@cosmicdrift/kumiko-samples 0.338.0 → 0.339.0

package/packages/bundled-features/src/inbound-mail-foundation/oauth-access-token.ts

@@ -0,0 +1,201 @@
+// OAuth access-token lifecycle for inbound-mail accounts. Access tokens
+// (~1h) are never persisted: they live in a per-process cache and are
+// re-minted from the refresh token in the account's secret slot.
+//
+// Serialization:
+//   - in-process: single-flight per account (concurrent callers share one
+//     refresh).
+//   - cross-worker: a pg advisory xact lock around "re-read refresh token →
+//     provider refresh → persist rotated refresh token". This serializes
+//     refreshes and secret writes so a rotating provider can't see two
+//     workers redeem the same refresh token concurrently. It does NOT make
+//     refresh exactly-once across workers: access tokens are per-process, so
+//     each worker still refreshes once itself.
+//
+// The refresh token is re-read inside the lock via `secrets.get` without an
+// audit context. SecretsContext does not cache values (only unwrapped DEKs),
+// so the read always reflects the latest committed write.
+
+import { transaction } from "@cosmicdrift/kumiko-framework/bun-db";
+import { acquireNamespacedAdvisoryLock, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import { Temporal } from "temporal-polyfill";
+import { InboundMailAuthMethods, inboundCredentialSecretKey } from "./constants.js";
+import {
+  InboundAuthError,
+  type InboundMailContext,
+  type InboundMailProviderPlugin,
+  type MailAccountRecord,
+  type OAuthTokenSet,
+} from "./types.js";
+
+// 'inoa' as ASCII — disjoint from the other fixed advisory-lock namespaces.
+const OAUTH_REFRESH_LOCK_NAMESPACE = 0x696e6f61;
+const ACCESS_TOKEN_EXPIRY_MARGIN = Temporal.Duration.from({ minutes: 2 });
+// The provider call runs while the lock transaction holds a pool connection,
+// so it gets an abort signal with this upper bound.
+const DEFAULT_REFRESH_TIMEOUT_MS = 30_000;
+
+/** Shared by the OAuth callback and the refresh path so both write the slot identically. */
+export function inboundRefreshTokenSecretOptions(accountId: string) {
+  return {
+    redact: (plaintext: string) => `${plaintext.slice(0, 4)}…`,
+    hint: `OAuth refresh token for inbound mail account ${accountId}`,
+  };
+}
+
+/** True for accounts whose access token the foundation must supply. */
+export function usesFoundationManagedOAuth(
+  account: MailAccountRecord,
+  plugin: InboundMailProviderPlugin,
+): boolean {
+  return (
+    plugin.oauth !== undefined &&
+    (account.authMethod === InboundMailAuthMethods.oauth ||
+      account.authMethod === InboundMailAuthMethods.xoauth2)
+  );
+}
+
+export type OAuthAccessTokenManagerDeps = {
+  readonly db: DbConnection;
+  readonly secrets: SecretsContext;
+  readonly providerCtx?: InboundMailContext;
+  readonly now?: () => Temporal.Instant;
+  readonly refreshTimeoutMs?: number;
+};
+
+export type OAuthAccessTokenManager = {
+  /** Valid access token for the account; refreshes when missing or near expiry. */
+  readonly getAccessToken: (
+    account: MailAccountRecord,
+    plugin: InboundMailProviderPlugin,
+  ) => Promise<string>;
+  /** Writes the refresh token under the account lock and drops any cached access token. */
+  readonly storeRefreshToken: (
+    account: Pick<MailAccountRecord, "id" | "tenantId">,
+    refreshToken: string,
+  ) => Promise<void>;
+  /** Seeds the cache from a code-exchange result (access token only). */
+  readonly primeFromExchange: (
+    account: Pick<MailAccountRecord, "id">,
+    tokens: OAuthTokenSet,
+  ) => void;
+  readonly invalidate: (accountId: string) => void;
+};
+
+type CachedToken = { readonly accessToken: string; readonly expiresAt: Temporal.Instant };
+
+function lockKey(account: Pick<MailAccountRecord, "id" | "tenantId">): string {
+  return `${account.tenantId}:${account.id}`;
+}
+
