@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.379.0

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "MFA setup uses the shared QR secret primitive",
+    "detail": "The pre-auth MFA setup screen renders the QR code and secret through the renderer's QR secret primitive instead of its own markup."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/src/billing-foundation/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Late Stripe events are dropped",
+    "detail": "The Stripe plugin passes event.created as providerEventAt, process-event stores it as providerEventAtIso in the subscription event and drops a created, updated or canceled event that is older than one already stored (result stale: true). A canceled subscription is no longer reactivated by a late delivery. Providers without a timestamp are unaffected; no migration."
+  },
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Contract mails reach users with encrypted email addresses",
+    "detail": "With a KMS configured, the contract confirmation and the receipt for a termination from the user account used the stored, encrypted email address as recipient. The mail channel refuses such addresses, so neither mail was sent and the send job failed after its retries. Both now decrypt the address first; an erased user gets no mail, as before for deleted users."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "\"This cancellation was not me\" link in the public cancellation receipt",
+    "detail": "When a public § 312k declaration matches an account, the receipt mail carries a one-time link (random token, only its sha256 is stored as revocationTokenHash in the declared event). The link opens a confirmation page; confirming with POST takes the cancellation back until it takes effect, resumes the provider subscription through the new optional SubscriptionProviderPlugin.resumeSubscription (Stripe sets cancel_at_period_end to false) or asks the operator to do it by hand, appends contract-termination.revoked and notifies the operator. Unknown requests and wrong tokens get the same answer; after the effective date the page says it is too late. Declarations stored before this release have no token and cannot be revoked by link."
+  },
   {
     "version": "0.377.0",
     "type": "improvement",

package/src/cap-counter/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.378.0",
+    "type": "fix",
+    "title": "Stock caps are atomic under parallel writes",
+    "detail": "withStockCap now takes a transaction-scoped advisory lock per tenant and cap, so concurrent creates cannot both pass the check and exceed the cap."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "withStockCap no longer widens the handler's grants",
+    "detail": "withStockCap serialises through TenantDb.advisoryXactLock instead of ctx.db.unsafeRaw(), so wrapped handlers no longer receive an implicit unsafeRaw grant."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Package ships its event-store table catalog",
+    "detail": "kumiko-es-tables.json is included in the published files; no runtime change."
+  },
   {
     "version": "0.372.0",
     "type": "breaking",

package/src/document-ingest-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "documentExtract projection survives a rebuild",
+    "detail": "DOCUMENT_EXTRACT_AGGREGATE_TYPE is exported, and the documentExtract entity projection applies the stored document-extract.* events, so rebuildProjection restores the rows. No event is rewritten."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/files/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "File uploads in an actionForm, dropzone display for files fields",
+    "detail": "A files or images field of an actionForm screen uploads through POST /files with actionForm=<screen QN> and fieldName; the file is stored pending under the screen and the route checks the caller's access to the screen and its handler before writing bytes. New helpers resolveActionFormFileField and listActionFormFileFields (framework/files), bindPendingFileRef takes bindTo (the target entity file field, checked against its accept and maxSize) and registry, and ACTION_FORM_PSEUDO_ENTITY moves to framework/ui-types. New display \"list\" or \"dropzone\" on FilesFieldDef and ImagesFieldDef; the dropzone works in entityEdit and actionForm and maps server error codes to translated texts. Pending actionForm uploads are removed on user forget and by the forget-subject file purge. New i18n keys kumiko.widget.upload.too-large|invalid-type|max-count|remove, kumiko.field.dropzone.* and errors.file.violatesBindTarget (de, es, fr, it included).",
+    "migration": "Custom upload screens such as solon document-upload can become an actionForm with a files field and display \"dropzone\". The form's handler must bind every file it keeps: load it with loadPendingFileRef (entityName = the screen QN) and move it onto a record with bindPendingFileRef({ bindTo, registry: ctx.registry }); unbound uploads are treated as the uploader's personal data and removed on forget."
+  },
   {
     "version": "0.372.0",
     "type": "breaking",

