@cosmicdrift/kumiko-samples 0.368.0 → 0.370.0

package/packages/bundled-features/src/waitlist/options.ts

@@ -1,5 +1,9 @@
 import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { PayloadRateLimitOption, RateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+import type {
+  PayloadRateLimitOption,
+  RateLimitDeclaration,
+  RateLimitOption,
+} from "@cosmicdrift/kumiko-types/handlers";
 
 export type WaitlistInviteOptions =
   | {
@@ -22,11 +26,19 @@ export type WaitlistOptions = {
   readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
   /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
   readonly invite?: WaitlistInviteOptions;
-  /** Default: 5 submits per IP per 10 minutes. */
-  readonly rateLimit?: RateLimitOption;
+  /** Default: 5 submits per IP per 10 minutes. Pass `{ disabled: true, reason }`
+   *  to turn the per-IP limit off (e.g. when a CDN already throttles the route). */
+  readonly rateLimit?: RateLimitDeclaration;
   /** Default: 3 submits per email address per day, across all IPs. Stops a botnet
    *  from flooding one address with confirmation mails. Pass `[]` to disable. */
   readonly emailRateLimits?: readonly PayloadRateLimitOption[];
+  /** Marks an invited entry `provisioned` and records the tenant when its email
+   *  becomes the first TenantAdmin member of a tenant (open signup after an
+   *  invite, or accepting an own-tenant invite). Default false. */
+  readonly linkOnSignup?: boolean;
+  /** Mounts the SystemAdmin-only `export` and `purge` handlers for handing over
+   *  and erasing the whole list. Default true; pass false to leave them out. */
+  readonly exportPurge?: boolean;
   /** Shown in the confirmation mail; omitted when unset. */
   readonly appName?: string;
 };

package/packages/bundled-features/src/waitlist/payloads.ts

@@ -1,6 +1,6 @@
 import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
-import { WAITLIST_FIELD_LIMITS } from "./constants.js";
+import { WAITLIST_FIELD_LIMITS } from "./constants.ts";
 
 // Submitted text lands in a mail subject; CR/LF there would allow header injection.
 const NO_CONTROL_CHARS = /^\P{Cc}*$/u;
@@ -53,3 +53,5 @@ export const WaitlistSubmitSchema = z
 export type WaitlistSubmitInput = z.infer<typeof WaitlistSubmitSchema>;
 
 export const WaitlistIdSchema = z.object({ id: z.uuid() }).strict();
+
+export const WaitlistAuditEventSchema = z.object({ count: z.number().int().nonnegative() });

package/packages/bundled-features/src/waitlist/screens.ts

@@ -1,6 +1,6 @@
 import { type EntityListScreenDefinition, i18nKey } from "@cosmicdrift/kumiko-framework/engine";
-import { WAITLIST_STATUS, WaitlistHandlers } from "./constants.js";
-import { adminAccess } from "./lib.js";
+import { WAITLIST_STATUS, WaitlistHandlers } from "./constants.ts";
+import { adminAccess } from "./lib.ts";
 
 export const waitlistListScreen: EntityListScreenDefinition = {
   id: "waitlist-list",

package/packages/bundled-features/src/waitlist/user-data-hooks.ts

@@ -4,9 +4,9 @@ import type {
   UserDataExportHook,
   UserDataHookCtx,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { collectErasureFailure, decryptStoredPii, throwIfErasureFailed } from "../shared/index.js";
-import { userTable } from "../user/index.js";
-import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.js";
+import { collectErasureFailure, decryptStoredPii, throwIfErasureFailed } from "../shared/index.ts";
+import { userTable } from "../user/index.ts";
+import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.ts";
 
 const PII_DECRYPT_REASON = "waitlist:user-data";
 const ERASE_REASON = "waitlist:user-data-forget";

package/packages/bundled-features/src/workflow-runner/changes.json

@@ -1,4 +1,12 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated workflowRunnerFeature constant is removed",
+    "detail": "workflowRunnerFeature was kept next to createWorkflowRunnerFeature() for one release. Mount the feature by calling createWorkflowRunnerFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces workflowRunnerFeature with createWorkflowRunnerFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/workflow-runner/db/queries/due-runs.ts