+export function createOAuthAccessTokenManager(
+  deps: OAuthAccessTokenManagerDeps,
+): OAuthAccessTokenManager {
+  const now = deps.now ?? (() => Temporal.Now.instant());
+  const refreshTimeoutMs = deps.refreshTimeoutMs ?? DEFAULT_REFRESH_TIMEOUT_MS;
+  const providerCtx: InboundMailContext = { ...deps.providerCtx, secrets: deps.secrets };
+  const cache = new Map<string, CachedToken>();
+  const inFlight = new Map<string, Promise<string>>();
+
+  function parseExpiry(iso: string): Temporal.Instant {
+    try {
+      return Temporal.Instant.from(iso);
+    } catch {
+      // Unparseable expiry: treat as already expired so it is never cached.
+      return now();
+    }
+  }
+
+  function remember(accountId: string, tokens: OAuthTokenSet): void {
+    cache.set(accountId, {
+      accessToken: tokens.accessToken,
+      expiresAt: parseExpiry(tokens.expiresAt),
+    });
+  }
+
+  function cachedValid(accountId: string): string | undefined {
+    const hit = cache.get(accountId);
+    if (!hit) return undefined;
+    const usableUntil = hit.expiresAt.subtract(ACCESS_TOKEN_EXPIRY_MARGIN);
+    return Temporal.Instant.compare(now(), usableUntil) < 0 ? hit.accessToken : undefined;
+  }
+
+  async function refreshWithTimeout(
+    plugin: InboundMailProviderPlugin,
+    account: MailAccountRecord,
+    refreshToken: string,
+  ): Promise<OAuthTokenSet> {
+    const oauth = plugin.oauth;
+    if (!oauth) throw new InboundAuthError("provider has no oauth flow");
+    return oauth.refreshAccessToken(providerCtx, account, refreshToken, {
+      signal: AbortSignal.timeout(refreshTimeoutMs),
+    });
+  }
+
+  async function refresh(
+    account: MailAccountRecord,
+    plugin: InboundMailProviderPlugin,
+  ): Promise<string> {
+    const secretKey = inboundCredentialSecretKey(account.id);
+    return transaction(deps.db, async (tx) => {
+      await acquireNamespacedAdvisoryLock(tx, OAUTH_REFRESH_LOCK_NAMESPACE, lockKey(account));
+      const stored = await deps.secrets.get(account.tenantId, secretKey);
+      if (!stored) {
+        throw new InboundAuthError("no refresh token stored for account");
+      }
+      const currentRefreshToken = stored.reveal();
+      const tokens = await refreshWithTimeout(plugin, account, currentRefreshToken);
+      if (tokens.refreshToken && tokens.refreshToken !== currentRefreshToken) {
+        await deps.secrets.set(
+          account.tenantId,
+          secretKey,
+          tokens.refreshToken,
+          inboundRefreshTokenSecretOptions(account.id),
+        );
+      }
+      remember(account.id, tokens);
+      return tokens.accessToken;
+    });
+  }
+
+  return {
+    async getAccessToken(account, plugin) {
+      const hit = cachedValid(account.id);
+      if (hit !== undefined) return hit;
+      const running = inFlight.get(account.id);
+      if (running) return running;
+      const started = refresh(account, plugin)
+        .catch((err: unknown) => {
+          cache.delete(account.id);
+          throw err;
+        })
+        .finally(() => {
+          inFlight.delete(account.id);
+        });
+      inFlight.set(account.id, started);
+      return started;
+    },
+
+    async storeRefreshToken(account, refreshToken) {
+      await transaction(deps.db, async (tx) => {
+        await acquireNamespacedAdvisoryLock(tx, OAUTH_REFRESH_LOCK_NAMESPACE, lockKey(account));
+        await deps.secrets.set(
+          account.tenantId,
+          inboundCredentialSecretKey(account.id),
+          refreshToken,
+          inboundRefreshTokenSecretOptions(account.id),
+        );
+      });
+      cache.delete(account.id);
+    },
+
+    primeFromExchange(account, tokens) {
+      remember(account.id, tokens);
+    },
+
+    invalidate(accountId) {
+      cache.delete(accountId);
+    },
+  };
+}

package/packages/bundled-features/src/inbound-mail-foundation/tenant-destroy-hook.ts

