generics are invisible at the framework boundary
+c, deps, state, scope, status) {
+    const locale = pageLocale(scope.locale);
+    const chrome = scope.tenantId === undefined ? null : await readPageChrome(deps, scope.tenantId, locale);
+    const page = renderUnsubscribePage({ state, locale, chrome });
+    return c.html(page.html, status, {
+        ...PAGE_HEADERS,
+        "Content-Security-Policy": page.contentSecurityPolicy,
+    });
+}
+function localeFromAcceptLanguage(header) {
+    const first = header?.split(",")[0]?.split(";")[0]?.trim();
+    return first !== undefined && first !== "" && localeClaimSchema.safeParse(first).success
+        ? first
+        : undefined;
+}
+// A browser lands on a page even for a dead link; API callers keep the JSON 400 from
+// verifyUnsubscribeToken. The rejected result never reaches a write.
+async function verifyForPage(token, encodedSecret, purpose, headers) {
+    try {
+        return await verifyUnsubscribeToken(token, encodedSecret, purpose);
+    }
+    catch (err) {
+        if (err instanceof ExpiredUnsubscribeTokenRejection) {
+            return {
+                kind: "rejected",
+                tenantId: err.tenantId,
+                locale: err.locale ?? localeFromAcceptLanguage(headers["accept-language"]),
+            };
         }
-        case "resubscribed":
-            return htmlPage(lang, mailT(lang, "mail.unsubscribe.resubscribedTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`);
-        case "failed": {
-            const message = mailT(lang, "mail.unsubscribe.failed");
-            return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
+        if (err instanceof ExtraRouteRejection) {
+            return {
+                kind: "rejected",
+                tenantId: undefined,
+                locale: localeFromAcceptLanguage(headers["accept-language"]),
+            };
         }
+        throw err;
     }
 }
-const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
+async function verifyPost(request, token, encodedSecret, purpose) {
+    return isFormRequest(request.headers["content-type"])
+        ? verifyForPage(token, encodedSecret, purpose, request.headers)
+        : verifyUnsubscribeToken(token, encodedSecret, purpose);
+}
 function isFormRequest(contentType) {
     return contentType?.includes("application/x-www-form-urlencoded") === true;
 }
@@ -336,34 +409,40 @@ export function createUnsubscribeRoutes(options) {
         method: "GET",
         path: DELIVERY_UNSUBSCRIBE_PATH,
         entry: "signature",
-        verify: async ({ query }) => {
+        verify: async ({ query, headers }) => {
             const token = query["token"];
-            if (!token) {
-                throw new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "missing unsubscribe token");
-            }
-            const verified = await verifyUnsubscribeToken(token, encodedSecret, "unsubscribe");
-            return { token, locale: verified.locale };
+            const verified = await verifyForPage(token, encodedSecret, "unsubscribe", headers);
+            if (verified.kind === "rejected")
+                return verified;
+            // verifyForPage only accepts a present token, the check is for the type.
+            if (token === undefined)
+                return { kind: "rejected", tenantId: undefined, locale: undefined };
+            return { kind: "confirm", token, tenantId: verified.tenantId, locale: verified.locale };
         },
-        handler: async (c, { token, locale }) => c.html(confirmationPage(token, locale), 200, CONFIRMATION_PAGE_HEADERS),
+        handler: async (c, verified, deps) => verified.kind === "rejected"
+            ? pageResponse(c, deps, { kind: "invalid" }, verified, 400)
+            : pageResponse(c, deps, { kind: "confirm", token: verified.token }, verified, 200),
     });
     const writeRoute = signatureRoute({
         method: "POST",
         path: DELIVERY_UNSUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyUnsubscribeToken(tokenFromPostRequest(request), encodedSecret, "unsubscribe"),
+        verify: async (request) => verifyPost(request, tokenFromPostRequest(request), encodedSecret, "unsubscribe"),
         handler: async (c, verified, deps) => {
+            if (verified.kind === "rejected") {
+                return pageResponse(c, deps, { kind: "invalid" }, verified, 400);
+            }
             // Token-verify passed — everything below is a legitimate write. Don't
             // swallow write-errors as "invalid token", that would mask real bugs
             // (e.g. events-table missing, DB down) behind a misleading 400.
             const succeeded = await dispatchUnsubscribeWrite(verified, deps);
             if (!succeeded) {
-                return c.html(renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }), 500, NO_STORE_HEADERS);
+                return pageResponse(c, deps, { kind: "failed" }, verified, 500);
             }
-            return c.html(renderUnsubscribeResultPage({
+            return pageResponse(c, deps, {
                 kind: "unsubscribed",
                 resubscribeToken: await signResubscribeToken(verified, encodedSecret),
-                locale: verified.locale,
-            }), 200, NO_STORE_HEADERS);
+            }, verified, 200);
         },
     });
     // Undo direction: token only from the JSON/form body, never the query
@@ -373,14 +452,17 @@ export function createUnsubscribeRoutes(options) {
         method: "POST",
         path: DELIVERY_RESUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyUnsubscribeToken(tokenFromRequestBody(request), encodedSecret, "resubscribe"),
+        verify: async (request) => verifyPost(request, tokenFromRequestBody(request), encodedSecret, "resubscribe"),
         handler: async (c, verified, deps) => {
+            if (verified.kind === "rejected") {
+                return pageResponse(c, deps, { kind: "invalid" }, verified, 400);
+            }
             const outcome = await dispatchResubscribeWrite(verified, deps);
             // The undo button on the unsubscribed page posts a form; a browser should land on a page.
             if (isFormRequest(c.req.header("content-type"))) {
                 return outcome === "success"
-                    ? c.html(renderUnsubscribeResultPage({ kind: "resubscribed", locale: verified.locale }), 200, NO_STORE_HEADERS)
-                    : c.html(renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }), outcome === "limit_reached" ? 409 : 500, NO_STORE_HEADERS);
+                    ? pageResponse(c, deps, { kind: "resubscribed" }, verified, 200)
+                    : pageResponse(c, deps, { kind: "failed" }, verified, outcome === "limit_reached" ? 409 : 500);
             }
             if (outcome === "limit_reached") {
                 return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, NO_STORE_HEADERS);

