@cosmicdrift/kumiko-samples 0.351.0 → 0.353.0

package/packages/bundled-features/src/delivery/types.ts

@@ -64,6 +64,9 @@ export type DeliveryChannel = {
   // Absent for channels addressed only through `route` (tenant-owned chat
   // targets): deliverToUser skips them without writing a no_address row.
   resolve?(userId: string, ctx: ChannelContext): Promise<string | null>;
+  // "connection-name": the address is a tenant-chosen connection name (chat webhooks), not
+  // personal data, so the attempt log keeps it unmasked. Absent = personal, masked.
+  readonly addressKind?: "connection-name";
   render?(message: ChannelMessage, ctx: ChannelContext): Promise<RenderedMessage>;
   send(
     address: string,
@@ -118,14 +121,21 @@ export type DeliveryService = {
 // payload — collectChannels derives it from the usage's entityName instead.
 export type DeliveryChannelPlugin = Omit<DeliveryChannel, "name">;
 
+function hasOptionalHooks(o: object): boolean {
+  return (
+    (!("render" in o) || o.render === undefined || typeof o.render === "function") &&
+    (!("resolve" in o) || o.resolve === undefined || typeof o.resolve === "function") &&
+    (!("addressKind" in o) || o.addressKind === undefined || o.addressKind === "connection-name")
+  );
+}
+
 export function isDeliveryChannelPlugin(o: unknown): o is DeliveryChannelPlugin {
   return (
     typeof o === "object" &&
     o !== null &&
     "mode" in o &&
     DELIVERY_CHANNEL_MODES.some((mode) => mode === o.mode) &&
-    (!("render" in o) || o.render === undefined || typeof o.render === "function") &&
-    (!("resolve" in o) || o.resolve === undefined || typeof o.resolve === "function") &&
+    hasOptionalHooks(o) &&
     "send" in o &&
     typeof o.send === "function"
   );

package/packages/bundled-features/src/derivatives-sharp/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "fix",
+    "title": "sharp is bumped to 0.35.5 to pick up the librsvg security fix",
+    "detail": "Bump sharp to 0.35.5 (librsvg advisory GHSA-WQ5F-XC86-PV6W)"
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/packages/bundled-features/src/files-tenant-data/hooks.ts

@@ -170,8 +170,9 @@ export const fileRefStorageDestroyHook: StorageProviderDestroyTenantHook = async
   }
   // Provider resolved — a list()/delete() failure from here IS fail-closed:
   // the "files" stage throws, tenant-lifecycle's retry/abandon handling sees
-  // it, and the next sweep tick retries (list+delete are idempotent, so this
-  // converges rather than double-deleting or erroring on a missing key).
+  // it and retries up to the stage's attempt cap before abandoning the destroy
+  // (list+delete are idempotent, so a retry converges rather than
+  // double-deleting or erroring on a missing key).
   for (const prefix of tenantStoragePrefixes(tenantId)) {
     const keys = await provider.list(prefix);
     const keptStemPrefixes = await survivorStemPrefixes(ctx.db, keys);

package/packages/bundled-features/src/folders/feature.ts

@@ -25,7 +25,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_FOLDER_ACCESS, FOLDERS_FEATURE_NAME } from "./constants.js";
 import { createFolderAssignmentEntity, folderEntity } from "./entity.js";
 import { createClearFolderHandler } from "./handlers/clear-folder.write.js";
@@ -166,17 +166,7 @@ export function createFoldersFeature(opts: FoldersFeatureOptions = {}): typeof f
   ) {
     return foldersFeature;
   }
-  if (hasWhereRule(opts.ownership?.write)) {
-    throw new Error(
-      "createFoldersFeature({ ownership }): ownership.write must not contain a " +
-        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-        "layer (the read path, via buildOwnershipClause). Write paths that " +
-        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them, so such a rule can only ever deny — boot validation " +
-        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-        "leave it unset.",
-    );
-  }
+  assertNoWhereRuleInOwnershipWrite("createFoldersFeature", opts.ownership?.write);
   if (opts.parents !== undefined && opts.parents.length === 0) {
     throw new Error(
       "createFoldersFeature({ parents }): parents must not be an empty array — " +

