@cosmicdrift/kumiko-samples 0.369.0 → 0.370.0

package/packages/bundled-features/src/jobs/index.ts

@@ -1,9 +1,9 @@
-export { JOBS_FEATURE, JobErrors, JobHandlers, JobQueries } from "./constants.js";
-export { createJobsFeature, type JobsFeatureOptions } from "./feature.js";
-export type { JobRunLoggerCallbacks } from "./job-run-logger.js";
-export { createJobRunLogger } from "./job-run-logger.js";
-export type { JobLogLevel, JobRunStatus } from "./job-run-table.js";
-export { jobRunLogsTable, jobRunsTable } from "./job-run-table.js";
-export { tenantJobFailuresTable } from "./tenant-job-failure-table.js";
-export type { TenantJobRunStatus } from "./tenant-job-run-table.js";
-export { tenantJobRunsTable } from "./tenant-job-run-table.js";
+export { JOBS_FEATURE, JobErrors, JobHandlers, JobQueries } from "./constants.ts";
+export { createJobsFeature, type JobsFeatureOptions } from "./feature.ts";
+export type { JobRunLoggerCallbacks } from "./job-run-logger.ts";
+export { createJobRunLogger } from "./job-run-logger.ts";
+export type { JobLogLevel, JobRunStatus } from "./job-run-table.ts";
+export { jobRunLogsTable, jobRunsTable } from "./job-run-table.ts";
+export { tenantJobFailuresTable } from "./tenant-job-failure-table.ts";
+export type { TenantJobRunStatus } from "./tenant-job-run-table.ts";
+export { tenantJobRunsTable } from "./tenant-job-run-table.ts";

package/packages/bundled-features/src/jobs/job-run-logger.ts

@@ -29,12 +29,12 @@ import type {
 } from "@cosmicdrift/kumiko-framework/jobs";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { mapWithConcurrency } from "../shared/index.js";
-import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events.js";
-import { parseJobInstant } from "./job-instant.js";
-import { jobRunLogsTable, jobRunsTable } from "./job-run-table.js";
-import { tenantJobFailuresTable } from "./tenant-job-failure-table.js";
-import { tenantJobRunsTable } from "./tenant-job-run-table.js";
+import { mapWithConcurrency } from "../shared/index.ts";
+import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events.ts";
+import { parseJobInstant } from "./job-instant.ts";
+import { jobRunLogsTable, jobRunsTable } from "./job-run-table.ts";
+import { tenantJobFailuresTable } from "./tenant-job-failure-table.ts";
+import { tenantJobRunsTable } from "./tenant-job-run-table.ts";
 
 // Matches PgKmsAdapter's default pool size (see tenant/handlers/*.query.ts) —
 // bounds concurrent getOrCreateDek calls so a large log batch doesn't claim

package/packages/bundled-features/src/jobs/web/client-plugin.tsx

@@ -1,8 +1,8 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { JOBS_FEATURE } from "../constants.js";
-import { defaultTranslations } from "./i18n.js";
+import { JOBS_FEATURE } from "../constants.ts";
+import { defaultTranslations } from "./i18n.ts";
 
 export type JobsClientOptions = {
   readonly translations?: TranslationsByLocale;

package/packages/bundled-features/src/jobs/web/i18n.ts

@@ -3,6 +3,6 @@ import {
   type TranslationsByLocale,
   translationsByLocaleFromKeys,
 } from "@cosmicdrift/kumiko-renderer";
-import { JOBS_I18N } from "../i18n.js";
+import { JOBS_I18N } from "../i18n.ts";
 
 export const defaultTranslations: TranslationsByLocale = translationsByLocaleFromKeys(JOBS_I18N);

package/packages/bundled-features/src/jobs/web/index.ts

@@ -1,2 +1,2 @@
 // @runtime client
-export { type JobsClientOptions, jobsClient } from "./client-plugin.js";
+export { type JobsClientOptions, jobsClient } from "./client-plugin.tsx";

package/packages/bundled-features/src/ledger/changes.json

@@ -1,4 +1,12 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated ledgerFeature constant is removed",
+    "detail": "ledgerFeature was kept next to createLedgerFeature() for one release. Mount the feature by calling createLedgerFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces ledgerFeature with createLedgerFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/ledger/entity.ts

