@cosmicdrift/kumiko-samples 0.403.0 → 0.404.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.403.0",
+  "version": "0.404.1",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.403.0",
+  "version": "0.404.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -165,38 +165,38 @@
     "@cosmicdrift/kumiko-framework": "workspace:*",
     "@cosmicdrift/kumiko-renderer": "workspace:*",
     "@cosmicdrift/kumiko-types": "workspace:*",
-    "@mollie/api-client": "^4.5.0",
-    "@node-rs/argon2": "^2.0.2",
-    "@tiptap/core": "^3.31.3",
-    "@tiptap/extension-link": "^3.31.3",
-    "@tiptap/extension-list": "^3.31.3",
-    "@tiptap/extension-table": "^3.31.3",
-    "@tiptap/html": "^3.31.3",
-    "@tiptap/extensions": "^3.31.3",
-    "@tiptap/pm": "^3.31.3",
-    "@tiptap/react": "^3.31.3",
-    "@tiptap/starter-kit": "^3.31.3",
-    "@types/mailparser": "^3.4.6",
-    "@types/qrcode": "^1.5.5",
+    "@mollie/api-client": "^4.6.0",
+    "@node-rs/argon2": "^2.2.2",
+    "@tiptap/core": "^3.32.1",
+    "@tiptap/extension-link": "^3.32.1",
+    "@tiptap/extension-list": "^3.32.1",
+    "@tiptap/extension-table": "^3.32.1",
+    "@tiptap/html": "^3.32.1",
+    "@tiptap/extensions": "^3.32.1",
+    "@tiptap/pm": "^3.32.1",
+    "@tiptap/react": "^3.32.1",
+    "@tiptap/starter-kit": "^3.32.1",
+    "@types/mailparser": "^3.9.0",
+    "@types/qrcode": "^1.5.6",
     "clsx": "^2.1.1",
     "happy-dom": "^21.0.4",
     "hono": "^4.13.14",
     "imapflow": "^1.7.8",
-    "ioredis": "^5.10.1",
-    "jose": "^6.2.13",
-    "lucide-react": "^1.14.0",
-    "mailparser": "^3.12.4",
-    "marked": "^18.0.3",
-    "nodemailer": "^10.2.1",
+    "ioredis": "^5.11.1",
+    "jose": "^6.2.14",
+    "lucide-react": "^1.65.0",
+    "mailparser": "^3.14.1",
+    "marked": "^18.1.2",
+    "nodemailer": "^10.3.1",
     "pdf-lib": "^1.17.1",
     "qrcode": "^1.5.4",
-    "react": "^19.2.6",
-    "react-dom": "^19.2.6",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "sharp": "^0.35.5",
     "stripe": "^22.6.2",
-    "tailwind-merge": "^3.6.0",
+    "tailwind-merge": "^3.7.0",
     "temporal-polyfill": "^0.3.2",
-    "uuid": "^14.0.0",
+    "uuid": "^14.0.3",
     "zod": "^4.6.7"
   },
   "publishConfig": {
@@ -764,7 +764,7 @@
     "@cosmicdrift/kumiko-locale-it": "workspace:*",
     "@cosmicdrift/kumiko-renderer-mail-html": "workspace:*",
     "jsqr": "^1.4.0",
-    "unpdf": "^1.8.1",
+    "unpdf": "^1.9.1",
     "@cosmicdrift/kumiko-testing": "workspace:*"
   },
   "peerDependencies": {

package/packages/bundled-features/src/account-security/README.md

@@ -15,17 +15,19 @@ import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sess
 
 const features = [
   createSessionsFeature(),
-  createAuthMfaFeature({ /* secrets, issuer */ }),
+  createAuthMfaFeature({
+    /* secrets, issuer */
+  }),
   createAccountSecurityFeature(),
 ];
 ```
 
 ## Options
 
-| Option | Default | Effect |
-| --- | --- | --- |
-| `access` | `openToAll` | Who may open the dashboard, e.g. `{ roles: ["Admin", "Editor"] }` |
-| `nav` | none | `{ order?, parent?, icon? }` (icon default `"user"`) adds a sidebar entry. Without it the screen is dormant and apps link it from the user menu |
+| Option   | Default     | Effect                                                                                                                                          |
+| -------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| `access` | `openToAll` | Who may open the dashboard, e.g. `{ roles: ["Admin", "Editor"] }`                                                                               |
+| `nav`    | none        | `{ order?, parent?, icon? }` (icon default `"user"`) adds a sidebar entry. Without it the screen is dormant and apps link it from the user menu |
 
 The MFA panels switch on `auth-mfa:query:status` (`enabled`), exported as
 `accountSecurityMfaStatusVisibility`.