package/src/form-draft/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "Form draft content is encrypted per owner",
+    "detail": "The jsonb field draft carries personal: { of: \"ownerId\" }, so its content is stored as ciphertext in events and in read_form_drafts; the delete event no longer keeps the plaintext in previous. The PII event backfill (jsonb-objects-v3) encrypts existing events once on the next boot and rebuilds the table. The column type stays jsonb, so there is no schema change.",
+    "migration": "Nothing to run; the backfill happens on boot. Code that reads read_form_drafts.draft with raw SQL must decrypt it (decryptPiiFieldValues) or use the form-draft lookup helpers; the get and list queries are unchanged for clients."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.378.0",
+    "type": "fix",
+    "title": "Mailbox list accepts the screen's limit",
+    "detail": "account:list accepted an empty payload only, so the projectionList screen's limit was rejected. It now takes limit up to MAX_LIST_LIMIT and returns the visible mailboxes ordered by id."
+  },
   {
     "version": "0.377.0",
     "type": "improvement",

package/src/ledger/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "ledger confirm-schedule-period takes its lock through TenantDb",
+    "detail": "confirm-schedule-period serializes parallel confirms of one schedule period with ctx.db.advisoryXactLock instead of an unsafeRaw connection and an escapeHatch declaration. The lock key is unchanged (tenant id plus reference), so nothing changes for running installations.",
+    "migration": "None."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "Email sending offers a platform default and an own SMTP server",
+    "detail": "The provider field is labelled \"Send via\" with the options \"Platform sending (default)\" (empty, saved as \"\") and \"Own SMTP server\"; the SMTP fields show only while the own server is picked."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/presets/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "dsgvoSelfServiceFeatures removed",
+    "detail": "The deprecated preset dsgvoSelfServiceFeatures and its DsgvoSelfServiceOptions type are gone. composeGdprStack covers the same features.",
+    "migration": "Use composeGdprStack({ selfService: { userDataRights } }), or mount createSessionsFeature, createDataRetentionFeature, createComplianceProfilesFeature, createUserDataRightsFeature and createUserProfileFeature yourself."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/src/tags/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "assign-tag and delete-tag no longer race",
+    "detail": "Re-assigning a tag after it was deleted no longer restores the assignment of a gone tag. assign-tag and delete-tag now take the same per-tag advisory lock, so a parallel assign can no longer leave an assignment for a deleted tag."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/template-resolver/changes.json