@@ -47,7 +47,7 @@ async function archiveAndDeleteRows(
   declareEscapeHatch({ reason: INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON });
   const rows = await ctx.db.selectMany<{ id: string }>(table, { tenantId: ctx.tenantId });
   for (const row of rows) {
-    await archiveStream(ctx.db.unsafeRaw(INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON), {
+    await archiveStream(ctx.db.unsafeRaw(), {
       tenantId: ctx.tenantId,
       aggregateId: row.id,
       aggregateType,

package/packages/bundled-features/src/inbound-mail-foundation/types.ts

@@ -135,6 +135,12 @@ export type InboundOAuthFlow = {
     ctx: InboundMailContext,
     account: MailAccountRecord,
     refreshToken: string,
+    /** The foundation aborts `signal` after a hard timeout while holding a
+     *  per-account lock (a pool connection is pinned meanwhile). Providers
+     *  MUST pass it to their token-endpoint fetch; the foundation awaits the
+     *  provider's result and never drops a late one, because that could lose
+     *  a rotated refresh token. */
+    opts?: { readonly signal?: AbortSignal },
   ) => Promise<OAuthTokenSet>;
 };
 
@@ -154,7 +160,14 @@ export type InboundMailProviderPlugin = {
     ctx: InboundMailContext,
     account: MailAccountRecord,
     cursor: SyncCursorPayload | null,
-    opts: { readonly backfillWindowDays: number; readonly maxMessages: number },
+    opts: {
+      readonly backfillWindowDays: number;
+      readonly maxMessages: number;
+      /** Valid OAuth access token, minted by the foundation for accounts
+       *  whose provider declares `oauth` (authMethod oauth/xoauth2). Absent
+       *  for password accounts and providers without an oauth flow. */
+      readonly accessToken?: string;
+    },
   ) => Promise<InboundFetchResult>;
   /** Nur OAuth-Provider. */
   readonly oauth?: InboundOAuthFlow;
@@ -170,6 +183,9 @@ export type InboundMailProviderPlugin = {
       readonly onMessages: (msgs: readonly RawInboundMessage[]) => Promise<void>;
       readonly onError: (err: unknown) => void;
     },
+    /** Same `accessToken` semantics as `fetch` opts; re-minted on every
+     *  supervisor (re)start of the watch. */
+    opts?: { readonly accessToken?: string },
   ) => Promise<() => Promise<void>>;
 };
 

package/packages/bundled-features/src/inbound-mail-foundation/watch-supervisor.ts

@@ -54,6 +54,11 @@ import type { DistributedLock } from "@cosmicdrift/kumiko-framework/pipeline";
 import { Temporal } from "temporal-polyfill";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
 import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
+import {
+  createOAuthAccessTokenManager,
+  type OAuthAccessTokenManager,
+  usesFoundationManagedOAuth,
+} from "./oauth-access-token.js";
 import { mailAccountsProjectionTable } from "./projection.js";
 import { resolveInboundProviderForAccount } from "./provider-factory.js";
 import {
@@ -67,6 +72,12 @@ import {
   type SyncCursorPayload,
 } from "./types.js";
 