package/packages/bundled-features/src/audit/feature.ts

@@ -77,7 +77,7 @@ export function createAuditFeature(): FeatureDefinition {
 
       r.job({
         name: "escape-hatch-retention",
-        trigger: { cron: "30 3 * * *" },
+        trigger: { maintenance: true },
         concurrency: "skip",
         // pruneEvents needs a transaction-capable connection, which only unsafeRaw() hands a job.
         escapeHatch: {

package/packages/bundled-features/src/auth-email-password/web/auth-gate.tsx

@@ -73,6 +73,7 @@ export function createLoginRoute(
   const MfaVerifyComponent = opts.mfaVerifyScreen;
   const MfaSetupComponent = opts.mfaSetupScreen;
 
+  // biome-ignore lint/correctness/noComponentHookFactories: setup-time factory (module scope or makeAuthGate); the route takes no props, so opts are bound here
   function LoginRoute(): ReactNode {
     const { status, refresh, bootstrapFailure, logout } = useSession();
     const { onAuthenticated } = opts;
@@ -212,6 +213,7 @@ function resolveLoginRedirectOrNull(
   try {
     return resolveLoginRedirect(loginUrl, locale, location);
   } catch (error) {
+    // biome-ignore lint/suspicious/noConsole: the browser console is the only place a broken loginUrl builder shows up, the visitor just sees the built-in login
     console.error("Auth gate: loginUrl could not be resolved, showing the built-in login", error);
     return null;
   }
@@ -223,6 +225,7 @@ export function makeAuthGate(opts: AuthGateOptions = {}): ComponentType<{
   const { loginUrl } = opts;
   if (typeof loginUrl === "string") assertNavigableUrl(loginUrl, "loginUrl");
   const LoginRoute = createLoginRoute(opts);
+  // biome-ignore lint/correctness/noComponentHookFactories: setup-time factory (makeSessionAuthGate or an app's mount function); gates only receive children, so opts are bound here
   function AuthGate({ children }: { readonly children: ReactNode }): ReactNode {
     const { status } = useSession();
     const locale = useLocale().locale();
@@ -255,6 +258,7 @@ export function makeSessionAuthGate(opts: SessionAuthGateOptions = {}): Componen
   const { postLogoutUrl } = opts;
   if (postLogoutUrl !== undefined) assertNavigableUrl(postLogoutUrl, "postLogoutUrl");
   const AuthGate = makeAuthGate(opts);
+  // biome-ignore lint/correctness/noComponentHookFactories: setup-time factory, called once per emailPasswordClient(); gates only receive children, so opts are bound here
   function SessionAuthGate({ children }: { readonly children: ReactNode }): ReactNode {
     return (
       <SessionProvider postLogoutUrl={postLogoutUrl}>

package/packages/bundled-features/src/data-retention/feature.ts

@@ -71,7 +71,7 @@ export function createDataRetentionFeature(): FeatureDefinition {
     // retention rules are configured but never enforced.
     r.job({
       name: "retention-cleanup",
-      trigger: { cron: "0 3 * * *" },
+      trigger: { maintenance: true },
       perTenant: true,
       concurrency: "skip",
       escapeHatch: {

package/packages/bundled-features/src/delivery/feature.ts

@@ -197,7 +197,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     if (attemptLogRetentionDays !== undefined) {
       r.job({
         name: DeliveryJobNames.attemptLogRetention,
-        trigger: { cron: "15 3 * * *" },
+        trigger: { maintenance: true },
         concurrency: "skip",
         escapeHatch: { reason: ATTEMPT_LOG_RETENTION_ESCAPE_HATCH_REASON },
         handler: async (_payload, ctx) => {

package/packages/bundled-features/src/documents/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.404.1",
+    "type": "fix",
+    "title": "Documents recipe has a README and gen-sample-index rejects a primarySample without one",
+    "detail": "feature-reference linked to /en/samples/recipes-documents/, a page the docs site never generated because the recipe had no README.md. The README is added, and gen-sample-index aborts with the feature, the sample and the fix when a primarySample from sample-index.overrides.json has no README.md."