@@ -7,7 +7,7 @@ import {
   createSelectField,
   createTextField,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { ACCOUNT_TYPES, SCHEDULE_INTERVALS, TRANSACTION_STATUS } from "./constants.js";
+import { ACCOUNT_TYPES, SCHEDULE_INTERVALS, TRANSACTION_STATUS } from "./constants.ts";
 
 // account — a node in the chart of accounts. Event-sourced (create/update/list/
 // detail via the standard handlers); the framework projects `read_ledger_accounts`

package/packages/bundled-features/src/ledger/executor.ts

@@ -1,5 +1,5 @@
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
-import { accountEntity, scheduleEntity, transactionEntity } from "./entity.js";
+import { accountEntity, scheduleEntity, transactionEntity } from "./entity.ts";
 
 // Shared tables + executors for the account + transaction handlers. Built once
 // (side-effect-free). The tables back the report query-handlers (selectMany over

package/packages/bundled-features/src/ledger/feature.ts

@@ -21,17 +21,17 @@ import {
   defineFeature,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { DEFAULT_LEDGER_ACCESS, LEDGER_FEATURE_NAME } from "./constants.js";
-import { accountEntity, scheduleEntity, transactionEntity } from "./entity.js";
-import { createConfirmSchedulePeriodHandler } from "./handlers/confirm-schedule-period.write.js";
-import { createCreateTransactionHandler } from "./handlers/create-transaction.write.js";
+import { DEFAULT_LEDGER_ACCESS, LEDGER_FEATURE_NAME } from "./constants.ts";
+import { accountEntity, scheduleEntity, transactionEntity } from "./entity.ts";
+import { createConfirmSchedulePeriodHandler } from "./handlers/confirm-schedule-period.write.ts";
+import { createCreateTransactionHandler } from "./handlers/create-transaction.write.ts";
 import {
   createBalanceSheetHandler,
   createBalancesReportHandler,
   createIncomeStatementHandler,
-} from "./handlers/reports.query.js";
-import { createReverseTransactionHandler } from "./handlers/reverse-transaction.write.js";
-import { requireScheduleSubjectPair } from "./schedule-subject-pair.js";
+} from "./handlers/reports.query.ts";
+import { createReverseTransactionHandler } from "./handlers/reverse-transaction.write.ts";
+import { requireScheduleSubjectPair } from "./schedule-subject-pair.ts";
 
 // Opt-in tier-gating (mirrors folders): when set, the feature declares itself
 // r.toggleable so the dispatcher gate + tier-engine can switch the WHOLE ledger
@@ -181,6 +181,3 @@ export function createLedgerFeature(opts: LedgerFeatureOptions = {}): typeof def
   const access = resolveAccess(opts);
   return defineFeature(LEDGER_FEATURE_NAME, (r) => registerLedger(r, access, opts.toggleable));
 }
-
-/** @deprecated Use createLedgerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const ledgerFeature = createLedgerFeature();

package/packages/bundled-features/src/ledger/handlers/confirm-schedule-period.write.ts

@@ -6,19 +6,19 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
+import { DEFAULT_LEDGER_ACCESS } from "../constants.ts";
 import {
   accountExecutor,
   scheduleExecutor,
   transactionExecutor,
   transactionTable,
-} from "../executor.js";
-import { findReversedIds, isoMonth, scheduleReference } from "../recurring.js";
+} from "../executor.ts";
+import { findReversedIds, isoMonth, scheduleReference } from "../recurring.ts";
 import {
   type ConfirmSchedulePeriodPayload,
   confirmSchedulePeriodPayloadSchema,
-} from "../schemas.js";
-import { readSubjectReference } from "../subject-reference.js";
+} from "../schemas.ts";
+import { readSubjectReference } from "../subject-reference.ts";
 
 // pg_advisory_xact_lock namespace (int4): 'lcsp' as ASCII, disjoint from the
 // framework's other fixed advisory-lock keys.

package/packages/bundled-features/src/ledger/handlers/create-transaction.write.ts

