@cosmicdrift/kumiko-samples 0.367.0 → 0.369.0

package/packages/bundled-features/src/inbound-provider-imap/feature.ts

@@ -272,17 +272,26 @@ export const imapInboundMailPlugin: InboundMailProviderPlugin = {
   // gehören den OAuth-Providern (M365/Gmail).
 };
 
-export const inboundProviderImapFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    'Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Store the per-account connection JSON (host/port/secure/user/password) in the account credential secret slot before the first sync.',
+export function createInboundProviderImapFeature() {
+  return defineFeature(
+    FEATURE_NAME,
+    (r) => {
+      r.describe(
+        'Registers the `"imap"` provider for `inbound-mail-foundation` using imapflow — password/app-password auth covers classic IMAP hosts without any OAuth (plus an XOAUTH2 fallback consuming an access token from the secret slot). Incremental sync via a UIDVALIDITY:lastUid cursor (UIDVALIDITY change triggers a cursor-invalid full resync), initial backfill bounded by the foundation backfill window, and live push via IMAP IDLE for the watch supervisor. Store the per-account connection JSON (host/port/secure/user/password) in the account credential secret slot before the first sync.',
+      );
+      r.uiHints({
+        displayLabel: "Inbound Mail · IMAP",
+        category: "notifications",
+        recommended: false,
+      });
+      r.requires({ features: ["inbound-mail-foundation"] });
+      r.requires({ features: ["secrets"] });
+      r.envSchema(mailAllowedPrivateHostsEnvSchema);
+      r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
+    },
+    { dedupeOptions: {} },
   );
-  r.uiHints({
-    displayLabel: "Inbound Mail · IMAP",
-    category: "notifications",
-    recommended: false,
-  });
-  r.requires({ features: ["inbound-mail-foundation"] });
-  r.requires({ features: ["secrets"] });
-  r.envSchema(mailAllowedPrivateHostsEnvSchema);
-  r.useExtension(INBOUND_MAIL_PROVIDER_EXTENSION, IMAP_PROVIDER_KEY, imapInboundMailPlugin);
-});
+}
+
+/** @deprecated Use createInboundProviderImapFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const inboundProviderImapFeature = createInboundProviderImapFeature();

package/packages/bundled-features/src/inbound-provider-imap/index.ts

@@ -6,7 +6,12 @@ export {
   type ParseCredentialResult,
   parseImapCredentialDocument,
 } from "./credential-document.js";
-export { IMAP_PROVIDER_KEY, inboundProviderImapFeature, setImapMailHostLookup } from "./feature.js";
+export {
+  createInboundProviderImapFeature,
+  IMAP_PROVIDER_KEY,
+  inboundProviderImapFeature,
+  setImapMailHostLookup,
+} from "./feature.js";
 export {
   assertUidValidity,
   buildProviderMessageId,