+  }
+]

package/packages/bundled-features/src/feature-toggles/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.404.0",
+    "type": "improvement",
+    "title": "Feature-toggle Redis signal follows KUMIKO_REDIS_PREFIX",
+    "detail": "createRedisToggleSyncSignal takes an optional channelSubscribePattern (default from KUMIKO_REDIS_PREFIX) and ignores messages from other channels, which a prefix-wide subscription delivers."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/feature-toggles/toggle-sync-signal.ts

@@ -4,6 +4,7 @@ import {
   createRedisPubSubSignal,
   type RedisClientOptions,
   redisChannelPrefixFromEnv,
+  redisNamespaceFromEnv,
 } from "@cosmicdrift/kumiko-framework/redis";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import type { ToggleSyncSignal } from "./toggle-runtime.ts";
@@ -36,11 +37,12 @@ export function createRedisToggleSyncSignal(
   redisUrl: string,
   clientOptions?: RedisClientOptions,
   channelPrefix: string = redisChannelPrefixFromEnv(),
+  channelSubscribePattern: string | undefined = redisNamespaceFromEnv().channelSubscribePattern,
 ): RedisToggleSyncSignal {
   const toggleSyncChannel = `${channelPrefix}${TOGGLE_SYNC_CHANNEL_NAME}`;
   const signal = createRedisPubSubSignal({
     redisUrl,
-    channelPattern: toggleSyncChannel,
+    channelPattern: channelSubscribePattern ?? toggleSyncChannel,
     label: "feature-toggles",
     ...(clientOptions ? { clientOptions } : {}),
   });
@@ -50,7 +52,9 @@ export function createRedisToggleSyncSignal(
       signal.publish(toggleSyncChannel, { featureName, enabled });
     },
     onMessage(listener) {
-      signal.onMessage((_channel, payload) => {
+      signal.onMessage((channel, payload) => {
+        // skip: a wide subscribe pattern also delivers other features' channels
+        if (channel !== toggleSyncChannel) return;
         if (!isTogglePayload(payload)) {
           // biome-ignore lint/suspicious/noConsole: ops-visible fallback — no ctx.obs.log in a raw PubSubSignal handler.
           console.error(

package/packages/bundled-features/src/form-draft/feature.ts

@@ -43,7 +43,7 @@ function registerFormDraft(r: FeatureRegistrar<typeof FORM_DRAFT_FEATURE_NAME>):
   r.config({ keys: { retentionDays: formDraftRetentionDaysConfig } });
   r.job({
     name: "cleanup",
-    trigger: { cron: "0 3 * * *" },
+    trigger: { maintenance: true },
     concurrency: "skip",
     escapeHatch: { reason: CLEANUP_ESCAPE_HATCH_REASON },
     handler: (payload, ctx) =>

package/packages/bundled-features/src/host-routing/README.md

@@ -55,16 +55,16 @@ the app sets it.
 
 ## Options
 
-| Option | Meaning |
-|---|---|
-| `tenantBy` | `"host"` (`<key>.<baseDomain>`) or `"path"` with `tenantPathPrefix` (`/t/<key>/...` on the apex) |
-| `baseDomain` | Apex hostname, lowercase, no port. `www.<baseDomain>` counts as apex |
-| `apex` | `{ file, csp?, localeFiles? }` for the apex |
-| `tenant` | `{ file, csp? }` for a known tenant and for the bare path prefix |
-| `unknownTenant` | `{ file, csp? }` served with 404; omit for a bare 404 |
-| `hosts` | Further fixed hostnames with their own surface, checked first |
-| `apexAnonymousTenantId` | Tenant for anonymous API calls on the apex (e.g. `SYSTEM_TENANT_ID` for public signup); omit and the apex has none |
-| `locales` | `{ default, prefixed }`: `/<default>/...` answers 301 to the unprefixed path, `/<prefixed>/...` serves `apex.localeFiles[locale]` |
+| Option                  | Meaning                                                                                                                           |
+| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| `tenantBy`              | `"host"` (`<key>.<baseDomain>`) or `"path"` with `tenantPathPrefix` (`/t/<key>/...` on the apex)                                  |
+| `baseDomain`            | Apex hostname, lowercase, no port. `www.<baseDomain>` counts as apex                                                              |
+| `apex`                  | `{ file, csp?, localeFiles? }` for the apex                                                                                       |
+| `tenant`                | `{ file, csp? }` for a known tenant and for the bare path prefix                                                                  |
+| `unknownTenant`         | `{ file, csp? }` served with 404; omit for a bare 404                                                                             |
+| `hosts`                 | Further fixed hostnames with their own surface, checked first                                                                     |
+| `apexAnonymousTenantId` | Tenant for anonymous API calls on the apex (e.g. `SYSTEM_TENANT_ID` for public signup); omit and the apex has none                |
+| `locales`               | `{ default, prefixed }`: `/<default>/...` answers 301 to the unprefixed path, `/<prefixed>/...` serves `apex.localeFiles[locale]` |
 
 A `csp` replaces runProdApp's default CSP for that surface; without it the
 default applies. Options are validated when the feature or dispatch is built.

