@cosmicdrift/kumiko-samples 0.393.0 → 0.394.0

package/packages/bundled-features/src/inbound-provider-imap/screens.ts

@@ -1,125 +1,219 @@
 import {
   IMAP_CONNECT_SCREEN_ID,
   IMAP_RECONNECT_SCREEN_ID,
+  type InboundMailRoles,
   MAIL_ACCOUNT_LIST_SCREEN_QN,
+  MY_IMAP_CONNECT_SCREEN_ID,
+  MY_IMAP_RECONNECT_SCREEN_ID,
+  MY_MAIL_ACCOUNT_LIST_SCREEN_QN,
 } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { i18nKey } from "@cosmicdrift/kumiko-framework/engine";
 import type { ActionFormScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
 import { ImapHandlers, ImapQueries, SMTP_SUBMISSION_PORT } from "./constants.ts";
 
-// Reached from the toolbar of the foundation's mail account list, never from the nav.
-export const imapConnectScreen: ActionFormScreenDefinition = {
-  id: IMAP_CONNECT_SCREEN_ID,
-  type: "actionForm",
-  agent: { expose: false },
-  handler: ImapHandlers.connectMailbox,
-  fields: {
-    displayName: { type: "text", required: true, maxLength: 200 },
-    address: { type: "text", required: true, maxLength: 320, format: "email" },
-    host: { type: "text", required: true, maxLength: 255 },
-    port: {
-      type: "number",
-      integer: true,
-      grouping: false,
-      required: true,
-      min: 1,
-      max: 65535,
-      default: 993,
-    },
-    user: { type: "text", required: true, maxLength: 320 },
-    password: { type: "text", required: true, format: "password", sensitive: true },
-    smtpHost: { type: "text", maxLength: 255 },
-    smtpPort: {
-      type: "number",
-      integer: true,
-      grouping: false,
-      required: true,
-      min: 1,
-      max: 65535,
-      default: SMTP_SUBMISSION_PORT,
-    },
-  },
-  layout: {
-    sections: [
-      // The name-based icon guess reads "address" as a postal address.
-      { fields: ["displayName", { field: "address", icon: "mail" }] },
-      {
-        title: i18nKey("inboundMail.imap.connect.server"),
-        fields: ["host", "port", "user", "password"],
+// The admin form connects a shared mailbox, the member form a personal one. The member form carries
+// no sender-check field because that policy is tenant-wide and only admins set it.
+function createConnectScreen(variant: {
+  readonly id: string;
+  readonly handler: string;
+  readonly roles: readonly string[];
+  readonly returnTarget: string;
+  readonly withSenderCheck: boolean;
+}): ActionFormScreenDefinition {
+  return {
+    id: variant.id,
+    type: "actionForm",
+    agent: { expose: false },
+    handler: variant.handler,
+    fields: {
+      displayName: { type: "text", required: true, maxLength: 200 },
+      address: { type: "text", required: true, maxLength: 320, format: "email" },
+      host: { type: "text", required: true, maxLength: 255 },
+      port: {
+        type: "number",
+        integer: true,
+        grouping: false,
+        required: true,
+        min: 1,