package/packages/bundled-features/src/inbound-provider-inmemory/feature.ts

@@ -139,16 +139,24 @@ export const inMemoryInboundMailPlugin: InboundMailProviderPlugin = {
 // =============================================================================
 // Feature-definition
 // =============================================================================
-
-export const inboundProviderInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    'Registers a scriptable in-process `"inmemory"` provider for `inbound-mail-foundation`. Seed messages with `seedInboundMessage(accountId, msg)` — an active watch pushes them immediately (IDLE simulation) and the cursor-based `fetch` re-delivers them on the reconciliation path, exercising the foundation dedup guarantee. Error injection via `failNextFetchWith`/`failNextVerifyWith`/`emitWatchError`; reset state with `resetInboundInMemory()`. For tests, demos and sample apps — not for production.',
+export function createInboundProviderInMemoryFeature() {
+  return defineFeature(
+    FEATURE_NAME,
+    (r) => {
+      r.describe(
+        'Registers a scriptable in-process `"inmemory"` provider for `inbound-mail-foundation`. Seed messages with `seedInboundMessage(accountId, msg)` — an active watch pushes them immediately (IDLE simulation) and the cursor-based `fetch` re-delivers them on the reconciliation path, exercising the foundation dedup guarantee. Error injection via `failNextFetchWith`/`failNextVerifyWith`/`emitWatchError`; reset state with `resetInboundInMemory()`. For tests, demos and sample apps — not for production.',
+      );
+      r.uiHints({
+        displayLabel: "Inbound Mail · In-Memory Provider",
+        category: "notifications",
+        recommended: false,
+      });
+      r.requires({ features: ["inbound-mail-foundation"] });
+      r.useExtension("inboundMailProvider", INMEMORY_PROVIDER_KEY, inMemoryInboundMailPlugin);
+    },
+    { dedupeOptions: {} },
   );
-  r.uiHints({
-    displayLabel: "Inbound Mail · In-Memory Provider",
-    category: "notifications",
-    recommended: false,
-  });
-  r.requires({ features: ["inbound-mail-foundation"] });
-  r.useExtension("inboundMailProvider", INMEMORY_PROVIDER_KEY, inMemoryInboundMailPlugin);
-});
+}
+
+/** @deprecated Use createInboundProviderInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const inboundProviderInMemoryFeature = createInboundProviderInMemoryFeature();

package/packages/bundled-features/src/inbound-provider-inmemory/index.ts

@@ -1,6 +1,7 @@
 // Public API of the inbound-provider-inmemory bundled-feature.
 
 export {
+  createInboundProviderInMemoryFeature,
   emitWatchError,
   failNextFetchWith,
   failNextVerifyWith,

package/packages/bundled-features/src/jobs/db/queries/retention.ts

@@ -10,8 +10,8 @@
 // deleteManyBatched (typed query API, no raw SQL in this file) chunks each
 // delete so a large backlog doesn't hold one lock for the whole sweep.
 
-import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/db";
 import { jobRunLogsTable, jobRunsTable } from "../../job-run-table.js";
 import { tenantJobFailuresTable } from "../../tenant-job-failure-table.js";
 import { tenantJobRunsTable } from "../../tenant-job-run-table.js";

package/packages/bundled-features/src/jobs/db/queries/stale-run-sweep.ts

@@ -12,8 +12,8 @@
 // the run becomes retriable via the existing jobs:write:retry gate
 // (retry.write.ts only allows retry from "failed").
 
-import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { deleteManyBatched, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import { mapWithConcurrency } from "../../../shared/index.js";
 import { DEFAULT_JOB_RUN_RETENTION_DAYS } from "../../handlers/retention-cleanup.job.js";
 import { encryptFailureError } from "../../job-run-logger.js";

package/packages/bundled-features/src/jobs/handlers/detail.query.ts

@@ -1,4 +1,4 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/jobs/handlers/list.query.ts

@@ -1,5 +1,10 @@
-import { countWhere, selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  countWhere,
+  decodeCursor,
+  encodeCursor,
+  selectMany,
+  type WhereObject,
+} from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";

package/packages/bundled-features/src/jobs/handlers/retry.write.ts

@@ -1,5 +1,5 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { isPiiCiphertext, PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import {
   InternalError,

package/packages/bundled-features/src/jobs/handlers/tenant-failures.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";

package/packages/bundled-features/src/jobs/handlers/tenant-runs.query.ts

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { serializeJobSubject } from "@cosmicdrift/kumiko-framework/jobs";

package/packages/bundled-features/src/jobs/job-run-logger.ts

@@ -1,4 +1,14 @@
 import {
+  configuredPiiSubjectKms,
+  encryptPiiValueForSubject,
+  KeyErasedError,
+  type LocalKeyKmsAdapter,
+  PII_ERASED_SENTINEL,
+  type SubjectId,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  acquireNamespacedAdvisoryLock,
+  type DbConnection,
   deleteMany,
   fetchOne,
   insertMany,
@@ -7,16 +17,7 @@ import {
   transaction,
   updateMany,
   upsertOnConflict,
-} from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  configuredPiiSubjectKms,
-  encryptPiiValueForSubject,
-  KeyErasedError,
-  type LocalKeyKmsAdapter,
-  PII_ERASED_SENTINEL,
-  type SubjectId,
-} from "@cosmicdrift/kumiko-framework/crypto";
-import { acquireNamespacedAdvisoryLock, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+} from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import type {
   JobDroppedMeta,

