@cosmicdrift/kumiko-bundled-features 0.102.1 → 0.104.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.102.1",
+  "version": "0.104.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -92,11 +92,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.102.1",
-    "@cosmicdrift/kumiko-framework": "0.102.1",
-    "@cosmicdrift/kumiko-headless": "0.102.1",
-    "@cosmicdrift/kumiko-renderer": "0.102.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.102.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.104.0",
+    "@cosmicdrift/kumiko-framework": "0.104.0",
+    "@cosmicdrift/kumiko-headless": "0.104.0",
+    "@cosmicdrift/kumiko-renderer": "0.104.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.104.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/auth-email-password/__tests__/email-templates.test.ts

@@ -1,106 +1,103 @@
-// Unit-Tests für die default-HTML-Renderer der Reset/Verify-Mails.
-// Pure-Functions, kein DOM, kein Mail-Versand — nur das Rendering-
-// Contract: subject enthält App-Namen, body enthält Reset-URL und
-// expiresAt, HTML escaped XSS-Versuche, beide Locales unterscheiden
-// sich erwartungsgemäß.
+// Unit-Tests für die structured token-mail-Renderer (reset + verify).
+// Pure-Functions: sie liefern AuthMailContent (subject + header + sections +
+// footer), das delivery's renderer-simple zu HTML rendert — Escaping lebt
+// dort. Diese Tests prüfen daher die strukturierte Content, nicht HTML.
 
 import { describe, expect, test } from "bun:test";
+import type { AuthMailContent } from "../email-templates";
 import { renderResetPasswordEmail, renderVerifyEmail } from "../email-templates";
 
+function buttonUrl(content: AuthMailContent): string | undefined {
+  for (const section of content.sections) {
+    if ("button" in section) return section.button.url;
+  }
+  return undefined;
+}
+
+function textOf(content: AuthMailContent): string {
+  return content.sections.map((section) => ("text" in section ? section.text : "")).join(" ");
+}
+
 describe("renderResetPasswordEmail", () => {
   const baseArgs = {
-    resetUrl: "https://acme.example/reset?token=t-abc123",
+    url: "https://acme.example/reset?token=t-abc123",
     expiresAt: "2026-05-04T13:45:00.000Z",
   };
 
   test("default-locale 'en' + default-appName 'Account'", () => {
     const out = renderResetPasswordEmail(baseArgs);
     expect(out.subject).toBe("Account — Reset your password");
-    expect(out.html).toContain("Reset password");
-    expect(out.html).toContain(baseArgs.resetUrl);
+    expect(out.header).toBe("Reset password");
+    expect(buttonUrl(out)).toBe(baseArgs.url);
     // expiresAt wird zu human-readable-Format formatiert (UTC-pinned).
-    expect(out.html).toContain("2026-05-04 13:45 UTC");
+    expect(textOf(out)).toContain("2026-05-04 13:45 UTC");
   });
 
   test("locale 'de' liefert deutsche Subjects + Body", () => {
     const out = renderResetPasswordEmail({ ...baseArgs, locale: "de" });
     expect(out.subject).toContain("Passwort zurücksetzen");
-    expect(out.html).toContain("Passwort zurücksetzen");
-    expect(out.html).toContain("Hallo");
+    expect(out.header).toBe("Passwort zurücksetzen");
+    expect(textOf(out)).toContain("Hallo");
   });
 
   test("appName-Override taucht in subject + body auf", () => {
     const out = renderResetPasswordEmail({ ...baseArgs, appName: "PublicStatus", locale: "en" });
     expect(out.subject).toBe("PublicStatus — Reset your password");
-    expect(out.html).toContain("PublicStatus");
+    expect(textOf(out)).toContain("PublicStatus");
   });
 
