kmcom-nuxt-layers 6.4.0 → 6.5.0

package/layers/data/forms/server/api/contact.post.ts

@@ -1,16 +1,20 @@
-import { createError, defineEventHandler, readBody } from 'h3'
+import { createError, defineEventHandler, getRequestHeader, getRequestIP, readBody } from 'h3'
 import { sendContactEmail } from '#layers/mailer/server/utils/email'
 import { mailerLayerHooks } from '#layers/mailer/server/utils/hooks'
 
-import { contactSchema } from '../../app/utils/contact-schema'
+import { contactSchema } from '../../shared/utils/contact-schema'
 
 type RateLimitRecord = { count: number; resetAt: number }
+// Per-instance memory: serverless instances each keep their own count. Move to useStorage()
+// or the host's rate limiting if the limit must hold across instances.
 const rateLimitStore = new Map<string, RateLimitRecord>()
 const RATE_LIMIT_MAX = 5
 const RATE_LIMIT_WINDOW_MS = 60_000
 
 function checkRateLimit(ip: string): boolean {
   const now = Date.now()
+  // Drop expired windows so the map doesn't grow with every IP ever seen
+  for (const [key, entry] of rateLimitStore) if (now > entry.resetAt) rateLimitStore.delete(key)
   const record = rateLimitStore.get(ip)
   if (!record || now > record.resetAt) {
     rateLimitStore.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS })
@@ -22,11 +26,15 @@ function checkRateLimit(ip: string): boolean {
 }
 
 export default defineEventHandler(async (event) => {
-  const ip = getRequestIP(event, { xForwardedFor: true }) ?? 'unknown'
+  // Netlify's client IP header can't be set by the client; X-Forwarded-For's first entry can
+  const ip =
+    getRequestHeader(event, 'x-nf-client-connection-ip') ??
+    getRequestIP(event, { xForwardedFor: true }) ??
+    'unknown'
   if (!checkRateLimit(ip)) {
     throw createError({
-      statusCode: 429,
-      statusMessage: 'Too many requests. Please try again later.',
+      status: 429,
+      statusText: 'Too many requests. Please try again later.',
     })
   }
 
@@ -34,7 +42,7 @@ export default defineEventHandler(async (event) => {
   const result = contactSchema.safeParse(body)
 
   if (!result.success) {
-    throw createError({ statusCode: 400, data: result.error.flatten().fieldErrors })
+    throw createError({ status: 400, data: result.error.flatten().fieldErrors })
   }
 
   const data = result.data
@@ -49,7 +57,7 @@ export default defineEventHandler(async (event) => {
 
   await mailerLayerHooks.callHook('contact:failed', { ...data, error: emailResult.error })
   throw createError({
-    statusCode: 500,
-    statusMessage: 'Failed to send message. Please try again later.',
+    status: 500,
+    statusText: 'Failed to send message. Please try again later.',
   })
 })

package/layers/data/forms/server/api/forms/status.get.ts

@@ -4,6 +4,9 @@ import { useMailerConfig } from '#layers/mailer/server/utils/config'
 export default defineEventHandler(() => {
   const { resendApiKey, emailFrom, emailTo } = useMailerConfig()
 
+  // Addresses are dev-only: emailTo is the private inbox every submission lands in
+  if (!import.meta.dev) return { configured: Boolean(resendApiKey) }
+
   return {
     configured: Boolean(resendApiKey),
     emailFrom,

package/layers/data/forms/{app → shared}/utils/contact-schema.ts

@@ -1,7 +1,8 @@
 import { z } from 'zod'
 
 export const contactSchema = z.object({
-  name: z.string().min(3, 'Name must be at least 3 characters'),
+  // Real names can be one or two letters (Li, Ng), so only require one
+  name: z.string().trim().min(1, 'Please enter your name'),
   email: z.string().email('Please enter a valid email'),
   message: z.string().min(8, 'Message must be at least 8 characters'),
 })

package/layers/data/metadata/server/api/metadata/search.get.ts

@@ -1,19 +1,39 @@
 import { searchMetadata } from '../../utils/metadata/search'
 import { createError, defineEventHandler, getQuery } from 'h3'
-import type { MetadataMediaType, MetadataProviderId } from '#layers/metadata/shared/types'
+import type { MetadataMediaType } from '#layers/metadata/shared/types'
+
+const MEDIA_TYPES = new Set<MetadataMediaType>([
+  'book',
+  'comic',
+  'comic-series',
+  'manga',
+  'graphic-novel',
+  'collected-edition',
+  'movie',
+  'tv-show',
+])
+const MAX_LIMIT = 50
 