package/packages/bundled-features/src/jobs/tenant-job-failure-table.ts

@@ -1,9 +1,9 @@
-import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   type EntityTableMeta,
   index,
   instant,
   table as pgTable,
+  requireEntityTableMeta,
   serial,
   sql,
   text,

package/packages/bundled-features/src/jobs/tenant-job-run-table.ts

@@ -1,9 +1,9 @@
-import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   type EntityTableMeta,
   index,
   instant,
   table as pgTable,
+  requireEntityTableMeta,
   serial,
   sql,
   text,

package/packages/bundled-features/src/ledger/feature.ts

@@ -151,7 +151,7 @@ function registerLedger(
   r.queryHandler(createBalanceSheetHandler(access));
 }
 
-export const ledgerFeature = defineFeature(LEDGER_FEATURE_NAME, (r) =>
+const defaultLedgerFeature = defineFeature(LEDGER_FEATURE_NAME, (r) =>
   registerLedger(r, DEFAULT_LEDGER_ACCESS, undefined),
 );
 
@@ -174,10 +174,13 @@ function resolveAccess(opts: LedgerFeatureOptions): AccessRule {
 
 // Options wrapper. Without options returns the module-level singleton (no
 // rebuild). access/roles/toggleable build a fresh feature-definition.
-export function createLedgerFeature(opts: LedgerFeatureOptions = {}): typeof ledgerFeature {
+export function createLedgerFeature(opts: LedgerFeatureOptions = {}): typeof defaultLedgerFeature {
   if (opts.access === undefined && opts.roles === undefined && opts.toggleable === undefined) {
-    return ledgerFeature;
+    return defaultLedgerFeature;
   }
   const access = resolveAccess(opts);
   return defineFeature(LEDGER_FEATURE_NAME, (r) => registerLedger(r, access, opts.toggleable));
 }
+
+/** @deprecated Use createLedgerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const ledgerFeature = createLedgerFeature();

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -45,6 +45,7 @@ import {
   type Registry,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { MAIL_FOUNDATION_I18N } from "./i18n.js";
 
 const FEATURE_NAME = "mail-foundation";
 
@@ -102,6 +103,10 @@ export type MailTransportContext = {
  */
 export type MailTransportPlugin = {
   readonly build: (ctx: MailTransportContext, tenantId: string) => Promise<EmailTransport>;
+  /** `false` keeps the provider out of the generated settings: it can still be set by a
+   *  seed or config write, but a tenant admin is never offered it (e.g. a test inbox
+   *  that swallows every mail). */
+  readonly selectableInSettings?: false;
 };
 
 // extension-usage `options` is engine-payload (unknown) — structurally validate
@@ -120,56 +125,71 @@ declare module "@cosmicdrift/kumiko-framework/engine" {
 // =============================================================================
 // Feature-definition
 // =============================================================================
+export function createMailFoundationFeature() {
+  return defineFeature(
+    FEATURE_NAME,
+    (r) => {
+      r.describe(
+        "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature`: notifications declared with `tenantTransport: true` then go through the tenant's own transport when it has a provider and through the app transport otherwise. Tenant admins pick the provider and fill in its settings on the generated Email sending settings screen; an empty provider is a valid choice and means the platform sends.",
+      );
+      r.uiHints({
+        displayLabel: "Mail Transport Foundation",
+        category: "notifications",
+        recommended: false,
+      });
+      r.requires({ features: ["config"] });
 
