@cosmicdrift/kumiko-samples 0.369.0 → 0.370.0

package/packages/bundled-features/src/waitlist/link-on-signup.ts

@@ -0,0 +1,106 @@
+import {
+  createTenantDb,
+  entityEventName,
+  fetchOne,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/db";
+import { type MultiStreamApplyFn, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { decryptStoredPii } from "../shared/index.ts";
+import { tenantMembershipsTable } from "../tenant/index.ts";
+import { userTable } from "../user/index.ts";
+import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS } from "./constants.ts";
+import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.ts";
+
+const PII_DECRYPT_REASON = "waitlist:link-on-signup";
+
+export const WAITLIST_MEMBERSHIP_CREATED_EVENT = entityEventName("tenant-membership", "created");
+
+type SignupOwnerMembership = { readonly userId: string; readonly tenantId: string };
+
+// Only a TenantAdmin membership can be the signup owner; invite-accept memberships of
+// other roles are not owners.
+function readSignupOwnerMembership(
+  event: Parameters<MultiStreamApplyFn>[0],
+): SignupOwnerMembership | undefined {
+  const { userId, roles } = event.payload;
+  if (typeof userId !== "string") return undefined;
+  if (!parseRoles(roles).includes(DEFAULT_OWN_TENANT_INVITE_ROLE)) return undefined;
+  return { userId, tenantId: event.tenantId };
+}
+
+// An unreadable submittedAt sorts last instead of throwing: one bad row must not
+// stall the at-least-once consumer.
+function newestSubmittedFirst(a: Record<string, unknown>, b: Record<string, unknown>): number {
+  return submittedAtMillis(b) - submittedAtMillis(a);
+}
+
+function submittedAtMillis(row: Record<string, unknown>): number {
+  return instantMillis(row["submittedAt"]);
+}
+
+function instantMillis(value: unknown): number {
+  if (value instanceof Temporal.Instant) return value.epochMilliseconds;
+  if (typeof value !== "string") return 0;
+  try {
+    return Temporal.Instant.from(value).epochMilliseconds;
+  } catch {
+    // Temporal.Instant.from throws RangeError for a non-ISO string.
+    return 0;
+  }
+}
+
+// Runs as a multi-stream consumer (at least once): the hook phase of the signup and
+// invite-accept paths has no system db handle, and a waitlist problem must not roll
+// back the signup. Idempotent because only `invited` entries are updated.
+export const linkWaitlistOnSignup: MultiStreamApplyFn = async (event, tx) => {
+  const membership = readSignupOwnerMembership(event);
+  // skip: not a TenantAdmin membership, nothing to link.
+  if (!membership) return;
+
+  // Only the tenant's first membership is the owner; later TenantAdmin invites must not link.
+  const [first] = await selectMany<{ readonly id: string }>(
+    tx,
+    tenantMembershipsTable,
+    { tenantId: membership.tenantId },
+    { limit: 1, fields: ["id"], orderBy: [{ col: "insertedAt" }, { col: "id" }] },
+  );
+  // skip: another membership came first.
+  if (first && first.id !== event.aggregateId) return;
+
+  const db = createTenantDb({ db: tx, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+  const user = await fetchOne<{ email?: unknown }>(tx, userTable, { id: membership.userId });
+  // skip: user row unreadable (erased or not projected yet).
+  if (typeof user?.email !== "string") return;
+  const email = normalizeEmail(await decryptStoredPii(user.email, "email", PII_DECRYPT_REASON));
+
+  const found = await waitlistExecutor.list(
+    {
+      filter: { field: "email", op: "eq", value: email },
+      filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
+    },
+    platformActor(),
+    db,
+  );
+  const invited = [...found.rows].sort(newestSubmittedFirst)[0];
+  // skip: the signup email has no invited waitlist entry (open signup or stale invite).
+  if (!invited) return;
+  const { id, version } = invited;
+  // skip: defensive guard on the row shape.
+  if (typeof id !== "string" || typeof version !== "number") return;
+
+  await waitlistExecutor.update(
+    {
+      id,
+      version,
+      changes: {
+        status: WAITLIST_STATUS.Provisioned,
+        linkedTenantId: membership.tenantId,
+        provisionedAt: Temporal.Now.instant(),
+      },
+    },
+    platformActor(),
+    db,
+  );
+};