@@ -1,5 +1,5 @@
 import { sql, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { workflowRunPendingTable } from "../../tables.js";
+import { workflowRunPendingTable } from "../../tables.ts";
 
 export type DueRow = { readonly runId: string; readonly stepIndex: number };
 

package/packages/bundled-features/src/workflow-runner/event-subscriber.ts

@@ -34,8 +34,8 @@ import type {
 import { evaluateEventMatch } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import type { TriggerEventRef } from "./runner.js";
-import { workflowRunPendingTable } from "./tables.js";
+import type { TriggerEventRef } from "./runner.ts";
+import { workflowRunPendingTable } from "./tables.ts";
 
 type CandidateRow = {
   readonly runId: string;

package/packages/bundled-features/src/workflow-runner/event-trigger.ts

@@ -28,14 +28,14 @@ import {
   WorkflowStepError,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
-import { workflowRunAggregateId } from "./aggregate-id.js";
-import { registerEventWakeup } from "./event-subscriber.js";
+import { workflowRunAggregateId } from "./aggregate-id.ts";
+import { registerEventWakeup } from "./event-subscriber.ts";
 import {
   startAndRunWorkflow,
   type WorkflowRunFailedPayload,
   WorkflowSuspensionUnsupportedError,
-} from "./runner.js";
-import { registerWorkflow } from "./workflow-registry.js";
+} from "./runner.ts";
+import { registerWorkflow } from "./workflow-registry.ts";
 
 const log = createFallbackLogger("workflow-runner");
 

package/packages/bundled-features/src/workflow-runner/feature.ts

@@ -25,10 +25,10 @@
 // wait/retry/waitForEvent suspensions all resume automatically now.
 
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { selectDueWorkflowRunPending } from "./db/queries/due-runs.js";
-import { resumeRunHandler } from "./handlers/resume-run.write.js";
-import { registerWorkflowRunPendingProjection } from "./pending-projection.js";
-import { workflowRunPendingTableMeta } from "./tables.js";
+import { selectDueWorkflowRunPending } from "./db/queries/due-runs.ts";
+import { resumeRunHandler } from "./handlers/resume-run.write.ts";
+import { registerWorkflowRunPendingProjection } from "./pending-projection.ts";
+import { workflowRunPendingTableMeta } from "./tables.ts";
 
 // Kebab-case matching the "./workflow-runner" export subpath — every other
 // bundled feature's runtime name follows this convention, and
@@ -95,6 +95,3 @@ export function createWorkflowRunnerFeature() {
     { dedupeOptions: {} },
   );
 }
-
-/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const workflowRunnerFeature = createWorkflowRunnerFeature();

package/packages/bundled-features/src/workflow-runner/handlers/resume-run.write.ts

@@ -62,9 +62,9 @@ import {
   type WorkflowRunCompletedPayload,
   type WorkflowRunFailedPayload,
   WorkflowSuspensionUnsupportedError,
-} from "../runner.js";
-import { workflowRunPendingTable } from "../tables.js";
-import { getWorkflow } from "../workflow-registry.js";
+} from "../runner.ts";
+import { workflowRunPendingTable } from "../tables.ts";
+import { getWorkflow } from "../workflow-registry.ts";
 
 const log = createFallbackLogger("workflow-runner");
 

package/packages/bundled-features/src/workflow-runner/index.ts

@@ -1,12 +1,12 @@
 // Public API of the workflow-runner bundled-feature.
 
