@cosmicdrift/kumiko-bundled-features 0.102.2 → 0.104.0

package/src/auth-email-password/handlers/invite-create.write.ts

@@ -1,8 +1,10 @@
 // Tenant-Invite Step 1 (create).
 //
 // Admin invitet email → DB-Row entsteht via event-store-executor (oder
-// wird re-used bei Re-Invite), Random-Token in Redis bidirektional,
-// Route-Layer schickt Mail mit Activation-URL.
+// wird re-used bei Re-Invite), Random-Token in Redis bidirektional, und der
+// Handler schickt die Invite-Mail an den Invitee via delivery (ctx.notify) —
+// wie reset/verify/signup. Der Token geht NICHT an den Admin zurück (er soll
+// die Annahme nicht impersonieren können).
 //
 // Resend-Idempotenz: Re-Invite für gleiche (tenantId, email) während
 // pending → existing row + token re-genutzt + TTL refresh + zweite Mail
@@ -33,7 +35,12 @@ import {
   reservedMembershipRoleError,
 } from "../../tenant/membership-roles";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants";
+import type { AuthMailLocale } from "../email-templates";
+import { renderInviteEmail } from "../email-templates";
 import { getTokenForInvitation, storeInviteToken } from "../invite-token-store";
+import { dispatchMagicLinkMail } from "../magic-link-mail";
+
+const INVITE_NOTIFICATION_TYPE = "auth-email-password:invite";
 
 const InviteCreateSchema = z.object({
   email: z.email(),
@@ -46,20 +53,24 @@ export type InviteCreateData = {
   readonly tenantId: string;
   readonly email: string;
   readonly role: string;
-  readonly token: string;
   readonly expiresAt: string;
 };
 
 export type InviteCreateOptions = {
   /** TTL für den Activation-Token. Default 7 Tage. */
   readonly tokenTtlMinutes?: number;
+  /** App page that receives the magic-link; the handler appends `?token=…`
+   *  and dispatches the invite mail via delivery (ctx.notify). */
+  readonly appUrl: string;
+  readonly appName?: string;
+  readonly locale?: AuthMailLocale;
 };
 
 const executor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, {
   entityName: "tenant-invitation",
 });
 
-export function createInviteCreateHandler(opts: InviteCreateOptions = {}) {
+export function createInviteCreateHandler(opts: InviteCreateOptions) {
   const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES;
   const ttlSeconds = ttlMinutes * 60;
 
@@ -133,6 +144,24 @@ export function createInviteCreateHandler(opts: InviteCreateOptions = {}) {
 
       await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
 
+      await dispatchMagicLinkMail(
+        ctx.notify,
+        {
+          handlerName: "invite-create",
+          notificationType: INVITE_NOTIFICATION_TYPE,
+          renderContent: (renderArgs) =>
+            renderInviteEmail({ ...renderArgs, role: event.payload.role }),
+        },
+        {
+          email,
+          appUrl: opts.appUrl,
+          token,
+          expiresAt: expiresAt.toString(),
+          ...(opts.appName !== undefined && { appName: opts.appName }),
+          ...(opts.locale !== undefined && { locale: opts.locale }),
+        },
+      );
+
       return {
         isSuccess: true,
         data: {
@@ -141,7 +170,6 @@ export function createInviteCreateHandler(opts: InviteCreateOptions = {}) {
           tenantId,
           email,
           role: event.payload.role,
-          token,
           expiresAt: expiresAt.toString(),
         },
       };

package/src/auth-email-password/handlers/request-email-verification.write.ts

@@ -1,4 +1,5 @@
 import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants";
+import { renderVerifyEmail } from "../email-templates";
 import { signVerificationToken } from "../verification-token";
 import {
   createTokenRequestHandler,
@@ -6,6 +7,8 @@ import {
   type TokenRequestOptions,
 } from "./token-request-handler";
 
+const VERIFY_NOTIFICATION_TYPE = "auth-email-password:email-verification";
+
 export type RequestEmailVerificationOptions = TokenRequestOptions;
 
 export type RequestVerificationData = TokenRequestData<"verification-requested">;
@@ -24,6 +27,8 @@ export function createRequestEmailVerificationHandler(opts: RequestEmailVerifica
       // unknown/deleted to keep the enumeration surface symmetric — the
       // caller sees the same 200 regardless of whether a token was minted.
       extraSilentSkip: (user) => user.emailVerified === true,
+      notificationType: VERIFY_NOTIFICATION_TYPE,
+      renderContent: renderVerifyEmail,
     },
     opts,
   );

package/src/auth-email-password/handlers/request-password-reset.write.ts

@@ -1,4 +1,5 @@
 import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants";
+import { renderResetPasswordEmail } from "../email-templates";
 import { signResetToken } from "../reset-token";
 import {
   createTokenRequestHandler,
@@ -6,6 +7,8 @@ import {
   type TokenRequestOptions,
 } from "./token-request-handler";
 
+const RESET_NOTIFICATION_TYPE = "auth-email-password:password-reset";
+
 export type RequestPasswordResetOptions = TokenRequestOptions;
 
