@cosmicdrift/kumiko-bundled-features 0.102.2 → 0.104.0

package/src/auth-email-password/__tests__/public-routes-rate-limit.integration.test.ts

@@ -14,9 +14,15 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -26,6 +32,9 @@ import { AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 
 let stack: TestStack;
+// delivery is a hard dep of the reset/verify flows now; mount it so boot
+// passes. These tests hit unknown emails → no-op → no mail is actually sent.
+const emailTransport = createInMemoryTransport();
 const encryptionKey = randomBytes(32).toString("base64");
 const resetSecret = randomBytes(32).toString("base64");
 const verifySecret = randomBytes(32).toString("base64");
@@ -39,26 +48,44 @@ beforeAll(async () => {
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
       createAuthEmailPasswordFeature({
-        passwordReset: { hmacSecret: resetSecret, tokenTtlMinutes: 15 },
-        emailVerification: { hmacSecret: verifySecret, tokenTtlMinutes: 60, mode: "strict" },
+        passwordReset: {
+          hmacSecret: resetSecret,
+          tokenTtlMinutes: 15,
+          appUrl: "https://app.example.com/reset",
+        },
+        emailVerification: {
+          hmacSecret: verifySecret,
+          tokenTtlMinutes: 60,
+          mode: "strict",
+          appUrl: "https://app.example.com/verify",
+        },
       }),
     ],
-    extraContext: { configResolver: resolver, configEncryption: encryption },
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: resolver,
+      configEncryption: encryption,
+    }),
     authConfig: {
       membershipQuery: "tenant:query:memberships",
       loginHandler: AuthHandlers.login,
       passwordReset: {
         requestHandler: AuthHandlers.requestPasswordReset,
         confirmHandler: AuthHandlers.resetPassword,
-        appResetUrl: "https://app.example.com/reset",
-        sendResetEmail: async () => {},
       },
       emailVerification: {
         requestHandler: AuthHandlers.requestEmailVerification,
         confirmHandler: AuthHandlers.verifyEmail,
-        appVerifyUrl: "https://app.example.com/verify",
-        sendVerificationEmail: async () => {},
       },
     },
     // Tight limit so the test trips it with a small number of requests,
@@ -70,7 +97,11 @@ beforeAll(async () => {
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
-  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
 });
 
 afterAll(async () => {

package/src/auth-email-password/__tests__/signup-flow.integration.test.ts

@@ -4,8 +4,8 @@
 // reale User-Pfad sind.
 //
 // Pinst:
-//   1. POST signup-request mit valid email → 200, Mail captured durch
-//      sendActivationEmail-callback (echte route + signup-feature).
+//   1. POST signup-request mit valid email → 200, Activation-Mail via
+//      delivery (channel-email in-memory transport) mit Token-URL.
 //   2. Resend-Idempotenz: zweiter Request für selbe email → gleicher
 //      Token in Mail (existing token in Redis wird re-genutzt).
 //   3. POST signup-confirm mit captured Token + Password → 200, Cookies
@@ -32,9 +32,15 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { createChannelEmailFeature, createInMemoryTransport } from "../../channel-email";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
+import { createDeliveryFeature, createDeliveryTestContext } from "../../delivery";
+import { notificationPreferencesTable } from "../../delivery/tables";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature, simpleRenderer } from "../../renderer-simple";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
@@ -44,11 +50,11 @@ import { AuthErrors, AuthHandlers } from "../constants";
 import { createAuthEmailPasswordFeature } from "../feature";
 
 const APP_ACTIVATION_URL = "https://app.example.com/signup/complete";
-const capturedActivationEmails: Array<{
-  email: string;
-  activationUrl: string;
-  expiresAt: string;
-}> = [];
+
+// Activation mails now go through delivery (ctx.notify → channel-email). The
+// in-memory transport captures what would be sent; route:{email} delivers
+// directly (no jobRunner in the test stack → inline send).
+const emailTransport = createInMemoryTransport();
 
 let stack: TestStack;
 
