@cosmicdrift/kumiko-samples 0.362.0 → 0.363.0

package/packages/bundled-features/src/inbound-mail-foundation/oauth-state.ts

@@ -12,6 +12,7 @@
 
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 
 const STATE_PURPOSE = "inbound-mail-oauth-connect";
 
@@ -91,13 +92,12 @@ export function verifyOAuthState(
 }
 
 function isOAuthStatePayload(v: unknown): v is OAuthStatePayload {
-  if (typeof v !== "object" || v === null) return false;
-  const o = v as Record<string, unknown>;
+  if (!isPlainObject(v)) return false;
   return (
-    typeof o["tenantId"] === "string" &&
-    (o["ownerUserId"] === null || typeof o["ownerUserId"] === "string") &&
-    typeof o["providerKey"] === "string" &&
-    typeof o["mailbox"] === "string" &&
-    typeof o["nonce"] === "string"
+    typeof v["tenantId"] === "string" &&
+    (v["ownerUserId"] === null || typeof v["ownerUserId"] === "string") &&
+    typeof v["providerKey"] === "string" &&
+    typeof v["mailbox"] === "string" &&
+    typeof v["nonce"] === "string"
   );
 }

package/packages/bundled-features/src/inbound-mail-foundation/retention-sweep.ts

@@ -157,12 +157,8 @@ async function purgeExpiredSeenAnchors(
   // direkt tenant-scoped, kein Account-Join. Trifft auch Anker, deren Account
   // schon disconnected/geloescht ist.
   const where = { tenantId, seenAt: { lt: cutoff } };
-  const expired = await selectMany<{ accountId: string }>(
-    db,
-    seenMessageTable as EntityTableMeta,
-    where,
-  );
+  const expired = await selectMany<{ accountId: string }>(db, seenMessageTable, where);
   if (expired.length === 0) return 0;
-  await deleteMany(db, seenMessageTable as EntityTableMeta, where);
+  await deleteMany(db, seenMessageTable, where);
   return expired.length;
 }

package/packages/bundled-features/src/inbound-mail-foundation/tenant-destroy-hook.ts

@@ -62,27 +62,19 @@ async function archiveAndDeleteRows(
 export async function mailAccountTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
   const accountIds = await archiveAndDeleteRows(
     ctx,
-    mailAccountsProjectionTable as EntityTableMeta,
+    mailAccountsProjectionTable,
     MAIL_ACCOUNT_AGGREGATE_TYPE,
   );
   for (const accountId of accountIds) {
-    await ctx.db.deleteMany(syncCursorTable as EntityTableMeta, { accountId });
-    await ctx.db.deleteMany(seenMessageTable as EntityTableMeta, { accountId });
+    await ctx.db.deleteMany(syncCursorTable, { accountId });
+    await ctx.db.deleteMany(seenMessageTable, { accountId });
   }
 }
 
 export async function inboundMessageTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
-  await archiveAndDeleteRows(
-    ctx,
-    inboundMessagesProjectionTable as EntityTableMeta,
-    INBOUND_MESSAGE_AGGREGATE_TYPE,
-  );
+  await archiveAndDeleteRows(ctx, inboundMessagesProjectionTable, INBOUND_MESSAGE_AGGREGATE_TYPE);
 }
 
 export async function mailThreadTenantDestroyHook(ctx: TenantDataHookCtx): Promise<void> {
-  await archiveAndDeleteRows(
-    ctx,
-    mailThreadsProjectionTable as EntityTableMeta,
-    MAIL_THREAD_AGGREGATE_TYPE,
-  );
+  await archiveAndDeleteRows(ctx, mailThreadsProjectionTable, MAIL_THREAD_AGGREGATE_TYPE);
 }

