@cosmicdrift/kumiko-bundled-features 0.385.0 → 0.387.0

package/dist/mail-transport-inmemory/feature.js

@@ -1,25 +1,25 @@
 // kumiko-feature-version: 1
 //
-// mail-transport-inmemory — In-Memory-EmailTransport für die mail-
-// foundation Plugin-API. Sammelt Mails in einem per-Tenant-Buffer
-// statt sie über einen echten SMTP-Server zu senden. Designed für
-// Demos, Sample-Apps und Tests die ohne Mailpit/Mailcrab/echten SMTP
-// laufen sollen.
+// mail-transport-inmemory — In-memory email transport for the mail-
+// foundation plugin API. Collects emails in a per-tenant buffer
+// instead of sending them through a real SMTP server. Designed for
+// demos, sample apps, and tests that should run without Mailpit,
+// Mailcrab, or real SMTP.
 //
-// **Was diese Feature liefert:**
-//   1. Plugin-Registration via `r.useExtension("mailTransport",
-//      "inmemory", { build })`. Tenants setzen
-//      "mail-foundation:config:provider" auf "inmemory" und kriegen
-//      die buffered-Variante.
-//   2. **Pro-Tenant Inbox.** Jeder Tenant hat einen eigenen
-//      Mail-Buffer (Map<tenantId, EmailMessage[]>). Demo-Apps können
-//      die Inbox via `getInbox(tenantId)` lesen + UI rendern.
+// **What this feature provides:**
+//   1. Plugin registration via `r.useExtension("mailTransport",
+//      "inmemory", { build })`. Tenants set
+//      "mail-foundation:config:provider" to "inmemory" and receive
+//      the buffered variant.
+//   2. **Per-tenant inbox.** Each tenant has its own mail buffer
+//      (Map<tenantId, EmailMessage[]>). Demo apps can read the inbox
+//      via `getInbox(tenantId)` and render a UI.
 //
-// **Pattern-Vorbild:** mirrors mail-transport-smtp.
+// **Pattern reference:** mirrors mail-transport-smtp.
 //
-// **NICHT für Production.** Buffer ist im Process-Memory, geht beim
-// Restart verloren. Cap-Counter / Audit-Trail bleiben trotzdem korrekt
-// — die hängen am event-store, nicht am Transport.
+// **NOT for production.** The buffer is in process memory and is lost
+// on restart. Cap counters and the audit trail remain correct because
+// they are tied to the event store, not the transport.
 import { createInMemoryTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { MAIL_TRANSPORT_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -28,9 +28,9 @@ const FEATURE_NAME = "mail-transport-inmemory";
 // Per-tenant in-memory buffer
 // =============================================================================
 //
-// Module-level Map weil der Plugin-build-call pro Send einen neuen
-// Transport-Wrapper baut, aber wir wollen dass alle Wrapper für
-// denselben Tenant auf denselben Buffer zeigen. Map<tenantId,
+// The module-level Map is needed because the plugin build call creates
+// a new transport wrapper for each send, while all wrappers for the
+// same tenant must point to the same buffer. Map<tenantId,
 // InMemoryTransport>.
 const transportsByTenant = new Map();
 function getOrCreateTransportForTenant(tenantId) {
@@ -42,15 +42,15 @@ function getOrCreateTransportForTenant(tenantId) {
     return transport;
 }
 /**
- * Demo/Test-Helper: lies die "versendeten" Mails eines Tenants. Im
- * Sample-App rendert ein query-Handler darauf die Inbox-UI.
+ * Demo/test helper: reads the emails "sent" for a tenant. A query
+ * handler in the sample app uses this to render the inbox UI.
  */
 export function getInbox(tenantId) {
     return transportsByTenant.get(tenantId)?.sent ?? [];
 }
 /**
- * Demo/Test-Helper: clear einen Tenant-Buffer (z.B. zwischen Test-
- * Szenarien).
+ * Demo/test helper: clears a tenant's buffer, for example between
+ * test scenarios.
  */
 export function clearInbox(tenantId) {
     const t = transportsByTenant.get(tenantId);
@@ -63,10 +63,9 @@ export function clearInbox(tenantId) {
 export function createMailTransportInMemoryFeature() {
     return defineFeature(FEATURE_NAME, (r) => {
         r.describe('Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).');
-        // Kein requires auf "config" oder "secrets" — der
-        // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
-        // kein Secret. Der einzige hard-require ist mail-foundation, das den
-        // extension-point "mailTransport" definiert.
+        // No `config` or `secrets` requirement: the in-memory transport has
+        // no configuration and no secret. The only hard requirement is
+        // mail-foundation, which defines the "mailTransport" extension point.
         r.requires({ features: ["mail-foundation"] });
         const plugin = {
             // Solon and studio mount it next to smtp in production; offering it there would

