@cosmicdrift/kumiko-samples 0.339.0 → 0.341.0

package/packages/bundled-features/src/files/changes.json

@@ -1 +1,13 @@
-[]
+[
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Uploads resolve a generic content type from the file content",
+    "detail": "POST /api/files now resolves application/octet-stream or a missing type from the bytes (PDF, XML, PNG, JPEG, GIF, WebP, ZIP) and falls back to the file extension. A concrete declared type is never overridden. The shared helper resolveContentType is exported from the files module."
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "Uploads without entityId no longer produce an empty storage key segment"
+  }
+]

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "Inbound mail projections use typed bun-db helpers",
+    "detail": "Mail-account and mail-thread events upsert through `upsertOnConflict` (`connectedAt` is only written on insert), inbound messages insert through `insertOnConflictDoNothing`. The raw `db/queries/inbound-projections.ts` module is gone.",
+    "migration": "keine"
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/packages/bundled-features/src/inbound-mail-foundation/projection.ts

@@ -17,12 +17,13 @@
 // write-handler. Die applies kopieren nur durch; decrypted wird erst
 // in den list-queries.
 
-import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
 import {
-  insertIgnoreProjectionRow,
-  upsertProjectionRow,
-} from "./db/queries/inbound-projections.js";
+  insertOnConflictDoNothing,
+  requireEntityTableMeta,
+  upsertOnConflict,
+} from "@cosmicdrift/kumiko-framework/bun-db";
+import { buildEntityTable, type EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
 import { inboundMessageEntity, mailAccountEntity, mailThreadEntity } from "./entities.js";
 import type {
   InboundMessageEventPayload,
@@ -39,9 +40,20 @@ export const inboundMessagesProjectionTable = buildEntityTable(
 );
 export const mailThreadsProjectionTable = buildEntityTable("mail-thread", mailThreadEntity);
 
-function tableNameOf(table: unknown): string {
-  return (table as { tableName: string }).tableName;
-}
+// Unbranded metas: the apply functions below ARE the executor of these
+// projections, so they may write through the typed helpers.
+const mailAccountsProjectionMeta: EntityTableMeta = requireEntityTableMeta(
+  mailAccountsProjectionTable,
+  "mail-account",
+);
+const inboundMessagesProjectionMeta: EntityTableMeta = requireEntityTableMeta(
+  inboundMessagesProjectionTable,
+  "inbound-message",
+);
+const mailThreadsProjectionMeta: EntityTableMeta = requireEntityTableMeta(
+  mailThreadsProjectionTable,
+  "mail-thread",
+);
 
 // =============================================================================
 // mail-account — connected/updated/disconnected teilen den payload-shape,
@@ -49,40 +61,30 @@ function tableNameOf(table: unknown): string {
 // defensive consistency (rebuild-aus-dem-Nichts, out-of-order).
 // =============================================================================
 
-const ACCOUNT_SET_CLAUSES = [
-  `"provider" = EXCLUDED."provider"`,
-  `"auth_method" = EXCLUDED."auth_method"`,
-  `"owner_user_id" = EXCLUDED."owner_user_id"`,
-  `"display_name" = EXCLUDED."display_name"`,
-  `"address" = EXCLUDED."address"`,
-  `"status" = EXCLUDED."status"`,
-  `"watch_state" = EXCLUDED."watch_state"`,
-  // connected_at bewusst NICHT im SET: der Erst-Connect-Zeitpunkt
-  // bleibt stehen, updated/disconnected überschreiben ihn nicht.
-];
-
 const applyMailAccountUpsert = defineApply<MailAccountEventPayload>(async (event, tx) => {
   const p = event.payload;
-  const insertCols = {
-    id: event.aggregateId,
-    tenant_id: event.tenantId,
+  const mutable = {
     provider: p.provider,
-    auth_method: p.authMethod,
-    owner_user_id: p.ownerUserId,
-    display_name: p.displayName,
+    authMethod: p.authMethod,
+    ownerUserId: p.ownerUserId,
+    displayName: p.displayName,
     address: p.address,
     status: p.status,
-    watch_state: p.watchState,
-    // Insert-Pfad = Erst-Connect (bzw. Rebuild: createdAt des ersten
-    // events des Streams — fachlich derselbe Zeitpunkt).
-    connected_at: event.createdAt.toString(),
+    watchState: p.watchState,
   };
-  await upsertProjectionRow(
+  await upsertOnConflict(
     tx,
-    tableNameOf(mailAccountsProjectionTable),
-    insertCols,
-    ACCOUNT_SET_CLAUSES,
-    Object.values(insertCols),
+    mailAccountsProjectionMeta,
+    {
+      id: event.aggregateId,
+      tenantId: event.tenantId,
+      ...mutable,
+      // Only the insert path is the first connect (on rebuild: createdAt of the
+      // stream's first event, the same moment). Left out of `update` so the
+      // first-connect time survives updated/disconnected events.
+      connectedAt: event.createdAt,
+    },
+    { conflictKeys: ["id"], update: mutable },
   );
 });
 