@@ -58,21 +64,31 @@ beforeAll(async () => {
       createConfigFeature(),
       createUserFeature(),
       createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        // route:{email} delivers directly — resolveEmail (userId→address) is
+        // never hit by the signup flow, but the channel requires it.
+        resolveEmail: async () => "unused@test.local",
+      }),
       createAuthEmailPasswordFeature({
-        signup: { tokenTtlMinutes: 60 },
+        signup: { tokenTtlMinutes: 60, appUrl: APP_ACTIVATION_URL },
       }),
     ],
-    extraContext: { configResolver: createConfigResolver() },
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
     authConfig: {
       membershipQuery: "tenant:query:memberships",
       loginHandler: AuthHandlers.login,
       signup: {
         requestHandler: AuthHandlers.signupRequest,
         confirmHandler: AuthHandlers.signupConfirm,
-        appActivationUrl: APP_ACTIVATION_URL,
-        sendActivationEmail: async (args) => {
-          capturedActivationEmails.push(args);
-        },
       },
     },
   });
@@ -82,7 +98,11 @@ beforeAll(async () => {
   // tenant.schema.indexes). unsafeCreateEntityTable baut das via
   // buildEntityTable nach — pinst den TOCTOU-Schutz für signup-confirm.
   await unsafeCreateEntityTable(stack.db, tenantEntity);
-  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
 });
 
 afterAll(async () => {
@@ -93,7 +113,7 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantMembershipsTable.tableName}"`);
   await asRawClient(stack.db).unsafe(`DELETE FROM "${tenantTable.tableName}"`);
-  capturedActivationEmails.length = 0;
+  emailTransport.sent.length = 0;
   // Redis-cleanup damit Resend-Tests keine state-leaks haben.
   const allKeys = await stack.redis.redis.keys("signup:*");
   if (allKeys.length > 0) await stack.redis.redis.del(...allKeys);
@@ -111,52 +131,49 @@ async function postLogin(email: string, password: string): Promise<Response> {
   return stack.http.raw("POST", "/api/auth/login", { email, password });
 }
 
-function extractTokenFromUrl(url: string): string {
-  const match = url.match(/[?&]token=([^&]+)/);
-  if (!match?.[1]) throw new Error(`No token in url: ${url}`);
+function extractTokenFromMail(html: string): string {
+  const match = html.match(/[?&]token=([^&"'<\s]+)/);
+  if (!match?.[1]) throw new Error(`No token in mail html: ${html.slice(0, 200)}`);
   return decodeURIComponent(match[1]);
 }
 
 describe("POST /api/auth/signup-request", () => {
-  test("known email → 200, mail captured mit activation-url", async () => {
+  test("known email → 200, delivery sends activation mail with token URL", async () => {
     const res = await postSignupRequest("alice@example.com");
     expect(res.status).toBe(200);
     expect(await res.json()).toEqual({ isSuccess: true });
-    expect(capturedActivationEmails).toHaveLength(1);
-    const [captured] = capturedActivationEmails;
-    if (!captured) throw new Error("no captured email");
-    expect(captured.email).toBe("alice@example.com");
-    expect(captured.activationUrl.startsWith(`${APP_ACTIVATION_URL}?token=`)).toBe(true);
-    expect(typeof captured.expiresAt).toBe("string");
+    expect(emailTransport.sent).toHaveLength(1);
+    const sent = emailTransport.sent[0];
+    if (!sent) throw new Error("no mail sent");
+    expect(sent.to).toBe("alice@example.com");
+    expect(sent.html).toContain(`${APP_ACTIVATION_URL}?token=`);
   });
 
   test("Resend: zweiter Request für selbe email → gleicher token in Mail", async () => {
     await postSignupRequest("resend@example.com");
     await postSignupRequest("resend@example.com");
 
-    expect(capturedActivationEmails).toHaveLength(2);
-    const [first, second] = capturedActivationEmails;
-    if (!first || !second) throw new Error("missing emails");
-    expect(extractTokenFromUrl(second.activationUrl)).toBe(
-      extractTokenFromUrl(first.activationUrl),
-    );
+    expect(emailTransport.sent).toHaveLength(2);
+    const [first, second] = emailTransport.sent;
+    if (!first || !second) throw new Error("missing mails");
+    expect(extractTokenFromMail(second.html)).toBe(extractTokenFromMail(first.html));
   });
 
   test("malformed body → 200 (silent success, anti-enumeration)", async () => {
     const res = await stack.http.raw("POST", "/api/auth/signup-request", { wrong: "shape" });
     expect(res.status).toBe(200);
-    expect(capturedActivationEmails).toHaveLength(0);
+    expect(emailTransport.sent).toHaveLength(0);
   });
 });
 