@@ -1,9 +1,9 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
-import { accountExecutor, transactionExecutor } from "../executor.js";
-import { type CreateTransactionPayload, createTransactionPayloadSchema } from "../schemas.js";
+import { DEFAULT_LEDGER_ACCESS } from "../constants.ts";
+import { accountExecutor, transactionExecutor } from "../executor.ts";
+import { type CreateTransactionPayload, createTransactionPayloadSchema } from "../schemas.ts";
 
 // create-transaction — books a balanced journal entry. The Σ=0 and ≥2-accounts
 // invariants are enforced by createTransactionPayloadSchema (command boundary).

package/packages/bundled-features/src/ledger/handlers/reports.query.ts

@@ -1,7 +1,7 @@
 import type { AccessRule, QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
-import { accountTable, transactionTable } from "../executor.js";
+import { DEFAULT_LEDGER_ACCESS } from "../constants.ts";
+import { accountTable, transactionTable } from "../executor.ts";
 import {
   accountBalances,
   balanceSheet,
@@ -10,7 +10,7 @@ import {
   type LedgerEntry,
   toAccounts,
   toEntries,
-} from "../reports.js";
+} from "../reports.ts";
 
 // Reports take an optional reporting period. Balance-sheet is cumulative → pass
 // { to: asOf }; income-statement is a period → { from, to }.

package/packages/bundled-features/src/ledger/handlers/reverse-transaction.write.ts

@@ -6,11 +6,11 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { DEFAULT_LEDGER_ACCESS } from "../constants.js";
-import { transactionExecutor, transactionTable } from "../executor.js";
-import { normalizeLines } from "../reports.js";
-import { type ReverseTransactionPayload, reverseTransactionPayloadSchema } from "../schemas.js";
-import { readSubjectReference } from "../subject-reference.js";
+import { DEFAULT_LEDGER_ACCESS } from "../constants.ts";
+import { transactionExecutor, transactionTable } from "../executor.ts";
+import { normalizeLines } from "../reports.ts";
+import { type ReverseTransactionPayload, reverseTransactionPayloadSchema } from "../schemas.ts";
+import { readSubjectReference } from "../subject-reference.ts";
 
 // reverse-transaction (Storno) — the ONLY correction path for a posted entry.
 // Books the mirror image (every amount negated) as a new posted entry that

package/packages/bundled-features/src/ledger/index.ts

@@ -10,30 +10,29 @@ export {
   type ScheduleInterval,
   TRANSACTION_STATUS,
   type TransactionStatus,
-} from "./constants.js";
-export { accountEntity, scheduleEntity, transactionEntity } from "./entity.js";
+} from "./constants.ts";
+export { accountEntity, scheduleEntity, transactionEntity } from "./entity.ts";
 export {
   createLedgerFeature,
   type LedgerFeatureOptions,
-  ledgerFeature,
-} from "./feature.js";
+} from "./feature.ts";
 export {
   confirmSchedulePeriodHandler,
   createConfirmSchedulePeriodHandler,
-} from "./handlers/confirm-schedule-period.write.js";
+} from "./handlers/confirm-schedule-period.write.ts";
 export {
   createCreateTransactionHandler,
   createTransactionHandler,
-} from "./handlers/create-transaction.write.js";
+} from "./handlers/create-transaction.write.ts";
 export {
   createBalanceSheetHandler,
   createBalancesReportHandler,
   createIncomeStatementHandler,
-} from "./handlers/reports.query.js";
+} from "./handlers/reports.query.ts";
 export {
   createReverseTransactionHandler,
   reverseTransactionHandler,
-} from "./handlers/reverse-transaction.write.js";
+} from "./handlers/reverse-transaction.write.ts";
 export {
   findReversedIds,
   type LedgerTxRow,
@@ -44,7 +43,7 @@ export {
   type ScheduleMonth,
   type ScheduleMonthStatus,
   scheduleReference,
-} from "./recurring.js";
+} from "./recurring.ts";
 export {
   type AccountBalance,
   accountBalances,
@@ -57,7 +56,7 @@ export {
   type LedgerEntry,
   type Period,
   rawBalances,
-} from "./reports.js";
+} from "./reports.ts";
 export {
   accountTypeSchema,
   type ConfirmSchedulePeriodPayload,
@@ -68,4 +67,4 @@ export {
   postingSchema,
   type ReverseTransactionPayload,
   reverseTransactionPayloadSchema,
-} from "./schemas.js";
+} from "./schemas.ts";

package/packages/bundled-features/src/ledger/recurring.ts

@@ -13,8 +13,8 @@
 // pure — no DB, no Date API (windows/asOf come in as params) — so the no-date-api
 // guard stays green and the forecast is deterministic.
 