@@ -1,4 +1,67 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Titles for the template-resolver write handlers",
+    "detail": "Every agent-callable template-resolver write handler now has a title in de, en, es, fr and it, so the AI assistant names actions such as \"Edit template draft\" instead of \"template-resolver:write:patch-draft\". The handlers of mounted content collections (`<id>-set`) stay untitled because their names depend on the app. The empty-field hint of the placeholder line editor now ends in an ellipsis inside the field instead of running past it."
+  },
+  {
+    "version": "0.379.0",
+    "type": "breaking",
+    "title": "Overrides of locked templates are no longer served",
+    "detail": "A tenant override of a mail, PDF or layout template is delivered (mail send, PDF render, linked PDFs, layouts, previews, export bundles, document blocks, overview, text blocks) only while the template is listed in tenantEditable. A locked override stays stored and has no effect; listing the template makes it effective again, nothing is deleted. A SystemAdmin sees locked overrides in the overview (`lockedOverride`, `lockedOverrideI18nKey`) and can reset or archive them with the existing handlers; the template-resolver queries do not show them to a TenantAdmin; the audit log keeps the history. Tenant rows of a collection mounted with `access` are served, except for a slug that has a system template outside tenantEditable: that system template wins, and the collection `-set` handler refuses such a slug for a non-SystemAdmin. createTemplateResolverApi(db) became createTemplateResolverApi(db, registry) because the delivery policy is read from the mounted feature; without the mounted feature no tenant override is served.",
+    "migration": "Overrides of templates that are not tenantEditable are no longer served; enable the template via tenantEditable to keep using them. Pass the registry as second argument to createTemplateResolverApi (ctx.registry in handlers, stack.registry in tests). Tenant rows without a system counterpart (for example text blocks seeded directly into a tenant) are hidden as well unless listed in tenantEditable."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Overview label for locked template overrides",
+    "detail": "Adds templateResolver.overview.lockedOverride."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Mail rendering follows the template delivery policy",
+    "detail": "Resolves templates through createTemplateResolverApi(db, registry); overrides of locked templates fall back to the system version."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "PDF rendering follows the template delivery policy",
+    "detail": "Resolves templates through createTemplateResolverApi(db, registry); overrides of locked templates fall back to the system version."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Samples follow the createTemplateResolverApi(db, registry) signature",
+    "detail": "Recipes and sample apps build the template resolver API with the registry as second argument."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "seedSystemTemplate accepts titleI18nKey",
+    "detail": "A seeded template can store an i18n key as its title (titleI18nKey, exclusive with title). The overview returns the key; the document-designer overview, mail editor and PDF link modal translate it and fall back to the raw text. Templates without a key behave as before; no migration."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "Document PDFs embed the images of a record",
+    "detail": "A template variable of type images (templateVariable.images()) holds FileRef ids of the record. The new Images block (div[data-images], PDF templates only, rejected for mail kinds) renders them as data-URI images in the real PDF render. Only files of the rendering tenant are read, only png, jpeg, gif and webp, at most 24 images and 20 MB per document; missing, foreign, oversized or non-image ids are dropped silently. Previews and draft PDFs never read files and show one placeholder box per block. An images variable never renders as inline text. i18n keys template-resolver.documentEditor.images, template-resolver.documentEditor.imagesVariable and templateResolver.errors.document.imagesBlockPdfOnly ship in de, es, fr and it.",
+    "migration": "Declare a template variable with type `images`, place the Images block, and pass FileRef ids of the record in `variables`. Images resolve only in the real PDF render, previews show placeholders. The ids must come from the record on the server, never from client input: a resolved id is read for the whole tenant without an entity access check."
+  },
+  {
+    "version": "0.378.0",
+    "type": "breaking",
+    "title": "Template editing is SystemAdmin-only unless the app unlocks it",
+    "detail": "Every tenant write handler, the overview and resource upload accept SystemAdmin only, plus the roles of the tenantEditable entries. A write on a template that is not unlocked fails with templateNotTenantEditable. The test send follows the same rule. For a non-SystemAdmin an unknown template id answers 403 like a locked one, so the response does not reveal whether it exists. Collections without an access rule default to SystemAdmin.",
+    "migration": "Where TenantAdmins must keep editing a template, pass tenantEditable to createTemplateResolverFeature, for example tenantEditable: [{ kind: \"mail\", slug: \"billing:notify:invoice-issued\", access: { roles: [\"TenantAdmin\"] } }]. Give template collections an explicit access rule if tenants should manage them."
+  },
+  {
+    "version": "0.378.0",
+    "type": "improvement",
+    "title": "send-test-status query for the template test mail",
+    "detail": "template-resolver:query:send-test-status answers whether a test mail can be sent (canSend) and, if not, why (no_channel or no_address), so clients can disable the action instead of failing on send."
+  },
   {
     "version": "0.377.0",
     "type": "improvement",

package/src/user-data-rights/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Client files of a feature live under web/",
+    "detail": "Files that carried a runtime-client marker moved into <feature>/web/ (constants.ts, i18n.ts, qualified-names and similar), so the runtime-isolation guard reads the runtime from the path. Export subpaths such as ./tenant/constants are unchanged; only relative imports into the old file locations break. The web-side translation glue of user-data-rights, managed-pages, admin-shell, audit, jobs and the document designer is now web/default-translations.ts.",
+    "migration": "Run bun kumiko-upgrade --apply, or bun kumiko codemod feature-layout . --write. It moves every file marked as runtime client from src/features/<feature>/ into src/features/<feature>/web/, rewrites the relative imports and drops the marker. Add --check to list what is left.",
+    "codemod": "scripts/codemod/feature-layout.ts"
+  },
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "DELETION_TOKEN_SECRET description corrected",
+    "detail": "The env description no longer claims a fallback to JWT_SECRET; without the secret the anonymous deletion-confirmation flow stays off."
+  },
   {
     "version": "0.376.0",
     "type": "improvement",

package/src/waitlist/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "Spanish admin notice for new waitlist entries",
+    "detail": "The operator notice \"new entry on the waitlist\" now exists in Spanish, like the entrant's confirmation. It follows the locale of the request that created the entry and falls back to English."
+  },
   {
     "version": "0.377.0",
     "type": "fix",

package/dist/admin-shell/i18n.d.ts

@@ -1,5 +0,0 @@
-type LocalizedString = {
-    readonly en: string;
-};
-export declare const ADMIN_SHELL_I18N: Readonly<Record<string, LocalizedString>>;
-export {};

