@cosmicdrift/kumiko-samples 0.374.0 → 0.377.0

package/packages/bundled-features/src/host-routing/options.ts

@@ -1,3 +1,4 @@
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
 // What a host (or a tenant) gets served on the HTML fallback.
@@ -20,11 +21,43 @@ export type HostRoutingLocales = {
   readonly prefixed: readonly string[];
 };
 
+// Maps a normalized hostname (lowercase, no port) that is neither the apex nor
+// a fixed host to the tenant it belongs to, e.g. a subdomain or custom domain
+// stored in an app table. Null means "no tenant here": the dispatch answers
+// 404 and the API answers tenant_required, never a default tenant. The
+// result still has to be an enabled, active tenant. Runs on every request
+// that reaches such a host, so keep it to one indexed lookup.
+export type HostTenantResolver = (
+  host: string,
+  db: DbConnection | TenantDb,
+) => Promise<TenantId | null> | TenantId | null;
+
 export type HostRoutingTenantMode =
   // <key>.<baseDomain> names the tenant.
-  | { readonly tenantBy: "host" }
+  | {
+      readonly tenantBy: "host";
+      // Also serve the tenant surface on the apex under <tenantPathPrefix>/<key>/...
+      readonly tenantPathPrefix?: string;
+    }
   // <baseDomain><tenantPathPrefix>/<key>/... names the tenant.
-  | { readonly tenantBy: "path"; readonly tenantPathPrefix: string };
+  | { readonly tenantBy: "path"; readonly tenantPathPrefix: string }
+  // The app resolves every other host itself (custom domains, profile subdomains).
+  | {
+      readonly tenantBy: HostTenantResolver;
+      readonly tenantPathPrefix?: string;
+    };
+
+// Fixed, app-configured redirect. `to` is a same-origin path or an https URL;
+// nothing from the request ever picks the target, only the matched remainder
+// of the path is appended.
+export type HostRoutingRedirect = {
+  // Path (exact or as a segment prefix, e.g. "/old" matches "/old" and "/old/x").
+  readonly from: string;
+  readonly to: string;
+  // Limits the rule to one lowercase hostname without port. Omit for every host.
+  readonly host?: string;
+  readonly status?: 301 | 302;
+};
 
 export type HostRoutingOptions = HostRoutingTenantMode & {
   // Apex host without port, e.g. "example.com". "www.<baseDomain>" counts as apex.
@@ -40,4 +73,14 @@ export type HostRoutingOptions = HostRoutingTenantMode & {
   // Tenant for anonymous API calls on the apex (e.g. SYSTEM_TENANT_ID for
   // public signup forms). Omit and the apex answers tenant_required.
   readonly apexAnonymousTenantId?: TenantId;
+  // Per apex hostname ("example.com" or "www.example.com"): the only
+  // /api/query and /api/stream types that get the apexAnonymousTenantId anchor. Other anonymous
+  // queries on that host get no tenant (tenant_required). "example.com" and
+  // "www.example.com" share one entry: a host without its own uses the other's.
+  // Other paths (e.g. /api/batch) keep the anchor for everything.
+  // Not allowed with tenantBy "path" (boot error): there the client's X-Tenant
+  // wins over the resolver, so the allowlist would be ineffective.
+  readonly apexAnonymousQueryAllowlist?: Readonly<Record<string, readonly string[]>>;
+  // Checked first, before any host classification.
+  readonly redirects?: readonly HostRoutingRedirect[];
 };