-export { workflowRunAggregateId } from "./aggregate-id.js";
-export { registerEventTrigger } from "./event-trigger.js";
-export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
+export { workflowRunAggregateId } from "./aggregate-id.ts";
+export { registerEventTrigger } from "./event-trigger.ts";
+export { createWorkflowRunnerFeature } from "./feature.ts";
 export {
   startAndRunWorkflow,
   type WorkflowRunCompletedPayload,
   type WorkflowRunFailedPayload,
   type WorkflowRunStartedPayload,
   WorkflowSuspensionUnsupportedError,
-} from "./runner.js";
+} from "./runner.ts";

package/packages/bundled-features/src/workflow-runner/pending-projection.ts

@@ -26,7 +26,7 @@ import {
   WORKFLOW_WAITING_FOR_EVENT_TYPE,
   WORKFLOW_WAITING_TYPE,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { workflowRunPendingTable } from "./tables.js";
+import { workflowRunPendingTable } from "./tables.ts";
 
 type WaitPayload = {
   readonly wakeAt: string;

package/samples/apps/ui-walkthrough/package.json

@@ -21,7 +21,8 @@
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
     "zod": "^4.4.3",
-    "@cosmicdrift/kumiko-locale-de": "workspace:*"
+    "@cosmicdrift/kumiko-locale-de": "workspace:*",
+    "@cosmicdrift/kumiko-locale-es": "workspace:*"
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-testing": "workspace:*"

package/samples/apps/ui-walkthrough/src/app/auth-constants.ts

@@ -27,3 +27,7 @@ export const TENANT_ADMIN_EMAIL = "a.berger@nordlicht-immobilien.de";
 export const TENANT_ADMIN_PASSWORD = "nordlicht-berger";
 export const PLATFORM_ADMIN_EMAIL = "plattform@kumiko.dev";
 export const PLATFORM_ADMIN_PASSWORD = "kumiko-plattform";
+
+// Signs the unsubscribe links of the sample's mails; the e2e signs its own links with it.
+// A real app reads it from its secret store.
+export const UNSUBSCRIBE_SECRET = "ui-walkthrough-unsubscribe-secret-sample-only";

package/samples/apps/ui-walkthrough/src/app/server.ts

@@ -9,11 +9,18 @@
 // kein Auto-Mint-JWT mehr. Persistent-DB-Modus über KUMIKO_DEV_DB_NAME
 // in der Umgebung.
 
+import { createUnsubscribeRoutes } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { runDevApp } from "@cosmicdrift/kumiko-dev-server";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createInMemoryFileProvider } from "@cosmicdrift/kumiko-framework/files";
 import { APP_FEATURES } from "../run-config";
-import { ADMIN_EMAIL, ADMIN_PASSWORD, BETA_TENANT_ID, DEV_TENANT_ID } from "./auth-constants";
+import {
+  ADMIN_EMAIL,
+  ADMIN_PASSWORD,
+  BETA_TENANT_ID,
+  DEV_TENANT_ID,
+  UNSUBSCRIBE_SECRET,
+} from "./auth-constants";
 import { seedTasks } from "./seed";
 import { seedRental } from "./seed-rental";
 import { seedTemplates } from "./seed-templates";
@@ -33,6 +40,8 @@ await runDevApp({
   port: Number.parseInt(process.env["PORT"] ?? "4173", 10),
   // Logo and attachment uploads of the mail editor need a file store.
   files: { storageProvider: createInMemoryFileProvider() },
+  // The pages behind a mail's unsubscribe link, dressed in the tenant's mail look.
+  extraRoutes: createUnsubscribeRoutes({ secret: UNSUBSCRIBE_SECRET }),
   clientEntry: "./src/app/client.tsx",
   htmlPath: "./public/index.html",
   watchDirs: ["./src", "../../../packages/*/src"],

package/samples/apps/ui-walkthrough/src/app/template-seed-data.ts

@@ -206,7 +206,7 @@ function invoiceIssuedBody(args: {
     `<h2>Ihre Rechnung ${v("invoiceNumber")}</h2>`,
     `<p>Guten Tag ${v("recipientName")},</p>`,
     `<p>${args.intro} ${v("invoiceNumber")} über ${v("invoiceTotal")}.${due} Die Rechnung finden Sie als PDF im Anhang und jederzeit online.</p>`,
-    '<a data-button href="{{invoiceUrl}}">Rechnung online ansehen</a>',
+    `<a data-button href="{{invoiceUrl}}">Rechnung ${v("invoiceNumber")} online ansehen</a>`,
     LINES_TABLE,
     "<hr>",
     "<p>Bei Fragen zur Rechnung antworten Sie einfach auf diese E-Mail.</p>",

package/samples/apps/ui-walkthrough/src/features/billing/feature.ts

@@ -2,45 +2,46 @@ import { defineFeature, templateVariable } from "@cosmicdrift/kumiko-framework/e
 import { toKeyFirst } from "../translations";
 import { billingTranslations } from "./i18n";
 