package/dist/mail-transport-smtp/feature.js

@@ -1,29 +1,29 @@
 // kumiko-feature-version: 1
 //
-// mail-transport-smtp — concrete SMTP-implementation for the
-// mail-foundation plugin-API.
+// mail-transport-smtp — concrete SMTP implementation for the
+// mail-foundation plugin API.
 //
-// **Was diese Feature liefert:**
-//   1. Provider-spezifische Tenant-Config (host/port/secure/from/authUser)
-//      und Secret (smtp.password). Self-contained — mail-foundation kennt
-//      diese Schlüssel nicht; wenn ein App-Owner zwischen SMTP und Brevo-
-//      API wechseln will, hat er pro-Plugin eigenständige Config-Sets.
-//   2. **Plugin-Registration** via `r.useExtension("mailTransport",
-//      "smtp", { build })`. Beim Boot kennt mail-foundation's
-//      Factory-Lookup damit den name "smtp" ↔ build-Funktion.
-//   3. `build(ctx, tenantId)` liest die config-keys + secret und ruft
-//      `createSmtpTransport()` aus channel-email auf. Das ist der
-//      EINZIGE Cross-Feature-Import dieses Plugins — bewusst lokal
-//      gehalten, mail-foundation bleibt provider-frei.
+// **What this feature provides:**
+//   1. Provider-specific tenant config (host/port/secure/from/authUser)
+//      and secret (smtp.password). Self-contained — mail-foundation does not
+//      know these keys; when an app owner switches between SMTP and the Brevo
+//      API, each plugin has its own independent config sets.
+//   2. **Plugin registration** via `r.useExtension("mailTransport",
+//      "smtp", { build })`. At boot, mail-foundation's factory lookup maps
+//      the name "smtp" to the build function.
+//   3. `build(ctx, tenantId)` reads the config keys and secret, then calls
+//      `createSmtpTransport()` from channel-email. This is the plugin's
+//      ONLY cross-feature import, deliberately kept local so
+//      mail-foundation remains provider-independent.
 //
-// **Pattern-Vorbild:** mirrors `channel-email` registering itself for
-// `delivery`. Diese Feature ist analog: registriert sich für
-// mail-foundation's "mailTransport"-Extension-Point.
+// **Pattern reference:** mirrors `channel-email` registering itself for
+// `delivery`. This feature is analogous: it registers for
+// mail-foundation's "mailTransport" extension point.
 //
-// **Boot-Dependencies:**
+// **Boot dependencies:**
 //   - `mail-foundation` — extension-point owner
-//   - `config` — für die Tenant-Config-Keys
-//   - `secrets` — für das verschlüsselte SMTP-Password
+//   - `config` — for the tenant config keys
+//   - `secrets` — for the encrypted SMTP password
 import { createSmtpTransport, } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { BlockedHostError, HostResolutionError, mailAllowedPrivateHostsEnvSchema, readAllowedPrivateMailHostsFromEnv, requireDefined, requireNonEmpty, requireSecretSet, resolveMailConnectTarget, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { MAIL_TRANSPORT_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";