package/dist/delivery/web/index.d.ts

@@ -1,2 +1,2 @@
-export { type DeliveryClientOptions, deliveryClient } from "./client-plugin.js";
-export { DeliveryStatusCell } from "./delivery-status-cell.js";
+export { type DeliveryClientOptions, deliveryClient } from "./client-plugin.tsx";
+export { DeliveryStatusCell } from "./delivery-status-cell.tsx";

package/dist/derivatives-sharp/feature.d.ts

@@ -1,7 +1,3 @@
 export declare function createDerivativesSharpFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
-/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const derivativesSharpFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};

package/dist/derivatives-sharp/feature.js

@@ -15,5 +15,3 @@ export function createDerivativesSharpFeature() {
         r.useExtension(EXT_DERIVATIVE_RENDERER, "image/*", plugin);
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createDerivativesSharpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const derivativesSharpFeature = createDerivativesSharpFeature();

package/dist/derivatives-sharp/index.d.ts

@@ -1,2 +1,2 @@
-export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
-export { imageMetadata } from "./render.js";
+export { createDerivativesSharpFeature } from "./feature.ts";
+export { imageMetadata } from "./render.ts";

package/dist/derivatives-sharp/index.js

@@ -1,2 +1,2 @@
-export { createDerivativesSharpFeature, derivativesSharpFeature } from "./feature.js";
+export { createDerivativesSharpFeature } from "./feature.js";
 export { imageMetadata } from "./render.js";

package/dist/document-ingest-foundation/feature.d.ts

@@ -4,10 +4,3 @@ export declare function createDocumentIngestFoundationFeature(): import("@cosmic
         maxPagesPerFileConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
     };
 };
-/** @deprecated Use createDocumentIngestFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const documentIngestFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: {
-        ocrLanguageConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
-        maxPagesPerFileConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
-    };
-};