package/packages/bundled-features/src/host-routing/redirects.ts

@@ -0,0 +1,33 @@
+import { normalizeHostname } from "./host.ts";
+import type { HostRoutingRedirect } from "./options.ts";
+
+// Same-origin targets collapse leading slashes and backslashes so an appended
+// "//evil.example" remainder can never turn into a protocol-relative URL.
+export function sameOriginPath(path: string): string {
+  return `/${path.replace(/^[/\\]+/, "")}`;
+}
+
+function remainderAfter(from: string, path: string): string | null {
+  if (path === from) return "";
+  const prefix = from.endsWith("/") ? from : `${from}/`;
+  return path.startsWith(prefix) ? path.slice(prefix.length - 1) : null;
+}
+
+export function matchRedirect(
+  redirects: readonly HostRoutingRedirect[],
+  host: string,
+  path: string,
+  search: string,
+): { readonly to: string; readonly status: 301 | 302 } | undefined {
+  const hostname = normalizeHostname(host);
+  for (const rule of redirects) {
+    if (rule.host !== undefined && rule.host !== hostname) continue;
+    const remainder = remainderAfter(rule.from, path);
+    if (remainder === null) continue;
+    const target = rule.to.startsWith("https://")
+      ? `${rule.to.replace(/\/$/, "")}${remainder}`
+      : sameOriginPath(`${rule.to.replace(/\/$/, "")}${remainder}`);
+    return { to: `${target}${search}`, status: rule.status ?? 301 };
+  }
+  return undefined;
+}

package/packages/bundled-features/src/host-routing/tenant-lookup.ts

@@ -0,0 +1,65 @@
+import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  isTenantServingPublicContent,
+  type TenantLifecycleStatus,
+  tenantTable,
+} from "../tenant/index.ts";
+import { classifyHost } from "./host.ts";
+import type { HostRoutingOptions } from "./options.ts";
+
+type TenantRow = {
+  readonly id: TenantId;
+  readonly isEnabled: boolean;
+  readonly status: TenantLifecycleStatus;
+};
+
+// Disabled tenants and tenants in any destroy phase are not routable, the same
+// rule public files and pages follow.
+export async function servingTenantIdByKey(
+  db: DbConnection | TenantDb,
+  key: string,
+): Promise<TenantId | null> {
+  const row = await fetchOne<TenantRow>(db, tenantTable, { key });
+  return row !== undefined && isTenantServingPublicContent(row) ? row.id : null;
+}
+
+export async function isTenantServing(db: DbConnection | TenantDb, id: TenantId): Promise<boolean> {
+  const row = await fetchOne<TenantRow>(db, tenantTable, { id });
+  return row !== undefined && isTenantServingPublicContent(row);
+}
+
+export async function servingTenantIdByResolver(
+  options: HostRoutingOptions,
+  db: DbConnection | TenantDb,
+  hostname: string,
+): Promise<TenantId | null> {
+  if (typeof options.tenantBy !== "function") return null;
+  const resolved = await options.tenantBy(hostname, db);
+  return resolved !== null && (await isTenantServing(db, resolved)) ? resolved : null;
+}
+
+// The tenant a Host header belongs to, without any request: subdomain key,
+// resolver result or the apex anchor. Fixed and unknown hosts have none.
+// Meant for features that serve per-tenant content by host, e.g. the
+// `resolveApexTenant` option of managed-pages.
+export function createHostTenantIdResolver(
+  options: HostRoutingOptions,
+  db: DbConnection | TenantDb,
+): (host: string) => Promise<TenantId | null> {
+  return async (host) => {
+    const classified = classifyHost(host, options);
+    switch (classified.kind) {
+      case "subdomain":
+        return options.tenantBy === "host" ? servingTenantIdByKey(db, classified.key) : null;
+      case "resolved":
+        return servingTenantIdByResolver(options, db, classified.hostname);
+      case "apex":
+        return options.apexAnonymousTenantId ?? null;
+      case "fixed":
+      case "unknown":
+        return null;
+    }
+  };
+}

package/packages/bundled-features/src/host-routing/validate-options.ts

@@ -1,9 +1,51 @@
+import { isApexHostname } from "./host.ts";
 import type { HostRoutingOptions } from "./options.ts";
 
 const DOMAIN_PATTERN = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/;
 const PATH_PREFIX_PATTERN = /^\/[a-z0-9-]+(?:\/[a-z0-9-]+)*$/;
 const LOCALE_PATTERN = /^[a-z]{2}(?:-[a-z]{2})?$/;
 