package/dist/managed-pages/branding.js

@@ -14,13 +14,13 @@ import { EMPTY_BRANDING } from "../page-render/index.js";
 // `write: access.withSystem(access.admin)` — tenant admins self-service via
 // configEdit AND the system actor (ctx.systemWriteAs) may provision/migrate
 // these keys. The scope default (`access.admin`, admin-only) has no system
-// path, so a continuity migration could not set them (issue #396). Adding
-// SYSTEM_ROLE keeps the keys human-writable (checkWriteAccess collapses to
+// path, so a continuity migration could not set them. Adding SYSTEM_ROLE
+// keeps the keys human-writable (checkWriteAccess collapses to
 // system-only only when system is the SOLE writer), so self-service survives.
 //
-// CONTINUITY (Phase 5 — Prod trap): these keys land under
+// CONTINUITY (Prod trap): these keys land under
 // `managed-pages:config:branding-*`, NOT the live `publicstatus:config:
-// branding-*`. The publicstatus consumer (Phase 5) MUST migrate the existing
+// branding-*`. The publicstatus consumer MUST migrate the existing
 // read_config_values rows to the new QNs per tenant BEFORE switching the read
 // path, or every tenant resets to defaults on deploy. The migration is
 // deliberately NOT built here — the source QNs belong to the consumer app.
@@ -30,7 +30,7 @@ import { EMPTY_BRANDING } from "../page-render/index.js";
 // also renders. text keys carry an explicit length cap too — `validateType`
 // only checks the JS type, and the configEdit `maxLength` is client-side, so a
 // direct config:write:set would otherwise be unbounded (the page body is
-// likewise capped in Phase 2).
+// likewise capped).
 const HEX_PATTERN = {
     regex: "^$|^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$",
 };
@@ -56,7 +56,7 @@ export const MANAGED_PAGES_CSS_FEATURE = "managed-pages-css";
 // site-url`. BRANDING_QN below is the single source those QN strings are read
 // from (configEdit screen + render read); the integration test pins write-
 // target == read-source end-to-end.
-// Admin self-service + system provisioning (see write-access note above, #396).
+// Admin self-service + system provisioning.
 const BRANDING_WRITE = access.withSystem(access.admin);
 export const BRANDING_KEYS = {
     brandingTitle: createTenantConfig("text", {

package/dist/managed-pages/feature.d.ts

@@ -10,36 +10,36 @@ export type ManagedPagesWrapLayout = (opts: {
     readonly branding: BrandingTokens;
 }) => string;
 export type ManagedPagesOptions = {
-    /** Host → tenantId für anonyme per-Tenant-Auslieferung. NULL → 404 (kein
-     *  Tenant für diesen Host). Apex-/Marketing-Apps geben hier ihre Subdomain-
-     *  /Custom-Domain-Auflösung rein; single-tenant gibt konstant einen
-     *  tenantId (oder SYSTEM_TENANT_ID) zurück. Erforderlich, weil der Apex-
-     *  Host keinen ambient ctx.tenantId hat. */
+    /** Host → tenantId for anonymous per-tenant delivery. NULL → 404 (no
+     *  tenant for this host). Apex/marketing apps provide their subdomain or
+     *  custom-domain resolution here; single-tenant apps return a constant
+     *  tenantId (or SYSTEM_TENANT_ID). Required because the apex host has no
+     *  ambient ctx.tenantId. */
     readonly resolveApexTenant: (host: string) => Promise<string | null> | string | null;
-    /** Custom Layout-Wrapper (Branding/Chrome). Default: minimaler