-  test("escaped potentielle XSS in resetUrl", () => {
-    // Ein Angreifer der den resetUrl-input kontrollieren würde, würde
-    // sonst HTML-injection im Mail erreichen. Token-Generation ist
-    // server-side, aber defense-in-depth schadet nicht.
-    const out = renderResetPasswordEmail({
-      ...baseArgs,
-      resetUrl: 'https://x.example/?token=t"><script>alert(1)</script>',
-    });
-    expect(out.html).not.toContain("<script>alert");
-    expect(out.html).toContain("&quot;");
+  test("url kommt unescaped 1:1 durch (renderer-simple escaped beim HTML-Bau)", () => {
+    const url = 'https://x.example/?token=t"><script>alert(1)</script>';
+    const out = renderResetPasswordEmail({ ...baseArgs, url });
+    expect(buttonUrl(out)).toBe(url);
   });
 
-  test("subject + html sind beide non-empty + html startet mit <!DOCTYPE", () => {
+  test("footer trägt die ignore-Reassurance", () => {
     const out = renderResetPasswordEmail(baseArgs);
-    expect(out.subject.length).toBeGreaterThan(0);
-    expect(out.html).toMatch(/^<!DOCTYPE html>/);
+    expect(out.footer.length).toBeGreaterThan(0);
+    expect(out.footer.toLowerCase()).toContain("ignore");
   });
 });
 
 describe("renderVerifyEmail", () => {
   const baseArgs = {
-    verificationUrl: "https://acme.example/verify?token=v-abc123",
+    url: "https://acme.example/verify?token=v-abc123",
     expiresAt: "2026-05-04T13:45:00.000Z",
   };
 
   test("default-locale 'en' + default-appName 'Account'", () => {
     const out = renderVerifyEmail(baseArgs);
     expect(out.subject).toBe("Account — Verify your email");
-    expect(out.html).toContain("Verify email");
-    expect(out.html).toContain(baseArgs.verificationUrl);
-    expect(out.html).toContain("2026-05-04 13:45 UTC");
+    expect(out.header).toBe("Verify email");
+    expect(buttonUrl(out)).toBe(baseArgs.url);
+    expect(textOf(out)).toContain("2026-05-04 13:45 UTC");
   });
 
   test("locale 'de' liefert deutsche Subjects + Body", () => {
     const out = renderVerifyEmail({ ...baseArgs, locale: "de" });
     expect(out.subject).toContain("E-Mail bestätigen");
-    expect(out.html).toContain("E-Mail bestätigen");
-    expect(out.html).toContain("Willkommen");
+    expect(out.header).toBe("E-Mail bestätigen");
+    expect(textOf(out)).toContain("Willkommen");
   });
 
   test("appName-Override im subject", () => {
     const out = renderVerifyEmail({ ...baseArgs, appName: "PublicStatus", locale: "en" });
     expect(out.subject).toBe("PublicStatus — Verify your email");
   });
-
-  test("escaped XSS in verificationUrl", () => {
-    const out = renderVerifyEmail({
-      ...baseArgs,
-      verificationUrl: 'https://x.example/?token=v"><script>alert(1)</script>',
-    });
-    expect(out.html).not.toContain("<script>alert");
-  });
 });
 
-describe("Reset vs Verify haben separate subjects + body-Texte", () => {
+describe("Reset vs Verify haben separate subjects + headers", () => {
   // Sicherheit gegen Copy-Paste-Bugs zwischen den beiden Renderern —
-  // die sind strukturell ähnlich, aber subjects + body-Intros müssen
-  // klar unterschiedlich sein damit User die Mails nicht verwechselt.
+  // die sind strukturell ähnlich, aber subjects + CTA müssen klar
+  // unterschiedlich sein damit User die Mails nicht verwechselt.
   const args = { expiresAt: "2026-05-04T13:45:00.000Z" };
-  const reset = renderResetPasswordEmail({ ...args, resetUrl: "https://x/r" });
-  const verify = renderVerifyEmail({ ...args, verificationUrl: "https://x/v" });
+  const reset = renderResetPasswordEmail({ ...args, url: "https://x/r" });
+  const verify = renderVerifyEmail({ ...args, url: "https://x/v" });
   test("subjects unterscheiden sich", () => {
     expect(reset.subject).not.toBe(verify.subject);
   });
-  test("button-labels unterscheiden sich", () => {
-    expect(reset.html).toContain("Reset password");
-    expect(verify.html).toContain("Verify email");
+  test("header-CTA unterscheiden sich", () => {
+    expect(reset.header).toBe("Reset password");
+    expect(verify.header).toBe("Verify email");
   });
 });

