@cosmicdrift/kumiko-bundled-features 0.401.0 → 0.403.0

package/dist/agent-tools/agent-manifest.js

@@ -3,6 +3,23 @@ import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-type
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { recordManifestDenyQns } from "./manifest-deny-qns.js";
+import { isExplicitlyAgentHidden } from "./tool-catalog.js";
+const FALLBACK_LOCALE = "en";
+/** Requested locale, then English, then the first remaining locale in code-point
+ *  order; `undefined` when the entry has no text at all (the key is then omitted). */
+function pickLabel(labels, locale) {
+    const nonEmpty = (value) => value !== undefined && value !== "" ? value : undefined;
+    const firstLocale = Object.keys(labels)
+        .sort(compareIds)
+        .find((key) => nonEmpty(labels[key]));
+    return (nonEmpty(labels[locale]) ??
+        nonEmpty(labels[FALLBACK_LOCALE]) ??
+        (firstLocale !== undefined ? labels[firstLocale] : undefined));
+}
+function labelProp(labels, locale) {
+    const label = pickLabel(labels, locale);
+    return label === undefined ? {} : { label };
+}
 /** The manifest surfaces one string per locale — a plural entry reads as its
  *  CLDR `other` form since the manifest has no `count` to select a category. */
 function entryAsLabels(entry) {
@@ -73,13 +90,13 @@ function isFilterableField(field) {
 function isPiiField(field) {
     return "pii" in field && field.pii === true;
 }
-function buildField(entityName, fieldName, field, translations, searchableFields) {
+function buildField(entityName, fieldName, field, translations, searchableFields, locale) {
     const options = field.type === "select" || field.type === "multiSelect" ? field.options : undefined;
     const references = field.type === "reference" ? field.entity : undefined;
     return {
         name: fieldName,
         type: field.type,
-        labels: labelsForSuffix(translations, `:entity:${entityName}:field:${fieldName}`),
+        ...labelProp(labelsForSuffix(translations, `:entity:${entityName}:field:${fieldName}`), locale),
         ...(field.description !== undefined && { description: field.description }),
         ...(options !== undefined && { options }),
         ...(references !== undefined && { references }),
@@ -88,29 +105,45 @@ function buildField(entityName, fieldName, field, translations, searchableFields
         ...(isPiiField(field) && { pii: true }),
     };
 }
-/** Entity schemas are emitted unfiltered by design: roles gate handlers, screens,
- *  navs and workspaces, while the handler pipeline gates the values themselves.
- *  The manifest describes shape, never data. */
-function buildEntities(entities, translations, getSearchableFields) {
+/** Shape, never data. Only entities the role reaches are emitted: the manifest is
+ *  prompt payload, so every extra schema costs tokens on each turn. */
+function buildEntities(entities, translations, getSearchableFields, visibleEntityNames, locale) {
     const result = [];
     for (const [entityName, entity] of entities) {
+        if (!visibleEntityNames.has(entityName))
+            continue;
         const searchableFields = new Set(getSearchableFields(entityName));
-        const fields = Object.entries(entity.fields).map(([fieldName, field]) => buildField(entityName, fieldName, field, translations, searchableFields));
+        const fields = Object.entries(entity.fields).map(([fieldName, field]) => buildField(entityName, fieldName, field, translations, searchableFields, locale));
         result.push({
             name: entityName,
-            labels: labelsForSuffix(translations, `:entity:${entityName}`),
+            ...labelProp(labelsForSuffix(translations, `:entity:${entityName}`), locale),
             ...(entity.description !== undefined && { description: entity.description }),
             fields,
         });
     }
     return result;
 }
-function buildFeatures(features) {
+const FEATURE_DESCRIPTION_MAX_CHARS = 300;