package/dist/admin-shell/i18n.js

@@ -1,51 +0,0 @@
-// @runtime client
-// Pure-Data i18n keys for admin-shell (server r.translations + client pivot).
-// Without these keys nav labels and workspace tabs render raw QNs in the shell.
-export const ADMIN_SHELL_I18N = {
-    "screen:tenant-overview.title": { en: "Overview" },
-    "screen:platform-overview.title": { en: "Overview" },
-    "admin-shell.screen.tenant-overview.subtitle": {
-        en: "Activity, failed jobs and deliveries, quotas and open admin tasks of this tenant.",
-    },
-    "admin-shell.screen.platform-overview.subtitle": {
-        en: "Tenant, user, job and delivery health across the whole installation.",
-    },
-    "admin-shell:workspace.tenant": { en: "Administration" },
-    "admin-shell:workspace.platform": { en: "Platform" },
-    "admin-shell:nav.tenantOverview": { en: "Overview" },
-    "admin-shell:nav.platformOverview": { en: "Overview" },
-    "admin-shell:nav.tenants": { en: "Tenants" },
-    "admin-shell:nav.tierAdmin": { en: "Assign tier" },
-    "admin-shell:nav.myCaps": { en: "Plans & Caps" },
-    "admin-shell:nav.tenantCaps": { en: "Plans & Caps" },
-    "admin-shell:overview.kpi.activeTenants": { en: "Active tenants" },
-    "admin-shell:overview.kpi.activeUsers7d": { en: "Active users, 7 days" },
-    "admin-shell:overview.kpi.activeMembers7d": { en: "Active members, 7 days" },
-    "admin-shell:overview.kpi.failedJobs24h": { en: "Failed jobs, 24 h" },
-    "admin-shell:overview.kpi.failedDeliveries24h": { en: "Failed deliveries, 24 h" },
-    "admin-shell:overview.chart.jobRunsByStatus": { en: "Job runs by status" },
-    "admin-shell:overview.chart.deliveriesByChannel": { en: "Deliveries by channel" },
-    "admin-shell:overview.chart.auditWrites": { en: "Changes per day" },
-    "admin-shell:overview.chart.auditWritesSubtitle": { en: "Audit log, 14 days" },
-    "admin-shell:overview.list.recentFailures": { en: "Recent failures" },
-    "admin-shell:overview.list.recentFailuresEmpty": { en: "No failed jobs" },
-    "admin-shell:overview.list.quotas": { en: "Quotas" },
-    "admin-shell:overview.list.quotasEmpty": { en: "No quotas configured" },
-    "admin-shell:overview.col.job": { en: "Job" },
-    "admin-shell:overview.col.startedAt": { en: "Started" },
-    "admin-shell:overview.col.failedAt": { en: "Failed at" },
-    "admin-shell:overview.col.reason": { en: "Reason" },
-    "admin-shell:overview.col.quota": { en: "Quota" },
-    "admin-shell:overview.col.used": { en: "Used" },
-    "admin-shell:overview.col.limit": { en: "Limit" },
-    "admin-shell:overview.col.usage": { en: "Usage" },
-    "admin-shell:overview.range.24h": { en: "24 hours" },
-    "admin-shell:overview.range.7d": { en: "7 days" },
-    "admin-shell:overview.range.30d": { en: "30 days" },
-    "admin-shell:overview.scope.badge": { en: "All tenants" },
-    "admin-shell:overview.scope.notice": {
-        en: "You are viewing data of all tenants. Cross-tenant queries are recorded in the audit log.",
-    },
-    "admin-shell:overview.filter.tenant": { en: "Tenant" },
-    "admin-shell:overview.filter.allTenants": { en: "All tenants" },
-};

package/dist/audit/i18n.d.ts

@@ -1,5 +0,0 @@
-type LocalizedString = {
-    readonly en: string;
-};
-export declare const AUDIT_I18N: Readonly<Record<string, LocalizedString>>;
-export {};