-import type { ScheduleInterval } from "./constants.js";
-import type { Posting } from "./schemas.js";
+import type { ScheduleInterval } from "./constants.ts";
+import type { Posting } from "./schemas.ts";
 
 export type ScheduleDef = {
   readonly startDate: string; // ISO; first period (day ignored for monthly)

package/packages/bundled-features/src/ledger/reports.ts

@@ -1,6 +1,6 @@
 import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
-import type { AccountType } from "./constants.js";
-import type { Posting } from "./schemas.js";
+import type { AccountType } from "./constants.ts";
+import type { Posting } from "./schemas.ts";
 
 // Pure report aggregation over posted journal entries. No DB, no IO — the query
 // handlers fetch accounts + transactions (selectMany) and feed them here, so the

package/packages/bundled-features/src/ledger/schemas.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { ACCOUNT_TYPES, TRANSACTION_STATUS } from "./constants.js";
+import { ACCOUNT_TYPES, TRANSACTION_STATUS } from "./constants.ts";
 
 // A posting line. amount is integer minor units (cents), SIGNED: Soll/debit > 0,
 // Haben/credit < 0. Integer → the balance check is exact (=== 0), no float epsilon.

package/packages/bundled-features/src/ledger/web/index.ts

@@ -17,7 +17,7 @@ export {
   type ScheduleInterval,
   TRANSACTION_STATUS,
   type TransactionStatus,
-} from "../constants.js";
+} from "../constants.ts";
 export {
   type LedgerTxRow,
   mergeScheduleActuals,
@@ -27,10 +27,10 @@ export {
   type ScheduleMonth,
   type ScheduleMonthStatus,
   scheduleReference,
-} from "../recurring.js";
+} from "../recurring.ts";
 export {
   type ConfirmSchedulePeriodPayload,
   confirmSchedulePeriodPayloadSchema,
   type Posting,
   postingSchema,
-} from "../schemas.js";
+} from "../schemas.ts";

package/packages/bundled-features/src/legal-pages/README.md

@@ -23,6 +23,7 @@ import {
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 
 runProdApp({
+  envSchema, // composeEnvSchema({ core: frameworkCoreEnvSchema, features })
   features: [
     createTemplateResolverFeature(),  // legal-pages requires template-resolver
     createLegalPagesFeature(),
@@ -129,6 +130,29 @@ non-empty `path`/`slug`/`lang`, and every `path` must start with `/`.
 An empty `routes` array is allowed — the boot check alone, no public
 routes.
 
+### Terms of service
+
+`createLegalPagesFeature({ terms: true })` appends `LEGAL_TERMS_ROUTES` to the
+routes: `/legal/nutzungsbedingungen` (`terms` / `de`) and `/legal/terms`
+(`terms` / `en`). Terms are never boot-required; an unseeded block answers 404.
+
+### Layout helper
+
+`createLegalPagesLayout({ siteName, css?, stylesheetHrefs?, headerHtml?, footerHtml?,
+contentClass? })` returns a `wrapLayout` with the app's chrome around the body:
+title as `<title> · <siteName>`, body inside `<main data-tenant-content>`.
+`headerHtml`/`footerHtml` get the route's `lang` and must return trusted HTML; the CSP
+rules above still apply.
+
+### Paths for static sites
+
+Apps that render legal pages elsewhere (e.g. an Astro site) link to the same
+paths with `legalPagePath(routes, slug, lang)`, for example
+`legalPagePath([...LEGAL_ROUTES, ...LEGAL_TERMS_ROUTES], "terms", "en")`. It is
+client-safe and returns `undefined` for an unknown combination. Import it with
+the route constants from `@cosmicdrift/kumiko-bundled-features/legal-pages/constants`,
+which keeps the server feature out of a client bundle.
+
 ---
 