-     *  page-render-Skeleton. Erhält slug + SEO-Meta zur freien Nutzung.
-     *  **`branding` ist RAW, untrusted tenant input.** `title`/`description`
-     *  sind am Write nur längen-gecappt, NICHT HTML-escaped; `customCss` ist
-     *  ungesanitet. Der Wrapper MUSS sie über die Boundary-Helper emittieren
-     *  (alle re-exported von `@cosmicdrift/kumiko-bundled-features/managed-pages`):
-     *  `brandingHeaderHtml(branding)` + `brandingStyleBlock(branding)` (escapen
-     *  Header/Theme) und — mit allowCustomCss — `tenantStyleBlock(branding.
-     *  customCss)` ins `<head>` plus `TENANT_CONTENT_ATTR` am Body-Container. Ein
-     *  Custom-Wrapper der `branding.title` selbst interpoliert ist stored XSS;
-     *  der Default-Wrapper nutzt durchweg die Helper. */
+    /** Custom layout wrapper (branding/chrome). Default: a minimal page-render
+     *  skeleton. Receives slug + SEO meta for free use.
+     *  **`branding` is RAW, untrusted tenant input.** `title`/`description`
+     *  are only length-capped on write, NOT HTML-escaped; `customCss` is
+     *  unsanitized. The wrapper MUST emit them through the boundary helpers
+     *  (all re-exported from `@cosmicdrift/kumiko-bundled-features/managed-pages`):
+     *  `brandingHeaderHtml(branding)` + `brandingStyleBlock(branding)` (which
+     *  escape header/theme) and, with allowCustomCss, `tenantStyleBlock(branding.
+     *  customCss)` in the `<head>` plus `TENANT_CONTENT_ATTR` on the body
+     *  container. A custom wrapper that interpolates `branding.title` itself is
+     *  stored XSS; the default wrapper uses the helpers throughout. */
     readonly wrapLayout?: ManagedPagesWrapLayout;
-    /** Basis-Pfad der Page-Routes. Default "/p" → GET /p/:slug. */
+    /** Base path for page routes. Default "/p" → GET /p/:slug. */
     readonly basePath?: string;
-    /** Default-Sprache wenn `?lang=` fehlt. Default "en". */
+    /** Default language when `?lang=` is missing. Default "en". */
     readonly defaultLang?: string;
-    /** Aktiviert die per-Tenant Custom-CSS-Capability (raw, untrusted): ein
-     *  `branding-custom-css` Config-Key + ein CSS-Feld im Branding-Editor + die
-     *  Render-Emission als scoped, allowlist-sanitized `<style data-tenant-css>`.
-     *  Default **false** (fail-closed — opt-in für untrusted-Tenant-Input). Auch
-     *  wenn true, wird die Emission zusätzlich per-Tenant über das
-     *  `managed-pages-css`-Toggle (createManagedPagesCssFeature) gegated, sobald
-     *  ein feature-toggles/tier-engine-Runtime verdrahtet ist. Der Render-time-
-     *  Sanitizer (page-render/css-sanitize) ist der Safety-Boundary. */
+    /** Enables the per-tenant custom CSS capability (raw, untrusted): a
+     *  `branding-custom-css` config key + a CSS field in the branding editor +
+     *  render emission as a scoped, allowlist-sanitized `<style data-tenant-css>`.
+     *  Default **false** (fail-closed — opt-in for untrusted tenant input). Even
+     *  when true, emission is additionally gated per tenant by the
+     *  `managed-pages-css` toggle (createManagedPagesCssFeature) once a
+     *  feature-toggles/tier-engine runtime is wired. The render-time sanitizer
+     *  (page-render/css-sanitize) is the safety boundary. */
     readonly allowCustomCss?: boolean;
 };
 export declare function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDefinition;