+// Only ". " before a capital ends the sentence, so "e.g. the" and "Art. 15" stay whole.
+const SENTENCE_END = /\.\s+(?=\p{Lu})/u;
+/** The manifest is prompt payload; the full text stays in `FeatureDefinition.description`
+ *  for the docs generators. */
+function leadSentence(description) {
+    const text = description.replace(/\s+/g, " ").trim();
+    const end = SENTENCE_END.exec(text);
+    const sentence = end === null ? text : text.slice(0, end.index + 1);
+    return sentence.slice(0, FEATURE_DESCRIPTION_MAX_CHARS);
+}
+function buildFeatures(features, visibleFeatureNames) {
     const result = [];
     for (const [, feature] of features) {
+        if (!visibleFeatureNames.has(feature.name))
+            continue;
         result.push({
             name: feature.name,
-            ...(feature.description !== undefined && { description: feature.description }),
+            ...(feature.description !== undefined && {
+                description: leadSentence(feature.description),
+            }),
             ...(feature.uiHints?.displayLabel !== undefined && {
                 displayLabel: feature.uiHints.displayLabel,
             }),
@@ -152,7 +185,7 @@ function buildHandlerEntry(qn, kind, def, roles, getHandlerEntity, denyQns) {
         return undefined;
     // `agent.expose: true` without a `description` still opts in — the author
     // asked for exposure explicitly, there's just nothing to show as prose.
-    const description = def.description ?? "";
+    const description = def.description !== undefined && def.description !== "" ? def.description : undefined;
     let inputSchema;
     try {
         // A handler whose schema can't be expressed as JSON Schema (transforms,
@@ -168,7 +201,7 @@ function buildHandlerEntry(qn, kind, def, roles, getHandlerEntity, denyQns) {
     return {
         qn,
         kind,
-        description,
+        ...(description !== undefined && { description }),
         risk: exposure.risk,
         inputSchema,
         ...(entity !== undefined && { entity }),
@@ -199,7 +232,7 @@ function assertDenyQnsExist(denyQns, registry) {
         throw new Error(`agent denyQns names handlers that are not registered: ${unknown.join(", ")}`);
     }
 }
-function buildNavs(navs, workspaces, translations, roles, screens) {
+function buildNavs(navs, workspaces, translations, roles, screens, locale) {
     const result = [];
     for (const [, nav] of navs) {
         if (!uiVisible(nav.access, roles))
@@ -215,10 +248,10 @@ function buildNavs(navs, workspaces, translations, roles, screens) {
             continue;
         result.push({
             id: nav.id,
-            labels: entryAsLabels(translations[nav.label] ?? {}),
+            ...labelProp(entryAsLabels(translations[nav.label] ?? {}), locale),
             ...(nav.screen !== undefined && { screen: nav.screen }),
             ...(nav.parent !== undefined && { parent: nav.parent }),
-            workspaces: visibleWorkspaces,
+            ...(visibleWorkspaces.length > 0 && { workspaces: visibleWorkspaces }),
         });
     }
     return withoutOrphanedNavs(result);
@@ -235,6 +268,46 @@ function withoutOrphanedNavs(navs) {
         remaining = reachable;
     }
 }
+// Qualified handler, screen and nav ids all start with the owning feature name.
+function featureNameOf(qualifiedId) {
+    const idx = qualifiedId.indexOf(":");
+    return idx === -1 ? qualifiedId : qualifiedId.slice(0, idx);
+}
+function visibleFeatureNamesOf(handlers, screens, navs) {
+    return new Set([...handlers.map((h) => h.qn), ...screens.map((s) => s.id), ...navs.map((n) => n.id)].map(featureNameOf));
+}
+function entitiesOfQueryToolsFor(registry, roles, denyQns) {
+    const names = [];
+    for (const [qn, def] of registry.getAllQueryHandlers()) {
+        const entityName = registry.getHandlerEntity(qn);
+        if (entityName === undefined || denyQns.has(qn) || isExplicitlyAgentHidden(def))
+            continue;