package/packages/bundled-features/src/inbound-mail-foundation/types.ts

@@ -257,17 +257,15 @@ export class InboundTransientError extends Error {
   }
 }
 
-type KindCarrier = { readonly kind?: unknown };
-
 export function isInboundAuthError(e: unknown): e is InboundAuthError {
-  return e instanceof Error && (e as KindCarrier).kind === "inbound-auth-error";
+  return e instanceof Error && "kind" in e && e.kind === "inbound-auth-error";
 }
 export function isInboundRateLimitError(e: unknown): e is InboundRateLimitError {
-  return e instanceof Error && (e as KindCarrier).kind === "inbound-rate-limit-error";
+  return e instanceof Error && "kind" in e && e.kind === "inbound-rate-limit-error";
 }
 export function isInboundCursorInvalidError(e: unknown): e is InboundCursorInvalidError {
-  return e instanceof Error && (e as KindCarrier).kind === "inbound-cursor-invalid-error";
+  return e instanceof Error && "kind" in e && e.kind === "inbound-cursor-invalid-error";
 }
 export function isInboundTransientError(e: unknown): e is InboundTransientError {
-  return e instanceof Error && (e as KindCarrier).kind === "inbound-transient-error";
+  return e instanceof Error && "kind" in e && e.kind === "inbound-transient-error";
 }

package/packages/bundled-features/src/inbound-mail-foundation/watch-supervisor.ts

@@ -49,9 +49,10 @@ import {
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import type { DbConnection, EntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { DistributedLock } from "@cosmicdrift/kumiko-framework/pipeline";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { InboundMailAccountStatuses, InboundMailFoundationHandlers } from "./constants.js";
 import { MAIL_ACCOUNT_PII_FIELDS, syncCursorTable } from "./entities.js";
 import {
@@ -158,6 +159,17 @@ export type InboundMailSupervisor = {
   readonly stop: () => Promise<void>;
 };
 
+type ActiveMailAccountRow = {
+  readonly id: string;
+  readonly tenantId: string;
+  readonly provider: string;
+  readonly authMethod: string;
+  readonly ownerUserId?: string | null;
+  readonly address: string;
+  readonly displayName?: string;
+  readonly watchState?: string;
+};
+
 export function createInboundMailSupervisor(
   deps: InboundMailSupervisorDeps,
 ): InboundMailSupervisor {
@@ -206,30 +218,32 @@ export function createInboundMailSupervisor(
   // (Provider arbeiten nie mit Ciphertext).
   // ---------------------------------------------------------------
   async function listActiveAccounts(): Promise<readonly MailAccountRecord[]> {
-    const rows = await selectMany(deps.db, mailAccountsProjectionTable, {
+    const rows = await selectMany<ActiveMailAccountRow>(deps.db, mailAccountsProjectionTable, {
       status: InboundMailAccountStatuses.active,
     });
     const piiKms = configuredPiiSubjectKms();
     const records: MailAccountRecord[] = [];
-    for (const raw of rows) {
-      const row = piiKms
-        ? await decryptPiiFieldValues(
-            raw as Record<string, unknown>,
-            MAIL_ACCOUNT_PII_FIELDS,
-            piiKms,
-            { requestId: "inbound-mail-foundation:supervisor:list-accounts" },
-          )
-        : (raw as Record<string, unknown>);
+    for (const row of rows) {
+      const decrypted = piiKms
+        ? await decryptPiiFieldValues(row, MAIL_ACCOUNT_PII_FIELDS, piiKms, {
+            requestId: "inbound-mail-foundation:supervisor:list-accounts",
+          })
+        : row;
+      const decryptedAddress = decrypted["address"];
+      // Falling back to row.address would hand the ciphertext to a provider.
+      if (typeof decryptedAddress !== "string") {
+        throw new Error(`inbound-mail: address of mail account ${row.id} did not decrypt to text`);
+      }
       records.push({
-        id: row["id"] as string,
-        tenantId: row["tenantId"] as string,
-        provider: row["provider"] as string,
-        authMethod: row["authMethod"] as string,
-        ownerUserId: (row["ownerUserId"] as string | null | undefined) ?? null,
-        address: row["address"] as string,
-        displayName: (row["displayName"] as string | undefined) ?? "",
+        id: row.id,
+        tenantId: row.tenantId,
+        provider: row.provider,
+        authMethod: row.authMethod,
+        ownerUserId: row.ownerUserId ?? null,
+        address: decryptedAddress,
+        displayName: row.displayName ?? "",
         status: InboundMailAccountStatuses.active,
-        watchState: (row["watchState"] as string | undefined) ?? "idle",
+        watchState: row.watchState ?? "idle",
       });
     }
     return records;
@@ -239,13 +253,14 @@ export function createInboundMailSupervisor(
   // Cursor-Persistenz (unmanaged direct-write store).
   // ---------------------------------------------------------------
   async function loadCursor(accountId: string): Promise<SyncCursorPayload | null> {
-    const row = await fetchOne<{ cursor: string }>(deps.db, syncCursorTable as EntityTableMeta, {
+    const row = await fetchOne<{ cursor: string }>(deps.db, syncCursorTable, {
       accountId,
       scope: CURSOR_SCOPE,
     });
     if (!row) return null;
     try {
-      return JSON.parse(row.cursor) as SyncCursorPayload; // @cast-boundary eigene JSON-Persistenz
+      const parsed: unknown = JSON.parse(row.cursor);
+      return isPlainObject(parsed) ? parsed : null;
     } catch {
       return null; // korrupter Cursor = wie kein Cursor → Backfill, Dedup fängt Dubletten
     }
@@ -258,21 +273,21 @@ export function createInboundMailSupervisor(
     const accountId = account.id;
     const now = Temporal.Now.instant().toString();
     const serialized = JSON.stringify(cursor);
-    const existing = await fetchOne<{ id: string }>(deps.db, syncCursorTable as EntityTableMeta, {
+    const existing = await fetchOne<{ id: string }>(deps.db, syncCursorTable, {
       accountId,
       scope: CURSOR_SCOPE,
     });
     if (existing) {
       await updateMany(
         deps.db,
-        syncCursorTable as EntityTableMeta,
+        syncCursorTable,
         { cursor: serialized, updatedAt: now },
         { accountId, scope: CURSOR_SCOPE },
       );
       // skip: update-Pfad fertig — nicht in den insert-Zweig durchfallen.
       return;
     }
-    await insertOne(deps.db, syncCursorTable as EntityTableMeta, {
+    await insertOne(deps.db, syncCursorTable, {
       id: crypto.randomUUID(),
       // Direct-write store: no executor stamps the NOT NULL tenant_id for us.
       tenantId: account.tenantId,
@@ -288,7 +303,7 @@ export function createInboundMailSupervisor(
     // → nächster fetch läuft als Backfill.
     await updateMany(
       deps.db,
-      syncCursorTable as EntityTableMeta,
+      syncCursorTable,
       { cursor: "", updatedAt: Temporal.Now.instant().toString() },
       { accountId, scope: CURSOR_SCOPE },
     );