+// Provider errors can embed token or response data in `message`; logs carry
+// only the error class.
+function describeError(err: unknown): string {
+  return err instanceof Error ? err.name : typeof err;
+}
+
 const DEFAULT_POLL_INTERVAL_MS = 5 * 60 * 1000;
 const DEFAULT_BACKFILL_WINDOW_DAYS = 30;
 const DEFAULT_MAX_MESSAGES_PER_POLL = 200;
@@ -110,6 +121,10 @@ export type InboundMailSupervisorDeps = {
    *  watcher lives. Omit for single-process deployments — every active
    *  account is watched locally, same as before #1719. */
   readonly lock?: DistributedLock;
+  /** Access-token lifecycle for OAuth accounts. Defaults to a manager built
+   *  from `db` + `providerCtx.secrets`; pass the instance shared with
+   *  `createInboundMailConnectRoutes` so a fresh connect primes this cache. */
+  readonly oauthTokens?: OAuthAccessTokenManager;
   /** TTL (seconds) for the per-account watch lease. Default 90s, renewed
    *  every ttl/3. Only used when `lock` is set. */
   readonly watchLeaseTtlSeconds?: number;
@@ -157,6 +172,29 @@ export function createInboundMailSupervisor(
   // configured TTL — real deployments (default 90s) never hit it.
   const renewIntervalMs = Math.max(50, Math.floor((leaseTtlSeconds * 1000) / 3));
   const log = deps.log ?? (() => {});
+  const oauthTokens =
+    deps.oauthTokens ??
+    (deps.providerCtx.secrets
+      ? createOAuthAccessTokenManager({
+          db: deps.db,
+          secrets: deps.providerCtx.secrets,
+          providerCtx: deps.providerCtx,
+        })
+      : undefined);
+
+  // Undefined for non-OAuth accounts. A refresh failure propagates into the
+  // caller's handleSyncError: InboundAuthError → auth_error, anything else
+  // → transient retry.
+  async function resolveAccessToken(
+    account: MailAccountRecord,
+    plugin: InboundMailProviderPlugin,
+  ): Promise<string | undefined> {
+    if (!usesFoundationManagedOAuth(account, plugin)) return undefined;
+    if (!oauthTokens) {
+      throw new Error("oauth account needs a secrets context for token refresh");
+    }
+    return oauthTokens.getAccessToken(account, plugin);
+  }
 
   let running = false;
   let pollTimer: ReturnType<typeof setTimeout> | null = null;
@@ -336,9 +374,7 @@ export function createInboundMailSupervisor(
       return true;
     }
     // Transient/unbekannt: loggen, nächster Tick retried.
-    log(
-      `inbound-mail: account ${account.id} sync error: ${err instanceof Error ? err.message : String(err)}`,
-    );
+    log(`inbound-mail: account ${account.id} sync error: ${describeError(err)}`);
     return true;
   }
 
@@ -354,9 +390,11 @@ export function createInboundMailSupervisor(
     try {
       // hasMore-Schleife: Pagination innerhalb eines Ticks bis Budget.
       for (;;) {
+        const accessToken = await resolveAccessToken(account, plugin);
         const result = await plugin.fetch(deps.providerCtx, account, cursor, {
           backfillWindowDays,
           maxMessages: budget,
+          ...(accessToken !== undefined && { accessToken }),
         });
         await ingestBatch(account, result.messages, JSON.stringify(result.nextCursor));
         await saveCursor(account, result.nextCursor);
@@ -376,7 +414,7 @@ export function createInboundMailSupervisor(
       try {
         plugin = resolveInboundProviderForAccount(deps.providerCtx, account);
       } catch (err) {
-        log(`inbound-mail: ${err instanceof Error ? err.message : String(err)}`);
+        log(`inbound-mail: ${describeError(err)}`);
         continue;
       }
       await pollAccount(account, plugin);
@@ -431,7 +469,7 @@ export function createInboundMailSupervisor(
       renewed = await deps.lock.renew(account.id, state.lockToken, leaseTtlSeconds);
     } catch (err) {
       log(
-        `inbound-mail: watch lease renew for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`,
+        `inbound-mail: watch lease renew for account ${account.id} failed: ${describeError(err)}`,
       );
       state.renewFailures += 1;
       // After failures spanning a full lease TTL, tear down — otherwise a
@@ -533,7 +571,7 @@ export function createInboundMailSupervisor(
       const delay = state.backoffMs;
       state.backoffMs = Math.min(state.backoffMs * 2, backoffMaxMs);
       log(
-        `inbound-mail: watch for account ${account.id} died (${err instanceof Error ? err.message : String(err)}) — restart in ${delay}ms`,
+        `inbound-mail: watch for account ${account.id} died (${describeError(err)}) — restart in ${delay}ms`,
       );
       void markAccount(account, { watchState: `backoff:${delay}ms` }, "watch_supervisor");
       state.restartTimer = setTimeout(() => {
@@ -544,27 +582,33 @@ export function createInboundMailSupervisor(
 