package/dist/managed-pages/feature.js

@@ -15,9 +15,9 @@ import { pageEntity } from "./table.js";
 import { MANAGED_PAGES_I18N } from "./web/i18n.js";
 // 60s-shared-cache saves the origin-revalidate roundtrip; CMS edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 };
-// QN-Konstante als dokumentierter Public-Contract — der Render-Pfad ruft
-// die by-slug-Query via systemQuery in-process (kein Code-Import des
-// Handlers, symmetrisch zum legal-pages-Muster).
+// QN constant as a documented public contract — the render path calls
+// the by-slug query in-process via systemQuery (without importing the
+// handler's code, symmetrically with the legal-pages pattern).
 const BY_SLUG_QN = "managed-pages:query:by-slug";
 function brandingRevisionSeed(branding) {
     return JSON.stringify([
@@ -45,28 +45,28 @@ async function readBrandingViaSystemQuery(systemQuery, tenantId) {
         return EMPTY_BRANDING;
     }
 }
-// managed-pages — vom Tenant editierbare, server-gerenderte Public-Pages.
-// Generalisiert das legal-pages-Render-Muster: eine dynamische Slug-Route
-// (`GET /p/:slug`), die den Tenant aus dem Host auflöst (resolveApexTenant),
-// die published Page lädt, Markdown gehärtet rendert (page-render) und über
-// einen optionalen wrapLayout in Chrome legt. Drafts → 404. Per-Tenant-
-// Content wird per `Vary: Host` cache-isoliert.
+// managed-pages — tenant-editable, server-rendered public pages.
+// Generalizes the legal-pages rendering pattern: a dynamic slug route
+// (`GET /p/:slug`) that resolves the tenant from the Host (resolveApexTenant),
+// loads the published page, renders hardened Markdown (page-render), and wraps
+// it in chrome through an optional wrapLayout. Drafts → 404. Per-tenant
+// content is cache-isolated through `Vary: Host`.
 //
-// Admin-Authoring: registriert entityList + entityEdit für `page` (TenantAdmin/
-// SystemAdmin) + die Convention-CRUD-Handler die der Renderer per Konvention
-// dispatcht. Die Screens MÜSSEN hier liegen (Boot-Validator verlangt entity-Ref
-// same-feature); Nav/Workspace bleibt App-Sache.
+// Admin authoring: registers entityList + entityEdit for `page` (TenantAdmin/
+// SystemAdmin) and the convention CRUD handlers dispatched by the renderer.
+// The screens MUST live here (the boot validator requires the entity reference
+// in the same feature); navigation/workspace remains the app's responsibility.
 //
-// Voraussetzungen am App-Bootstrap:
-//   • anonymousAccess so verdrahtet, dass der X-Tenant-Header honoriert wird
-//     — Multi-Tenant nutzt einen tenantResolver (oder keinen defaultTenantId).
-//     Ein fixer defaultTenantId lockt Single-Tenant und lehnt den per-Page
-//     gesetzten X-Tenant mit 400 tenant_mismatch ab.
-//   • Admin-UI: die App zeigt via `r.nav({ screen: "managed-pages:screen:
-//     page-list" })` + Workspace-Eintrag auf die hier deklarierten Screens
-//     (cross-feature Nav→Screen ist global-validiert) und grantet ihren Admins
-//     TenantAdmin. Ohne Nav bleiben die Screens dormant — kein Leak in
-//     flat-nav-Apps die managed-pages nur zum Public-Render nutzen.
+// App bootstrap requirements:
+//   • anonymousAccess must be wired to honor the X-Tenant header
+//     — multi-tenant apps use a tenantResolver (or no defaultTenantId).
+//     A fixed defaultTenantId locks the app to single-tenant mode and rejects
+//     the per-page X-Tenant with 400 tenant_mismatch.
+//   • Admin UI: the app exposes these screens via `r.nav({ screen:
+//     "managed-pages:screen:page-list" })` plus a workspace entry
+//     (cross-feature Nav→Screen is globally validated) and grants its admins
+//     TenantAdmin. Without navigation, the screens remain dormant — no leak in
+//     flat-nav apps that use managed-pages only for public rendering.
 export function createManagedPagesFeature(opts) {
     const wrapLayout = opts.wrapLayout ??
         ((o) => wrapInLayout({
@@ -112,8 +112,8 @@ export function createManagedPagesFeature(opts) {
             path: `${basePath}/:slug`,
             anonymous: true,
             handler: async (c, { systemQuery }) => {
-                // `param("slug")` ist string|undefined, weil `path` ein computed
-                // Template ist (Hono inferiert `:slug` nur aus String-Literalen).
+                // `param("slug")` is string|undefined because `path` is a computed
+                // template (Hono infers `:slug` only from string literals).
                 const slug = c.req.param("slug");
                 if (!slug)
                     return c.text("not found", 404);
@@ -124,13 +124,13 @@ export function createManagedPagesFeature(opts) {
                 const tenantId = await opts.resolveApexTenant(host);
                 if (!tenantId)
                     return c.text("not found", 404);
-                // Page + branding read in parallel, beide über systemQuery in-
-                // process gegen den host-resolved tenantId erzwungen (kein X-Tenant-
-                // Header-Trick über app.fetch — der sähe für einen host-basierten
-                // anonymousAccess-Resolver wie ein Client-Override aus und würde
-                // von resolverTrust: "authoritative" zurecht abgelehnt; siehe
-                // systemQuery's Doc in http-route.ts). Branding ist Deko → ein
-                // Fehlschlag degradiert zum unbranded Default, blockt nie die Page.
+                // Page and branding are read in parallel, both forced through systemQuery
+                // in-process for the host-resolved tenantId (no X-Tenant header trick
+                // through app.fetch — for a host-based anonymousAccess resolver, that
+                // would look like a client override and would rightly be rejected by
+                // resolverTrust: "authoritative"; see systemQuery's documentation in
+                // http-route.ts). Branding is decorative → a failure degrades to the
+                // unbranded default and never blocks the page.
                 let pageSettled;
                 let brandingResult;
                 try {
@@ -168,8 +168,8 @@ export function createManagedPagesFeature(opts) {
                     "content-type": "text/html; charset=utf-8",
                     vary: "Host",
                 };
-                // 304 (Revision unverändert) und HEAD überspringen beide das
-                // Markdown-Rendern — der Body wird ohnehin verworfen.
+                // 304 (unchanged revision) and HEAD both skip Markdown rendering — the body
+                // would be discarded anyway.
                 if (etagMatches(c.req.raw.headers.get("if-none-match"), etag) || c.req.method === "HEAD") {
                     return cachedSecurePageResponse(c.req.raw, {
                         body: null,