 ## Boot check
@@ -212,6 +236,21 @@ E-Mail: hello@example.com`,
 });
 ```
 
+### Boot seed for runProdApp
+
+`legalContentSeed(source)` returns a seed for `runProdApp({ seeds: [...] })`.
+`source` is `{ blocks }` (import your generated JSON) or `{ path }` (a JSON file
+resolved against the process cwd). Both are validated as a list of
+`{ slug, locale, title, content }`. The template is authoritative: an existing
+block is updated on every boot, so edits made through the API are overwritten.
+
+```typescript
+import legalContent from "./legal-content.json" with { type: "json" };
+import { legalContentSeed } from "@cosmicdrift/kumiko-bundled-features/legal-pages";
+
+runProdApp({ /* ... */ seeds: [legalContentSeed({ blocks: legalContent })] });
+```
+
 Templates for imprint + privacy policy: see
 [docs/plans/datenschutz/legal-artifacts.md](../../../../docs/plans/datenschutz/legal-artifacts.md)
 and vetted external generators (e-recht24.de,

package/packages/bundled-features/src/legal-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "improvement",
+    "title": "legal-pages serves terms of service, ships a layout helper and a boot seed",
+    "detail": "createLegalPagesFeature({ terms: true }) adds /legal/nutzungsbedingungen and /legal/terms (slug terms, de/en, never boot-required). createLegalPagesLayout({ siteName, css?, stylesheetHrefs?, headerHtml?, footerHtml?, contentClass? }) builds a wrapLayout with the app's chrome. legalContentSeed({ blocks } | { path }) returns a seed for runProdApp seeds that writes the blocks into SYSTEM_TENANT and updates existing ones, so the JSON stays authoritative. legalPagePath(routes, slug, lang) from the client-safe ./legal-pages/constants subpath gives static sites the same paths. Defaults are unchanged."
+  },
   {
     "version": "0.352.0",
     "type": "fix",

package/packages/bundled-features/src/legal-pages/constants.ts

@@ -51,6 +51,28 @@ export const LEGAL_ROUTES = [
   { path: "/legal/privacy", slug: "privacy", lang: "en", titleFallback: "Privacy Policy" },
 ] as const;
 
+// Terms of service are opt-in (`terms: true`) and never boot-required: not every
+// app needs them, and DACH law does not mandate them the way it does imprint.
+export const LEGAL_TERMS_ROUTES = [
+  {
+    path: "/legal/nutzungsbedingungen",
+    slug: "terms",
+    lang: "de",
+    titleFallback: "Nutzungsbedingungen",
+  },
+  { path: "/legal/terms", slug: "terms", lang: "en", titleFallback: "Terms of Service" },
+] as const;
+
+// Client-safe path lookup so apps that render their own legal pages (e.g. a
+// static marketing site) link to the same paths the feature serves.
+export function legalPagePath(
+  routes: readonly LegalPageRoute[],
+  slug: string,
+  lang: string,
+): string | undefined {
+  return routes.find((route) => route.slug === slug && route.lang === lang)?.path;
+}
+
 export const LegalPagesErrors = {
   bootMissingBlock: "legal_pages_boot_missing_block",
 } as const;

package/packages/bundled-features/src/legal-pages/feature.ts

@@ -10,18 +10,19 @@ import {
   type PublicPageWrapLayout,
   redirectToCanonicalPath,
   slashVariantOf,
-} from "../page-render/index.js";
+} from "../page-render/index.ts";
 import {
   LEGAL_REQUIRED_BLOCKS,
   LEGAL_ROUTES,
+  LEGAL_TERMS_ROUTES,
   type LegalPageRoute,
   type LegalRequiredBlock,
-} from "./constants.js";
-import { runLegalPagesBootCheck } from "./lib/boot-check.js";
-import { validateRoutes } from "./lib/validate-routes.js";
-import { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
+} from "./constants.ts";
+import { runLegalPagesBootCheck } from "./lib/boot-check.ts";
+import { validateRoutes } from "./lib/validate-routes.ts";
+import { renderMarkdownToHtml, wrapInLayout } from "./markdown.ts";
 
-export { type LegalPagesBootCheckCtx, runLegalPagesBootCheck } from "./lib/boot-check.js";
