@dokebi/cli 0.4.1 → 0.4.26

package/catalog.json

@@ -1,10 +1,10 @@
 {
   "$comment": "Generated by scripts/catalog/build.ts from package.json dokebiCatalog fields and packages/cli/catalog-src (D-0065). Do not edit; run node scripts/catalog/build.ts.",
   "schemaVersion": 1,
-  "cli": "0.4.1",
+  "cli": "0.4.26",
   "core": {
     "package": "@dokebi/core",
-    "version": "0.4.0"
+    "version": "0.4.2"
   },
   "capabilities": {
     "admin.ui": {
@@ -12,9 +12,16 @@
       "en": "admin dashboard crud backoffice"
     },
     "auth": {
-      "summary": "login",
-      "users and permissions (authentication and authorization)": null,
-      "en": "auth authentication authorization login user password oauth jwt signup"
+      "summary": "session login, route protection and permissions on your own user table (authentication and authorization)",
+      "en": "auth authentication authorization login logout user password session signin"
+    },
+    "auth.permissions": {
+      "summary": "roles, grades and scoped permissions (all, subtree, direct, own over a holding tree) checked from memory",
+      "en": "permissions rbac roles grades scope access control authorization admin reseller tree"
+    },
+    "background.outbox": {
+      "summary": "durable background work in the app database (enqueue in the transaction, fair claims across owners, per-destination breakers, dead items with resend, retention)",
+      "en": "outbox background work delivery webhook export cleanup retry backoff breaker transactional"
     },
     "cache.local": {
       "summary": "in-process memory cache (LRU)",
@@ -25,23 +32,28 @@
       "en": "cache redis shared"
     },
     "cli.project": {
-      "summary": "commands to create a project",
-      "install plugins and verify it": null,
+      "summary": "commands to create a project, install plugins and verify it",
       "en": "command line scaffold install verify"
     },
     "config.yaml": {
       "summary": "read and validate dokebi.yaml (a required part of the core)",
       "en": "yaml configuration"
     },
+    "content.rich-text": {
+      "summary": "rich text documents from an editor checked whole and written as safe HTML, text and excerpts",
+      "en": "rich text editor tiptap prosemirror wysiwyg html sanitize body post content"
+    },
     "core.runtime": {
-      "summary": "application lifecycle",
-      "plugin registration": null,
-      "logger and shared libraries": null,
+      "summary": "application lifecycle, plugin registration, logger and shared libraries",
       "en": "application lifecycle plugin registry logger"
     },
     "csrf": {
-      "summary": "issue and check CSRF tokens",
-      "en": "csrf xsrf token"
+      "summary": "CSRF protection for forms and scripts (origin check and tokens)",
+      "en": "csrf xsrf token forgery form protection"
+    },
+    "data.tree": {
+      "summary": "trees in your own tables (paths, subtree moves, sibling order, ancestors, pages in tree order)",
+      "en": "tree hierarchy categories parent children ancestors descendants subtree nested path"
     },
     "db.connection": {
       "summary": "named database connections (pools) with readiness checks and shutdown",
@@ -75,23 +87,40 @@
       "summary": "SQLite file database",
       "en": "sqlite sqlite3 file database"
     },
+    "email-verification": {
+      "summary": "e-mail address verification after sign-up",
+      "en": "email verification confirm address signup"
+    },
     "events.bus": {
       "summary": "event bus (in process or over NATS)",
       "en": "event bus pubsub publish subscribe"
     },
+    "files.records": {
+      "summary": "a record and owner of every stored file (claim, release, removal after commit, sweep of unowned files, read rules per owner)",
+      "en": "files uploads attachments records owner cleanup orphan download thumbnail"
+    },
+    "font.korean": {
+      "summary": "Korean font files for writing PDF files (Hangul, Hanja, kana and Latin)",
+      "en": "font korean hangul cjk noto typeface glyph"
+    },
+    "geoip.lookup": {
+      "summary": "offline IP geolocation (country, region, city, time zone, ISP) from operator-provided MaxMind DB files such as GeoLite2 or DB-IP Lite, in memory without a network call",
+      "en": "geoip geolocation ip location country city region asn isp maxmind geolite2 mmdb dbip"
+    },
     "health.checks": {
-      "summary": "live",
-      "ready and draining state with readiness checks": null,
+      "summary": "live, ready and draining state with readiness checks",
       "en": "health readiness liveness"
     },
     "i18n": {
       "summary": "multiple languages (translated strings)",
       "en": "i18n translation locale"
     },
+    "image.thumbnail": {
+      "summary": "server-side image thumbnails (WebP) of stored files, made once and deleted with their source",
+      "en": "image thumbnail resize preview webp picture photo sharp"
+    },
     "job.durable": {
-      "summary": "at-least-once job queue (JetStream",
-      "retries": null,
-      "DLQ)": null,
+      "summary": "at-least-once job queue (JetStream, retries, DLQ)",
       "en": "job queue background task retry dlq"
     },
     "lock.local": {
@@ -102,26 +131,88 @@
       "summary": "Redis lease lock (fencing tokens)",
       "en": "distributed lock redis lease"
     },
+    "log.activity": {
+      "summary": "activity log of what members do (sign-ins, actions) with address and device, masked failed logins, retention",
+      "en": "activity log login history sign in ip address device member actions"
+    },
+    "log.audit": {
+      "summary": "audit log of changes (written in the change's transaction, a declared code tree, the actor from auth or an OAuth grant, masked values, keyset lists)",
+      "en": "audit log history changes who changed operator admin trail"
+    },
+    "logging.network": {
+      "summary": "ship log records to a receiver over HTTPS in batches (NDJSON for Dokebi Studio, OTLP/HTTP JSON for an OpenTelemetry collector) with retries and bounded buffers",
+      "en": "log shipping network http https ndjson otlp opentelemetry collector studio batch"
+    },
+    "logging.redaction": {
+      "summary": "secrets removed from every log record before any target (passwords, tokens, cookies, chosen fields)",
+      "en": "redact redaction mask secrets password token log"
+    },
+    "logging.rotation": {
+      "summary": "log files rotated by size and time with a kept count and age",
+      "en": "log rotation rotate files logrotate"
+    },
+    "logging.targets": {
+      "summary": "the app logger writes JSON to stdout, rotated files and readable development lines at once without blocking the app",
+      "en": "logging logger log pino stdout file pretty production"
+    },
     "mail": {
-      "summary": "send mail (SMTP)",
-      "en": "mail email smtp"
+      "summary": "mail templates, SMTP and SES, queued delivery",
+      "en": "mail email smtp ses templates"
     },
     "markdown": {
       "summary": "convert Markdown to HTML",
       "en": "markdown md html"
     },
+    "mcp.server": {
+      "summary": "MCP server so AI clients call your tools over stateless Streamable HTTP with OAuth tokens (scopes per tool, result envelope, per-connection limits)",
+      "en": "mcp model context protocol ai tools claude chatgpt connector server"
+    },
+    "messaging.bulk-send": {
+      "summary": "bulk sends to many recipients over mail, notes or other channels with recipient rows, scheduling, progress, stop and resend of failures",
+      "en": "bulk send mass mail newsletter broadcast notice messages campaign recipients schedule"
+    },
     "messaging.nats": {
       "summary": "named NATS connections and JetStream publishing",
       "en": "nats jetstream messaging"
     },
+    "metrics.http": {
+      "summary": "per-route HTTP response metrics",
+      "en": "metrics prometheus monitoring latency status"
+    },
+    "oauth": {
+      "summary": "social login with Google or Apple (sign in with another provider)",
+      "en": "oauth social login google apple sign in with"
+    },
+    "oauth.server": {
+      "summary": "OAuth 2.1 authorization server so AI clients (MCP) connect for a signed-in user (PKCE, refresh rotation, revocation, protected resource metadata)",
+      "en": "oauth2 authorization server pkce mcp connector token grant consent"
+    },
+    "oidc.client": {
+      "summary": "sign in with any OpenID Connect provider (company SSO, GitHub, Keycloak, Okta, Azure AD)",
+      "en": "oidc openid connect sso github keycloak okta azure entra provider external login"
+    },
     "orm": {
-      "summary": "ORM",
-      "query builder and model mapping": null,
+      "summary": "ORM, query builder and model mapping",
       "en": "orm query builder model"
     },
+    "password-reset": {
+      "summary": "password reset by e-mail (forgotten password links)",
+      "en": "password reset forgot recovery link"
+    },
+    "pdf.generate": {
+      "summary": "create PDF files (documents, invoices, reports)",
+      "en": "pdf generate create make export render document invoice report print"
+    },
+    "pdf.text": {
+      "summary": "text of stored PDF files as page parts, with the page count and whether there is any text, extracted once in bounded worker threads",
+      "en": "pdf text extract read document page attachment pdfjs"
+    },
+    "pdf.thumbnail": {
+      "summary": "a WebP thumbnail of the first page of a stored PDF file, made once and deleted with its source",
+      "en": "pdf thumbnail preview first page render webp"
+    },
     "process.cluster": {
-      "summary": "run several node:cluster workers",
-      "watch them and replace them one by one": null,
+      "summary": "run several node:cluster workers, watch them and replace them one by one",
       "en": "cluster multi process workers"
     },
     "rate-limit": {
@@ -129,8 +220,7 @@
       "en": "rate limit throttle"
     },
     "realtime.hub": {
-      "summary": "hub of WebSocket clients",
-      "rooms and broadcast": null,
+      "summary": "hub of WebSocket clients, rooms and broadcast",
       "en": "websocket hub rooms broadcast"
     },
     "realtime.sse": {
@@ -138,8 +228,7 @@
       "en": "sse server sent events eventsource"
     },
     "realtime.websocket": {
-      "summary": "WebSocket routes",
-      "rooms and broadcast (across servers and workers)": null,
+      "summary": "WebSocket routes, rooms and broadcast (across servers and workers)",
       "en": "websocket socket realtime chat"
     },
     "redis.connection": {
@@ -150,6 +239,10 @@
       "summary": "Redis leader election and incremental state",
       "en": "redis leader election coordination"
     },
+    "reports.rollups": {
+      "summary": "report roll-ups (facts folded into hour, day and month rows per time zone, read with an as-of time and a report budget)",
+      "en": "reports statistics stats rollups aggregates dashboard hourly daily monthly totals timezone"
+    },
     "rss": {
       "summary": "RSS and Atom feeds",
       "en": "rss atom feed"
@@ -163,10 +256,25 @@
       "en": "search full text index"
     },
     "security.seal": {
-      "summary": "sealing of transport bodies (obfuscation",
-      "replay protection) and a browser client": null,
+      "summary": "sealing of transport bodies (obfuscation, replay protection) and a browser client",
       "en": "seal obfuscation replay encryption"
     },
+    "settings.runtime": {
+      "summary": "settings operators change while the app runs (stored in the database, checked by type and rules, common and personal values, every worker refreshed)",
+      "en": "runtime settings admin options preferences operator values site configuration personal"
+    },
+    "static.files": {
+      "summary": "a folder served under a path prefix (update feeds, installers, downloads) with Range, ETag and cache rules",
+      "en": "static files folder download update feed appcast installer range etag"
+    },
+    "time.site-zone": {
+      "summary": "an application time zone changed while the app runs and day boundaries computed the same on the server and in the browser",
+      "en": "timezone time zone site day boundary utc range calendar today dst summer time"
+    },
+    "two-factor": {
+      "summary": "two-factor login (TOTP, recovery codes)",
+      "en": "two factor 2fa mfa totp otp authenticator"
+    },
     "upload": {
       "summary": "receive and store file uploads (multipart)",
       "en": "upload multipart file storage"
@@ -195,23 +303,32 @@
       "summary": "controller registry per app",
       "en": "controller mvc"
     },
+    "web.cors": {
+      "summary": "cross-origin browser access (CORS) with allowed origins, methods, headers and credentials per app",
+      "en": "cors cross origin preflight access-control-allow-origin"
+    },
     "web.http": {
-      "summary": "HTTP server (Fastify) with 503 before ready",
-      "drain and health paths": null,
+      "summary": "HTTP server (Fastify) with 503 before ready, drain and health paths",
       "en": "http server fastify web"
     },
     "web.modules": {
       "summary": "feature modules (src/shared/modules)",
       "en": "feature module"
     },
+    "web.overload": {
+      "summary": "load shedding with 503 and Retry-After when the event loop stalls or memory runs high, health routes served",
+      "en": "overload load shedding under pressure event loop delay backpressure 503"
+    },
     "web.routing": {
       "summary": "routes grouped under a prefix (mount)",
       "en": "router routes prefix"
     },
+    "web.security-headers": {
+      "summary": "security headers on by default (CSP, HSTS over HTTPS, X-Frame-Options, nosniff, Referrer-Policy) with per-route changes",
+      "en": "security headers csp content security policy hsts helmet clickjacking frame options nosniff"
+    },
     "web.session": {
-      "summary": "server-side sessions (signed cookie",
-      "memory or redis store": null,
-      "flash)": null,
+      "summary": "server-side sessions (signed cookie, memory or redis store, flash)",
       "en": "session cookie flash"
     },
     "worker.thread": {
@@ -223,7 +340,7 @@
     {
       "id": "dokebi-app",
       "package": "@dokebi/app",
-      "version": "0.4.1",
+      "version": "0.4.5",
       "kind": "plugin",
       "summary": "Several apps chosen by request domain (src/apps/<app>) with a template each; installs web, controller and template-ejs with it",