+// Variable labels are i18n keys, so the designer's rail and chips speak the editor's language.
 // Both mails are sent by the host app's billing run, not by an event trigger in
 // this sample; they exist so the template overview has real senders to show.
 const INVOICE_ISSUED_VARIABLES = {
   recipientName: templateVariable.text({
-    label: "Empfängername",
+    label: "billing:mail.variable.recipientName",
     required: true,
     example: "Familie Yilmaz",
   }),
   recipientEmail: templateVariable.text({
-    label: "Empfänger-Adresse",
+    label: "billing:mail.variable.recipientEmail",
     example: "yilmaz.familie@example.org",
   }),
   invoiceNumber: templateVariable.text({
-    label: "Rechnungsnummer",
+    label: "billing:mail.variable.invoiceNumber",
     required: true,
     example: "RE-2026-0142",
   }),
   invoiceTotal: templateVariable.money({
-    label: "Rechnungsbetrag",
+    label: "billing:mail.variable.invoiceTotal",
     required: true,
     example: { amount: 128450, currency: "EUR" },
   }),
   dueDate: templateVariable.date({
-    label: "Fälligkeitsdatum",
+    label: "billing:mail.variable.dueDate",
     required: true,
     example: "2026-10-30",
   }),
   invoiceUrl: templateVariable.link({
-    label: "Link zur Rechnung",
+    label: "billing:mail.variable.invoiceUrl",
     required: true,
     example: "https://nordlicht-immobilien.de/rechnungen/RE-2026-0142",
   }),
   lines: templateVariable.list(
     {
-      description: templateVariable.text({ label: "Bezeichnung" }),
-      amount: templateVariable.money({ label: "Betrag" }),
+      description: templateVariable.text({ label: "billing:mail.variable.lines.description" }),
+      amount: templateVariable.money({ label: "billing:mail.variable.lines.amount" }),
     },
     {
-      label: "Rechnungspositionen",
+      label: "billing:mail.variable.lines",
       required: true,
       example: [
         { description: "Kaltmiete Oktober 2026, Lindenstraße 14 WE 3", amount: 98000 },
@@ -50,7 +51,7 @@ const INVOICE_ISSUED_VARIABLES = {
     },
   ),
   paymentReference: templateVariable.text({
-    label: "Zahlungsreferenz",
+    label: "billing:mail.variable.paymentReference",
     example: "RE-2026-0142 / Yilmaz",
   }),
 } as const;

