@cosmicdrift/kumiko-bundled-features 0.369.0 → 0.371.0

package/dist/notes-history/feature.d.ts

@@ -39,8 +39,4 @@ export type NotesHistoryFeatureOptions = {
     readonly parents?: readonly string[];
 };
 export declare function createNotesHistoryFeature(opts?: NotesHistoryFeatureOptions): typeof defaultNotesHistoryFeature;
-/** @deprecated Use createNotesHistoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const notesHistoryFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};
 export {};

package/dist/notes-history/feature.js

@@ -69,5 +69,3 @@ export function createNotesHistoryFeature(opts = {}) {
     }
     return defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) => registerNotesHistory(r, resolveAccess(opts), opts.ownership, opts.parents));
 }
-/** @deprecated Use createNotesHistoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const notesHistoryFeature = createNotesHistoryFeature();

package/dist/notes-history/handlers/add-note.write.d.ts

@@ -1,4 +1,4 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { noteEntryExecutor } from "../executor.js";
+import { noteEntryExecutor } from "../executor.ts";
 export declare function createAddNoteHandler(access?: AccessRule, entryExecutor?: typeof noteEntryExecutor): WriteHandlerDef;
 export declare const addNoteHandler: WriteHandlerDef;

package/dist/notes-history/index.d.ts

@@ -1,6 +1,6 @@
-export { DEFAULT_NOTES_HISTORY_ACCESS, DEFAULT_NOTES_HISTORY_ROLES, NOTES_HISTORY_FEATURE_NAME, NOTES_SECTION_EXTENSION_NAME, NotesHistoryHandlers, NotesHistoryQueries, } from "./constants.js";
-export { noteEntryEntity, noteMentionEntity } from "./entity.js";
-export { noteEntryExecutor, noteEntryTable, noteMentionExecutor, noteMentionTable, } from "./executor.js";
-export { createNotesHistoryFeature, type NotesHistoryFeatureOptions, notesHistoryFeature, } from "./feature.js";
-export { addNoteHandler, createAddNoteHandler, } from "./handlers/add-note.write.js";
-export { type AddNotePayload, addNotePayloadSchema } from "./schemas.js";
+export { DEFAULT_NOTES_HISTORY_ACCESS, DEFAULT_NOTES_HISTORY_ROLES, NOTES_HISTORY_FEATURE_NAME, NOTES_SECTION_EXTENSION_NAME, NotesHistoryHandlers, NotesHistoryQueries, } from "./constants.ts";
+export { noteEntryEntity, noteMentionEntity } from "./entity.ts";
+export { noteEntryExecutor, noteEntryTable, noteMentionExecutor, noteMentionTable, } from "./executor.ts";
+export { createNotesHistoryFeature, type NotesHistoryFeatureOptions, } from "./feature.ts";
+export { addNoteHandler, createAddNoteHandler, } from "./handlers/add-note.write.ts";
+export { type AddNotePayload, addNotePayloadSchema } from "./schemas.ts";

package/dist/notes-history/index.js

@@ -1,6 +1,6 @@
 export { DEFAULT_NOTES_HISTORY_ACCESS, DEFAULT_NOTES_HISTORY_ROLES, NOTES_HISTORY_FEATURE_NAME, NOTES_SECTION_EXTENSION_NAME, NotesHistoryHandlers, NotesHistoryQueries, } from "./constants.js";
 export { noteEntryEntity, noteMentionEntity } from "./entity.js";
 export { noteEntryExecutor, noteEntryTable, noteMentionExecutor, noteMentionTable, } from "./executor.js";
-export { createNotesHistoryFeature, notesHistoryFeature, } from "./feature.js";
+export { createNotesHistoryFeature, } from "./feature.js";
 export { addNoteHandler, createAddNoteHandler, } from "./handlers/add-note.write.js";
 export { addNotePayloadSchema } from "./schemas.js";