@@ -104,20 +106,20 @@ export const applyMailAccountDisconnected = applyMailAccountUpsert;
 export const applyInboundMessageReceived = defineApply<InboundMessageEventPayload>(
   async (event, tx) => {
     const p = event.payload;
-    await insertIgnoreProjectionRow(tx, tableNameOf(inboundMessagesProjectionTable), {
+    await insertOnConflictDoNothing(tx, inboundMessagesProjectionMeta, {
       id: event.aggregateId,
-      tenant_id: event.tenantId,
-      account_id: p.accountId,
-      owner_user_id: p.ownerUserId,
-      message_id_header: p.messageIdHeader,
-      thread_key: p.threadKey,
+      tenantId: event.tenantId,
+      accountId: p.accountId,
+      ownerUserId: p.ownerUserId,
+      messageIdHeader: p.messageIdHeader,
+      threadKey: p.threadKey,
       from: p.from,
       to: p.to,
       cc: p.cc,
       subject: p.subject,
       snippet: p.snippet,
-      received_at: p.receivedAtIso,
-      body_ref: p.bodyRef,
+      receivedAt: p.receivedAtIso,
+      bodyRef: p.bodyRef,
       scope: p.scope,
     });
   },
@@ -133,23 +135,20 @@ export const applyInboundMessageReceived = defineApply<InboundMessageEventPayloa
 /** mail-thread-updated → UPSERT full mit dem Payload-Snapshot. */
 export const applyMailThreadUpdated = defineApply<MailThreadEventPayload>(async (event, tx) => {
   const p = event.payload;
-  const insertCols = {
-    id: event.aggregateId,
-    tenant_id: event.tenantId,
-    thread_key: p.threadKey,
+  const mutable = {
     subject: p.subject,
-    last_message_at: p.lastMessageAtIso,
-    message_count: p.messageCount,
+    lastMessageAt: p.lastMessageAtIso,
+    messageCount: p.messageCount,
   };
-  await upsertProjectionRow(
+  await upsertOnConflict(
     tx,
-    tableNameOf(mailThreadsProjectionTable),
-    insertCols,
-    [
-      `"subject" = EXCLUDED."subject"`,
-      `"last_message_at" = EXCLUDED."last_message_at"`,
-      `"message_count" = EXCLUDED."message_count"`,
-    ],
-    Object.values(insertCols),
+    mailThreadsProjectionMeta,
+    {
+      id: event.aggregateId,
+      tenantId: event.tenantId,
+      threadKey: p.threadKey,
+      ...mutable,
+    },
+    { conflictKeys: ["id"], update: mutable },
   );
 });

package/packages/bundled-features/src/legal-pages/README.md

@@ -71,9 +71,32 @@ Response:
 - `404 text/plain` — block missing. Hint: "Tenant admin must set this text block".
 - `503 text/plain` — `app.fetch` to `/api/query` failed (anonymousAccess missing?).
 