package/dist/managed-pages/handlers/by-slug.query.js

@@ -2,12 +2,11 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { pagesTable } from "../table.js";
-// Public-Read by (tenantId, slug, lang). Anonymous-capable (Landing-/
-// Marketing-Pages). Tenant kommt aus query.user.tenantId — am Render-Pfad
-// via X-Tenant = Host-resolved-tenant gesetzt. Liefert NUR published Pages
-// mit Body: Drafts + leere Pages sind für anonyme Besucher unsichtbar
-// (Route → 404). Admin-Editing nutzt die Entity-List/Edit-Screens, nicht
-// diese Query.
+// Public read by (tenantId, slug, lang), including anonymous access for landing and
+// marketing pages. The tenant comes from query.user.tenantId, set on the render path
+// via X-Tenant = Host-resolved-tenant. Returns ONLY published pages with a body:
+// drafts and empty pages are invisible to anonymous visitors (the route returns 404).
+// Admin editing uses the entity list/edit screens instead of this query.
 export const bySlugQuery = defineQueryHandler({
     name: "by-slug",
     schema: z.object({

package/dist/managed-pages/handlers/by-tenant-published.query.js

@@ -5,8 +5,8 @@ import { pagesTable } from "../table.js";
 export const byTenantPublishedQuery = defineQueryHandler({
     name: "by-tenant-published",
     schema: z.object({
-        /** Optional cross-tenant read — nur für SystemAdmin. Symmetrisch zur
-         *  by-slug.query Override-Logik. */
+        /** Optional cross-tenant read — only for SystemAdmin. Matches the override
+         *  logic in by-slug.query. */
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },

package/dist/managed-pages/handlers/set.write.js

@@ -14,12 +14,10 @@ const langSchema = z
     .max(8)
     .regex(/^[a-z]{2}(-[a-z]{2})?$/i, "lang must be ISO 639-1 (e.g. de, en, en-us)");
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
-// Upsert einer Page — eine Operation pro (tenantId, slug, lang). Tenant-
-// Scope default aus event.user; SystemAdmin kann via `tenantIdOverride`
-// für einen anderen Tenant schreiben (typisch SYSTEM_TENANT_ID für app-
-// weite Pages). published/description/ogImage werden bei Update preserved
-// wenn im Payload weggelassen (undefined) — damit ein Publish-Toggle nicht
-// den Body überschreiben muss und umgekehrt.
+// Upserts one page per (tenantId, slug, lang). The tenant scope defaults to event.user;
+// SystemAdmin can write to another tenant via `tenantIdOverride` (typically SYSTEM_TENANT_ID
+// for app-wide pages). On update, omitted published/description/ogImage values are preserved
+// so a publish toggle does not overwrite the body, and vice versa.
 export const setWrite = defineWriteHandler({
     name: "set",
     schema: z.object({
@@ -30,7 +28,7 @@ export const setWrite = defineWriteHandler({
         description: z.string().max(500).nullable().optional(),
         ogImage: z.string().max(2000).nullable().optional(),
         published: z.boolean().optional(),
-        /** Cross-tenant write — nur SystemAdmin (z.B. SYSTEM_TENANT_ID-Pages). */
+        /** Cross-tenant write — only SystemAdmin (for example, SYSTEM_TENANT_ID pages). */
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["TenantAdmin", "SystemAdmin"] },