package/samples/apps/ui-walkthrough/src/features/billing/i18n.ts

@@ -1,7 +1,8 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
 // The keys follow the document-designer's "used by" lookup:
-// `<feature>:feature.label` and `<feature>:notify.<notification>.label`.
+// `<feature>:feature.label` and `<feature>:notify.<notification>.label`. Variable labels
+// are plain keys the notification's variables name in their `label`.
 export const billingTranslations: TranslationsByLocale = {
   de: {
     "billing:feature.label": "Rechnungen",
@@ -9,6 +10,16 @@ export const billingTranslations: TranslationsByLocale = {
     "billing:notify.invoice-corrected.label": "Rechnung korrigiert",
     "billing:notify.payment-reminder.label": "Mahnlauf",
     "billing:notify.terms-changed.label": "AGB-Änderung",
+    "billing:mail.variable.recipientName": "Empfängername",
+    "billing:mail.variable.recipientEmail": "Empfänger-Adresse",
+    "billing:mail.variable.invoiceNumber": "Rechnungsnummer",
+    "billing:mail.variable.invoiceTotal": "Rechnungsbetrag",
+    "billing:mail.variable.dueDate": "Fälligkeitsdatum",
+    "billing:mail.variable.invoiceUrl": "Link zur Rechnung",
+    "billing:mail.variable.lines.description": "Bezeichnung",
+    "billing:mail.variable.lines.amount": "Betrag",
+    "billing:mail.variable.lines": "Rechnungspositionen",
+    "billing:mail.variable.paymentReference": "Zahlungsreferenz",
   },
   en: {
     "billing:feature.label": "Invoices",
@@ -16,5 +27,15 @@ export const billingTranslations: TranslationsByLocale = {
     "billing:notify.invoice-corrected.label": "Invoice corrected",
     "billing:notify.payment-reminder.label": "Dunning run",
     "billing:notify.terms-changed.label": "Terms update",
+    "billing:mail.variable.recipientName": "Recipient name",
+    "billing:mail.variable.recipientEmail": "Recipient address",
+    "billing:mail.variable.invoiceNumber": "Invoice number",
+    "billing:mail.variable.invoiceTotal": "Invoice total",
+    "billing:mail.variable.dueDate": "Due date",
+    "billing:mail.variable.invoiceUrl": "Invoice link",
+    "billing:mail.variable.lines.description": "Description",
+    "billing:mail.variable.lines.amount": "Amount",
+    "billing:mail.variable.lines": "Invoice lines",
+    "billing:mail.variable.paymentReference": "Payment reference",
   },
 };

package/samples/apps/ui-walkthrough/src/run-config.ts

@@ -14,6 +14,7 @@ import { createRendererFoundationFeature } from "@cosmicdrift/kumiko-bundled-fea
 import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { createDocumentDesignerFeature } from "@cosmicdrift/kumiko-document-designer";
 import { localeDe } from "@cosmicdrift/kumiko-locale-de";
+import { localeEs } from "@cosmicdrift/kumiko-locale-es";
 import { createRendererMailHtmlFeature } from "@cosmicdrift/kumiko-renderer-mail-html";
 import { createRendererPuppeteerClientFeature } from "@cosmicdrift/kumiko-renderer-puppeteer-client";
 import { TENANT_ADMIN_EMAIL } from "./app/auth-constants";
@@ -24,6 +25,8 @@ import { vehiclesFeature } from "./features/vehicles";
 
 export const APP_FEATURES = [
   localeDe(),
+  // Spanish mail copy: subscribers whose mails go out in Spanish land on Spanish unsubscribe pages.
+  localeEs(),
   taskFeature,
   rentalFeature,
   vehiclesFeature,
@@ -43,11 +46,17 @@ export const APP_FEATURES = [
             imprint: { label: "Impressum", url: "https://nordlicht-immobilien.de/impressum" },
             privacy: { label: "Datenschutz", url: "https://nordlicht-immobilien.de/datenschutz" },
           }
-        : {
-            text: "Sent via the Nordlicht tenant portal",
-            imprint: { label: "Imprint", url: "https://nordlicht-immobilien.de/imprint" },
-            privacy: { label: "Privacy", url: "https://nordlicht-immobilien.de/privacy" },
-          },
+        : locale.startsWith("es")
+          ? {
+              text: "Enviado a través del portal de inquilinos Nordlicht",
+              imprint: { label: "Aviso legal", url: "https://nordlicht-immobilien.de/imprint" },
+              privacy: { label: "Privacidad", url: "https://nordlicht-immobilien.de/privacy" },
+            }
+          : {
+              text: "Sent via the Nordlicht tenant portal",
+              imprint: { label: "Imprint", url: "https://nordlicht-immobilien.de/imprint" },
+              privacy: { label: "Privacy", url: "https://nordlicht-immobilien.de/privacy" },
+            },
   }),
   // The PDF preview of the template editor prints through the puppeteer-service
   // (PUPPETEER_SERVICE_URL / PUPPETEER_AUTH_TOKEN); the e2e config starts one.

package/samples/apps/ui-walkthrough/tsconfig.json

@@ -8,6 +8,7 @@
     "target": "ESNext",
     "module": "ESNext",
     "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
     "lib": ["ESNext", "DOM", "DOM.Iterable"],