package/src/auth-email-password/__tests__/email-verification.integration.test.ts

@@ -16,9 +16,15 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { Temporal } from "temporal-polyfill";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -32,7 +38,9 @@ import { hashPassword } from "../password-hashing";
 import { signResetToken } from "../reset-token";
 import { signVerificationToken } from "../verification-token";
 
-const capturedEmails: Array<{ email: string; verificationUrl: string; expiresAt: string }> = [];
+// Verify mails now go through delivery (ctx.notify → channel-email); the
+// in-memory transport captures what would be sent.
+const emailTransport = createInMemoryTransport();
 
 let stack: TestStack;
 const systemAdmin = TestUsers.systemAdmin;
@@ -54,16 +62,30 @@ beforeAll(async () => {
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
       createAuthEmailPasswordFeature({
         emailVerification: {
           hmacSecret: verifySecret,
           tokenTtlMinutes: 60,
           mode: "strict",
+          appUrl: appVerifyUrl,
         },
-        passwordReset: { hmacSecret: resetSecret, tokenTtlMinutes: 15 },
+        passwordReset: { hmacSecret: resetSecret, tokenTtlMinutes: 15, appUrl: appResetUrl },
       }),
     ],
-    extraContext: { configResolver: resolver, configEncryption: encryption },
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: resolver,
+      configEncryption: encryption,
+    }),
     authConfig: {
       membershipQuery: "tenant:query:memberships",
       loginHandler: AuthHandlers.login,
@@ -75,23 +97,21 @@ beforeAll(async () => {
       emailVerification: {
         requestHandler: AuthHandlers.requestEmailVerification,
         confirmHandler: AuthHandlers.verifyEmail,
-        appVerifyUrl,
-        sendVerificationEmail: async (args) => {
-          capturedEmails.push(args);
-        },
       },
       passwordReset: {
         requestHandler: AuthHandlers.requestPasswordReset,
         confirmHandler: AuthHandlers.resetPassword,
-        appResetUrl,
-        sendResetEmail: async () => {},
       },
     },
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
-  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
 });
 
 afterAll(async () => {
@@ -101,7 +121,7 @@ afterAll(async () => {
 beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
-  capturedEmails.length = 0;
+  emailTransport.sent.length = 0;
 });
 
 async function seedUser(opts: {
@@ -144,7 +164,7 @@ async function post(path: string, body: unknown): Promise<Response> {
 // --- request-email-verification -------------------------------------------
 
 describe("POST /auth/request-email-verification", () => {
-  test("unverified user → 200, email callback invoked with verification URL", async () => {
+  test("unverified user → 200, delivery sends mail with verification URL", async () => {
     await seedUser({ email: "fresh@example.com", password: "pw-initial-1234" });
 
     const res = await post("/api/auth/request-email-verification", {
@@ -152,14 +172,14 @@ describe("POST /auth/request-email-verification", () => {
     });
 
     expect(res.status).toBe(200);
-    expect(capturedEmails).toHaveLength(1);
-    const [captured] = capturedEmails;
-    if (!captured) throw new Error("no email captured");
-    expect(captured.email).toBe("fresh@example.com");
-    expect(captured.verificationUrl.startsWith(`${appVerifyUrl}?token=`)).toBe(true);
+    expect(emailTransport.sent).toHaveLength(1);
+    const sent = emailTransport.sent[0];
+    if (!sent) throw new Error("no email sent");
+    expect(sent.to).toBe("fresh@example.com");
+    expect(sent.html).toContain(`${appVerifyUrl}?token=`);
   });
 
