@cosmicdrift/kumiko-samples 0.386.0 → 0.388.0

package/packages/bundled-features/src/managed-pages/seeding.ts

@@ -1,6 +1,6 @@
-// Test-/Seed-Helper für managed-pages. Legt eine Page direkt über den
-// Event-Store-Executor an — gleicher Pfad wie der echte set-Handler, aber
-// ohne Access-Check. Default ifExists="skip".
+// Test/seed helper for managed-pages. Creates a page directly through the
+// event-store executor—the same path as the real set handler, but without an
+// access check. Default ifExists="skip".
 
 import {
   createEventStoreExecutor,
@@ -33,9 +33,9 @@ export type SeedPageOptions = {
 };
 
 export async function seedPage(db: DbConnection, opts: SeedPageOptions): Promise<{ id: string }> {
-  // Default-user muss user.tenantId === opts.tenantId haben (sonst landet
-  // der event-store-stream im falschen tenant-bucket → version_conflict
-  // bei späteren echten writes). TestUsers.systemAdmin ist testTenantId(1).
+  // The default user must have user.tenantId === opts.tenantId; otherwise the
+  // event-store stream ends up in the wrong tenant bucket → version_conflict
+  // on subsequent real writes. TestUsers.systemAdmin is testTenantId(1).
   const by = opts.by ?? { ...TestUsers.systemAdmin, tenantId: opts.tenantId };
   const tdb = createTenantDb({ db, tenantId: opts.tenantId, mode: "system" });
 
@@ -70,8 +70,8 @@ export async function seedPage(db: DbConnection, opts: SeedPageOptions): Promise
       if (!result.isSuccess) {
         throw new Error(`seedPage create failed: ${JSON.stringify(result)}`);
       }
-      // @cast-boundary db-row: executor.create result.data ist die inserted
-      // Drizzle-Row (Record<string, unknown>), projected nach RETURNING.
+      // @cast-boundary db-row: executor.create result.data is the inserted
+      // Drizzle row (Record<string, unknown>), projected from RETURNING.
       const data = result.data as Partial<PageRow>;
       if (data.id === undefined) {
         throw new Error("seedPage: executor.create did not return an id");

package/packages/bundled-features/src/managed-pages/table.ts

@@ -5,12 +5,13 @@ import {
   createTextField,
 } from "@cosmicdrift/kumiko-framework/engine";
 
-// Page — vom Tenant editierbare, server-gerenderte Public-Page (Landing,
-// About, custom). Pro (tenantId, slug, lang) genau eine Row. Body ist
-// Markdown (gehärtet server-gerendert über page-render). `published` gated
-// die Auslieferung an anonyme Besucher: Drafts → 404. description/ogImage
-// für SEO + Social-Preview. SYSTEM_TENANT_ID für app-weite Pages, sonst
-// Tenant-eigene Pages (Host → tenantId via resolveApexTenant am Render-Pfad).
+// Page — a tenant-editable, server-rendered public page (landing,
+// about, custom). Exactly one row per (tenantId, slug, lang). The body is
+// Markdown, rendered securely on the server via page-render. `published`
+// gates delivery to anonymous visitors: drafts return 404. description and
+// ogImage support SEO and social previews. SYSTEM_TENANT_ID is used for
+// app-wide pages; otherwise the page belongs to the tenant resolved from the
+// host via resolveApexTenant during rendering.
 export const pageEntity = createEntity({
   table: "read_pages",
   description:
@@ -38,12 +39,12 @@ export const pageEntity = createEntity({
       personal: false,
       reason: "is_business_data",
     }),
-    // Body + description sind vom Tenant-Admin authored Business-Content
-    // (Markdown), keine User-Generated-PII. `multiline` → der entityEdit-
-    // Renderer gibt ein <textarea> aus (createLongTextField hat aktuell
-    // einen Render-Gap: edit.ts/render-field.tsx gaten nur type==="text").
-    // maxLengths spiegeln die Handler-Schemas (set.write + Convention-CRUD
-    // leiten ihre zod-Caps aus diesen Field-maxLengths ab).
+    // Body and description are tenant-admin-authored business content
+    // (Markdown), not user-generated PII. `multiline` makes the entityEdit
+    // renderer output a <textarea> (createLongTextField currently has a
+    // rendering gap: edit.ts/render-field.tsx only gates on type==="text").
+    // maxLengths mirror the handler schemas (set.write and convention CRUD
+    // derive their zod caps from these field maxLengths).
     body: createTextField({
       multiline: { rows: 16 },
       maxLength: 100_000,
@@ -59,9 +60,9 @@ export const pageEntity = createEntity({
 
 export const pagesTable = buildEntityTable("page", pageEntity);
 