+        max: 65535,
+        default: 993,
       },
-      {
-        title: i18nKey("inboundMail.imap.connect.outgoing"),
-        description: i18nKey("inboundMail.imap.connect.outgoingHint"),
-        fields: ["smtpHost", "smtpPort"],
+      user: { type: "text", required: true, maxLength: 320 },
+      password: { type: "text", required: true, format: "password", sensitive: true },
+      smtpHost: { type: "text", maxLength: 255 },
+      smtpPort: {
+        type: "number",
+        integer: true,
+        grouping: false,
+        required: true,
+        min: 1,
+        max: 65535,
+        default: SMTP_SUBMISSION_PORT,
       },
-    ],
-  },
-  submitLabel: i18nKey("inboundMail.imap.connect.submit"),
-  redirect: MAIL_ACCOUNT_LIST_SCREEN_QN,
-  cancelTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
-  access: { roles: ["SystemAdmin", "TenantAdmin"] },
-  dormant: true,
-};
+      ...(variant.withSenderCheck && { trustedAuthservId: { type: "text", maxLength: 255 } }),
+    },
+    layout: {
+      sections: [
+        // The name-based icon guess reads "address" as a postal address.
+        { fields: ["displayName", { field: "address", icon: "mail" }] },
+        {
+          title: i18nKey("inboundMail.imap.connect.server"),
+          fields: ["host", "port", "user", "password"],
+        },
+        {
+          title: i18nKey("inboundMail.imap.connect.outgoing"),
+          description: i18nKey("inboundMail.imap.connect.outgoingHint"),
+          fields: ["smtpHost", "smtpPort"],
+        },
+        ...(variant.withSenderCheck
+          ? [
+              {
+                title: i18nKey("inboundMail.imap.connect.senderCheck"),
+                description: i18nKey("inboundMail.imap.connect.senderCheckHint"),
+                fields: ["trustedAuthservId"],
+              },
+            ]
+          : []),
+      ],
+    },
+    submitLabel: i18nKey("inboundMail.imap.connect.submit"),
+    redirect: variant.returnTarget,
+    cancelTarget: variant.returnTarget,
+    access: { roles: [...variant.roles] },
+    dormant: true,
+  };
+}
+
+// Reached from the toolbar of the foundation's mail account list, never from the nav.
+export const createImapConnectScreen = ({
+  adminRoles,
+}: InboundMailRoles): ActionFormScreenDefinition =>
+  createConnectScreen({
+    id: IMAP_CONNECT_SCREEN_ID,
+    handler: ImapHandlers.connectMailbox,
+    roles: adminRoles,
+    returnTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
+    withSenderCheck: true,
+  });
+
+// Reached from the toolbar of "My mail accounts".
+export const createMyImapConnectScreen = ({
+  memberRoles,
+}: InboundMailRoles): ActionFormScreenDefinition =>
+  createConnectScreen({
+    id: MY_IMAP_CONNECT_SCREEN_ID,
+    handler: ImapHandlers.connectMyMailbox,
+    roles: memberRoles,
+    returnTarget: MY_MAIL_ACCOUNT_LIST_SCREEN_QN,
+    withSenderCheck: false,
+  });
 