+        if (hasAccess({ roles }, def.access))
+            names.push(entityName);
+    }
+    return names;
+}
+// A reference target is "entity" or "<feature>:entity"; registry entity keys are the bare name.
+function entityNameOfReference(target) {
+    return target.slice(target.lastIndexOf(":") + 1);
+}
+function referenceTargetsOf(entity) {
+    return Object.values(entity?.fields ?? {}).flatMap((field) => field.type === "reference" ? [entityNameOfReference(field.entity)] : []);
+}
+/** Reachable = tagged on a manifest handler, shown by a manifest screen, or read by a
+ *  registry-derived `get_`/`list_` tool (which takes labels from the manifest entity). */
+function visibleEntityNamesOf(registry, roles, denyQns, handlers, screens) {
+    const reachable = new Set([
+        ...handlers.flatMap((handler) => (handler.entity !== undefined ? [handler.entity] : [])),
+        ...screens.flatMap((screen) => [screen.entity ?? [], screen.detailFor ?? []].flat()),
+        ...entitiesOfQueryToolsFor(registry, roles, denyQns),
+    ]);
+    const entities = registry.getAllEntities();
+    return new Set([
+        ...reachable,
+        ...[...reachable].flatMap((n) => referenceTargetsOf(entities.get(n))),
+    ]);
+}
 function lastSegment(qualifiedId) {
     const idx = qualifiedId.lastIndexOf(":");
     return idx === -1 ? qualifiedId : qualifiedId.slice(idx + 1);
@@ -242,10 +315,31 @@ function lastSegment(qualifiedId) {
 function detailIdParam(screen) {
     return screen.type === "projectionDetail" ? (screen.idParam ?? "id") : "id";
 }
-function screenTitles(translations, screenId, shortId) {
-    return entryAsLabels(translations[`${screenId}.title`] ?? translations[`screen:${shortId}.title`] ?? {});
+function screenTitles(translations, screenId, shortId, locale) {
+    const title = pickLabel(entryAsLabels(translations[`${screenId}.title`] ?? translations[`screen:${shortId}.title`] ?? {}), locale);
+    return title === undefined ? {} : { title };
+}
+function buildScreenEntry(screen, screenWorkspaces, translations, locale) {
+    return {
+        id: screen.id,
+        type: screen.type,
+        ...screenTitles(translations, screen.id, lastSegment(screen.id), locale),
+        // `screen.description` may be a raw i18n key (`registry.getAllTranslations()`
+        // double-prefixes it, see build-app-schema.ts:77-81) — match on suffix like
+        // `labelsForSuffix` does for entity/field labels, else fall back to the
+        // literal string as authored.
+        ...(screen.description !== undefined && {
+            description: pickLabel(labelsForSuffix(translations, screen.description), locale) ?? screen.description,
+        }),
+        ...("entity" in screen && screen.entity !== undefined && { entity: screen.entity }),
+        // A detail screen takes the row id under its idParam; everything else is parameterless.
+        ...(screen.detailFor !== undefined && { params: [detailIdParam(screen)] }),
+        ...(screenWorkspaces.length > 0 && { workspaces: screenWorkspaces }),
+        ...(screen.detailFor !== undefined && { detailFor: screen.detailFor }),
+        ...("handler" in screen && typeof screen.handler === "string" && { handler: screen.handler }),
+    };
 }
-function buildScreens(screens, navs, workspaces, translations, roles, visibleNavIds) {
+function buildScreens(screens, navs, workspaces, translations, roles, visibleNavIds, locale) {
     const allNavs = [...navs.values()];
     const result = [];
     for (const [, screen] of screens) {
@@ -265,37 +359,19 @@ function buildScreens(screens, navs, workspaces, translations, roles, visibleNav
             });
         if (!uiVisible(screen.access, roles) || !reachable)
             continue;
-        const shortId = lastSegment(screen.id);
         const screenWorkspaces = dedupeSorted(accessibleNavs.flatMap((nav) => visibleWorkspaceIds(nav.workspaces, workspaces, roles)));
-        result.push({
-            id: screen.id,
-            type: screen.type,