 // fallow-ignore-next-line complexity
 export default defineEventHandler(async (event) => {
   const query = getQuery(event)
 
   const q = String(query.q ?? '').trim()
-  if (!q) throw createError({ statusCode: 400, message: 'q is required' })
+  if (!q) throw createError({ status: 400, message: 'q is required' })
+
+  const mediaType = query.mediaType ? (String(query.mediaType) as MetadataMediaType) : undefined
+  if (mediaType && !MEDIA_TYPES.has(mediaType)) {
+    throw createError({ status: 400, message: `Unknown mediaType '${mediaType}'` })
+  }
+
+  // Unknown provider ids are dropped by searchMetadata's registry filter
+  const providers = query.providers ? String(query.providers).split(',').filter(Boolean) : undefined
 
-  const mediaType = query.mediaType as MetadataMediaType | undefined
-  const providers = query.providers
-    ? (String(query.providers).split(',').filter(Boolean) as MetadataProviderId[])
-    : undefined
-  const limit = query.limit ? Number(query.limit) : 10
+  const rawLimit = query.limit ? Number(query.limit) : 10
+  if (!Number.isInteger(rawLimit) || rawLimit < 1) {
+    throw createError({ status: 400, message: 'limit must be a positive integer' })
+  }
+  const limit = Math.min(rawLimit, MAX_LIMIT)
 
   return searchMetadata({
     query: q,

package/layers/data/metadata/server/api/metadata/status.get.ts

@@ -1,7 +1,10 @@
 import { getProviders } from '../../utils/metadata/provider-registry'
-import { defineEventHandler } from 'h3'
+import { createError, defineEventHandler } from 'h3'
 
 export default defineEventHandler(async () => {
+  // Dev-only: each call runs a live search on every provider, spending real API quota
+  if (!import.meta.dev) throw createError({ status: 404 })
+
   const providers = getProviders()
 
   return Promise.all(

package/layers/data/metadata/server/api/metadata/sync.post.ts

@@ -1,8 +1,18 @@
 import { resolveRecord } from '../../utils/metadata/resolve-record'
 import { defineEventHandler, readBody } from 'h3'
-import type { MetadataSyncInput } from '#layers/metadata/shared/types'
+
+const str = (v: unknown) => (typeof v === 'string' && v.trim() ? v.trim() : undefined)
 
 export default defineEventHandler(async (event) => {
-  const body = await readBody<MetadataSyncInput>(event)
-  return resolveRecord({ ...body })
+  // Pick known fields only; resolveRecord rejects missing provider/providerId with a 400
+  const body = (await readBody<Record<string, unknown>>(event)) ?? {}
+  const provider = str(body.provider)
+  const providerId = str(body.providerId)
+  const resourceType = str(body.resourceType)
+  return resolveRecord({
+    ...(provider && { provider }),
+    ...(providerId && { providerId }),
+    ...(resourceType && { resourceType }),
+    force: body.force === true,
+  })
 })

package/layers/data/metadata/server/utils/metadata/resolve-record.ts

@@ -20,12 +20,12 @@ export async function resolveRecord(
 ): Promise<{ record: MetadataRecord; synced: boolean }> {
   const { provider: providerName, providerId, resourceType, force } = input
   if (!providerName || !providerId) {
-    throw createError({ statusCode: 400, message: 'provider and providerId are required' })
+    throw createError({ status: 400, message: 'provider and providerId are required' })
   }
 
   const provider = getProvider(providerName)
   if (!provider) {
-    throw createError({ statusCode: 404, message: `Provider '${providerName}' not registered` })
+    throw createError({ status: 404, message: `Provider '${providerName}' not registered` })
   }
 
   const cacheKey = makeCacheKey('metadata', providerName, resourceType ?? 'item', providerId)
@@ -40,7 +40,7 @@ export async function resolveRecord(
     providerId,
     ...(resourceType && { resourceType }),
   })
-  if (!record) throw createError({ statusCode: 404, message: 'Not found' })
+  if (!record) throw createError({ status: 404, message: 'Not found' })
 