package/packages/bundled-features/src/inbound-provider-imap/imap-client.ts

@@ -18,6 +18,7 @@ import {
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { legacyDateToInstant } from "@cosmicdrift/kumiko-framework/time";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { ImapFlow } from "imapflow";
 import { type AddressObject, type ParsedMail, simpleParser } from "mailparser";
 import type { ImapCredentialDocument } from "./credential-document.js";
@@ -97,11 +98,11 @@ export function mapImapError(err: unknown, host: string): Error {
   // imapflow-Fehler tragen die Server-Antwort in responseText, die
   // message ist nur "Command failed" — beides in den Match einbeziehen;
   // authenticationFailed ist das verlässliche Flag.
-  const carrier = err as { authenticationFailed?: unknown; responseText?: unknown };
-  const responseText = typeof carrier?.responseText === "string" ? carrier.responseText : "";
+  const carrier = isPlainObject(err) ? err : undefined;
+  const responseText = typeof carrier?.["responseText"] === "string" ? carrier["responseText"] : "";
   const msg = `${err instanceof Error ? err.message : String(err)} ${responseText}`.trim();
   if (
-    carrier?.authenticationFailed === true ||
+    carrier?.["authenticationFailed"] === true ||
     /auth(entication)? failed|invalid credentials|invalid login|LOGIN failed|AUTHENTICATIONFAILED/i.test(
       msg,
     )

package/packages/bundled-features/src/jobs/handlers/catalog.query.ts

@@ -12,7 +12,7 @@ export type ManualJobCatalogEntry = {
 function payloadSchemaJson(job: JobDefinition): Record<string, unknown> | null {
   if (job.schema === undefined) return null;
   try {
-    return z.toJSONSchema(job.schema) as Record<string, unknown>;
+    return z.toJSONSchema(job.schema);
   } catch {
     // Non-JSON-Schema-able Zod types (transforms/effects) — UI still lists the job.
     return null;