     state.starting = true;
     try {
-      const stop = await plugin.watch(deps.providerCtx, account, {
-        onMessages: async (msgs) => {
-          try {
-            await ingestBatch(account, msgs, "watch");
-          } catch (err) {
-            // Ingest-Fehler killt den Watcher nicht — der Poll holt die
-            // Messages beim nächsten Tick (Dedup macht's idempotent).
-            log(
-              `inbound-mail: watch-ingest for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`,
-            );
-          }
-        },
-        onError: (err) => {
-          void (async () => {
-            const keepRunning = await handleSyncError(account, err);
-            // auth_error → stopWatcher hat die generation gebumpt,
-            // scheduleRestart no-op't; für alle anderen: Backoff-Restart.
-            if (keepRunning) scheduleRestart(err);
-          })();
+      const accessToken = await resolveAccessToken(account, plugin);
+      const stop = await plugin.watch(
+        deps.providerCtx,
+        account,
+        {
+          onMessages: async (msgs) => {
+            try {
+              await ingestBatch(account, msgs, "watch");
+            } catch (err) {
+              // An ingest failure must not kill the watcher: the next poll
+              // tick fetches the messages again and dedup keeps it idempotent.
+              log(
+                `inbound-mail: watch-ingest for account ${account.id} failed: ${describeError(err)}`,
+              );
+            }
+          },
+          onError: (err) => {
+            void (async () => {
+              const keepRunning = await handleSyncError(account, err);
+              // On auth_error stopWatcher already bumped the generation, so
+              // scheduleRestart is a no-op; every other error restarts with backoff.
+              if (keepRunning) scheduleRestart(err);
+            })();
+          },
         },
-      });
+        accessToken !== undefined ? { accessToken } : undefined,
+      );
       if (state.generation !== generation || !running) {
         await stop();
         // skip: stop() kam während des Connects — Watcher wurde sofort wieder abgebaut.
@@ -581,7 +625,7 @@ export function createInboundMailSupervisor(
         await markAccount(account, { watchState: "watching" }, "watch_supervisor");
       } catch (err) {
         log(
-          `inbound-mail: markAccount(watching) for account ${account.id} failed: ${err instanceof Error ? err.message : String(err)}`,
+          `inbound-mail: markAccount(watching) for account ${account.id} failed: ${describeError(err)}`,
         );
       }
     } catch (err) {
@@ -617,9 +661,7 @@ export function createInboundMailSupervisor(
       try {
         await stop();
       } catch (err) {
-        log(
-          `inbound-mail: stop watcher ${accountId} failed: ${err instanceof Error ? err.message : String(err)}`,
-        );
+        log(`inbound-mail: stop watcher ${accountId} failed: ${describeError(err)}`);
       }
     }
     if (deps.lock && lockToken) {
@@ -627,7 +669,7 @@ export function createInboundMailSupervisor(
         await deps.lock.release(accountId, lockToken);
       } catch (err) {
         log(
-          `inbound-mail: watch lease release for account ${accountId} failed: ${err instanceof Error ? err.message : String(err)}`,
+          `inbound-mail: watch lease release for account ${accountId} failed: ${describeError(err)}`,
         );
       }
     }
@@ -642,11 +684,7 @@ export function createInboundMailSupervisor(
     pollTimer = setTimeout(() => {
       pollTimer = null;
       pollInFlight = pollOnce()
-        .catch((err) =>
-          log(
-            `inbound-mail: poll tick failed: ${err instanceof Error ? err.message : String(err)}`,
-          ),
-        )
+        .catch((err) => log(`inbound-mail: poll tick failed: ${describeError(err)}`))
         .finally(() => {
           pollInFlight = null;
           scheduleNextPoll();

package/packages/bundled-features/src/managed-pages/handlers/set.write.ts

@@ -72,7 +72,7 @@ export const setWrite = defineWriteHandler({
     const scopedDb =
       override !== undefined
         ? createTenantDb(
-            db.unsafeRaw(SET_PAGE_TENANT_OVERRIDE_REASON),
+            db.unsafeRaw(),
             override as TenantId, // @cast-boundary engine-bridge
             "tenant",
           )