package/packages/bundled-features/src/form-draft/changes.json

@@ -1 +1,7 @@
-[]
+[
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "The stale-draft cleanup keeps sweeping when a whole batch was re-saved in the meantime"
+  }
+]

package/packages/bundled-features/src/form-draft/db/queries/cleanup.ts

@@ -57,6 +57,7 @@ export async function selectStaleDraftsBatch(
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */
 export async function isDraftStillStale(
   db: DbConnection,
+  tenantId: TenantId,
   id: string,
   olderThanDays: number,
 ): Promise<boolean> {
@@ -64,9 +65,10 @@ export async function isDraftStillStale(
     db,
     `SELECT 1 FROM "read_form_drafts"
      WHERE "id" = $1
-       AND COALESCE("modified_at", "inserted_at") < now() - ($2::int * interval '1 day')
+       AND "tenant_id" = $2
+       AND COALESCE("modified_at", "inserted_at") < now() - ($3::int * interval '1 day')
      LIMIT 1`,
-    [id, olderThanDays],
+    [id, tenantId, olderThanDays],
   )) as readonly unknown[];
   return rows.length > 0;
 }

package/packages/bundled-features/src/form-draft/handlers/cleanup.job.ts

@@ -121,20 +121,24 @@ export function groupStaleDraftIdsByTenant(
 // resurrects, PII included. formDraftExecutor.delete() is the event-sourced
 // path; it needs a tenant-scoped db + a SessionUser, so rows are grouped by
 // tenant first (see groupStaleDraftIdsByTenant above).
-async function deleteStaleDraftsBatch(
+export async function deleteStaleDraftsBatch(
   batch: readonly StaleDraftRow[],
   db: DbConnection,
   retentionDays: number,
   log: AppContext["log"],
-): Promise<readonly StaleDraftRow[]> {
+): Promise<{ readonly deletedRows: readonly StaleDraftRow[]; readonly skippedCount: number }> {
   const deletedRows: StaleDraftRow[] = [];
+  let skippedCount = 0;
   const byId = new Map(batch.map((row) => [row.id, row]));
   for (const [tenantId, ids] of groupStaleDraftIdsByTenant(batch)) {
     const systemUser = createSystemUser(tenantId);
     const tenantDb = createTenantDb(db, tenantId, "system");
     for (const id of ids) {
       // Race: user may have saved between select and here — skip if no longer stale.
-      if (!(await isDraftStillStale(db, id, retentionDays))) continue;
+      if (!(await isDraftStillStale(db, tenantId, id, retentionDays))) {
+        skippedCount++;
+        continue;
+      }
       const result = await formDraftExecutor.delete({ id }, systemUser, tenantDb);
       if (result.isSuccess) {
         const row = byId.get(id);
@@ -146,7 +150,7 @@ async function deleteStaleDraftsBatch(
       }
     }
   }
-  return deletedRows;
+  return { deletedRows, skippedCount };
 }
 
 export async function cleanupDraftsJob(
@@ -189,12 +193,20 @@ export async function cleanupDraftsJob(
     // entirely for rows with no FileRefs in the blob, the common case.
     // Delete first (with staleness re-check), then release binaries from rows
     // that actually disappeared — never release a draft the user just saved.
-    const deletedRows = await deleteStaleDraftsBatch(batch, db, retentionDays, ctx.log);
+    const { deletedRows, skippedCount } = await deleteStaleDraftsBatch(
+      batch,
+      db,
+      retentionDays,
+      ctx.log,
+    );
     for (const row of deletedRows) {
       await releaseRowFileRefs(row, db, fileProviderResolver, ctx.log);
     }
     deleted += deletedRows.length;
-    if (deletedRows.length === 0 || batch.length < DEFAULT_BATCH_SIZE) break;
+    // A skipped row is no longer stale, so the next select drops it — a fully
+    // skipped batch still makes progress. Only a batch with neither deletes nor
+    // skips (all failed) would reselect the same rows forever.
+    if (deletedRows.length + skippedCount === 0 || batch.length < DEFAULT_BATCH_SIZE) break;
   }
   ctx.log?.info?.(`[form-draft:cleanup] deleted=${deleted} retentionDays=${retentionDays}`);
 }