package/dist/audit/i18n.js

@@ -1,22 +0,0 @@
-// @runtime client
-// Server + client i18n for audit (nav labels + audit-log/-detail screens).
-export const AUDIT_I18N = {
-    "screen:audit-log.title": { en: "Audit log" },
-    "screen:audit-log-detail.title": { en: "Event" },
-    "audit.log.detail.subtitle": {
-        en: "Read-only detail view of one audit event showing actor, timestamp, aggregate and the raw event payload and metadata; reached from a row of the audit log.",
-    },
-    "audit.errors.systemScopeRequiresSystemAdmin": {
-        en: "Only SystemAdmin may read system events.",
-    },
-    "audit:nav.auditLog": { en: "Audit" },
-    "audit.log.col.when": { en: "When" },
-    "audit.log.col.type": { en: "Event" },
-    "audit.log.col.aggregateType": { en: "Aggregate type" },
-    "audit.log.col.aggregateId": { en: "Aggregate ID" },
-    "audit.log.col.actor": { en: "Actor" },
-    "audit.log.details": { en: "Details" },
-    "audit.log.detail.payload": { en: "Event payload" },
-    "audit.log.detail.metadata": { en: "Metadata" },
-    "audit.log.detail.field.id": { en: "Event ID" },
-};

package/dist/jobs/i18n.d.ts

@@ -1,5 +0,0 @@
-type LocalizedString = {
-    readonly en: string;
-};
-export declare const JOBS_I18N: Readonly<Record<string, LocalizedString>>;
-export {};

package/dist/jobs/i18n.js

@@ -1,52 +0,0 @@
-// @runtime client
-// Server + client i18n for jobs operator screens.
-export const JOBS_I18N = {
-    "screen:job-runs.title": { en: "Job runs" },
-    "screen:job-run-detail.title": { en: "Job run" },
-    "screen:job-trigger.title": { en: "Trigger job" },
-    "jobs.screen.job-trigger.subtitle": {
-        en: "Start a job manually by name, with an optional JSON payload.",
-    },
-    "jobs.screen.job-run-detail.subtitle": {
-        en: "Status, timings, error and log lines of one job run.",
-    },
-    "jobs:entity:__action-form__:field:jobName": { en: "Job name" },
-    "jobs:entity:__action-form__:field:payload": { en: "JSON payload" },
-    "jobs:nav.jobRuns": { en: "Jobs" },
-    "jobs.runs.open": { en: "Details" },
-    "jobs.runs.filter.status": { en: "Status" },
-    "jobs.runs.filter.completed": { en: "Completed" },
-    "jobs.runs.filter.failed": { en: "Failed" },
-    "jobs.runs.filter.running": { en: "Running" },
-    "jobs.runs.filter.queued": { en: "Queued" },
-    "jobs.runs.col.job": { en: "Job" },
-    "jobs.runs.col.status": { en: "Status" },
-    "jobs.runs.col.started": { en: "Started" },
-    "jobs.runs.col.duration": { en: "Duration (ms)" },
-    "jobs.detail.field.job": { en: "Job" },
-    "jobs.detail.field.status": { en: "Status" },
-    "jobs.detail.field.id": { en: "Run ID" },
-    "jobs.detail.field.started": { en: "Started" },
-    "jobs.detail.field.finished": { en: "Finished" },
-    "jobs.detail.field.duration": { en: "Duration (ms)" },
-    "jobs.detail.field.error": { en: "Error" },
-    "jobs.detail.logs": { en: "Logs" },
-    "jobs.detail.retry": { en: "Retry" },
-    "jobs.trigger.title": { en: "Run a job" },
-    "jobs.errors.invalidCursor": { en: "The pagination cursor is invalid." },
-    "jobs.trigger.submit": { en: "Run" },
-    "jobs.errors.unknownJob": { en: "Unknown job." },
-    "jobs.errors.notManual": {
-        en: "This job cannot be triggered manually.",
-    },
-    "jobs.errors.invalidPayload": {
-        en: "The payload must be a valid JSON object.",
-    },
-    "jobs.errors.notFound": { en: "Not found." },
-    "jobs.errors.onlyFailedCanRetry": {
-        en: "Only failed runs can be retried.",
-    },
-    "jobs.errors.payloadErased": {
-        en: "This run's payload can no longer be read — the triggering user's data was erased.",
-    },
-};

package/dist/managed-pages/i18n.d.ts

@@ -1,5 +0,0 @@
-type LocalizedString = {
-    readonly en: string;
-};
-export declare const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>>;
-export {};