package/packages/bundled-features/src/waitlist/mail.ts

@@ -4,7 +4,7 @@ import {
   type TemplateVariables,
   templateVariable,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { mailHeading, mailParagraph, mailRepeatedRows } from "../shared/index.js";
+import { mailHeading, mailParagraph, mailRepeatedRows } from "../shared/index.ts";
 
 export type WaitlistMailLocale = "en" | "de" | "es";
 

package/packages/bundled-features/src/waitlist/options.ts

@@ -1,5 +1,9 @@
 import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { PayloadRateLimitOption, RateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+import type {
+  PayloadRateLimitOption,
+  RateLimitDeclaration,
+  RateLimitOption,
+} from "@cosmicdrift/kumiko-types/handlers";
 
 export type WaitlistInviteOptions =
   | {
@@ -22,11 +26,19 @@ export type WaitlistOptions = {
   readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
   /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
   readonly invite?: WaitlistInviteOptions;
-  /** Default: 5 submits per IP per 10 minutes. */
-  readonly rateLimit?: RateLimitOption;
+  /** Default: 5 submits per IP per 10 minutes. Pass `{ disabled: true, reason }`
+   *  to turn the per-IP limit off (e.g. when a CDN already throttles the route). */
+  readonly rateLimit?: RateLimitDeclaration;
   /** Default: 3 submits per email address per day, across all IPs. Stops a botnet
    *  from flooding one address with confirmation mails. Pass `[]` to disable. */
   readonly emailRateLimits?: readonly PayloadRateLimitOption[];
+  /** Marks an invited entry `provisioned` and records the tenant when its email
+   *  becomes the first TenantAdmin member of a tenant (open signup after an
+   *  invite, or accepting an own-tenant invite). Default false. */
+  readonly linkOnSignup?: boolean;
+  /** Mounts the SystemAdmin-only `export` and `purge` handlers for handing over
+   *  and erasing the whole list. Default true; pass false to leave them out. */
+  readonly exportPurge?: boolean;
   /** Shown in the confirmation mail; omitted when unset. */
   readonly appName?: string;
 };

package/packages/bundled-features/src/waitlist/payloads.ts

@@ -1,6 +1,6 @@
 import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
-import { WAITLIST_FIELD_LIMITS } from "./constants.js";
+import { WAITLIST_FIELD_LIMITS } from "./constants.ts";
 
 // Submitted text lands in a mail subject; CR/LF there would allow header injection.
 const NO_CONTROL_CHARS = /^\P{Cc}*$/u;
@@ -53,3 +53,5 @@ export const WaitlistSubmitSchema = z
 export type WaitlistSubmitInput = z.infer<typeof WaitlistSubmitSchema>;
 
 export const WaitlistIdSchema = z.object({ id: z.uuid() }).strict();
+
+export const WaitlistAuditEventSchema = z.object({ count: z.number().int().nonnegative() });

package/packages/bundled-features/src/waitlist/screens.ts

@@ -1,6 +1,6 @@
 import { type EntityListScreenDefinition, i18nKey } from "@cosmicdrift/kumiko-framework/engine";
-import { WAITLIST_STATUS, WaitlistHandlers } from "./constants.js";
-import { adminAccess } from "./lib.js";
+import { WAITLIST_STATUS, WaitlistHandlers } from "./constants.ts";
+import { adminAccess } from "./lib.ts";
 
 export const waitlistListScreen: EntityListScreenDefinition = {
   id: "waitlist-list",

package/packages/bundled-features/src/waitlist/user-data-hooks.ts

@@ -4,9 +4,9 @@ import type {
   UserDataExportHook,
   UserDataHookCtx,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { collectErasureFailure, decryptStoredPii, throwIfErasureFailed } from "../shared/index.js";
-import { userTable } from "../user/index.js";
-import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.js";
+import { collectErasureFailure, decryptStoredPii, throwIfErasureFailed } from "../shared/index.ts";
+import { userTable } from "../user/index.ts";
+import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.ts";
 