package/dist/document-ingest-foundation/feature.js

@@ -175,5 +175,3 @@ export function createDocumentIngestFoundationFeature() {
         return { ocrLanguageConfigKey, maxPagesPerFileConfigKey };
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createDocumentIngestFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const documentIngestFoundationFeature = createDocumentIngestFoundationFeature();

package/dist/document-ingest-foundation/index.d.ts

@@ -1,7 +1,7 @@
-export { documentIngestAggregateId } from "./aggregate-id.js";
-export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.js";
-export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
-export { createDocumentIngestFoundationFeature, documentIngestFoundationFeature, } from "./feature.js";
-export { readIngestPages, writeIngestPages } from "./pages.js";
-export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.js";
-export { type DocumentExtractWriteResult, writeDocumentExtractForLiveFileRef, } from "./write-document-extract.js";
+export { documentIngestAggregateId } from "./aggregate-id.ts";
+export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.ts";
+export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.ts";
+export { createDocumentIngestFoundationFeature } from "./feature.ts";
+export { readIngestPages, writeIngestPages } from "./pages.ts";
+export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.ts";
+export { type DocumentExtractWriteResult, writeDocumentExtractForLiveFileRef, } from "./write-document-extract.ts";

package/dist/document-ingest-foundation/index.js

@@ -2,7 +2,7 @@
 export { documentIngestAggregateId } from "./aggregate-id.js";
 export { documentExtractEntity, documentExtractsTable, } from "./entity.js";
 export { DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
-export { createDocumentIngestFoundationFeature, documentIngestFoundationFeature, } from "./feature.js";
+export { createDocumentIngestFoundationFeature } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, resolveDocumentIngestProviders, } from "./providers.js";
 export { writeDocumentExtractForLiveFileRef, } from "./write-document-extract.js";

package/dist/document-ingest-foundation/pages.d.ts

@@ -1,3 +1,3 @@
-import type { IngestPage } from "./entity.js";
+import type { IngestPage } from "./entity.ts";
 export declare function writeIngestPages(pages: readonly IngestPage[]): string;
 export declare function readIngestPages(raw: unknown): IngestPage[];

package/dist/document-ingest-foundation/providers.d.ts

@@ -1,6 +1,6 @@
 import type { FeatureDefinition, Registry } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DOCUMENT_INGEST_REQUESTED_EVENT_QN } from "./events.js";
+import { DOCUMENT_INGEST_REQUESTED_EVENT_QN } from "./events.ts";
 export declare const EXT_DOCUMENT_INGEST_PROVIDER: "documentIngestProvider";
 export declare const documentIngestProviderOptionsSchema: z.ZodObject<{
     mimeTypes: z.ZodArray<z.ZodString>;

package/dist/document-ingest-foundation/write-document-extract.d.ts

@@ -1,6 +1,6 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { type DocumentExtractMeta, type IngestPage } from "./entity.js";
+import { type DocumentExtractMeta, type IngestPage } from "./entity.ts";
 export type DocumentExtractWriteResult = {
     readonly kind: "written";
     readonly documentExtractId: string;

package/dist/feature-toggles/compose-tier-resolver.d.ts

@@ -1,3 +1,3 @@
 import { type EffectiveFeaturesResolver, type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import type { GlobalFeatureToggleRuntime } from "./toggle-runtime.js";
+import type { GlobalFeatureToggleRuntime } from "./toggle-runtime.ts";
 export declare function composeTierResolverWithGlobalToggles(tierResolver: EffectiveFeaturesResolver, toggleRuntime: GlobalFeatureToggleRuntime, registry: Registry): EffectiveFeaturesResolver;