       "description": "Multiple apps per project for Dokebi: pick the app and template by request domain, with EJS and Inertia skeletons.",
@@ -247,12 +364,13 @@
       ],
       "recipes": [
         "api",
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [
         {
           "id": "dokebi-web",
-          "range": "^0.4.1",
+          "range": "^0.4.3",
           "package": "@dokebi/web",
           "automatic": true
         },
@@ -277,6 +395,10 @@
         {
           "id": "dokebi-session",
           "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-static",
+          "range": "^0.1.0"
         }
       ],
       "optionKeys": [
@@ -290,10 +412,233 @@
       },
       "install": "npx dokebi add @dokebi/app"
     },
+    {
+      "id": "dokebi-audit",
+      "package": "@dokebi/audit",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Audit and activity logs in your database: written in the change's transaction, a declared code tree, the actor from auth or an OAuth grant (AI clients by name), masking before the write, indexed keyset lists, retention",
+      "description": "Audit and activity logs for Dokebi: rows written in the change's transaction, a declared code tree, the actor from auth or an OAuth grant, masking before the write, indexed keyset lists and retention.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "audit",
+        "activity",
+        "log",
+        "database"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "log.activity",
+        "log.audit"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "No free-text search over labels and reasons; filters by code, actor, target, owner, address and time",
+        "Does not decide who may read the logs: the application's routes do",
+        "Does not create tables at start (the migration dokebi add writes)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-geoip",
+          "range": "^0.1.0"
+        }
+      ],
+      "optionKeys": [
+        "activity",
+        "audit",
+        "connection",
+        "list",
+        "maxChangesBytes",
+        "pool",
+        "prune"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/audit"
+    },
+    {
+      "id": "dokebi-auth",
+      "package": "@dokebi/auth",
+      "version": "0.4.1",
+      "kind": "plugin",
+      "summary": "Login on your own user table: sessions, remember-me, API tokens, route protection, authorize hook, password hashing, login throttling, realms; optional Google/Apple social login",
+      "description": "Login for @dokebi/web on your own user table through an extension class: sessions, remember-me, API tokens (personal, access/refresh), route protection, authorization hook, password hashing, login throttling, realms.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "web",
+        "auth",
+        "login",
+        "password",
+        "token"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "auth",
+        "email-verification",
+        "oauth",
+        "password-reset"
+      ],
+      "variants": [],
+      "doesNot": [
+        "Does not own a user table, roles or a sign-up screen (your extension class maps your rows)",
+        "No two-factor login yet; reset and email-confirmed signup require mail and job",
+        "Does not issue CSRF tokens",
+        "No JWT: API tokens are opaque and checked against the token store",
+        "Is not an OAuth authorization server (that is @dokebi/oauth) and supports no arbitrary OIDC providers; social login supports Google and Apple"
+      ],
+      "recipes": [
+        "blog",
+        "site"
+      ],
+      "requires": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.3"
+        },
+        {
+          "id": "dokebi-session",
+          "range": "^0.4.4"
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-redis",
+          "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-csrf",
+          "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-mail",
+          "range": "^0.4.0"
+        }
+      ],
+      "optionKeys": [
+        "apps",
+        "bearerMaxBlocked",
+        "cacheMs",
+        "default",
+        "hashAlgorithm",
+        "hashWaitTimeoutMs",
+        "homePath",
+        "live",
+        "logRepeatWindowMs",
+        "loginPath",
+        "mailLinkMaxRunning",
+        "mailLinkMaxWaiting",
+        "maxCachedUsers",
+        "maxConcurrentHashes",
+        "maxPasswordBytes",
+        "maxQueuedHashes",
+        "maxStampMemo",
+        "passwordConfirmMs",
+        "passwordReset",
+        "realm",
+        "reauthenticatePath",
+        "rememberMs",
+        "rememberRaceMs",
+        "secrets",
+        "secretsEnv",
+        "signup",
+        "storeRetryAfterMs",
+        "throttle",
+        "tokenMaxTouched",
+        "tokenTouchIntervalMs",
+        "tokens",
+        "verifyMaxMemoryMiB",
+        "via"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/auth"
+    },
+    {
+      "id": "dokebi-bulk-send",
+      "package": "@dokebi/bulk-send",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Bulk sends over @dokebi/outbox: a send row, recipient rows per person and channel fixed when it goes (excluded and failed with reasons), channels and audiences your app registers (mail through @dokebi/mail, an inbox of your own), scheduling and cancel, progress per channel, stop, and failed deliveries sent again",
+      "description": "Bulk sends for Dokebi over @dokebi/outbox: recipient rows fixed when a send goes, channels and audiences your app registers, scheduling and cancel, progress per channel, stop, and failures sent again.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "bulk",
+        "mail",
+        "messages",
+        "newsletter",
+        "outbox"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "messaging.bulk-send"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "No templates or inbox of its own: your channels send (mail.send) or write your inbox rows",
+        "No bounce processing: a delivery error your channel throws marks the row",
+        "Does not create tables at start (the migration dokebi add writes)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        },
+        {
+          "id": "dokebi-outbox",
+          "range": "^0.1.0",
+          "package": "@dokebi/outbox",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "connection",
+        "deliverBatch",
+        "deliverConcurrency",
+        "maxContentBytes",
+        "maxPage",
+        "maxScheduleDays",
+        "maxTargetBytes",
+        "prepareBatch"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/bulk-send"
+    },
     {
       "id": "dokebi-cache",
       "package": "@dokebi/cache",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "plugin",
       "summary": "Named cache backends (local LRU by default; redis through the @dokebi/cache-redis driver)",
       "description": "Named cache backends for Dokebi: in-process LRU or a shared Redis driver.",
@@ -305,7 +650,7 @@
         "redis"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "cache.local"
       ],
@@ -323,7 +668,8 @@
         }
       ],
       "optionKeys": [
-        "backends"
+        "backends",
+        "retryAfterMs"
       ],
       "docs": {
         "ai": "AI.md",
@@ -334,7 +680,7 @@
     {
       "id": null,
       "package": "@dokebi/cache-redis",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "driver",
       "summary": "Redis driver of @dokebi/cache (not a plugin: install it with npm install)",
       "description": "Redis driver for @dokebi/cache (not a plugin; install with npm).",
@@ -367,7 +713,7 @@
     {
       "id": null,
       "package": "@dokebi/cli",
-      "version": "0.4.1",
+      "version": "0.4.26",
       "kind": "cli",
       "summary": "Commands to create a project, browse the plugin catalog, run recipes, install plugins and verify (dokebi)",
       "description": "Project scaffolding, plugin catalog, recipes, install and verification CLI for Dokebi.",
@@ -390,7 +736,8 @@
       ],
       "recipes": [
         "api",
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [],
       "optional": [],
@@ -404,7 +751,7 @@
     {
       "id": null,
       "package": "@dokebi/cluster",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "library",
       "summary": "Runner that starts several app workers from a node:cluster parent process, watches them and replaces them one by one",
       "description": "node:cluster runner for Dokebi: starts, watches and rolls independent application workers.",
@@ -416,7 +763,7 @@
         "rolling-restart"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "process.cluster"
       ],
@@ -438,7 +785,7 @@
     {
       "id": "dokebi-config",
       "package": "@dokebi/config",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "required",
       "summary": "Required part of the core that reads and validates dokebi.yaml into read-only settings per app (installed automatically)",
       "description": "Validated immutable YAML configuration for Dokebi applications.",
@@ -460,7 +807,8 @@
       ],
       "recipes": [
         "api",
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [],
       "optional": [],
@@ -474,7 +822,7 @@
     {
       "id": "dokebi-controller",
       "package": "@dokebi/controller",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "plugin",
       "summary": "Registry that creates each controller object once per app and hands it out with its type",
       "description": "Per-app controller registry for Dokebi: build controllers once and read them with their types.",
@@ -497,7 +845,8 @@
       ],
       "recipes": [
         "api",
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [],
       "optional": [],
@@ -511,7 +860,7 @@
     {
       "id": null,
       "package": "@dokebi/core",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "core",
       "summary": "Application core: settings loading, plugin registration, lifecycle, logger and shared libraries (required)",
       "description": "Minimal composable Node.js application and plugin lifecycle framework.",
@@ -534,7 +883,8 @@
       ],
       "recipes": [
         "api",
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [],
       "optional": [],
@@ -545,10 +895,119 @@
       },
       "install": "automatic (dokebi init)"
     },
+    {
+      "id": "dokebi-cors",
+      "package": "@dokebi/cors",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "CORS: the origins, methods, headers and credentials a browser page on another origin may use, per app of @dokebi/app, preflight answered before authentication",
+      "description": "CORS for @dokebi/web on @fastify/cors: allowed origins, methods, headers and credentials in dokebi.yaml, per app of @dokebi/app, preflight answered before auth.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "web",
+        "cors",
+        "security"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "web.cors"
+      ],
+      "variants": [],
+      "doesNot": [
+        "Not an access control: CORS only tells browsers which pages may read answers; servers and scripts ignore it",
+        "Does not change CSRF, session cookies (SameSite) or the origin checks of SSE and WebSocket routes: configure those where they live"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.3",
+          "package": "@dokebi/web",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "allowedHeaders",
+        "apps",
+        "credentials",
+        "exposedHeaders",
+        "maxAgeSec",
+        "methods",
+        "origins",
+        "routeIds"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/cors"
+    },
+    {
+      "id": "dokebi-csrf",
+      "package": "@dokebi/csrf",
+      "version": "0.4.0",
+      "kind": "plugin",
+      "summary": "CSRF protection for web forms and scripts: origin check plus a signed, masked token (EJS field, Inertia XSRF-TOKEN cookie)",
+      "description": "CSRF protection for @dokebi/web: origin check and signed, masked double-submit tokens.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "web",
+        "csrf",
+        "security"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "csrf"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No login or user accounts (that is dokebi-auth)",
+        "Does not parse multipart bodies: a multipart form sends the token in the header or the query string"
+      ],
+      "recipes": [
+        "blog",
+        "site"
+      ],
+      "requires": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.3",
+          "package": "@dokebi/web",
+          "automatic": true
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-session",
+          "range": "^0.4.0"
+        }
+      ],
+      "optionKeys": [
+        "cookie",
+        "exclude",
+        "field",
+        "header",
+        "logRepeatWindowMs",
+        "originCheck",
+        "secrets",
+        "secretsEnv",
+        "trustedOrigins"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/csrf"
+    },
     {
       "id": "dokebi-db",
       "package": "@dokebi/db",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "plugin",
       "summary": "Named database connections (pools) with readiness checks and shutdown; you use the driver API as it is",
       "description": "Named database connections for Dokebi: create, readiness check and close pools of pg, mysql2, mariadb or mongodb.",
@@ -584,6 +1043,15 @@
             "version": "8.23.1"
           },
           "migrate": true,
+          "connectionOptions": {
+            "max": 10,
+            "waitTimeoutMs": 3000,
+            "idleTimeoutMs": 10000,
+            "statementTimeoutMs": 10000,
+            "queryTimeoutMs": 15000,
+            "checkTimeoutMs": 5000,
+            "logRepeatWindowMs": 10000
+          },
           "devInfra": {
             "docker": {
               "image": "postgres:16.15-alpine",
@@ -614,6 +1082,16 @@
             "version": "3.24.5"
           },
           "migrate": true,
+          "connectionOptions": {
+            "max": 10,
+            "waitTimeoutMs": 3000,
+            "maxWaiting": 4096,
+            "connectTimeoutMs": 3000,
+            "idleTimeoutMs": 10000,
+            "statementTimeoutMs": 10000,
+            "checkTimeoutMs": 5000,
+            "logRepeatWindowMs": 10000
+          },
           "devInfra": {
             "docker": {
               "image": "mysql:8",
@@ -646,6 +1124,16 @@
             "version": "3.5.4"
           },
           "migrate": true,
+          "connectionOptions": {
+            "max": 10,
+            "waitTimeoutMs": 3000,
+            "connectTimeoutMs": 3000,
+            "initializationTimeoutMs": 3000,