   const now = new Date().toISOString()
   await setCacheRecord(cacheKey, {

package/layers/delivery/feeds/nuxt.config.ts

@@ -4,7 +4,7 @@ export default defineNuxtConfig({
     name: 'feeds',
   },
 
-  extends: process.env.FEEDS_STANDALONE ? ['../../core', '../../content'] : [],
+  extends: ['../../core', '../../content'],
 
   alias: {
     '#layers/feeds': import.meta.dirname,
@@ -29,4 +29,9 @@ export default defineNuxtConfig({
   },
 
   compatibilityDate: '2025-07-15',
+
+  typescript: {
+    typeCheck: false,
+    strict: true,
+  },
 })

package/layers/delivery/feeds/package.json

@@ -8,8 +8,8 @@
     "typecheck": "vue-tsc --noEmit -p ../../../tsconfig.typecheck.json",
     "dev": "nuxi dev .playground",
     "dev:prepare": "nuxt prepare .playground",
-    "build": "FEEDS_STANDALONE=true nuxi build",
-    "generate": "FEEDS_STANDALONE=true nuxi generate",
+    "build": "nuxi build",
+    "generate": "nuxi generate",
     "preview": "nuxt preview .playground",
     "lint": "eslint ."
   },

package/layers/delivery/feeds/server/routes/feed/demo.get.ts

@@ -1,6 +1,6 @@
 import { buildFeed } from '../../utils/feed-service'
 import { defineEventHandler, getRequestURL, setHeader } from 'h3'
-import { useAppConfig } from 'nitropack/runtime'
+import { readServerAppConfig } from '#layers/core/server/utils/app-config'
 
 const RSS_ICON = `<svg viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">
         <path d="M2.5 3a.5.5 0 0 1 .5-.5h1a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5H3a.5.5 0 0 1-.5-.5V3Z"/>
@@ -26,7 +26,7 @@ function formatDate(date: Date): string {
 }
 
 export default defineEventHandler(async (event) => {
-  const appConfig = useAppConfig()
+  const appConfig = readServerAppConfig()
   const feedConfig =
     (appConfig as { feedsLayer?: { feed?: { defaultCollection?: string } } }).feedsLayer?.feed ?? {}
   const defaultCollection = feedConfig.defaultCollection ?? 'blog'

package/layers/delivery/feeds/server/utils/content-adapter.ts

@@ -39,7 +39,7 @@ export async function getContentFeedItems(
   limit: number = 30
 ): Promise<FeedItem[]> {
   if (!COLLECTION_NAME_RE.test(collection)) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid collection name' })
+    throw createError({ status: 400, statusText: 'Invalid collection name' })
   }
 
   // queryCollection is keyed by literal collection names, but feed routes accept

package/layers/delivery/feeds/server/utils/feed-service.ts

@@ -1,6 +1,6 @@
 import { getContentFeedItems } from './content-adapter'
 import { getRequestURL, type H3Event } from 'h3'
-import { useAppConfig } from 'nitropack/runtime'
+import { readServerAppConfig } from '#layers/core/server/utils/app-config'
 
 import {
   createFeedConfig,
@@ -16,7 +16,7 @@ export async function buildFeed(
   collection?: string,
   options?: { unlimited?: boolean }
 ): Promise<{ items: FeedItem[]; config: FeedConfig }> {
-  const appConfig = useAppConfig() as unknown as AppFeedConfig
+  const appConfig = readServerAppConfig() as unknown as AppFeedConfig
   const feedConfig = appConfig.feedsLayer?.feed
   const requestUrl = getRequestURL(event)
   const { site, siteUrl } = resolveFeedSiteConfig(appConfig, requestUrl)

package/layers/design-system/theming/app/plugins/theme.client.ts

@@ -50,6 +50,13 @@ export default defineNuxtPlugin({
       { immediate: true }
     )
 
+    // The Reduce Motion switch (restored on mount) also ends core's boot loading screen. Core
+    // handles the OS setting itself, so this only reacts to changes, never before hydration
+    const loading = useLoading()
+    watch(effectiveReducedMotion, (reduced) => {
+      if (reduced && loading.isLoading.value) loading.finishNow()
+    })
+
     watch(
       effectiveReducedTransparency,
       (reduced) => {

package/layers/design-system/theming/nuxt.config.ts

@@ -28,8 +28,6 @@ export default defineNuxtConfig({
   // Shadow/duration tokens live in core (core/app/assets/css/tokens/elevation-motion.css).
   css: ['#layers/theming/app/assets/css/theme.css'],
 