 // Reached from the "Reconnect" row action of an account with a sign-in error. The record id comes
 // from the path; the load query returns the stored server settings, never the password.
-export const imapReconnectScreen: ActionFormScreenDefinition = {
-  id: IMAP_RECONNECT_SCREEN_ID,
-  type: "actionForm",
-  agent: { expose: false },
-  handler: ImapHandlers.reconnectMailbox,
-  load: { query: ImapQueries.reconnectPrefill, idParam: "accountId" },
-  fields: {
-    accountId: { type: "text", required: true },
-    displayName: { type: "text", maxLength: 200 },
-    host: { type: "text", required: true, maxLength: 255 },
-    port: {
-      type: "number",
-      integer: true,
-      grouping: false,
-      required: true,
-      min: 1,
-      max: 65535,
-      default: 993,
-    },
-    user: { type: "text", required: true, maxLength: 320 },
-    password: { type: "text", required: true, format: "password", sensitive: true },
-    smtpHost: { type: "text", maxLength: 255 },
-    smtpPort: {
-      type: "number",
-      integer: true,
-      grouping: false,
-      required: true,
-      min: 1,
-      max: 65535,
-      default: SMTP_SUBMISSION_PORT,
-    },
-  },
-  layout: {
-    sections: [
-      {
-        title: i18nKey("inboundMail.imap.connect.server"),
-        description: i18nKey("inboundMail.imap.reconnect.hint"),
-        // The id only travels in the payload; the admin recognises the mailbox by its name.
-        fields: [
-          { field: "accountId", visible: false },
-          { field: "displayName", readOnly: true, submit: false },
-          "host",
-          "port",
-          "user",
-          "password",
-        ],
+// The admin and the owner variant share this form; the owner's carries no sender-check field
+// because that policy is tenant-wide and only admins set it.
+function createReconnectScreen(variant: {
+  readonly id: string;
+  readonly roles: readonly string[];
+  readonly returnTarget: string;
+  readonly withSenderCheck: boolean;
+}): ActionFormScreenDefinition {
+  return {
+    id: variant.id,
+    type: "actionForm",
+    agent: { expose: false },
+    handler: ImapHandlers.reconnectMailbox,
+    load: { query: ImapQueries.reconnectPrefill, idParam: "accountId" },
+    fields: {
+      accountId: { type: "text", required: true },
+      displayName: { type: "text", maxLength: 200 },
+      host: { type: "text", required: true, maxLength: 255 },
+      port: {
+        type: "number",
+        integer: true,
+        grouping: false,
+        required: true,
+        min: 1,
+        max: 65535,
+        default: 993,
       },
-      {
-        title: i18nKey("inboundMail.imap.connect.outgoing"),
-        description: i18nKey("inboundMail.imap.connect.outgoingHint"),
-        fields: ["smtpHost", "smtpPort"],
+      user: { type: "text", required: true, maxLength: 320 },
+      password: { type: "text", required: true, format: "password", sensitive: true },
+      smtpHost: { type: "text", maxLength: 255 },
+      smtpPort: {
+        type: "number",
+        integer: true,
+        grouping: false,
+        required: true,
+        min: 1,
+        max: 65535,
+        default: SMTP_SUBMISSION_PORT,
       },
-    ],
-  },
-  submitLabel: i18nKey("inboundMail.imap.reconnect.submit"),
-  redirect: MAIL_ACCOUNT_LIST_SCREEN_QN,
-  cancelTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
-  access: { roles: ["SystemAdmin", "TenantAdmin"] },
-  dormant: true,
-};
+      ...(variant.withSenderCheck && { trustedAuthservId: { type: "text", maxLength: 255 } }),
+    },
+    layout: {
+      sections: [
+        {
+          title: i18nKey("inboundMail.imap.connect.server"),
+          description: i18nKey("inboundMail.imap.reconnect.hint"),
+          // The id only travels in the payload; the user recognises the mailbox by its name.
+          fields: [
+            { field: "accountId", visible: false },
+            { field: "displayName", readOnly: true, submit: false },
+            "host",
+            "port",
+            "user",
+            "password",
+          ],
+        },
+        {
+          title: i18nKey("inboundMail.imap.connect.outgoing"),
+          description: i18nKey("inboundMail.imap.connect.outgoingHint"),
+          fields: ["smtpHost", "smtpPort"],
+        },
+        ...(variant.withSenderCheck
+          ? [
+              {
+                title: i18nKey("inboundMail.imap.connect.senderCheck"),
+                description: i18nKey("inboundMail.imap.connect.senderCheckHint"),
+                fields: ["trustedAuthservId"],
+              },
+            ]
+          : []),
+      ],
+    },
+    submitLabel: i18nKey("inboundMail.imap.reconnect.submit"),
+    redirect: variant.returnTarget,
+    cancelTarget: variant.returnTarget,
+    access: { roles: [...variant.roles] },
+    dormant: true,
+  };
+}
+
+export const createImapReconnectScreen = ({
+  adminRoles,
+}: InboundMailRoles): ActionFormScreenDefinition =>
+  createReconnectScreen({
+    id: IMAP_RECONNECT_SCREEN_ID,
+    roles: adminRoles,
+    returnTarget: MAIL_ACCOUNT_LIST_SCREEN_QN,
+    withSenderCheck: true,
+  });
+
+// Reached from the "Reactivate" row action of "My mail accounts".
+export const createMyImapReconnectScreen = ({
+  memberRoles,
+}: InboundMailRoles): ActionFormScreenDefinition =>
+  createReconnectScreen({
+    id: MY_IMAP_RECONNECT_SCREEN_ID,
+    roles: memberRoles,
+    returnTarget: MY_MAIL_ACCOUNT_LIST_SCREEN_QN,
+    withSenderCheck: false,
+  });
+
+export const createImapScreens = (roles: InboundMailRoles): ActionFormScreenDefinition[] => [
+  createImapConnectScreen(roles),
+  createImapReconnectScreen(roles),
+  createMyImapConnectScreen(roles),
+  createMyImapReconnectScreen(roles),
+];

