@cosmicdrift/kumiko-samples 0.340.0 → 0.342.0

package/packages/bundled-features/src/files/changes.json

@@ -1 +1,13 @@
-[]
+[
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Uploads resolve a generic content type from the file content",
+    "detail": "POST /api/files now resolves application/octet-stream or a missing type from the bytes (PDF, XML, PNG, JPEG, GIF, WebP, ZIP) and falls back to the file extension. A concrete declared type is never overridden. The shared helper resolveContentType is exported from the files module."
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "Uploads without entityId no longer produce an empty storage key segment"
+  }
+]

package/packages/bundled-features/src/legal-pages/README.md

@@ -71,9 +71,32 @@ Response:
 - `404 text/plain` — block missing. Hint: "Tenant admin must set this text block".
 - `503 text/plain` — `app.fetch` to `/api/query` failed (anonymousAccess missing?).
 
-Layout: a minimal HTML5 skeleton with inline CSS — apps that want to
-integrate into their own layout use `template-resolver:query:by-slug`
-directly and render themselves.
+Layout: a minimal HTML5 skeleton with inline CSS. Apps that want their own
+header, footer and theme pass `createLegalPagesFeature({ wrapLayout })`, a
+`PublicPageWrapLayout` (`@cosmicdrift/kumiko-bundled-features/page-render`):
+`({ title, bodyHtml, lang, slug?, alternates? }) => string`. The framework
+keeps setting the security headers; the layout only returns the HTML.
+
+The page CSP is `script-src 'none'`, so the layout must not need JavaScript
+(a language switch has to be plain links).
+
+Trailing slash: every route also answers its other slash form
+(`/legal/impressum/`) with a `301` to the configured path, for `GET` and `HEAD`,
+query string kept. A path configured with a trailing slash redirects the form
+without it.
+
+### Contract termination pages
+
+`createContractTerminationRoutes({ paths?, wrapLayout? })` (billing-foundation,
+consumer protection) serves `/legal/kuendigen` and `/legal/cancel`. It takes the
+same `wrapLayout` and wraps every page with it: form, review, result, 429 and
+error. `alternates` maps `de`/`en` to the configured paths (custom `paths`
+included), so the layout can link to the other language. The body sits in
+`<div data-kumiko-page="contract-termination">` with `data-kumiko-*` hooks on
+the forms, field groups, buttons and review table for app CSS. The headers (CSP
+with `script-src 'none'`, `frame-ancestors 'none'`, `X-Frame-Options: DENY`,
+`no-store`) are the same with and without `wrapLayout`, so a layout that loads
+scripts fails. The slash redirect applies here too; `POST` has no alias.
 
 ---
 

package/packages/bundled-features/src/legal-pages/feature.ts

@@ -1,23 +1,27 @@
-import {
-  requireTemplateResolver,
-  TEXT_BLOCK_KIND,
-  type TemplateResolverApi,
-} from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import {
   defineFeature,
   type FeatureDefinition,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { cachedSecurePageResponse } from "../page-render/index.js";
+import {
+  cachedSecurePageResponse,
+  type PublicPageWrapLayout,
+  redirectToCanonicalPath,
+  slashVariantOf,
+} from "../page-render/index.js";
 import {
   LEGAL_REQUIRED_BLOCKS,
   LEGAL_ROUTES,
   type LegalPageRoute,
   type LegalRequiredBlock,
 } from "./constants.js";
+import { runLegalPagesBootCheck } from "./lib/boot-check.js";
+import { validateRoutes } from "./lib/validate-routes.js";
 import { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
 
+export { type LegalPagesBootCheckCtx, runLegalPagesBootCheck } from "./lib/boot-check.js";
+
 // QN-Konstante als dokumentierter Public-Contract des template-resolver-
 // Features. Ein magic-string statt eines Code-Imports ist hier explizit
 // gewollt: Cross-Feature-Calls gehen nur über stable Public-API
@@ -59,12 +63,7 @@ const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 //     setzen — sonst wirft Boot-Check beim Start
 //   • anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID } — sonst
 //     antworten die Routes mit 503
-export type LegalPagesWrapLayout = (opts: {
-  readonly title: string;
-  readonly bodyHtml: string;
-  readonly lang: string;
-  readonly slug?: string;
-}) => string;
+export type LegalPagesWrapLayout = PublicPageWrapLayout;
 
 export type LegalPagesOptions = {
   /** Custom Layout-Wrapper für die /legal/*-Routes. Default: minimaler
@@ -86,26 +85,6 @@ export type LegalPagesOptions = {
   readonly requiredBlocks?: readonly LegalRequiredBlock[];
 };
 