-  plugins: ['#layers/theming/app/plugins/theme.client.ts'],
-
   colorMode: {
     dataValue: 'theme-mode',
     storageKey: 'theme-mode',

package/layers/motion/scroll/app/plugins/locomotive-scroll.client.ts

@@ -61,10 +61,11 @@ export default defineNuxtPlugin({
     // Without a mounted screen the state stays 'hidden' and GSAP is never touched.
     watch(
       screen,
-      (state) => {
+      (state, previous) => {
         gsap.globalTimeline.paused(state !== 'hidden')
 
-        if (state !== 'leaving') return
+        // Start as the screen leaves, or once it's gone if it skipped 'leaving' (finishNow)
+        if (state === 'visible' || previous === 'leaving') return
         instance.value?.start()
         // Remeasure once the screen's scroll lock is off the page
         requestAnimationFrame(() => {

package/layers/render/canvas/nuxt.config.ts

@@ -167,10 +167,6 @@ export default defineNuxtConfig({
     '#layers/canvas': import.meta.dirname,
   },
 
-  imports: {
-    dirs: [`${import.meta.dirname}/app/composables`],
-  },
-
   vite: {
     plugins: [threeWebGPUSSRStub()],
     optimizeDeps: {

package/layers/render/shader/nuxt.config.ts

@@ -18,8 +18,4 @@ export default defineNuxtConfig({
     '#layers/shader': import.meta.dirname,
     '#layers/shader/types': `${import.meta.dirname}/app/types`,
   },
-
-  imports: {
-    dirs: [`${import.meta.dirname}/app/composables`],
-  },
 })

package/layers/structure/routing/app/middleware/01.maintenance.global.ts

@@ -2,5 +2,8 @@ export default defineNuxtRouteMiddleware((to) => {
   const { isEnabled, allowRoutes } = useMaintenance()
   if (!isEnabled.value) return
   if (allowRoutes.value.some((r) => to.path.startsWith(r))) return
-  return navigateTo(allowRoutes.value[0])
+  const target = allowRoutes.value[0]
+  // No allowed route to send visitors to: show the maintenance state as an error instead
+  if (!target) return abortNavigation(createError({ status: 503 }))
+  return navigateTo(target)
 })

package/layers/structure/routing/app/middleware/02.governance.global.ts

@@ -11,6 +11,6 @@ export default defineNuxtRouteMiddleware((to) => {
 
   if (config.debug) console.log('[routing] resolution', resolution)
 
-  if (resolution.outcome === 'deny') throw createError({ statusCode: 404 })
+  if (resolution.outcome === 'deny') return abortNavigation(createError({ status: 404 }))
   if (resolution.outcome === 'redirect') return navigateTo(resolution.to)
 })

package/layers/structure/routing/nuxt.config.ts

@@ -1,3 +1,5 @@
+import { resolve } from 'node:path'
+
 type RoutePage = {
   file?: string
   meta?: Record<string, unknown>
@@ -21,19 +23,24 @@ export default defineNuxtConfig({
     strict: true,
   },
 
-  hooks: {
-    'pages:extend'(pages: unknown[]) {
-      const cwd = process.cwd()
-      const tag = (list: RoutePage[]) => {
-        for (const page of list) {
-          if (page.file && !page.file.startsWith(cwd)) {
-            page.meta ??= {}
-            page.meta.__fromLayer = true
+  modules: [
+    // Tag pages that don't live in the app's own pages dir. Compared against the app's pages
+    // dir, not process.cwd(): an npm consumer's layer pages sit under <app>/node_modules, which
+    // is inside cwd, so a cwd prefix check never tagged anything.
+    (_options, nuxt) => {
+      const appPagesDir = `${resolve(nuxt.options.srcDir, nuxt.options.dir.pages)}/`
+      nuxt.hook('pages:extend', (pages) => {
+        const tag = (list: RoutePage[]) => {
+          for (const page of list) {
+            if (page.file && !page.file.startsWith(appPagesDir)) {
+              page.meta ??= {}
+              page.meta.__fromLayer = true
+            }
+            if (page.children) tag(page.children)
           }
-          if (page.children) tag(page.children)
         }
-      }
-      tag(pages as unknown as RoutePage[])
+        tag(pages as RoutePage[])
+      })
     },
-  },
+  ],
 })