package/packages/bundled-features/src/inbound-provider-imap/send-mail.ts

@@ -9,8 +9,9 @@ import {
   type MailAccountRecord,
   MailSendNotConfiguredError,
   MailSendRejectedError,
+  type OutboundAttachment,
   type OutboundMailMessage,
-  type OutboundMailSent,
+  type ProviderSentMail,
 } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import MailComposer from "nodemailer/lib/mail-composer";
 import { FEATURE_NAME } from "./constants.ts";
@@ -37,7 +38,8 @@ export async function sendFromImapAccount(
   ctx: InboundMailContext,
   account: MailAccountRecord,
   message: OutboundMailMessage,
-): Promise<OutboundMailSent> {
+  attachments: readonly OutboundAttachment[],
+): Promise<ProviderSentMail> {
   const doc = await readCredentialDocument(ctx, account);
   if (!doc.smtpHost || !doc.password) {
     throw new MailSendNotConfiguredError(
@@ -55,6 +57,13 @@ export async function sendFromImapAccount(
     ...(message.html !== undefined && { html: message.html }),
     ...(message.inReplyTo && { inReplyTo: message.inReplyTo }),
     ...(message.references && { references: [...message.references] }),
+    ...(attachments.length > 0 && {
+      attachments: attachments.map((attachment) => ({
+        filename: attachment.fileName,
+        contentType: attachment.mimeType,
+        content: Buffer.from(attachment.data),
+      })),
+    }),
   }).compile();
   const raw = await mime.build();
 

package/packages/bundled-features/src/inbound-provider-imap/sender-auth-headers.ts

@@ -0,0 +1,36 @@
+import {
+  fromDomainOf,
+  parseSenderAuthentication,
+  type SenderAuthentication,
+} from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
+import type { ParsedMail } from "mailparser";
+
+const HEADER_NAME = "authentication-results";
+
+// headerLines keeps every occurrence in file order, topmost first. Unlike `headers`, which merges
+// repeated headers, the order is what the trust rule depends on.
+function authenticationResultValues(parsed: ParsedMail): string[] {
+  return parsed.headerLines
+    .filter((header) => header.key === HEADER_NAME)
+    .map((header) => header.line.slice(header.line.indexOf(":") + 1));
+}
+
+// A From header with addresses of several domains cannot be bound to one DMARC verdict.
+function singleFromDomain(parsed: ParsedMail): string | null {
+  const domains = new Set(
+    (parsed.from?.value ?? []).map((address) => fromDomainOf(address.address ?? "")),
+  );
+  const [only] = domains;
+  return domains.size === 1 && only ? only : null;
+}
+
+export function senderAuthenticationOf(
+  parsed: ParsedMail,
+  trustedAuthservId: string | null,
+): SenderAuthentication | null {
+  return parseSenderAuthentication(
+    authenticationResultValues(parsed),
+    trustedAuthservId,
+    singleFromDomain(parsed),
+  );
+}

package/packages/bundled-features/src/inbound-provider-inmemory/feature.ts

@@ -13,11 +13,13 @@
 
 import {
   InboundAuthError,
+  type InboundContentFetchResult,
   type InboundFetchResult,
   type InboundMailContext,
   type InboundMailProviderPlugin,
   type MailAccountRecord,
   type RawInboundMessage,
+  type RejectedInboundMessage,
   type SyncCursorPayload,
 } from "@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
@@ -36,11 +38,21 @@ type WatchHandlers = {
   readonly onError: (err: unknown) => void;
 };
 
