@cosmicdrift/kumiko-samples 0.368.0 → 0.370.0

package/packages/bundled-features/src/legal-pages/index.ts

@@ -3,14 +3,23 @@ export {
   LEGAL_PAGES_FEATURE,
   LEGAL_REQUIRED_BLOCKS,
   LEGAL_ROUTES,
+  LEGAL_TERMS_ROUTES,
   type LegalPageRoute,
   LegalPagesErrors,
   type LegalRequiredBlock,
-} from "./constants.js";
+  legalPagePath,
+} from "./constants.ts";
 export {
   createLegalPagesFeature,
   type LegalPagesBootCheckCtx,
   type LegalPagesOptions,
   runLegalPagesBootCheck,
-} from "./feature.js";
-export { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
+} from "./feature.ts";
+export { createLegalPagesLayout, type LegalPagesLayoutOptions } from "./layout.ts";
+export { renderMarkdownToHtml, wrapInLayout } from "./markdown.ts";
+export {
+  type LegalContentBlock,
+  type LegalContentSeedFn,
+  type LegalContentSeedSource,
+  legalContentSeed,
+} from "./seed.ts";

package/packages/bundled-features/src/legal-pages/layout.ts

@@ -0,0 +1,45 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { type PublicPageWrapLayout, TENANT_CONTENT_ATTR } from "../page-render/index.ts";
+
+export type LegalPagesLayoutOptions = {
+  // Appended to the page title as "<title> · <siteName>".
+  readonly siteName: string;
+  // Trusted app CSS, inlined into one <style> block.
+  readonly css?: string;
+  readonly stylesheetHrefs?: readonly string[];
+  // Trusted app chrome per language; the feature passes the route's `lang`.
+  readonly headerHtml?: (lang: string) => string;
+  readonly footerHtml?: (lang: string) => string;
+  readonly contentClass?: string;
+};
+
+export function createLegalPagesLayout(options: LegalPagesLayoutOptions): PublicPageWrapLayout {
+  const stylesheets = (options.stylesheetHrefs ?? [])
+    .map((href) => `\n<link rel="stylesheet" href="${escapeHtmlAttr(href)}">`)
+    .join("");
+  // html-ok: css comes from app code (LegalPagesLayoutOptions), never from tenant or user input.
+  const style = options.css ? `\n<style>${options.css}</style>` : "";
+  const contentClass = options.contentClass
+    ? ` class="${escapeHtmlAttr(options.contentClass)}"`
+    : "";
+  return ({ title, bodyHtml, lang }) => {
+    const headerHtml = options.headerHtml?.(lang) ?? "";
+    const footerHtml = options.footerHtml?.(lang) ?? "";
+    return `<!doctype html>
+<html lang="${escapeHtmlAttr(lang)}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)} · ${escapeHtml(options.siteName)}</title>
+<meta name="robots" content="index,follow">${stylesheets}${style}
+</head>
+<body>
+${headerHtml}
+<main ${TENANT_CONTENT_ATTR}${contentClass}>
+${bodyHtml}
+</main>
+${footerHtml}
+</body>
+</html>`;
+  };
+}

package/packages/bundled-features/src/legal-pages/lib/boot-check.ts

@@ -4,7 +4,7 @@ import {
   type TemplateResolverApi,
 } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../constants.js";
+import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../constants.ts";
 
 // Only the fields the check reads, so HandlerContext, AppContext or a hand-built
 // object in a unit test all fit.

package/packages/bundled-features/src/legal-pages/lib/validate-routes.ts

@@ -1,4 +1,4 @@
-import type { LegalPageRoute } from "../constants.js";
+import type { LegalPageRoute } from "../constants.ts";
 
 // Validated once at feature-build time (not per-request) so a config typo
 // fails app startup instead of surfacing as a confusing 404 later.

package/packages/bundled-features/src/legal-pages/markdown.ts

@@ -3,5 +3,5 @@
 // für legal-pages' Public-API (index.ts exportiert renderMarkdownToHtml +
 // wrapInLayout).
 