 const PII_DECRYPT_REASON = "waitlist:user-data";
 const ERASE_REASON = "waitlist:user-data-forget";

package/packages/bundled-features/src/workflow-runner/changes.json

@@ -1,4 +1,12 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "The deprecated workflowRunnerFeature constant is removed",
+    "detail": "workflowRunnerFeature was kept next to createWorkflowRunnerFeature() for one release. Mount the feature by calling createWorkflowRunnerFeature().",
+    "migration": "Run bun kumiko-upgrade --apply. It replaces workflowRunnerFeature with createWorkflowRunnerFeature().",
+    "codemod": "scripts/codemod/feature-factory.ts"
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/workflow-runner/db/queries/due-runs.ts

@@ -1,5 +1,5 @@
 import { sql, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { workflowRunPendingTable } from "../../tables.js";
+import { workflowRunPendingTable } from "../../tables.ts";
 
 export type DueRow = { readonly runId: string; readonly stepIndex: number };
 

package/packages/bundled-features/src/workflow-runner/event-subscriber.ts

@@ -34,8 +34,8 @@ import type {
 import { evaluateEventMatch } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import type { TriggerEventRef } from "./runner.js";
-import { workflowRunPendingTable } from "./tables.js";
+import type { TriggerEventRef } from "./runner.ts";
+import { workflowRunPendingTable } from "./tables.ts";
 
 type CandidateRow = {
   readonly runId: string;

package/packages/bundled-features/src/workflow-runner/event-trigger.ts

@@ -28,14 +28,14 @@ import {
   WorkflowStepError,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
-import { workflowRunAggregateId } from "./aggregate-id.js";
-import { registerEventWakeup } from "./event-subscriber.js";
+import { workflowRunAggregateId } from "./aggregate-id.ts";
+import { registerEventWakeup } from "./event-subscriber.ts";
 import {
   startAndRunWorkflow,
   type WorkflowRunFailedPayload,
   WorkflowSuspensionUnsupportedError,
-} from "./runner.js";
-import { registerWorkflow } from "./workflow-registry.js";
+} from "./runner.ts";
+import { registerWorkflow } from "./workflow-registry.ts";
 
 const log = createFallbackLogger("workflow-runner");
 

package/packages/bundled-features/src/workflow-runner/feature.ts

@@ -25,10 +25,10 @@
 // wait/retry/waitForEvent suspensions all resume automatically now.
 
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { selectDueWorkflowRunPending } from "./db/queries/due-runs.js";
-import { resumeRunHandler } from "./handlers/resume-run.write.js";
-import { registerWorkflowRunPendingProjection } from "./pending-projection.js";
-import { workflowRunPendingTableMeta } from "./tables.js";
+import { selectDueWorkflowRunPending } from "./db/queries/due-runs.ts";
+import { resumeRunHandler } from "./handlers/resume-run.write.ts";
+import { registerWorkflowRunPendingProjection } from "./pending-projection.ts";
+import { workflowRunPendingTableMeta } from "./tables.ts";
 
 // Kebab-case matching the "./workflow-runner" export subpath — every other
 // bundled feature's runtime name follows this convention, and
@@ -95,6 +95,3 @@ export function createWorkflowRunnerFeature() {
     { dedupeOptions: {} },
   );
 }
-
-/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const workflowRunnerFeature = createWorkflowRunnerFeature();

package/packages/bundled-features/src/workflow-runner/handlers/resume-run.write.ts

@@ -62,9 +62,9 @@ import {
   type WorkflowRunCompletedPayload,
   type WorkflowRunFailedPayload,
   WorkflowSuspensionUnsupportedError,
-} from "../runner.js";
-import { workflowRunPendingTable } from "../tables.js";
-import { getWorkflow } from "../workflow-registry.js";
+} from "../runner.ts";
+import { workflowRunPendingTable } from "../tables.ts";
+import { getWorkflow } from "../workflow-registry.ts";
 
 const log = createFallbackLogger("workflow-runner");
 

package/packages/bundled-features/src/workflow-runner/index.ts

@@ -1,12 +1,12 @@
 // Public API of the workflow-runner bundled-feature.
 