+type LogEntry =
+  | { readonly message: RawInboundMessage }
+  | { readonly rejected: RejectedInboundMessage };
+
 type AccountState = {
-  readonly log: RawInboundMessage[];
+  readonly log: LogEntry[];
+  // What fetchContent serves; a message that is not in here counts as gone from the server.
+  readonly fullContent: Map<string, RawInboundMessage>;
+  readonly contentFetches: string[][];
   watch: WatchHandlers | null;
+  watchedTrustedAuthservId: string | null | undefined;
   nextFetchError: unknown;
   nextVerifyError: unknown;
+  hangingFetch: Promise<void> | null;
+  lastFetchSignal: AbortSignal | undefined;
   credentialSecretKey: string | null;
 };
 
@@ -51,9 +63,14 @@ function stateFor(accountId: string): AccountState {
   if (!state) {
     state = {
       log: [],
+      fullContent: new Map(),
+      contentFetches: [],
       watch: null,
+      watchedTrustedAuthservId: undefined,
       nextFetchError: null,
       nextVerifyError: null,
+      hangingFetch: null,
+      lastFetchSignal: undefined,
       credentialSecretKey: null,
     };
     accounts.set(accountId, state);
@@ -66,10 +83,25 @@ function stateFor(accountId: string): AccountState {
  *  cursor — the foundation's deduplication makes this idempotent. */
 export async function seedInboundMessage(accountId: string, msg: RawInboundMessage): Promise<void> {
   const state = stateFor(accountId);
-  state.log.push(msg);
+  state.log.push({ message: msg });
   if (state.watch) await state.watch.onMessages([msg]);
 }
 
+/** Test helper: a mail the provider cannot parse; fetch reports it as rejected and moves on. */
+export function seedRejectedInboundMessage(accountId: string, providerMessageId: string): void {
+  stateFor(accountId).log.push({ rejected: { providerMessageId, reason: "unparseable" } });
+}
+
+/** Test helper: the full version of a message that fetchContent serves later. */
+export function setInboundFullContent(accountId: string, msg: RawInboundMessage): void {
+  stateFor(accountId).fullContent.set(msg.providerMessageId, msg);
+}
+
+/** Test helper: the provider message ids of every fetchContent call so far. */
+export function contentFetchesOf(accountId: string): readonly (readonly string[])[] {
+  return stateFor(accountId).contentFetches;
+}
+
 /** Test helper: injects a one-shot error into the next fetch (e.g.
  *  InboundAuthError or InboundCursorInvalidError). */
 export function failNextFetchWith(accountId: string, err: unknown): void {
@@ -81,6 +113,25 @@ export function failNextVerifyWith(accountId: string, err: unknown): void {
   stateFor(accountId).nextVerifyError = err;
 }
 
+/** Test helper: fetches of the account do not return until `release()`, whatever the abort signal
+ *  says, like a provider that ignores cancellation on a dead connection. */
+export function hangFetchesOf(accountId: string): { readonly release: () => void } {
+  const state = stateFor(accountId);
+  const { promise, resolve } = Promise.withResolvers<void>();
+  state.hangingFetch = promise;
+  return {
+    release: () => {
+      state.hangingFetch = null;
+      resolve();
+    },
+  };
+}
+
+/** Test helper: the abort signal the last fetch of the account received. */
+export function lastFetchSignalOf(accountId: string): AbortSignal | undefined {
+  return stateFor(accountId).lastFetchSignal;
+}
+
 /** Test helper: every fetch reads this tenant secret first, like a real
  *  provider reads its stored credentials; a missing secret is an auth error. */
 export function requireCredentialSecretOnFetch(accountId: string, key: string): void {
@@ -116,6 +167,11 @@ export function isWatching(accountId: string): boolean {
   return accounts.get(accountId)?.watch != null;
 }
 