package/packages/bundled-features/src/ledger/recurring.ts

@@ -63,9 +63,7 @@ export function findReversedIds(
 ): Set<string> {
   const ids = new Set(rows.map((r) => r.id));
   return new Set(
-    rows
-      .filter((r) => r.reference !== null && ids.has(r.reference))
-      .map((r) => r.reference as string),
+    rows.flatMap((r) => (r.reference !== null && ids.has(r.reference) ? [r.reference] : [])),
   );
 }
 

package/packages/bundled-features/src/managed-pages/branding.ts

@@ -50,6 +50,11 @@ const DESCRIPTION_PATTERN = { regex: "^[\\s\\S]{0,500}$" } as const;
 // there.
 const CUSTOM_CSS_PATTERN = { regex: "^[\\s\\S]{0,8000}$" } as const;
 
+// Empty or a FileRef id (UUID); the upload UI that fills it ships separately.
+const FILE_REF_ID_PATTERN = {
+  regex: "^$|^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+} as const;
+
 export const LAYOUT_PRESETS = ["minimal", "centered", "wide"] as const;
 
 // Companion toggle feature name. managed-pages reads ctx.hasFeature() against it
@@ -91,6 +96,12 @@ export const BRANDING_KEYS = {
     pattern: HTTPS_PATTERN,
     write: BRANDING_WRITE,
   }),
+  // Ownership is checked where it is read (renderer-mail-html: FileRef must belong to the rendering tenant).
+  brandingLogoFile: createTenantConfig("text", {
+    default: "",
+    pattern: FILE_REF_ID_PATTERN,
+    write: BRANDING_WRITE,
+  }),
   brandingLayoutPreset: createTenantConfig("select", {
     default: "centered",
     options: LAYOUT_PRESETS,
@@ -112,6 +123,7 @@ export const BRANDING_QN = {
   siteUrl: "managed-pages:config:branding-site-url",
   accentColor: "managed-pages:config:branding-accent-color",
   logoUrl: "managed-pages:config:branding-logo-url",
+  logoFile: "managed-pages:config:branding-logo-file",
   layoutPreset: "managed-pages:config:branding-layout-preset",
   customCss: "managed-pages:config:branding-custom-css",
 } as const;
@@ -129,17 +141,28 @@ async function readText(config: ConfigAccessor, qualifiedKey: string): Promise<s
 // publicstatus' branding read), not a crash.
 export async function readBranding(config: ConfigAccessor | undefined): Promise<BrandingTokens> {
   if (!config) return EMPTY_BRANDING;
-  const [title, description, siteUrl, accentColor, logoUrl, layoutPreset] = await Promise.all([
-    readText(config, BRANDING_QN.title),
-    readText(config, BRANDING_QN.description),
-    readText(config, BRANDING_QN.siteUrl),
-    readText(config, BRANDING_QN.accentColor),
-    readText(config, BRANDING_QN.logoUrl),
-    readText(config, BRANDING_QN.layoutPreset),
-  ]);
+  const [title, description, siteUrl, accentColor, logoUrl, logoFile, layoutPreset] =
+    await Promise.all([
+      readText(config, BRANDING_QN.title),
+      readText(config, BRANDING_QN.description),
+      readText(config, BRANDING_QN.siteUrl),
+      readText(config, BRANDING_QN.accentColor),
+      readText(config, BRANDING_QN.logoUrl),
+      readText(config, BRANDING_QN.logoFile),
+      readText(config, BRANDING_QN.layoutPreset),
+    ]);
   // customCss stays "" here — it is gated (allowCustomCss + per-tenant toggle)
   // and read separately by the branding query via readCustomCss.
-  return { title, description, siteUrl, accentColor, logoUrl, layoutPreset, customCss: "" };
+  return {
+    title,
+    description,
+    siteUrl,
+    accentColor,
+    logoUrl,
+    logoFile,
+    layoutPreset,
+    customCss: "",
+  };
 }
 