+const REDIRECT_PATH_PATTERN = /^\/[A-Za-z0-9._~/-]*$/;
+// A redirect target is either a same-origin path or an https URL; neither may
+// carry a query or fragment, because the request's query string is appended.
+const REDIRECT_TARGET_PATTERN =
+  /^(?:\/(?!\/)[A-Za-z0-9._~/-]*|https:\/\/[a-z0-9.-]+(?::[0-9]{1,5})?(?:\/[A-Za-z0-9._~/-]*)?)$/;
+
+function validateRedirects(options: HostRoutingOptions): void {
+  for (const rule of options.redirects ?? []) {
+    if (!REDIRECT_PATH_PATTERN.test(rule.from)) {
+      throw new Error(`host-routing: redirect from must be a path like "/old", got "${rule.from}"`);
+    }
+    if (!REDIRECT_TARGET_PATTERN.test(rule.to)) {
+      throw new Error(
+        `host-routing: redirect to must be a same-origin path or an https URL without query, got "${rule.to}"`,
+      );
+    }
+    if (rule.host !== undefined && !DOMAIN_PATTERN.test(rule.host)) {
+      throw new Error(
+        `host-routing: redirect host must be a lowercase hostname, got "${rule.host}"`,
+      );
+    }
+  }
+}
+
+function validateAnonymousQueryAllowlist(options: HostRoutingOptions): void {
+  if (options.apexAnonymousQueryAllowlist !== undefined && options.tenantBy === "path") {
+    // Path mode resolves as fallback-only: a client-sent X-Tenant or cookie wins
+    // before the resolver runs, so the allowlist could never hold.
+    throw new Error(
+      'host-routing: apexAnonymousQueryAllowlist cannot be used with tenantBy "path", because the client names its tenant there and bypasses the allowlist',
+    );
+  }
+  for (const host of Object.keys(options.apexAnonymousQueryAllowlist ?? {})) {
+    if (!isApexHostname(host, options.baseDomain)) {
+      throw new Error(
+        `host-routing: apexAnonymousQueryAllowlist key must be the apex or www.<apex> hostname, got "${host}"`,
+      );
+    }
+  }
+}
+
 // Checked once when the app composes its features, so a config typo fails
 // the boot instead of routing every request to a 404.
 export function validateHostRoutingOptions(options: HostRoutingOptions): void {
@@ -17,11 +59,16 @@ export function validateHostRoutingOptions(options: HostRoutingOptions): void {
       throw new Error(`host-routing: hosts key must be a lowercase hostname, got "${host}"`);
     }
   }
-  if (options.tenantBy === "path" && !PATH_PREFIX_PATTERN.test(options.tenantPathPrefix)) {
+  if (
+    options.tenantPathPrefix !== undefined &&
+    !PATH_PREFIX_PATTERN.test(options.tenantPathPrefix)
+  ) {
     throw new Error(
       `host-routing: tenantPathPrefix must look like "/app" (leading slash, no trailing slash), got "${options.tenantPathPrefix}"`,
     );
   }
+  validateRedirects(options);
+  validateAnonymousQueryAllowlist(options);
   const { locales } = options;
   if (locales !== undefined) {
     for (const locale of [locales.default, ...locales.prefixed]) {

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.377.0",
+    "type": "improvement",
+    "title": "Declarative mailbox list and rename screens",
+    "detail": "The feature registers the projectionList mail-accounts (name, address, provider, status, connected; row actions rename and disconnect) and the actionForm mail-account-edit, both restricted to SystemAdmin and TenantAdmin like the handlers. The list shows several mailboxes per tenant, never a credential. Screens are dormant, so the app places the list in its own nav. MAIL_ACCOUNT_LIST_SCREEN_ID and MAIL_ACCOUNT_EDIT_SCREEN_ID are exported.",
+    "migration": "Place mail-accounts in the app nav with r.nav; no other change."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/packages/bundled-features/src/inbound-mail-foundation/feature.ts