package/dist/notes-history/web/index.d.ts

@@ -1,3 +1,3 @@
-export { NOTES_SECTION_EXTENSION_NAME, NotesHistoryHandlers, NotesHistoryQueries, } from "../constants.js";
-export { notesHistoryClient } from "./client-plugin.js";
-export { NotesSection } from "./notes-section.js";
+export { NOTES_SECTION_EXTENSION_NAME, NotesHistoryHandlers, NotesHistoryQueries, } from "../constants.ts";
+export { notesHistoryClient } from "./client-plugin.tsx";
+export { NotesSection } from "./notes-section.tsx";

package/dist/notes-history-user-data/index.d.ts

@@ -1,8 +1,4 @@
-export { eraseNoteBodiesReachingSubject } from "./hooks.js";
+export { eraseNoteBodiesReachingSubject } from "./hooks.ts";
 export declare function createNotesHistoryUserDataFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
-/** @deprecated Use createNotesHistoryUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const notesHistoryUserDataFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};

package/dist/notes-history-user-data/index.js

@@ -26,5 +26,3 @@ export function createNotesHistoryUserDataFeature() {
         });
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createNotesHistoryUserDataFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const notesHistoryUserDataFeature = createNotesHistoryUserDataFeature();

package/dist/page-render/index.d.ts

@@ -1,7 +1,7 @@
-export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.js";
-export { type CachedSecurePageResponseInit, cachedSecurePageResponse, } from "./cached-page-response.js";
-export { sanitizeTenantCss } from "./css-sanitize.js";
-export { type PublicPageWrapLayout, type SeoHeadInput, TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
-export { renderSafeMarkdown } from "./markdown.js";
-export { securePageHeaders } from "./security-headers.js";
-export { redirectToCanonicalPath, slashVariantOf } from "./trailing-slash.js";
+export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.ts";
+export { type CachedSecurePageResponseInit, cachedSecurePageResponse, } from "./cached-page-response.ts";
+export { sanitizeTenantCss } from "./css-sanitize.ts";
+export { type PublicPageWrapLayout, type SeoHeadInput, TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.ts";
+export { renderSafeMarkdown } from "./markdown.ts";
+export { securePageHeaders } from "./security-headers.ts";
+export { redirectToCanonicalPath, slashVariantOf } from "./trailing-slash.ts";

package/dist/page-render/layout.d.ts

@@ -1,5 +1,5 @@
 import { type ApexHead } from "@cosmicdrift/kumiko-headless/apex";
-import { type BrandingTokens } from "./branding.js";
+import { type BrandingTokens } from "./branding.ts";
 export type SeoHeadInput = Omit<ApexHead, "title" | "description" | "lang">;
 export type PublicPageWrapLayout = (opts: {
     readonly title: string;

package/dist/page-render/web.d.ts

@@ -1,5 +1,5 @@
-export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.js";
-export { sanitizeTenantCss } from "./css-sanitize.js";
-export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout } from "./layout.js";
-export { renderSafeMarkdown } from "./markdown.js";
-export { securePageHeaders } from "./security-headers.js";
+export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.ts";
+export { sanitizeTenantCss } from "./css-sanitize.ts";
+export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout } from "./layout.ts";
+export { renderSafeMarkdown } from "./markdown.ts";
+export { securePageHeaders } from "./security-headers.ts";

package/dist/personal-access-tokens/feature.d.ts

@@ -1,7 +1,7 @@
 import { type FeatureDefinition, type ProjectionListScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type PatRateLimit } from "./constants.js";
-import { type CreatePatOptions } from "./handlers/create.write.js";
-import type { PatScopeConfig } from "./scopes.js";
+import { type PatRateLimit } from "./constants.ts";
+import { type CreatePatOptions } from "./handlers/create.write.ts";
+import type { PatScopeConfig } from "./scopes.ts";
 export type BindPatAutoRevokeOnPasswordChange = (revoker: (userId: string) => Promise<number>) => void;
 export declare function bindPatAutoRevokeOnPasswordChangeFromFeature(feature: FeatureDefinition): BindPatAutoRevokeOnPasswordChange | undefined;
 export type PersonalAccessTokensOptions = {