 // Read the raw, untrusted custom CSS for the request's tenant. The caller (the
@@ -167,6 +190,7 @@ export function coerceBranding(value: unknown): BrandingTokens {
     siteUrl: stringField(source, "siteUrl"),
     accentColor: stringField(source, "accentColor"),
     logoUrl: stringField(source, "logoUrl"),
+    logoFile: stringField(source, "logoFile"),
     layoutPreset: stringField(source, "layoutPreset"),
     customCss: stringField(source, "customCss"),
   };

package/packages/bundled-features/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Branding screen edits the logo file and readBranding returns logoFile",
+    "detail": "The branding settings screen has a logo upload for managed-pages:config:branding-logo-file, and readBranding and the branding query include logoFile next to logoUrl. The template resource errors template_resource_too_large and template_resource_unsupported_image have German and Spanish texts."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -47,6 +47,7 @@ function brandingRevisionSeed(branding: BrandingTokens): string {
     branding.siteUrl,
     branding.accentColor,
     branding.logoUrl,
+    branding.logoFile,
     branding.layoutPreset,
     branding.customCss,
   ]);

package/packages/bundled-features/src/managed-pages/i18n.ts

@@ -42,6 +42,7 @@ export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
     en: "Accent color",
   },
   "managed-pages:entity:__config-edit__:field:logoUrl": { en: "Logo URL" },
+  "managed-pages:entity:__config-edit__:field:logoFile": { en: "Logo file" },
   "managed-pages:entity:__config-edit__:field:layoutPreset": { en: "Layout" },
 
   // Section-Header

package/packages/bundled-features/src/managed-pages/screens/branding-screen.ts

@@ -1,5 +1,6 @@
 import {
   type ConfigEditScreenDefinition,
+  createImageField,
   createSelectField,
   createTextField,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -35,6 +36,7 @@ export function createBrandingSettingsScreen(opts: {
       siteUrl: BRANDING_QN.siteUrl,
       accentColor: BRANDING_QN.accentColor,
       logoUrl: BRANDING_QN.logoUrl,
+      logoFile: BRANDING_QN.logoFile,
       layoutPreset: BRANDING_QN.layoutPreset,
     },
     fields: {
@@ -62,6 +64,11 @@ export function createBrandingSettingsScreen(opts: {
         personal: false,
         reason: "is_business_data",
       }),
+      logoFile: createImageField({
+        accept: ["image/png", "image/jpeg", "image/webp"],
+        personal: false,
+        reason: "is_business_data",
+      }),
       layoutPreset: createSelectField({ options: LAYOUT_PRESETS }),
     },
     layout: {
@@ -75,6 +82,7 @@ export function createBrandingSettingsScreen(opts: {
             { field: "description", span: 2 },
             { field: "siteUrl", span: 1 },
             { field: "logoUrl", span: 1 },
+            { field: "logoFile", span: 1 },
             { field: "accentColor", span: 1 },
           ],
         },

package/packages/bundled-features/src/page-render/branding.ts

@@ -13,6 +13,8 @@ export type BrandingTokens = {
   readonly siteUrl: string;
   readonly accentColor: string;
   readonly logoUrl: string;
+  // FileRef id of an uploaded logo ("" = none); the renderer resolves it, tenant ownership is checked there.
+  readonly logoFile: string;
   readonly layoutPreset: string;
   // RAW, untrusted tenant CSS — "" unless the custom-css capability is gated on
   // (managed-pages allowCustomCss + the per-tenant toggle). It is NOT pre-
@@ -29,6 +31,7 @@ export const EMPTY_BRANDING: BrandingTokens = {
   siteUrl: "",
   accentColor: "",
   logoUrl: "",
+  logoFile: "",
   layoutPreset: "",
   customCss: "",
 };

package/packages/bundled-features/src/page-render/markdown.ts

@@ -25,7 +25,7 @@ safeRenderer.use({
 });
 
 export function renderSafeMarkdown(markdown: string): string {
-  // @cast-boundary marked.parse return-type ist `string | Promise<string>`;
+  // @cast-boundary third-party-type-gap marked.parse return-type ist `string | Promise<string>`;
   // `{ async: false }` garantiert sync (string) — Cast nur API-Vertragsfix.
   return safeRenderer.parse(markdown, { async: false }) as string;
 }