-            titles: screenTitles(translations, screen.id, shortId),
-            // `screen.description` may be a raw i18n key (`registry.getAllTranslations()`
-            // double-prefixes it, see build-app-schema.ts:77-81) — match on suffix like
-            // `labelsForSuffix` does for entity/field labels, else fall back to the
-            // literal string as authored.
-            ...(screen.description !== undefined && {
-                description: labelsForSuffix(translations, screen.description)["en"] ?? screen.description,
-            }),
-            ...("entity" in screen && screen.entity !== undefined && { entity: screen.entity }),
-            // A detail screen takes the row id under its idParam; everything else is parameterless.
-            params: screen.detailFor !== undefined ? [detailIdParam(screen)] : [],
-            workspaces: screenWorkspaces,
-            ...(screen.detailFor !== undefined && { detailFor: screen.detailFor }),
-            ...("handler" in screen && typeof screen.handler === "string" && { handler: screen.handler }),
-        });
+        result.push(buildScreenEntry(screen, screenWorkspaces, translations, locale));
     }
     return result;
 }
-function buildWorkspaces(workspaces, translations, roles) {
+function buildWorkspaces(workspaces, translations, roles, locale) {
     const result = [];
     for (const [, workspace] of workspaces) {
         if (!uiVisible(workspace.access, roles))
             continue;
         result.push({
             id: workspace.id,
-            labels: entryAsLabels(translations[workspace.label] ?? {}),
+            ...labelProp(entryAsLabels(translations[workspace.label] ?? {}), locale),
             ...(workspace.default === true && { default: true }),
         });
     }
@@ -310,13 +386,14 @@ export function buildAgentManifest(registry, options) {
     const navMap = registry.getAllNavs();
     const { roles } = options;
     assertDenyQnsExist(options.denyQns ?? [], registry);
-    const features = buildFeatures(registry.features);
-    const entities = buildEntities(registry.getAllEntities(), translations, (name) => registry.getSearchableFields(name));
-    const handlers = buildHandlers(registry.getAllQueryHandlers(), registry.getAllWriteHandlers(), roles, (qn) => registry.getHandlerEntity(qn), new Set(options.denyQns ?? []));
+    const denyQns = new Set(options.denyQns ?? []);
+    const handlers = buildHandlers(registry.getAllQueryHandlers(), registry.getAllWriteHandlers(), roles, (qn) => registry.getHandlerEntity(qn), denyQns);
     const screenMap = registry.getAllScreens();
-    const navs = buildNavs(navMap, workspaceMap, translations, roles, screenMap);
-    const screens = buildScreens(screenMap, navMap, workspaceMap, translations, roles, new Set(navs.map((nav) => nav.id)));
-    const workspaces = buildWorkspaces(workspaceMap, translations, roles);
+    const navs = buildNavs(navMap, workspaceMap, translations, roles, screenMap, options.locale);
+    const screens = buildScreens(screenMap, navMap, workspaceMap, translations, roles, new Set(navs.map((nav) => nav.id)), options.locale);
+    const workspaces = buildWorkspaces(workspaceMap, translations, roles, options.locale);
+    const features = buildFeatures(registry.features, visibleFeatureNamesOf(handlers, screens, navs));
+    const entities = buildEntities(registry.getAllEntities(), translations, (name) => registry.getSearchableFields(name), visibleEntityNamesOf(registry, roles, denyQns, handlers, screens), options.locale);
     const manifest = {
         builtForRoles: [...roles],
         features: sortedByKey(features, (f) => f.name),
@@ -330,6 +407,6 @@ export function buildAgentManifest(registry, options) {
             ...(options.currency && { currency: options.currency }),
         },
     };
-    recordManifestDenyQns(manifest, new Set(options.denyQns ?? []));
+    recordManifestDenyQns(manifest, denyQns);
     return manifest;
 }