-Layout: a minimal HTML5 skeleton with inline CSS — apps that want to
-integrate into their own layout use `template-resolver:query:by-slug`
-directly and render themselves.
+Layout: a minimal HTML5 skeleton with inline CSS. Apps that want their own
+header, footer and theme pass `createLegalPagesFeature({ wrapLayout })`, a
+`PublicPageWrapLayout` (`@cosmicdrift/kumiko-bundled-features/page-render`):
+`({ title, bodyHtml, lang, slug?, alternates? }) => string`. The framework
+keeps setting the security headers; the layout only returns the HTML.
+
+The page CSP is `script-src 'none'`, so the layout must not need JavaScript
+(a language switch has to be plain links).
+
+Trailing slash: every route also answers its other slash form
+(`/legal/impressum/`) with a `301` to the configured path, for `GET` and `HEAD`,
+query string kept. A path configured with a trailing slash redirects the form
+without it.
+
+### Contract termination pages
+
+`createContractTerminationRoutes({ paths?, wrapLayout? })` (billing-foundation,
+consumer protection) serves `/legal/kuendigen` and `/legal/cancel`. It takes the
+same `wrapLayout` and wraps every page with it: form, review, result, 429 and
+error. `alternates` maps `de`/`en` to the configured paths (custom `paths`
+included), so the layout can link to the other language. The body sits in
+`<div data-kumiko-page="contract-termination">` with `data-kumiko-*` hooks on
+the forms, field groups, buttons and review table for app CSS. The headers (CSP
+with `script-src 'none'`, `frame-ancestors 'none'`, `X-Frame-Options: DENY`,
+`no-store`) are the same with and without `wrapLayout`, so a layout that loads
+scripts fails. The slash redirect applies here too; `POST` has no alias.
 
 ---
 

package/packages/bundled-features/src/legal-pages/feature.ts

@@ -1,23 +1,27 @@
-import {
-  requireTemplateResolver,
-  TEXT_BLOCK_KIND,
-  type TemplateResolverApi,
-} from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import {
   defineFeature,
   type FeatureDefinition,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { cachedSecurePageResponse } from "../page-render/index.js";
+import {
+  cachedSecurePageResponse,
+  type PublicPageWrapLayout,
+  redirectToCanonicalPath,
+  slashVariantOf,
+} from "../page-render/index.js";
 import {
   LEGAL_REQUIRED_BLOCKS,
   LEGAL_ROUTES,
   type LegalPageRoute,
   type LegalRequiredBlock,
 } from "./constants.js";
+import { runLegalPagesBootCheck } from "./lib/boot-check.js";
+import { validateRoutes } from "./lib/validate-routes.js";
 import { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
 
+export { type LegalPagesBootCheckCtx, runLegalPagesBootCheck } from "./lib/boot-check.js";
+
 // QN-Konstante als dokumentierter Public-Contract des template-resolver-
 // Features. Ein magic-string statt eines Code-Imports ist hier explizit
 // gewollt: Cross-Feature-Calls gehen nur über stable Public-API
@@ -59,12 +63,7 @@ const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 //     setzen — sonst wirft Boot-Check beim Start
 //   • anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID } — sonst
 //     antworten die Routes mit 503
-export type LegalPagesWrapLayout = (opts: {
-  readonly title: string;
-  readonly bodyHtml: string;
-  readonly lang: string;
-  readonly slug?: string;
-}) => string;
+export type LegalPagesWrapLayout = PublicPageWrapLayout;
 
 export type LegalPagesOptions = {
   /** Custom Layout-Wrapper für die /legal/*-Routes. Default: minimaler
@@ -86,26 +85,6 @@ export type LegalPagesOptions = {
   readonly requiredBlocks?: readonly LegalRequiredBlock[];
 };
 