package/packages/bundled-features/src/jobs/handlers/list.query.ts

@@ -1,11 +1,13 @@
 import { countWhere, selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { jobRunsTable } from "../job-run-table.js";
 
 const KMS_POOL_CONCURRENCY = 4;
+const DEFAULT_PAGE_SIZE = 50;
 
 const jobRunStatusSchema = z.enum(["queued", "running", "completed", "failed"]);
 
@@ -23,6 +25,31 @@ async function decryptRunRow<T extends Record<string, unknown>>(row: T): Promise
   return result;
 }
 
+type JobRunStatus = z.infer<typeof jobRunStatusSchema>;
+
+function buildListWhere(payload: {
+  readonly jobName?: string | undefined;
+  readonly status?: JobRunStatus | undefined;
+  readonly filters?: readonly { readonly value: readonly JobRunStatus[] }[] | undefined;
+}): WhereObject {
+  const where: WhereObject = {};
+  if (payload.jobName) where["jobName"] = payload.jobName;
+  const statuses = payload.filters?.[0]?.value ?? (payload.status ? [payload.status] : []);
+  if (statuses.length === 1) where["status"] = statuses[0];
+  else if (statuses.length > 1) where["status"] = { in: statuses };
+  return where;
+}
+
+function parseOffsetCursor(cursor: string | undefined): number {
+  const offset = cursor ? Number(decodeCursor(cursor)) : 0;
+  if (!Number.isInteger(offset) || offset < 0) {
+    throw new ValidationError({
+      fields: [{ path: "cursor", code: "invalid_cursor", i18nKey: "jobs.errors.invalidCursor" }],
+    });
+  }
+  return offset;
+}
+
 export const listQuery = defineQueryHandler({
   name: "list",
   description:
@@ -42,6 +69,7 @@ export const listQuery = defineQueryHandler({
     sort: z.enum(["jobName", "status", "startedAt", "duration"]).optional(),
     sortDirection: z.enum(["asc", "desc"]).optional(),
     limit: z.number().optional(),
+    cursor: z.string().optional(),
     totalCount: z.boolean().optional(),
   }),
   access: { roles: ["SystemAdmin"] },
@@ -54,17 +82,22 @@ export const listQuery = defineQueryHandler({
     const db = ctx.systemDb.unsafeRaw(
       "cross-tenant job monitoring: SystemAdmin lists job runs of every tenant",
     );
-    const where: WhereObject = {};
-    if (query.payload.jobName) where["jobName"] = query.payload.jobName;
-    const statusFilter = query.payload.filters?.find((filter) => filter.field === "status");
-    const statuses = statusFilter?.value ?? (query.payload.status ? [query.payload.status] : []);
-    if (statuses.length === 1) where["status"] = statuses[0];
-    else if (statuses.length > 1) where["status"] = { in: statuses };
+    const where = buildListWhere(query.payload);
     const sortColumn = query.payload.sort ?? "startedAt";
-    const rows = await selectMany(db, jobRunsTable, where, {
-      orderBy: { col: sortColumn, direction: query.payload.sortDirection ?? "desc" },
-      limit: query.payload.limit ?? 50,
+    const limit = query.payload.limit ?? DEFAULT_PAGE_SIZE;
+    const offset = parseOffsetCursor(query.payload.cursor);
+    const direction = query.payload.sortDirection ?? "desc";
+    // selectMany has no OFFSET: read through the end of the page plus one probe
+    // row, then slice. `id` as tiebreaker keeps pages stable for non-unique sorts.
+    const fetched = await selectMany(db, jobRunsTable, where, {
+      orderBy: [
+        { col: sortColumn, direction },
+        { col: "id", direction },
+      ],
+      limit: offset + limit + 1,
     });
+    const hasMore = fetched.length > offset + limit;
+    const rows = fetched.slice(offset, offset + limit);
     // countWhere reruns the SAME `where` without the limit — `rows.length` is
     // capped at the page size and would silently undercount the total.
     const total =
@@ -72,7 +105,7 @@ export const listQuery = defineQueryHandler({
     // payload/error are stored encrypted under the triggering user's DEK (#799, #2307).
     return {
       rows: await mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, decryptRunRow),
-      nextCursor: null,
+      nextCursor: hasMore ? encodeCursor(String(offset + limit)) : null,
       ...(total !== undefined && { total }),
     };
   },