-// Concrete Row-Type — single-source für die benannten Werte (statt
-// `row["x"] as Y`-Casts in Handlern). entity.fields + Standard-Spalten
-// (id, version, tenantId, createdAt, updatedAt, createdBy, updatedBy).
+// Concrete row type — the single source of truth for named values instead
+// of `row["x"] as Y` casts in handlers. Includes entity.fields and standard
+// columns (id, version, tenantId, createdAt, updatedAt, createdBy, updatedBy).
 export type PageRow = {
   readonly id: string;
   readonly version: number;

package/packages/bundled-features/src/managed-pages/web/client-plugin.tsx

@@ -1,15 +1,15 @@
-// Client-Feature-Factory für managed-pages. Bringt NUR die Übersetzungen mit —
-// die Screens (page-list/page-edit/branding-settings) sind schema-driven
-// (entityList/entityEdit/configEdit), also keine custom-React-Components zu
-// registrieren. Apps mounten es in createKumikoApp({ clientFeatures:
-// [managedPagesClient()] }), damit die Admin-Labels übersetzt rendern.
+// Client feature factory for managed-pages. It provides ONLY translations —
+// the screens (page-list/page-edit/branding-settings) are schema-driven
+// (entityList/entityEdit/configEdit), so no custom React components are
+// registered. Apps mount it in createKumikoApp({ clientFeatures:
+// [managedPagesClient()] }) so the admin labels render translated.
 
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { defaultTranslations } from "./default-translations.ts";
 
 export type ManagedPagesClientOptions = {
-  /** Key-wise Overrides über die Default-Bundles (de/en). */
+  /** Key-wise overrides of the default bundles (de/en). */
   readonly translations?: TranslationsByLocale;
 };
 

package/packages/bundled-features/src/managed-pages/web/i18n.ts

@@ -56,7 +56,7 @@ export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
     en: "Delete this page?",
   },
 
-  // Nur bei allowCustomCss:true im Screen — unconditional geliefert
+  // Only used when allowCustomCss:true in the screen; supplied unconditionally
   "managed-pages:entity:__config-edit__:field:customCss": { en: "Custom CSS" },
   "managed-pages:branding.section.custom-css": { en: "Custom CSS" },
 };

package/packages/bundled-features/src/notes-history/entity.ts

@@ -15,7 +15,7 @@ import {
 // Strictly append-only by design: no update/delete write-handler is
 // registered (see feature.ts). A correction is a new entry, not an edit —
 // that is the whole point of a note *history* instead of the single
-// overwritable textarea this bundle replaces (solon#13).
+// overwritable textarea this bundle replaces.
 //
 // `body` is about the HOST entity (entityType/entityId), not the author — the
 // author is never the data subject of a note's content, so it is deliberately
@@ -24,7 +24,7 @@ import {
 // employee leaving triggers a forget), garbling unrelated business notes
 // about customers/projects/etc. — data loss, not privacy.
 //
-// `body` is instead `personal: { of: "id" }` (Row-Subject, fw#2596/#2786):
+// `body` is instead `personal: { of: "id" }` (Row-Subject):
 // the note's OWN row is its content's subject, so `body` is encrypted under a
 // per-note key that nothing else shares. That key gets erased only when the
 // note is reached by a forgotten subject: `note-mention` (below) names the
@@ -34,7 +34,7 @@ import {
 // shreds `authorName` (`personal: { of: "authorId" }`, the name as stamped at
 // write time); the two erasures are independent.
 //
-// Known gap (fw#2596, not fixed by this entity): prose that names a third
+// Known gap (not fixed by this entity): prose that names a third
 // party without a structured @-mention is not tracked — regex/NLP over
 // free text is unreliable. An operator must erase such a note's own record
 // subject (`forget-subject` kind "record", entity "note-entry") to cover it.
@@ -86,7 +86,7 @@ export function createNoteEntryEntity(
       body: createLongTextField({
         required: true,
         maxLength: 20_000,
-        // Row-Subject (fw#2596/#2786): the note itself is the subject, so its
+        // Row-Subject: the note itself is the subject, so its
         // key is erased per-note via `note-mention` lookups, not tied to any
         // user's own forget.
         personal: { of: "id" },