 describe("POST /api/auth/signup-confirm", () => {
   async function requestSignup(email: string): Promise<string> {
-    capturedActivationEmails.length = 0;
+    emailTransport.sent.length = 0;
     const res = await postSignupRequest(email);
     expect(res.status).toBe(200);
-    const captured = capturedActivationEmails[0];
-    if (!captured) throw new Error("signup-request fixture didn't capture mail");
-    return extractTokenFromUrl(captured.activationUrl);
+    const sent = emailTransport.sent[0];
+    if (!sent) throw new Error("signup-request fixture didn't send mail");
+    return extractTokenFromMail(sent.html);
   }
 
   test("voller Roundtrip: confirm legt user + tenant + Admin-Membership an, Cookies + Login funktioniert", async () => {

package/src/auth-email-password/auth-paths.ts

@@ -0,0 +1,24 @@
+// Convention paths for the four auth pages (relative to the app base URL).
+// resolveAuthMail builds each flow's magic-link appUrl from baseUrl + these;
+// the handlers append `?token=…` and mail via delivery (ctx.notify).
+
+/** Pfad-Konstanten der 4 Auth-Seiten (relativ zur App-baseUrl). */
+export type AuthPaths = {
+  readonly resetPassword: string;
+  readonly verifyEmail: string;
+  readonly signupComplete: string;
+  readonly inviteAccept: string;
+};
+
+/** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
+ *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
+export const DEFAULT_AUTH_PATHS: AuthPaths = {
+  resetPassword: "/reset-password",
+  verifyEmail: "/verify-email",
+  signupComplete: "/signup/complete",
+  inviteAccept: "/invite/accept",
+};
+
+export function makeAuthPaths(overrides: Partial<AuthPaths> = {}): AuthPaths {
+  return { ...DEFAULT_AUTH_PATHS, ...overrides };
+}

package/src/auth-email-password/email-templates.ts

@@ -1,63 +1,42 @@
-// Default-HTML-Renderer für die transactional Auth-Mails (Reset-Password
-// + Verify-Email). Apps wiren die `sendResetEmail` / `sendVerificationEmail`
-// callbacks im framework-config (siehe PasswordResetConfig im
-// auth-routes.ts). Statt jede App selbst HTML zu schreiben, kann sie diese
-// Renderer als one-liner nutzen:
+// Default renderers for the transactional auth mails. All four magic-link flows
+// (password-reset, email-verification, signup-activation, invite) emit
+// structured AuthMailContent that the handler hands to delivery (ctx.notify) —
+// renderer-simple turns it into HTML. Apps wanting their own branding swap the
+// renderer; these templates are deliberately plain so the renderer (and the
+// operator reading the mailer log) can rely on them.
 //
-//   passwordReset: {
-//     sendResetEmail: ({ email, resetUrl, expiresAt }) =>
-//       mailSender.send({
-//         to: email,
-//         ...renderResetPasswordEmail({ resetUrl, expiresAt, locale: "de" }),
-//       }),
-//   }
-//
-// Apps die ihr eigenes Branding wollen, schreiben einen eigenen Renderer
-// und mischen ihn in. Die Templates hier sind bewusst plain HTML mit
-// inline-styling — kein CSS-Framework, kein bild-asset. Mail-Clients
-// rendern das verlässlich, und der Operator kann das HTML im Mailer-Log
-// problemlos lesen.
-//
-// Locale: de + en. Apps mit anderen Sprachen rendern selbst.
+// Locale: de + en. Apps with other languages render themselves.
 
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { Temporal } from "temporal-polyfill";
 
 export type AuthMailLocale = "de" | "en";
 
-export type RenderResetPasswordEmailArgs = {
-  readonly resetUrl: string;
+// Unified args for the structured token-mail renderers (reset + verify).
+// `url` is the fully-built magic-link — the handler already appended ?token=.
+export type RenderTokenContentArgs = {
+  readonly url: string;
   readonly expiresAt: string;
   readonly locale?: AuthMailLocale;
   /** Optional: App-Name fürs Subject + Header. Default "Account". */
   readonly appName?: string;
 };
 
-export type RenderVerifyEmailArgs = {
-  readonly verificationUrl: string;
-  readonly expiresAt: string;
-  readonly locale?: AuthMailLocale;
-  readonly appName?: string;
-};
+// Invite adds the role to the unified token-content args; `url` is the fully-
+// built magic-link (the handler already appended ?token=).
+export type RenderInviteEmailArgs = RenderTokenContentArgs & { readonly role: string };
 