-export { wrapInLayout } from "../page-render/layout.js";
-export { renderSafeMarkdown as renderMarkdownToHtml } from "../page-render/markdown.js";
+export { wrapInLayout } from "../page-render/layout.ts";
+export { renderSafeMarkdown as renderMarkdownToHtml } from "../page-render/markdown.ts";

package/packages/bundled-features/src/legal-pages/seed.ts

@@ -0,0 +1,53 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  type LegalContentBlock,
+  seedLegalContentFromJson,
+} from "@cosmicdrift/kumiko-bundled-features/template-resolver/seeding";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import * as z from "zod";
+
+export type { LegalContentBlock };
+
+// `path` is resolved against the process cwd (the app root for `bun bin/main.ts`),
+// not against this module, so apps can keep their generated JSON where it is.
+export type LegalContentSeedSource =
+  | { readonly blocks: readonly LegalContentBlock[] }
+  | { readonly path: string };
+
+export type LegalContentSeedFn = (deps: { readonly db: DbConnection }) => Promise<void>;
+
+const legalContentBlocksSchema = z.array(
+  z.object({
+    slug: z.string().min(1),
+    locale: z.string().min(1),
+    title: z.string(),
+    content: z.string(),
+  }),
+);
+
+const jsonModuleSchema = z.object({ default: z.unknown() });
+
+async function loadBlocksFromJson(path: string): Promise<readonly LegalContentBlock[]> {
+  const url = pathToFileURL(resolve(process.cwd(), path)).href;
+  const module = jsonModuleSchema.parse(await import(url, { with: { type: "json" } }));
+  const parsed = legalContentBlocksSchema.safeParse(module.default);
+  if (!parsed.success) {
+    throw new Error(
+      `legal-pages: ${path} is not a list of { slug, locale, title, content } blocks: ${parsed.error.message}`,
+    );
+  }
+  return parsed.data;
+}
+
+// Boot seed for runProdApp's `seeds: [...]`. The JSON template is authoritative
+// (ifExists "update"), so legally required text changes reach rows seeded once.
+export function legalContentSeed(source: LegalContentSeedSource): LegalContentSeedFn {
+  return async ({ db }) => {
+    const blocks =
+      "blocks" in source
+        ? legalContentBlocksSchema.parse(source.blocks)
+        : await loadBlocksFromJson(source.path);
+    await seedLegalContentFromJson(db, blocks);
+  };
+}

package/packages/bundled-features/src/legal-pages/web/client-plugin.ts

@@ -18,7 +18,7 @@
 
 import type { TreeChildrenSubscribe, TreeNode } from "@cosmicdrift/kumiko-framework/engine";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { LEGAL_OPTIONAL_BLOCKS, LEGAL_REQUIRED_BLOCKS } from "../constants.js";
+import { LEGAL_OPTIONAL_BLOCKS, LEGAL_REQUIRED_BLOCKS } from "../constants.ts";
 
 const treeProvider: TreeChildrenSubscribe = () => (emit) => {
   // V.1.5d Slug-first Verschachtelung (Variante C):

package/packages/bundled-features/src/legal-pages/web/index.ts

@@ -1,4 +1,4 @@
 // @runtime client
 // Public exports für die Browser-Seite des legal-pages Features.
 
-export { legalPagesClient } from "./client-plugin.js";
+export { legalPagesClient } from "./client-plugin.ts";

package/packages/bundled-features/src/mail-foundation/changes.json

@@ -1 +1,10 @@
-[]
+[
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated mailFoundationFeature constant is removed",
+    "detail": "mailFoundationFeature was kept next to createMailFoundationFeature() for one release. Mount the feature by calling createMailFoundationFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces mailFoundationFeature with createMailFoundationFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  }
+]

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -45,6 +45,7 @@ import {
   type Registry,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { MAIL_FOUNDATION_I18N } from "./i18n.ts";
 
 const FEATURE_NAME = "mail-foundation";
 
@@ -102,6 +103,10 @@ export type MailTransportContext = {
  */
 export type MailTransportPlugin = {
   readonly build: (ctx: MailTransportContext, tenantId: string) => Promise<EmailTransport>;
+  /** `false` keeps the provider out of the generated settings: it can still be set by a
+   *  seed or config write, but a tenant admin is never offered it (e.g. a test inbox
+   *  that swallows every mail). */
+  readonly selectableInSettings?: false;
 };
 
 // extension-usage `options` is engine-payload (unknown) — structurally validate
@@ -125,7 +130,7 @@ export function createMailFoundationFeature() {
     FEATURE_NAME,
     (r) => {
       r.describe(
-        "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature` so a tenant with a provider configured sends delivery mails through its own transport and other tenants through the app transport.",
+        "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature`: notifications declared with `tenantTransport: true` then go through the tenant's own transport when it has a provider and through the app transport otherwise. Tenant admins pick the provider and fill in its settings on the generated Email sending settings screen; an empty provider is a valid choice and means the platform sends.",
       );
       r.uiHints({
         displayLabel: "Mail Transport Foundation",
@@ -145,28 +150,32 @@ export function createMailFoundationFeature() {
         },
       });
 