package/packages/bundled-features/src/notes-history/feature.ts

@@ -78,8 +78,8 @@ export type NotesHistoryFeatureOptions = {
   /** Row-level ownership on the note-entry rows themselves — orthogonal to
    *  `access`, which only gates whether a caller may dispatch create/list at
    *  all. `ownership.read` is no longer what keeps a caller from reading notes
-   *  on host entities they can't see: that gate is default-on since fw#2766
-   *  and derives from the entity's `parentRef`. Use `ownership.read` for an
+   *  on host entities they can't see: that gate is default-on and derives from
+   *  the entity's `parentRef`. Use `ownership.read` for an
    *  ADDITIONAL row rule on the note row itself (e.g. author-only visibility);
    *  it is AND-ed with the host-visibility gate, never a replacement for it.
    *

package/packages/bundled-features/src/notes-history-user-data/hooks.ts

@@ -74,7 +74,7 @@ async function selectNotesReachingSubject(
 // (entity.ts), so forgetting the AUTHOR already crypto-shreds that field on
 // its own. `body` is Row-Subject (`personal: { of: "id" }`): its key is per
 // note, so forgetting a subject only reaches a body when the note structurally
-// @-mentions the subject (`note-mention`, fw#2787) or hangs on it as host.
+// @-mentions the subject (`note-mention`) or hangs on it as host.
 // Free-text mentions are NOT detected — the documented gap in entity.ts.
 //
 // Reached bodies are shredded regardless of the host entity's retention strategy:

package/packages/bundled-features/src/page-render/layout.ts

@@ -51,19 +51,19 @@ const TENANT_CLIP = `${TENANT_SCOPE}{overflow:hidden}`;
 export function tenantStyleBlock(customCss: string): string {
   const sanitized = sanitizeTenantCss(customCss, TENANT_SCOPE);
   if (!sanitized) return "";
-  // html-ok: sanitizeTenantCss ist die Escaping-Boundary (Allowlist, strippt `<`).
+  // html-ok: sanitizeTenantCss is the escaping boundary (allowlist, strips `<`).
   return `\n<style data-tenant-css>${TENANT_CONTAINMENT}\n${TENANT_CLIP}\n${sanitized}</style>`;
 }
 
-// Minimaler HTML5-Skeleton mit Inline-CSS — Default-`wrapLayout` für
-// server-gerenderte Public-Pages, damit sie auch ohne App-Layout sauber
-// aussehen. Apps die ihr eigenes Marketing-Layout (Header/Footer/Theme)
-// um den Body legen wollen, übergeben ihre eigene Render-Function.
+// Minimal HTML5 skeleton with inline CSS — the default `wrapLayout` for
+// server-rendered public pages, so they look clean without an app layout.
+// Apps that want to wrap the body in their own marketing layout
+// (header/footer/theme) pass their own render function.
 //
-// Branding (optional): emittiert nach dem Base-`<style>` einen scoped
-// `:root`-Override (Accent-Farbe, Layout-Preset → max-width) plus einen
-// Logo-/Titel-Header. Alle Branding-Werte sind tenant-supplied + untrusted
-// und werden in branding.ts re-validiert/escaped, bevor sie ins Markup gehen.
+// Branding (optional): emits a scoped `:root` override after the base
+// `<style>` (accent color, layout preset → max-width) and a logo/title header.
+// All branding values are tenant-supplied and untrusted; branding.ts
+// revalidates/escapes them before they enter the markup.
 export function wrapInLayout(opts: {
   title: string;
   bodyHtml: string;

package/packages/bundled-features/src/page-render/markdown.ts

@@ -1,15 +1,15 @@
 import { escapeHtml, isSafeHref } from "@cosmicdrift/kumiko-renderer/headless";
 import { Marked } from "marked";
 