+            "idleTimeoutMs": 10000,
+            "statementTimeoutMs": 10000,
+            "checkTimeoutMs": 5000,
+            "logRepeatWindowMs": 10000
+          },
           "devInfra": {
             "docker": {
               "image": "mariadb:11",
@@ -675,6 +1163,15 @@
             "version": "7.7.0"
           },
           "migrate": true,
+          "connectionOptions": {
+            "max": 10,
+            "waitTimeoutMs": 3000,
+            "connectTimeoutMs": 3000,
+            "serverSelectionTimeoutMs": 3000,
+            "idleTimeoutMs": 10000,
+            "queryTimeoutMs": 15000,
+            "checkTimeoutMs": 5000
+          },
           "devInfra": {
             "docker": {
               "image": "mongo:7",
@@ -713,7 +1210,10 @@
         }
       ],
       "optionKeys": [
-        "connections"
+        "busyRetryAfterMs",
+        "connections",
+        "timeoutRetryAfterMs",
+        "unavailableRetryAfterMs"
       ],
       "docs": {
         "ai": "AI.md",
@@ -724,7 +1224,7 @@
     {
       "id": "dokebi-event-bus",
       "package": "@dokebi/event-bus",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "plugin",
       "summary": "Named event buses (local or NATS, at most once)",
       "description": "Named event buses for Dokebi: in-process dispatch or NATS Core delivery between processes.",
@@ -736,7 +1236,7 @@
         "nats"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "events.bus"
       ],
@@ -753,7 +1253,8 @@
         }
       ],
       "optionKeys": [
-        "buses"
+        "buses",
+        "logRepeatWindowMs"
       ],
       "docs": {
         "ai": "AI.md",
@@ -762,17 +1263,173 @@
       "install": "npx dokebi add @dokebi/event-bus"
     },
     {
-      "id": "dokebi-health",
-      "package": "@dokebi/health",
-      "version": "0.4.0",
+      "id": "dokebi-files",
+      "package": "@dokebi/files",
+      "version": "0.1.0",
       "kind": "plugin",
-      "summary": "Collects the live, ready and draining state of the app and the readiness checks of plugins (web serves the HTTP paths)",
-      "description": "Liveness, readiness and draining state with plugin readiness checks for Dokebi.",
+      "summary": "A record of every stored file: uploads recorded without an owner, claimed by a feature in its transaction, removals whose bytes go after the commit through @dokebi/outbox, unowned files swept after a grace, read rules per owner type in front of downloads and thumbnails, lists by owner, kind and time",
+      "description": "A record of every stored file for Dokebi: owners claimed in the caller's transaction, removals whose bytes are deleted after the commit (@dokebi/outbox), a sweep of unowned files after a grace, read rules per owner type, uploads, downloads and thumbnails behind them.",
       "keywords": [
         "dokebi",
         "dokebi-plugin",
-        "health",
-        "readiness",
+        "files",
+        "uploads",
+        "attachments",
+        "storage"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "files.records"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "Keeps no bytes itself: they live in @dokebi/storage",
+        "Keeps no deletion log of its own: removals answer the records for the audit log",
+        "Does not create tables at start (the migration dokebi add writes)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        },
+        {
+          "id": "dokebi-storage",
+          "range": "^0.1.0",
+          "package": "@dokebi/storage",
+          "automatic": true
+        },
+        {
+          "id": "dokebi-outbox",
+          "range": "^0.1.0",
+          "package": "@dokebi/outbox",
+          "automatic": true
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-image",
+          "range": "^0.1.0"
+        }
+      ],
+      "optionKeys": [
+        "connection",
+        "list",
+        "sweep",
+        "unowned"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/files"
+    },
+    {
+      "id": null,
+      "package": "@dokebi/font-noto-kr",
+      "version": "0.1.0",
+      "kind": "library",
+      "summary": "Noto Sans KR font files (Regular and Bold, SIL OFL 1.1) that @dokebi/pdf-writer embeds by default: Hangul, KS X 1001 Hanja, kana and Latin",
+      "description": "Noto Sans CJK KR (Regular and Bold, OpenType CFF) for Dokebi PDF writing: Hangul, KS X 1001 Hanja, kana and Latin.",
+      "keywords": [
+        "dokebi",
+        "font",
+        "noto",
+        "korean",
+        "cjk",
+        "pdf"
+      ],
+      "maturity": "experimental",
+      "core": null,
+      "provides": [
+        "font.korean"
+      ],
+      "variants": [],
+      "doesNot": [
+        "Not a plugin you app.register: installed with @dokebi/pdf-writer",
+        "No emoji and not every Chinese or Japanese character (add fallbackFonts of @dokebi/pdf-writer)"
+      ],
+      "recipes": [],
+      "requires": [],
+      "optional": [],
+      "optionKeys": [],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npm install @dokebi/font-noto-kr"
+    },
+    {
+      "id": "dokebi-geoip",
+      "package": "@dokebi/geoip",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Offline IP geolocation from operator-provided .mmdb files (MaxMind GeoLite2 or GeoIP2, DB-IP Lite): country, region, city, coordinates, time zone and ISP in memory, private and reserved ranges answered without a lookup, files reopened without a restart, a download command",
+      "description": "Offline IP geolocation for Dokebi from operator-provided MaxMind DB (.mmdb) files (GeoLite2, GeoIP2, DB-IP Lite): country, region, city, location and ISP in memory, complete special-purpose address ranges, a bounded LRU cache, files reopened without a restart, and a download command.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "geoip",
+        "geolocation",
+        "maxmind",
+        "mmdb",
+        "geolite2"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "geoip.lookup"
+      ],
+      "variants": [],
+      "doesNot": [
+        "Ships no database: the operator downloads one under its own license (GeoLite2 needs a free MaxMind account and its EULA; DB-IP Lite is CC BY 4.0)",
+        "No network lookup service: the address never leaves the process",
+        "No IP2Location BIN files and no CSV databases (MaxMind DB .mmdb only)",
+        "No routes: the app decides who may see a location"
+      ],
+      "recipes": [],
+      "requires": [],
+      "optional": [
+        {
+          "id": "dokebi-health",
+          "range": "^0.4.0"
+        }
+      ],
+      "optionKeys": [
+        "asn",
+        "cache",
+        "city",
+        "download",
+        "folder",
+        "health",
+        "language",
+        "maxAgeDays",
+        "maxFileBytes",
+        "precision",
+        "refresh"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/geoip"
+    },
+    {
+      "id": "dokebi-health",
+      "package": "@dokebi/health",
+      "version": "0.4.1",
+      "kind": "plugin",
+      "summary": "Collects the live, ready and draining state of the app and the readiness checks of plugins (web serves the HTTP paths)",
+      "description": "Liveness, readiness and draining state with plugin readiness checks for Dokebi.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "health",
+        "readiness",
         "liveness"
       ],
       "maturity": "preview",
@@ -783,9 +1440,13 @@
       "variants": [],
       "doesNot": [
         "No periodic probes or automatic restarts",
-        "No aggregation across the cluster"
+        "No aggregation across the cluster (web's ready route asks every worker)"
+      ],
+      "recipes": [
+        "api",
+        "blog",
+        "site"
       ],
-      "recipes": [],
       "requires": [],
       "optional": [],
       "optionKeys": [
@@ -797,10 +1458,134 @@
       },
       "install": "npx dokebi add @dokebi/health"
     },
+    {
+      "id": "dokebi-i18n",
+      "package": "@dokebi/i18n",
+      "version": "0.2.0",
+      "kind": "plugin",
+      "summary": "Compiled translations, locale negotiation, cardinal plurals and named number/date formats",
+      "description": "Compiled translation catalogs, locale negotiation, cardinal plurals and named Intl formats.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "i18n",
+        "locale"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.0",
+      "provides": [
+        "i18n",
+        "time.site-zone"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No translation service; the Vue page runtime is @dokebi/template-inertia/i18n and HTTP integration is opt-in",
+        "Plain text with named interpolation and cardinal plurals; not full ICU MessageFormat"
+      ],
+      "recipes": [],
+      "requires": [],
+      "optional": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.3"
+        }
+      ],
+      "optionKeys": [
+        "defaultLocale",
+        "http",
+        "maxAcceptLanguageLength",
+        "maxAcceptLanguageRanges",
+        "maxBranchLength",
+        "maxCatalogBytes",
+        "maxCatalogCharacters",
+        "maxDefaultCharacters",
+        "maxDefaultTemplates",
+        "maxKeyLength",
+        "maxLocales",
+        "maxMessages",
+        "maxNamedFormats",
+        "maxOutputLength",
+        "missing",
+        "timeZone"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/i18n"
+    },
+    {
+      "id": "dokebi-image",
+      "package": "@dokebi/image",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Server-side WebP thumbnails of stored png, jpeg, gif, webp and avif images, made once and deleted with their source",
+      "description": "Bounded server-side WebP thumbnails of stored images, made once and deleted with their source.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "image",
+        "thumbnail",
+        "webp",
+        "sharp"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "image.thumbnail"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No public routes, access policy, cropping, watermarks, animation or formats other than WebP output",
+        "No SVG, HTML or other non-raster input (refused as UNSUPPORTED_IMAGE)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-storage",
+          "range": "^0.1.0",
+          "package": "@dokebi/storage",
+          "automatic": true
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-lock",
+          "range": "^0.4.0"
+        }
+      ],
+      "optionKeys": [
+        "busyRetryAfterMs",
+        "effort",
+        "lockBackend",
+        "lockUnavailable",
+        "lockWaitTimeoutMs",
+        "logRepeatWindowMs",
+        "maxConcurrent",
+        "maxInputBytes",
+        "maxInputPixels",
+        "maxOutputBytes",
+        "maxSideMax",
+        "maxSideMin",
+        "maxWaiting",
+        "quality",
+        "sharpConcurrency",
+        "sweepIntervalMs",
+        "sweepLimit",
+        "timeoutMs",
+        "timeoutRetryAfterMs",
+        "waitTimeoutMs"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/image"
+    },
     {
       "id": "dokebi-job",
       "package": "@dokebi/job",
-      "version": "0.4.0",
+      "version": "0.4.3",
       "kind": "plugin",
       "summary": "NATS JetStream job queue (at least once, retries, DLQ)",
       "description": "Bounded durable jobs over the Dokebi NATS provider: retries, delayed redelivery and a dead-letter stream.",
@@ -822,19 +1607,24 @@
         "No exactly-once delivery (handlers must be idempotent)",
         "No database"
       ],
-      "recipes": [],
+      "recipes": [
+        "api",
+        "blog",
+        "site"
+      ],
       "requires": [
         {
           "id": "dokebi-nats",
-          "range": "^0.4.0"
-        }
-      ],
-      "optional": [
+          "range": "^0.4.1"
+        },
         {
           "id": "dokebi-health",
-          "range": "^0.4.0"
+          "range": "^0.4.0",
+          "package": "@dokebi/health",
+          "automatic": true
         }
       ],
+      "optional": [],
       "optionKeys": [
         "queues"
       ],
@@ -847,7 +1637,7 @@
     {
       "id": "dokebi-lock",
       "package": "@dokebi/lock",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "plugin",
       "summary": "Named locks (local by default; redis leases through the @dokebi/lock-redis driver) with fencing tokens",
       "description": "Named lock backends for Dokebi with fencing tokens: in-process or Redis leases.",
@@ -859,7 +1649,7 @@
         "redis"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "lock.local"
       ],
@@ -876,7 +1666,8 @@
         }
       ],
       "optionKeys": [
-        "backends"
+        "backends",
+        "retryAfterMs"
       ],
       "docs": {
         "ai": "AI.md",
@@ -887,7 +1678,7 @@
     {
       "id": null,
       "package": "@dokebi/lock-redis",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "driver",
       "summary": "Redis lease driver of @dokebi/lock (not a plugin: install it with npm install)",
       "description": "Redis lease driver for @dokebi/lock (not a plugin; install with npm).",
@@ -919,116 +1710,388 @@
       "install": "npm install @dokebi/lock-redis"
     },
     {
-      "id": "dokebi-migrate",
-      "package": "@dokebi/migrate",
-      "version": "0.4.0",
+      "id": "dokebi-logger",
+      "package": "@dokebi/logger",
+      "version": "0.1.0",
       "kind": "plugin",
-      "summary": "Migration and seed runner for dokebi-db connections (dokebi-migrate up in the deploy step)",
-      "description": "Migrations and seeds for dokebi-db connections: history and lock for PostgreSQL, MySQL, MariaDB and MongoDB, run from the deployment.",
+      "summary": "The app logger on pino: JSON to stdout, rotating files, pretty development output and network targets (NDJSON batches to Dokebi Studio, OTLP/HTTP JSON) at once, written in worker threads with bounded buffers, secrets redacted, levels per plugin, flushed on shutdown",
+      "description": "Production logging for Dokebi apps on pino: stdout, rotating files, pretty output and HTTP/OTLP log shipping at once, written off the event loop, with redaction, per-plugin levels and flush on shutdown.",
       "keywords": [
         "dokebi",
         "dokebi-plugin",
-        "database",
-        "migrations",
-        "seeds"
-      ],
-      "maturity": "preview",
-      "core": "^0.4.0",
+        "logging",
+        "pino",
+        "log-rotation",
+        "redaction",
+        "otlp"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
       "provides": [
-        "db.migrate",
-        "db.seed"
+        "logging.network",
+        "logging.redaction",
+        "logging.rotation",