package/dist/personal-access-tokens/handlers/available-scopes.query.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { PatScopeConfig } from "../scopes.js";
+import type { PatScopeConfig } from "../scopes.ts";
 export declare function buildAvailableScopesQuery(scopes: PatScopeConfig): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"available-scopes", z.ZodObject<{}, z.core.$strip>, {
     name: string;
     label: string;

package/dist/personal-access-tokens/i18n.d.ts

@@ -1,4 +1,4 @@
-import type { PatScopeConfig } from "./scopes.js";
+import type { PatScopeConfig } from "./scopes.ts";
 type LocalizedString = {
     readonly en: string;
 };

package/dist/personal-access-tokens/index.d.ts

@@ -1,15 +1,15 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type PatRateLimit } from "./constants.js";
-export type { PatRateLimit } from "./constants.js";
-export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./constants.js";
-export type { BindPatAutoRevokeOnPasswordChange, PersonalAccessTokensOptions } from "./feature.js";
-export { bindPatAutoRevokeOnPasswordChangeFromFeature, createPersonalAccessTokensFeature, } from "./feature.js";
-export type { CreatePatOptions, PatMfaVerifyResult } from "./handlers/create.write.js";
-export { hashPatToken, mintPatToken } from "./hash.js";
-export { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN, PAT_REVOKED_EVENT_SHORT, type PatRevokedPayload, patRevokedSchema, } from "./pat-revoked-event.js";
-export { createPatResolver } from "./resolver.js";
-export { revokeAllPatTokensForUser } from "./revoke-for-user.js";
-export { apiTokenEntity, apiTokenTable } from "./schema/api-token.js";
-export type { PatScopeConfig, PatScopeDef } from "./scopes.js";
-export { expandScopes } from "./scopes.js";
+import { type PatRateLimit } from "./constants.ts";
+export type { PatRateLimit } from "./constants.ts";
+export { PAT_DEFAULT_RATE_LIMIT, PAT_FEATURE, PatHandlers, PatQueries } from "./constants.ts";
+export type { BindPatAutoRevokeOnPasswordChange, PersonalAccessTokensOptions } from "./feature.ts";
+export { bindPatAutoRevokeOnPasswordChangeFromFeature, createPersonalAccessTokensFeature, } from "./feature.ts";
+export type { CreatePatOptions, PatMfaVerifyResult } from "./handlers/create.write.ts";
+export { hashPatToken, mintPatToken } from "./hash.ts";
+export { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN, PAT_REVOKED_EVENT_SHORT, type PatRevokedPayload, patRevokedSchema, } from "./pat-revoked-event.ts";
+export { createPatResolver } from "./resolver.ts";
+export { revokeAllPatTokensForUser } from "./revoke-for-user.ts";
+export { apiTokenEntity, apiTokenTable } from "./schema/api-token.ts";
+export type { PatScopeConfig, PatScopeDef } from "./scopes.ts";
+export { expandScopes } from "./scopes.ts";
 export declare function patRateLimitFromFeature(feature: FeatureDefinition): PatRateLimit;

package/dist/personal-access-tokens/resolver.d.ts

@@ -1,6 +1,6 @@
 import type { TokenVerifier } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type PatScopeConfig } from "./scopes.js";
+import { type PatScopeConfig } from "./scopes.ts";
 export declare function createPatResolver(opts: {
     readonly db: DbConnection;
     readonly scopes: PatScopeConfig;

package/dist/personal-access-tokens/screens.d.ts

@@ -1,5 +1,5 @@
 import { type ProjectionListScreenDefinition, type SecretMintScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import type { PatScopeConfig } from "./scopes.js";
+import type { PatScopeConfig } from "./scopes.ts";
 export declare const patListScreen: ProjectionListScreenDefinition;
 export declare function patGrantOptions(scopes: PatScopeConfig): string[];
 export declare function createPatMintScreen(scopes: PatScopeConfig): SecretMintScreenDefinition;