-      // Provider-selector. Default empty so the boot-validator throws if a
-      // tenant tries to send mail without first picking + setting up a
-      // provider — better than a silent fallback. The actual list of valid
-      // values lives in the registered plugins, not here — Designer-UI can
-      // render `getExtensionUsages("mailTransport").map(u => u.entityName)`
-      // as the option-list.
+      // Empty = this tenant has no own provider: tenantMailTransport yields null and
+      // channel-email uses the app transport, so empty is a valid choice a tenant can
+      // return to (reset in the settings mask) and readiness must not flag it.
+      // createTransportForTenant still throws on empty.
       const providerConfigKey = r.config(
         "provider",
         createTenantConfig("text", {
           default: "",
-          // required: without a chosen provider createTransportForTenant throws —
-          // readiness used to report ready:true and the first mail send
-          // surfaced the UnconfiguredError (280/1).
-          required: true,
-          write: access.roles("TenantAdmin", "SystemAdmin"),
+          // No SystemAdmin: a platform-level provider would be inherited by every tenant,
+          // whose own credentials (tenant secrets) are missing, and break all their mail.
+          write: access.withSystem(access.roles("TenantAdmin")),
           read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+          mask: {
+            title: "mail-foundation.provider",
+            description: "mail-foundation.provider.description",
+            icon: "mail",
+            order: 1,
+          },
         }),
       );
       // Readiness gating: transport-plugins' required keys/secrets count only
       // while their plugin is the one this key selects.
       r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
 
+      r.translations({ keys: MAIL_FOUNDATION_I18N });
+
       return {
         /** Config-key-handle for the provider-selector. */
         providerConfigKey,
@@ -179,9 +188,6 @@ export function createMailFoundationFeature() {
 // The typed handles below come from one shared instance; each factory call builds its own handle objects.
 const sharedMailFoundationFeature = createMailFoundationFeature();
 
-/** @deprecated Use createMailFoundationFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const mailFoundationFeature = sharedMailFoundationFeature;
-
 // =============================================================================
 // Transport-factory — looks up the registered plugin + delegates
 // =============================================================================

package/packages/bundled-features/src/mail-foundation/i18n.ts

@@ -0,0 +1,8 @@
+export const MAIL_FOUNDATION_I18N = {
+  "screen:mail-foundation-tenant.title": { en: "Email sending" },
+  "mail-foundation.settings": { en: "Email sending" },
+  "mail-foundation.provider": { en: "Own mail server" },
+  "mail-foundation.provider.description": {
+    en: "Without one, the platform sends the mails. Reset the choice to go back to that.",
+  },
+} as const;

package/packages/bundled-features/src/mail-foundation/index.ts

@@ -15,7 +15,6 @@ export {
   MAIL_TRANSPORT_EXTENSION,
   type MailTransportContext,
   type MailTransportPlugin,
-  mailFoundationFeature,
   type TenantMailTransportScope,
   tenantMailTransport,
-} from "./feature.js";
+} from "./feature.ts";

package/packages/bundled-features/src/mail-transport-inmemory/changes.json

@@ -1 +1,10 @@
-[]
+[
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated mailTransportInMemoryFeature constant is removed",
+    "detail": "mailTransportInMemoryFeature was kept next to createMailTransportInMemoryFeature() for one release. Mount the feature by calling createMailTransportInMemoryFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces mailTransportInMemoryFeature with createMailTransportInMemoryFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  }
+]

package/packages/bundled-features/src/mail-transport-inmemory/feature.ts

@@ -89,6 +89,9 @@ export function createMailTransportInMemoryFeature() {
       r.requires({ features: ["mail-foundation"] });
 
       const plugin: MailTransportPlugin = {
+        // Solon and studio mount it next to smtp in production; offering it there would
+        // let a tenant admin route every mail into process memory.
+        selectableInSettings: false,
         build: async (_ctx: MailTransportContext, tenantId: string): Promise<EmailTransport> => {
           // Returns the per-tenant buffer. Identity-stable across calls so the
           // demo inbox keeps accumulating.
@@ -96,10 +99,10 @@ export function createMailTransportInMemoryFeature() {
         }, // @wrapper-known semantic-alias
       };
       r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
+      r.translations({
+        keys: { "mail-transport-inmemory.settings": { en: "Test inbox (in memory)" } },
+      });
     },
     { dedupeOptions: {} },
   );
 }
-
-/** @deprecated Use createMailTransportInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const mailTransportInMemoryFeature = createMailTransportInMemoryFeature();