-  test("already-verified user → 200, NO callback (enumeration-safe)", async () => {
+  test("already-verified user → 200, NO mail (enumeration-safe)", async () => {
     await seedUser({
       email: "done@example.com",
       password: "pw-already-1234",
@@ -171,15 +191,15 @@ describe("POST /auth/request-email-verification", () => {
     });
 
     expect(res.status).toBe(200);
-    expect(capturedEmails).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
   });
 
-  test("unknown email → 200, NO callback (enumeration-safe)", async () => {
+  test("unknown email → 200, NO mail (enumeration-safe)", async () => {
     const res = await post("/api/auth/request-email-verification", {
       email: "ghost@example.com",
     });
     expect(res.status).toBe(200);
-    expect(capturedEmails).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
   });
 });
 

package/src/auth-email-password/__tests__/invite-flow.integration.test.ts

@@ -9,8 +9,8 @@
 //
 // Flow pro Test:
 //   1. Admin invitet email → invite-create (Admin-Auth)
-//   2. Mail captured durch sendInviteEmail-callback
-//   3. Token aus Activation-URL extrahieren
+//   2. Invite-Mail via delivery (in-memory transport) an den Invitee
+//   3. Token aus dem Mail-HTML extrahieren (NICHT aus dem Admin-Result)
 //   4. Branch-spezifischer Accept-Endpoint
 //   5. DB-State + Membership + Cookies/JWT verifizieren
 
@@ -28,9 +28,15 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/invitation-table";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
@@ -50,12 +56,10 @@ const CAROL_EMAIL = "carol@example.com";
 const BOB_PASSWORD = "bob-existing-pw-1234";
 const CAROL_PASSWORD = "carol-new-pw-1234";
 
-const capturedInviteEmails: Array<{
-  email: string;
-  inviteUrl: string;
-  expiresAt: string;
-  role: string;
-}> = [];
+// Invite mails now go through delivery (ctx.notify → channel-email). The
+// in-memory transport captures what would be sent; route:{email} delivers
+// directly (no jobRunner in the test stack → inline send).
+const emailTransport = createInMemoryTransport();
 
 let stack: TestStack;
 let aliceId: string;
@@ -77,17 +81,37 @@ const GUEST: SessionUser = {
   roles: ["all"],
 };
 
+function extractTokenFromMail(html: string): string {
+  const match = html.match(/[?&]token=([^&"'<\s]+)/);
+  if (!match?.[1]) throw new Error(`No token in invite mail html: ${html.slice(0, 200)}`);
+  return decodeURIComponent(match[1]);
+}
+
 beforeAll(async () => {
   stack = await setupTestStack({
     features: [
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        // route:{email} delivers directly — resolveEmail (userId→address) is
+        // never hit by the invite flow, but the channel requires it.
+        resolveEmail: async () => "unused@test.local",
+      }),
       createAuthEmailPasswordFeature({
-        invite: { tokenTtlMinutes: 60 },
+        invite: { tokenTtlMinutes: 60, appUrl: APP_ACCEPT_URL },
       }),
     ],
-    extraContext: { configResolver: createConfigResolver() },
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
     authConfig: {
       membershipQuery: "tenant:query:memberships",
       loginHandler: AuthHandlers.login,
@@ -95,10 +119,6 @@ beforeAll(async () => {
         acceptHandler: AuthHandlers.inviteAccept,
         acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
         signupCompleteHandler: AuthHandlers.inviteSignupComplete,
-        appAcceptUrl: APP_ACCEPT_URL,
-        sendInviteEmail: async (args) => {
-          capturedInviteEmails.push(args);
-        },
       },
     },
   });
@@ -106,7 +126,11 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, tenantInvitationEntity);
-  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
 });
 
 afterAll(async () => {
@@ -118,7 +142,7 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantInvitationsTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
-  capturedInviteEmails.length = 0;
+  emailTransport.sent.length = 0;
   const allKeys = await stack.redis.redis.keys("invite:*");
   if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
 