-export { workflowRunAggregateId } from "./aggregate-id.js";
-export { registerEventTrigger } from "./event-trigger.js";
-export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
+export { workflowRunAggregateId } from "./aggregate-id.ts";
+export { registerEventTrigger } from "./event-trigger.ts";
+export { createWorkflowRunnerFeature } from "./feature.ts";
 export {
   startAndRunWorkflow,
   type WorkflowRunCompletedPayload,
   type WorkflowRunFailedPayload,
   type WorkflowRunStartedPayload,
   WorkflowSuspensionUnsupportedError,
-} from "./runner.js";
+} from "./runner.ts";

package/packages/bundled-features/src/workflow-runner/pending-projection.ts

@@ -26,7 +26,7 @@ import {
   WORKFLOW_WAITING_FOR_EVENT_TYPE,
   WORKFLOW_WAITING_TYPE,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { workflowRunPendingTable } from "./tables.js";
+import { workflowRunPendingTable } from "./tables.ts";
 
 type WaitPayload = {
   readonly wakeAt: string;

package/samples/apps/ui-walkthrough/package.json

@@ -21,7 +21,8 @@
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
     "zod": "^4.4.3",
-    "@cosmicdrift/kumiko-locale-de": "workspace:*"
+    "@cosmicdrift/kumiko-locale-de": "workspace:*",
+    "@cosmicdrift/kumiko-locale-es": "workspace:*"
   },
   "devDependencies": {
     "@cosmicdrift/kumiko-testing": "workspace:*"

package/samples/apps/ui-walkthrough/src/app/auth-constants.ts

@@ -27,3 +27,7 @@ export const TENANT_ADMIN_EMAIL = "a.berger@nordlicht-immobilien.de";
 export const TENANT_ADMIN_PASSWORD = "nordlicht-berger";
 export const PLATFORM_ADMIN_EMAIL = "plattform@kumiko.dev";
 export const PLATFORM_ADMIN_PASSWORD = "kumiko-plattform";
+
+// Signs the unsubscribe links of the sample's mails; the e2e signs its own links with it.
+// A real app reads it from its secret store.
+export const UNSUBSCRIBE_SECRET = "ui-walkthrough-unsubscribe-secret-sample-only";

package/samples/apps/ui-walkthrough/src/app/server.ts

@@ -9,11 +9,18 @@
 // kein Auto-Mint-JWT mehr. Persistent-DB-Modus über KUMIKO_DEV_DB_NAME
 // in der Umgebung.
 
+import { createUnsubscribeRoutes } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { runDevApp } from "@cosmicdrift/kumiko-dev-server";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createInMemoryFileProvider } from "@cosmicdrift/kumiko-framework/files";
 import { APP_FEATURES } from "../run-config";
-import { ADMIN_EMAIL, ADMIN_PASSWORD, BETA_TENANT_ID, DEV_TENANT_ID } from "./auth-constants";
+import {
+  ADMIN_EMAIL,
+  ADMIN_PASSWORD,
+  BETA_TENANT_ID,
+  DEV_TENANT_ID,
+  UNSUBSCRIBE_SECRET,
+} from "./auth-constants";
 import { seedTasks } from "./seed";
 import { seedRental } from "./seed-rental";
 import { seedTemplates } from "./seed-templates";
@@ -33,6 +40,8 @@ await runDevApp({
   port: Number.parseInt(process.env["PORT"] ?? "4173", 10),
   // Logo and attachment uploads of the mail editor need a file store.
   files: { storageProvider: createInMemoryFileProvider() },
+  // The pages behind a mail's unsubscribe link, dressed in the tenant's mail look.
+  extraRoutes: createUnsubscribeRoutes({ secret: UNSUBSCRIBE_SECRET }),
   clientEntry: "./src/app/client.tsx",
   htmlPath: "./public/index.html",
   watchDirs: ["./src", "../../../packages/*/src"],