package/packages/bundled-features/src/inbound-mail-foundation/handlers/thread-rollup.ts

@@ -107,6 +107,7 @@ export async function appendThreadRollup(
     // @cast-boundary engine-payload — eigene events, shape via defineEvent
     const previousThread = lastThreadEvent?.payload as MailThreadEventPayload | undefined;
     const previousLastAt = previousThread?.lastMessageAtIso ?? "";
+    // biome-ignore lint/complexity/useMathMinMax: ISO strings compare lexicographically; Math.max would coerce them to NaN
     const newLastAt = receivedAtIso > previousLastAt ? receivedAtIso : previousLastAt;
     const messageCount = await countWhere(threadRollupRunner, inboundMessagesProjectionTable, {
       tenantId,

package/packages/bundled-features/src/inbound-mail-foundation/retention-job.ts

@@ -18,7 +18,7 @@ export function registerInboundMailRetentionJob(r: FeatureRegistrar<"inbound-mai
     "inbound-mail retention runs raw deletes; every statement filters by this run's tenantId";
   r.job({
     name: "inbound-mail-retention",
-    trigger: { cron: "0 3 * * *" },
+    trigger: { maintenance: true },
     perTenant: true,
     concurrency: "skip",
     escapeHatch: { reason: INBOUND_MAIL_RETENTION_REASON },

package/packages/bundled-features/src/jobs/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.404.0",
+    "type": "improvement",
+    "title": "Cleanup jobs run once a day in the maintenance window",
+    "detail": "jobs (stale-run-sweep, hourly before, and retention-cleanup), user-data-rights (export and forget), data-retention, audit escape-hatch-retention, inbound-mail retention, delivery attempt-log-retention and form-draft cleanup use trigger { maintenance: true } instead of 03:00 to 03:30 and hourly crons. Without KUMIKO_MAINTENANCE_WINDOW they all run at 03:00 UTC. A stuck job run is now marked failed at most a day after it crosses the stale timeout."
+  },
   {
     "version": "0.394.0",
     "type": "fix",

package/packages/bundled-features/src/jobs/feature.ts

@@ -43,7 +43,7 @@ export type JobsFeatureOptions = {
   // store_job_run_logs before the daily retention-cleanup job deletes it. Also the age after
   // which a tenant-visible "queued" row counts as lost and is dropped by the stale-run sweep.
   readonly retentionDays?: number;
-  // How long a run can sit at status "running" before the hourly
+  // How long a run can sit at status "running" before the daily
   // stale-run-sweep job marks it "failed" — a process kill mid-run
   // never fires onJobComplete/onJobFailed, so nothing else ever revisits
   // it). Must clear any legitimately long-running job (reindexEntity,
@@ -120,18 +120,17 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     // stores — nothing else purges them.
     r.job(
       "retention-cleanup",
-      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
+      { trigger: { maintenance: true }, concurrency: "skip" },
       createRetentionCleanupJob(retentionDays),
     );
 
     // Sweeps store_job_runs for rows stuck at status "running" past the
-    // timeout. Hourly matches the timeout's own granularity —
-    // frequent enough to catch a stuck run soon after it crosses the
-    // threshold, cheap enough that an (almost always empty) result set
-    // doesn't matter.