+        "logging.targets"
       ],
       "variants": [],
       "doesNot": [
-        "No DDL when the app starts",
-        "No tables generated from ORM models"
+        "No log search, viewer or retention beyond the rotated files and what the receiver of a network target keeps",
+        "No OTLP over gRPC or protobuf, no Loki or Elasticsearch format: network targets send NDJSON (http) or OTLP/HTTP JSON (otlp)"
       ],
       "recipes": [
         "api",
-        "blog"
+        "blog",
+        "site"
       ],
-      "requires": [
+      "requires": [],
+      "optional": [
         {
-          "id": "dokebi-db",
-          "range": "^0.4.0",
-          "package": "@dokebi/db",
-          "automatic": true
+          "id": "dokebi-health",
+          "range": "^0.4.0"
         }
       ],
-      "optional": [],
       "optionKeys": [
-        "connections",
-        "directory",
-        "lockTimeoutMs",
-        "lockTtlMs",
-        "onPending"
+        "confirmIntervalMs",
+        "dropReportIntervalMs",
+        "fields",
+        "flushTimeoutMs",
+        "level",
+        "maxLineBytes",
+        "maxMessageLength",
+        "plugins",
+        "redact",
+        "requests",
+        "targets"
       ],
       "docs": {
         "ai": "AI.md",
         "readme": "README.md"
       },
-      "install": "npx dokebi add @dokebi/migrate"
+      "install": "npx dokebi add @dokebi/logger"
     },
     {
-      "id": "dokebi-module",
-      "package": "@dokebi/module",
-      "version": "0.4.0",
+      "id": "dokebi-mail",
+      "package": "@dokebi/mail",
+      "version": "0.4.2",
       "kind": "plugin",
-      "summary": "Modules that hold one feature each (src/shared/modules/<module>); an app attaches them under a prefix",
-      "description": "Feature modules for Dokebi apps: controllers, models, views and routes in one folder mounted under a prefix.",
+      "summary": "Mail: EJS templates per locale, SMTP with required STARTTLS (nodemailer) and Amazon SES v2, queued sending through @dokebi/job with sealed links and tokens, a development inbox and test outbox",
+      "description": "Mail for Dokebi apps: EJS templates per locale, SMTP (nodemailer, STARTTLS required) and Amazon SES v2, queued sending through @dokebi/job with sealed data, deterministic Message-IDs, a development inbox and test helpers.",
       "keywords": [
         "dokebi",
         "dokebi-plugin",
-        "web",
-        "modules",
-        "mvc"
+        "mail",
+        "email",
+        "smtp"
       ],
-      "maturity": "preview",
-      "core": "^0.4.0",
+      "maturity": "experimental",
+      "core": "^0.4.2",
       "provides": [
-        "web.modules"
+        "mail"
       ],
       "variants": [],
       "doesNot": [
-        "Does not attach modules to apps by itself (modules in app.ts)"
+        "No API providers other than SES; no bounce or complaint webhooks and no suppression list",
+        "No password reset or e-mail verification flow (those come with dokebi-auth)",
+        "Large attachments: only small inline ones (store files elsewhere and send a link)"
       ],
       "recipes": [
         "api",
         "blog"
       ],
       "requires": [],
-      "optional": [],
-      "optionKeys": [],
+      "optional": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-job",
+          "range": "^0.4.2"
+        },
+        {
+          "id": "dokebi-redis",
+          "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-i18n",
+          "range": "^0.2.0"
+        }
+      ],
+      "optionKeys": [
+        "allowedFrom",
+        "defaultLocale",
+        "devInbox",
+        "from",
+        "layout",
+        "logRepeatWindowMs",
+        "maxAttachmentBytes",
+        "maxAttachments",
+        "maxDataDepth",
+        "maxDataNodes",
+        "maxHeaders",
+        "maxRecipients",
+        "maxTemplateFileBytes",
+        "maxTemplates",
+        "messageIdDomain",
+        "queue",
+        "redis",
+        "replyTo",
+        "returnPath",
+        "routeIds",
+        "secrets",
+        "secretsEnv",
+        "sentMarkerTtlMs",
+        "siteUrl",
+        "timeZone",
+        "transport"
+      ],
       "docs": {
         "ai": "AI.md",
         "readme": "README.md"
       },
-      "install": "npx dokebi add @dokebi/module"
+      "install": "npx dokebi add @dokebi/mail"
     },
     {
-      "id": "dokebi-nats",
-      "package": "@dokebi/nats",
-      "version": "0.4.0",
+      "id": "dokebi-mcp",
+      "package": "@dokebi/mcp",
+      "version": "0.1.0",
       "kind": "plugin",
-      "summary": "Named NATS connections (Core and JetStream publishing, durable consumers)",
-      "description": "Named NATS connections and bounded JetStream publication for Dokebi.",
+      "summary": "MCP server on @dokebi/oauth: stateless Streamable HTTP at /mcp, tool classes with checked input schemas and scopes, a forced result envelope with paging, per-grant limits and coded tool errors",
+      "description": "MCP server for @dokebi/web on @dokebi/oauth: stateless Streamable HTTP, tool classes with checked schemas, a forced result envelope, per-grant limits and coded tool errors.",
       "keywords": [
         "dokebi",
         "dokebi-plugin",
-        "nats",
-        "jetstream",
-        "messaging"
+        "web",
+        "mcp",
+        "model-context-protocol",
+        "ai",
+        "oauth"
       ],
-      "maturity": "preview",
-      "core": "^0.4.0",
+      "maturity": "experimental",
+      "core": "^0.4.2",
       "provides": [
-        "messaging.nats"
+        "mcp.server"
       ],
       "variants": [],
       "doesNot": [
-        "No raw SDK client and no stream management rights"
+        "No stdio transport, no sessions and no server-sent events: one JSON answer per POST (GET and DELETE are 405)",
+        "No sampling, elicitation or other requests from the server to the client; no list_changed notifications",
+        "Does not authorize by itself: tokens come from @dokebi/oauth (one protected resource, one scope per tool)"
       ],
       "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.3"
+        },
+        {
+          "id": "dokebi-oauth",
+          "range": "^0.1.0"
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-rate-limit",
+          "range": "^0.1.1"
+        }
+      ],
+      "optionKeys": [
+        "allowedOrigins",
+        "app",
+        "bodyLimitBytes",
+        "imageMaxBytes",
+        "imageTotalMaxBytes",
+        "instructions",
+        "limits",
+        "listTtlMs",
+        "logRepeatWindowMs",
+        "maxBatch",
+        "maxImages",
+        "name",
+        "onCallMaxPending",
+        "path",
+        "resource",
+        "resultMaxChars",
+        "routeIds",
+        "title",
+        "toolTimeoutMs",
+        "uriMaxChars",
+        "version"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/mcp"
+    },
+    {
+      "id": "dokebi-metrics",
+      "package": "@dokebi/metrics",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Bounded route latency quantiles, status counters and 5xx ratios in JSON or Prometheus text",
+      "description": "Bounded per-route HTTP response metrics with JSON and Prometheus output for Dokebi.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "metrics",
+        "prometheus",
+        "http"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.0",
+      "provides": [
+        "metrics.http"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No automatic public endpoint, persistence or cross-process aggregation",
+        "Quantiles cover the last sampleSize completed responses, not a time window"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.3",
+          "package": "@dokebi/web",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "cluster",
+        "enabled",
+        "maxRoutes",
+        "maxSourceSamples",
+        "sampleSize"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/metrics"
+    },
+    {
+      "id": "dokebi-migrate",
+      "package": "@dokebi/migrate",
+      "version": "0.4.2",
+      "kind": "plugin",
+      "summary": "Migration and seed runner for dokebi-db connections (dokebi-migrate up in the deploy step)",
+      "description": "Migrations and seeds for dokebi-db connections: history and lock for PostgreSQL, MySQL, MariaDB and MongoDB, run from the deployment.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "database",
+        "migrations",
+        "seeds"
+      ],
+      "maturity": "preview",
+      "core": "^0.4.2",
+      "provides": [
+        "db.migrate",
+        "db.seed"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No DDL when the app starts",
+        "No tables generated from ORM models"
+      ],
+      "recipes": [
+        "api",
+        "blog"
+      ],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.0",
+          "package": "@dokebi/db",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "connections",
+        "directory",
+        "lockRetries",
+        "lockRetryDelayMs",
+        "lockTimeoutMs",
+        "lockTtlMs",
+        "lockWaitTimeoutMs",
+        "onChanged",
+        "onPending",
+        "queryTimeoutMs",
+        "statementTimeoutMs"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/migrate"
+    },
+    {
+      "id": "dokebi-module",
+      "package": "@dokebi/module",
+      "version": "0.4.1",
+      "kind": "plugin",
+      "summary": "Modules that hold one feature each (src/shared/modules/<module>); an app attaches them under a prefix",
+      "description": "Feature modules for Dokebi apps: controllers, models, views and routes in one folder mounted under a prefix.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "web",
+        "modules",
+        "mvc"
+      ],
+      "maturity": "preview",
+      "core": "^0.4.0",
+      "provides": [
+        "web.modules"
+      ],
+      "variants": [],
+      "doesNot": [
+        "Does not attach modules to apps by itself (modules in app.ts)"
+      ],
+      "recipes": [
+        "api",
+        "blog"
+      ],
+      "requires": [],
+      "optional": [],
+      "optionKeys": [],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/module"
+    },
+    {
+      "id": "dokebi-nats",
+      "package": "@dokebi/nats",
+      "version": "0.4.1",
+      "kind": "plugin",
+      "summary": "Named NATS connections (Core and JetStream publishing, durable consumers)",
+      "description": "Named NATS connections and bounded JetStream publication for Dokebi.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "nats",
+        "jetstream",
+        "messaging"
+      ],
+      "maturity": "preview",
+      "core": "^0.4.2",
+      "provides": [
+        "messaging.nats"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No raw SDK client and no stream management rights"
+      ],
+      "recipes": [
+        "api",
+        "blog",
+        "site"
+      ],
       "requires": [],
       "optional": [
         {
@@ -1045,10 +2108,414 @@
       },
       "install": "npx dokebi add @dokebi/nats"
     },
+    {
+      "id": "dokebi-oauth",
+      "package": "@dokebi/oauth",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "OAuth 2.1 authorization server on @dokebi/auth tokens: authorization code with PKCE S256, refresh rotation and reuse detection, revocation, client ID metadata documents, protected resource metadata and protected routes",
+      "description": "OAuth 2.1 authorization server for @dokebi/web on @dokebi/auth tokens: authorization code with PKCE, refresh rotation, revocation, client ID metadata documents, protected resource metadata and route protection.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "web",
+        "oauth",
+        "oauth2",
+        "authorization-server",
+        "pkce",
+        "mcp"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "oauth.server"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No OpenID Connect: no id_token, userinfo or openid-configuration",
+        "No implicit, password, client_credentials or device grants, no introspection, no JWT access tokens, no private_key_jwt",
+        "Does not draw the consent screen: the application renders it (renderConsent in src/infra/oauth/extension.ts)",
+        "Dynamic client registration is closed unless registration: open (public clients only)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.3"
+        },
+        {
+          "id": "dokebi-auth",
+          "range": "^0.4.1"
+        },
+        {
+          "id": "dokebi-session",
+          "range": "^0.4.4"
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-csrf",
+          "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-redis",
+          "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-rate-limit",
+          "range": "^0.1.1"
+        }
+      ],
+      "optionKeys": [
+        "accessMs",
+        "app",
+        "cimd",
+        "clientUnusedMs",
+        "clients",
+        "codeGraceMs",
+        "codeMs",
+        "grant",
+        "grantCacheMs",
+        "grantTouchMs",
+        "issuer",
+        "live",
+        "logRepeatWindowMs",
+        "maxBodyBytes",
+        "maxCachedGrants",
+        "maxPending",
+        "maxTrackedAddresses",
+        "paths",
+        "pendingMs",
+        "rateLimit",
+        "realm",
+        "refreshMs",
+        "registration",
+        "registrationLimit",
+        "registrationWindowMs",
+        "resources",
+        "routeIds",
+        "store",
+        "storeFullRetryAfterMs",
+        "storeRetryAfterMs"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/oauth"
+    },
+    {
+      "id": "dokebi-outbox",
+      "package": "@dokebi/outbox",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Durable background work in your database: enqueue in the business transaction, fair batch claims across owners, leases, backoff, per-destination breakers that wait out outages, dead items with bulk resend, retention, arrival and drain numbers",
+      "description": "Durable database-backed background work for Dokebi: enqueue in the business transaction, fair batch claims across owners, leases, retries with backoff, per-destination breakers, dead items with bulk resend, retention and arrival/drain numbers.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "outbox",
+        "background",
+        "queue",
+        "database",
+        "retry"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "background.outbox"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "Not exactly once: handlers run at least once and must be idempotent",
