Bundled features

Bundled features are complete features from the framework repo that you add to an app in one line. Each includes schema, handlers, hooks, often UI components, and tests. You use them like your own features and can override conventions such as table names, hash algorithms, and channel implementations.

They live under packages/bundled-features/src/<feature>/ and get activated through two paths:

1. Auto mode: when you set auth: { ... } in runDevApp / runProdApp, composeFeatures auto-prepends the identity quartet (config, user, tenant, auth-email-password). That’s all most apps need.

2. Manual: other features (audit, secrets, jobs, channels …) you import explicitly and add to your features array.

import { runDevApp } from "@cosmicdrift/kumiko-dev-server";
import { createAuditFeature } from "@cosmicdrift/kumiko-bundled-features/audit";
import { createSecretsFeature } from "@cosmicdrift/kumiko-bundled-features/secrets";

await runDevApp({
  features: [
    createAuditFeature(),
    createSecretsFeature(),
    myAppFeature,
  ],
  auth: { /* enables config + user + tenant + auth-email-password */ },
});

Overview

The framework currently ships 89 bundled feature registrations in the booted registry. The catalog below groups the most common app-building paths; the complete generated reference is the source of truth for the full set.

Bucket	Features	When
Identity layer	auth-email-password, auth-foundation, auth-mfa, sessions, user, tenant, tenant-handover, tenant-settings, user-profile, personal-access-tokens, config, auth-self-registration, account-security, host-routing	Accounts, self-signup switch, tenant switching, MFA, profile, tokens, tenant defaults, a self-service security page, and subdomain tenant routing.
Audit & security	audit, secrets, rate-limiting, readiness, crypto-shredding	Audit, secret storage, throttling, readiness probes, and key-based erasure.
Compliance & DSGVO	compliance-profiles, compliance-profiles-ops, data-retention, tenant-lifecycle, user-data-rights, user-data-rights-defaults, files-tenant-data, folders-user-data, form-draft-user-data, auth-mfa-user-data, notes-history-user-data, template-resolver-user-data, tenant-inactivity	Region profiles, retention, tenant destruction, export/erasure, data cleanup, and deletion of abandoned free accounts.
Operations	admin-shell, metrics, metrics-system, jobs, feature-toggles, cap-counter, cap-overview, workflow-runner, step-dispatcher	Admin workspaces, dashboard metrics (guide), background work, rollout, usage budgets, workflows, and deferred side effects.
Notifications & mail	delivery, channel-email, channel-in-app, channel-push, mail-foundation, mail-transport-smtp, mail-transport-inmemory, renderer-foundation, renderer-mail-html, inbound-mail-foundation, inbound-provider-imap, inbound-provider-inmemory, template-resolver, channel-discord, channel-slack, channel-teams, channel-telegram	Outbound delivery, chat webhooks, inboxes, mail transport, templates, and notification rendering.
Files & documents	file-foundation, file-provider-inmemory, file-provider-s3, file-provider-s3-env, files, file-derivatives, derivatives-sharp, document-ingest-foundation, renderer-pdf, renderer-puppeteer-client, documents, document-designer	Uploads, S3/local providers, derivatives, document-ingest foundations, table PDFs, template PDFs, filed documents, and the template editor.
Content & SEO	legal-pages, managed-pages, seo, waitlist	Editable copy, legal pages, public CMS surfaces, waitlist sign-ups, and site discovery.
Helpdesk	helpdesk	Website contact form, in-app problem reports, and an inbox where SystemAdmins reply by email.
Domain data	custom-fields, folders, form-draft, ledger, notes-history, tags	Runtime fields, folder trees, drafts, money ledgers, notes, and tags.
Billing	billing-foundation, subscription-stripe, subscription-mollie, subscription-paddle, tier-engine	Provider-neutral billing, subscriptions, and plan composition. With several providers mounted, customers pick one at checkout.
AI foundations	agent-tools	Open-framework tool catalog and agent manifest used by Enterprise AI.
Collaboration	presence	Shows who else is viewing or editing the same record.
Localization	locale-de	German UI and mail copy for the framework screens; opt-in.

The reference also includes supporting registrations such as locale and user-data extensions. They are listed there even when they are normally mounted by another feature rather than directly by an app.

Status legend

• ✅ Stable, used in production apps (publicstatus), API is stable
• 🚧 Beta, works, but the API may still change. Use at your own risk in production
• ⬜ Planned, on the roadmap, not in the repo yet

Complete feature catalog

The generated feature reference contains one page for every registration in the booted manifest. Each page lists dependencies, configuration, secrets, extensions, and the command surface. Start here when you know what kind of capability you need; open the detail page before adding the feature to an app.

The generated reference currently covers all 89/89 bundled registrations. Some registrations are support pieces mounted by other features rather than direct app choices. They remain in the catalog so the dependency graph is complete.

Common paths

Building…	Start with
A secure multi-tenant app	user, tenant, auth-email-password, sessions, audit
A public or SaaS surface	tenant, rate-limiting, anonymousAccess, feature-toggles
Notifications and inbound mail	delivery, channel-*, mail-foundation, inbound-mail-foundation
File-backed workflows	file-foundation, files, file-provider-s3-env, file-derivatives
Compliance and erasure	compliance-profiles, data-retention, user-data-rights, user-data-rights-defaults
Operations and automation	jobs, workflow-runner, step-dispatcher, admin-shell
Domain data helpers	custom-fields, folders, form-draft, ledger, notes-history, tags

Each path still needs the dependency closure shown on its feature reference pages. Mounting one feature rarely means mounting only one feature.

See also

Where do I find…	Here
How these features fit into the pipeline	Framework
Runnable examples (auth, audit, notifications, …)	Recipes
Deployment + hosting	Platform
Pattern reference (r.config, r.secret, r.job, …)	Patterns