+/** Test helper: the trustedAuthservId of the account the last watch was started with. */
+export function watchedTrustedAuthservIdOf(accountId: string): string | null | undefined {
+  return accounts.get(accountId)?.watchedTrustedAuthservId;
+}
+
 /** Test-Helper: kompletter State-Reset (Test-Isolation — Mock-States
  *  nie zwischen Tests teilen). */
 export function resetInboundInMemory(): void {
@@ -142,6 +198,8 @@ export const inMemoryInboundMailPlugin: InboundMailProviderPlugin = {
   },
   fetch: async (ctx, account, cursor, opts): Promise<InboundFetchResult> => {
     const state = stateFor(account.id);
+    state.lastFetchSignal = opts.signal;
+    if (state.hangingFetch) await state.hangingFetch;
     if (state.nextFetchError) {
       const err = state.nextFetchError;
       state.nextFetchError = null;
@@ -153,15 +211,29 @@ export const inMemoryInboundMailPlugin: InboundMailProviderPlugin = {
     const offset = offsetOf(cursor);
     const slice = state.log.slice(offset, offset + opts.maxMessages);
     const nextOffset = offset + slice.length;
+    const rejected = slice.flatMap((entry) => ("rejected" in entry ? [entry.rejected] : []));
     return {
-      messages: slice,
+      messages: slice.flatMap((entry) => ("message" in entry ? [entry.message] : [])),
+      ...(rejected.length > 0 && { rejected }),
       nextCursor: { offset: nextOffset },
       hasMore: nextOffset < state.log.length,
     };
   },
+  fetchContent: async (_ctx, account, providerMessageIds): Promise<InboundContentFetchResult> => {
+    const state = stateFor(account.id);
+    state.contentFetches.push([...providerMessageIds]);
+    const messages = providerMessageIds.flatMap((id) => state.fullContent.get(id) ?? []);
+    const found = new Set(messages.map((m) => m.providerMessageId));
+    return {
+      messages,
+      missing: providerMessageIds.filter((id) => !found.has(id)),
+      rejected: [],
+    };
+  },
   watch: async (_ctx, account, handlers) => {
     const state = stateFor(account.id);
     state.watch = handlers;
+    state.watchedTrustedAuthservId = account.trustedAuthservId ?? null;
     return async () => {
       if (state.watch === handlers) state.watch = null;
     };

package/packages/bundled-features/src/inbound-provider-inmemory/index.ts

@@ -1,13 +1,19 @@
 // Public API of the inbound-provider-inmemory bundled-feature.
 
 export {
+  contentFetchesOf,
   createInboundProviderInMemoryFeature,
   emitWatchError,
   failNextFetchWith,
   failNextVerifyWith,
+  hangFetchesOf,
   INMEMORY_PROVIDER_KEY,
   isWatching,
+  lastFetchSignalOf,
   requireCredentialSecretOnFetch,
   resetInboundInMemory,
   seedInboundMessage,
+  seedRejectedInboundMessage,
+  setInboundFullContent,
+  watchedTrustedAuthservIdOf,
 } from "./feature.ts";

package/packages/bundled-features/src/jobs/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.394.0",
+    "type": "fix",
+    "title": "catchUp job consumers ignore foreign event types before upcasting, and catchUp with maxPerTenant skip fails at boot",
+    "detail": "A catch-up job consumer now filters on the trigger's event types before the stored event is upcast, so a foreign event with a failing upcaster no longer stalls the job cursor. Boot rejects `trigger.catchUp` together with `maxPerTenant` onLimit \"skip\" (including the number shorthand): a replay must not discard history. Use onLimit \"defer\"."
+  },
+  {
+    "version": "0.394.0",
+    "type": "improvement",
+    "title": "r.job event triggers can catch up on stored events",
+    "detail": "trigger { on, catchUp: true } gives the job its own event consumer job:<jobQn> that starts at the beginning of the event store, so events from before the job existed run it too, once per event (job id derived from job QN and event id). Every \"on\" entry must be an r.defineEvent event, otherwise boot fails. The job is no longer fired by the shared job-trigger consumer. JobRunner gains handleCatchUpEvent."
+  },
+  {
+    "version": "0.394.0",
+    "type": "fix",
+    "title": "triggerName is documented as the firing event's qualified name",
+    "detail": "The JSDoc of `triggerName` said it names the handler that emitted the event; the job runner sets the event's qualified name, which multi-trigger jobs compare against the event QN constants."
+  },
   {
     "version": "0.390.0",
     "type": "fix",

package/packages/bundled-features/src/managed-pages/web/i18n.ts

@@ -16,6 +16,7 @@ export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
   // Screen titles (global/unprefixed, screenTitleKey = screen:<id>.title)
   "screen:page-list.title": { en: "Pages" },
   "screen:page-edit.title": { en: "Edit page" },
+  "screen:page-edit.createTitle": { en: "New page" },
   "screen:branding-settings.title": { en: "Branding" },
 