package/samples/apps/ui-walkthrough/src/app/template-seed-data.ts

@@ -206,7 +206,7 @@ function invoiceIssuedBody(args: {
     `<h2>Ihre Rechnung ${v("invoiceNumber")}</h2>`,
     `<p>Guten Tag ${v("recipientName")},</p>`,
     `<p>${args.intro} ${v("invoiceNumber")} über ${v("invoiceTotal")}.${due} Die Rechnung finden Sie als PDF im Anhang und jederzeit online.</p>`,
-    '<a data-button href="{{invoiceUrl}}">Rechnung online ansehen</a>',
+    `<a data-button href="{{invoiceUrl}}">Rechnung ${v("invoiceNumber")} online ansehen</a>`,
     LINES_TABLE,
     "<hr>",
     "<p>Bei Fragen zur Rechnung antworten Sie einfach auf diese E-Mail.</p>",

package/samples/apps/ui-walkthrough/src/features/billing/feature.ts

@@ -2,45 +2,46 @@ import { defineFeature, templateVariable } from "@cosmicdrift/kumiko-framework/e
 import { toKeyFirst } from "../translations";
 import { billingTranslations } from "./i18n";
 
+// Variable labels are i18n keys, so the designer's rail and chips speak the editor's language.
 // Both mails are sent by the host app's billing run, not by an event trigger in
 // this sample; they exist so the template overview has real senders to show.
 const INVOICE_ISSUED_VARIABLES = {
   recipientName: templateVariable.text({
-    label: "Empfängername",
+    label: "billing:mail.variable.recipientName",
     required: true,
     example: "Familie Yilmaz",
   }),
   recipientEmail: templateVariable.text({
-    label: "Empfänger-Adresse",
+    label: "billing:mail.variable.recipientEmail",
     example: "yilmaz.familie@example.org",
   }),
   invoiceNumber: templateVariable.text({
-    label: "Rechnungsnummer",
+    label: "billing:mail.variable.invoiceNumber",
     required: true,
     example: "RE-2026-0142",
   }),
   invoiceTotal: templateVariable.money({
-    label: "Rechnungsbetrag",
+    label: "billing:mail.variable.invoiceTotal",
     required: true,
     example: { amount: 128450, currency: "EUR" },
   }),
   dueDate: templateVariable.date({
-    label: "Fälligkeitsdatum",
+    label: "billing:mail.variable.dueDate",
     required: true,
     example: "2026-10-30",
   }),
   invoiceUrl: templateVariable.link({
-    label: "Link zur Rechnung",
+    label: "billing:mail.variable.invoiceUrl",
     required: true,
     example: "https://nordlicht-immobilien.de/rechnungen/RE-2026-0142",
   }),
   lines: templateVariable.list(
     {
-      description: templateVariable.text({ label: "Bezeichnung" }),
-      amount: templateVariable.money({ label: "Betrag" }),
+      description: templateVariable.text({ label: "billing:mail.variable.lines.description" }),
+      amount: templateVariable.money({ label: "billing:mail.variable.lines.amount" }),
     },
     {
-      label: "Rechnungspositionen",
+      label: "billing:mail.variable.lines",
       required: true,
       example: [
         { description: "Kaltmiete Oktober 2026, Lindenstraße 14 WE 3", amount: 98000 },
@@ -50,7 +51,7 @@ const INVOICE_ISSUED_VARIABLES = {
     },
   ),
   paymentReference: templateVariable.text({
-    label: "Zahlungsreferenz",
+    label: "billing:mail.variable.paymentReference",
     example: "RE-2026-0142 / Yilmaz",
   }),
 } as const;