package/packages/bundled-features/src/notes-history/handlers/add-note.write.ts

@@ -72,16 +72,13 @@ export function createAddNoteHandler(
         // Bun.SQL poisons the whole tx after any error inside it, even one that's
         // caught — so the lookup runs in a savepoint where available, otherwise directly
         // (pool statements are their own units).
-        authorName = await runInSavepointIfSupported(
-          ctx.db.unsafeRaw(READ_AUTHOR_DISPLAY_NAME_REASON),
-          async (sp) => {
-            const userRow = await fetchOne<{ displayName: string | null }>(sp, userTable, {
-              id: event.user.id,
-            });
-            if (!userRow?.displayName) return null;
-            return decryptStoredPii(userRow.displayName, "displayName", "notes-history:add-note");
-          },
-        );
+        authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(), async (sp) => {
+          const userRow = await fetchOne<{ displayName: string | null }>(sp, userTable, {
+            id: event.user.id,
+          });
+          if (!userRow?.displayName) return null;
+          return decryptStoredPii(userRow.displayName, "displayName", "notes-history:add-note");
+        });
       } catch (e) {
         ctx.log?.warn("notes-history: authorName lookup failed", {
           error: e,

package/packages/bundled-features/src/renderer-simple/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "createRendererSimpleFeature({ mailBranding }) brands every notification mail, including the auth mails, with product name or logo, primary color and footer text and links",
+    "detail": "renderer-simple accepts mailBranding for all framework notification mails",
+    "migration": "No code change needed."
+  }
+]

package/packages/bundled-features/src/renderer-simple/feature.ts

@@ -1,4 +1,5 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { NotificationRenderer } from "../delivery/index.js";
 import {
   RENDERER_EXTENSION,
   type RendererContext,
@@ -7,7 +8,7 @@ import {
   type RenderResponse,
 } from "../renderer-foundation/index.js";
 import { resolveNotificationVariables } from "./resolve-variables.js";
-import { simpleRenderer } from "./simple-renderer.js";
+import { createSimpleRenderer, type MailBranding, simpleRenderer } from "./simple-renderer.js";
 
 // Adapter: simpleRenderer.render hat `Promise<string>`-Signatur (Legacy
 // NotificationRenderer-Contract), renderer-foundation erwartet
@@ -19,6 +20,7 @@ import { simpleRenderer } from "./simple-renderer.js";
 export async function adaptToFoundation(
   req: RenderRequest,
   ctx: RendererContext,
+  renderer: NotificationRenderer = simpleRenderer,
 ): Promise<RenderResponse> {
   if (req.kind !== "notification") {
     // Defensiver Guard — Foundation wählt Plugins nur für matching kinds,
@@ -29,14 +31,22 @@ export async function adaptToFoundation(
     );
   }
   const variables = await resolveNotificationVariables(req, ctx);
-  const html = await simpleRenderer.render({
+  const html = await renderer.render({
     template: req.payload.template ?? "",
     variables,
   });
   return { kind: "notification", html };
 }
 
-export function createRendererSimpleFeature(): FeatureDefinition {
+export type RendererSimpleOptions = {
+  /** Branding applied to every notification mail, including the framework auth mails. */
+  readonly mailBranding?: MailBranding;
+};
+
+export function createRendererSimpleFeature(options?: RendererSimpleOptions): FeatureDefinition {
+  const renderer = options?.mailBranding
+    ? createSimpleRenderer(options.mailBranding)
+    : simpleRenderer;
   return defineFeature("renderer-simple", (r) => {
     r.describe(
       'Default renderer plugin for `kind="notification"`: takes a structured `EmailTemplateData` variable map (with `header`, `sections[]` of text/button objects, and optional `footer`; falls back to `title`/`body` if no structured fields are present) and returns rendered HTML with inline CSS. Requires `renderer-foundation`; sufficient for plain notification emails \u2014 swap it for `renderer-mail-html` if you need MJML/Markdown layouts.',
@@ -51,7 +61,7 @@ export function createRendererSimpleFeature(): FeatureDefinition {
 
     r.useExtension(RENDERER_EXTENSION, "simple", {
       kinds: ["notification"] as const,
-      render: adaptToFoundation,
+      render: (req, ctx) => adaptToFoundation(req, ctx, renderer),
     });
   });
 }

package/packages/bundled-features/src/renderer-simple/index.ts

@@ -1,2 +1,2 @@
-export { createRendererSimpleFeature } from "./feature.js";
-export { simpleRenderer } from "./simple-renderer.js";
+export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
+export { createSimpleRenderer, type MailBranding, simpleRenderer } from "./simple-renderer.js";