package/packages/bundled-features/src/jobs/i18n.ts

@@ -36,6 +36,7 @@ export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
   "jobs.detail.logs": { en: "Logs" },
   "jobs.detail.retry": { en: "Retry" },
   "jobs.trigger.title": { en: "Run a job" },
+  "jobs.errors.invalidCursor": { en: "The pagination cursor is invalid." },
   "jobs.trigger.submit": { en: "Run" },
   "jobs.errors.unknownJob": { en: "Unknown job." },
   "jobs.errors.notManual": {

package/packages/bundled-features/src/ledger/entity.ts

@@ -94,12 +94,14 @@ export const transactionEntity = createEntity({
     // Optional business-object reference (e.g. a lease contract) so entries can
     // be filtered by what they're about, not just grepped out of `reference`.
     subjectType: createTextField({
+      minLength: 1,
       maxLength: 64,
       personal: false,
       reason: "technical_reference",
       filterable: true,
     }),
     subjectId: createTextField({
+      minLength: 1,
       maxLength: 128,
       personal: false,
       reason: "technical_reference",
@@ -147,12 +149,14 @@ export const scheduleEntity = createEntity({
     // Confirmed periods inherit this from the schedule (see
     // confirm-schedule-period.write.ts) rather than repeating it per period.
     subjectType: createTextField({
+      minLength: 1,
       maxLength: 64,
       personal: false,
       reason: "technical_reference",
       filterable: true,
     }),
     subjectId: createTextField({
+      minLength: 1,
       maxLength: 128,
       personal: false,
       reason: "technical_reference",

package/packages/bundled-features/src/ledger/schemas.ts

@@ -28,8 +28,14 @@ export const createTransactionPayloadSchema = z
     status: z.enum(TRANSACTION_STATUS).optional(),
     lines: z.array(postingSchema).min(2),
     // Business-object reference (e.g. a lease contract) this entry is about.
-    subjectType: z.string().max(64).optional(),
-    subjectId: z.string().max(128).optional(),
+    subjectType: z.string().min(1).max(64).optional(),
+    subjectId: z.string().min(1).max(128).optional(),
+  })
+  // Ids are only unique within their type, so a lone subjectId would match
+  // bookings of a different object type.
+  .refine((p) => (p.subjectType === undefined) === (p.subjectId === undefined), {
+    message: "subjectType and subjectId must be set together",
+    path: ["subjectId"],
   })
   .refine((p) => sumIsZero(p.lines), {
     message: "Transaction must balance: Σ of posting amounts must equal 0",

package/packages/bundled-features/src/legal-pages/README.md

@@ -201,10 +201,10 @@ await seedTextBlock(db, {
   title: "Impressum",
   content: `## Angaben gemäß § 5 TMG
 
-**Marc Frost**
+**Alex Morgan**
 
-Slevogtstr. 10
-04159 Leipzig
+Musterstraße 1
+12345 Musterstadt
 
 ## Kontakt
 

package/packages/bundled-features/src/legal-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "fix",
+    "title": "The legal-pages README imprint example uses a fictional demo identity",
+    "detail": "The legal-pages README seeds its imprint example with a fictional demo identity and address instead of a real person's details."
+  },
   {
     "version": "0.344.0",
     "type": "improvement",