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -42,11 +42,9 @@ export function bindPatAutoRevokeOnPasswordChangeFromFeature(
 ): BindPatAutoRevokeOnPasswordChange | undefined {
   const exports = feature.exports;
   if (exports && typeof exports === "object" && "bindAutoRevokeOnPasswordChange" in exports) {
-    const { bindAutoRevokeOnPasswordChange } = exports as {
-      bindAutoRevokeOnPasswordChange: unknown;
-    };
+    const { bindAutoRevokeOnPasswordChange } = exports;
     if (typeof bindAutoRevokeOnPasswordChange === "function") {
-      // @cast-boundary exports-walk — feature.exports is untyped by design
+      // @cast-boundary feature-exports — feature.exports is untyped by design
       return bindAutoRevokeOnPasswordChange as BindPatAutoRevokeOnPasswordChange;
     }
   }

package/packages/bundled-features/src/personal-access-tokens/handlers/list.query.ts

@@ -1,5 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { decryptStoredPii } from "../../shared/index.js";
 import { isExpiredAt } from "../expiry.js";
@@ -13,7 +14,7 @@ const SORTABLE_COLUMNS = ["id", "name", "createdAt", "expiresAt", "revokedAt"] a
 type SortableColumn = (typeof SORTABLE_COLUMNS)[number];
 
 function isSortableColumn(value: string): value is SortableColumn {
-  return (SORTABLE_COLUMNS as readonly string[]).includes(value);
+  return isOneOf(SORTABLE_COLUMNS, value);
 }
 
 type PatStatus = "active" | "revoked" | "expired";

package/packages/bundled-features/src/personal-access-tokens/index.ts

@@ -29,7 +29,7 @@ export { expandScopes } from "./scopes.js";
 export function patRateLimitFromFeature(feature: FeatureDefinition): PatRateLimit {
   const exports = feature.exports;
   if (exports && typeof exports === "object" && "rateLimit" in exports) {
-    const { rateLimit } = exports as { rateLimit: unknown };
+    const { rateLimit } = exports;
     if (
       rateLimit &&
       typeof rateLimit === "object" &&

package/packages/bundled-features/src/personal-access-tokens/revoke-for-user.ts

@@ -4,6 +4,7 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import {
   PAT_REVOKED_AGGREGATE_TYPE,
   PAT_REVOKED_EVENT_QN,
@@ -13,7 +14,7 @@ import { apiTokenTable } from "./schema/api-token.js";
 
 // A pool has begin(); a tx/savepoint handle does not and is already atomic.
 function canBeginTransaction(db: DbRunner): boolean {
-  return typeof (db as { begin?: unknown }).begin === "function"; // @cast-boundary driver-handle-probe
+  return typeof propertyOf(db, "begin") === "function";
 }
 
 // Cross-tenant revoke: password-change and MFA-enable/disable are account-

package/packages/bundled-features/src/renderer-foundation/README.md

@@ -1,6 +1,6 @@
 # renderer-foundation
 
-Plugin-Foundation für Renderer (Notification, HTML-Mail, PDF, Image). Plugins (`renderer-simple`, `renderer-mail-html`, `renderer-puppeteer-client`) registrieren sich via `r.useExtension("renderer", "<name>", { kinds, render })`.
+Plugin-Foundation für Renderer (HTML-Mail, PDF, Image). Plugins (`renderer-mail-html`, `renderer-puppeteer-client`) registrieren sich via `r.useExtension("renderer", "<name>", { kinds, render })`.
 
 **Plan-Doc:** [`kumiko-platform/docs/plans/features/renderer-foundation.md`](../../../../../../kumiko-platform/docs/plans/features/renderer-foundation.md)
 
@@ -16,8 +16,7 @@ import {
 const features = [
   createTemplateResolverFeature(),
   createRendererFoundationFeature(),
-  createRendererSimpleFeature(),   // Plugin
-  createRendererMailHtmlFeature(), // Plugin (enterprise)
+  createRendererMailHtmlFeature(), // Plugin: kind "mail"
   // weitere Plugins...
 ];
 