package/dist/feature-toggles/feature.d.ts

@@ -1,10 +1,10 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import type { GlobalFeatureToggleRuntime } from "./toggle-runtime.js";
+import type { GlobalFeatureToggleRuntime } from "./toggle-runtime.ts";
 export type FeatureTogglesOptions = {
     readonly getRuntime?: () => GlobalFeatureToggleRuntime;
 };
 export declare function createFeatureTogglesFeature(options?: FeatureTogglesOptions): FeatureDefinition;
-export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./constants.js";
-export { globalFeatureStateTable, globalFeatureStateTableMeta, } from "./global-feature-state-table.js";
-export { createFeatureToggleRuntime, GlobalFeatureToggleRuntime, type ToggleSyncSignal, } from "./toggle-runtime.js";
-export { createRedisToggleSyncSignal, type RedisToggleSyncSignal } from "./toggle-sync-signal.js";
+export { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors } from "./constants.ts";
+export { globalFeatureStateTable, globalFeatureStateTableMeta, } from "./global-feature-state-table.ts";
+export { createFeatureToggleRuntime, GlobalFeatureToggleRuntime, type ToggleSyncSignal, } from "./toggle-runtime.ts";
+export { createRedisToggleSyncSignal, type RedisToggleSyncSignal } from "./toggle-sync-signal.ts";

package/dist/feature-toggles/handlers/set.write.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { GlobalFeatureToggleRuntime } from "../toggle-runtime.js";
+import type { GlobalFeatureToggleRuntime } from "../toggle-runtime.ts";
 export declare function createSetWriteHandler(getRuntime: (() => GlobalFeatureToggleRuntime) | undefined): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"set", z.ZodObject<{
     featureName: z.ZodString;
     enabled: z.ZodBoolean;

package/dist/feature-toggles/index.d.ts

@@ -1,3 +1,3 @@
-export { composeTierResolverWithGlobalToggles } from "./compose-tier-resolver.js";
-export { FEATURE_TOGGLES_FEATURE, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./constants.js";
-export { createFeatureToggleRuntime, createFeatureTogglesFeature, createRedisToggleSyncSignal, FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors, type FeatureTogglesOptions, GlobalFeatureToggleRuntime, globalFeatureStateTable, globalFeatureStateTableMeta, type RedisToggleSyncSignal, type ToggleSyncSignal, } from "./feature.js";
+export { composeTierResolverWithGlobalToggles } from "./compose-tier-resolver.ts";
+export { FEATURE_TOGGLES_FEATURE, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./constants.ts";
+export { createFeatureToggleRuntime, createFeatureTogglesFeature, createRedisToggleSyncSignal, FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleErrors, type FeatureTogglesOptions, GlobalFeatureToggleRuntime, globalFeatureStateTable, globalFeatureStateTableMeta, type RedisToggleSyncSignal, type ToggleSyncSignal, } from "./feature.ts";

package/dist/feature-toggles/toggle-sync-signal.d.ts

@@ -1,5 +1,5 @@
 import { type CacheSyncBus, type RedisClientOptions } from "@cosmicdrift/kumiko-framework/redis";
-import type { ToggleSyncSignal } from "./toggle-runtime.js";
+import type { ToggleSyncSignal } from "./toggle-runtime.ts";
 export type RedisToggleSyncSignal = ToggleSyncSignal & {
     close(): Promise<void>;
 };

package/dist/feature-toggles/web/index.d.ts

@@ -1 +1 @@
-export { type FeatureTogglesClientOptions, featureTogglesClient, } from "./client-plugin.js";
+export { type FeatureTogglesClientOptions, featureTogglesClient, } from "./client-plugin.tsx";

package/dist/file-derivatives/feature.d.ts

@@ -25,5 +25,3 @@ export type FileDerivativesOptions = {
     readonly publicTenantResolution?: PublicVariantTenantResolution;
 };
 export declare function createFileDerivativesFeature(opts?: FileDerivativesOptions): FeatureDefinition;
-/** @deprecated Use createFileDerivativesFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const fileDerivativesFeature: FeatureDefinition;