package/packages/bundled-features/src/mail-transport-inmemory/index.ts

@@ -4,5 +4,4 @@ export {
   clearInbox,
   createMailTransportInMemoryFeature,
   getInbox,
-  mailTransportInMemoryFeature,
-} from "./feature.js";
+} from "./feature.ts";

package/packages/bundled-features/src/mail-transport-smtp/changes.json

@@ -1,4 +1,19 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated mailTransportSmtpFeature constant is removed",
+    "detail": "mailTransportSmtpFeature was kept next to createMailTransportSmtpFeature() for one release. Mount the feature by calling createMailTransportSmtpFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces mailTransportSmtpFeature with createMailTransportSmtpFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  },
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "Tenant admins edit their own SMTP server on the Email sending screen",
+    "detail": "mail-foundation's provider key and the SMTP keys (host, port, SSL/TLS, user name, sender address) carry settings masks, so the generated Settings-Hub shows tenant admins one Email sending form: the provider choice, the chosen provider's connection fields and its password, each field with a help text and every label in English, German and Spanish, saved together by one Save button in one /api/batch. Switching the provider swaps the fields at once; fields of a provider that is not selected are not saved. A selector owner's selection screen (`<owner>-tenant-selection`) now carries the plugins' config keys (field id `<owner>-<key>`) and secrets (field id `<plugin>-<key>`, listed in the new ConfigEditScreenDefinition.secretKeys) behind a visible condition on the provider field; the separate `<plugin>-tenant` and `<plugin>-tenant-secrets` screens and their dashboard panels are gone, and so is the `config.settings.saveProvider` label. A secret with its own writeRoles stays on the global secrets screen. Boot validation checks every secretKeys field (tenant scope, writeOnly text, declared secret). The configEdit renderer loads secretKeys fields from secrets:query:list (set or unset, no preview), writes them with secrets:write:set or secrets:write:delete in the same batch, and leaves hidden fields out. The provider key is no longer required: empty means the tenant has no own server and the platform sends, so readiness no longer reports it as missing (createTransportForTenant still throws on an empty provider). The provider and SMTP keys are written by TenantAdmin and the system identity, no longer by SystemAdmin, because a platform-level provider would reach every tenant without that tenant's password. The secrets set and delete handlers also admit the system identity, so server code stores a tenant secret via dispatchSystemWrite through the same key and value checks as an admin; the settings screens keep showing only the human roles. The provider choice shows each plugin's `<feature>.settings` name, also for a plugin without settings of its own, and keeps the English name when a locale feature mounted earlier declares the same key in its own language only. A MailTransportPlugin with `selectableInSettings: false` stays allowed on the server but is not offered in the form; the in-memory transport sets it, because apps mount it next to smtp in production and a tenant admin picking it would drop every mail. A plugin's secrets section takes an optional `<feature>.settings.secrets` title (SMTP password under \"SMTP sign-in\").",
+    "migration": "E2E specs that used the testIds `dashboard-panel-<plugin>-tenant`, `dashboard-panel-<plugin>-tenant-secrets` or the separate secret input of these screens address the fields of `<owner>-tenant-selection` instead (one Save). Code that wrote these keys as a SystemAdmin user writes them as the tenant's TenantAdmin or via dispatchSystemWrite. Apps that relied on readiness flagging an empty provider check it themselves."
+  },
   {
     "version": "0.326.1",
     "type": "fix",

package/packages/bundled-features/src/mail-transport-smtp/config-keys.ts

@@ -0,0 +1,67 @@
+import { access, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+
+// No SystemAdmin write: the password is a tenant secret, so platform-level SMTP keys
+// could never form a working transport (see mail-foundation's provider key).
+const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
+const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
+
+// required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+export const SMTP_CONFIG_KEYS = {
+  host: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.host",
+      description: "mail-transport-smtp.host.description",
+      icon: "server",
+      order: 1,
+    },
+  }),
+  port: createTenantConfig("number", {
+    default: 587,
+    bounds: { min: 1, max: 65535 },
+    write: tenantAdminWrite,
+    mask: {
+      title: "mail-transport-smtp.port",
+      description: "mail-transport-smtp.port.description",
+      icon: "hash",
+      order: 2,
+    },
+  }),
+  secure: createTenantConfig("boolean", {
+    default: false,
+    write: tenantAdminWrite,
+    mask: {
+      title: "mail-transport-smtp.secure",
+      description: "mail-transport-smtp.secure.description",
+      icon: "lock",
+      order: 3,
+    },
+  }),
+  authUser: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.authUser",
+      description: "mail-transport-smtp.authUser.description",
+      icon: "user",
+      order: 4,
+    },
+  }),
+  from: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.from",
+      description: "mail-transport-smtp.from.description",
+      icon: "mail",
+      order: 5,
+    },
+  }),
+};