+        "No cron: time-of-day schedules stay with @dokebi/scheduler; delayed items use notBefore",
+        "Does not create tables at start (the migration dokebi add writes)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-health",
+          "range": "^0.4.0"
+        }
+      ],
+      "optionKeys": [
+        "abandonAfterMs",
+        "breaker",
+        "connection",
+        "handlerPool",
+        "handlerTimeoutMs",
+        "health",
+        "leaseGraceMs",
+        "maxContinuations",
+        "maxNotBeforeMs",
+        "maxPageSize",
+        "maxPayloadBytes",
+        "maxProgressBytes",
+        "maxResend",
+        "pool",
+        "retention",
+        "retry",
+        "runner",
+        "stats",
+        "types"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/outbox"
+    },
+    {
+      "id": "dokebi-pdf",
+      "package": "@dokebi/pdf",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Text of stored PDF files as page parts and a first-page WebP thumbnail, in worker threads with bounded bytes, pages, characters, time and memory, made once and deleted with their source",
+      "description": "Bounded text extraction and first-page WebP thumbnails of stored PDF files, in worker threads, made once and deleted with their source.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "pdf",
+        "text-extraction",
+        "thumbnail",
+        "webp"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "pdf.text",
+        "pdf.thumbnail"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No OCR: a scanned PDF answers hasText false",
+        "No password entry, forms, scripts, attachments, XFA or links: an encrypted PDF is PDF_ENCRYPTED",
+        "No public routes or access policy; no PDF editing (writing PDF files is @dokebi/pdf-writer)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-storage",
+          "range": "^0.1.0",
+          "package": "@dokebi/storage",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "busyRetryAfterMs",
+        "maxConcurrent",
+        "maxImagePixels",
+        "maxInputBytes",
+        "maxOutputBytes",
+        "maxPageChars",
+        "maxPages",
+        "maxPendingBytes",
+        "maxSideMax",
+        "maxSideMin",
+        "maxTotalChars",
+        "maxWaiting",
+        "quality",
+        "sweepLimit",
+        "timeoutMs",
+        "timeoutRetryAfterMs",
+        "waitTimeoutMs",
+        "workerIdleMs",
+        "workerMemoryMb"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/pdf"
+    },
+    {
+      "id": "dokebi-pdf-writer",
+      "package": "@dokebi/pdf-writer",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "PDF files written from markdown or blocks (headings, paragraphs, lists, tables, code, quotes, stored JPEG/PNG images) with embedded Korean fonts and font fallback, in worker threads with bounded pages, bytes, time and memory, stored in dokebi-storage",
+      "description": "PDF files written from markdown or blocks with embedded Korean fonts and stored images, in worker threads, stored in dokebi-storage.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "pdf",
+        "pdf-generation",
+        "markdown",
+        "korean"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "pdf.generate"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No HTML or CSS rendering: markdown HTML is printed as text, scripts never run",
+        "No WebP, GIF or AVIF images (they are skipped and reported); no remote images or fonts",
+        "No forms, JavaScript, attachments, encryption or signatures in the written PDF; no public routes or access policy"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-storage",
+          "range": "^0.1.0",
+          "package": "@dokebi/storage",
+          "automatic": true
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-image",
+          "range": "^0.1.0"
+        }
+      ],
+      "optionKeys": [
+        "boldFont",
+        "busyRetryAfterMs",
+        "fallbackFonts",
+        "font",
+        "fontSize",
+        "marginPt",
+        "maxBlocks",
+        "maxConcurrent",
+        "maxImageBytes",
+        "maxImagePixels",
+        "maxImages",
+        "maxOutputBytes",
+        "maxPages",
+        "maxPendingBytes",
+        "maxSourceChars",
+        "maxWaiting",
+        "pageSize",
+        "svgMaxSide",
+        "timeoutMs",
+        "timeoutRetryAfterMs",
+        "waitTimeoutMs",
+        "workerIdleMs",
+        "workerMemoryMb"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/pdf-writer"
+    },
+    {
+      "id": "dokebi-permissions",
+      "package": "@dokebi/permissions",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Roles, grades and scoped permissions: keys declared in code, grants saved in your database in the caller's transaction, can(actor, key, target) from memory over the holding tree (all, subtree, direct, own), list conditions as SQL, every worker refreshed by a revision; plugs into @dokebi/auth's authorize",
+      "description": "Roles, grades and scoped permissions for Dokebi: permissions declared in code, grants saved in your database in the caller's transaction, checks from memory over the holding tree (all, subtree, direct, own), list conditions as SQL, every worker refreshed by a revision.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "permissions",
+        "authorization",
+        "roles",
+        "rbac"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "auth.permissions"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "Does not own your roles, grades or members: it knows their keys and the tree you pass (id, parentId, path)",
+        "Does not decide business rules such as which member types a grade may create",
+        "Does not create tables at start (the migration dokebi add writes)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "connection",
+        "refreshMs",
+        "superRoles"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/permissions"
+    },
+    {
+      "id": "dokebi-rate-limit",
+      "package": "@dokebi/rate-limit",
+      "version": "0.1.1",
+      "kind": "plugin",
+      "summary": "Bounded token buckets with local counters or shared atomic Redis limits",
+      "description": "Bounded token-bucket limits with synchronous local and atomic shared Redis stores.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "rate-limit"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "rate-limit"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No automatic routes, trusted proxy configuration, user identification or distributed local state",
+        "No automatic retries or fail-open fallback on storage failure"
+      ],
+      "recipes": [],
+      "requires": [],
+      "optional": [
+        {
+          "id": "dokebi-redis",
+          "range": "^0.4.1"
+        }
+      ],
+      "optionKeys": [
+        "connection",
+        "driver",
+        "identity",
+        "logRepeatWindowMs",
+        "maxKeyLength",
+        "maxPending",
+        "maxPolicyRevisions",
+        "namespace",
+        "policies",
+        "policyOverlapWarnMs",
+        "policyRevisionTtlMs",
+        "retryAfterMs"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/rate-limit"
+    },
     {
       "id": "dokebi-redis",
       "package": "@dokebi/redis",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "plugin",
       "summary": "Named standalone Redis connections and leader election (coordination)",
       "description": "Named, lifecycle-owned Redis connections for Dokebi with leader election and coordination.",
@@ -1059,7 +2526,7 @@
         "coordination"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "redis.connection",
         "redis.coordination"
@@ -1078,18 +2545,110 @@
         }
       ],
       "optionKeys": [
-        "connections"
+        "connections"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/redis"
+    },
+    {
+      "id": null,
+      "package": "@dokebi/rich-text",
+      "version": "0.1.0",
+      "kind": "library",
+      "summary": "Editor documents (Tiptap or ProseMirror JSON) checked whole against a declared schema of nodes, marks, links and image sources, with coded 422 errors, then safe HTML, plain text and excerpts",
+      "description": "Rich text documents for Dokebi: editor JSON (Tiptap, ProseMirror) checked whole against a declared schema with coded 422 errors, then safe HTML, plain text and excerpts.",
+      "keywords": [
+        "dokebi",
+        "rich-text",
+        "tiptap",
+        "prosemirror",
+        "sanitize",
+        "html"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "content.rich-text"
+      ],
+      "variants": [],
+      "doesNot": [
+        "Not a plugin you app.register: npm install it and define a schema in your code",
+        "No editor (use Tiptap in the browser) and no custom nodes with your own HTML",
+        "Does not clean arbitrary HTML: it writes HTML only from checked documents"
+      ],
+      "recipes": [],
+      "requires": [],
+      "optional": [],
+      "optionKeys": [],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npm install @dokebi/rich-text"
+    },
+    {
+      "id": "dokebi-rollups",
+      "package": "@dokebi/rollups",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Report roll-ups by @dokebi/db AI.md 6.9: facts recorded as small rows in the caller's transaction (no hot row), folded in parallel by outbox lanes into UTC hour rows and day and month rows per whole-hour time zone (rebuilt from the hours when a zone is added), bounded reads with an as-of time, running totals and a report budget (429, 503)",
+      "description": "Report roll-ups for Dokebi by @dokebi/db AI.md 6.9: facts recorded as small rows in the caller's transaction, folded by outbox lanes into UTC hour rows and day and month rows per time zone, bounded reads with an as-of time and a report budget.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "reports",
+        "statistics",
+        "rollups",
+        "aggregates"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "reports.rollups"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "No rankings (top N per bucket) and no distinct counts (active members): sums only",
+        "No time zones with half-hour offsets: day rows are cut from UTC hour rows",
+        "Does not create tables at start (the migration dokebi add writes)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        },
+        {
+          "id": "dokebi-outbox",
+          "range": "^0.1.0",
+          "package": "@dokebi/outbox",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "connection",
+        "fold",
+        "rebuild",
+        "reports",
+        "zones"
       ],
       "docs": {
         "ai": "AI.md",
         "readme": "README.md"
       },
-      "install": "npx dokebi add @dokebi/redis"
+      "install": "npx dokebi add @dokebi/rollups"
     },
     {
       "id": "dokebi-router",
       "package": "@dokebi/router",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "plugin",
       "summary": "Adds routes in a prefix scope on top of dokebi-web (mount)",
       "description": "Prefix-mounted Fastify route scopes for @dokebi/web.",
@@ -1124,10 +2683,58 @@
       },
       "install": "npx dokebi add @dokebi/router"
     },
+    {
+      "id": "dokebi-runtime-settings",
+      "package": "@dokebi/runtime-settings",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Settings operators change while the app runs: definitions in code (a group tree, text, number, numbers per choice, boolean, select, multiselect, json and file with rules, choices from your data), common and personal values saved in your database in the caller's transaction (the changes answered for the audit log), common values read from memory, every worker refreshed by a revision",
+      "description": "Settings operators change while the app runs, for Dokebi: definitions in code (a group tree, nine types with rules, choices from your data), common and personal values in your database saved in the caller's transaction, common values read from memory, every worker refreshed by a revision.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "settings",
+        "configuration",
+        "admin",
+        "database"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "settings.runtime"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "Keeps no history of its own: write the changes it answers with @dokebi/audit in the same transaction",
+        "Does not store files: a file setting holds a stored file's key, name, size and type",
+        "Settings that change only with a deploy belong in dokebi.yaml (npx dokebi settings add)",
+        "Does not create tables at start (the migration dokebi add writes)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "connection",
+        "refreshMs"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/runtime-settings"
+    },
     {
       "id": "dokebi-scheduler",
       "package": "@dokebi/scheduler",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "plugin",
       "summary": "Submits fixed-interval and cron schedules as @dokebi/job jobs (one leader through Redis)",
       "description": "Interval and cron schedules (with time zones) for Dokebi that submit jobs, with one leader over Redis.",
@@ -1163,6 +2770,8 @@
       "optionKeys": [
         "allowInCluster",
         "coordination",
+        "logRepeatWindowMs",
+        "retryAfterMs",
         "schedules",
         "shutdownTimeoutMs"
       ],
@@ -1175,7 +2784,7 @@
     {
       "id": "dokebi-seal",
       "package": "@dokebi/seal",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "plugin",
       "summary": "Seals WebSocket frames and HTTP bodies (obfuscation, replay protection) with a browser client (WASM)",
       "description": "Payload sealing (obfuscation, replay defence, in-transit encryption) for seal hosts: @dokebi/websocket frames and @dokebi/web HTTP bodies, with browser socket, fetch and Inertia clients and their WASM loader",
@@ -1187,7 +2796,7 @@
         "obfuscation"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "security.seal"
       ],
@@ -1206,19 +2815,80 @@
         {
           "id": "dokebi-websocket-hub",
           "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-redis",
+          "range": "^0.4.0"
         }
       ],
-      "optionKeys": [],
+      "optionKeys": [
+        "logRepeatWindowMs",
+        "nonces",
+        "routeIds"
+      ],
       "docs": {
         "ai": "AI.md",
         "readme": "README.md"
       },
       "install": "npx dokebi add @dokebi/seal"
     },
+    {
+      "id": "dokebi-search",