-// Geteilter, gehärteter Markdown→HTML-Kern für server-gerenderte Public-
-// Pages (legal-pages, managed-pages). Annahme: untrusted Tenant-Authoren.
-// Raw-HTML-Tokens werden als Text escaped (kein <script>/<img onerror>-
-// Passthrough), und link/image-hrefs auf http(s)/mailto/relativ beschränkt
-// (kein javascript:/data:). Markdown-Struktur (Headings, Listen, Links,
-// Code) bleibt intakt — das neutralisiert die XSS-Vektoren ohne Sanitizer-
-// Dependency. Defense-in-Depth ergänzt `securePageHeaders` (`script-src
-// 'none'`). GFM aus, breaks aus — strukturierte Pages brauchen keine
-// Tables/Strikethrough/Task-Lists.
+// Shared, hardened Markdown→HTML core for server-rendered public
+// pages (legal-pages, managed-pages). Assumption: untrusted tenant authors.
+// Raw HTML tokens are escaped as text (no <script>/<img onerror>-
+// passthrough), and link/image hrefs are restricted to http(s)/mailto/relative
+// (no javascript:/data:). Markdown structure (headings, lists, links,
+// code) remains intact—this neutralizes XSS vectors without a sanitizer
+// dependency. Defense in depth complements `securePageHeaders` (`script-src
+// 'none'`). GFM and breaks are disabled—structured pages do not need
+// tables/strikethrough/task lists.
 const safeRenderer = new Marked({ gfm: false, breaks: false });
 safeRenderer.use({
   walkTokens(token) {
@@ -25,7 +25,7 @@ safeRenderer.use({
 });
 
 export function renderSafeMarkdown(markdown: string): string {
-  // @cast-boundary third-party-type-gap marked.parse return-type ist `string | Promise<string>`;
-  // `{ async: false }` garantiert sync (string) — Cast nur API-Vertragsfix.
+  // @cast-boundary third-party-type-gap marked.parse return type is `string | Promise<string>`;
+  // `{ async: false }` guarantees synchronous output (string)—the cast only fixes the API contract.
   return safeRenderer.parse(markdown, { async: false }) as string;
 }

package/packages/bundled-features/src/page-render/security-headers.ts

@@ -1,9 +1,10 @@
-// Security-Header für server-gerenderte Public-HTML-Pages (legal-pages,
-// managed-pages). `script-src 'none'` ist Defense-in-Depth: selbst wenn
-// HTML-Injection durchrutscht, läuft kein Script. Bewusst KEIN `default-src`
-// → Styles/Images/Fonts bleiben unrestricted (rückwärtskompatibel zu
-// Inline-<style>-Layouts wie publicstatus' renderLegalLayout).
-// nosniff/SAMEORIGIN/Referrer-Policy sind universell sichere Defaults.
+// Security headers for server-rendered public HTML pages (legal-pages,
+// managed-pages). `script-src 'none'` provides defense in depth: even if
+// HTML injection gets through, no script can run. Deliberately omit
+// `default-src` so styles, images, and fonts remain unrestricted for
+// backward compatibility with inline-<style> layouts such as
+// publicstatus' renderLegalLayout.
+// nosniff/SAMEORIGIN/Referrer-Policy are broadly safe defaults.
 const PUBLIC_PAGE_SECURITY_HEADERS = {
   "content-security-policy": "script-src 'none'; object-src 'none'; base-uri 'none'",
   "x-content-type-options": "nosniff",

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -36,7 +36,7 @@ const PAT_REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
 
 export type BindPatAutoRevokeOnPasswordChange = (
   revoker: (userId: string) => Promise<number>,
-) => void;
+) => () => void;
 