package/dist/presets/dsgvo-self-service.d.ts

@@ -1,8 +1,10 @@
 import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type UserDataRightsOptions } from "../user-data-rights/index.js";
+import { type UserDataRightsOptions } from "../user-data-rights/index.ts";
 export type DsgvoSelfServiceOptions = {
     /** Passed through to createUserDataRightsFeature — export/deletion mail
      *  callbacks + Apex deletion HMAC. Default {} (no-op mail side). */
     readonly userDataRights?: UserDataRightsOptions;
 };
+/** @deprecated Removed in the next release. Use `composeGdprStack({ selfService: { userDataRights } })`
+ *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export declare function dsgvoSelfServiceFeatures(opts?: DsgvoSelfServiceOptions): FeatureDefinition[];

package/dist/presets/dsgvo-self-service.js

@@ -11,6 +11,8 @@ import { createUserProfileFeature } from "../user-profile/index.js";
 // comment. text-content + legal-pages stay out deliberately — legal-pages
 // has an app-specific wrapLayout, text-content is a standalone foundation;
 // both are spread in by the app itself.
+/** @deprecated Removed in the next release. Use `composeGdprStack({ selfService: { userDataRights } })`
+ *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export function dsgvoSelfServiceFeatures(opts = {}) {
     return [
         createDataRetentionFeature(),

package/dist/presets/index.d.ts

@@ -1,2 +1,2 @@
-export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service.js";
-export { type SecurityBaselineOptions, securityBaselineFeatures } from "./security-baseline.js";
+export { type DsgvoSelfServiceOptions, dsgvoSelfServiceFeatures } from "./dsgvo-self-service.ts";
+export { type SecurityBaselineOptions, securityBaselineFeatures } from "./security-baseline.ts";

package/dist/presets/security-baseline.d.ts

@@ -2,4 +2,6 @@ import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export type SecurityBaselineOptions = {
     readonly includeSessions?: boolean;
 };
+/** @deprecated Removed in the next release. Use `composeSecurityStack({ includeSessions })`
+ *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export declare function securityBaselineFeatures(opts?: SecurityBaselineOptions): FeatureDefinition[];

package/dist/presets/security-baseline.js

@@ -3,6 +3,8 @@ import { createCryptoShreddingFeature } from "../crypto-shredding/index.js";
 import { createRateLimitingFeature } from "../rate-limiting/index.js";
 import { createSessionsFeature } from "../sessions/index.js";
 // Host app must mount user, tenant, auth-foundation (sessions/audit requires).
+/** @deprecated Removed in the next release. Use `composeSecurityStack({ includeSessions })`
+ *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
 export function securityBaselineFeatures(opts = {}) {
     return [
         ...(opts.includeSessions !== false ? [createSessionsFeature()] : []),

package/dist/rate-limiting/index.d.ts

@@ -1,2 +1,2 @@
-export { RATE_LIMITING_FEATURE, RateLimitErrors, RateLimitQueries } from "./constants.js";
-export { createRateLimitingFeature } from "./feature.js";
+export { RATE_LIMITING_FEATURE, RateLimitErrors, RateLimitQueries } from "./constants.ts";
+export { createRateLimitingFeature } from "./feature.ts";

package/dist/readiness/feature.d.ts

@@ -5,11 +5,3 @@ export declare function createReadinessFeature(): import("@cosmicdrift/kumiko-ty
         };
     };
 };
-/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const readinessFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: {
-        queries: {
-            status: import("@cosmicdrift/kumiko-types/handlers").HandlerRef;
-        };
-    };
-};

package/dist/readiness/feature.js

@@ -25,5 +25,3 @@ export function createReadinessFeature() {
         return { queries };
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createReadinessFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const readinessFeature = createReadinessFeature();

package/dist/readiness/index.d.ts

@@ -1,3 +1,3 @@
-export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { createReadinessFeature, readinessFeature } from "./feature.js";
-export type { ReadinessMissingSecret } from "./handlers/status.query.js";
+export { READINESS_FEATURE, ReadinessQueries } from "./constants.ts";
+export { createReadinessFeature } from "./feature.ts";
+export type { ReadinessMissingSecret } from "./handlers/status.query.ts";

package/dist/readiness/index.js

@@ -1,2 +1,2 @@
 export { READINESS_FEATURE, ReadinessQueries } from "./constants.js";
-export { createReadinessFeature, readinessFeature } from "./feature.js";
+export { createReadinessFeature } from "./feature.js";