+export { type LegalPagesBootCheckCtx, runLegalPagesBootCheck } from "./lib/boot-check.ts";
 
 // QN-Konstante als dokumentierter Public-Contract des template-resolver-
 // Features. Ein magic-string statt eines Code-Imports ist hier explizit
@@ -84,11 +85,17 @@ export type LegalPagesOptions = {
    *  `privacy/de`). Apps whose routes use a different slug/lang set
    *  (e.g. Spanish-default) pass their own list here. */
   readonly requiredBlocks?: readonly LegalRequiredBlock[];
+  /** Also serve LEGAL_TERMS_ROUTES (`/legal/nutzungsbedingungen`,
+   *  `/legal/terms`, slug `terms`). Appended to `routes`; never boot-required. */
+  readonly terms?: boolean;
 };
 
 export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDefinition {
   const wrapLayout = opts.wrapLayout ?? wrapInLayout;
-  const routes: readonly LegalPageRoute[] = opts.routes ?? LEGAL_ROUTES;
+  const routes: readonly LegalPageRoute[] = [
+    ...(opts.routes ?? LEGAL_ROUTES),
+    ...(opts.terms === true ? LEGAL_TERMS_ROUTES : []),
+  ];
   const requiredBlocks = opts.requiredBlocks ?? LEGAL_REQUIRED_BLOCKS;
   validateRoutes(routes);
   if (opts.routes !== undefined && opts.routes.length > 0 && opts.requiredBlocks === undefined) {

package/packages/bundled-features/src/legal-pages/index.ts

@@ -3,14 +3,23 @@ export {
   LEGAL_PAGES_FEATURE,
   LEGAL_REQUIRED_BLOCKS,
   LEGAL_ROUTES,
+  LEGAL_TERMS_ROUTES,
   type LegalPageRoute,
   LegalPagesErrors,
   type LegalRequiredBlock,
-} from "./constants.js";
+  legalPagePath,
+} from "./constants.ts";
 export {
   createLegalPagesFeature,
   type LegalPagesBootCheckCtx,
   type LegalPagesOptions,
   runLegalPagesBootCheck,
-} from "./feature.js";
-export { renderMarkdownToHtml, wrapInLayout } from "./markdown.js";
+} from "./feature.ts";
+export { createLegalPagesLayout, type LegalPagesLayoutOptions } from "./layout.ts";
+export { renderMarkdownToHtml, wrapInLayout } from "./markdown.ts";
+export {
+  type LegalContentBlock,
+  type LegalContentSeedFn,
+  type LegalContentSeedSource,
+  legalContentSeed,
+} from "./seed.ts";

package/packages/bundled-features/src/legal-pages/layout.ts

@@ -0,0 +1,45 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { type PublicPageWrapLayout, TENANT_CONTENT_ATTR } from "../page-render/index.ts";
+
+export type LegalPagesLayoutOptions = {
+  // Appended to the page title as "<title> · <siteName>".
+  readonly siteName: string;
+  // Trusted app CSS, inlined into one <style> block.
+  readonly css?: string;
+  readonly stylesheetHrefs?: readonly string[];
+  // Trusted app chrome per language; the feature passes the route's `lang`.
+  readonly headerHtml?: (lang: string) => string;
+  readonly footerHtml?: (lang: string) => string;
+  readonly contentClass?: string;
+};
+
+export function createLegalPagesLayout(options: LegalPagesLayoutOptions): PublicPageWrapLayout {
+  const stylesheets = (options.stylesheetHrefs ?? [])
+    .map((href) => `\n<link rel="stylesheet" href="${escapeHtmlAttr(href)}">`)
+    .join("");
+  // html-ok: css comes from app code (LegalPagesLayoutOptions), never from tenant or user input.
+  const style = options.css ? `\n<style>${options.css}</style>` : "";
+  const contentClass = options.contentClass
+    ? ` class="${escapeHtmlAttr(options.contentClass)}"`
+    : "";
+  return ({ title, bodyHtml, lang }) => {
+    const headerHtml = options.headerHtml?.(lang) ?? "";
+    const footerHtml = options.footerHtml?.(lang) ?? "";
+    return `<!doctype html>
+<html lang="${escapeHtmlAttr(lang)}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)} · ${escapeHtml(options.siteName)}</title>
+<meta name="robots" content="index,follow">${stylesheets}${style}
+</head>
+<body>
+${headerHtml}
+<main ${TENANT_CONTENT_ATTR}${contentClass}>