+    // timeout. Runs in the maintenance window: the timeout is
+    // hours, so a daily pass finds a stuck run at most a day late and a sleeping
+    // app is not woken every hour for it.
     r.job(
       "stale-run-sweep",
-      { trigger: { cron: "0 * * * *" }, concurrency: "skip" },
+      { trigger: { maintenance: true }, concurrency: "skip" },
       createStaleRunSweepJob(staleRunTimeoutHours, retentionDays),
     );
 

package/packages/bundled-features/src/legal-pages/README.md

@@ -25,7 +25,7 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 runProdApp({
   envSchema, // composeEnvSchema({ core: frameworkCoreEnvSchema, features })
   features: [
-    createTemplateResolverFeature(),  // legal-pages requires template-resolver
+    createTemplateResolverFeature(), // legal-pages requires template-resolver
     createLegalPagesFeature(),
     /* ... */
   ],
@@ -60,12 +60,12 @@ See [template-resolver/README.md](../template-resolver/README.md).
 
 **Default** (DACH: DE required, EN optional):
 
-| Path | Slug + locale | Title fallback (when block empty) |
-|---|---|---|
-| `GET /legal/impressum` | `imprint` / `de` | "Impressum" |
-| `GET /legal/datenschutz` | `privacy` / `de` | "Datenschutzerklärung" |
-| `GET /legal/imprint` | `imprint` / `en` | "Imprint" |
-| `GET /legal/privacy` | `privacy` / `en` | "Privacy Policy" |
+| Path                     | Slug + locale    | Title fallback (when block empty) |
+| ------------------------ | ---------------- | --------------------------------- |
+| `GET /legal/impressum`   | `imprint` / `de` | "Impressum"                       |
+| `GET /legal/datenschutz` | `privacy` / `de` | "Datenschutzerklärung"            |
+| `GET /legal/imprint`     | `imprint` / `en` | "Imprint"                         |
+| `GET /legal/privacy`     | `privacy` / `en` | "Privacy Policy"                  |
 
 Response:
 - `200 text/html` — block exists + has content. Cache header `public, max-age=300`.
@@ -112,11 +112,19 @@ that needs an additional page (terms/AGB), passes its own lists:
 createLegalPagesFeature({
   routes: [
     { path: "/legal/aviso-legal", slug: "imprint", lang: "es", titleFallback: "Aviso legal" },
-    { path: "/legal/privacidad", slug: "privacy", lang: "es", titleFallback: "Política de privacidad" },
+    {
+      path: "/legal/privacidad",
+      slug: "privacy",
+      lang: "es",
+      titleFallback: "Política de privacidad",
+    },
     { path: "/legal/terminos", slug: "terms", lang: "es", titleFallback: "Términos y condiciones" },
   ],
-  requiredBlocks: [{ slug: "imprint", lang: "es" }, { slug: "privacy", lang: "es" }],
-})
+  requiredBlocks: [
+    { slug: "imprint", lang: "es" },
+    { slug: "privacy", lang: "es" },
+  ],
+});
 ```
 
 `slug` is free-form — it only has to match the `slug` you seed the
@@ -162,10 +170,10 @@ starts and checks whether the required blocks exist in SYSTEM_TENANT.
 A throw rejects the boot, so the process never reports ready.
 **Default** (DACH):
 
-| Slug + locale | What happens when missing |
-|---|---|
+| Slug + locale    | What happens when missing                                                                 |
+| ---------------- | ----------------------------------------------------------------------------------------- |
 | `imprint` / `de` | **Production:** `throw new Error(...)` blocks app start. **Dev:** `ctx.obs.log.warn(...)` |
-| `privacy` / `de` | as above |
+| `privacy` / `de` | as above                                                                                  |
 
 EN versions are **not** boot-fail-relevant by default (`LEGAL_OPTIONAL_BLOCKS`).
 Routes return `404` if an EN block is missing.