package/dist/managed-pages/screens/page-screens.js

@@ -1,11 +1,11 @@
-// Admin-Authoring-Screens für die `page`-Entity. Reine Daten (JSON-safe) —
-// der generische DataTable-/Form-Renderer mountet sie, kein React-Component
-// nötig. Beide MÜSSEN im managed-pages-Feature registriert werden (nicht in
-// der App): der Boot-Validator verlangt, dass `entity: "page"` im selben
-// Feature deklariert ist wie der Screen. Nav/Workspace bleibt App-Sache
-// (placement-spezifisch, `default`-Workspace ist ein App-Singleton) — die
-// App zeigt via `r.nav({ screen: "managed-pages:screen:page-list" })` darauf
-// (cross-feature Nav→Screen ist gegen den globalen Screen-QN-Set validiert).
+// Admin authoring screens for the `page` entity. These are JSON-safe data only —
+// the generic DataTable/form renderer mounts them, so no React component is
+// needed. Both MUST be registered in the managed-pages feature (not in the
+// app): the boot validator requires `entity: "page"` to be declared in the
+// same feature as the screen. Navigation and workspace placement remain app-
+// specific (`default` workspace is an app singleton) — the app points to this
+// via `r.nav({ screen: "managed-pages:screen:page-list" })`.
+// Cross-feature Nav→Screen is validated against the global screen QN set.
 const ADMIN_ROLES = ["TenantAdmin", "SystemAdmin"];
 export const pageListScreen = {
     id: "page-list",
@@ -64,9 +64,9 @@ export const pageEditScreen = {
                     { field: "title", span: 2 },
                     { field: "description", span: 2 },
                     { field: "ogImage", span: 2 },
-                    // Publish/Unpublish: der `published`-Toggle hier IST der
-                    // Publish-Mechanismus (kein separater One-Click-List-Action —
-                    // rowAction-payload kann keine Konstanten injizieren).
+                    // Publish/Unpublish: the `published` toggle here IS the publishing
+                    // mechanism (there is no separate one-click list action —
+                    // rowAction-payload cannot inject constants).
                     { field: "published", span: 1 },
                 ],
             },

package/dist/managed-pages/seeding.js

@@ -1,14 +1,14 @@
-// Test-/Seed-Helper für managed-pages. Legt eine Page direkt über den
-// Event-Store-Executor an — gleicher Pfad wie der echte set-Handler, aber
-// ohne Access-Check. Default ifExists="skip".
+// Test/seed helper for managed-pages. Creates a page directly through the
+// event-store executor—the same path as the real set handler, but without an
+// access check. Default ifExists="skip".
 import { createEventStoreExecutor, createTenantDb, fetchOne, } from "@cosmicdrift/kumiko-framework/db";
 import { runEventStoreSeed, TestUsers, } from "@cosmicdrift/kumiko-framework/seeding";
 import { pageEntity, pagesTable } from "./table.js";
 const executor = createEventStoreExecutor(pagesTable, pageEntity, { entityName: "page" });
 export async function seedPage(db, opts) {
-    // Default-user muss user.tenantId === opts.tenantId haben (sonst landet
-    // der event-store-stream im falschen tenant-bucket → version_conflict
-    // bei späteren echten writes). TestUsers.systemAdmin ist testTenantId(1).
+    // The default user must have user.tenantId === opts.tenantId; otherwise the
+    // event-store stream ends up in the wrong tenant bucket → version_conflict
+    // on subsequent real writes. TestUsers.systemAdmin is testTenantId(1).
     const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
     const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
     const existing = await fetchOne(db, pagesTable, {
@@ -36,8 +36,8 @@ export async function seedPage(db, opts) {
             if (!result.isSuccess) {
                 throw new Error(`seedPage create failed: ${JSON.stringify(result)}`);
             }
-            // @cast-boundary db-row: executor.create result.data ist die inserted
-            // Drizzle-Row (Record<string, unknown>), projected nach RETURNING.
+            // @cast-boundary db-row: executor.create result.data is the inserted
+            // Drizzle row (Record<string, unknown>), projected from RETURNING.
             const data = result.data;
             if (data.id === undefined) {
                 throw new Error("seedPage: executor.create did not return an id");