package/dist/renderer-foundation/api.d.ts

@@ -1,6 +1,6 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { type RenderKind } from "./constants.js";
-import { type RendererPlugin } from "./types.js";
+import { type RenderKind } from "./constants.ts";
+import { type RendererPlugin } from "./types.ts";
 export type RendererFoundationApi = {
     /**
      * Selects + returns a RendererPlugin for (tenantId × kind). Callers

package/dist/renderer-foundation/constants.d.ts

@@ -1,4 +1,4 @@
-import type { RenderKind as RenderKindLocal } from "../template-resolver/index.js";
+import type { RenderKind as RenderKindLocal } from "../template-resolver/index.ts";
 export declare const RENDERER_EXTENSION: "renderer";
-export { CONTENT_FORMATS, type ContentFormat, RENDER_KINDS, type RenderKind, } from "../template-resolver/index.js";
+export { CONTENT_FORMATS, type ContentFormat, RENDER_KINDS, type RenderKind, } from "../template-resolver/index.ts";
 export declare const DEFAULT_PLUGIN_BY_KIND: Readonly<Record<RenderKindLocal, string>>;

package/dist/renderer-foundation/feature.d.ts

@@ -1,5 +1,5 @@
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type RendererPlugin } from "./types.js";
+import { type RendererPlugin } from "./types.ts";
 export declare function createRendererFoundationFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: {};
 };

package/dist/renderer-foundation/index.d.ts

@@ -1,5 +1,5 @@
-export { attachmentFileNameSchema } from "../shared/index.js";
-export { createRendererFoundationApi, type RendererFoundationApi, requireRendererFoundation, } from "./api.js";
-export { CONTENT_FORMATS, type ContentFormat, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, type RenderKind, } from "./constants.js";
-export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.js";
-export { type DocumentPayload, type DocumentPdfDraft, type DocumentPdfPayload, type DocumentPreview, type DocumentPreviewRequest, type FileAttachmentRef, type ImageOptions, type InlineAttachmentRef, isRendererRegistrationPlugin, type MailAttachmentRef, type MailDraft, type MailPayload, type PdfOptions, type RenderedPdfAttachmentRef, type RenderedTemplateRef, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderProvenance, type RenderRequest, type RenderResponse, } from "./types.js";
+export { attachmentFileNameSchema } from "../shared/index.ts";
+export { createRendererFoundationApi, type RendererFoundationApi, requireRendererFoundation, } from "./api.ts";
+export { CONTENT_FORMATS, type ContentFormat, DEFAULT_PLUGIN_BY_KIND, RENDER_KINDS, RENDERER_EXTENSION, type RenderKind, } from "./constants.ts";
+export { collectRendererPlugins, createRendererFoundationFeature } from "./feature.ts";
+export { type DocumentPayload, type DocumentPdfDraft, type DocumentPdfPayload, type DocumentPreview, type DocumentPreviewRequest, type FileAttachmentRef, type ImageOptions, type InlineAttachmentRef, isRendererRegistrationPlugin, type MailAttachmentRef, type MailChrome, type MailChromeLink, type MailChromeRequest, type MailDraft, type MailPayload, type PdfOptions, type RenderedPdfAttachmentRef, type RenderedTemplateRef, type RendererContext, RendererError, type RendererPlugin, type RendererRegistrationPlugin, type RenderProvenance, type RenderRequest, type RenderResponse, } from "./types.ts";