package/dist/agent-tools/tool-catalog.d.ts

@@ -1,4 +1,10 @@
+import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import type { AgentManifest, RegistrySearchView, ToolCatalog, ToolCatalogOptions } from "./types.ts";
+/** The entity CRUD tools are enumerated off the registry, not off the manifest, so
+ *  `resolveAgentExposure` never runs for them. Only an EXPLICIT opt-out may hide one here —
+ *  the resolver's own default is fail-closed on a missing `description`, and CRUD-generated
+ *  handlers never carry one, so reusing it would delete every entity tool in every app. */
+export declare function isExplicitlyAgentHidden(def: QueryHandlerDef): boolean;
 /** Drops the `query`/`write` verb segment from a handler QN, joins the rest with `_`, and
  *  sanitizes to a valid tool-call identifier. Only the FIRST matching segment is dropped —
  *  QNs are `<feature>:query|write:<entity>:<verb>`, so the verb only ever appears once at that

package/dist/agent-tools/tool-catalog.js

@@ -72,7 +72,7 @@ function isDetailHandlerQn(qn, entityName) {
  *  `resolveAgentExposure` never runs for them. Only an EXPLICIT opt-out may hide one here —
  *  the resolver's own default is fail-closed on a missing `description`, and CRUD-generated
  *  handlers never carry one, so reusing it would delete every entity tool in every app. */
-function isExplicitlyAgentHidden(def) {
+export function isExplicitlyAgentHidden(def) {
     return def.agent?.expose === false;
 }
 /** The model's filters feed the WHERE clause, and only the output is field-filtered — a field
@@ -105,10 +105,10 @@ function addToolsForListHandler(registry, qn, entityName, entity, roles, sink) {
         addTool(sink, tool, { kind: "findBy", entityName, fieldName, qn });
     }
 }
-function entityDisplayLabel(entity, entityName, locale) {
+function entityDisplayLabel(entity, entityName) {
     if (entity?.description)
         return entity.description;
-    const label = entity?.labels[locale];
+    const label = entity?.label;
     if (label)
         return label;
     return entityName;
@@ -212,7 +212,7 @@ function stripFieldFromSchema(schema, field) {
     return { ...rest, properties: strippedProperties, required: strippedRequired };
 }
 function handlerDescription(handler) {
-    return handler.description.length > 0 ? handler.description : `Run ${handler.qn}.`;
+    return handler.description ?? `Run ${handler.qn}.`;
 }
 /** Drops the `query`/`write` verb segment from a handler QN, joins the rest with `_`, and
  *  sanitizes to a valid tool-call identifier. Only the FIRST matching segment is dropped —
@@ -373,18 +373,18 @@ function collectEntityHandlerQns(registry, roleFilter, denyQns) {
     }
     return { detailQnByEntity, listQnByEntity, entityListDetailQns };
 }
-function addGetTools(registry, detailQnByEntity, entityByName, locale, sink) {
+function addGetTools(registry, detailQnByEntity, entityByName, sink) {
     const getEntries = [...detailQnByEntity.entries()].sort((a, b) => compareByCodePoint(a[0], b[0]));
     for (const [entityName, qn] of getEntries) {
-        const label = entityDisplayLabel(entityByName.get(entityName), entityName, locale);
+        const label = entityDisplayLabel(entityByName.get(entityName), entityName);
         const { tool, descriptor } = buildGetTool(entityName, qn, label, entityHandlerRisk(registry, qn));
         addTool(sink, tool, descriptor);
     }
 }
-function addListTools(registry, listQnByEntity, entityByName, roles, locale, sink) {
+function addListTools(registry, listQnByEntity, entityByName, roles, sink) {
     const listEntries = [...listQnByEntity.entries()].sort((a, b) => compareByCodePoint(a[0], b[0]));
     for (const [entityName, qn] of listEntries) {
-        const label = entityDisplayLabel(entityByName.get(entityName), entityName, locale);
+        const label = entityDisplayLabel(entityByName.get(entityName), entityName);
         const searchableFields = registry.getSearchableFields(entityName);
         const filterableFields = filterableFieldsOf(entityByName.get(entityName), registry.getEntity(entityName), roles);
         const { tool, descriptor } = buildListTool(entityName, qn, label, searchableFields, filterableFields, entityHandlerRisk(registry, qn));
@@ -472,14 +472,13 @@ function addClientTools(manifest, mode, sink) {
 export function buildToolCatalog(registry, manifest, options) {
     const sink = { tools: [], dispatchTable: new Map(), usedNames: new Set() };
     const roleFilter = { roles: manifest.builtForRoles };
-    const locale = manifest.tenantSettings.locale;
     const entityByName = new Map(manifest.entities.map((entity) => [entity.name, entity]));
     const denyQns = new Set(options.denyQns ?? []);
     assertCatalogMirrorsManifestDenyQns(manifest, denyQns);
     addRegistrySearchTools(registry, roleFilter, denyQns, sink);
     const { detailQnByEntity, listQnByEntity, entityListDetailQns } = collectEntityHandlerQns(registry, roleFilter, denyQns);
-    addGetTools(registry, detailQnByEntity, entityByName, locale, sink);
-    addListTools(registry, listQnByEntity, entityByName, roleFilter.roles, locale, sink);
+    addGetTools(registry, detailQnByEntity, entityByName, sink);
+    addListTools(registry, listQnByEntity, entityByName, roleFilter.roles, sink);
     addQueryHandlerTools(manifest, entityListDetailQns, denyQns, sink);
     if (options.mode !== "read-only") {
         addWriteHandlerTools(manifest, detailQnByEntity, denyQns, sink);