-// Validated once at feature-build time (not per-request) so a config typo
-// fails app startup instead of surfacing as a confusing 404 later.
-function validateRoutes(routes: readonly LegalPageRoute[]): void {
-  const seenPaths = new Set<string>();
-  for (const route of routes) {
-    if (!route.path || !route.slug || !route.lang) {
-      throw new Error(
-        `legal-pages: route is missing a required field (path/slug/lang): ${JSON.stringify(route)}`,
-      );
-    }
-    if (!route.path.startsWith("/")) {
-      throw new Error(`legal-pages: route path must start with "/", got "${route.path}"`);
-    }
-    if (seenPaths.has(route.path)) {
-      throw new Error(`legal-pages: duplicate route path "${route.path}"`);
-    }
-    seenPaths.add(route.path);
-  }
-}
-
 export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDefinition {
   const wrapLayout = opts.wrapLayout ?? wrapInLayout;
   const routes = opts.routes ?? LEGAL_ROUTES;
@@ -138,6 +117,8 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
         method: "GET",
         path: route.path,
         anonymous: true,
+        // Public pages backed by a DB query: bound the per-IP read rate.
+        rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
         handler: async (c, { systemQuery }) => {
           // Architektur: 1 App = X Tenants = 1 Impressum. Egal welche
           // Subdomain der Visitor besucht (apex, admin.*, tenant-x.*) —
@@ -208,6 +189,20 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
       });
     }
 
+    // Hono matches strictly, so "/legal/x/" would 404 for sites that link with
+    // a trailing slash. GET also serves HEAD.
+    const configuredPaths = new Set(routes.map((route) => route.path));
+    for (const route of routes) {
+      const variant = slashVariantOf(route.path);
+      if (variant === null || configuredPaths.has(variant)) continue;
+      r.httpRoute({
+        method: "GET",
+        path: variant,
+        anonymous: true,
+        handler: (c) => redirectToCanonicalPath(c.req.url, route.path),
+      });
+    }
+
     // Boot-Check via ctx.templateResolver (extraContext-Pattern, symmetrisch
     // zu requireConfigResolver in config). App-Bootstrap muss templateResolver
     // wired haben — der Helper gibt einen klaren Wiring-Hinweis wenn nicht.
@@ -232,56 +227,3 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
     return {};
   });
 }
-
-// Minimal-shape für die Boot-Check-Logik — nur die Felder die der Check
-// braucht. Akzeptiert HandlerContext + AppContext + jeden anderen
-// Container der templateResolver + log mitbringt. Macht den Check direkt
-// unit-testbar mit constructed ctx-Objects.
-export type LegalPagesBootCheckCtx = {
-  readonly templateResolver?: TemplateResolverApi;
-  readonly log?: {
-    readonly info?: (msg: string) => void;
-    readonly warn?: (msg: string) => void;
-  };
-};
-
-// Exportiert für direkte Tests. Wirft InternalError wenn ctx.templateResolver
-// nicht gewired ist (Hinweis auf fehlenden extraContext). Wirft Error
-// in NODE_ENV=production wenn Pflicht-Blocks fehlen, sonst log.warn.
-// Logged log.info wenn alles vorhanden ist (kein silent-skip).
-export async function runLegalPagesBootCheck(
-  ctx: LegalPagesBootCheckCtx,
-  requiredBlocks: readonly LegalRequiredBlock[] = LEGAL_REQUIRED_BLOCKS,
-): Promise<void> {
-  const templateResolver: TemplateResolverApi = requireTemplateResolver(
-    ctx,
-    "legal-pages-boot-check",
-  );
-  const missing: { slug: string; lang: string }[] = [];
-
-  for (const required of requiredBlocks) {
-    const block = await templateResolver.findExact({
-      tenantId: SYSTEM_TENANT_ID,
-      slug: required.slug,
-      kind: TEXT_BLOCK_KIND,
-      locale: required.lang,
-    });
-    if (!block?.content) {
-      missing.push({ slug: required.slug, lang: required.lang });
-    }
-  }
-
-  if (missing.length === 0) {
-    ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
-  } else {
-    const message =
-      `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
-      missing.map((m) => `${m.slug}/${m.lang}`).join(", ") +
-      ". Seed via template-resolver:write:set or the seedTextBlock helper.";
-
-    if (process.env["NODE_ENV"] === "production") {
-      throw new Error(`Boot-Validation failed: ${message}`);
-    }
-    ctx.log?.warn?.(message);
-  }
-}