 // Reads the late-bind setter off a mounted personal-access-tokens feature's
 // exports — run{Prod,Dev}App call this once a concrete db is available,
@@ -123,12 +123,12 @@ export function createPersonalAccessTokensFeature(
     } satisfies AuthProviderPlugin);
     // Direct-write store like store_user_sessions: create/revoke write it, the
     // resolver point-reads it. r.entity would make it a rebuildable projection
-    // whose replay (no token events) would wipe every live token (#498/#494).
+    // whose replay (no token events) would wipe every live token.
     r.storeTable(
       deriveEntityTableMeta(API_TOKEN_ENTITY_NAME, apiTokenEntity, { source: "unmanaged" }),
       {
         reason: "read_side.api_tokens_direct_write",
-        // create.write encrypts `name` via encryptForDirectWrite (#820).
+        // create.write encrypts `name` via encryptForDirectWrite.
         piiEncryptedOnWrite: true,
       },
     );
@@ -145,9 +145,9 @@ export function createPersonalAccessTokensFeature(
     // Password-change auto-revoke — mirrors sessions' own
     // autoRevokeOnPasswordChange postSave hook, including WHY it's a
     // late-bind callback rather than direct ctx.db use: user:write:user:update
-    // is r.systemScope()'d (the user aggregate is a systemStream, framework
-    // #497), so a postSave hook on "user" gets a poisoned ctx.db here. The
-    // concrete revoker is bound once run{Prod,Dev}App has a real db handle.
+    // is r.systemScope()'d (the user aggregate is a systemStream), so a postSave hook
+    // on "user" gets a poisoned ctx.db here. The concrete revoker is bound once
+    // run{Prod,Dev}App has a real db handle.
     // Explicit option wins; the runtime binding is replaceable so a second boot of the same
     // feature instance binds its own database.
     let boundAutoRevoke: ((userId: string) => Promise<number>) | undefined;
@@ -169,6 +169,9 @@ export function createPersonalAccessTokensFeature(
     });
     const bindAutoRevokeOnPasswordChange: BindPatAutoRevokeOnPasswordChange = (revoker) => {
       boundAutoRevoke = revoker;
+      return () => {
+        if (boundAutoRevoke === revoker) boundAutoRevoke = undefined;
+      };
     };
 
     const handlers = {

package/packages/bundled-features/src/personal-access-tokens/roles.ts

@@ -12,8 +12,8 @@ import { isPrincipalRowBlocked, type UserStatus, userTable } from "../user/index
 // time would keep a since-revoked admin role for the token's whole (months-long)
 // life. Returns null when the user has no membership in that tenant: removed
 // from the tenant → the PAT stops authenticating there. Also null when the
-// user's lifecycle status blocks them (fw security-welle2) — collapsed onto
-// the same "no roles" outcome as missing-membership so a blocked user's PAT
+// user's lifecycle status blocks them — collapsed onto the same "no roles"
+// outcome as missing-membership so a blocked user's PAT
 // gets an identical 401 to an unknown token (no status oracle).
 export async function resolvePatRoles(
   db: DbConnection,

package/packages/bundled-features/src/readiness/handlers/status.query.ts

@@ -22,9 +22,9 @@ export const statusQuery = defineQueryHandler({
     // One gate for both halves: required keys/secrets of provider-features
     // count only while their provider is the selected one (r.extensionSelector).
     const gate = await buildProviderSelectionGate(ctx, ReadinessQueries.status, query.user, ctx.db);
-    // skipAccessFilter: das Verdict muss ALLE required Keys zählen — der
-    // Handler selbst ist TenantAdmin-gated, der Per-Key-Filter wäre hier
-    // eine ready:true-Lüge für SystemAdmin-gated Keys (277/1).
+    // skipAccessFilter: the verdict must count ALL required keys—the
+    // Handler itself is TenantAdmin-gated; the per-key filter would falsely
+    // report ready:true for SystemAdmin-gated keys.
     const missingConfig = await collectMissingRequiredConfig(
       ctx,
       ReadinessQueries.status,

package/packages/bundled-features/src/renderer-foundation/api.ts

@@ -1,7 +1,7 @@
-// RendererFoundationApi — Cross-Feature-Schnittstelle. Konsumenten
-// (delivery, mail-Sender, Solon NKA-PDF-Generator) holen sich pro
-// Render-Call den passenden Plugin via `createRendererForTenant`.
-// Pattern symmetrisch zu ai-foundation's `createLLMProviderForTenant`.
+// RendererFoundationApi — cross-feature interface. Consumers
+// (delivery, mail sender, Solon NKA PDF generator) retrieve the appropriate
+// plugin for each render call via `createRendererForTenant`.
+// The pattern mirrors ai-foundation's `createLLMProviderForTenant`.
 