package/dist/file-derivatives/feature.js

@@ -163,5 +163,3 @@ export function createFileDerivativesFeature(opts = {}) {
         }
     }, Object.keys(opts).length === 0 ? { dedupeOptions: {} } : undefined);
 }
-/** @deprecated Use createFileDerivativesFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const fileDerivativesFeature = createFileDerivativesFeature();

package/dist/file-derivatives/index.d.ts

@@ -1,4 +1,4 @@
-export type { FileDerivativesOptions, PublicVariantResolveApexTenant, PublicVariantTenantResolution, } from "./feature.js";
-export { createFileDerivativesFeature, fileDerivativesFeature } from "./feature.js";
-export type { DerivativePublicPredicateArgs, DerivativePublicPredicatePlugin, } from "./handlers/public-variant.query.js";
-export { card, full, hero, thumb } from "./presets.js";
+export type { FileDerivativesOptions, PublicVariantResolveApexTenant, PublicVariantTenantResolution, } from "./feature.ts";
+export { createFileDerivativesFeature } from "./feature.ts";
+export type { DerivativePublicPredicateArgs, DerivativePublicPredicatePlugin, } from "./handlers/public-variant.query.ts";
+export { card, full, hero, thumb } from "./presets.ts";

package/dist/file-derivatives/index.js

@@ -1,2 +1,2 @@
-export { createFileDerivativesFeature, fileDerivativesFeature } from "./feature.js";
+export { createFileDerivativesFeature } from "./feature.js";
 export { card, full, hero, thumb } from "./presets.js";

package/dist/file-foundation/feature.d.ts

@@ -5,9 +5,3 @@ export declare function createFileFoundationFeature(): import("@cosmicdrift/kumi
         providerConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
     };
 };
-/** @deprecated Use createFileFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const fileFoundationFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: {
-        providerConfigKey: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
-    };
-};

package/dist/file-foundation/feature.js

@@ -47,5 +47,3 @@ export function createFileFoundationFeature() {
         return { providerConfigKey };
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createFileFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const fileFoundationFeature = createFileFoundationFeature();

package/dist/file-foundation/index.d.ts

@@ -1,2 +1,2 @@
-export { createFileFoundationFeature, createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
-export { type FileRefContent, FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";
+export { createFileFoundationFeature, createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, isFileProviderPlugin, } from "./feature.ts";
+export { type FileRefContent, FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.ts";

package/dist/file-foundation/index.js

@@ -1,3 +1,3 @@
 // Public API of the file-foundation bundled-feature.
-export { createFileFoundationFeature, createFileProviderForTenant, fileFoundationFeature, isFileProviderPlugin, } from "./feature.js";
+export { createFileFoundationFeature, createFileProviderForTenant, isFileProviderPlugin, } from "./feature.js";
 export { FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-provider-inmemory/feature.d.ts

@@ -5,7 +5,3 @@ export declare function clearStorage(tenantId: string): void;
 export declare function createFileProviderInMemoryFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
-/** @deprecated Use createFileProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const fileProviderInMemoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};

package/dist/file-provider-inmemory/feature.js

@@ -64,5 +64,3 @@ export function createFileProviderInMemoryFeature() {
         r.useExtension("fileProvider", "inmemory", plugin);
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createFileProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const fileProviderInMemoryFeature = createFileProviderInMemoryFeature();

package/dist/file-provider-inmemory/index.d.ts

@@ -1 +1 @@
-export { clearStorage, createFileProviderInMemoryFeature, fileProviderInMemoryFeature, listKeys, } from "./feature.js";
+export { clearStorage, createFileProviderInMemoryFeature, listKeys, } from "./feature.ts";

package/dist/file-provider-inmemory/index.js

@@ -1,2 +1,2 @@
 // Public API of the file-provider-inmemory bundled-feature.
-export { clearStorage, createFileProviderInMemoryFeature, fileProviderInMemoryFeature, listKeys, } from "./feature.js";
+export { clearStorage, createFileProviderInMemoryFeature, listKeys, } from "./feature.js";