+      "package": "@dokebi/search",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Search in your lists that stays bounded on a growing table: a term table in display order written in the text's transaction, Korean word prefixes, the rarest word leads, capped requests and searches with a signed cursor; answers item ids",
+      "description": "Search in an application's lists for Dokebi by @dokebi/db AI.md 6.10: a term table in display order written in the text's transaction, Korean word prefixes, the rarest word leads, bounded requests and searches with a signed cursor.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "search",
+        "full-text",
+        "database"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "search"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "No relevance ranking: results come in the index's display order",
+        "Does not read or authorize your rows: it answers item ids, and hidden items are removed from the index by your code",
+        "No typo tolerance, synonyms or stemming beyond word prefixes",
+        "Does not create tables at start (the migration dokebi add writes)"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "connection",
+        "counts",
+        "examineLimit",
+        "list",
+        "pool",
+        "searchLimit",
+        "secrets",
+        "secretsEnv"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/search"
+    },
     {
       "id": "dokebi-session",
       "package": "@dokebi/session",
-      "version": "0.4.0",
+      "version": "0.4.4",
       "kind": "plugin",
       "summary": "Server-side sessions for @dokebi/web (signed cookie, memory or redis store, flash)",
       "description": "Server-side sessions for @dokebi/web: signed cookie, memory or Redis store, flash.",
@@ -1230,7 +2900,7 @@
         "cookie"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "web.session"
       ],
@@ -1240,12 +2910,13 @@
         "Does not issue CSRF tokens"
       ],
       "recipes": [
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [
         {
           "id": "dokebi-web",
-          "range": "^0.4.0"
+          "range": "^0.4.3"
         }
       ],
       "optional": [
@@ -1256,18 +2927,28 @@
         {
           "id": "dokebi-health",
           "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-geoip",
+          "range": "^0.1.0"
         }
       ],
       "optionKeys": [
         "absoluteMs",
+        "apps",
         "cookie",
+        "devices",
         "exclude",
+        "logRepeatWindowMs",
         "maxBytes",
+        "maxMergeAttempts",
+        "maxOnce",
         "refreshBelow",
         "rolling",
         "secrets",
         "secretsEnv",
         "store",
+        "storeProbeIntervalMs",
         "ttlMs"
       ],
       "docs": {
@@ -1279,7 +2960,7 @@
     {
       "id": "dokebi-sse",
       "package": "@dokebi/sse",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "plugin",
       "summary": "Server-sent events (SSE) streams and rooms, delivery across workers, and a browser client",
       "description": "Server-sent events for @dokebi/web: authenticated streams, rooms, cross-worker fan-out over @dokebi/event-bus, and a browser client",
@@ -1291,7 +2972,7 @@
         "realtime"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "realtime.sse"
       ],
@@ -1303,7 +2984,7 @@
       "requires": [
         {
           "id": "dokebi-web",
-          "range": "^0.4.0"
+          "range": "^0.4.3"
         }
       ],
       "optional": [
@@ -1318,13 +2999,19 @@
       ],
       "optionKeys": [
         "allowInCluster",
+        "beforeStreamTimeoutMs",
         "busEvent",
+        "busRetryAfterMs",
+        "busWatchIntervalMs",
+        "endTimeoutMs",
         "eventBus",
         "heartbeatMs",
+        "logRepeatWindowMs",
         "maxBufferedBytes",
         "maxConnections",
         "maxEventBytes",
         "maxRooms",
+        "reloadRetryMs",
         "retryMs",
         "shutdownTimeoutMs"
       ],
@@ -1334,10 +3021,110 @@
       },
       "install": "npx dokebi add @dokebi/sse"
     },
+    {
+      "id": "dokebi-static",
+      "package": "@dokebi/static",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Folders served under a path prefix (update feeds, installers, downloads) through @fastify/static: Range, ETag, conditional requests, cache rules per pattern, no listing, no path outside the root, uploads in progress hidden",
+      "description": "Folders served under a path prefix on @dokebi/web through @fastify/static: Range, ETag, conditional requests and cache rules, never a path outside the root or a file being uploaded.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "web",
+        "static",
+        "files",
+        "range"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "static.files"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No access policy: a mount is public on its hosts (private files belong in @dokebi/storage behind your own check)",
+        "No directory listing, index files, uploads or files generated per request"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-web",
+          "range": "^0.4.3",
+          "package": "@dokebi/web",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "maxCacheRules",
+        "maxHide",
+        "maxMounts",
+        "maxTypes",
+        "mounts"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/static"
+    },
+    {
+      "id": "dokebi-storage",
+      "package": "@dokebi/storage",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Local and S3 file storage with bounded multipart uploads and private downloads",
+      "description": "Bounded streaming file storage with local and S3 drivers and optional multipart uploads.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "storage",
+        "s3",
+        "upload"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "upload"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No automatic public routes, access policy, virus scanning or image processing",
+        "Single-object uploads; no resumable uploads or S3 multipart upload API"
+      ],
+      "recipes": [],
+      "requires": [],
+      "optional": [],
+      "optionKeys": [
+        "busyRetryAfterMs",
+        "directory",
+        "driver",
+        "maxConcurrent",
+        "maxFileBytes",
+        "maxListPage",
+        "maxWaiting",
+        "s3",
+        "signedUrlExpiresIn",
+        "signedUrlMaxExpiresIn",
+        "sniffBytes",
+        "staleUploadMs",
+        "tempDirectory",
+        "timeoutMs",
+        "timeoutRetryAfterMs",
+        "unavailableRetryAfterMs",
+        "waitTimeoutMs"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/storage"
+    },
     {
       "id": "dokebi-template-ejs",
       "package": "@dokebi/template-ejs",
-      "version": "0.4.1",
+      "version": "0.4.3",
       "kind": "plugin",
       "summary": "Compiles EJS templates at startup and renders them by name (layouts, partials, a scope per app)",
       "description": "Precompiled EJS templates for Dokebi apps: layouts, partials and per-app scopes.",
@@ -1365,7 +3152,8 @@
       ],
       "recipes": [
         "api",
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [],
       "optional": [],
@@ -1384,7 +3172,7 @@
     {
       "id": "dokebi-template-inertia",
       "package": "@dokebi/template-inertia",
-      "version": "0.4.1",
+      "version": "0.4.4",
       "kind": "plugin",
       "summary": "Inertia (v3) server adapter: Vue 3 views, Vite build files and optional server-side rendering (SSR)",
       "description": "Inertia v3 server adapter for Dokebi: page JSON, Vite manifest assets and optional server-side rendering.",
@@ -1398,7 +3186,7 @@
         "ssr"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "view.inertia-vue",
         "view.inertia-vue-ssr"
@@ -1436,12 +3224,13 @@
         "Vue and Vite are not server dependencies (they are dev dependencies of the app)"
       ],
       "recipes": [
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [
         {
           "id": "dokebi-web",
-          "range": "^0.4.1"
+          "range": "^0.4.3"
         }
       ],
       "optional": [
@@ -1451,15 +3240,22 @@
         }
       ],
       "optionKeys": [
+        "assetCacheMaxBytes",
+        "bootFallback",
+        "devDepsRepairIntervalMs",
+        "devHosts",
         "encryptHistory",
         "errorPage",
+        "logRepeatWindowMs",
         "rootId",
+        "routeIds",
         "scripts",
         "ssr",
         "styles",
         "title",
         "version",
-        "vite"
+        "vite",
+        "viteManifestMaxBytes"
       ],
       "docs": {
         "ai": "AI.md",
@@ -1467,12 +3263,132 @@
       },
       "install": "npx dokebi add @dokebi/template-inertia"
     },
+    {
+      "id": "dokebi-tree",
+      "package": "@dokebi/tree",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Trees in your own tables (categories, a members' holding tree): materialized paths kept on place and move, a subtree moved in one UPDATE in the caller's transaction and never under itself, sibling order with the parent locked, ancestors, subtree SQL conditions, and keyset pages in tree order that keep their parent context",
+      "description": "Trees in your own tables for Dokebi: materialized paths, places and subtree moves in the caller's transaction (never under itself), sibling order, ancestors, subtree conditions, and pages in tree order that keep their parent context.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "tree",
+        "hierarchy",
+        "categories",
+        "database"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "data.tree"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "Owns no table: your migration adds the parent, path and order columns",
+        "Does not decide who may move what: your routes do"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        }
+      ],
+      "optional": [
+        {
+          "id": "dokebi-lock",
+          "range": "^0.4.0"
+        }
+      ],
+      "optionKeys": [
+        "busyRetryAfterMs",
+        "connection",
+        "lockBackend",
+        "lockWaitTimeoutMs",
+        "maxMove",
+        "maxPage",
+        "maxRepair"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/tree"
+    },
+    {
+      "id": "dokebi-two-factor",
+      "package": "@dokebi/two-factor",
+      "version": "0.1.0",
+      "kind": "plugin",
+      "summary": "Two-factor sign-in for @dokebi/auth: TOTP codes of authenticator apps (secrets encrypted at rest, a code good once), ten recovery codes kept as HMACs, a second step after the password, remembered devices, lockout after wrong codes, and a code confirmation for the re-authentication page",
+      "description": "Two-factor sign-in for @dokebi/auth: TOTP codes of authenticator apps (secrets encrypted at rest), recovery codes stored as HMACs, a second step after the password, remembered devices, lockout, and a code confirmation for re-authentication.",
+      "keywords": [
+        "dokebi",
+        "dokebi-plugin",
+        "two-factor",
+        "2fa",
+        "totp",
+        "mfa",
+        "auth"
+      ],
+      "maturity": "experimental",
+      "core": "^0.4.2",
+      "provides": [
+        "two-factor"
+      ],
+      "variants": [],
+      "doesNot": [
+        "No MongoDB (PostgreSQL, MySQL 8, MariaDB 10.6+)",
+        "No SMS, e-mail codes, WebAuthn or passkeys: TOTP and recovery codes only",
+        "Does not decide who must use it: the application sends those users to its setup page",
+        "Cannot stop a login route that calls request.auth.attempt itself: use twoFactor.attempt there",
+        "Does not draw the QR code: it answers the otpauth URI"
+      ],
+      "recipes": [],
+      "requires": [
+        {
+          "id": "dokebi-db",
+          "range": "^0.4.1",
+          "package": "@dokebi/db",
+          "automatic": true
+        },
+        {
+          "id": "dokebi-auth",
+          "range": "^0.4.1",
+          "package": "@dokebi/auth",
+          "automatic": true
+        }
+      ],
+      "optional": [],
+      "optionKeys": [
+        "challengeMs",
+        "confirmMs",
+        "connection",
+        "enrollMs",
+        "issuer",
+        "lockMs",
+        "maxFailures",
+        "maxTries",
+        "rememberDeviceMs",
+        "secrets",
+        "secretsEnv"
+      ],
+      "docs": {
+        "ai": "AI.md",
+        "readme": "README.md"
+      },
+      "install": "npx dokebi add @dokebi/two-factor"
+    },
     {
       "id": "dokebi-web",
       "package": "@dokebi/web",
-      "version": "0.4.1",
+      "version": "0.4.3",
       "kind": "plugin",
-      "summary": "Fastify 5 HTTP server (503 before ready, health paths, drain, zero-downtime cluster replacement)",
+      "summary": "Fastify 5 HTTP server (503 before ready, health paths, drain, zero-downtime cluster replacement, security headers and overload protection on by default)",
       "description": "Fastify 5 HTTP server owned by a Dokebi app: 503 before ready, health routes, drain and cluster handover.",
       "keywords": [
         "dokebi",
@@ -1482,38 +3398,63 @@
         "fastify"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
-        "web.http"
+        "web.http",
+        "web.overload",
+        "web.security-headers"
       ],
       "variants": [],
       "doesNot": [
-        "No built-in authentication, rate limit, CORS or security headers",
+        "No built-in authentication, rate limit or CORS (CORS is @dokebi/cors)",
         "No file upload (multipart)"
       ],
       "recipes": [
         "api",
-        "blog"
+        "blog",
+        "site"
       ],
       "requires": [],
       "optional": [
         {
           "id": "dokebi-health",
           "range": "^0.4.0"
+        },
+        {
+          "id": "dokebi-logger",
+          "range": "^0.1.0"
         }
       ],
       "optionKeys": [
+        "binaryBody",
+        "compression",
         "developmentErrors",
+        "drainGraceMs",
+        "drainIdleMs",
         "formBody",
         "formMaxFields",
+        "formOldInputMaxChars",
+        "formRefererMaxLength",
         "healthRoutes",
         "host",
+        "linger",
+        "logRepeatWindowMs",
         "maxBodyBytes",
+        "maxRouteBodyBytes",
+        "overload",
         "port",
         "requestTimeoutMs",
+        "routeIds",
         "sealDriftMs",
         "sealExclude",
-        "trustProxy"
+        "sealRetryAfterMs",
+        "securityHeaders",
+        "transientLogLevel",
+        "transientLogMaxKeys",
+        "transientLogWindowMs",
+        "trustProxy",