+${bodyHtml}
+</main>
+${footerHtml}
+</body>
+</html>`;
+  };
+}

package/packages/bundled-features/src/legal-pages/lib/boot-check.ts

@@ -4,7 +4,7 @@ import {
   type TemplateResolverApi,
 } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../constants.js";
+import { LEGAL_REQUIRED_BLOCKS, type LegalRequiredBlock } from "../constants.ts";
 
 // Only the fields the check reads, so HandlerContext, AppContext or a hand-built
 // object in a unit test all fit.

package/packages/bundled-features/src/legal-pages/lib/validate-routes.ts

@@ -1,4 +1,4 @@
-import type { LegalPageRoute } from "../constants.js";
+import type { LegalPageRoute } from "../constants.ts";
 
 // Validated once at feature-build time (not per-request) so a config typo
 // fails app startup instead of surfacing as a confusing 404 later.

package/packages/bundled-features/src/legal-pages/markdown.ts

@@ -3,5 +3,5 @@
 // für legal-pages' Public-API (index.ts exportiert renderMarkdownToHtml +
 // wrapInLayout).
 
-export { wrapInLayout } from "../page-render/layout.js";
-export { renderSafeMarkdown as renderMarkdownToHtml } from "../page-render/markdown.js";
+export { wrapInLayout } from "../page-render/layout.ts";
+export { renderSafeMarkdown as renderMarkdownToHtml } from "../page-render/markdown.ts";

package/packages/bundled-features/src/legal-pages/seed.ts

@@ -0,0 +1,53 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  type LegalContentBlock,
+  seedLegalContentFromJson,
+} from "@cosmicdrift/kumiko-bundled-features/template-resolver/seeding";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import * as z from "zod";
+
+export type { LegalContentBlock };
+
+// `path` is resolved against the process cwd (the app root for `bun bin/main.ts`),
+// not against this module, so apps can keep their generated JSON where it is.
+export type LegalContentSeedSource =
+  | { readonly blocks: readonly LegalContentBlock[] }
+  | { readonly path: string };
+
+export type LegalContentSeedFn = (deps: { readonly db: DbConnection }) => Promise<void>;
+
+const legalContentBlocksSchema = z.array(
+  z.object({
+    slug: z.string().min(1),
+    locale: z.string().min(1),
+    title: z.string(),
+    content: z.string(),
+  }),
+);
+
+const jsonModuleSchema = z.object({ default: z.unknown() });
+
+async function loadBlocksFromJson(path: string): Promise<readonly LegalContentBlock[]> {
+  const url = pathToFileURL(resolve(process.cwd(), path)).href;
+  const module = jsonModuleSchema.parse(await import(url, { with: { type: "json" } }));
+  const parsed = legalContentBlocksSchema.safeParse(module.default);
+  if (!parsed.success) {
+    throw new Error(
+      `legal-pages: ${path} is not a list of { slug, locale, title, content } blocks: ${parsed.error.message}`,
+    );
+  }
+  return parsed.data;
+}
+
+// Boot seed for runProdApp's `seeds: [...]`. The JSON template is authoritative
+// (ifExists "update"), so legally required text changes reach rows seeded once.
+export function legalContentSeed(source: LegalContentSeedSource): LegalContentSeedFn {
+  return async ({ db }) => {
+    const blocks =
+      "blocks" in source
+        ? legalContentBlocksSchema.parse(source.blocks)
+        : await loadBlocksFromJson(source.path);
+    await seedLegalContentFromJson(db, blocks);
+  };
+}

package/packages/bundled-features/src/legal-pages/web/client-plugin.ts

@@ -18,7 +18,7 @@
 
 import type { TreeChildrenSubscribe, TreeNode } from "@cosmicdrift/kumiko-framework/engine";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { LEGAL_OPTIONAL_BLOCKS, LEGAL_REQUIRED_BLOCKS } from "../constants.js";
+import { LEGAL_OPTIONAL_BLOCKS, LEGAL_REQUIRED_BLOCKS } from "../constants.ts";
 
 const treeProvider: TreeChildrenSubscribe = () => (emit) => {
   // V.1.5d Slug-first Verschachtelung (Variante C):