-// Validated once at feature-build time (not per-request) so a config typo
-// fails app startup instead of surfacing as a confusing 404 later.
-function validateRoutes(routes: readonly LegalPageRoute[]): void {
-  const seenPaths = new Set<string>();
-  for (const route of routes) {
-    if (!route.path || !route.slug || !route.lang) {
-      throw new Error(
-        `legal-pages: route is missing a required field (path/slug/lang): ${JSON.stringify(route)}`,
-      );
-    }
-    if (!route.path.startsWith("/")) {
-      throw new Error(`legal-pages: route path must start with "/", got "${route.path}"`);
-    }
-    if (seenPaths.has(route.path)) {
-      throw new Error(`legal-pages: duplicate route path "${route.path}"`);
-    }
-    seenPaths.add(route.path);
-  }
-}
-
 export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDefinition {
   const wrapLayout = opts.wrapLayout ?? wrapInLayout;
   const routes = opts.routes ?? LEGAL_ROUTES;
@@ -138,6 +117,8 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
         method: "GET",
         path: route.path,
         anonymous: true,
+        // Public pages backed by a DB query: bound the per-IP read rate.
+        rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
         handler: async (c, { systemQuery }) => {
           // Architektur: 1 App = X Tenants = 1 Impressum. Egal welche
           // Subdomain der Visitor besucht (apex, admin.*, tenant-x.*) —
@@ -208,6 +189,20 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
       });
     }
 
+    // Hono matches strictly, so "/legal/x/" would 404 for sites that link with
+    // a trailing slash. GET also serves HEAD.
+    const configuredPaths = new Set(routes.map((route) => route.path));
+    for (const route of routes) {
+      const variant = slashVariantOf(route.path);
+      if (variant === null || configuredPaths.has(variant)) continue;
+      r.httpRoute({
+        method: "GET",
+        path: variant,
+        anonymous: true,
+        handler: (c) => redirectToCanonicalPath(c.req.url, route.path),
+      });
+    }
+
     // Boot-Check via ctx.templateResolver (extraContext-Pattern, symmetrisch
     // zu requireConfigResolver in config). App-Bootstrap muss templateResolver
     // wired haben — der Helper gibt einen klaren Wiring-Hinweis wenn nicht.
@@ -232,56 +227,3 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
     return {};
   });
 }
-
-// Minimal-shape für die Boot-Check-Logik — nur die Felder die der Check
-// braucht. Akzeptiert HandlerContext + AppContext + jeden anderen
-// Container der templateResolver + log mitbringt. Macht den Check direkt
-// unit-testbar mit constructed ctx-Objects.
-export type LegalPagesBootCheckCtx = {
-  readonly templateResolver?: TemplateResolverApi;
-  readonly log?: {
-    readonly info?: (msg: string) => void;
-    readonly warn?: (msg: string) => void;
-  };
-};
-
-// Exportiert für direkte Tests. Wirft InternalError wenn ctx.templateResolver
-// nicht gewired ist (Hinweis auf fehlenden extraContext). Wirft Error
-// in NODE_ENV=production wenn Pflicht-Blocks fehlen, sonst log.warn.
-// Logged log.info wenn alles vorhanden ist (kein silent-skip).
-export async function runLegalPagesBootCheck(
-  ctx: LegalPagesBootCheckCtx,
-  requiredBlocks: readonly LegalRequiredBlock[] = LEGAL_REQUIRED_BLOCKS,
-): Promise<void> {
-  const templateResolver: TemplateResolverApi = requireTemplateResolver(
-    ctx,
-    "legal-pages-boot-check",
-  );
-  const missing: { slug: string; lang: string }[] = [];
-
-  for (const required of requiredBlocks) {
-    const block = await templateResolver.findExact({
-      tenantId: SYSTEM_TENANT_ID,
-      slug: required.slug,
-      kind: TEXT_BLOCK_KIND,
-      locale: required.lang,
-    });
-    if (!block?.content) {
-      missing.push({ slug: required.slug, lang: required.lang });
-    }
-  }
-
-  if (missing.length === 0) {
-    ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
-  } else {
-    const message =
-      `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
-      missing.map((m) => `${m.slug}/${m.lang}`).join(", ") +
-      ". Seed via template-resolver:write:set or the seedTextBlock helper.";
-
-    if (process.env["NODE_ENV"] === "production") {
-      throw new Error(`Boot-Validation failed: ${message}`);
-    }
-    ctx.log?.warn?.(message);
-  }
-}