package/dist/renderer-foundation/types.d.ts

@@ -1,8 +1,8 @@
 import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigAccessor, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
-import type { LinkedResourceEntry, MailTemplateMeta, PdfPageFormat, PdfTemplateMeta, TemplateScope } from "../template-resolver/index.js";
-import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.js";
+import type { LinkedResourceEntry, MailTemplateMeta, PdfPageFormat, PdfTemplateMeta, TemplateScope } from "../template-resolver/index.ts";
+import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.ts";
 export type RenderRequest = {
     kind: "mail";
     payload: MailPayload;
@@ -142,12 +142,34 @@ export type RendererContext = {
     /** Only plugins that embed resource bytes (PDF) need it; without it images are dropped. */
     readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
 };
+export type MailChromeLink = {
+    readonly label: string;
+    readonly url: string;
+};
+/** The tenant's mail look with every text resolved for one locale, for pages a
+ *  recipient reaches from a mail link. URLs are http(s) only, the logo https only,
+ *  the accent color a #rrggbb hex. */
+export type MailChrome = {
+    readonly tenantName: string;
+    readonly brandSuffix: string;
+    readonly logoUrl?: string;
+    readonly accentColor?: string;
+    readonly siteUrl?: string;
+    readonly footerText?: string;
+    readonly imprint?: MailChromeLink;
+    readonly privacy?: MailChromeLink;
+};
+export type MailChromeRequest = {
+    readonly locale: string;
+};
 export type RendererPlugin = {
     readonly name: string;
     readonly kinds: ReadonlyArray<RenderKind>;
     render(req: RenderRequest, ctx: RendererContext): Promise<RenderResponse>;
     /** Optional: plugins that print documents offer a preview that never reaches the print service. */
     previewDocument?(req: DocumentPreviewRequest, ctx: RendererContext): Promise<DocumentPreview>;
+    /** Optional: mail plugins hand out their brand row and footer for pages outside a mail. */
+    readMailChrome?(req: MailChromeRequest, ctx: RendererContext): Promise<MailChrome>;
 };
 export declare class RendererError extends Error {
     readonly code: "no_plugin_for_kind" | "invalid_payload" | "unavailable" | "other";

package/dist/renderer-pdf/feature.d.ts

@@ -1,4 +1,4 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type RenderRequest, type RenderResponse } from "../renderer-foundation/index.js";
+import { type RenderRequest, type RenderResponse } from "../renderer-foundation/index.ts";
 export declare function renderTablePdfRequest(req: RenderRequest): Promise<RenderResponse>;
 export declare function createRendererPdfFeature(): FeatureDefinition;

package/dist/renderer-pdf/index.d.ts

@@ -1,2 +1,2 @@
-export { createRendererPdfFeature } from "./feature.js";
-export { type PdfTableColumn, type PdfTableDocument, type PdfTableOptions, type PdfTableResult, pdfTableDocumentSchema, renderTablePdf, } from "./render-table-pdf.js";
+export { createRendererPdfFeature } from "./feature.ts";
+export { type PdfTableColumn, type PdfTableDocument, type PdfTableOptions, type PdfTableResult, pdfTableDocumentSchema, renderTablePdf, } from "./render-table-pdf.ts";

package/dist/renderer-pdf/render-table-pdf.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { PdfPageFormat } from "../template-resolver/index.js";
+import type { PdfPageFormat } from "../template-resolver/index.ts";
 declare const pdfTableColumnSchema: z.ZodReadonly<z.ZodObject<{
     header: z.ZodString;
     weight: z.ZodOptional<z.ZodNumber>;

package/dist/secrets/constants.d.ts

@@ -6,4 +6,11 @@ export declare const SECRETS_ERROR_KEYS: {
     readonly writeDenied: "secrets.errors.writeDenied";
     readonly invalidValue: "secrets.errors.invalidValue";
 };
+export declare const SecretsHandlers: {
+    readonly set: "secrets:write:set";
+    readonly delete: "secrets:write:delete";
+};
+export declare const SecretsQueries: {
+    readonly list: "secrets:query:list";
+};
 export declare const INVALID_SECRET_VALUE_CODE: "invalid_secret_value";

package/dist/secrets/constants.js

@@ -14,4 +14,11 @@ export const SECRETS_ERROR_KEYS = {
     writeDenied: "secrets.errors.writeDenied",
     invalidValue: "secrets.errors.invalidValue",
 };
+export const SecretsHandlers = {
+    set: "secrets:write:set",
+    delete: "secrets:write:delete",
+};
+export const SecretsQueries = {
+    list: "secrets:query:list",
+};
 export const INVALID_SECRET_VALUE_CODE = "invalid_secret_value";