package/dist/managed-pages/i18n.js

@@ -1,55 +0,0 @@
-// @runtime client
-// Pure-Data (i18n-Keys) — client-marked, damit das web/-Bundle sie in den
-// Browser-Store pivotieren darf; feature.ts (server) importiert sie ebenso
-// (server darf client-safe Pure-Data importieren, wie PAT constants.ts).
-//
-// Übersetzungs-Bundle für die managed-pages Admin-Screens. Ohne diese Keys
-// rendert die UI die Roh-i18n-Keys (screen:*.title, entity:*:field:*, Section-
-// Header). Der Boot-Validator (required-surface-keys) verlangt — sobald ein
-// Feature r.translations ruft — den KOMPLETTEN Required-Surface-Satz in de+en;
-// diese Datei deckt jeden Screen/Feld/Section-Key ab, den managed-pages
-// registriert. Die zwei customCss-Keys werden unconditional geliefert (schaden
-// bei allowCustomCss:false nicht, sind aber Pflicht für Consumer die es aktivieren).
-export const MANAGED_PAGES_I18N = {
-    // Screen-Titel (global/unpräfixiert — screenTitleKey = screen:<id>.title)
-    "screen:page-list.title": { en: "Pages" },
-    "screen:page-edit.title": { en: "Edit page" },
-    "screen:branding-settings.title": { en: "Branding" },
-    // Page-Entity Feld-Labels (managed-pages:entity:page:field:*)
-    "managed-pages:entity:page:field:slug": { en: "Slug" },
-    "managed-pages:entity:page:field:lang": { en: "Language" },
-    "managed-pages:entity:page:field:title": { en: "Title" },
-    "managed-pages:entity:page:field:published": { en: "Published" },
-    "managed-pages:entity:page:field:published:option:true": {
-        en: "Published",
-    },
-    "managed-pages:entity:page:field:published:option:false": { en: "Draft" },
-    "managed-pages:entity:page:field:description": { en: "Description" },
-    "managed-pages:entity:page:field:ogImage": { en: "OG image" },
-    "managed-pages:entity:page:field:body": { en: "Content" },
-    // Config-Edit Feld-Labels (managed-pages:entity:__config-edit__:field:*, camelCase Form-Keys)
-    "managed-pages:entity:__config-edit__:field:title": { en: "Site title" },
-    "managed-pages:entity:__config-edit__:field:description": {
-        en: "Description",
-    },
-    "managed-pages:entity:__config-edit__:field:siteUrl": { en: "Site URL" },
-    "managed-pages:entity:__config-edit__:field:accentColor": {
-        en: "Accent color",
-    },
-    "managed-pages:entity:__config-edit__:field:logoUrl": { en: "Logo URL" },
-    "managed-pages:entity:__config-edit__:field:logoFile": { en: "Logo file" },
-    "managed-pages:entity:__config-edit__:field:layoutPreset": { en: "Layout" },
-    // Section-Header
-    "managed-pages:section.meta": { en: "Metadata" },
-    "managed-pages:section.body": { en: "Content" },
-    "managed-pages:branding.section.identity": { en: "Identity" },
-    // Row-Actions + Confirm (pageListScreen)
-    "managed-pages:actions.edit": { en: "Edit" },
-    "managed-pages:actions.delete": { en: "Delete" },
-    "managed-pages:confirms.page-delete": {
-        en: "Delete this page?",
-    },
-    // Nur bei allowCustomCss:true im Screen — unconditional geliefert
-    "managed-pages:entity:__config-edit__:field:customCss": { en: "Custom CSS" },
-    "managed-pages:branding.section.custom-css": { en: "Custom CSS" },
-};

package/dist/presets/dsgvo-self-service.d.ts

@@ -1,10 +0,0 @@
-import type { FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type UserDataRightsOptions } from "../user-data-rights/index.ts";
-export type DsgvoSelfServiceOptions = {
-    /** Passed through to createUserDataRightsFeature — export/deletion mail
-     *  callbacks + Apex deletion HMAC. Default {} (no-op mail side). */
-    readonly userDataRights?: UserDataRightsOptions;
-};
-/** @deprecated Removed in the next release. Use `composeGdprStack({ selfService: { userDataRights } })`
- *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
-export declare function dsgvoSelfServiceFeatures(opts?: DsgvoSelfServiceOptions): FeatureDefinition[];