-export type RenderActivationEmailArgs = {
-  readonly activationUrl: string;
-  readonly expiresAt: string;
-  readonly locale?: AuthMailLocale;
-  readonly appName?: string;
-};
+export type AuthMailSection =
+  | { readonly text: string }
+  | { readonly button: { readonly label: string; readonly url: string } };
 
-export type RenderInviteEmailArgs = {
-  readonly inviteUrl: string;
-  readonly expiresAt: string;
-  readonly role: string;
-  readonly locale?: AuthMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderedEmail = {
+// Structured content the magic-link handlers pass as the delivery `data`
+// payload: renderer-simple turns header/sections/footer into HTML, the
+// email-channel reads `subject`. No pre-rendered HTML — the renderer owns layout.
+export type AuthMailContent = {
   readonly subject: string;
-  readonly html: string;
+  readonly header: string;
+  readonly sections: readonly AuthMailSection[];
+  readonly footer: string;
 };
 
 const STRINGS = {
@@ -94,7 +73,6 @@ const STRINGS = {
     inviteExpiry: (when: string) => `Der Link läuft am ${when} ab.`,
     inviteIgnore:
       "Falls du diese Einladung nicht erwartet hast, kannst du diese E-Mail ignorieren.",
-    fallbackUrl: "Falls der Button nicht funktioniert, kopiere diesen Link in den Browser:",
   },
   en: {
     resetSubject: (app: string) => `${app} — Reset your password`,
@@ -127,134 +105,97 @@ const STRINGS = {
     inviteButton: "Accept invitation",
     inviteExpiry: (when: string) => `The link expires on ${when}.`,
     inviteIgnore: "If you weren't expecting this invitation, you can ignore this email.",
-    fallbackUrl: "If the button doesn't work, copy this link into your browser:",
   },
 } as const;
 
-// Shared shape für beide Token-Mails — heading/intro/button/expiry/ignore
-// + button-Url + fallback-Url. renderResetPasswordEmail und renderVerifyEmail
-// bauen den Spec aus den lokalisierten STRINGS und delegieren ans
-// renderTokenEmail. Damit ist die Layout-Logik genau einmal definiert.
-type TokenEmailSpec = {
+// Structured content for the delivery path. header = action title (CTA label),
+// sections = greeting/intro/button/expiry, footer = the "ignore if not you"
+// reassurance. The old plain-text fallback-URL link drops out — renderer-simple
+// has no link-text section and the button carries the URL.
+function tokenMailContent(spec: {
   readonly subject: string;
+  readonly header: string;
   readonly greeting: string;
   readonly intro: string;
   readonly buttonLabel: string;
   readonly buttonUrl: string;
   readonly expiry: string;
   readonly ignore: string;
-  readonly fallbackUrlLabel: string;
-};
-
-function renderTokenEmail(spec: TokenEmailSpec): RenderedEmail {
-  const bodyHtml = `
-    <tr><td>
-      <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(spec.greeting)}</p>
-      <p style="margin: 0 0 24px; font-size: 14px; line-height: 1.5;">${escapeHtml(spec.intro)}</p>
-      <p style="margin: 0 0 24px;">${renderButton({ url: spec.buttonUrl, label: spec.buttonLabel })}</p>
-      <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(spec.expiry)}</p>
-      <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(spec.ignore)}</p>
-      ${renderFallbackUrl({ url: spec.buttonUrl, label: spec.fallbackUrlLabel })}
-    </td></tr>`;
-  return { subject: spec.subject, html: renderShell({ title: spec.subject, bodyHtml }) };
-}
-
-// Plain inline-styled HTML — funktioniert in Gmail/Outlook/Apple-Mail
-// ohne dass wir Tailwind oder eine HTML-mail-Lib reinziehen müssen.
-// guard:dup-ok — Email-HTML (table-layout, inline CSS) ≠ Web-HTML (legal-pages/markdown.ts)
-function renderShell(args: { title: string; bodyHtml: string }): string {
-  return `<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(args.title)}</title>
-  </head>
-  <body style="margin: 0; padding: 0; background: #f7f7f7; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; color: #1a1a1a;">
-    <table width="100%" cellpadding="0" cellspacing="0" style="padding: 24px 0;">
-      <tr>
-        <td align="center">
-          <table width="560" cellpadding="0" cellspacing="0" style="max-width: 560px; background: #ffffff; border-radius: 8px; padding: 32px;">
-            ${args.bodyHtml}
-          </table>
-        </td>
-      </tr>
-    </table>
-  </body>
-</html>`;
-}
-
-// guard:dup-ok — Email-HTML-Helper; selbe normalisierte AST-Form wie wrapInLayout (legal-pages), verschiedene Semantik
-function renderButton(args: { url: string; label: string }): string {
-  return `<a href="${escapeHtmlAttr(args.url)}" style="display: inline-block; background: #1a1a1a; color: #ffffff; padding: 12px 24px; border-radius: 6px; text-decoration: none; font-weight: 500;">${escapeHtml(args.label)}</a>`;
-}
-
-// guard:dup-ok — Email-HTML-Helper; selbe normalisierte AST-Form wie wrapInLayout (legal-pages), verschiedene Semantik
-function renderFallbackUrl(args: { url: string; label: string }): string {
-  return `<p style="margin: 24px 0 0; font-size: 12px; color: #666;">${escapeHtml(args.label)}<br /><a href="${escapeHtmlAttr(args.url)}" style="color: #1a1a1a; word-break: break-all;">${escapeHtml(args.url)}</a></p>`;
+}): AuthMailContent {
+  return {
+    subject: spec.subject,
+    header: spec.header,
+    sections: [
+      { text: spec.greeting },
+      { text: spec.intro },
+      { button: { label: spec.buttonLabel, url: spec.buttonUrl } },
+      { text: spec.expiry },
+    ],
+    footer: spec.ignore,
+  };
 }
 