package/layers/structure/routing/server/api/feature-flags.get.ts

@@ -1,8 +1,10 @@
+import { readServerAppConfig } from '#layers/core/server/utils/app-config'
 import { defineEventHandler } from 'h3'
-import { useAppConfig } from 'nitropack/runtime'
 import type { FeatureValue } from '../../app/types/routing'
 
 export default defineEventHandler(() => {
-  const config = useAppConfig() as { routingLayer?: { features?: Record<string, FeatureValue> } }
+  const config = readServerAppConfig() as {
+    routingLayer?: { features?: Record<string, FeatureValue> }
+  }
   return config.routingLayer?.features ?? {}
 })

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kmcom-nuxt-layers",
   "private": false,
-  "version": "6.4.0",
+  "version": "6.5.0",
   "description": "Composable Nuxt 4 layers for building scalable Vue applications",
   "exports": {
     "./layers/core": "./layers/core/nuxt.config.ts",
@@ -57,7 +57,12 @@
     "layers/*/*/providers/*/tsconfig.json",
     "layers/*/*/providers/*/server/**",
     "types/**",
-    "docs/"
+    "docs/",
+    "!**/*.test.ts",
+    "!**/*.spec.ts",
+    "!docs/superpowers/**",
+    "!docs/fallow-refactor/**",
+    "!docs/*AUDIT*"
   ],
   "repository": {
     "type": "git",
@@ -72,6 +77,7 @@
     "packages/*"
   ],
   "peerDependencies": {
+    "@neondatabase/serverless": "^0.10.0",
     "@nuxt/content": "^3.14.0",
     "@nuxt/eslint": "^1.15.2",
     "@nuxt/image": "^2.0.0",
@@ -87,10 +93,15 @@
     "@vueuse/nuxt": "^14.3.0 || ^15.0.0",
     "baseline-status": "^1.1.1",
     "better-sqlite3": "^12.10.0 || ^13.0.0",
+    "drizzle-orm": "^0.45.4",
+    "feed": "^5.2.1",
     "gsap": "^3.15.0",
+    "hookable": "^5.5.3 || ^6.0.0",
     "locomotive-scroll": "^5.0.1",
     "nuxt": "^4.6.1",
+    "nuxt-auth-utils": "^0.5.0",
     "pinia": "^3.0.4 || ^4.1.0",
+    "resend": "^4.0.0",
     "tailwindcss": "^4.3.0",
     "three": ">=0.184.0",
     "v-gsap-nuxt": ">=1.5.12",
@@ -150,6 +161,24 @@
     },
     "baseline-status": {
       "optional": true
+    },
+    "@neondatabase/serverless": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
+    "feed": {
+      "optional": true
+    },
+    "hookable": {
+      "optional": true
+    },
+    "nuxt-auth-utils": {
+      "optional": true
+    },
+    "resend": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -211,7 +240,9 @@
     "vue-tsc": "3.3.13",
     "zod": "^4.3.6",
     "zod-to-json-schema": "^3.25.2",
-    "vite-plus": "1.3.0"
+    "vite-plus": "1.3.0",
+    "node-gyp": "^12.3.0",
+    "skills": "^1.5.23"
   },
   "browserslist": [
     "last 2 Chrome major versions",
@@ -221,8 +252,7 @@
     "extends browserslist-config-baseline"
   ],
   "dependencies": {
-    "node-gyp": "^12.3.0",
-    "skills": "^1.5.23"
+    "@iconify/vue": "^5.0.1"
   },
   "engines": {
     "node": ">=24 <25"