@@ -79,6 +79,7 @@ import { ingestMessageHandler } from "./handlers/ingest-message.write.ts";
 import { listAccountsQuery } from "./handlers/list-accounts.query.ts";
 import { listMessagesQuery } from "./handlers/list-messages.query.ts";
 import { updateAccountHandler } from "./handlers/update-account.write.ts";
+import { INBOUND_MAIL_FOUNDATION_I18N } from "./i18n.ts";
 import {
   applyInboundMessageReceived,
   applyMailAccountConnected,
@@ -90,6 +91,7 @@ import {
   mailThreadsProjectionTable,
 } from "./projection.ts";
 import { runInboundMailRetention } from "./retention-sweep.ts";
+import { mailAccountEditScreen, mailAccountListScreen } from "./screens.ts";
 import {
   INBOUND_MAIL_TENANT_DESTROY_ARCHIVE_REASON,
   inboundMessageTenantDestroyHook,
@@ -195,6 +197,12 @@ export function createInboundMailFoundationFeature() {
       r.queryHandler(listAccountsQuery);
       r.queryHandler(listMessagesQuery);
 
+      // Declarative mailbox admin: list (rename, disconnect) and rename form.
+      // The app places `mailAccountListScreen` via r.nav in its settings area.
+      r.screen(mailAccountListScreen);
+      r.screen(mailAccountEditScreen);
+      r.translations({ keys: INBOUND_MAIL_FOUNDATION_I18N });
+
       // Entity-genaue GDPR-Destroy-Hooks — der gdpr-storage-Boot-Validator
       // prueft die EXT_TENANT_DATA-Registrierung pro tenant-subject-Entity.
       r.useExtension(EXT_TENANT_DATA, "mail-account", {

package/packages/bundled-features/src/inbound-mail-foundation/i18n.ts

@@ -0,0 +1,42 @@
+import { ACTION_FORM_ENTITY } from "@cosmicdrift/kumiko-framework/ui-types";
+import { fieldLabelKey } from "@cosmicdrift/kumiko-renderer/headless";
+import { INBOUND_MAIL_FOUNDATION_FEATURE, InboundMailAccountStatuses } from "./constants.ts";
+import {
+  MAIL_ACCOUNT_EDIT_SCREEN_ID,
+  MAIL_ACCOUNT_LIST_SCREEN_ID,
+  MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX,
+} from "./screens.ts";
+
+const formFieldKey = (field: string): string =>
+  fieldLabelKey(INBOUND_MAIL_FOUNDATION_FEATURE, ACTION_FORM_ENTITY, field);
+
+export const INBOUND_MAIL_FOUNDATION_I18N: Readonly<Record<string, { readonly en: string }>> = {
+  [`screen:${MAIL_ACCOUNT_LIST_SCREEN_ID}.title`]: { en: "Mailboxes" },
+  [`screen:${MAIL_ACCOUNT_EDIT_SCREEN_ID}.title`]: { en: "Edit mailbox" },
+  "inboundMail.accounts.col.name": { en: "Name" },
+  "inboundMail.accounts.col.address": { en: "Address" },
+  "inboundMail.accounts.col.provider": { en: "Provider" },
+  "inboundMail.accounts.col.status": { en: "Status" },
+  "inboundMail.accounts.col.connected": { en: "Connected" },
+  [`${MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX}${InboundMailAccountStatuses.active}`]: {
+    en: "Active",
+  },
+  [`${MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX}${InboundMailAccountStatuses.authError}`]: {
+    en: "Sign-in failed",
+  },
+  [`${MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX}${InboundMailAccountStatuses.degraded}`]: {
+    en: "Interrupted",
+  },
+  [`${MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX}${InboundMailAccountStatuses.disconnected}`]: {
+    en: "Disconnected",
+  },
+  "inboundMail.accounts.edit": { en: "Rename" },
+  "inboundMail.accounts.edit.submit": { en: "Save" },
+  "inboundMail.accounts.disconnect": { en: "Disconnect" },
+  "inboundMail.accounts.disconnect.confirm": {
+    en: "Disconnect this mailbox? No new mail is fetched; stored mail is kept.",
+  },
+  [formFieldKey("accountId")]: { en: "Mailbox" },
+  [formFieldKey("displayName")]: { en: "Name" },
+  [formFieldKey("reason")]: { en: "Reason" },
+};