-export const mailFoundationFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature` so a tenant with a provider configured sends delivery mails through its own transport and other tenants through the app transport.",
-  );
-  r.uiHints({
-    displayLabel: "Mail Transport Foundation",
-    category: "notifications",
-    recommended: false,
-  });
-  r.requires({ features: ["config"] });
+      // Plugin extension-point. Provider-features register here. The
+      // entityName at registration time becomes the value tenants pick in
+      // `provider` config-key (e.g. "smtp", "brevo-api").
+      r.extendsRegistrar(MAIL_TRANSPORT_EXTENSION, {
+        onRegister: () => {
+          // No side-effects at register-time — the registry stores the
+          // usage, factory looks it up at request-time. Same shape as
+          // delivery's extendsRegistrar.
+        },
+      });
 
-  // Plugin extension-point. Provider-features register here. The
-  // entityName at registration time becomes the value tenants pick in
-  // `provider` config-key (e.g. "smtp", "brevo-api").
-  r.extendsRegistrar(MAIL_TRANSPORT_EXTENSION, {
-    onRegister: () => {
-      // No side-effects at register-time — the registry stores the
-      // usage, factory looks it up at request-time. Same shape as
-      // delivery's extendsRegistrar.
-    },
-  });
+      // Empty = this tenant has no own provider: tenantMailTransport yields null and
+      // channel-email uses the app transport, so empty is a valid choice a tenant can
+      // return to (reset in the settings mask) and readiness must not flag it.
+      // createTransportForTenant still throws on empty.
+      const providerConfigKey = r.config(
+        "provider",
+        createTenantConfig("text", {
+          default: "",
+          // No SystemAdmin: a platform-level provider would be inherited by every tenant,
+          // whose own credentials (tenant secrets) are missing, and break all their mail.
+          write: access.withSystem(access.roles("TenantAdmin")),
+          read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+          mask: {
+            title: "mail-foundation.provider",
+            description: "mail-foundation.provider.description",
+            icon: "mail",
+            order: 1,
+          },
+        }),
+      );
+      // Readiness gating: transport-plugins' required keys/secrets count only
+      // while their plugin is the one this key selects.
+      r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
 
-  // Provider-selector. Default empty so the boot-validator throws if a
-  // tenant tries to send mail without first picking + setting up a
-  // provider — better than a silent fallback. The actual list of valid
-  // values lives in the registered plugins, not here — Designer-UI can
-  // render `getExtensionUsages("mailTransport").map(u => u.entityName)`
-  // as the option-list.
-  const providerConfigKey = r.config(
-    "provider",
-    createTenantConfig("text", {
-      default: "",
-      // required: ohne gewählten Provider wirft createTransportForTenant —
-      // readiness meldete vorher ready:true und der erste Mail-Send
-      // lieferte den UnconfiguredError (280/1).
-      required: true,
-      write: access.roles("TenantAdmin", "SystemAdmin"),
-      read: access.roles("TenantAdmin", "SystemAdmin", "User"),
-    }),
+      r.translations({ keys: MAIL_FOUNDATION_I18N });
+
+      return {
+        /** Config-key-handle for the provider-selector. */
+        providerConfigKey,
+      };
+    },
+    { dedupeOptions: {} },
   );
-  // Readiness gating: transport-plugins' required keys/secrets count only
-  // while their plugin is the one this key selects.
-  r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
+}
+
+// The typed handles below come from one shared instance; each factory call builds its own handle objects.
+const sharedMailFoundationFeature = createMailFoundationFeature();
 
-  return {
-    /** Config-key-handle for the provider-selector. */
-    providerConfigKey,
-  };
-});
+/** @deprecated Use createMailFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const mailFoundationFeature = sharedMailFoundationFeature;
 