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -1,7 +1,24 @@
 {
   "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled + signup)",
-  "featureCount": 84,
+  "featureCount": 86,
   "features": [
+    {
+      "name": "account-security",
+      "description": "Self-service account dashboard: MFA enrollment, recovery codes and the user's own sessions, composed from the auth-mfa and sessions screens.",
+      "toggleableDefault": null,
+      "requires": [
+        "sessions",
+        "auth-mfa"
+      ],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": []
+    },
     {
       "name": "admin-shell",
       "description": "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
@@ -407,7 +424,7 @@
     },
     {
       "name": "channel-email",
-      "description": "Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send each tenant's mail through its own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.",
+      "description": "Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send the notifications declared with `tenantTransport: true` through the sending tenant's own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`; every other notification (password reset, sign-in) always goes through the app `transport`. `transport` may be left out when `tenantTransport` is set; a mail that then has no transport fails with `missing_credentials`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.",
       "toggleableDefault": null,
       "requires": [
         "delivery"
@@ -725,7 +742,7 @@
     },
     {
       "name": "delivery",
-      "description": "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting — add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (`runProdApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
+      "description": "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting — add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (the `runProdApp` and `runDevApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. An app serving its own (e.g. legacy) unsubscribe links renders the same result page with `renderUnsubscribeResultPage({ kind, locale })`. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
       "toggleableDefault": null,
       "requires": [
         "tenant"
@@ -1329,6 +1346,28 @@
       "secrets": [],
       "writeHandlers": []
     },
+    {
+      "name": "host-routing",
+      "description": "Host- and path-based tenant routing: an authoritative tenant resolver from the subdomain (tenantBy host), a tenant existence check against enabled, active tenants, and the tenant-key query behind createHostDispatch, which picks the HTML file, CSP, locale redirect or 404 per host for runProdApp's hostDispatch.",
+      "toggleableDefault": null,
+      "requires": [
+        "auth-foundation",
+        "tenant"
+      ],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [
+        {
+          "extensionName": "tenantExistence",
+          "entityName": "active-tenant"
+        }
+      ],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": []
+    },
     {
       "name": "inbound-mail-foundation",
       "description": "Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push). The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.",
@@ -1507,7 +1546,7 @@
     },
     {
       "name": "mail-foundation",
-      "description": "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending — use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature` so a tenant with a provider configured sends delivery mails through its own transport and other tenants through the app transport.",
+      "description": "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending — use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature`: notifications declared with `tenantTransport: true` then go through the tenant's own transport when it has a provider and through the app transport otherwise. Tenant admins pick the provider and fill in its settings on the generated Email sending settings screen; an empty provider is a valid choice and means the platform sends.",
       "toggleableDefault": null,
       "requires": [
         "config"
@@ -1531,8 +1570,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "TenantAdmin",
@@ -1603,8 +1642,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "TenantAdmin",
@@ -1624,8 +1663,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "TenantAdmin",
@@ -1645,8 +1684,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "TenantAdmin",
@@ -1669,8 +1708,8 @@
           },
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "all"
@@ -1689,8 +1728,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "all"
@@ -2122,7 +2161,7 @@
     },
     {
       "name": "renderer-mail-html",
-      "description": "A `renderer-foundation` plugin that handles `RenderRequest { kind: \"mail\" }` and returns `{ subject, html, text, previewText? }` suitable for sending via `channel-email`. The mail template (`kind: \"mail\"`, document HTML, subject in `meta`) resolves through `template-resolver`'s DB fallback, its body is compiled to Handlebars by template-resolver and rendered with escaping, then placed into an MJML layout (`kind: \"mail-layout\"`, slug `default` unless `meta.layoutSlug` says otherwise, an in-code structured layout with the tenant branding logo and accent color as last resort) that `mjml()` compiles to email-safe table HTML, with `html-to-text` producing the plain-text alternative. An optional `footer` resolver adds the platform imprint, privacy link and footer text below every structured layout, an optional `brandSuffix` resolver adds a word after the tenant name in the brand row of the in-code layout, and an optional `siteUrl` resolver supplies the site link of the card when the tenant branding has no site URL (without either, the link is left out). The brand row and `data-resource=\"logo\"` images use the branding logo upload, or the branding logo https address when no file is uploaded. Mail meta `headerChip`, `tone` and `footerNote` add a chip beside the brand, the tone of the top line and chip, and a note above the site and unsubscribe links of the card. Seed an editable system layout with `seedSystemMailLayout(db)`. Requires `renderer-foundation` + `template-resolver`.",
+      "description": "A `renderer-foundation` plugin that handles `RenderRequest { kind: \"mail\" }` and returns `{ subject, html, text, previewText? }` suitable for sending via `channel-email`. The mail template (`kind: \"mail\"`, document HTML, subject in `meta`) resolves through `template-resolver`'s DB fallback, its body is compiled to Handlebars by template-resolver and rendered with escaping, then placed into an MJML layout (`kind: \"mail-layout\"`, slug `default` unless `meta.layoutSlug` says otherwise, an in-code structured layout with the tenant branding logo and accent color as last resort) that `mjml()` compiles to email-safe table HTML, with `html-to-text` producing the plain-text alternative. An optional `footer` resolver adds the platform imprint, privacy link and footer text below every structured layout, an optional `brandSuffix` resolver adds a word after the tenant name in the brand row of the in-code layout, and an optional `siteUrl` resolver supplies the site link of the card when the tenant branding has no site URL (without either, the link is left out). The brand row and `data-resource=\"logo\"` images use the branding logo upload, or the branding logo https address when no file is uploaded. Mail meta `headerChip`, `tone` and `footerNote` add a chip beside the brand, the tone of the top line and chip, and a note above the site and unsubscribe links of the card. `readMailChrome` hands the same brand row and footer, resolved for one locale, to pages a recipient opens from a mail, such as the unsubscribe page. Seed an editable system layout with `seedSystemMailLayout(db)`. Requires `renderer-foundation` + `template-resolver`.",
       "toggleableDefault": null,
       "requires": [
         "renderer-foundation",
@@ -2191,7 +2230,7 @@
     },
     {
       "name": "secrets",
-      "description": "Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: [\"TenantAdmin\"] }; adopt the host's role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins).",
+      "description": "Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: [\"TenantAdmin\"] }; adopt the host's role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: SecretsHandlers.set, payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.",
       "toggleableDefault": null,
       "requires": [],
       "optionalRequires": [],
@@ -3229,7 +3268,9 @@
       "configKeys": [],
       "secrets": [],
       "writeHandlers": [
+        "waitlist:write:export",
         "waitlist:write:invite",
+        "waitlist:write:purge",
         "waitlist:write:reject",
         "waitlist:write:submit"
       ],