+        "unavailableRetryAfterMs",
+        "unknownFields"
       ],
       "docs": {
         "ai": "AI.md",
@@ -1524,7 +3465,7 @@
     {
       "id": "dokebi-websocket",
       "package": "@dokebi/websocket",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "plugin",
       "summary": "WebSocket routes, rooms and broadcast on top of dokebi-web (at most once)",
       "description": "WebSocket routes on @dokebi/web with rooms and broadcast across servers through @dokebi/websocket-hub.",
@@ -1536,7 +3477,7 @@
         "realtime"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "realtime.websocket"
       ],
@@ -1552,7 +3493,7 @@
         },
         {
           "id": "dokebi-web",
-          "range": "^0.4.0"
+          "range": "^0.4.3"
         }
       ],
       "optional": [
@@ -1562,9 +3503,12 @@
         }
       ],
       "optionKeys": [
+        "beforeUpgradeTimeoutMs",
         "heartbeatMs",
+        "hubFanOut",
         "hubWaitMs",
         "idleTimeoutMs",
+        "logRepeatWindowMs",
         "maxBufferedBytes",
         "maxConnections",
         "maxPayloadBytes",
@@ -1581,7 +3525,7 @@
     {
       "id": "dokebi-websocket-hub",
       "package": "@dokebi/websocket-hub",
-      "version": "0.4.0",
+      "version": "0.4.2",
       "kind": "plugin",
       "summary": "Hub of WebSocket clients, rooms, broadcast and kick (usually used through @dokebi/websocket)",
       "description": "WebSocket hub for Dokebi: connection roster, rooms, broadcast and kick across workers and servers.",
@@ -1593,7 +3537,7 @@
         "realtime"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "realtime.hub"
       ],
@@ -1616,10 +3560,13 @@
       "optionKeys": [
         "advertiseHost",
         "allowInCluster",
+        "broadcastShare",
         "host",
         "leaseMs",
+        "logRepeatWindowMs",
         "maxConnections",
         "maxFrameBytes",
+        "maxNonces",
         "maxOwners",
         "maxPayloadBytes",
         "maxPending",
@@ -1645,7 +3592,7 @@
     {
       "id": "dokebi-worker",
       "package": "@dokebi/worker",
-      "version": "0.4.0",
+      "version": "0.4.1",
       "kind": "plugin",
       "summary": "Runs CPU-heavy functions in a worker thread pool",
       "description": "Worker thread pool for CPU-heavy functions in a Dokebi app.",
@@ -1657,7 +3604,7 @@
         "pool"
       ],
       "maturity": "preview",
-      "core": "^0.4.0",
+      "core": "^0.4.2",
       "provides": [
         "worker.thread"
       ],
@@ -1666,7 +3613,9 @@
         "Not several processes (cluster)",
         "Not a distributed job queue (@dokebi/job)"
       ],
-      "recipes": [],
+      "recipes": [
+        "site"
+      ],
       "requires": [],
       "optional": [],
       "optionKeys": [
@@ -1688,41 +3637,44 @@
   "recipes": [
     {
       "name": "api",
-      "summary": "JSON API server (one app, one JSON module and a database of your choice)",
+      "summary": "JSON API for other programs (one app, one JSON module and a database of your choice); builds no browser screens — when people use the service in a browser, use site or blog",
       "match": [
         "api",
         "rest",
         "json",
         "backend"
       ],
+      "screens": false,
       "capabilities": [
         "web.apps",
-        "web.modules"
+        "web.modules",
+        "logging.targets"
       ],
       "questions": [
         "db",
-        "devInfra"
+        "devInfra",
+        "mail"
       ],
       "fixed": {
-        "view": "ejs",
         "admin": "none"
       },
       "module": {
         "name": "items",
         "views": false,
-        "why": "A feature module that answers JSON: write the API in its routes.ts and controllers"
+        "why": "A feature module that answers JSON: bind routes in routes.ts; controllers call services, and models own persistence"
       },
       "web": {
         "port": 3000,
-        "domain": "localhost"
+        "domain": "auto"
       },
       "then": [
-        "Attach the module to the app: modules: { \"/api/items\": items } in src/apps/main/app.ts"
+        "Attach the module to the app: modules: { \"/api/items\": items } in src/apps/main/app.ts",
+        "Security headers and overload protection of @dokebi/web are on by default (D-0149, D-0150): keep them. Only when the user asks that browser pages on other origins call this API, add @dokebi/cors and list those origins (D-0148)"
       ]
     },
     {
       "name": "blog",
-      "summary": "A blog web app with a post list and post pages (choose the views, database, development database and admin area)",
+      "summary": "A blog web app with browser screens: a post list and post pages (choose the views (default Inertia + Vue), database, development database and admin area)",
       "match": [
         "blog",
         "board",
@@ -1732,27 +3684,72 @@
       ],
       "capabilities": [
         "web.apps",
-        "web.modules"
+        "web.modules",
+        "csrf",
+        "logging.targets"
       ],
       "questions": [
         "view",
         "db",
         "devInfra",
-        "admin"
+        "admin",
+        "mail"
       ],
       "module": {
         "name": "posts",
-        "why": "The module for the posts feature: write its controllers, models and routes here"
+        "why": "The module for the posts feature: write its controllers, services, models and routes here"
       },
       "web": {
         "port": 3000,
-        "domain": "localhost",
+        "domain": "auto",
         "forms": true
       },
       "then": [
+        "Web application requirements: install the i18n capability and verify sealing (the recipe installed security.seal and sealed the browser hosts). Inertia + Vue is the default view unless the user chose another: keep the sealInertia bootstrap of views/app.js before createInertiaApp and dokebiInertia() in vite.config.ts (it makes every import of @dokebi/seal/http load the served /dokebi/seal/http.mjs); the first page and every visit then go sealed. With inertia-vue-ssr the recipe left the hosts unsealed, because SSR writes the props into plain HTML (SEAL_SSR_CONFLICT): tell the user and let them choose. With EJS, the recipe sealed the host and turned on dokebi-web.formBody (sealed forms are form bodies); keep <%- data.seal?.head ?? '' %> in the shared layout <head> (first, before an import map of its own); it loads @dokebi/seal/forms, which seals every post form with no per-form code and moves _csrf into the x-csrf-token header of a multipart form itself. Submit from a script with form.requestSubmit() or submitSealedForm(form), never form.submit() (it goes out plain: 415); data-seal=\"off\" only for a deliberate exception, never to make a plain form post pass (a sealed host answers it 415). Application API requests use @dokebi/seal/http sealedFetch, with the same module instance as that bootstrap (Inertia: import { sealedFetch } from @dokebi/seal/http in the page; dokebiInertia() makes it the served module views/app.js uses), and the documented CSRF header. Do not substitute raw fetch or direct Inertia HTTP calls, and never turn sealing off to make a form work or a request pass",
+        "Provide Korean and English UI, validation messages and persistent language switching. Keep matching feature catalogs under src/shared/locales/ko and src/shared/locales/en and use the documented key/default pair. Read the installed i18n AI guide; Vue pages use useI18n() of @dokebi/template-inertia/i18n",
+        "Confirm single application process or process cluster and the worker count with the user. The blog recipe does not configure process topology. For cluster, discover process.cluster, install the library from its catalog entry, and read node_modules/@dokebi/cluster/AI.md. Keep the parent in src/main.ts and the worker factory in src/infra/runtime/application.ts; configure the count in YAML and share its absolute DOKEBI_CONFIG path. Provision shared state and queues actually used by the app before checking all workers and graceful shutdown. Job consumers and CPU threads are separate choices; there is no recipe --workers flag",
         "Attach the module to the app: modules: { \"/posts\": posts } in src/apps/main/app.ts (posts = the default export of src/shared/modules/posts/module.ts)",
-        "Write the post list (GET /posts) and the post page (GET /posts/:id) in the routes.ts and controllers of the module",
-        "The write form (GET /posts/new → POST /posts) reads request.body (with EJS the recipe turned on dokebi-web.formBody). With --admin none it is a public form (no login); with app-code it belongs to the admin app. Either way it needs a CSRF token check in app code (csrf is absent). A refused post throws validationError({ title: \"Required\" }) from @dokebi/web (D-0074): an EJS form shows data.errors.title and data.old.title (with @dokebi/session the refused post goes back to the form, 303; without it views/default/errors/422.ejs or errors/error.ejs shows the fields), an Inertia form gets them in form.errors (submit with only). Edit the shared layout src/shared/views/layouts/main.ejs where it is"
+        "Bind the post list (GET /posts) and post page (GET /posts/:id) in routes.ts. Controllers handle HTTP through services, and services provide data through models. Keep SQL in models; use app-specific, shared or module services according to ownership",
+        "The write form (GET /posts/new → POST /posts) reads request.body (with EJS the recipe sealed the host and turned on dokebi-web.formBody: @dokebi/seal/forms sends the form sealed and the handler gets the same body). With --admin none it is a public form (no login); with login both routes get config: { auth: \"required\" } (only signed-in users write); with app-code it belongs to the admin app. @dokebi/csrf checks every POST: an EJS form writes <%- data.csrf.field %> inside the form, an Inertia form needs nothing (XSRF-TOKEN), sealedFetch sends the documented X-XSRF-TOKEN header through the shared adapter. A refused post throws validationError({ title: \"Required\" }) from @dokebi/web (D-0074): an EJS form shows data.errors.title and data.old.title (with @dokebi/session the refused post goes back to the form, 303; without it views/default/errors/422.ejs or errors/error.ejs shows the fields), an Inertia form gets them in form.errors (submit with only). Edit the shared layout only when the app actually uses EJS web pages; keep mail templates separately"
+      ]
+    },
+    {
+      "name": "site",
+      "summary": "A browser app people use (sign up, browse, press buttons, read lists): public web, admin and API apps of your choice with explicit domains, auth realms and an optional worker (asks the view; default Inertia + Vue)",
+      "match": [
+        "site",
+        "web",
+        "browser",
+        "service",
+        "screens",
+        "multiapp",
+        "admin",
+        "worker",
+        "domains"
+      ],
+      "capabilities": [
+        "web.apps",
+        "web.session",
+        "csrf",
+        "auth",
+        "logging.targets"
+      ],
+      "questions": [
+        "apps",
+        "domains",
+        "realms",
+        "view",
+        "worker"
+      ],
+      "web": {
+        "port": 3000,
+        "domain": "auto"
+      },
+      "then": [
+        "Connect the realm auth extensions to your own user tables before enabling login",
+        "Security headers and overload protection of @dokebi/web are on by default (D-0149, D-0150): keep them, and change a CSP directive in dokebi.yaml rather than turning them off. Add @dokebi/cors only when the user asks for pages on other origins (D-0148)",
+        "For web apps, install i18n (the recipe installed security.seal and sealed the web and admin hosts; api stays plain). Use @dokebi/seal/http for application API requests and preserve its Inertia bridge on the same module instance. Inertia web and admin apps: keep the sealInertia bootstrap of views/app.js before createInertiaApp and dokebiInertia() in vite.config.ts, and import sealedFetch from @dokebi/seal/http (the plugin makes it the same served module). With server rendering (inertia-vue-ssr) the recipe left them unsealed, because SSR writes the props into plain HTML (SEAL_SSR_CONFLICT): tell the user and let them choose. EJS web and admin apps are sealed hosts with dokebi-web.formBody on (the recipe did both): keep <%- data.seal?.head ?? '' %> in the shared layout <head> so @dokebi/seal/forms seals their post forms (no per-form code; a multipart form gets its _csrf moved into the x-csrf-token header); submit from a script with form.requestSubmit() or submitSealedForm(form), never form.submit(); never turn sealing off to make a form work. Follow the documented CSRF header contract; resolve explicit SSR conflicts before choosing configuration",
+        "For web apps, implement Korean and English catalogs by feature under src/shared/locales/ko and src/shared/locales/en, translated forms and validation, and persistent language switching; verify both languages"
       ]
     }
   ],
@@ -1761,53 +3758,197 @@
       "id": "admin",
       "flag": "--admin",
       "from": "fixed",
-      "question": "Do you need an admin area (a login that protects writing and managing posts)?",
+      "question": "Do you need an admin area (a login that protects writing and managing content)?",
       "default": "none",
-      "defaultReason": "There is no auth plugin, so the app would have to write the login itself. When the request does not mention an admin area, none is made; a public write form is still possible (it needs no login)",
+      "defaultReason": "When the request does not mention an admin area or a login, none is made. A public write form is still possible (it needs no login, and @dokebi/csrf protects it from other sites); choose login for an admin login",
       "options": [
         {
-          "value": "none",
-          "label": "None (no login and no admin area; a public write form is still possible)",
+          "value": "none",
+          "label": "None (no login and no admin area; a public write form is still possible)",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [
+            "The simplest choice with the smallest attack surface",
+            "Content can still be written in the browser with a public write form (with EJS the recipe turns on dokebi-web.formBody for it), protected from other sites by @dokebi/csrf"
+          ],
+          "cons": [
+            "Without a login anyone who can open the site can use the write form"
+          ]
+        },
+        {
+          "value": "login",