package/packages/bundled-features/src/inbound-mail-foundation/index.ts

@@ -77,6 +77,10 @@ export {
   resolveInboundProviderForAccount,
   resolveInboundProviderForKey,
 } from "./provider-factory.ts";
+export {
+  MAIL_ACCOUNT_EDIT_SCREEN_ID,
+  MAIL_ACCOUNT_LIST_SCREEN_ID,
+} from "./screens.ts";
 export {
   InboundAuthError,
   InboundCursorInvalidError,

package/packages/bundled-features/src/inbound-mail-foundation/screens.ts

@@ -0,0 +1,100 @@
+import {
+  i18nKey,
+  MAX_LIST_LIMIT,
+  type ProjectionListScreenDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import type { ActionFormScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
+import {
+  InboundMailAccountStatuses,
+  InboundMailFoundationHandlers,
+  InboundMailFoundationQueries,
+} from "./constants.ts";
+
+export const MAIL_ACCOUNT_LIST_SCREEN_ID = "mail-accounts";
+export const MAIL_ACCOUNT_EDIT_SCREEN_ID = "mail-account-edit";
+
+export const MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX = "inboundMail.accounts.status.";
+
+// Same roles as the update/disconnect handlers: a screen rule wider than the
+// handlers would only render actions that 403.
+const MAIL_ACCOUNT_ADMIN_ACCESS = { roles: ["SystemAdmin", "TenantAdmin"] } as const;
+
+// Several mailboxes per tenant, one row each. The bound query already filters
+// personal mailboxes the caller neither owns nor administers and returns no
+// credential: the secret lives in the secrets feature, never in the row.
+// dormant: the consuming app places the list in its own settings nav.
+export const mailAccountListScreen: ProjectionListScreenDefinition = {
+  id: MAIL_ACCOUNT_LIST_SCREEN_ID,
+  type: "projectionList",
+  agent: { expose: false },
+  query: InboundMailFoundationQueries.listAccounts,
+  pagination: false,
+  pageSize: MAX_LIST_LIMIT,
+  columns: [
+    { field: "displayName", label: i18nKey("inboundMail.accounts.col.name"), sortable: false },
+    { field: "address", label: i18nKey("inboundMail.accounts.col.address"), sortable: false },
+    {
+      field: "provider",
+      label: i18nKey("inboundMail.accounts.col.provider"),
+      sortable: false,
+      hideOnNarrow: true,
+    },
+    {
+      field: "status",
+      label: i18nKey("inboundMail.accounts.col.status"),
+      sortable: false,
+      renderer: { format: "enumOption", keyPrefix: MAIL_ACCOUNT_STATUS_OPTION_KEY_PREFIX },
+    },
+    {
+      field: "connectedAt",
+      label: i18nKey("inboundMail.accounts.col.connected"),
+      sortable: false,
+      hideOnNarrow: true,
+      renderer: { format: "timestamp" },
+    },
+  ],
+  rowActions: [
+    {
+      kind: "navigate",
+      id: "edit",
+      label: i18nKey("inboundMail.accounts.edit"),
+      screen: MAIL_ACCOUNT_EDIT_SCREEN_ID,
+      params: { map: { accountId: "id", displayName: "displayName" } },
+      visible: { field: "status", ne: InboundMailAccountStatuses.disconnected },
+    },
+    {
+      kind: "writeHandler",
+      id: "disconnect",
+      label: i18nKey("inboundMail.accounts.disconnect"),
+      handler: InboundMailFoundationHandlers.disconnectAccount,
+      payload: { map: { accountId: "id" } },
+      style: "danger",
+      confirm: i18nKey("inboundMail.accounts.disconnect.confirm"),
+      visible: { field: "status", ne: InboundMailAccountStatuses.disconnected },
+    },
+  ],
+  access: MAIL_ACCOUNT_ADMIN_ACCESS,
+  dormant: true,
+};
+
+// The reason is the audit label update-account requires; it is not in the
+// layout, so the default is what gets written.
+export const mailAccountEditScreen: ActionFormScreenDefinition = {
+  id: MAIL_ACCOUNT_EDIT_SCREEN_ID,
+  type: "actionForm",
+  agent: { expose: false },
+  handler: InboundMailFoundationHandlers.updateAccount,
+  fields: {
+    accountId: { type: "text", required: true },
+    displayName: { type: "text", required: true, maxLength: 200 },
+    reason: { type: "text", default: "tenant_admin" },
+  },
+  layout: {
+    sections: [{ fields: [{ field: "accountId", readOnly: true }, "displayName"] }],
+  },
+  submitLabel: i18nKey("inboundMail.accounts.edit.submit"),
+  redirect: MAIL_ACCOUNT_LIST_SCREEN_ID,
+  cancelTarget: MAIL_ACCOUNT_LIST_SCREEN_ID,
+  access: MAIL_ACCOUNT_ADMIN_ACCESS,
+  dormant: true,
+};