package/packages/bundled-features/src/legal-pages/lib/boot-check.ts

@@ -0,0 +1,57 @@
+import {
+  requireTemplateResolver,
+  TEXT_BLOCK_KIND,
+  type TemplateResolverApi,
+} from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../constants.js";
+
+// Only the fields the check reads, so HandlerContext, AppContext or a hand-built
+// object in a unit test all fit.
+export type LegalPagesBootCheckCtx = {
+  readonly templateResolver?: TemplateResolverApi;
+  readonly log?: {
+    readonly info?: (msg: string) => void;
+    readonly warn?: (msg: string) => void;
+  };
+};
+
+// Missing required blocks fail the boot only in production; elsewhere they warn,
+// so a dev setup without seeded legal texts still starts. A complete set logs
+// info on purpose, so a skipped check is visible.
+export async function runLegalPagesBootCheck(
+  ctx: LegalPagesBootCheckCtx,
+  requiredBlocks: readonly LegalRequiredBlock[] = LEGAL_REQUIRED_BLOCKS,
+): Promise<void> {
+  const templateResolver: TemplateResolverApi = requireTemplateResolver(
+    ctx,
+    "legal-pages-boot-check",
+  );
+  const missing: { slug: string; lang: string }[] = [];
+
+  for (const required of requiredBlocks) {
+    const block = await templateResolver.findExact({
+      tenantId: SYSTEM_TENANT_ID,
+      slug: required.slug,
+      kind: TEXT_BLOCK_KIND,
+      locale: required.lang,
+    });
+    if (!block?.content) {
+      missing.push({ slug: required.slug, lang: required.lang });
+    }
+  }
+
+  if (missing.length === 0) {
+    ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
+  } else {
+    const message =
+      `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
+      missing.map((m) => `${m.slug}/${m.lang}`).join(", ") +
+      ". Seed via template-resolver:write:set or the seedTextBlock helper.";
+
+    if (process.env["NODE_ENV"] === "production") {
+      throw new Error(`Boot-Validation failed: ${message}`);
+    }
+    ctx.log?.warn?.(message);
+  }
+}

package/packages/bundled-features/src/legal-pages/lib/validate-routes.ts

@@ -0,0 +1,21 @@
+import type { LegalPageRoute } from "../constants.js";
+
+// Validated once at feature-build time (not per-request) so a config typo
+// fails app startup instead of surfacing as a confusing 404 later.
+export function validateRoutes(routes: readonly LegalPageRoute[]): void {
+  const seenPaths = new Set<string>();
+  for (const route of routes) {
+    if (!route.path || !route.slug || !route.lang) {
+      throw new Error(
+        `legal-pages: route is missing a required field (path/slug/lang): ${JSON.stringify(route)}`,
+      );
+    }
+    if (!route.path.startsWith("/")) {
+      throw new Error(`legal-pages: route path must start with "/", got "${route.path}"`);
+    }
+    if (seenPaths.has(route.path)) {
+      throw new Error(`legal-pages: duplicate route path "${route.path}"`);
+    }
+    seenPaths.add(route.path);
+  }
+}

package/packages/bundled-features/src/page-render/index.ts

@@ -13,6 +13,7 @@ export {
 } from "./cached-page-response.js";
 export { sanitizeTenantCss } from "./css-sanitize.js";
 export {
+  type PublicPageWrapLayout,
   type SeoHeadInput,
   TENANT_CONTENT_ATTR,
   tenantStyleBlock,
@@ -20,3 +21,4 @@ export {
 } from "./layout.js";
 export { renderSafeMarkdown } from "./markdown.js";
 export { securePageHeaders } from "./security-headers.js";
+export { redirectToCanonicalPath, slashVariantOf } from "./trailing-slash.js";

package/packages/bundled-features/src/page-render/layout.ts

@@ -8,6 +8,18 @@ import { sanitizeTenantCss } from "./css-sanitize.js";
 // wrapInLayout's own opts, so callers don't repeat them).
 export type SeoHeadInput = Omit<ApexHead, "title" | "description" | "lang">;
 