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -32,10 +32,9 @@ export type RendererFoundationApi = {
   }) => RendererPlugin;
 };
 
-// Plugin-Pool wird zur Boot-Zeit aus Extension-Usages aufgebaut.
-// Aus dem Registry kommen alle registrierten Plugins. Foundation-Feature
-// baut den Pool via `collectRendererPlugins(registry)` und steckt das
-// Result in extraContext.
+// The plugin pool is built at boot time from extension usages.
+// The registry provides all registered plugins. The foundation feature builds
+// the pool via `collectRendererPlugins(registry)` and puts it in extraContext.
 export function createRendererFoundationApi(
   plugins: ReadonlyArray<RendererPlugin>,
   tenantConfigLookup: (tenantId: TenantId) => Record<string, string> | null = () => null,
@@ -50,7 +49,7 @@ export function createRendererFoundationApi(
       if (tenantPluginName) {
         const plugin = plugins.find((p) => p.name === tenantPluginName && p.kinds.includes(kind));
         if (plugin) return plugin;
-        // Tenant-Config zeigt auf nicht-registriertes Plugin — fällt durch zu Default
+        // The tenant configuration points to an unregistered plugin; fall through to the default.
       }
 
       // 2. Default-Plugin
@@ -60,7 +59,7 @@ export function createRendererFoundationApi(
         if (plugin) return plugin;
       }
 
-      // 3. Erstes Plugin im Pool das das kind bedient
+      // 3. First plugin in the pool that serves the kind
       const first = byKind.get(kind)?.[0];
       if (first) return first;
 
@@ -85,14 +84,14 @@ function indexByKind(plugins: ReadonlyArray<RendererPlugin>): Map<RenderKind, Re
   return map;
 }
 
-// Single point of truth für "dieser Handler braucht renderer-foundation".
-// Pattern symmetrisch zu requireTemplateResolver + requireTextContent.
+// Single source of truth for handlers that require renderer-foundation.
+// The pattern mirrors requireTemplateResolver + requireTextContent.
 export function requireRendererFoundation(
   ctx: { readonly rendererFoundation?: RendererFoundationApi } | object,
   callerName: string,
 ): RendererFoundationApi {
   // @cast-boundary engine-bridge — rendererFoundation kommt per extraContext
-  // aus App-Bootstrap.
+  // from the app bootstrap.
   const api = (ctx as { rendererFoundation?: RendererFoundationApi }).rendererFoundation;
   if (!api) {
     throw new InternalError({

package/packages/bundled-features/src/renderer-foundation/constants.ts

@@ -14,8 +14,8 @@ export {
   type RenderKind,
 } from "../template-resolver/index.ts";
 
-// Standard-Default-Plugin pro Kind, wenn Tenant keine explizite Config
-// gesetzt hat. App-Bootstrap kann das via TenantConfigKey überschreiben.
+// Standard default plugin for each kind when the tenant has not set explicit configuration.
+// App bootstrap can override this through TenantConfigKey.
 export const DEFAULT_PLUGIN_BY_KIND: Readonly<Record<RenderKindLocal, string>> = {
   mail: "mail-html",
   "document-pdf": "puppeteer",

package/packages/bundled-features/src/renderer-foundation/feature.ts

@@ -24,9 +24,9 @@ export function createRendererFoundationFeature() {
 
     r.extendsRegistrar(RENDERER_EXTENSION, {
       onRegister: () => {
-        // Plugin-Konformitäts-Check könnte hier: shape-validation der
-        // options (kinds, render-Funktion present). Aktuell kein
-        // shape-check — Caller's TypeScript-Type-Sicherheit greift.
+        // Plugin conformance check could go here: validate the shape of
+        // options (kinds, render function present). No shape check currently —
+        // the caller's TypeScript type safety applies.
       },
     });
 
@@ -34,11 +34,11 @@ export function createRendererFoundationFeature() {
   });
 }
 