package/packages/bundled-features/src/renderer-foundation/README.md

@@ -21,9 +21,7 @@ const features = [
 const app = createKumikoApp({
   features,
   extraContext: ({ registry }) => ({
-    rendererFoundation: createRendererFoundationApi(
-      collectRendererPlugins(registry),
-    ),
+    rendererFoundation: createRendererFoundationApi(collectRendererPlugins(registry)),
   }),
 });
 ```
@@ -39,7 +37,11 @@ async function sendMail(ctx, tenantId) {
   const result = await renderer.render(
     {
       kind: "mail",
-      payload: { slug: "billing:notify:invoice-ready", locale: "de", variables: { name: "Frau Schmidt" } },
+      payload: {
+        slug: "billing:notify:invoice-ready",
+        locale: "de",
+        variables: { name: "Frau Schmidt" },
+      },
     },
     { db: ctx.db, registry: ctx.registry, tenantId, config: ctx.config },
   );

package/packages/bundled-features/src/renderer-pdf/README.md

@@ -11,7 +11,11 @@ const { pdfBytes, pageCount } = await renderTablePdf(
   {
     title: "Prüfprotokoll",
     meta: [{ label: "Anlage", value: "Kessel 3" }],
-    columns: [{ header: "Datum" }, { header: "Prüfer", weight: 2 }, { header: "Kosten", align: "right" }],
+    columns: [
+      { header: "Datum" },
+      { header: "Prüfer", weight: 2 },
+      { header: "Kosten", align: "right" },
+    ],
     rows: [["03.02.2026", "Müller", "120,00 €"]],
     footerText: "Kumiko GmbH",
     pageLabel: "Seite {page} von {pages}",

package/packages/bundled-features/src/template-resolver/README.md

@@ -44,13 +44,13 @@ async function someHandler(ctx) {
 
 ## Kinds, format, and meta
 
-| kind | contentFormat | meta |
-|---|---|---|
-| `mail` | `html` (document schema, rebuilt server-side) | Required: `subject`; optional `previewText`, `layoutSlug`, `category` (`transactional`/`marketing`), `senderName`, `replyTo` |
-| `mail-layout` | `mjml` | empty (`{}`) or missing |
-| `pdf-layout` | `html` | empty (`{}`) or missing |
-| `document-pdf` | `html` | missing |
-| remaining kinds | arbitrary | missing |
+| kind            | contentFormat                                 | meta                                                                                                                         |
+| --------------- | --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
+| `mail`          | `html` (document schema, rebuilt server-side) | Required: `subject`; optional `previewText`, `layoutSlug`, `category` (`transactional`/`marketing`), `senderName`, `replyTo` |
+| `mail-layout`   | `mjml`                                        | empty (`{}`) or missing                                                                                                      |
+| `pdf-layout`    | `html`                                        | empty (`{}`) or missing                                                                                                      |
+| `document-pdf`  | `html`                                        | missing                                                                                                                      |
+| remaining kinds | arbitrary                                     | missing                                                                                                                      |
 
 `meta` is stored as JSON in the `meta` column and is validated on write per kind against
 `template-meta.ts` (errors as field issues on `meta.*`). Subject and preview text allow only simple
@@ -105,22 +105,22 @@ await seedSystemTemplate(db, {
 
 ## Admin workflows (write handlers + queries)
 
-| Handler | QN | Who | What |
-|---|---|---|---|
-| `TemplateResolverHandlers.upsertSystem` | `template-resolver:write:upsert-system` | SystemAdmin | Creates or updates system default templates (`SYSTEM_TENANT_ID`, scope='system', status='active') |
-| `TemplateResolverHandlers.upsertTenant` | `template-resolver:write:upsert-tenant` | TenantAdmin (own tenant) + SystemAdmin via `tenantIdOverride` | Creates or updates tenant overrides (scope='tenant'), default status='draft' |
-| `TemplateResolverHandlers.publish` | `template-resolver:write:publish` | TenantAdmin (own tenant) | Sets status='active' |
-| `TemplateResolverHandlers.archive` | `template-resolver:write:archive` | TenantAdmin (own tenant) | Sets status='archived' (the resolver ignores it afterward) |
-| `TemplateResolverHandlers.publishSystem` | `template-resolver:write:publish-system` | SystemAdmin | Sets status='active' on a system default, with the same mail validation as `publish` |
-| `TemplateResolverHandlers.archiveSystem` | `template-resolver:write:archive-system` | SystemAdmin | Sets status='archived' on a system default; tenants without an override fall through |
-| `TemplateResolverHandlers.resetToSystem` | `template-resolver:write:reset-to-system` | TenantAdmin (own tenant) | Archives the own override so that the active system template applies again; without an active system template, `no_system_template` |
-| `TemplateResolverQueries.findById` | `template-resolver:query:find-by-id` | TenantAdmin + User (own tenant, system templates visible) | Raw lookup for the edit UI |
-| `TemplateResolverQueries.list` | `template-resolver:query:list` | same | Filters by kind/locale/status, optionally includeSystem |
-| `TemplateResolverQueries.usage` | `template-resolver:query:usage` | TenantAdmin | Which notifications use a mail template or mail layout, from the registry |
-| `TemplateResolverQueries.overview` | `template-resolver:query:overview` | TenantAdmin + SystemAdmin | One row per slug and type, mail, PDF, layouts, with origin, languages, status, version, layout, and usage; searchable, filterable, sortable, and pageable |