@@ -38,23 +37,25 @@ import { requireRendererFoundation } from "@cosmicdrift/kumiko-bundled-features/
 
 async function sendMail(ctx, tenantId) {
   const foundation = requireRendererFoundation(ctx, "sendMail");
-  const renderer = foundation.createRendererForTenant({ tenantId, kind: "mail-html" });
+  const renderer = foundation.createRendererForTenant({ tenantId, kind: "mail" });
   const result = await renderer.render(
     {
-      kind: "mail-html",
-      payload: { content: "Hello {{name}}", contentFormat: "markdown", variables: { name: "Frau Schmidt" } },
+      kind: "mail",
+      payload: { slug: "billing:notify:invoice-ready", locale: "de", variables: { name: "Frau Schmidt" } },
     },
-    { db: ctx.db, registry: ctx.registry, tenantId },
+    { db: ctx.db, registry: ctx.registry, tenantId, config: ctx.config },
   );
-  // result.html, result.text
+  // result.subject, result.html, result.text, result.previewText
 }
 ```
 
-Plugins ohne Service-Deps (`renderer-simple`) ignorieren den zweiten `ctx`-Parameter.
+Plugins ohne Service-Deps ignorieren den zweiten `ctx`-Parameter.
+
+Mails einer `r.notification` rendert die Delivery selbst: `template` + `meta` an der Notification werden beim Boot gesät (`seedNotificationTemplates`) und über kind `"mail"` gerendert. Ohne `template` + `meta` scheitert der Versand über den Email-Channel.
 
 ## Plugin-Auswahl-Reihenfolge
 
-1. Tenant-Override (Config-Key `rendererPluginByKind`, z.B. `{ "mail-html": "mail-html" }`)
+1. Tenant-Override (Config-Key `rendererPluginByKind`, z.B. `{ "mail": "mail-html" }`)
 2. `DEFAULT_PLUGIN_BY_KIND` aus constants
 3. Erstes Plugin im Pool das das kind bedient
 4. `RendererError("no_plugin_for_kind")` wenn nichts passt

package/packages/bundled-features/src/renderer-foundation/api.ts

@@ -10,21 +10,21 @@ import { RendererError, type RendererPlugin } from "./types.js";
 
 export type RendererFoundationApi = {
   /**
-   * Wählt + returnt ein RendererPlugin für (tenantId × kind). Caller
-   * rufen anschließend `plugin.render(req, ctx)`.
+   * Selects + returns a RendererPlugin for (tenantId × kind). Callers
+   * then invoke `plugin.render(req, ctx)`.
    *
-   * **Auswahl-Reihenfolge:**
-   *   1. Tenant-spezifische Config (config-Bundle: `rendererPluginByKind`)
-   *   2. DEFAULT_PLUGIN_BY_KIND aus constants
-   *   3. Erstes Plugin im Pool das das kind bedient
-   *   4. `RendererError("no_plugin_for_kind")` wenn nichts passt
+   * **Selection order:**
+   *   1. Tenant-specific config (config bundle: `rendererPluginByKind`)
+   *   2. DEFAULT_PLUGIN_BY_KIND from constants
+   *   3. First plugin in the pool that serves the kind
+   *   4. `RendererError("no_plugin_for_kind")` if nothing matches
    *
-   * **Caller-Pattern:** `tenantId` MUSS vom Server kommen (typisch
-   * `ctx.user.tenantId`). Plugins, die Service-Access brauchen (z.B.
-   * `renderer-mail-html` für Layout-Resolve via `template-resolver`),
-   * erhalten `RendererContext` als zweites Argument zu `render()` —
-   * matcht das Pattern von `DeliveryChannel.send(addr, msg, ctx)`.
-   * Plugins ohne Service-Deps (z.B. `renderer-simple`) ignorieren ctx.
+   * **Caller pattern:** `tenantId` MUST come from the server (typically
+   * `ctx.user.tenantId`). Plugins that need service access (e.g.
+   * `@cosmicdrift/kumiko-renderer-mail-html` for layout resolution via `template-resolver`)
+   * receive `RendererContext` as the second argument to `render()` —
+   * matches the pattern of `DeliveryChannel.send(addr, msg, ctx)`.
+   * Plugins without service deps ignore ctx.
    */
   readonly createRendererForTenant: (args: {
     readonly tenantId: TenantId;
@@ -66,7 +66,7 @@ export function createRendererFoundationApi(
 
       // 4. Kein Plugin → Error
       throw new RendererError(
-        `[renderer-foundation] no plugin registered for kind="${kind}". Mount at least one plugin (renderer-simple, renderer-mail-html, renderer-puppeteer-client) for this kind.`,
+        `[renderer-foundation] no plugin registered for kind="${kind}". Mount at least one plugin (renderer-mail-html, renderer-puppeteer-client) for this kind.`,
         "no_plugin_for_kind",
       );
     },