package/dist/file-provider-s3/env-feature.d.ts

@@ -1,3 +1,13 @@
-export declare function createFileProviderS3EnvFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
+export declare function createFileProviderS3EnvFeature(): import("@cosmicdrift/kumiko-framework/env").FeatureWithEnvSchema<import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
-};
+}, {
+    S3_ACCESS_KEY: import("zod").ZodOptional<import("zod").ZodString>;
+    S3_BUCKET: import("zod").ZodOptional<import("zod").ZodString>;
+    S3_ENDPOINT: import("zod").ZodOptional<import("zod").ZodUnion<[import("zod").ZodPipe<import("zod").ZodLiteral<"">, import("zod").ZodTransform<undefined, "">>, import("zod").ZodURL]>>;
+    S3_FORCE_PATH_STYLE: import("zod").ZodOptional<import("zod").ZodEnum<{
+        true: "true";
+        false: "false";
+    }>>;
+    S3_REGION: import("zod").ZodOptional<import("zod").ZodString>;
+    S3_SECRET_KEY: import("zod").ZodOptional<import("zod").ZodString>;
+}>;

package/dist/file-provider-s3/env-feature.js

@@ -14,17 +14,18 @@
 // **Pattern-Vorbild:** mirrors file-provider-inmemory (zero admin seeding,
 // only the file-foundation plugin-point required).
 //
-// **Env vars** (read by createS3ProviderFromEnv, prefix `S3_`):
-//   required — S3_BUCKET, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY
-//   optional — S3_ENDPOINT (S3-compat stores incl. Hetzner Object Storage),
-//              S3_FORCE_PATH_STYLE
-// Missing required vars throw on the FIRST file op (inside the export cron).
+// **Env vars** (read by createS3ProviderFromEnv, declared in s3EnvSchema):
+//   S3_BUCKET, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY, optional S3_ENDPOINT
+//   and S3_FORCE_PATH_STYLE. The schema keeps them optional because apps mount
+//   this provider next to another one; missing vars throw on the FIRST file op.
 // The user-data-rights boot guard surfaces that at boot instead.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { s3EnvSchema } from "./env-schema.js";
 import { createS3ProviderFromEnv } from "./lib/env-helper.js";
 const FEATURE_NAME = "file-provider-s3-env";
 export function createFileProviderS3EnvFeature() {
-    return defineFeature(FEATURE_NAME, (r) => {
+    const feature = defineFeature(FEATURE_NAME, (r) => {
         r.describe('Registers an `"s3-env"` provider for `file-foundation` that reads one S3 credential set from `process.env` (`S3_BUCKET`/`S3_REGION`/`S3_ACCESS_KEY`/`S3_SECRET_KEY`, optional `S3_ENDPOINT`/`S3_FORCE_PATH_STYLE`) and serves every tenant from one shared bucket — no per-tenant config or secret seeding. Use this for single-bucket S3-compatible deploys (e.g. Hetzner Object Storage); use `file-provider-s3` instead when each tenant needs its own bucket/credentials.');
         r.uiHints({
             displayLabel: "File Provider · S3 (env)",
@@ -35,6 +36,7 @@ export function createFileProviderS3EnvFeature() {
         // env, not the per-tenant config + secrets store. Only the file-foundation
         // plugin-extension-point must be mounted.
         r.requires({ features: ["file-foundation"] });
+        r.envSchema(s3EnvSchema);
         const plugin = {
             // tenantId ignored: one shared bucket serves all tenants (isolation via
             // tenant-prefixed / UUID keys). Built fresh per call like file-provider-s3;
@@ -43,4 +45,5 @@ export function createFileProviderS3EnvFeature() {
         };
         r.useExtension("fileProvider", "s3-env", plugin);
     }, { dedupeOptions: {} });
+    return featureWithEnvSchema(feature, s3EnvSchema);
 }