package/packages/bundled-features/src/legal-pages/lib/boot-check.ts

@@ -0,0 +1,57 @@
+import {
+  requireTemplateResolver,
+  TEXT_BLOCK_KIND,
+  type TemplateResolverApi,
+} from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../constants.js";
+
+// Only the fields the check reads, so HandlerContext, AppContext or a hand-built
+// object in a unit test all fit.
+export type LegalPagesBootCheckCtx = {
+  readonly templateResolver?: TemplateResolverApi;
+  readonly log?: {
+    readonly info?: (msg: string) => void;
+    readonly warn?: (msg: string) => void;
+  };
+};
+
+// Missing required blocks fail the boot only in production; elsewhere they warn,
+// so a dev setup without seeded legal texts still starts. A complete set logs
+// info on purpose, so a skipped check is visible.
+export async function runLegalPagesBootCheck(
+  ctx: LegalPagesBootCheckCtx,
+  requiredBlocks: readonly LegalRequiredBlock[] = LEGAL_REQUIRED_BLOCKS,
+): Promise<void> {
+  const templateResolver: TemplateResolverApi = requireTemplateResolver(
+    ctx,
+    "legal-pages-boot-check",
+  );
+  const missing: { slug: string; lang: string }[] = [];
+
+  for (const required of requiredBlocks) {
+    const block = await templateResolver.findExact({
+      tenantId: SYSTEM_TENANT_ID,
+      slug: required.slug,
+      kind: TEXT_BLOCK_KIND,
+      locale: required.lang,
+    });
+    if (!block?.content) {
+      missing.push({ slug: required.slug, lang: required.lang });
+    }
+  }
+
+  if (missing.length === 0) {
+    ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
+  } else {
+    const message =
+      `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
+      missing.map((m) => `${m.slug}/${m.lang}`).join(", ") +
+      ". Seed via template-resolver:write:set or the seedTextBlock helper.";
+
+    if (process.env["NODE_ENV"] === "production") {
+      throw new Error(`Boot-Validation failed: ${message}`);
+    }
+    ctx.log?.warn?.(message);
+  }
+}

package/packages/bundled-features/src/legal-pages/lib/validate-routes.ts

@@ -0,0 +1,21 @@
+import type { LegalPageRoute } from "../constants.js";
+
+// Validated once at feature-build time (not per-request) so a config typo
+// fails app startup instead of surfacing as a confusing 404 later.
+export function validateRoutes(routes: readonly LegalPageRoute[]): void {
+  const seenPaths = new Set<string>();
+  for (const route of routes) {
+    if (!route.path || !route.slug || !route.lang) {
+      throw new Error(
+        `legal-pages: route is missing a required field (path/slug/lang): ${JSON.stringify(route)}`,
+      );
+    }
+    if (!route.path.startsWith("/")) {
+      throw new Error(`legal-pages: route path must start with "/", got "${route.path}"`);
+    }
+    if (seenPaths.has(route.path)) {
+      throw new Error(`legal-pages: duplicate route path "${route.path}"`);
+    }
+    seenPaths.add(route.path);
+  }
+}

package/packages/bundled-features/src/page-render/index.ts

@@ -13,6 +13,7 @@ export {
 } from "./cached-page-response.js";
 export { sanitizeTenantCss } from "./css-sanitize.js";
 export {
+  type PublicPageWrapLayout,
   type SeoHeadInput,
   TENANT_CONTENT_ATTR,
   tenantStyleBlock,
@@ -20,3 +21,4 @@ export {
 } from "./layout.js";
 export { renderSafeMarkdown } from "./markdown.js";
 export { securePageHeaders } from "./security-headers.js";
+export { redirectToCanonicalPath, slashVariantOf } from "./trailing-slash.js";

package/packages/bundled-features/src/page-render/layout.ts

@@ -8,6 +8,18 @@ import { sanitizeTenantCss } from "./css-sanitize.js";
 // wrapInLayout's own opts, so callers don't repeat them).
 export type SeoHeadInput = Omit<ApexHead, "title" | "description" | "lang">;
 