package/packages/bundled-features/src/mail-transport-smtp/feature.ts

@@ -47,9 +47,11 @@ import {
   type MailTransportPlugin,
 } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { SMTP_CONFIG_KEYS } from "./config-keys.ts";
+import { MAIL_TRANSPORT_SMTP_I18N } from "./i18n.ts";
 
 const FEATURE_NAME = "mail-transport-smtp";
 
@@ -107,38 +109,9 @@ export function createMailTransportSmtpFeature() {
         required: true,
       });
 
-      // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
-      const configKeys = r.config({
-        keys: {
-          host: createTenantConfig("text", {
-            required: true,
-            default: "",
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-            read: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-          port: createTenantConfig("number", {
-            default: 587,
-            bounds: { min: 1, max: 65535 },
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-          secure: createTenantConfig("boolean", {
-            default: false,
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-          from: createTenantConfig("text", {
-            required: true,
-            default: "",
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-            read: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-          authUser: createTenantConfig("text", {
-            required: true,
-            default: "",
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-            read: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-        },
-      });
+      const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
+
+      r.translations({ keys: MAIL_TRANSPORT_SMTP_I18N });
 
       // Plugin: register against mail-foundation's "mailTransport" extension.
       // `entityName` "smtp" is what tenants set in mail-foundation's
@@ -164,9 +137,6 @@ export function createMailTransportSmtpFeature() {
 // The typed handles below come from one shared instance; each factory call builds its own handle objects.
 const sharedMailTransportSmtpFeature = createMailTransportSmtpFeature();
 
-/** @deprecated Use createMailTransportSmtpFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const mailTransportSmtpFeature = sharedMailTransportSmtpFeature;
-
 /** Typed handle for the SMTP password — exported so seeds + tests can
  *  set it via `secrets:write:set` with the full qualified-name. */
 export const SMTP_PASSWORD = sharedMailTransportSmtpFeature.exports.password;

package/packages/bundled-features/src/mail-transport-smtp/i18n.ts

@@ -0,0 +1,28 @@
+export const MAIL_TRANSPORT_SMTP_I18N = {
+  // Also the option label of mail-foundation's provider select.
+  "mail-transport-smtp.settings": { en: "SMTP server" },
+  "mail-transport-smtp.settings.secrets": { en: "SMTP sign-in" },
+  "mail-transport-smtp.settings.description": {
+    en: "The connection details come from your mail provider, for example Brevo, Postmark, Amazon SES or your own server.",
+  },
+  "mail-transport-smtp.host": { en: "Server address" },
+  "mail-transport-smtp.host.description": {
+    en: "Host name of the SMTP server, for example smtp.example.com.",
+  },
+  "mail-transport-smtp.port": { en: "Port number" },
+  "mail-transport-smtp.port.description": {
+    en: "Usually 587. Use 465 when your provider asks for SSL/TLS.",
+  },
+  "mail-transport-smtp.secure": { en: "SSL/TLS from the start" },
+  "mail-transport-smtp.secure.description": {
+    en: "Turn on for port 465. Leave off for 587, which switches to encryption by itself.",
+  },
+  "mail-transport-smtp.authUser": { en: "User name" },
+  "mail-transport-smtp.authUser.description": {
+    en: "Login name at the SMTP server, often an email address.",
+  },
+  "mail-transport-smtp.from": { en: "Sender address" },
+  "mail-transport-smtp.from.description": {
+    en: "The address mails are sent from, for example status@example.com. Your provider must allow it.",
+  },
+} as const;

package/packages/bundled-features/src/mail-transport-smtp/index.ts

@@ -3,7 +3,6 @@
 export {
   createMailTransportSmtpFeature,
   mailTransportSmtpEnvSchema,
-  mailTransportSmtpFeature,
   SMTP_PASSWORD,
   setSmtpMailHostLookup,
-} from "./feature.js";
+} from "./feature.ts";

package/packages/bundled-features/src/managed-pages/branding.ts

@@ -4,7 +4,7 @@ import {
   type ConfigKeyDefinition,
   createTenantConfig,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { type BrandingTokens, EMPTY_BRANDING } from "../page-render/index.js";
+import { type BrandingTokens, EMPTY_BRANDING } from "../page-render/index.ts";
 