package/dist/secrets/db/queries/read.d.ts

@@ -1,4 +1,4 @@
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { StoredEnvelope } from "../../table.js";
+import type { StoredEnvelope } from "../../table.ts";
 export declare function selectTenantSecretEnvelope(db: DbRunner, tenantId: TenantId, key: string): Promise<StoredEnvelope | undefined>;

package/dist/secrets/feature.d.ts

@@ -1,4 +1,5 @@
 import { type AccessRule, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
 /**
@@ -20,8 +21,8 @@ export declare const secretsEnvSchema: z.ZodObject<{
     KUMIKO_SECRETS_MASTER_KEY_V1: z.ZodString;
     KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>;
-export { createSecretsContext, type SecretsContext, type SecretsContextOptions, TENANT_SECRET_READ_EVENT, } from "./secrets-context.js";
-export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.js";
+export { createSecretsContext, type SecretsContext, type SecretsContextOptions, TENANT_SECRET_READ_EVENT, } from "./secrets-context.ts";
+export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.ts";
 export declare const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 export declare function requireSecretsContext(ctx: {
     readonly secrets?: SecretsContext;
@@ -43,4 +44,4 @@ export type SecretsFeatureOptions = {
     /** Shorthand for { access: { roles } }. Mutually exclusive with `access`. */
     readonly roles?: readonly string[];
 };
-export declare function createSecretsFeature(opts?: SecretsFeatureOptions): FeatureDefinition;
+export declare function createSecretsFeature(opts?: SecretsFeatureOptions): FeatureWithEnvSchema<FeatureDefinition, typeof secretsEnvSchema.shape>;

package/dist/secrets/feature.js

@@ -1,4 +1,5 @@
 import { defineFeature, SYSTEM_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
@@ -104,8 +105,8 @@ function withSystemWriter(rule) {
 export function createSecretsFeature(opts = {}) {
     const access = resolveSecretsAccess(opts);
     const writeAccess = withSystemWriter(access);
-    return defineFeature(SECRETS_FEATURE_NAME, (r) => {
-        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: "secrets:write:set", payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.');
+    const feature = defineFeature(SECRETS_FEATURE_NAME, (r) => {
+        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: SecretsHandlers.set, payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.');
         r.uiHints({
             displayLabel: "Tenant Secrets",
             category: "infrastructure",
@@ -161,4 +162,5 @@ export function createSecretsFeature(opts = {}) {
         // ops-tool (see docs/plans/architecture/event-dispatcher.md §retention).
         // No per-feature retention-job anymore.
     });
+    return featureWithEnvSchema(feature, secretsEnvSchema);
 }

package/dist/secrets/handlers/delete.write.js

@@ -2,7 +2,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.js";
 import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
 export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
@@ -16,7 +16,7 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
         access,
         escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:delete").withRunner(ctx.db.unsafeRaw());
+            const secrets = requireSecretsContext(ctx, SecretsHandlers.delete).withRunner(ctx.db.unsafeRaw());
             const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
                 allowUndeclared: true,
             });

package/dist/secrets/handlers/rotate.job.d.ts

@@ -1,6 +1,6 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
-import { type ChunkedMigrationStopReason } from "../../shared/index.js";
+import { type ChunkedMigrationStopReason } from "../../shared/index.ts";
 export type RotateJobPayload = {
     readonly batchSize?: number;
     readonly maxDurationMs?: number;

package/dist/secrets/handlers/set.write.js

@@ -1,7 +1,7 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
-import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
+import { DEFAULT_SECRETS_ACCESS, SecretsHandlers } from "../constants.js";
 import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
@@ -23,7 +23,7 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
         access,
         escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:set").withRunner(ctx.db.unsafeRaw());
+            const secrets = requireSecretsContext(ctx, SecretsHandlers.set).withRunner(ctx.db.unsafeRaw());
             const { key, value, redactedPreview, hint } = event.payload;
             // Preview-priority: explicit payload param > feature-declared redact
             // (via r.secret()) > generic default. A feature that declared a