+          "label": "Admin login (only signed-in users write)",
           "capability": null,
           "available": true,
           "absent": false,
-          "plugins": [],
+          "plugins": [
+            "@dokebi/auth",
+            "@dokebi/csrf",
+            "@dokebi/session"
+          ],
           "alsoInstalls": [],
           "needs": [],
-          "absentFeatures": [],
+          "when": {
+            "db": "!none"
+          },
+          "absentFeatures": [
+            "admin.ui"
+          ],
           "pros": [
-            "The simplest choice with the smallest attack surface",
-            "Posts can still be written in the browser with a public write form (with EJS the recipe turns on dokebi-web.formBody for it)"
+            "A login page, sign-out, a protected admin page and a first admin account are made (@dokebi/auth session login); writing is for signed-in users only",
+            "The plugin hashes and checks passwords (argon2id or scrypt), throttles logins and shows one sentence for every failed login",
+            "The user table is the app's own (a migration with the app's column names); the first admin's password is generated into dokebi.yaml and never printed"
           ],
           "cons": [
-            "Without a login anyone who can open the site can use the write form",
-            "The write form has no CSRF protection until the app adds a token check (csrf is absent)"
+            "Password recovery requires an installed mail plugin with a job queue and an email address mapped by the extension",
+            "Needs a database for the user table (not available with --db none)",
+            "Sign-up and verification screens are app code using @dokebi/auth; two-factor sign-in is a separate package (npx dokebi add @dokebi/two-factor)"
           ]
         },
         {
           "value": "app-code",
-          "label": "An admin app written in app code",
+          "label": "An admin app whose login you write yourself (with @dokebi/auth)",
           "capability": null,
           "available": true,
           "absent": false,
           "plugins": [
+            "@dokebi/csrf",
             "@dokebi/session"
           ],
           "alsoInstalls": [],
           "needs": [],
           "absentFeatures": [
-            "auth",
             "admin.ui"
           ],
           "pros": [
-            "One app on its own domain (such as admin.localhost) with sessions is set up"
+            "One app on its own domain (admin.<project>.localhost) with sessions and CSRF protection is set up",
+            "You decide the login screens and the user table; add @dokebi/auth for the login itself"
           ],
           "cons": [
-            "Login, password hashing, permission checks and CSRF must be written in app code (there is no plugin)"
+            "The login, the user table and the permission checks are app code to write (npx dokebi add @dokebi/auth, then its extension class)"
           ]
         }
       ]
     },
+    {
+      "id": "apps",
+      "flag": "--apps",
+      "from": "fixed",
+      "question": "Which HTTP apps belong in this site?",
+      "default": "web,admin,api",
+      "defaultReason": "Separate public pages, administration and API domains",
+      "options": [
+        {
+          "value": "web",
+          "label": "web",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "admin",
+          "label": "admin",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "api",
+          "label": "api",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "web,admin",
+          "label": "web, admin",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "web,api",
+          "label": "web, api",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "admin,api",
+          "label": "admin, api",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "web,admin,api",
+          "label": "web, admin, api",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "none",
+          "label": "No HTTP apps (worker only)",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        }
+      ]
+    },
     {
       "id": "db",
       "flag": "--db",
@@ -1898,7 +4039,7 @@
           "needs": [],
           "absentFeatures": [],
           "pros": [
-            "Stores documents (JSON) without a schema, handy for data whose shape changes often, such as posts"
+            "Stores documents (JSON) without a schema, handy for data whose shape changes often, such as user-written content"
           ],
           "cons": [
             "Relations, joins and transactions are less convenient than in a SQL database",
@@ -1990,14 +4131,126 @@
         }
       ]
     },
+    {
+      "id": "domains",
+      "flag": "--domains",
+      "from": "fixed",
+      "input": "text",
+      "question": "Domain for each selected HTTP app: web=www.example.com,admin=admin.example.com,api=api.example.com. Use auto for <app>.<project>.localhost, the development hosts of this project (the project name from package.json, else the folder name), so two Dokebi projects on one machine never share cookies.",
+      "default": "auto",
+      "defaultReason": "Local development hosts unique to this project: browsers keep cookies per host, not per port",
+      "options": []
+    },
+    {
+      "id": "mail",
+      "flag": "--mail",
+      "from": "fixed",
+      "question": "How should development mail be delivered?",
+      "default": "none",
+      "defaultReason": "No mail is installed unless the user requests mail or password recovery",
+      "options": [
+        {
+          "value": "none",
+          "label": "No development mail",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [
+            "No extra services or credentials"
+          ],
+          "cons": [
+            "Password recovery requires mail and a durable job queue"
+          ]
+        },
+        {
+          "value": "mailpit",
+          "label": "Local Mailpit inbox with a durable job queue",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [
+            "@dokebi/job",
+            "@dokebi/mail",
+            "@dokebi/nats"
+          ],
+          "alsoInstalls": [],
+          "needs": [
+            "docker"
+          ],
+          "absentFeatures": [],
+          "pros": [
+            "Starts Mailpit and NATS in compose.mail.yaml with free loopback ports",
+            "Messages stay on this computer and are never delivered externally"
+          ],
+          "cons": [
+            "Docker is required",
+            "Not a production mail server"
+          ]
+        },
+        {
+          "value": "smtp",
+          "label": "Existing SMTP server",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [
+            "@dokebi/mail"
+          ],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [
+            "Uses an existing mail service"
+          ],
+          "cons": [
+            "First install mail and configure transport and sender in dokebi.yaml without putting credentials on a command line",
+            "Login recovery also requires a provisioned job queue"
+          ]
+        },
+        {
+          "value": "ses",
+          "label": "Amazon SES v2",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [
+            "@dokebi/mail"
+          ],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [
+            "Uses an existing SES account and verified sender"
+          ],
+          "cons": [
+            "First install mail and configure the region and verified sender in dokebi.yaml and AWS credentials through the documented options or environment",
+            "Login recovery also requires a provisioned job queue"
+          ]
+        }
+      ]
+    },
+    {
+      "id": "realms",
+      "flag": "--realms",
+      "from": "fixed",
+      "input": "text",
+      "question": "Authentication realm for each selected HTTP app: web=members,admin=staff,api=members. Use auto for separate app realms.",
+      "default": "auto",
+      "defaultReason": "Separate user sets for each app",
+      "options": []
+    },
     {
       "id": "view",
       "flag": "--view",
       "from": "variants",
       "capabilityPrefix": "view.",
       "question": "What should the views (screens) be built with?",
-      "default": "ejs",
-      "defaultReason": "No build step and it runs right away on one server. Enough for blog screens such as the post list and a post page",
+      "default": "inertia-vue",
+      "defaultReason": "The default for browser apps. It needs a Vite build (npm run build)",
       "options": [
         {
           "value": "ejs",
@@ -2073,7 +4326,8 @@
           ],
           "cons": [
             "Two builds (browser and server) and the most configuration",
-            "Uses more server memory and CPU"
+            "Uses more server memory and CPU",
+            "Cannot be sealed (@dokebi/seal): the server writes the page props into the first HTML as plain text, so its browser hosts stay unsealed"
           ]
         },
         {
@@ -2091,29 +4345,69 @@
           "cons": []
         }
       ]
+    },
+    {
+      "id": "worker",
+      "flag": "--worker",
+      "from": "fixed",
+      "question": "Does this site need a background job queue or CPU worker pool?",
+      "default": "none",
+      "defaultReason": "No worker infrastructure unless the application needs it",
+      "options": [
+        {
+          "value": "none",
+          "label": "No worker",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "thread",
+          "label": "CPU thread pool",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [
+            "@dokebi/worker"
+          ],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": []
+        },
+        {
+          "value": "job",
+          "label": "Durable NATS job queue",
+          "capability": null,
+          "available": true,
+          "absent": false,
+          "plugins": [
+            "@dokebi/job",
+            "@dokebi/nats"
+          ],
+          "alsoInstalls": [],
+          "needs": [],
+          "absentFeatures": [],
+          "pros": [],
+          "cons": [
+            "Configure NATS and provision the queue before starting; no database or infrastructure is invented"
+          ]
+        }
+      ]
     }
   ],
   "absent": [
     {
       "capability": "admin.ui",
       "summary": "There are no generated admin screens (CRUD generator)",
-      "instead": "Create one more app with dokebi app add admin --domain admin.localhost and write its screens in app code (there is no auth either, so the app writes the login)",
-      "verify": [
-        "no-provider"
-      ]
-    },
-    {
-      "capability": "auth",
-      "summary": "There is no login, sign-up or permission plugin",
-      "instead": "Write it in app code. Keep the login state in @dokebi/session and hash passwords with scrypt from node:crypto. Install an outside auth library only with the permission of the user",
-      "verify": [
-        "no-provider"
-      ]
-    },
-    {
-      "capability": "csrf",
-      "summary": "There is no CSRF token plugin",
-      "instead": "The app keeps a random token in the session and compares it with a hidden form field or a header (the @dokebi/session AI.md says what sameSite does and does not block)",
+      "instead": "Create one more app with dokebi app add admin --domain auto (its host admin.<project>.localhost) and write its screens in app code; protect them with @dokebi/auth (config.auth on the routes)",
       "verify": [
         "no-provider"
       ]
@@ -2127,25 +4421,17 @@
       ]
     },
     {
-      "capability": "i18n",
-      "summary": "There is no i18n plugin",
-      "instead": "Keep an object of strings per language in app code",
-      "verify": [
-        "no-provider"
-      ]
-    },
-    {
-      "capability": "mail",
-      "summary": "There is no mail plugin",
-      "instead": "With the permission of the user, use an SMTP library in app code. Mail that must be sent goes through an @dokebi/job job",
+      "capability": "markdown",
+      "summary": "There is no Markdown to HTML converter (@dokebi/pdf-writer lays markdown out only in PDF files)",
+      "instead": "Store and show the requested content as plain text (EJS escapes with <%= %>), or use a Markdown library with the permission of the user; to put markdown in a PDF file, use @dokebi/pdf-writer (it never makes HTML)",
       "verify": [
         "no-provider"
       ]
     },
     {
-      "capability": "markdown",
-      "summary": "There is no Markdown converter",
-      "instead": "Store and show post bodies as plain text (EJS escapes with <%= %>), or use a Markdown library with the permission of the user",
+      "capability": "oidc.client",
+      "summary": "There is no OpenID Connect client for an arbitrary provider (the social login of @dokebi/auth knows Google and Apple only)",
+      "instead": "Write the client in app code next to @dokebi/auth (request.auth.login after the callback) with the authorization code flow, PKCE S256, state and nonce bound to the browser, the ID token checked against the provider's JWKS (issuer, audience, expiry, nonce, no alg none), and users found by issuer and subject; make the provider's issuer, client id and secret settings; ask the user before adding a library",
       "verify": [
         "no-provider"
       ]
@@ -2158,34 +4444,10 @@
         "no-provider"
       ]
     },
-    {
-      "capability": "rate-limit",
-      "summary": "There is no rate limit plugin",
-      "instead": "Limit requests in the front proxy (nginx or similar), or register a Fastify plugin with the permission of the user",
-      "verify": [
-        "no-provider"
-      ]
-    },
     {
       "capability": "rss",
       "summary": "There is no RSS or Atom feed generator",
-      "instead": "Build the XML string in a controller and answer with application/rss+xml",
-      "verify": [
-        "no-provider"
-      ]
-    },
-    {
-      "capability": "search",
-      "summary": "There is no full-text search plugin",
-      "instead": "Use LIKE or the full-text search of the database (such as postgres tsvector) in app code",
-      "verify": [
-        "no-provider"
-      ]
-    },
-    {
-      "capability": "upload",
-      "summary": "There is no file upload (multipart) plugin",
-      "instead": "With the permission of the user the app registers a Fastify multipart plugin, or it starts without uploads",
+      "instead": "Build the feed in an application service, escape XML values, and have the controller answer with application/rss+xml",
       "verify": [
         "no-provider"
       ]