 // Per-tenant branding, lifted from the publicstatus-local branding-config
 // pattern into the framework so every app + studio-tenant gets tenant-editable

package/packages/bundled-features/src/managed-pages/css-gate.ts

@@ -1,5 +1,5 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { MANAGED_PAGES_CSS_FEATURE } from "./branding.js";
+import { MANAGED_PAGES_CSS_FEATURE } from "./branding.ts";
 
 // Per-tenant toggle gate for the managed-pages custom-CSS capability. Declares
 // no handlers/entities — composing it simply registers `managed-pages-css` as a

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -7,18 +7,18 @@ import {
   EMPTY_BRANDING,
   renderSafeMarkdown,
   wrapInLayout,
-} from "../page-render/index.js";
-import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.js";
-import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.js";
-import { createBrandingQuery } from "./handlers/branding.query.js";
-import { bySlugQuery } from "./handlers/by-slug.query.js";
-import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query.js";
-import { pageCrudQueries, pageCrudWrites } from "./handlers/page-crud.js";
-import { setWrite } from "./handlers/set.write.js";
-import { MANAGED_PAGES_I18N } from "./i18n.js";
-import { createBrandingSettingsScreen } from "./screens/branding-screen.js";
-import { pageEditScreen, pageListScreen } from "./screens/page-screens.js";
-import { pageEntity } from "./table.js";
+} from "../page-render/index.ts";
+import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.ts";
+import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.ts";
+import { createBrandingQuery } from "./handlers/branding.query.ts";
+import { bySlugQuery } from "./handlers/by-slug.query.ts";
+import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query.ts";
+import { pageCrudQueries, pageCrudWrites } from "./handlers/page-crud.ts";
+import { setWrite } from "./handlers/set.write.ts";
+import { MANAGED_PAGES_I18N } from "./i18n.ts";
+import { createBrandingSettingsScreen } from "./screens/branding-screen.ts";
+import { pageEditScreen, pageListScreen } from "./screens/page-screens.ts";
+import { pageEntity } from "./table.ts";
 
 // 60s-shared-cache saves the origin-revalidate roundtrip; CMS edits are live within 60s.
 const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;

package/packages/bundled-features/src/managed-pages/handlers/branding.query.ts

@@ -1,6 +1,6 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { MANAGED_PAGES_CSS_FEATURE, readBranding, readCustomCss } from "../branding.js";
+import { MANAGED_PAGES_CSS_FEATURE, readBranding, readCustomCss } from "../branding.ts";
 
 // Public branding read for the server-render path. Anonymous-capable: the
 // render route reaches this via internal app.fetch with X-Tenant = host-

package/packages/bundled-features/src/managed-pages/handlers/by-slug.query.ts

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { type PageRow, pagesTable } from "../table.js";
+import { type PageRow, pagesTable } from "../table.ts";
 
 // Public-Read by (tenantId, slug, lang). Anonymous-capable (Landing-/
 // Marketing-Pages). Tenant kommt aus query.user.tenantId — am Render-Pfad

package/packages/bundled-features/src/managed-pages/handlers/by-tenant-published.query.ts

@@ -1,7 +1,7 @@
 import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { type PageRow, pagesTable } from "../table.js";
+import { type PageRow, pagesTable } from "../table.ts";
 
 // Public-Read aller published Pages eines Tenants — Discovery-Quelle für
 // sitemap.xml/llms.txt (siehe seo-Feature). Anders als by-slug (single-row,

package/packages/bundled-features/src/managed-pages/handlers/page-crud.ts

@@ -5,7 +5,7 @@ import {
   defineEntityListHandler,
   defineEntityUpdateHandler,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { pageEntity } from "../table.js";
+import { pageEntity } from "../table.ts";
 
 // Admin authoring runs as TenantAdmin (self-service) or SystemAdmin (app-wide
 // pages). Mirrors set.write's ACL — an app with its own role alias

package/packages/bundled-features/src/managed-pages/handlers/set.write.ts

@@ -1,8 +1,8 @@
 import { createEventStoreExecutor, fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { requireForTenant } from "../../shared/index.js";
-import { type PageRow, pageEntity, pagesTable } from "../table.js";
+import { requireForTenant } from "../../shared/index.ts";
+import { type PageRow, pageEntity, pagesTable } from "../table.ts";
 
 const slugSchema = z
   .string()