package/samples/apps/ui-walkthrough/src/features/billing/i18n.ts

@@ -1,7 +1,8 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
 // The keys follow the document-designer's "used by" lookup:
-// `<feature>:feature.label` and `<feature>:notify.<notification>.label`.
+// `<feature>:feature.label` and `<feature>:notify.<notification>.label`. Variable labels
+// are plain keys the notification's variables name in their `label`.
 export const billingTranslations: TranslationsByLocale = {
   de: {
     "billing:feature.label": "Rechnungen",
@@ -9,6 +10,16 @@ export const billingTranslations: TranslationsByLocale = {
     "billing:notify.invoice-corrected.label": "Rechnung korrigiert",
     "billing:notify.payment-reminder.label": "Mahnlauf",
     "billing:notify.terms-changed.label": "AGB-Änderung",
+    "billing:mail.variable.recipientName": "Empfängername",
+    "billing:mail.variable.recipientEmail": "Empfänger-Adresse",
+    "billing:mail.variable.invoiceNumber": "Rechnungsnummer",
+    "billing:mail.variable.invoiceTotal": "Rechnungsbetrag",
+    "billing:mail.variable.dueDate": "Fälligkeitsdatum",
+    "billing:mail.variable.invoiceUrl": "Link zur Rechnung",
+    "billing:mail.variable.lines.description": "Bezeichnung",
+    "billing:mail.variable.lines.amount": "Betrag",
+    "billing:mail.variable.lines": "Rechnungspositionen",
+    "billing:mail.variable.paymentReference": "Zahlungsreferenz",
   },
   en: {
     "billing:feature.label": "Invoices",
@@ -16,5 +27,15 @@ export const billingTranslations: TranslationsByLocale = {
     "billing:notify.invoice-corrected.label": "Invoice corrected",
     "billing:notify.payment-reminder.label": "Dunning run",
     "billing:notify.terms-changed.label": "Terms update",
+    "billing:mail.variable.recipientName": "Recipient name",
+    "billing:mail.variable.recipientEmail": "Recipient address",
+    "billing:mail.variable.invoiceNumber": "Invoice number",
+    "billing:mail.variable.invoiceTotal": "Invoice total",
+    "billing:mail.variable.dueDate": "Due date",
+    "billing:mail.variable.invoiceUrl": "Invoice link",
+    "billing:mail.variable.lines.description": "Description",
+    "billing:mail.variable.lines.amount": "Amount",
+    "billing:mail.variable.lines": "Invoice lines",
+    "billing:mail.variable.paymentReference": "Payment reference",
   },
 };

package/samples/apps/ui-walkthrough/src/run-config.ts

@@ -14,6 +14,7 @@ import { createRendererFoundationFeature } from "@cosmicdrift/kumiko-bundled-fea
 import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { createDocumentDesignerFeature } from "@cosmicdrift/kumiko-document-designer";
 import { localeDe } from "@cosmicdrift/kumiko-locale-de";
+import { localeEs } from "@cosmicdrift/kumiko-locale-es";
 import { createRendererMailHtmlFeature } from "@cosmicdrift/kumiko-renderer-mail-html";
 import { createRendererPuppeteerClientFeature } from "@cosmicdrift/kumiko-renderer-puppeteer-client";
 import { TENANT_ADMIN_EMAIL } from "./app/auth-constants";
@@ -24,6 +25,8 @@ import { vehiclesFeature } from "./features/vehicles";
 
 export const APP_FEATURES = [
   localeDe(),
+  // Spanish mail copy: subscribers whose mails go out in Spanish land on Spanish unsubscribe pages.
+  localeEs(),
   taskFeature,
   rentalFeature,
   vehiclesFeature,
@@ -43,11 +46,17 @@ export const APP_FEATURES = [
             imprint: { label: "Impressum", url: "https://nordlicht-immobilien.de/impressum" },
             privacy: { label: "Datenschutz", url: "https://nordlicht-immobilien.de/datenschutz" },
           }
-        : {
-            text: "Sent via the Nordlicht tenant portal",
-            imprint: { label: "Imprint", url: "https://nordlicht-immobilien.de/imprint" },
-            privacy: { label: "Privacy", url: "https://nordlicht-immobilien.de/privacy" },
-          },
+        : locale.startsWith("es")
+          ? {
+              text: "Enviado a través del portal de inquilinos Nordlicht",
+              imprint: { label: "Aviso legal", url: "https://nordlicht-immobilien.de/imprint" },
+              privacy: { label: "Privacidad", url: "https://nordlicht-immobilien.de/privacy" },
+            }
+          : {
+              text: "Sent via the Nordlicht tenant portal",
+              imprint: { label: "Imprint", url: "https://nordlicht-immobilien.de/imprint" },
+              privacy: { label: "Privacy", url: "https://nordlicht-immobilien.de/privacy" },
+            },
   }),
   // The PDF preview of the template editor prints through the puppeteer-service
   // (PUPPETEER_SERVICE_URL / PUPPETEER_AUTH_TOKEN); the e2e config starts one.