+// Signature a public FW page (legal-pages, contract termination) accepts for
+// an app-supplied layout. `alternates` maps a locale to the path of the same
+// page in that locale, so the layout can render a language switch from plain
+// links (the page CSP has script-src 'none').
+export type PublicPageWrapLayout = (opts: {
+  readonly title: string;
+  readonly bodyHtml: string;
+  readonly lang: string;
+  readonly slug?: string;
+  readonly alternates?: Readonly<Record<string, string>>;
+}) => string;
+
 // Attribute marking the content container. The page body lives in
 // `<main data-tenant-content>`; tenant custom CSS is scoped to its descendants
 // and host containment clips its paint to this box. A custom wrapLayout that
@@ -98,6 +110,11 @@ ${headHtml}
   a { color: var(--accent); }
   code { background: #f4f4f4; padding: 0.1rem 0.3rem; border-radius: 3px; }
   hr { border: 0; border-top: 1px solid #ddd; margin: 2rem 0; }
+  input, select, textarea, button { font: inherit; color: inherit; padding: 0.4rem 0.6rem;
+         border: 1px solid #bbb; border-radius: 4px; box-sizing: border-box; }
+  input:not([type="radio"]):not([type="checkbox"]):not([type="hidden"]), select, textarea {
+         width: 100%; max-width: 100%; }
+  button { cursor: pointer; background: #f4f4f4; }
   .brand-header { position: relative; z-index: 1; display: flex; align-items: center;
                   gap: 0.6rem; margin-bottom: 1.5rem; }
   .brand-header a { display: flex; align-items: center; gap: 0.6rem; color: inherit; text-decoration: none; }

package/packages/bundled-features/src/page-render/trailing-slash.ts

@@ -0,0 +1,15 @@
+// The other trailing-slash form of a path, or null for the root path (it has
+// no distinct variant).
+export function slashVariantOf(path: string): string | null {
+  if (path === "/") return null;
+  return path.endsWith("/") ? path.slice(0, -1) : `${path}/`;
+}
+
+// Hono matches strictly, so the slash variant of a page would 404. A 301 keeps
+// one canonical URL; the query string is carried over.
+export function redirectToCanonicalPath(requestUrl: string, canonicalPath: string): Response {
+  return new Response(null, {
+    status: 301,
+    headers: { location: `${canonicalPath}${new URL(requestUrl).search}` },
+  });
+}

package/packages/bundled-features/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Localized mail branding, locale through delivery, logoPath",
+    "detail": "`ctx.notify` accepts `locale`, and the locale now travels through the delivery jobs (`delivery.render`, `delivery.send`) to `NotificationRenderer.render`, where `RendererInput.locale` is available. Jobs queued before this release have no locale and keep working. The email channel and `renderer-simple` pass it on; the auth mails and the consumer-protection mails set it to the language they already translate their content into. This lands in the same release as the `NotifyOptions` change from #3508.\n`MailBranding` for `renderer-simple` can now be localized: `footerText`, `footerLinks[].label` and `footerLinks[].url` take a plain string or a map of locale to string. The renderer picks the exact locale, then the language part (`de-AT` falls back to `de`), then the new optional `MailBranding.defaultLocale`, then the first entry. Every URL in a map must be an absolute http(s) URL, otherwise `createSimpleRenderer` throws at boot. Without a locale and with plain strings the HTML is unchanged.\n`MailBranding` also gets `logoPath` and `baseUrl`, so an app can point at a raster logo on its own origin (`logoPath: \"/logo.png\"`, `baseUrl` the same base as `auth.mail.baseUrl`). `logoPath` and `logoUrl` exclude each other, `logoPath` needs a valid `baseUrl`, must start with a single `/` and must stay on the base origin; violations throw at boot. Use PNG or JPEG, because mail clients block SVG."
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/packages/bundled-features/src/renderer-simple/feature.ts