package/packages/bundled-features/src/inbound-mail-foundation/types.ts

@@ -21,7 +21,7 @@ import { INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus } from "
  *   config   — tenant config reads (host/port/... of the plugins)
  *   registry — extension lookup in the factory (not plugin-internal)
  *   secrets  — tenant secret reads (IMAP password, OAuth refresh token)
- *   _userId  — audit identity for secret reads. Handler path: the dispatcher
+ *   auditUserId  — audit identity for secret reads. Handler path: the dispatcher
  *              sets the caller user ID; worker path: system identity.
  *   metricsFor — metrics handle of a feature by name, same behavior as
  *              HandlerContext.metricsFor: unregistered metrics are a silent
@@ -31,7 +31,7 @@ export type InboundMailContext = {
   readonly config?: ConfigAccessor;
   readonly registry?: Registry;
   readonly secrets?: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext;
-  readonly _userId?: string | undefined;
+  readonly auditUserId?: string | undefined;
   readonly metricsFor?: (featureName: string) => MetricsHandle;
 };
 

package/packages/bundled-features/src/jobs/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { JOBS_FEATURE } from "../constants.ts";
 import { defaultTranslations } from "./i18n.ts";
 

package/packages/bundled-features/src/legal-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.376.0",
+    "type": "improvement",
+    "title": "Legal layout receives alternates",
+    "detail": "createLegalPagesLayout passes alternates as second argument to headerHtml and footerHtml, and legal-pages routes provide the other-language paths of the same slug, so a layout can render a language switch."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/legal-pages/feature.ts

@@ -4,7 +4,7 @@ import {
   type FeatureDefinition,
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { escapeHtml } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import {
   cachedSecurePageResponse,
   type PublicPageWrapLayout,
@@ -90,6 +90,17 @@ export type LegalPagesOptions = {
   readonly terms?: boolean;
 };
 