package/packages/bundled-features/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "A rate-limited page request answers 429 with Retry-After instead of 503 or an unbranded page",
+    "detail": "Managed pages and sitemap answer 429 when rate limited, agent catalog checks the deny list, draft cleanup continues past skipped rows\nA rate-limited managed-page request now answers 429 with `Retry-After` instead of 503 or an unbranded page, and `sitemap.xml` and `llms.txt` answer 429 instead of silently dropping the managed-page entries. `buildToolCatalog` throws when its manifest was built with `denyQns` that the catalog options lack. The form-draft cleanup no longer stops when a whole batch was re-saved by users in the meantime."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -1,5 +1,6 @@
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { RateLimitError } from "@cosmicdrift/kumiko-framework/errors";
 import {
   type BrandingTokens,
   cachedSecurePageResponse,
@@ -7,7 +8,7 @@ import {
   renderSafeMarkdown,
   wrapInLayout,
 } from "../page-render/index.js";
-import type { SystemQueryFn } from "../shared/index.js";
+import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.js";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.js";
 import { createBrandingQuery } from "./handlers/branding.query.js";
 import { bySlugQuery } from "./handlers/by-slug.query.js";
@@ -51,16 +52,18 @@ function brandingRevisionSeed(branding: BrandingTokens): string {
   ]);
 }
 
-// Never throws: a query failure or malformed result degrades to the
-// unbranded default (branding is decoration, not a hard dependency of the
-// page render).
+// A query failure or malformed result degrades to the unbranded default
+// (branding is decoration, not a hard dependency of the page render). A rate
+// limit is rethrown so the route answers 429 instead of serving (and caching)
+// an unbranded page.
 async function readBrandingViaSystemQuery(
   systemQuery: SystemQueryFn,
   tenantId: string,
 ): Promise<BrandingTokens> {
   try {
     return coerceBranding(await systemQuery(BRANDING_QUERY_QN, {}, tenantId));
-  } catch {
+  } catch (error) {
+    if (error instanceof RateLimitError) throw error;
     return EMPTY_BRANDING;
   }
 }
@@ -207,12 +210,22 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
         // von resolverTrust: "authoritative" zurecht abgelehnt; siehe
         // systemQuery's Doc in http-route.ts). Branding ist Deko → ein
         // Fehlschlag degradiert zum unbranded Default, blockt nie die Page.
-        const [pageSettled, brandingResult] = await Promise.all([
-          systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
-            .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
-            .catch(() => ({ ok: false as const, data: null as BySlugQueryResult })),
-          readBrandingViaSystemQuery(systemQuery, tenantId),
-        ]);
+        let pageSettled: { ok: true; data: BySlugQueryResult } | { ok: false };
+        let brandingResult: BrandingTokens;
+        try {
+          [pageSettled, brandingResult] = await Promise.all([
+            systemQuery(BY_SLUG_QN, { slug, lang }, tenantId)
+              .then((data) => ({ ok: true as const, data: data as BySlugQueryResult }))
+              .catch((error: unknown) => {
+                if (error instanceof RateLimitError) throw error;
+                return { ok: false as const };
+              }),
+            readBrandingViaSystemQuery(systemQuery, tenantId),
+          ]);
+        } catch (error) {
+          if (error instanceof RateLimitError) return rateLimitedTextResponse(error);
+          throw error;
+        }
         if (!pageSettled.ok) return c.text("page unavailable", 503);
 
         const data = pageSettled.data;

package/packages/bundled-features/src/notes-history/feature.ts

@@ -20,7 +20,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_NOTES_HISTORY_ACCESS, NOTES_HISTORY_FEATURE_NAME } from "./constants.js";
 import { createNoteEntryEntity, noteMentionEntity } from "./entity.js";
 import { createNoteEntryExecutor } from "./executor.js";
@@ -123,17 +123,7 @@ export function createNotesHistoryFeature(
   ) {
     return notesHistoryFeature;
   }
-  if (hasWhereRule(opts.ownership?.write)) {
-    throw new Error(
-      "createNotesHistoryFeature({ ownership }): ownership.write must not contain a " +
-        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-        "layer (the read path, via buildOwnershipClause). Write paths that " +
-        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them, so such a rule can only ever deny — boot validation " +
-        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-        "leave it unset.",
-    );
-  }
+  assertNoWhereRuleInOwnershipWrite("createNotesHistoryFeature", opts.ownership?.write);
   // A mount that accepts no parents at all can never take a note write —
   // that's a config mistake, not a valid allowlist. Omit `parents` instead
   // of passing an empty array.