package/dist/managed-pages/table.js

@@ -1,11 +1,12 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { createBooleanField, createEntity, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
-// Page — vom Tenant editierbare, server-gerenderte Public-Page (Landing,
-// About, custom). Pro (tenantId, slug, lang) genau eine Row. Body ist
-// Markdown (gehärtet server-gerendert über page-render). `published` gated
-// die Auslieferung an anonyme Besucher: Drafts → 404. description/ogImage
-// für SEO + Social-Preview. SYSTEM_TENANT_ID für app-weite Pages, sonst
-// Tenant-eigene Pages (Host → tenantId via resolveApexTenant am Render-Pfad).
+// Page — a tenant-editable, server-rendered public page (landing,
+// about, custom). Exactly one row per (tenantId, slug, lang). The body is
+// Markdown, rendered securely on the server via page-render. `published`
+// gates delivery to anonymous visitors: drafts return 404. description and
+// ogImage support SEO and social previews. SYSTEM_TENANT_ID is used for
+// app-wide pages; otherwise the page belongs to the tenant resolved from the
+// host via resolveApexTenant during rendering.
 export const pageEntity = createEntity({
     table: "read_pages",
     description: "One tenant-editable public web page, unique per slug and language, holding a markdown body plus the title, SEO description and OG image, with a published flag that decides whether anonymous visitors are served it or get a 404.",
@@ -32,12 +33,12 @@ export const pageEntity = createEntity({
             personal: false,
             reason: "is_business_data",
         }),
-        // Body + description sind vom Tenant-Admin authored Business-Content
-        // (Markdown), keine User-Generated-PII. `multiline` → der entityEdit-
-        // Renderer gibt ein <textarea> aus (createLongTextField hat aktuell
-        // einen Render-Gap: edit.ts/render-field.tsx gaten nur type==="text").
-        // maxLengths spiegeln die Handler-Schemas (set.write + Convention-CRUD
-        // leiten ihre zod-Caps aus diesen Field-maxLengths ab).
+        // Body and description are tenant-admin-authored business content
+        // (Markdown), not user-generated PII. `multiline` makes the entityEdit
+        // renderer output a <textarea> (createLongTextField currently has a
+        // rendering gap: edit.ts/render-field.tsx only gates on type==="text").
+        // maxLengths mirror the handler schemas (set.write and convention CRUD
+        // derive their zod caps from these field maxLengths).
         body: createTextField({
             multiline: { rows: 16 },
             maxLength: 100_000,

package/dist/managed-pages/web/client-plugin.d.ts

@@ -1,7 +1,7 @@
 import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 export type ManagedPagesClientOptions = {
-    /** Key-wise Overrides über die Default-Bundles (de/en). */
+    /** Key-wise overrides of the default bundles (de/en). */
     readonly translations?: TranslationsByLocale;
 };
 export declare function managedPagesClient(options?: ManagedPagesClientOptions): ClientFeatureDefinition;

package/dist/managed-pages/web/client-plugin.js

@@ -1,8 +1,8 @@
-// Client-Feature-Factory für managed-pages. Bringt NUR die Übersetzungen mit —
-// die Screens (page-list/page-edit/branding-settings) sind schema-driven
-// (entityList/entityEdit/configEdit), also keine custom-React-Components zu
-// registrieren. Apps mounten es in createKumikoApp({ clientFeatures:
-// [managedPagesClient()] }), damit die Admin-Labels übersetzt rendern.
+// Client feature factory for managed-pages. It provides ONLY translations —
+// the screens (page-list/page-edit/branding-settings) are schema-driven
+// (entityList/entityEdit/configEdit), so no custom React components are
+// registered. Apps mount it in createKumikoApp({ clientFeatures:
+// [managedPagesClient()] }) so the admin labels render translated.
 import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
 import { defaultTranslations } from "./default-translations.js";
 export function managedPagesClient(options) {

package/dist/managed-pages/web/i18n.js

@@ -48,7 +48,7 @@ export const MANAGED_PAGES_I18N = {
     "managed-pages:confirms.page-delete": {
         en: "Delete this page?",
     },
-    // Nur bei allowCustomCss:true im Screen — unconditional geliefert
+    // Only used when allowCustomCss:true in the screen; supplied unconditionally
     "managed-pages:entity:__config-edit__:field:customCss": { en: "Custom CSS" },
     "managed-pages:branding.section.custom-css": { en: "Custom CSS" },
 };