-// Plugin-Pool-Aufbau zur Boot-Zeit. App-Bootstrap ruft das nach
-// Feature-Registration auf, baut den Pool, gibt ihn via extraContext
-// an die Handlers weiter.
+// Build the plugin pool at boot time. App bootstrap calls this after
+// feature registration, builds the pool, and passes it to handlers via
+// extraContext.
 //
-// Symmetrisch zu collectChannels / collectRenderers in delivery-service.
+// Symmetric to collectChannels / collectRenderers in delivery-service.
 export function collectRendererPlugins(registry: Registry): RendererPlugin[] {
   const usages = registry.getExtensionUsages(RENDERER_EXTENSION);
   return usages.map((usage) => {

package/packages/bundled-features/src/renderer-foundation/types.ts

@@ -10,9 +10,9 @@ import type {
 } from "../template-resolver/index.ts";
 import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants.ts";
 
-// RenderRequest — Plugins erhalten das. Resource-Mode wählt der Caller
-// (renderer-foundation api) je nach kind oder explizit. Plugin selbst
-// entscheidet nicht — es bekommt eine schon aufgelöste Form.
+// RenderRequest — plugins receive this. The caller selects resource mode
+// (renderer-foundation API) by kind or explicitly. Plugins do not decide this;
+// they receive an already-resolved form.
 export type RenderRequest =
   | { kind: "mail"; payload: MailPayload }
   | { kind: "document-pdf"; payload: DocumentPdfPayload; options?: PdfOptions }
@@ -157,13 +157,12 @@ export type ImageOptions = {
   readonly quality?: number;
 };
 
-// RendererContext — schmale Surface (Kumiko-Style, matcht FileProviderContext
-// + ChannelContext). Plugins, die Service-Access brauchen, holen sich
-// templateResolver/etc. via direkten Bundle-Import + ctx.db (cross-feature-
-// public-API). KEIN extraContext-Pass-Through — Plugin importiert pure-
-// Function-Factories statt App-ctx zu casten.
+// RendererContext — a narrow surface (Kumiko-style, matching FileProviderContext
+// + ChannelContext). Plugins that need services obtain templateResolver/etc. via
+// direct bundle imports + ctx.db (cross-feature public API). No extraContext
+// pass-through: plugins import pure function factories instead of casting App-ctx.
 //
-// **Beispiel renderer-mail-html:**
+// **Example renderer-mail-html:**
 //   import { createTemplateResolverApi } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 //   const tplApi = createTemplateResolverApi(ctx.db, ctx.registry);
 //   const layout = await tplApi.resolveTemplate({ tenantId: ctx.tenantId, slug, kind });
@@ -178,9 +177,9 @@ export type RendererContext = {
   readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
 };
 
-// RendererPlugin-Contract — pro Plugin (renderer-mail-html,
-// renderer-puppeteer-client). Plugin deklariert welche kinds es bedienen
-// kann; Foundation-Resolver wählt basierend auf Tenant-Config + kind.
+// RendererPlugin contract — per plugin (renderer-mail-html,
+// renderer-puppeteer-client). The plugin declares which kinds it can handle;
+// the Foundation resolver selects one based on tenant config + kind.
 //
 // Plugin invariants:
 // - `kinds` has at least one entry, otherwise the plugin is never picked.

package/packages/bundled-features/src/renderer-pdf/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "renderTablePdf validates the document for direct callers",
+    "detail": "renderTablePdf parses the document against pdfTableDocumentSchema and throws RendererError invalid_payload above the row, column and cell caps. Title, subtitle, meta entries, headers, empty text, footer text and page label now have length caps and meta at most 500 entries."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/renderer-pdf/render-table-pdf.ts

@@ -7,10 +7,13 @@ import type { PdfPageFormat } from "../template-resolver/index.ts";
 const PDF_TABLE_MAX_ROWS = 10_000;
 const PDF_TABLE_MAX_COLUMNS = 30;
 const PDF_TABLE_MAX_CELL_LENGTH = 5_000;
+const PDF_TABLE_MAX_META_ENTRIES = 500;
+const PDF_TABLE_MAX_TEXT_LENGTH = 20_000;
+const PDF_TABLE_MAX_PAGE_LABEL_LENGTH = 100;
 
 const pdfTableColumnSchema = z
   .object({
-    header: z.string(),
+    header: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
     weight: z.number().positive().optional(),
     align: z.enum(["left", "right"]).optional(),
   })
@@ -18,10 +21,18 @@ const pdfTableColumnSchema = z
 