package/dist/agent-tools/types.d.ts

@@ -105,8 +105,8 @@ export type AgentManifestOptions = {
 export type AgentManifestField = {
     readonly name: string;
     readonly type: string;
-    /** Label per app locale, keyed by locale code. */
-    readonly labels: Readonly<Record<string, string>>;
+    /** Label in the requested locale (English, then any other, as fallback); absent when untranslated. */
+    readonly label?: string;
     readonly description?: string;
     readonly options?: readonly string[];
     /** Entity a `reference` field points at. */
@@ -119,14 +119,14 @@ export type AgentManifestField = {
 };
 export type AgentManifestEntity = {
     readonly name: string;
-    readonly labels: Readonly<Record<string, string>>;
+    readonly label?: string;
     readonly description?: string;
     readonly fields: readonly AgentManifestField[];
 };
 export type AgentManifestHandler = {
     readonly qn: string;
     readonly kind: "query" | "write";
-    readonly description: string;
+    readonly description?: string;
     readonly risk: AgentRisk;
     readonly inputSchema: Readonly<Record<string, unknown>>;
     readonly entity?: string;
@@ -136,11 +136,12 @@ export type AgentManifestHandler = {
 export type AgentManifestScreen = {
     readonly id: string;
     readonly type: string;
-    readonly titles: Readonly<Record<string, string>>;
+    readonly title?: string;
     readonly description?: string;
     readonly entity?: string;
-    readonly params: readonly string[];
-    readonly workspaces: readonly string[];
+    /** Only present on detail screens. */
+    readonly params?: readonly string[];
+    readonly workspaces?: readonly string[];
     /** Entity this screen is the detail view for. Distinct from `entity`: a custom
      *  screen can render entity A while being the detail view for B. */
     readonly detailFor?: string;
@@ -149,14 +150,14 @@ export type AgentManifestScreen = {
 };
 export type AgentManifestNav = {
     readonly id: string;
-    readonly labels: Readonly<Record<string, string>>;
+    readonly label?: string;
     readonly screen?: string;
     readonly parent?: string;
-    readonly workspaces: readonly string[];
+    readonly workspaces?: readonly string[];
 };
 export type AgentManifestWorkspace = {
     readonly id: string;
-    readonly labels: Readonly<Record<string, string>>;
+    readonly label?: string;
     readonly default?: true;
 };
 export type AgentManifestFeature = {