package/samples/apps/ui-walkthrough/tsconfig.json

@@ -8,6 +8,7 @@
     "target": "ESNext",
     "module": "ESNext",
     "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
     "lib": ["ESNext", "DOM", "DOM.Iterable"],

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -1,7 +1,24 @@
 {
   "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled + signup)",
-  "featureCount": 84,
+  "featureCount": 86,
   "features": [
+    {
+      "name": "account-security",
+      "description": "Self-service account dashboard: MFA enrollment, recovery codes and the user's own sessions, composed from the auth-mfa and sessions screens.",
+      "toggleableDefault": null,
+      "requires": [
+        "sessions",
+        "auth-mfa"
+      ],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": []
+    },
     {
       "name": "admin-shell",
       "description": "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
@@ -1329,6 +1346,28 @@
       "secrets": [],
       "writeHandlers": []
     },
+    {
+      "name": "host-routing",
+      "description": "Host- and path-based tenant routing: an authoritative tenant resolver from the subdomain (tenantBy host), a tenant existence check against enabled, active tenants, and the tenant-key query behind createHostDispatch, which picks the HTML file, CSP, locale redirect or 404 per host for runProdApp's hostDispatch.",
+      "toggleableDefault": null,
+      "requires": [
+        "auth-foundation",
+        "tenant"
+      ],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [
+        {
+          "extensionName": "tenantExistence",
+          "entityName": "active-tenant"
+        }
+      ],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": []
+    },
     {
       "name": "inbound-mail-foundation",
       "description": "Plugin host for inbound e-mail (inbox federation) — provider plugins (inbound-provider-imap, later M365 Graph / Gmail REST) register at the `inboundMailProvider` extension point with verify/fetch and optional oauth/watch (live push). The foundation owns three event-sourced streams (mail-account lifecycle, inbound-message with exactly-once ingest via deterministic aggregate ids, mail-thread rollup) and their projections `read_mail_accounts`/`read_inbound_messages`/`read_mail_threads`; PII fields are envelope-encrypted per tenant subject key before every append (crypto-shredding on tenant destroy). Wire `createInboundMailConnectRoutes` (OAuth connect + anonymous callback outside /api) and `createInboundMailSupervisor` (IDLE watch with backoff + reconciliation poll) in bin/server.ts. Consume `inbound-mail-foundation:event:inbound-message-received` from app features to attach business processes.",
@@ -2122,7 +2161,7 @@
     },
     {
       "name": "renderer-mail-html",
-      "description": "A `renderer-foundation` plugin that handles `RenderRequest { kind: \"mail\" }` and returns `{ subject, html, text, previewText? }` suitable for sending via `channel-email`. The mail template (`kind: \"mail\"`, document HTML, subject in `meta`) resolves through `template-resolver`'s DB fallback, its body is compiled to Handlebars by template-resolver and rendered with escaping, then placed into an MJML layout (`kind: \"mail-layout\"`, slug `default` unless `meta.layoutSlug` says otherwise, an in-code structured layout with the tenant branding logo and accent color as last resort) that `mjml()` compiles to email-safe table HTML, with `html-to-text` producing the plain-text alternative. An optional `footer` resolver adds the platform imprint, privacy link and footer text below every structured layout, an optional `brandSuffix` resolver adds a word after the tenant name in the brand row of the in-code layout, and an optional `siteUrl` resolver supplies the site link of the card when the tenant branding has no site URL (without either, the link is left out). The brand row and `data-resource=\"logo\"` images use the branding logo upload, or the branding logo https address when no file is uploaded. Mail meta `headerChip`, `tone` and `footerNote` add a chip beside the brand, the tone of the top line and chip, and a note above the site and unsubscribe links of the card. Seed an editable system layout with `seedSystemMailLayout(db)`. Requires `renderer-foundation` + `template-resolver`.",
+      "description": "A `renderer-foundation` plugin that handles `RenderRequest { kind: \"mail\" }` and returns `{ subject, html, text, previewText? }` suitable for sending via `channel-email`. The mail template (`kind: \"mail\"`, document HTML, subject in `meta`) resolves through `template-resolver`'s DB fallback, its body is compiled to Handlebars by template-resolver and rendered with escaping, then placed into an MJML layout (`kind: \"mail-layout\"`, slug `default` unless `meta.layoutSlug` says otherwise, an in-code structured layout with the tenant branding logo and accent color as last resort) that `mjml()` compiles to email-safe table HTML, with `html-to-text` producing the plain-text alternative. An optional `footer` resolver adds the platform imprint, privacy link and footer text below every structured layout, an optional `brandSuffix` resolver adds a word after the tenant name in the brand row of the in-code layout, and an optional `siteUrl` resolver supplies the site link of the card when the tenant branding has no site URL (without either, the link is left out). The brand row and `data-resource=\"logo\"` images use the branding logo upload, or the branding logo https address when no file is uploaded. Mail meta `headerChip`, `tone` and `footerNote` add a chip beside the brand, the tone of the top line and chip, and a note above the site and unsubscribe links of the card. `readMailChrome` hands the same brand row and footer, resolved for one locale, to pages a recipient opens from a mail, such as the unsubscribe page. Seed an editable system layout with `seedSystemMailLayout(db)`. Requires `renderer-foundation` + `template-resolver`.",
       "toggleableDefault": null,
       "requires": [
         "renderer-foundation",
@@ -2191,7 +2230,7 @@
     },
     {
       "name": "secrets",
-      "description": "Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: [\"TenantAdmin\"] }; adopt the host's role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: \"secrets:write:set\", payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.",
+      "description": "Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: [\"TenantAdmin\"] }; adopt the host's role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: SecretsHandlers.set, payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.",
       "toggleableDefault": null,
       "requires": [],
       "optionalRequires": [],
@@ -3229,7 +3268,9 @@
       "configKeys": [],
       "secrets": [],
       "writeHandlers": [
+        "waitlist:write:export",
         "waitlist:write:invite",
+        "waitlist:write:purge",
         "waitlist:write:reject",
         "waitlist:write:submit"
       ],