@@ -34,6 +34,7 @@ export async function adaptToFoundation(
   const html = await renderer.render({
     template: req.payload.template ?? "",
     variables,
+    locale: req.payload.locale,
   });
   return { kind: "notification", html };
 }

package/packages/bundled-features/src/renderer-simple/index.ts

@@ -1,2 +1,7 @@
 export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
-export { createSimpleRenderer, type MailBranding, simpleRenderer } from "./simple-renderer.js";
+export {
+  createSimpleRenderer,
+  type LocalizedText,
+  type MailBranding,
+  simpleRenderer,
+} from "./simple-renderer.js";

package/packages/bundled-features/src/renderer-simple/simple-renderer.ts

@@ -6,13 +6,24 @@ export type MailBranding = {
   readonly productName?: string;
   /** Hex color (#rgb, #rrggbb, #rrggbbaa); used for buttons and the header accent. */
   readonly primaryColor?: string;
-  /** Absolute http(s) URL; anything else is dropped. */
+  /** Absolute http(s) URL; anything else is dropped. Mutually exclusive with `logoPath`. */
   readonly logoUrl?: string;
-  readonly footerText?: string;
-  /** Absolute http(s) URLs only; other entries are dropped. */
-  readonly footerLinks?: readonly { readonly label: string; readonly url: string }[];
+  /** Absolute path on `baseUrl` (e.g. "/logo.png"); use PNG/JPEG, mail clients block SVG. */
+  readonly logoPath?: string;
+  /** Absolute http(s) origin that `logoPath` is resolved against; same base as `auth.mail.baseUrl`. */
+  readonly baseUrl?: string;
+  /** Locale tried after the exact and language-part match when a localized field has no entry. */
+  readonly defaultLocale?: string;
+  readonly footerText?: LocalizedText;
+  /** Absolute http(s) URLs only; string URLs that are not are dropped, localized ones fail at boot. */
+  readonly footerLinks?: readonly {
+    readonly label: LocalizedText;
+    readonly url: LocalizedText;
+  }[];
 };
 
+export type LocalizedText = string | Readonly<Record<string, string>>;
+
 const DEFAULT_PRIMARY_COLOR = "#2563eb";
 const HEX_COLOR_PATTERN = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
 
@@ -25,14 +36,79 @@ function isHttpUrl(value: string): boolean {
   }
 }
 
+function languagePart(locale: string): string {
+  return locale.split("-")[0] ?? locale;
+}
+
+function pickByLocale(
+  entries: Readonly<Record<string, string>>,
+  locale: string,
+): string | undefined {
+  // Own keys only: a locale like "constructor" must not hit Object.prototype.
+  const ownEntry = (key: string): string | undefined =>
+    Object.hasOwn(entries, key) ? entries[key] : undefined;
+  return ownEntry(locale) ?? ownEntry(languagePart(locale));
+}
+
+function resolveLocalized(
+  value: LocalizedText | undefined,
+  locale: string | undefined,
+  defaultLocale: string | undefined,
+): string | undefined {
+  if (value === undefined || typeof value === "string") return value;
+  return (
+    (locale !== undefined ? pickByLocale(value, locale) : undefined) ??
+    (defaultLocale !== undefined ? pickByLocale(value, defaultLocale) : undefined) ??
+    Object.values(value)[0]
+  );
+}
+
+function assertLocalizedUrlsAreHttp(branding: MailBranding): void {
+  for (const link of branding.footerLinks ?? []) {
+    if (typeof link.url === "string") continue;
+    for (const [locale, url] of Object.entries(link.url)) {
+      if (!isHttpUrl(url)) {
+        throw new Error(
+          `createSimpleRenderer: footerLinks url for locale "${locale}" must be an absolute http(s) URL`,
+        );
+      }
+    }
+  }
+}
+
+function resolveLogoUrl(branding: MailBranding | undefined): string | undefined {
+  if (!branding) return undefined;
+  const { logoUrl, logoPath, baseUrl } = branding;
+  if (logoPath === undefined) {
+    return logoUrl && isHttpUrl(logoUrl) ? logoUrl : undefined;
+  }
+  if (logoUrl !== undefined) {
+    throw new Error("createSimpleRenderer: logoPath and logoUrl are mutually exclusive");
+  }
+  if (baseUrl === undefined || !isHttpUrl(baseUrl)) {
+    throw new Error("createSimpleRenderer: logoPath requires an absolute http(s) baseUrl");
+  }
+  if (!/^\/(?![/\\])/.test(logoPath) || logoPath.includes("\\")) {
+    throw new Error('createSimpleRenderer: logoPath must start with a single "/"');
+  }
+  const resolved = new URL(logoPath, baseUrl);
+  if (resolved.origin !== new URL(baseUrl).origin) {
+    throw new Error("createSimpleRenderer: logoPath must stay on the baseUrl origin");
+  }
+  return resolved.href;
+}
+
 function resolvePrimaryColor(branding: MailBranding | undefined): string {
   const color = branding?.primaryColor;
   return color && HEX_COLOR_PATTERN.test(color) ? color : DEFAULT_PRIMARY_COLOR;
 }
 