+// Only slugs served in more than one language get alternates.
+function alternatesBySlugOf(
+  routes: readonly LegalPageRoute[],
+): ReadonlyMap<string, Readonly<Record<string, string>>> {
+  const bySlug = new Map<string, Record<string, string>>();
+  for (const route of routes) {
+    bySlug.set(route.slug, { ...bySlug.get(route.slug), [route.lang]: route.path });
+  }
+  return new Map([...bySlug].filter(([, byLang]) => Object.keys(byLang).length > 1));
+}
+
 export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDefinition {
   const wrapLayout = opts.wrapLayout ?? wrapInLayout;
   const routes: readonly LegalPageRoute[] = [
@@ -108,6 +119,7 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
       );
     }
   }
+  const alternatesBySlug = alternatesBySlugOf(routes);
   return defineFeature("legal-pages", (r) => {
     r.describe(
       "Opt-in wrapper around `template-resolver` text-blocks that registers public HTML routes (default: `/legal/impressum`, `/legal/datenschutz`, `/legal/imprint`, `/legal/privacy`) with Markdown-to-HTML rendering and a boot-time job that hard-fails in production when the required blocks (default: `imprint/de`, `privacy/de`) are not seeded in `SYSTEM_TENANT`. Both are configurable via `routes`/`requiredBlocks` for apps with a different default language or additional pages. Requires `anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID }` and `extraContext.templateResolver` to be wired at app bootstrap; for per-tenant imprints or a custom layout call `template-resolver:query:by-slug` directly.",
@@ -189,6 +201,7 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
               : renderedBody,
             lang: route.lang,
             slug: route.slug,
+            alternates: alternatesBySlug.get(route.slug),
           });
 
           return cachedSecurePageResponse(c.req.raw, {

package/packages/bundled-features/src/legal-pages/layout.ts

@@ -1,4 +1,4 @@
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 import { type PublicPageWrapLayout, TENANT_CONTENT_ATTR } from "../page-render/index.ts";
 
 export type LegalPagesLayoutOptions = {
@@ -8,8 +8,8 @@ export type LegalPagesLayoutOptions = {
   readonly css?: string;
   readonly stylesheetHrefs?: readonly string[];
   // Trusted app chrome per language; the feature passes the route's `lang`.
-  readonly headerHtml?: (lang: string) => string;
-  readonly footerHtml?: (lang: string) => string;
+  readonly headerHtml?: (lang: string, alternates?: Readonly<Record<string, string>>) => string;
+  readonly footerHtml?: (lang: string, alternates?: Readonly<Record<string, string>>) => string;
   readonly contentClass?: string;
 };
 
@@ -22,9 +22,9 @@ export function createLegalPagesLayout(options: LegalPagesLayoutOptions): Public
   const contentClass = options.contentClass
     ? ` class="${escapeHtmlAttr(options.contentClass)}"`
     : "";
-  return ({ title, bodyHtml, lang }) => {
-    const headerHtml = options.headerHtml?.(lang) ?? "";
-    const footerHtml = options.footerHtml?.(lang) ?? "";
+  return ({ title, bodyHtml, lang, alternates }) => {
+    const headerHtml = options.headerHtml?.(lang, alternates) ?? "";
+    const footerHtml = options.footerHtml?.(lang, alternates) ?? "";
     return `<!doctype html>
 <html lang="${escapeHtmlAttr(lang)}">
 <head>

package/packages/bundled-features/src/legal-pages/web/client-plugin.ts

@@ -17,7 +17,7 @@
 // fehlende Pflicht-Blocks.
 
 import type { TreeChildrenSubscribe, TreeNode } from "@cosmicdrift/kumiko-framework/engine";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { LEGAL_OPTIONAL_BLOCKS, LEGAL_REQUIRED_BLOCKS } from "../constants.ts";
 
 const treeProvider: TreeChildrenSubscribe = () => (emit) => {

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -58,34 +58,33 @@ export const MAIL_TRANSPORT_EXTENSION = "mailTransport" as const;
 // =============================================================================
 