@@ -183,31 +207,35 @@ async function authedRaw(
 }
 
 async function inviteEmail(email: string, role: string): Promise<string> {
-  // invite-create geht via /api/write (Admin-Auth via JWT). Token kommt
-  // direkt aus dem handler-result; sendInviteEmail-callback ist die
-  // optionale Mail-Side, die in production-Setups separat von der
-  // Sample-App aufgerufen wird (NICHT framework-route — invite-create
-  // ist Admin-only und somit kein Magic-Link-Pattern wie signup-request).
-  const result = (await stack.http.writeOk(
-    AuthHandlers.inviteCreate,
-    { email, role },
-    aliceSession(),
-  )) as { token: string };
-  return result.token;
+  // invite-create geht via /api/write (Admin-Auth via JWT). Der Handler
+  // dispatcht die Invite-Mail via delivery; der Token erreicht den Invitee
+  // NUR über die Mail (das Admin-Result enthält ihn nicht mehr).
+  await stack.http.writeOk(AuthHandlers.inviteCreate, { email, role }, aliceSession());
+  const sent = emailTransport.sent.at(-1);
+  if (!sent) throw new Error("invite-create didn't send a mail");
+  return extractTokenFromMail(sent.html);
 }
 
 describe("invite-create", () => {
-  test("Admin invitet → invitation row + token in result", async () => {
+  test("Admin invitet → invitation row + delivery sends mail with token URL", async () => {
     const result = (await stack.http.writeOk(
       AuthHandlers.inviteCreate,
       { email: BOB_EMAIL, role: "Admin" },
       aliceSession(),
-    )) as { invitationId: string; email: string; role: string; token: string };
+    )) as { invitationId: string; email: string; role: string };
 
     expect(result.email).toBe(BOB_EMAIL);
     expect(result.role).toBe("Admin");
-    expect(result.token).toBeTruthy();
-    expect(result.token.length).toBeGreaterThanOrEqual(16);
+    // Der Token geht NICHT an den Admin zurück (er soll die Annahme nicht
+    // impersonieren können) — nur an den Invitee per Mail.
+    expect((result as { token?: string }).token).toBeUndefined();
+
+    expect(emailTransport.sent).toHaveLength(1);
+    const sent = emailTransport.sent[0];
+    if (!sent) throw new Error("no mail sent");
+    expect(sent.to).toBe(BOB_EMAIL);
+    expect(sent.html).toContain(`${APP_ACCEPT_URL}?token=`);
+    expect(sent.html).toContain("Admin");
 
     const rows = await selectMany(stack.db, tenantInvitationsTable, { email: BOB_EMAIL });
     expect(rows).toHaveLength(1);
@@ -442,7 +470,7 @@ describe("privilege escalation via invite role", () => {
   // passed every SystemAdmin gate cross-tenant.
   const FORBIDDEN_ROLES = ["SystemAdmin", "system", "all", "anonymous"];
 
-  test("invite-create rejects reserved/global roles — no invitation persisted", async () => {
+  test("invite-create rejects reserved/global roles — no invitation persisted, no mail", async () => {
     for (const role of FORBIDDEN_ROLES) {
       const err = await stack.http.writeErr(
         AuthHandlers.inviteCreate,
@@ -453,6 +481,8 @@ describe("privilege escalation via invite role", () => {
       const rows = await selectMany(stack.db, tenantInvitationsTable, { email: CAROL_EMAIL });
       expect(rows).toHaveLength(0);
     }
+    // The forbidden-role check fires before the mail dispatch.
+    expect(emailTransport.sent).toHaveLength(0);
   });
 
   test("legitimate tenant role still issues an invitation", async () => {

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -11,10 +11,16 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { Temporal } from "temporal-polyfill";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
 import { createSessionsFeature, userSessionTable } from "../../sessions";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -27,9 +33,10 @@ import { createAuthEmailPasswordFeature } from "../feature";
 import { hashPassword, verifyPassword } from "../password-hashing";
 import { signResetToken } from "../reset-token";
 
-// Signed tokens are forwarded out-of-band (email). In the test we grab them
-// from the sendResetEmail callback instead.
-const capturedEmails: Array<{ email: string; resetUrl: string; expiresAt: string }> = [];
+// Reset mails now go through delivery (ctx.notify → channel-email). The
+// in-memory transport captures what would be sent; route:{email} delivers
+// directly (no jobRunner in the test stack → inline send).
+const emailTransport = createInMemoryTransport();
 