package/dist/presets/dsgvo-self-service.js

@@ -1,24 +0,0 @@
-import { createComplianceProfilesFeature } from "../compliance-profiles/index.js";
-import { createDataRetentionFeature } from "../data-retention/index.js";
-import { createSessionsFeature } from "../sessions/index.js";
-import { createUserDataRightsFeature, } from "../user-data-rights/index.js";
-import { createUserProfileFeature } from "../user-profile/index.js";
-// DSGVO + account self-service chain every Kumiko SaaS app mounts (privacy
-// center, account deletion Art. 17, export Art. 20, sessions). Order is
-// load-bearing (require-order): user-data-rights needs data-retention +
-// compliance-profiles + sessions, user-profile needs user-data-rights. This
-// exact order used to be hand-copied into every app with an explainer
-// comment. text-content + legal-pages stay out deliberately — legal-pages
-// has an app-specific wrapLayout, text-content is a standalone foundation;
-// both are spread in by the app itself.
-/** @deprecated Removed in the next release. Use `composeGdprStack({ selfService: { userDataRights } })`
- *  from `@cosmicdrift/kumiko-dev-server/compose-stacks`. */
-export function dsgvoSelfServiceFeatures(opts = {}) {
-    return [
-        createDataRetentionFeature(),
-        createComplianceProfilesFeature(),
-        createSessionsFeature(),
-        createUserDataRightsFeature(opts.userDataRights ?? {}),
-        createUserProfileFeature(),
-    ];
-}

package/dist/user-data-rights/i18n.d.ts

@@ -1,5 +0,0 @@
-type LocalizedString = {
-    readonly en: string;
-};
-export declare const USER_DATA_RIGHTS_I18N: Readonly<Record<string, LocalizedString>>;
-export {};

package/dist/user-data-rights/i18n.js

@@ -1,39 +0,0 @@
-export const USER_DATA_RIGHTS_I18N = {
-    "user-data-rights:feature.label": { en: "Privacy" },
-    "user-data-rights:notify.export-ready.label": { en: "Data export ready" },
-    "user-data-rights:notify.export-failed.label": { en: "Data export failed" },
-    "user-data-rights:notify.deletion-requested.label": { en: "Deletion requested" },
-    "user-data-rights:notify.deletion-executed.label": { en: "Deletion completed" },
-    "user-data-rights:nav.exportJobs": { en: "GDPR exports" },
-    "screen:export-job-list.title": { en: "GDPR exports" },
-    "screen:export-job-detail.title": { en: "Export job" },
-    "screen:download-attempt-list.title": { en: "Download attempts" },
-    "screen:privacy-center.title": { en: "Privacy" },
-    "userDataRights.privacyCenter.subtitle": {
-        en: "Logged-in GDPR self-service page where a user requests and downloads a data export (Art. 20), restricts processing of their account (Art. 18) and requests its deletion (Art. 17).",
-    },
-    "user-data-rights:entity:export-job:field:userId": { en: "User" },
-    "user-data-rights:entity:export-job:field:status": { en: "Status" },
-    "user-data-rights:entity:export-job:field:requestedAt": { en: "Requested" },
-    "user-data-rights:entity:export-job:field:completedAt": { en: "Completed" },
-    "user-data-rights:entity:export-job:field:expiresAt": { en: "Expires" },
-    "user-data-rights:entity:export-job:field:requestedFromTenantId": {
-        en: "Tenant",
-    },
-    "user-data-rights:entity:export-job:field:startedAt": { en: "Started" },
-    "user-data-rights:entity:export-job:field:downloadStorageKey": {
-        en: "Storage key",
-    },
-    "user-data-rights:entity:export-job:field:bytesWritten": { en: "Bytes" },
-    "user-data-rights:entity:export-job:field:errorMessage": { en: "Error" },
-    "user-data-rights:entity:download-attempt:field:attemptedAt": {
-        en: "Attempted at",
-    },
-    "user-data-rights:entity:download-attempt:field:result": { en: "Result" },
-    "user-data-rights:entity:download-attempt:field:via": { en: "Via" },
-    "user-data-rights:entity:download-attempt:field:ip": { en: "IP" },
-    "user-data-rights:entity:download-attempt:field:attemptedByUserId": {
-        en: "User",
-    },
-    "user-data-rights:entity:download-attempt:field:jobId": { en: "Job" },
-};