+// Signature a public FW page (legal-pages, contract termination) accepts for
+// an app-supplied layout. `alternates` maps a locale to the path of the same
+// page in that locale, so the layout can render a language switch from plain
+// links (the page CSP has script-src 'none').
+export type PublicPageWrapLayout = (opts: {
+  readonly title: string;
+  readonly bodyHtml: string;
+  readonly lang: string;
+  readonly slug?: string;
+  readonly alternates?: Readonly<Record<string, string>>;
+}) => string;
+
 // Attribute marking the content container. The page body lives in
 // `<main data-tenant-content>`; tenant custom CSS is scoped to its descendants
 // and host containment clips its paint to this box. A custom wrapLayout that
@@ -98,6 +110,11 @@ ${headHtml}
   a { color: var(--accent); }
   code { background: #f4f4f4; padding: 0.1rem 0.3rem; border-radius: 3px; }
   hr { border: 0; border-top: 1px solid #ddd; margin: 2rem 0; }
+  input, select, textarea, button { font: inherit; color: inherit; padding: 0.4rem 0.6rem;
+         border: 1px solid #bbb; border-radius: 4px; box-sizing: border-box; }
+  input:not([type="radio"]):not([type="checkbox"]):not([type="hidden"]), select, textarea {
+         width: 100%; max-width: 100%; }
+  button { cursor: pointer; background: #f4f4f4; }
   .brand-header { position: relative; z-index: 1; display: flex; align-items: center;
                   gap: 0.6rem; margin-bottom: 1.5rem; }
   .brand-header a { display: flex; align-items: center; gap: 0.6rem; color: inherit; text-decoration: none; }

package/packages/bundled-features/src/page-render/trailing-slash.ts

@@ -0,0 +1,15 @@
+// The other trailing-slash form of a path, or null for the root path (it has
+// no distinct variant).
+export function slashVariantOf(path: string): string | null {
+  if (path === "/") return null;
+  return path.endsWith("/") ? path.slice(0, -1) : `${path}/`;
+}
+
+// Hono matches strictly, so the slash variant of a page would 404. A 301 keeps
+// one canonical URL; the query string is carried over.
+export function redirectToCanonicalPath(requestUrl: string, canonicalPath: string): Response {
+  return new Response(null, {
+    status: 301,
+    headers: { location: `${canonicalPath}${new URL(requestUrl).search}` },
+  });
+}

package/packages/bundled-features/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Localized mail branding, locale through delivery, logoPath",
+    "detail": "`ctx.notify` accepts `locale`, and the locale now travels through the delivery jobs (`delivery.render`, `delivery.send`) to `NotificationRenderer.render`, where `RendererInput.locale` is available. Jobs queued before this release have no locale and keep working. The email channel and `renderer-simple` pass it on; the auth mails and the consumer-protection mails set it to the language they already translate their content into. This lands in the same release as the `NotifyOptions` change from #3508.\n`MailBranding` for `renderer-simple` can now be localized: `footerText`, `footerLinks[].label` and `footerLinks[].url` take a plain string or a map of locale to string. The renderer picks the exact locale, then the language part (`de-AT` falls back to `de`), then the new optional `MailBranding.defaultLocale`, then the first entry. Every URL in a map must be an absolute http(s) URL, otherwise `createSimpleRenderer` throws at boot. Without a locale and with plain strings the HTML is unchanged.\n`MailBranding` also gets `logoPath` and `baseUrl`, so an app can point at a raster logo on its own origin (`logoPath: \"/logo.png\"`, `baseUrl` the same base as `auth.mail.baseUrl`). `logoPath` and `logoUrl` exclude each other, `logoPath` needs a valid `baseUrl`, must start with a single `/` and must stay on the base origin; violations throw at boot. Use PNG or JPEG, because mail clients block SVG."
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/packages/bundled-features/src/renderer-simple/feature.ts

@@ -34,6 +34,7 @@ export async function adaptToFoundation(
   const html = await renderer.render({
     template: req.payload.template ?? "",
     variables,
+    locale: req.payload.locale,
   });
   return { kind: "notification", html };
 }

package/packages/bundled-features/src/renderer-simple/index.ts

@@ -1,2 +1,7 @@
 export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
-export { createSimpleRenderer, type MailBranding, simpleRenderer } from "./simple-renderer.js";
+export {
+  createSimpleRenderer,
+  type LocalizedText,
+  type MailBranding,
+  simpleRenderer,
+} from "./simple-renderer.js";