 // =============================================================================
 // Transport-factory — looks up the registered plugin + delegates
@@ -224,7 +244,7 @@ export async function createTransportForTenantIfConfigured(
   }
 
   const provider = requireDefined(
-    await ctxConfig(mailFoundationFeature.exports.providerConfigKey),
+    await ctxConfig(sharedMailFoundationFeature.exports.providerConfigKey),
     FEATURE_NAME,
     "provider",
   ) as string; // @cast-boundary engine-payload

package/packages/bundled-features/src/mail-foundation/i18n.ts

@@ -0,0 +1,8 @@
+export const MAIL_FOUNDATION_I18N = {
+  "screen:mail-foundation-tenant.title": { en: "Email sending" },
+  "mail-foundation.settings": { en: "Email sending" },
+  "mail-foundation.provider": { en: "Own mail server" },
+  "mail-foundation.provider.description": {
+    en: "Without one, the platform sends the mails. Reset the choice to go back to that.",
+  },
+} as const;

package/packages/bundled-features/src/mail-foundation/index.ts

@@ -8,6 +8,7 @@
 //     when registering via `r.useExtension("mailTransport", ...)`
 
 export {
+  createMailFoundationFeature,
   createTransportForTenant,
   createTransportForTenantIfConfigured,
   isMailTransportPlugin,

package/packages/bundled-features/src/mail-transport-inmemory/feature.ts

@@ -75,23 +75,37 @@ export function clearInbox(tenantId: string): void {
 // =============================================================================
 // Feature-definition
 // =============================================================================
+export function createMailTransportInMemoryFeature() {
+  return defineFeature(
+    FEATURE_NAME,
+    (r) => {
+      r.describe(
+        'Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).',
+      );
+      // Kein requires auf "config" oder "secrets" — der
+      // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
+      // kein Secret. Der einzige hard-require ist mail-foundation, das den
+      // extension-point "mailTransport" definiert.
+      r.requires({ features: ["mail-foundation"] });
 
-export const mailTransportInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
-  r.describe(
-    'Registers an in-process `"inmemory"` provider for `mail-foundation` that buffers sent mails per tenant instead of contacting an SMTP server. Use `getInbox(tenantId)` and `clearInbox(tenantId)` in demo apps and tests; not for production (buffer is process-memory, lost on restart).',
+      const plugin: MailTransportPlugin = {
+        // Solon and studio mount it next to smtp in production; offering it there would
+        // let a tenant admin route every mail into process memory.
+        selectableInSettings: false,
+        build: async (_ctx: MailTransportContext, tenantId: string): Promise<EmailTransport> => {
+          // Returns the per-tenant buffer. Identity-stable across calls so the
+          // demo inbox keeps accumulating.
+          return getOrCreateTransportForTenant(tenantId);
+        }, // @wrapper-known semantic-alias
+      };
+      r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
+      r.translations({
+        keys: { "mail-transport-inmemory.settings": { en: "Test inbox (in memory)" } },
+      });
+    },
+    { dedupeOptions: {} },
   );
-  // Kein requires auf "config" oder "secrets" — der
-  // In-Memory-Transport hat keine Config (nichts zu konfigurieren) und
-  // kein Secret. Der einzige hard-require ist mail-foundation, das den
-  // extension-point "mailTransport" definiert.
-  r.requires({ features: ["mail-foundation"] });
+}
 
-  const plugin: MailTransportPlugin = {
-    build: async (_ctx: MailTransportContext, tenantId: string): Promise<EmailTransport> => {
-      // Returnt den per-tenant Buffer. Identitätsstabil zwischen calls
-      // damit die Demo-Inbox accumulated bleibt.
-      return getOrCreateTransportForTenant(tenantId);
-    }, // @wrapper-known semantic-alias
-  };
-  r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
-});
+/** @deprecated Use createMailTransportInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
+export const mailTransportInMemoryFeature = createMailTransportInMemoryFeature();

package/packages/bundled-features/src/mail-transport-inmemory/index.ts

@@ -1,3 +1,8 @@
 // Public API of the mail-transport-inmemory bundled-feature.
 