package/samples/apps/use-all-bundled/scripts/check-coverage.ts

@@ -23,13 +23,12 @@ const FRAMEWORK_ROOT = resolve(ROOT, "..", "..", "..");
 // Held-back exports: existieren in bundled-features, sind aber nicht
 // als runtime-feature in use-all-bundled mountbar.
 //
-// Nur Utilities ohne defineFeature (foundation-shared sowie files-provider-s3, der deprecated Alias von file-provider-s3/lib, sind pure helpers)
+// Nur Utilities ohne defineFeature (foundation-shared ist pure helpers)
 // und scaffold-only Features. Gemountete Features gehören nicht hierher.
 const EXPECTED_HELD_BACK = new Set([
-  "files-provider-s3", // deprecated alias of file-provider-s3/lib (createS3Provider helpers), kein defineFeature
   "foundation-shared", // utilities (requireDefined/requireNonEmpty), kein feature
   "page-render", // shared HTML render/cache helpers (legal/managed-pages), kein defineFeature
-  "presets", // feature-bundle helpers (dsgvoSelfServiceFeatures, securityBaselineFeatures), kein defineFeature
+  "presets", // deprecated feature-bundle helpers (dsgvoSelfServiceFeatures, securityBaselineFeatures), kein defineFeature
 ]);
 
 // Sub-paths in bundled-features's package.json exports (./tenant/seeding,