-function renderBrandingHeader(branding: MailBranding | undefined, primaryColor: string): string {
+function renderBrandingHeader(
+  branding: MailBranding | undefined,
+  primaryColor: string,
+  logoUrl: string | undefined,
+): string {
   if (!branding) return "";
-  const logoUrl = branding.logoUrl && isHttpUrl(branding.logoUrl) ? branding.logoUrl : undefined;
   if (!logoUrl && !branding.productName) return "";
   const logo = logoUrl
     ? `<img src="${escapeHtmlAttr(logoUrl)}" alt="${escapeHtmlAttr(branding.productName ?? "")}" style="display:block;max-height:40px;max-width:200px;border:0" />`
@@ -40,18 +116,24 @@ function renderBrandingHeader(branding: MailBranding | undefined, primaryColor:
   return `<div style="margin:0 0 24px;padding:0 0 16px;border-bottom:3px solid ${escapeHtmlAttr(primaryColor)}">${logo}</div>`;
 }
 
-function renderBrandingFooter(branding: MailBranding | undefined): string {
+function renderBrandingFooter(
+  branding: MailBranding | undefined,
+  locale: string | undefined,
+): string {
   if (!branding) return "";
-  const links = (branding.footerLinks ?? [])
-    .filter((link) => isHttpUrl(link.url))
-    .map(
-      (link) =>
-        `<a href="${escapeHtmlAttr(link.url)}" style="color:#999">${escapeHtml(link.label)}</a>`,
-    );
-  const footerPartsHtml = [
-    branding.footerText ? escapeHtml(branding.footerText) : "",
-    links.join(" · "),
-  ].filter((part) => part !== "");
+  const pick = (value: LocalizedText | undefined): string | undefined =>
+    resolveLocalized(value, locale, branding.defaultLocale);
+  const links = (branding.footerLinks ?? []).flatMap((link) => {
+    const url = pick(link.url);
+    if (url === undefined || !isHttpUrl(url)) return [];
+    return [
+      `<a href="${escapeHtmlAttr(url)}" style="color:#999">${escapeHtml(pick(link.label) ?? "")}</a>`,
+    ];
+  });
+  const footerText = pick(branding.footerText);
+  const footerPartsHtml = [footerText ? escapeHtml(footerText) : "", links.join(" · ")].filter(
+    (part) => part !== "",
+  );
   if (footerPartsHtml.length === 0) return "";
   const footerHtml = footerPartsHtml.join("<br />");
   return `<p style="margin:16px 0 0;color:#999;font-size:12px">${footerHtml}</p>`;
@@ -85,6 +167,8 @@ function renderSection(section: Section, primaryColor: string): string {
 // No external dependencies, no template engine — just string concatenation.
 export function createSimpleRenderer(branding?: MailBranding): NotificationRenderer {
   const primaryColor = resolvePrimaryColor(branding);
+  const logoUrl = resolveLogoUrl(branding);
+  if (branding) assertLocalizedUrlsAreHttp(branding);
   return {
     name: "simple",
 
@@ -98,7 +182,7 @@ export function createSimpleRenderer(branding?: MailBranding): NotificationRende
       const parts: string[] = [];
       parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
       parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
-      parts.push(renderBrandingHeader(branding, primaryColor));
+      parts.push(renderBrandingHeader(branding, primaryColor, logoUrl));
 
       if (header) {
         parts.push(
@@ -118,7 +202,7 @@ export function createSimpleRenderer(branding?: MailBranding): NotificationRende
         );
       }
 