-export { clearInbox, getInbox, mailTransportInMemoryFeature } from "./feature.js";
+export {
+  clearInbox,
+  createMailTransportInMemoryFeature,
+  getInbox,
+  mailTransportInMemoryFeature,
+} from "./feature.js";

package/packages/bundled-features/src/mail-transport-smtp/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "Tenant admins edit their own SMTP server on the Email sending screen",
+    "detail": "mail-foundation's provider key and the SMTP keys (host, port, SSL/TLS, user name, sender address) carry settings masks, so the generated Settings-Hub shows tenant admins one Email sending form: the provider choice, the chosen provider's connection fields and its password, each field with a help text and every label in English, German and Spanish, saved together by one Save button in one /api/batch. Switching the provider swaps the fields at once; fields of a provider that is not selected are not saved. A selector owner's selection screen (`<owner>-tenant-selection`) now carries the plugins' config keys (field id `<owner>-<key>`) and secrets (field id `<plugin>-<key>`, listed in the new ConfigEditScreenDefinition.secretKeys) behind a visible condition on the provider field; the separate `<plugin>-tenant` and `<plugin>-tenant-secrets` screens and their dashboard panels are gone, and so is the `config.settings.saveProvider` label. A secret with its own writeRoles stays on the global secrets screen. Boot validation checks every secretKeys field (tenant scope, writeOnly text, declared secret). The configEdit renderer loads secretKeys fields from secrets:query:list (set or unset, no preview), writes them with secrets:write:set or secrets:write:delete in the same batch, and leaves hidden fields out. The provider key is no longer required: empty means the tenant has no own server and the platform sends, so readiness no longer reports it as missing (createTransportForTenant still throws on an empty provider). The provider and SMTP keys are written by TenantAdmin and the system identity, no longer by SystemAdmin, because a platform-level provider would reach every tenant without that tenant's password. The secrets set and delete handlers also admit the system identity, so server code stores a tenant secret via dispatchSystemWrite through the same key and value checks as an admin; the settings screens keep showing only the human roles. The provider choice shows each plugin's `<feature>.settings` name, also for a plugin without settings of its own, and keeps the English name when a locale feature mounted earlier declares the same key in its own language only. A MailTransportPlugin with `selectableInSettings: false` stays allowed on the server but is not offered in the form; the in-memory transport sets it, because apps mount it next to smtp in production and a tenant admin picking it would drop every mail. A plugin's secrets section takes an optional `<feature>.settings.secrets` title (SMTP password under \"SMTP sign-in\").",
+    "migration": "E2E specs that used the testIds `dashboard-panel-<plugin>-tenant`, `dashboard-panel-<plugin>-tenant-secrets` or the separate secret input of these screens address the fields of `<owner>-tenant-selection` instead (one Save). Code that wrote these keys as a SystemAdmin user writes them as the tenant's TenantAdmin or via dispatchSystemWrite. Apps that relied on readiness flagging an empty provider check it themselves."
+  },
   {
     "version": "0.326.1",
     "type": "fix",

package/packages/bundled-features/src/mail-transport-smtp/config-keys.ts

@@ -0,0 +1,67 @@
+import { access, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+
+// No SystemAdmin write: the password is a tenant secret, so platform-level SMTP keys
+// could never form a working transport (see mail-foundation's provider key).
+const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
+const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
+
+// required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+export const SMTP_CONFIG_KEYS = {
+  host: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.host",
+      description: "mail-transport-smtp.host.description",
+      icon: "server",
+      order: 1,
+    },
+  }),
+  port: createTenantConfig("number", {
+    default: 587,
+    bounds: { min: 1, max: 65535 },
+    write: tenantAdminWrite,
+    mask: {
+      title: "mail-transport-smtp.port",
+      description: "mail-transport-smtp.port.description",
+      icon: "hash",
+      order: 2,
+    },
+  }),
+  secure: createTenantConfig("boolean", {
+    default: false,
+    write: tenantAdminWrite,
+    mask: {
+      title: "mail-transport-smtp.secure",
+      description: "mail-transport-smtp.secure.description",
+      icon: "lock",
+      order: 3,
+    },
+  }),
+  authUser: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.authUser",
+      description: "mail-transport-smtp.authUser.description",
+      icon: "user",
+      order: 4,
+    },
+  }),
+  from: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.from",
+      description: "mail-transport-smtp.from.description",
+      icon: "mail",
+      order: 5,
+    },
+  }),
+};