-export function renderResetPasswordEmail(args: RenderResetPasswordEmailArgs): RenderedEmail {
+export function renderResetPasswordEmail(args: RenderTokenContentArgs): AuthMailContent {
   const locale = args.locale ?? "en";
   const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");
   const t = STRINGS[locale];
-  return renderTokenEmail({
+  return tokenMailContent({
     subject: t.resetSubject(appName),
+    header: t.resetButton,
     greeting: t.resetGreeting,
     intro: t.resetIntro(appName),
     buttonLabel: t.resetButton,
-    buttonUrl: args.resetUrl,
+    buttonUrl: args.url,
     expiry: t.resetExpiry(formatExpiry(args.expiresAt)),
     ignore: t.resetIgnore,
-    fallbackUrlLabel: t.fallbackUrl,
   });
 }
 
-export function renderVerifyEmail(args: RenderVerifyEmailArgs): RenderedEmail {
+export function renderVerifyEmail(args: RenderTokenContentArgs): AuthMailContent {
   const locale = args.locale ?? "en";
   const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");
   const t = STRINGS[locale];
-  return renderTokenEmail({
+  return tokenMailContent({
     subject: t.verifySubject(appName),
+    header: t.verifyButton,
     greeting: t.verifyGreeting,
     intro: t.verifyIntro(appName),
     buttonLabel: t.verifyButton,
-    buttonUrl: args.verificationUrl,
+    buttonUrl: args.url,
     expiry: t.verifyExpiry(formatExpiry(args.expiresAt)),
     ignore: t.verifyIgnore,
-    fallbackUrlLabel: t.fallbackUrl,
   });
 }
 
-export function renderActivationEmail(args: RenderActivationEmailArgs): RenderedEmail {
+export function renderActivationEmail(args: RenderTokenContentArgs): AuthMailContent {
   const locale = args.locale ?? "en";
   const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");
   const t = STRINGS[locale];
-  return renderTokenEmail({
+  return tokenMailContent({
     subject: t.activationSubject(appName),
+    header: t.activationButton,
     greeting: t.activationGreeting,
     intro: t.activationIntro(appName),
     buttonLabel: t.activationButton,
-    buttonUrl: args.activationUrl,
+    buttonUrl: args.url,
     expiry: t.activationExpiry(formatExpiry(args.expiresAt)),
     ignore: t.activationIgnore,
-    fallbackUrlLabel: t.fallbackUrl,
   });
 }
 