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -4,10 +4,25 @@ import {
   type ProjectionListScreenDefinition,
   type SecretMintScreenDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries } from "./constants.js";
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldOptionLabelKeyPrefix } from "@cosmicdrift/kumiko-headless";
+import {
+  PAT_FEATURE,
+  PAT_MINT_SCREEN_ID,
+  PAT_SCREEN_ID,
+  PatHandlers,
+  PatQueries,
+} from "./constants.js";
 import type { PatScopeConfig } from "./scopes.js";
 
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
+// Same keys the mint form's `scopes` multiSelect options resolve through
+// (see patScopeOptionTranslations), so list and form show identical labels.
+const PAT_SCOPE_OPTION_KEY_PREFIX = fieldOptionLabelKeyPrefix(
+  PAT_FEATURE,
+  ACTION_FORM_ENTITY,
+  "scopes",
+);
 
 // Both screens render only for tenants whose tier includes the feature; the
 // availability query is rejected by the feature gate otherwise.
@@ -29,11 +44,17 @@ export const patListScreen: ProjectionListScreenDefinition = {
   defaultSort: { field: "createdAt", dir: "desc" },
   columns: [
     { field: "name", label: i18nKey("pat.list.col.name") },
-    { field: "prefix", label: i18nKey("pat.list.col.prefix") },
-    { field: "scopes", label: i18nKey("pat.list.col.scopes") },
+    { field: "prefix", label: i18nKey("pat.list.col.prefix"), sortable: false },
+    {
+      field: "scopes",
+      label: i18nKey("pat.list.col.scopes"),
+      sortable: false,
+      renderer: { format: "enumOption", keyPrefix: PAT_SCOPE_OPTION_KEY_PREFIX },
+    },
     {
       field: "status",
       label: i18nKey("pat.list.col.status"),
+      sortable: false,
       renderer: { format: "enumOption", keyPrefix: PAT_STATUS_OPTION_KEY_PREFIX },
     },
     {

package/packages/bundled-features/src/renderer-foundation/types.ts

@@ -12,7 +12,7 @@ export type RenderRequest =
   | { kind: "image-snapshot"; payload: DocumentPayload; options?: ImageOptions };
 
 export type RenderResponse =
-  | { kind: "notification"; html: string }
+  | { kind: "notification"; html: string; text?: string }
   | { kind: "mail-html"; html: string; text: string }
   | { kind: "document-pdf"; pdfBytes: Uint8Array; pageCount: number; sizeBytes: number }
   | {

package/packages/bundled-features/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "Badge, stages track and chips for the simple mail renderer",
+    "detail": "Use badge, { stages } and { chips } in the template variables; the notification RenderResponse carries the matching plain text in text."
+  },
   {
     "version": "0.344.0",
     "type": "improvement",

package/packages/bundled-features/src/renderer-simple/feature.ts

@@ -31,12 +31,10 @@ export async function adaptToFoundation(
     );
   }
   const variables = await resolveNotificationVariables(req, ctx);
-  const html = await renderer.render({
-    template: req.payload.template ?? "",
-    variables,
-    locale: req.payload.locale,
-  });
-  return { kind: "notification", html };
+  const input = { template: req.payload.template ?? "", variables, locale: req.payload.locale };
+  const html = await renderer.render(input);
+  const text = renderer.renderText ? await renderer.renderText(input) : undefined;
+  return text === undefined ? { kind: "notification", html } : { kind: "notification", html, text };
 }
 
 export type RendererSimpleOptions = {

package/packages/bundled-features/src/renderer-simple/index.ts

@@ -1,4 +1,5 @@
 export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
+export type { MailBadge, MailChip, MailStage, MailStageState, MailTone } from "./mail-blocks.js";
 export {
   createSimpleRenderer,
   type LocalizedText,