package/dist/billing-foundation/consumer-protection/confirmation-mail.js

@@ -1,7 +1,7 @@
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { Marked } from "marked";
-import { isAllowedDocumentLinkHref, isDocumentPlaceholderHref, } from "../../template-resolver/index.js";
+import { isAllowedDocumentUrlHref, isDocumentPlaceholderHref, } from "../../template-resolver/index.js";
 import { resolveConsentLocale } from "./consent-text.js";
 export const CONFIRMATION_LABELS = {
     de: {
@@ -96,7 +96,7 @@ function formatDate(iso, locale, timeZone) {
 // row as escaped text, so author HTML, images and refused links stay plain text.
 const ROW_END = "\n\n";
 function isMailLinkHref(href) {
-    return isAllowedDocumentLinkHref(href) && !isDocumentPlaceholderHref(href);
+    return isAllowedDocumentUrlHref(href) && !isDocumentPlaceholderHref(href);
 }
 const inlineHtmlMarkdown = new Marked({ gfm: false, breaks: false });
 inlineHtmlMarkdown.use({

package/dist/inbound-mail-foundation/entities.js

@@ -214,6 +214,7 @@ export const syncCursorEntity = createEntity({
 export const seenMessageEntity = createEntity({
     table: "store_mail_seen_messages",
     softDelete: false,
+    indexes: [{ unique: true, columns: ["accountId", "providerMessageId"] }],
     fields: {
         accountId: createTextField({
             required: true,

package/dist/inbound-mail-foundation/watch-lease.d.ts

@@ -5,7 +5,7 @@ export type WatchLease = {
     readonly acquire: (account: MailAccountRecord, state: WatcherState) => Promise<WatchLeaseResult>;
 };
 export declare function createWatchLease(deps: {
-    readonly lock: DistributedLock | undefined;
+    readonly lock: DistributedLock;
     readonly ttlSeconds: number;
     readonly renewIntervalMs: number;
     readonly watchers: ReadonlyMap<string, WatcherState>;

package/dist/inbound-mail-foundation/watch-lease.js

@@ -20,7 +20,7 @@ export function createWatchLease(deps) {
     async function renewLeaseOnce(account, state, generation) {
         state.renewTimer = null;
         // skip: supervisor stopped, generation superseded, or lease already lost — stale timer fire, nothing to renew.
-        if (!isRunning() || state.generation !== generation || !state.lockToken || !lock)
+        if (!isRunning() || state.generation !== generation || !state.lockToken)
             return;
         let renewed;
         try {
@@ -55,7 +55,7 @@ export function createWatchLease(deps) {
     }
     // kumiko-lint-ignore complexity-budget yield-point stale-map check after acquire is intentional
     async function acquire(account, state) {
-        if (!lock || state.lockToken)
+        if (state.lockToken)
             return "acquired";
         // A throwing lock (Redis outage) reads as "not claimed": the next tick retries instead of leaving the start flag set.
         const token = await lock.acquire(account.id, { ttlSeconds: ttlSeconds }).catch((err) => {

package/dist/inbound-mail-foundation/watch-supervisor-types.d.ts

@@ -40,15 +40,15 @@ export type InboundMailSupervisorDeps = {
     /** Coordinates the IMAP watch (not the poll) across worker processes:
      *  before `plugin.watch()`, ensureWatcher claims a TTL lease for the
      *  account via `lock.acquire` and renews it via `lock.renew` while the
-     *  watcher lives. Omit for single-process deployments — every active
-     *  account is watched locally, same as before. */
-    readonly lock?: DistributedLock;
+     *  watcher lives. Required: without it every worker would hold its own
+     *  IDLE connection per account. */
+    readonly lock: DistributedLock;
     /** Access-token lifecycle for OAuth accounts. Defaults to a manager built
      *  from `db` + `providerCtx.secrets`; pass the instance shared with
      *  `createInboundMailConnectRoutes` so a fresh connect primes this cache. */
     readonly oauthTokens?: OAuthAccessTokenManager;
     /** TTL (seconds) for the per-account watch lease. Default 90s, renewed
-     *  every ttl/3. Only used when `lock` is set. */
+     *  every ttl/3. */
     readonly watchLeaseTtlSeconds?: number;
     readonly log?: (line: string) => void;
 };
@@ -60,7 +60,7 @@ export type WatcherState = {
      *  an already stopped watcher. */
     generation: number;
     /** Token from `deps.lock.acquire` while this worker owns the account's
-     *  watch lease; null when unclaimed (no `deps.lock`, or claim lost). */
+     *  watch lease; null when unclaimed (claim lost). */
     lockToken: string | null;
     renewTimer: ReturnType<typeof setTimeout> | null;
     /** Consecutive renew() throws — tear down once failures span a full TTL. */