-export function renderInviteEmail(args: RenderInviteEmailArgs): RenderedEmail {
+export function renderInviteEmail(args: RenderInviteEmailArgs): AuthMailContent {
   const locale = args.locale ?? "en";
-  const appName = args.appName ?? (locale === "de" ? "Workspace" : "Workspace");
+  const appName = args.appName ?? "Workspace";
   const t = STRINGS[locale];
-  return renderTokenEmail({
+  return tokenMailContent({
     subject: t.inviteSubject(appName),
+    header: t.inviteButton,
     greeting: t.inviteGreeting,
     intro: t.inviteIntro(appName, args.role),
     buttonLabel: t.inviteButton,
-    buttonUrl: args.inviteUrl,
+    buttonUrl: args.url,
     expiry: t.inviteExpiry(formatExpiry(args.expiresAt)),
     ignore: t.inviteIgnore,
-    fallbackUrlLabel: t.fallbackUrl,
   });
 }
 

package/src/auth-email-password/feature.ts

@@ -1,5 +1,6 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import type { AuthMailLocale } from "./email-templates";
 import { changePasswordWrite } from "./handlers/change-password.write";
 import { createInviteAcceptHandler } from "./handlers/invite-accept.write";
 import { createInviteAcceptWithLoginHandler } from "./handlers/invite-accept-with-login.write";
@@ -54,6 +55,12 @@ export const authEmailPasswordEnvSchema = z.object({
 export type PasswordResetOptions = {
   readonly hmacSecret: string;
   readonly tokenTtlMinutes?: number;
+  // App page that receives the magic-link; the handler appends `?token=…` and
+  // sends the mail via delivery (ctx.notify). No sendResetEmail callback — the
+  // app mounts `delivery` + a mail channel instead.
+  readonly appUrl: string;
+  readonly appName?: string;
+  readonly locale?: AuthMailLocale;
 };
 
 // Opt-in configuration for the email-verification flow. mode="strict"
@@ -65,6 +72,11 @@ export type EmailVerificationOptions = {
   readonly hmacSecret: string;
   readonly tokenTtlMinutes?: number;
   readonly mode?: "strict" | "off";
+  // App page that receives the magic-link; the handler appends `?token=…` and
+  // sends via delivery (ctx.notify). No sendVerificationEmail callback.
+  readonly appUrl: string;
+  readonly appName?: string;
+  readonly locale?: AuthMailLocale;
 };
 
 // Brute-force protection on the login handler. Omit for the defaults
@@ -126,7 +138,7 @@ export function createAuthEmailPasswordFeature(
 
   return defineFeature("auth-email-password", (r) => {
     r.describe(
-      "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows \u2014 password reset, email verification, magic-link self-signup, and tenant invite \u2014 are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`) to `createAuthEmailPasswordFeature(opts)`. Each opt-in flow uses HMAC-signed or opaque-random tokens delivered via callback (e.g. `sendResetEmail`) so the feature stays transport-agnostic. Requires the `user` and `tenant` features, and declares `JWT_SECRET` (\u2265 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
+      "Provides email+password authentication: the always-on handlers are `login`, `changePassword`, and `logout`; optional flows \u2014 password reset, email verification, magic-link self-signup, and tenant invite \u2014 are registered only when you pass their respective option objects (`passwordReset`, `emailVerification`, `signup`, `invite`) to `createAuthEmailPasswordFeature(opts)`. All four magic-link flows (reset, verification, signup activation, tenant invite) dispatch their mail through the `delivery` feature via `ctx.notify`, so mounting any of them additionally requires `delivery`. Tokens are HMAC-signed (reset/verify) or opaque-random in Redis (signup/invite). Requires the `user` and `tenant` features, and declares `JWT_SECRET` (\u2265 32 chars) in `authEmailPasswordEnvSchema` so a missing secret surfaces at boot validation rather than on the first login attempt.",
     );
     r.uiHints({
       displayLabel: "Auth \u00b7 Email + Password",
@@ -146,6 +158,12 @@ export function createAuthEmailPasswordFeature(
     });
     r.requires("user");
     r.requires("tenant");
+    // All four magic-link flows (reset/verify/signup/invite) dispatch via
+    // ctx.notify → delivery must be mounted. Fail closed at boot instead of
+    // silently dropping the mail.
+    if (opts.passwordReset || opts.emailVerification || opts.signup || opts.invite) {
+      r.requires("delivery");
+    }
     r.envSchema(authEmailPasswordEnvSchema);
 
     const handlers = {