package/docs/FALLOW-COMPLEXITY-DUPLICATION-AUDIT.md

@@ -1,64 +0,0 @@
-# Fallow Complexity and Duplication Audit
-
-This file is the entry point for the layer-by-layer Fallow refactor handoff. Each app or layer has its own document under `docs/fallow-refactor/`.
-
-Use the split documents instead of one combined warning list. They separate complexity work from duplication work and identify whether the likely extraction target is a component, composable, utility, or local refactor.
-
-## Source Data
-
-The audit uses two sources:
-
-- Complexity data from `fallow health --complexity --hotspots --targets --format json --quiet --explain`.
-- Duplication data from the user-provided Fallow Problems export.
-
-Run these commands before and after each implementation phase:
-
-```bash
-FALLOW_AGENT_SOURCE=codex fallow health --complexity --hotspots --targets --format json --quiet --explain 2>/dev/null || true
-FALLOW_AGENT_SOURCE=codex fallow dupes --top 80 --format json --quiet --explain 2>/dev/null || true
-pnpm typecheck
-```
-
-## Recommended Order
-
-1. [apps/playground](./fallow-refactor/apps-playground.md)
-2. [layers/shader](./fallow-refactor/layers-shader.md)
-3. [layers/layout](./fallow-refactor/layers-layout.md)
-4. [layers/core](./fallow-refactor/layers-core.md)
-5. [layers/feeds](./fallow-refactor/layers-feeds.md)
-6. Smaller cleanup documents, ordered by risk and locality.
-
-## App Documents
-
-- [apps/debug](./fallow-refactor/apps-debug.md)
-- [apps/playground](./fallow-refactor/apps-playground.md)
-- [apps/visual-identity](./fallow-refactor/apps-visual-identity.md)
-
-## Layer Documents
-
-- [layers/animations](./fallow-refactor/layers-animations.md)
-- [layers/canvas](./fallow-refactor/layers-canvas.md)
-- [layers/content](./fallow-refactor/layers-content.md)
-- [layers/core](./fallow-refactor/layers-core.md)
-- [layers/feeds](./fallow-refactor/layers-feeds.md)
-- [layers/forms](./fallow-refactor/layers-forms.md)
-- [layers/layout](./fallow-refactor/layers-layout.md)
-- [layers/mailer](./fallow-refactor/layers-mailer.md)
-- [layers/motion](./fallow-refactor/layers-motion.md)
-- [layers/navigation](./fallow-refactor/layers-navigation.md)
-- [layers/page-transitions](./fallow-refactor/layers-page-transitions.md)
-- [layers/routing](./fallow-refactor/layers-routing.md)
-- [layers/scroll](./fallow-refactor/layers-scroll.md)
-- [layers/scripts](./fallow-refactor/layers-scripts.md)
-- [layers/seo](./fallow-refactor/layers-seo.md)
-- [layers/shader](./fallow-refactor/layers-shader.md)
-- [layers/theme](./fallow-refactor/layers-theme.md)
-- [layers/transitions](./fallow-refactor/layers-transitions.md)
-- [layers/typography](./fallow-refactor/layers-typography.md)
-- [layers/visual](./fallow-refactor/layers-visual.md)
-
-## Non-Goals
-
-Do not address unused exports, unused files, unused dependencies, circular dependencies, or catalog warnings as part of this specific task. Those warnings need separate verification and tracing.
-
-Do not run `fallow fix` for this work. These refactors are structural and require manual review.

package/docs/IMPROVE-AUDIT-README.md

@@ -1,29 +0,0 @@
-# Improve Audit
-
-Audit written against commit `a2805da`.
-
-## Files
-
-| File                                                   | Purpose                                                                                                 |
-| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------- |
-| [IMPROVE-AUDIT-RESULTS.md](./IMPROVE-AUDIT-RESULTS.md) | Vetted improve audit findings, direction options, verification results, and recommended planning order. |
-
-## Recommended Next Work
-
-Recommended first implementation set:
-
-1. Fix the current feeds lint failure.
-2. Bring published server routes into root typecheck and type-aware lint coverage.
-3. Stop exposing configured mailer addresses from the public forms status endpoint.
-4. Correct the forms demo mailer environment variable names.
-5. Add focused behavior tests around feed, forms/mailer, and routing paths.
-
-## Dependency Order
-
-| Order | Finding                                            | Depends On                                        | Status |
-| ----- | -------------------------------------------------- | ------------------------------------------------- | ------ |
-| 1     | Current feeds lint failure                         | None                                              | TODO   |
-| 2     | Server route typecheck coverage                    | Feeds lint fix recommended first                  | TODO   |
-| 3     | Public forms status endpoint leaks email addresses | Server route typecheck coverage recommended first | TODO   |
-| 4     | Wrong mailer env var docs in forms demo            | None                                              | TODO   |
-| 5     | Missing behavior tests                             | Typecheck/lint baseline                           | TODO   |