package/samples/apps/use-all-bundled/scripts/check-coverage.ts

@@ -23,13 +23,12 @@ const FRAMEWORK_ROOT = resolve(ROOT, "..", "..", "..");
 // Held-back exports: existieren in bundled-features, sind aber nicht
 // als runtime-feature in use-all-bundled mountbar.
 //
-// Nur Utilities ohne defineFeature (foundation-shared sowie files-provider-s3, der deprecated Alias von file-provider-s3/lib, sind pure helpers)
+// Nur Utilities ohne defineFeature (foundation-shared ist pure helpers)
 // und scaffold-only Features. Gemountete Features gehören nicht hierher.
 const EXPECTED_HELD_BACK = new Set([
-  "files-provider-s3", // deprecated alias of file-provider-s3/lib (createS3Provider helpers), kein defineFeature
   "foundation-shared", // utilities (requireDefined/requireNonEmpty), kein feature
   "page-render", // shared HTML render/cache helpers (legal/managed-pages), kein defineFeature
-  "presets", // feature-bundle helpers (dsgvoSelfServiceFeatures, securityBaselineFeatures), kein defineFeature
+  "presets", // deprecated feature-bundle helpers (dsgvoSelfServiceFeatures, securityBaselineFeatures), kein defineFeature
 ]);
 
 // Sub-paths in bundled-features's package.json exports (./tenant/seeding,