 // Records the userId every time the sessions feature's auto-revoke hook
 // fires after a password change. The session-revoke tests assert on this
@@ -51,8 +58,19 @@ beforeAll(async () => {
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        // route:{email} delivers directly — resolveEmail (userId→address) is
+        // never hit by the reset flow, but the channel requires it.
+        resolveEmail: async () => "unused@test.local",
+      }),
       createAuthEmailPasswordFeature({
-        passwordReset: { hmacSecret: resetSecret, tokenTtlMinutes: 15 },
+        passwordReset: { hmacSecret: resetSecret, tokenTtlMinutes: 15, appUrl: appResetUrl },
       }),
       // Sessions feature wires the cross-feature entityHook on
       // "user.postSave" that triggers autoRevokeOnPasswordChange whenever
@@ -65,17 +83,17 @@ beforeAll(async () => {
         },
       }),
     ],
-    extraContext: { configResolver: resolver, configEncryption: encryption },
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: resolver,
+      configEncryption: encryption,
+    }),
     authConfig: {
       membershipQuery: "tenant:query:memberships",
       loginHandler: AuthHandlers.login,
       passwordReset: {
         requestHandler: AuthHandlers.requestPasswordReset,
         confirmHandler: AuthHandlers.resetPassword,
-        appResetUrl,
-        sendResetEmail: async (args) => {
-          capturedEmails.push(args);
-        },
       },
     },
   });
@@ -86,6 +104,7 @@ beforeAll(async () => {
     configValuesTable,
     tenantMembershipsTable,
     userSessionTable,
+    notificationPreferencesTable,
   });
 });
 
@@ -97,7 +116,7 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userSessionTable.tableName}"`);
-  capturedEmails.length = 0;
+  emailTransport.sent.length = 0;
   autoRevokeCalls.length = 0;
 });
 
@@ -132,34 +151,34 @@ async function post(path: string, body: unknown): Promise<Response> {
 // --- request-password-reset -----------------------------------------------
 
 describe("POST /auth/request-password-reset", () => {
-  test("known email → 200, email callback invoked with reset URL", async () => {
+  test("known email → 200, delivery sends mail with reset URL", async () => {
     await seedUser({ email: "alice@example.com", password: "initial-pw!" });
 
     const res = await post("/api/auth/request-password-reset", { email: "alice@example.com" });
 
     expect(res.status).toBe(200);
     expect(await res.json()).toEqual({ isSuccess: true });
-    expect(capturedEmails).toHaveLength(1);
-    const [captured] = capturedEmails;
-    if (!captured) throw new Error("no email captured");
-    expect(captured.email).toBe("alice@example.com");
-    expect(captured.resetUrl.startsWith(`${appResetUrl}?token=`)).toBe(true);
-    expect(typeof captured.expiresAt).toBe("string");
+    expect(emailTransport.sent).toHaveLength(1);
+    const sent = emailTransport.sent[0];
+    if (!sent) throw new Error("no email sent");
+    expect(sent.to).toBe("alice@example.com");
+    expect(sent.subject).toContain("Reset");
+    expect(sent.html).toContain(`${appResetUrl}?token=`);
   });
 
-  test("unknown email → 200 with NO sendResetEmail side-effect (enumeration-safe)", async () => {
+  test("unknown email → 200 with NO mail sent (enumeration-safe)", async () => {
     const res = await post("/api/auth/request-password-reset", { email: "ghost@example.com" });
 
     expect(res.status).toBe(200);
     expect(await res.json()).toEqual({ isSuccess: true });
-    expect(capturedEmails).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
   });
 
   test("malformed body → 200 (silent success, no enumeration via error shape)", async () => {
     const res = await post("/api/auth/request-password-reset", { wrong: "shape" });
     expect(res.status).toBe(200);
     expect(await res.json()).toEqual({ isSuccess: true });
-    expect(capturedEmails).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
   });
 });