   // Page-Entity Feld-Labels (managed-pages:entity:page:field:*)

package/packages/bundled-features/src/subscription-paddle/changes.json

@@ -0,0 +1,15 @@
+[
+  {
+    "version": "0.394.0",
+    "type": "improvement",
+    "title": "Add subscription-paddle, a Paddle Billing provider plugin",
+    "detail": "Checkout via the Paddle.js overlay on a page served by the feature at /billing/paddle-checkout. The Default Payment Link in the Paddle dashboard must point to <APP_BASE_URL>/billing/paddle-checkout; it is the only source, because transactions are created without a checkout url. Create subscription prices in the Paddle catalog with quantity minimum and maximum 1; for one-off packs set the quantity limits on purpose, because the payment event carries quantity and the app has to multiply its credits by it. Also ships customer portal, cancel, resume, batched price lookup, in-app plan switch and tenant binding of checkouts through an HMAC in custom_data."
+  },
+  {
+    "version": "0.394.0",
+    "type": "breaking",
+    "title": "Remove subscription-dodo, replaced by subscription-paddle",
+    "detail": "Removed exports of @cosmicdrift/kumiko-bundled-features/subscription-dodo: DODO_BASE_URLS, DODO_PROVIDER_NAME, DodoEnvironment, DodoEnvironments, SUBSCRIPTION_DODO_FEATURE, SubscriptionDodoOptions, createSubscriptionDodoFeature, dodoEnvSchema, subscriptionDodoEnvSchema.",
+    "migration": "Replace createSubscriptionDodoFeature with createSubscriptionPaddleFeature from @cosmicdrift/kumiko-bundled-features/subscription-paddle and dodoEnvSchema with paddleEnvSchema. Map Paddle price ids (pri_...) to tiers in priceToTier, set PADDLE_API_KEY, PADDLE_WEBHOOK_SECRET, PADDLE_TENANT_BINDING_KEY and PADDLE_CLIENT_TOKEN (or the matching config keys) and point the Default Payment Link at /billing/paddle-checkout. Point the Paddle notification destination at /webhooks/subscription/paddle when billing is mounted through the server-runtime boot option (SUBSCRIPTION_WEBHOOK_PATH), or at /api/subscription/webhook/paddle when createSubscriptionWebhookRoute is mounted by hand. In server-runtime boot options, billing.dodo becomes billing.paddle. An app-own credit-pack env such as DODO_PRODUCT_PACKS becomes a list of Paddle pri_ ids; the pack size comes from the price or product custom_data.credits, which surfaces as ProviderPrice.metadata.credits. Existing Dodo subscriptions are not migrated; a subscription stays with the provider stored on it."
+  }
+]

package/packages/bundled-features/src/subscription-paddle/checkout-config.query.ts

@@ -0,0 +1,17 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import type { PaddleRuntimes } from "./runtime.ts";
+
+// Anonymous on purpose: the checkout page is public. The answer is the public
+// Paddle.js client token and the environment, nothing else.
+export function makeCheckoutConfigQuery(readCheckoutConfig: PaddleRuntimes["readCheckoutConfig"]) {
+  return defineQueryHandler({
+    name: "checkout-config",
+    schema: z.object({}),
+    access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
+    description:
+      "Answers the public Paddle.js client token and the Paddle environment for the checkout page; the client token is public by design and no other config leaves this handler.",
+    handler: async (_query, ctx) => readCheckoutConfig(ctx),
+  });
+}