package/dist/inbound-mail-foundation/watch-supervisor.js

@@ -17,11 +17,9 @@
 //     db,
 //     dispatchWrite: ({ handlerQn, payload, tenantId }) =>
 //       deps.dispatchSystemWrite({ handlerQn, payload, tenantId: tenantId as TenantId }),
-//     // Multi-worker deployments: share one DistributedLock (same Redis,
-//     // same key prefix) across every worker process so only one of them
-//     // holds the IMAP IDLE connection per account. Omit `lock`
-//     // for a single-process deployment — every active account gets
-//     // watched locally, as before.
+//     // One DistributedLock (same Redis, same key prefix) shared across
+//     // every worker process, so only one of them holds the IMAP IDLE
+//     // connection per account.
 //     lock: createDistributedLock(redis, `${RedisKeys.lock}inbound-mail:watch:`),
 //   });
 //   await supervisor.start();
@@ -34,7 +32,7 @@
 // **Multi-worker coordination:** the reconciliation poll remains deliberately
 // N-fold: every worker polls every active account, which is idempotent and
 // cheap. Only `plugin.watch()` holds a long-lived connection, and only one
-// worker may hold it per account. With `deps.lock`, `ensureWatcher` claims a
+// worker may hold it per account. `ensureWatcher` claims a
 // TTL lease (`lock.acquire`) before connecting; a worker that fails to claim
 // it leaves the account to its current holder, while the poll still covers
 // it. The holder renews the lease via heartbeat (`lock.renew`, every ttl/3)
@@ -375,7 +373,7 @@ export function createInboundMailSupervisor(deps) {
                 log(`inbound-mail: stop watcher ${accountId} failed: ${describeError(err)}`);
             }
         }
-        if (deps.lock && lockToken) {
+        if (lockToken) {
             try {
                 await deps.lock.release(accountId, lockToken);
             }

package/dist/managed-pages/feature.js

@@ -184,7 +184,15 @@ export function createManagedPagesFeature(opts) {
                 }
                 const html = wrapLayout({
                     title: data.title,
-                    bodyHtml: renderPageBody({ slug, body: data.body, bodyFormat: data.bodyFormat }),
+                    bodyHtml: renderPageBody({
+                        tenantId,
+                        slug,
+                        lang,
+                        version: data.version,
+                        updatedAt: data.updatedAt,
+                        body: data.body,
+                        bodyFormat: data.bodyFormat,
+                    }),
                     lang: data.lang,
                     slug,
                     description: data.description,

package/dist/managed-pages/render-page-body.d.ts

@@ -1,10 +1,21 @@
 import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
+import { sanitizeDocumentHtml } from "../template-resolver/index.ts";
 import type { BodyFormat } from "./constants.ts";
 type WarnLogger = Pick<Logger, "warn">;
 export type RenderablePageBody = {
+    readonly tenantId: string;
     readonly slug: string;
+    readonly lang: string;
+    readonly version: number;
+    readonly updatedAt: string;
     readonly body: string;
     readonly bodyFormat: BodyFormat;
 };
-export declare function renderPageBody(page: RenderablePageBody, log?: WarnLogger): string;
+export type PageBodyRendererDeps = {
+    readonly sanitizeDocument?: typeof sanitizeDocumentHtml;
+    readonly renderMarkdown?: (markdown: string) => string;
+    readonly maxEntries?: number;
+};
+export declare function createPageBodyRenderer(deps?: PageBodyRendererDeps): (page: RenderablePageBody, log?: WarnLogger) => string;
+export declare const renderPageBody: (page: RenderablePageBody, log?: WarnLogger) => string;
 export {};