-      parts.push(renderBrandingFooter(branding));
+      parts.push(renderBrandingFooter(branding, input.locale));
       parts.push("</div></body></html>");
       return parts.join("");
     },

package/packages/bundled-features/src/secrets/announce-secret-change.ts

@@ -0,0 +1,30 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  CACHE_SYNC_TOPICS,
+  type CacheSyncBus,
+  type TenantConfigSyncMessage,
+} from "@cosmicdrift/kumiko-framework/redis";
+
+type AnnouncingContext = {
+  readonly cacheSync?: CacheSyncBus;
+  readonly scheduleAfterCommit?: (hook: () => Promise<void>) => void;
+};
+
+// Secret writes bypass config:write:*, yet provider caches (e.g. the S3 secret
+// key) depend on them: announce on the tenant-config topic, after commit so a
+// replica reloading on the message sees the new value.
+export function announceSecretChange(
+  ctx: AnnouncingContext,
+  tenantId: TenantId,
+  key: string,
+): void {
+  const bus = ctx.cacheSync;
+  // skip: no bus wired (single-process setup), nothing to announce
+  if (!bus) return;
+  const message: TenantConfigSyncMessage = { tenantId, key };
+  const publish = async (): Promise<void> => {
+    bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+  };
+  if (ctx.scheduleAfterCommit) ctx.scheduleAfterCommit(publish);
+  else bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+}

package/packages/bundled-features/src/secrets/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Chat channel secret values are validated on write",
+    "detail": "`r.secret` and `r.secretNamespace` accept a `valueSchema`. `secrets:write:set` checks the value against it after the key and role checks and answers a failure with a 400 validation error on field `value` (`secrets.errors.invalidValue`); the response never contains the value or the schema's issues. `secrets:write:delete` is unaffected.\nThe chat channels use it: Slack, Discord and Teams webhook secrets must be URLs that pass the channel's host allowlist (including the Discord `/api/webhooks/` path), and the Telegram bot token must have the `<bot id>:<secret>` shape. The allowlist comes from the same options as the channel, so `createChannelSlackFeature({ allowedHosts })` also governs what can be stored.\n`channel-slack`, `channel-discord`, `channel-teams` and `channel-telegram` now export their secret keys (`SLACK_SECRET_KEYS`, `DISCORD_SECRET_KEYS`, `TEAMS_SECRET_KEYS`, `TELEGRAM_SECRET_KEYS`), allowlist constants and `isTelegramChatId` / `isTelegramBotToken`. `delivery` exports `checkChatWebhookTarget`, `chatWebhookUrlSchema` and `resolveChatWebhookTarget`, so apps can validate an address or URL when a user creates a channel.\nExisting invalid secrets stay stored; only new writes are checked. Writes through `ctx.secrets.set` in feature code run through the same check."
+  },
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "ctx.secrets.set validates against the declared valueSchema",
+    "migration": "Code that calls createSecretsContext({ db, masterKeyProvider }) must also pass registry (the booted Registry). Programmatic ctx.secrets.set calls with a value that fails the key's valueSchema now throw a ValidationError instead of storing it."
+  },
   {
     "version": "0.337.0",
     "type": "breaking",

package/packages/bundled-features/src/secrets/feature.ts

@@ -76,7 +76,7 @@ export function requireSecretsContext(
     throw new InternalError({
       message:
         `[${handlerName}] ctx.secrets missing — pass ` +
-        "createSecretsContext({db, masterKeyProvider}) via extraContext.secrets at boot.",
+        "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
     });
   }
   const raw = ctx.secrets;

package/packages/bundled-features/src/secrets/handlers/delete.write.ts

@@ -1,6 +1,7 @@
 import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
@@ -23,6 +24,7 @@ export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS)
         deletedBy: event.user.id,
       });
       if (!removed) return failNotFound("tenant-secret", event.payload.key);
+      announceSecretChange(ctx, event.user.tenantId, event.payload.key);
       return { isSuccess: true, data: { key: event.payload.key } };
     },
   });