package/dist/secrets/index.d.ts

@@ -1,7 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
-export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
-export { createDeleteHandler } from "./handlers/delete.write.js";
-export { createListHandler } from "./handlers/list.query.js";
-export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.js";
-export { createSetHandler } from "./handlers/set.write.js";
-export { isInvalidSecretValueError } from "./write-gate.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./constants.ts";
+export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.ts";
+export { createDeleteHandler } from "./handlers/delete.write.ts";
+export { createListHandler } from "./handlers/list.query.ts";
+export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.ts";
+export { createSetHandler } from "./handlers/set.write.ts";
+export { isInvalidSecretValueError } from "./write-gate.ts";

package/dist/secrets/index.js

@@ -1,4 +1,4 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, SecretsHandlers, SecretsQueries, } from "./constants.js";
 export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
 export { createDeleteHandler } from "./handlers/delete.write.js";
 export { createListHandler } from "./handlers/list.query.js";

package/dist/secrets/secrets-context.d.ts

@@ -1,7 +1,7 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type DekCache, type MasterKeyProvider, type SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
-import { type SecretValueSchemaSource } from "./write-gate.js";
+import { type SecretValueSchemaSource } from "./write-gate.ts";
 export type { Secret, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 export type SecretsContextOptions = {
     readonly db: DbConnection;

package/dist/seo/feature.d.ts

@@ -1,7 +1,7 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { SEO_DEFAULT_PATHS } from "./constants.js";
-import { type RobotsPolicy } from "./robots-txt.js";
-import { type SitemapEntry } from "./sitemap.js";
+import { SEO_DEFAULT_PATHS } from "./constants.ts";
+import { type RobotsPolicy } from "./robots-txt.ts";
+import { type SitemapEntry } from "./sitemap.ts";
 export type ManagedPagesDiscoveryOptions = {
     /** Same per-host tenant resolver the app already passes to
      *  createManagedPagesFeature — needed to X-Tenant-scope the anonymous

package/dist/seo/index.d.ts

@@ -1,6 +1,6 @@
-export { SEO_CONFIG_KEYS, SEO_CONFIG_QN, SEO_DEFAULT_PATHS, SEO_FEATURE } from "./constants.js";
-export { createSeoFeature, type ManagedPagesDiscoveryOptions, runSeoBootCheck, type SeoBootCheckCtx, type SeoOptions, } from "./feature.js";
-export { buildLlmsTxt, type LlmsTxtInput, type LlmsTxtLink, type LlmsTxtSection, } from "./llms-txt.js";
-export { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.js";
-export { type FaqItem, faqPageSchema, type OrganizationSchemaInput, organizationSchema, type WebPageSchemaInput, webPageSchema, } from "./schema-builders.js";
-export { buildSitemapXml, type SitemapEntry } from "./sitemap.js";
+export { SEO_CONFIG_KEYS, SEO_CONFIG_QN, SEO_DEFAULT_PATHS, SEO_FEATURE } from "./constants.ts";
+export { createSeoFeature, type ManagedPagesDiscoveryOptions, runSeoBootCheck, type SeoBootCheckCtx, type SeoOptions, } from "./feature.ts";
+export { buildLlmsTxt, type LlmsTxtInput, type LlmsTxtLink, type LlmsTxtSection, } from "./llms-txt.ts";
+export { buildRobotsTxt, type RobotsPolicy } from "./robots-txt.ts";
+export { type FaqItem, faqPageSchema, type OrganizationSchemaInput, organizationSchema, type WebPageSchemaInput, webPageSchema, } from "./schema-builders.ts";
+export { buildSitemapXml, type SitemapEntry } from "./sitemap.ts";

package/dist/sessions/feature.d.ts

@@ -1,5 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type SessionAllOthersRevoker, type SessionMassRevoker } from "./session-callbacks.js";
+import { type SessionAllOthersRevoker, type SessionMassRevoker } from "./session-callbacks.ts";
 export type SessionsFeatureOptions = {
     readonly autoRevokeOnPasswordChange?: SessionMassRevoker;
     readonly expiresInMs?: number;