 export const pdfTableDocumentSchema = z
   .object({
-    title: z.string(),
-    subtitle: z.string().optional(),
+    title: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+    subtitle: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
     meta: z
-      .array(z.object({ label: z.string(), value: z.string() }).readonly())
+      .array(
+        z
+          .object({
+            label: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+            value: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+          })
+          .readonly(),
+      )
+      .max(PDF_TABLE_MAX_META_ENTRIES)
       .readonly()
       .optional(),
     columns: z.array(pdfTableColumnSchema).min(1).max(PDF_TABLE_MAX_COLUMNS).readonly(),
@@ -29,10 +40,10 @@ export const pdfTableDocumentSchema = z
       .array(z.array(z.string().max(PDF_TABLE_MAX_CELL_LENGTH)).readonly())
       .max(PDF_TABLE_MAX_ROWS)
       .readonly(),
-    emptyText: z.string().optional(),
-    footerText: z.string().optional(),
+    emptyText: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
+    footerText: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
     // Template with `{page}` and `{pages}`; default `"{page} / {pages}"`.
-    pageLabel: z.string().optional(),
+    pageLabel: z.string().max(PDF_TABLE_MAX_PAGE_LABEL_LENGTH).optional(),
   })
   .readonly();
 
@@ -235,12 +246,18 @@ function resolveTableLayout(
 }
 
 export async function renderTablePdf(
-  doc: PdfTableDocument,
+  untrustedDoc: PdfTableDocument,
   options?: PdfTableOptions,
 ): Promise<PdfTableResult> {
-  if (doc.columns.length === 0) {
-    throw new RendererError("table needs at least one column", "invalid_payload");
+  // Direct callers bypass renderTablePdfRequest, so the size caps are enforced here too.
+  const parsed = pdfTableDocumentSchema.safeParse(untrustedDoc);
+  if (!parsed.success) {
+    throw new RendererError(
+      `table document is invalid: ${parsed.error.message}`,
+      "invalid_payload",
+    );
   }
+  const doc = parsed.data;
   assertRowShape(doc);
 
   const pdf = await PDFDocument.create({ updateMetadata: false });

package/packages/bundled-features/src/secrets/feature.ts

@@ -71,15 +71,15 @@ export const JOIN_REQUEST_TRANSACTION_REASON =
   "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 
 // AppContext carries ctx.secrets via extraContext. requireSecretsContext
-// wraps that raw context so every `.get(...)` call auto-includes the
-// current user + handler as audit metadata — feature code can't forget
-// to log the read (silent bypass of audit was the v1 gap).
+// wraps that raw context so every `.get(...)` call automatically includes
+// the current user and handler as audit metadata, preventing feature code
+// from silently bypassing read auditing.
 //
-// Surface bewusst minimal: HandlerContext-Pfade (Set/Delete-Handler) +
-// FileProviderContext-Pfade (S3-Plugin im Worker) liefern dieselben
-// zwei Felder, also reicht die schmale ctx-shape — kein voller
-// HandlerContext-Import noetig.
-// Handler contexts carry the caller as ctx.user, provider contexts set auditUserId (takes precedence).
+// The context shape stays minimal: HandlerContext paths (Set/Delete handlers)
+// and FileProviderContext paths (the S3 plugin in the worker) provide the same
+// two fields, so importing the full HandlerContext is unnecessary.
+// Handler contexts carry the caller as ctx.user; provider contexts set
+// auditUserId, which takes precedence.
 export function requireSecretsContext(
   ctx: {
     readonly secrets?: SecretsContext;
@@ -181,7 +181,7 @@ export function createSecretsFeature(
     // Backing table: envelope/metadata/last_rotated_at + the (tenant,key)
     // uniqueIndex are not expressible via the field-DSL (jsonb-without-default,
     // now()-default), so the physical table is the DDL truth. Without this the
-    // generated migration omitted those columns → prod-500 (publicstatus#116).
+    // generated migration omitted those columns → prod-500.
     r.entity({ name: "tenant-secret", ...tenantSecretEntity, backingTable: tenantSecretsTable });
 
     // Read-audit domain-event. Registered here so ops tools + MSPs can