-| `TemplateResolverQueries.layoutSource` | `template-resolver:query:layout-source` | TenantAdmin + SystemAdmin | Own and system version of a layout, header/signature/footer regions of the effective HTML version, storage locale; MJML source only for SystemAdmin |
-| `TemplateResolverQueries.tenantOverrides` | `template-resolver:query:tenant-overrides` | SystemAdmin | Number of active/draft overrides of a system template and total active tenants, numbers only |
-| `TemplateResolverQueries.diffToSystem` | `template-resolver:query:diff-to-system` | TenantAdmin (own tenant) | Block and meta comparison of a tenant override with the system template |
+| Handler                                   | QN                                         | Who                                                           | What                                                                                                                                                      |
+| ----------------------------------------- | ------------------------------------------ | ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `TemplateResolverHandlers.upsertSystem`   | `template-resolver:write:upsert-system`    | SystemAdmin                                                   | Creates or updates system default templates (`SYSTEM_TENANT_ID`, scope='system', status='active')                                                         |
+| `TemplateResolverHandlers.upsertTenant`   | `template-resolver:write:upsert-tenant`    | TenantAdmin (own tenant) + SystemAdmin via `tenantIdOverride` | Creates or updates tenant overrides (scope='tenant'), default status='draft'                                                                              |
+| `TemplateResolverHandlers.publish`        | `template-resolver:write:publish`          | TenantAdmin (own tenant)                                      | Sets status='active'                                                                                                                                      |
+| `TemplateResolverHandlers.archive`        | `template-resolver:write:archive`          | TenantAdmin (own tenant)                                      | Sets status='archived' (the resolver ignores it afterward)                                                                                                |
+| `TemplateResolverHandlers.publishSystem`  | `template-resolver:write:publish-system`   | SystemAdmin                                                   | Sets status='active' on a system default, with the same mail validation as `publish`                                                                      |
+| `TemplateResolverHandlers.archiveSystem`  | `template-resolver:write:archive-system`   | SystemAdmin                                                   | Sets status='archived' on a system default; tenants without an override fall through                                                                      |
+| `TemplateResolverHandlers.resetToSystem`  | `template-resolver:write:reset-to-system`  | TenantAdmin (own tenant)                                      | Archives the own override so that the active system template applies again; without an active system template, `no_system_template`                       |
+| `TemplateResolverQueries.findById`        | `template-resolver:query:find-by-id`       | TenantAdmin + User (own tenant, system templates visible)     | Raw lookup for the edit UI                                                                                                                                |
+| `TemplateResolverQueries.list`            | `template-resolver:query:list`             | same                                                          | Filters by kind/locale/status, optionally includeSystem                                                                                                   |
+| `TemplateResolverQueries.usage`           | `template-resolver:query:usage`            | TenantAdmin                                                   | Which notifications use a mail template or mail layout, from the registry                                                                                 |
+| `TemplateResolverQueries.overview`        | `template-resolver:query:overview`         | TenantAdmin + SystemAdmin                                     | One row per slug and type, mail, PDF, layouts, with origin, languages, status, version, layout, and usage; searchable, filterable, sortable, and pageable |
+| `TemplateResolverQueries.layoutSource`    | `template-resolver:query:layout-source`    | TenantAdmin + SystemAdmin                                     | Own and system version of a layout, header/signature/footer regions of the effective HTML version, storage locale; MJML source only for SystemAdmin       |
+| `TemplateResolverQueries.tenantOverrides` | `template-resolver:query:tenant-overrides` | SystemAdmin                                                   | Number of active/draft overrides of a system template and total active tenants, numbers only                                                              |
+| `TemplateResolverQueries.diffToSystem`    | `template-resolver:query:diff-to-system`   | TenantAdmin (own tenant)                                      | Block and meta comparison of a tenant override with the system template                                                                                   |
 
 **SystemAdmin cross-tenant access for publish/archive/findById:** deferred (Task 8), `upsertTenant` already has `tenantIdOverride`; publish/archive only need this when a system admin panel curates templates belonging to other tenants. `ctx.db` is tenant-scoped, foreign IDs result in NotFound without an override.