 /**
- * Schmaler Surface-Type fuer Transport-Plugins — gespiegelt von
- * file-foundation's FileProviderContext. HandlerContext ist zu fett
- * (haelt tx, actor, signal etc.); Plugins beschraenken sich auf die
- * read-Felder die fuer Tenant-Config + Secret-Lookup noetig sind.
+ * Narrow surface type for transport plugins, mirroring file-foundation's
+ * FileProviderContext. HandlerContext carries tx, actor, signal and more;
+ * plugins only get the read fields needed for tenant config and secret lookup.
  *
- * **Warum nicht voller HandlerContext?** Im Worker-Pfad (r.job-getriggerte
- * Transport-Builds, z.B. der user-data-rights forget/export-Cron) gibt es
- * keinen per-request `config`/`tx`/`actor` — der Wrapper baut den per-Tenant-
- * ConfigAccessor aus `ctx.configResolver`. Ein Plugin das `ctx.tx` oder
- * andere request-only-Felder liest, wuerde den Worker-Pfad zur Runtime
- * brechen — und das fiele NUR mit echtem SMTP und nur in production auf.
- * Cast `ctx as unknown as HandlerContext` macht den Compiler happy, fliegt
- * aber zur Runtime im Worker. Plugin das mehr braucht: MailTransportContext
- * explizit erweitern (sichtbarer breaking change) statt ctx-cast.
+ * **Why not the full HandlerContext?** On the worker path (transport builds
+ * triggered by r.job, such as the user-data-rights forget/export cron) there
+ * is no per-request `config`/`tx`/`actor`; the wrapper builds the per-tenant
+ * ConfigAccessor from `ctx.configResolver`. A plugin reading `ctx.tx` or other
+ * request-only fields would break the worker path at runtime, and that would
+ * only show up with real SMTP in production. Casting
+ * `ctx as unknown as HandlerContext` satisfies the compiler but fails at
+ * runtime in the worker. A plugin that needs more extends MailTransportContext
+ * explicitly (a visible breaking change) instead of casting ctx.
  *
- * **Felder:**
- *   config   — tenant-config-reads (host/port/from/... der Plugins)
- *   registry — extension-Lookup in der Factory (nicht plugin-intern)
- *   secrets  — tenant-secret-reads (smtp.password)
- *   _userId  — Audit-Identity fuer secret-reads. Handler-Pfad: dispatcher
- *              setzt Caller-User-ID; Worker-Pfad: r.job-Wrap setzt eine
- *              System-Identity.
+ * **Fields:**
+ *   config      — tenant config reads (the plugin's host/port/from/...)
+ *   registry    — extension lookup in the factory (not plugin-internal)
+ *   secrets     — tenant secret reads (smtp.password)
+ *   auditUserId — audit identity for secret reads. Handler path: the
+ *                 dispatcher sets the caller's user id; worker path: the
+ *                 r.job wrap sets a system identity.
  */
 export type MailTransportContext = {
   readonly config?: ConfigAccessor;
   readonly registry?: Registry;
   readonly secrets?: import("@cosmicdrift/kumiko-framework/secrets").SecretsContext;
-  readonly _userId?: string | undefined;
+  readonly auditUserId?: string | undefined;
 };
 
 /**
@@ -283,7 +282,7 @@ export function tenantMailTransport(
       config: scope.config,
       registry: scope.registry,
       secrets: scope.secrets,
-      _userId: createSystemUser(scope.tenantId).id,
+      auditUserId: createSystemUser(scope.tenantId).id,
     },
     scope.tenantId,
     "channel-email",

package/packages/bundled-features/src/managed-pages/web/client-plugin.tsx

@@ -6,7 +6,7 @@
 // [managedPagesClient()] }), damit die Admin-Labels übersetzt rendern.
 
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { defaultTranslations } from "./i18n.ts";
 
 export type ManagedPagesClientOptions = {

package/packages/bundled-features/src/notes-history/web/client-plugin.tsx

@@ -1,6 +1,6 @@
 // @runtime client
 
-import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { NOTES_HISTORY_FEATURE_NAME, NOTES_SECTION_EXTENSION_NAME } from "../constants.ts";
 import { defaultTranslations } from "./i18n.ts";
 import { NotesSection } from "./notes-section.tsx";

package/packages/bundled-features/src/page-render/branding.ts

@@ -1,4 +1,4 @@
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 
 // Tenant-branding tokens resolved at render time (managed-pages reads them
 // from config — see managed-pages/branding.ts). Empty string = "unset, use