 
@@ -166,12 +166,12 @@ The harness checks `TemplateNotFoundError` propagation, locale fallback, and, wh
 Marketing, FAQ, and legal texts use the same store, but a separate write path: `set.write` carries
 `title` + `folder` (content tree) and has no draft status, saving publishes.
 
-| Handler | QN | Who | What |
-|---|---|---|---|
-| `TemplateResolverHandlers.set` | `template-resolver:write:set` | TenantAdmin + SystemAdmin (via `tenantIdOverride`, also on `SYSTEM_TENANT_ID`) | Upserts one resource per `(tenantId, slug, kind, locale)` |
-| `TemplateResolverQueries.bySlug` | `template-resolver:query:by-slug` | anonymous + User + Admins | One text block, the public read for landing/legal pages |
-| `TemplateResolverQueries.byTenant` | `template-resolver:query:by-tenant` | anonymous + User + Admins | All text blocks of a tenant for the content tree |
-| `<collection>-list` / `-item` / `-set` | `template-resolver:query:<id>-list` … | as declared | Per content collection, see below |
+| Handler                                | QN                                    | Who                                                                            | What                                                      |
+| -------------------------------------- | ------------------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------- |
+| `TemplateResolverHandlers.set`         | `template-resolver:write:set`         | TenantAdmin + SystemAdmin (via `tenantIdOverride`, also on `SYSTEM_TENANT_ID`) | Upserts one resource per `(tenantId, slug, kind, locale)` |
+| `TemplateResolverQueries.bySlug`       | `template-resolver:query:by-slug`     | anonymous + User + Admins                                                      | One text block, the public read for landing/legal pages   |
+| `TemplateResolverQueries.byTenant`     | `template-resolver:query:by-tenant`   | anonymous + User + Admins                                                      | All text blocks of a tenant for the content tree          |
+| `<collection>-list` / `-item` / `-set` | `template-resolver:query:<id>-list` … | as declared                                                                    | Per content collection, see below                         |
 
 The two public queries are hardcoded to `kind: "text-block"` and accept **no** kind parameter. Mail
 templates and AI prompts are stored in the same table and use the handlers of their collection. This

package/packages/bundled-features/src/template-resolver/document-sanitizer.ts

@@ -248,8 +248,9 @@ export function withParsedDocument<T>(html: string, read: (body: ScanElement) =>
     );
     return read(parsed.body);
   } finally {
-    window.happyDOM.abort();
-    window.happyDOM.close();
+    // The window is never reused, so this sync API need not await the teardown promises.
+    void window.happyDOM.abort();
+    void window.happyDOM.close();
   }
 }
 

package/packages/bundled-features/src/template-resolver/web/collection-entry-create-form.tsx

@@ -17,6 +17,7 @@ const SLUG_INVALID_ISSUE: FieldIssue = {
 export function createCollectionEntryCreateForm(
   tenantId: string | undefined,
 ): (props: { readonly target: TargetRef; readonly onClose: () => void }) => ReactNode {
+  // biome-ignore lint/correctness/noComponentHookFactories: setup-time factory, called once per templateResolverClient(); the resolver slot only passes target/onClose, so tenantId is bound here
   return function BoundCollectionEntryCreateForm(props) {
     return <CollectionEntryCreateForm {...props} tenantId={tenantId} />;
   };

package/packages/bundled-features/src/tenant-lifecycle/stages.ts

@@ -92,6 +92,7 @@ const tenantMembershipCrud = createEventStoreExecutor(
 // earlier hook that keeps reporting done:false can use up the budget, so later chunking
 // hooks time out with nothing processed until it finishes.
 function newOutcomeAccumulator(): {
+  // biome-ignore lint/suspicious/noConfusingVoidType: takes the awaited result of a destroy hook, whose public type allows void
   add: (result: TenantDestroyHookResult | void) => void;
   outcome: () => StageRunOutcome;
 } {