 // Public shape re-exported for callers that build custom routes on top of
@@ -26,6 +29,8 @@ export function createRequestPasswordResetHandler(opts: RequestPasswordResetOpti
       // non-deleted user can initiate a reset regardless of verification
       // state. The sessions feature handles the post-change revocation.
       extraSilentSkip: () => false,
+      notificationType: RESET_NOTIFICATION_TYPE,
+      renderContent: renderResetPasswordEmail,
     },
     opts,
   );

package/src/auth-email-password/handlers/signup-request.write.ts

@@ -1,8 +1,8 @@
 // Magic-Link-Signup, Step 1 (request).
 //
 // User gibt Email ein → wir minten einen opaken Random-Token, speichern
-// ihn bidirektional in Redis (token↔email), und der Route-Layer schickt
-// die Activation-Mail. Anders als reset/verify-Flows machen wir HIER keinen
+// ihn bidirektional in Redis (token↔email), und schicken die Activation-Mail
+// via delivery (ctx.notify) — wie reset/verify. Anders als die: HIER kein
 // userId-Lookup und kein HMAC-signing (es gäbe kein Subject — im Normalfall
 // existiert der User noch nicht). Ob die Email bereits ein Konto hat,
 // entscheidet bewusst der Confirm-Schritt, nicht dieser.
@@ -28,8 +28,13 @@ import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/error
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "../constants";
+import type { AuthMailLocale } from "../email-templates";
+import { renderActivationEmail } from "../email-templates";
+import { dispatchMagicLinkMail } from "../magic-link-mail";
 import { getTokenForSignupEmail, normalizeEmail, storeSignupToken } from "../signup-token-store";
 
+const SIGNUP_NOTIFICATION_TYPE = "auth-email-password:signup-activation";
+
 const SignupRequestSchema = z.object({
   email: z.email(),
 });
@@ -47,9 +52,14 @@ export type SignupRequestOptions = {
   /** TTL für den Activation-Token. Default 24 h — lang genug damit User
    *  "morgen aktivieren" können ohne Resend-Spam. */
   readonly tokenTtlMinutes?: number;
+  /** App page that receives the magic-link; the handler appends `?token=…`
+   *  and dispatches the activation mail via delivery (ctx.notify). */
+  readonly appUrl: string;
+  readonly appName?: string;
+  readonly locale?: AuthMailLocale;
 };
 
-export function createSignupRequestHandler(opts: SignupRequestOptions = {}) {
+export function createSignupRequestHandler(opts: SignupRequestOptions) {
   const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_SIGNUP_DEFAULT_TTL_MINUTES;
   const ttlSeconds = ttlMinutes * 60;
 
@@ -86,19 +96,39 @@ export function createSignupRequestHandler(opts: SignupRequestOptions = {}) {
       const token = existingToken ?? generateToken();
 
       const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+      const expiresAtIso = expiresAt.toString();
 
       await storeSignupToken(ctx.redis, { email, token, ttlSeconds });
 
+      // normalizeEmail aus dem Store — eine Quelle für die Normalisierungs-
+      // Verantwortung; delivery-Empfänger + Lookup-Pfad kriegen konsistent
+      // das gleiche Format.
+      const normalizedEmail = normalizeEmail(email);
+
+      await dispatchMagicLinkMail(
+        ctx.notify,
+        {
+          handlerName: "signup-request",
+          notificationType: SIGNUP_NOTIFICATION_TYPE,
+          renderContent: renderActivationEmail,
+        },
+        {
+          email: normalizedEmail,
+          appUrl: opts.appUrl,
+          token,
+          expiresAt: expiresAtIso,
+          ...(opts.appName !== undefined && { appName: opts.appName }),
+          ...(opts.locale !== undefined && { locale: opts.locale }),
+        },
+      );
+
       return {
         isSuccess: true,
         data: {
           kind: "signup-requested",
-          // normalizeEmail aus dem Store — eine Quelle für die
-          // Normalisierungs-Verantwortung; Mail-Callback kriegt
-          // konsistent das gleiche Format wie der Lookup-Pfad.
-          email: normalizeEmail(email),
+          email: normalizedEmail,
           token,
-          expiresAt: expiresAt.toString(),
+          expiresAt: expiresAtIso,
         },
       };
     },

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -17,6 +17,8 @@ import type { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { UserQueries } from "../../user";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";
+import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "../email-templates";
+import { dispatchMagicLinkMail } from "../magic-link-mail";
 
 const RequestTokenSchema = z.object({
   email: z.email(),
@@ -56,11 +58,22 @@ export type TokenRequestSpec<TName extends string, TSuccessKind extends string>
   // soft-deleted". Verification skips when emailVerified is already true;
   // password-reset has no extra condition (returns false).
   readonly extraSilentSkip: (user: AuthUserRow) => boolean;
+  // Notification type dispatched via ctx.notify on success. No r.notification
+  // is declared (the recipient is an anonymous email, not a userId) — the
+  // route:{email} path delivers directly and buildMessage falls back to data.
+  readonly notificationType: string;
+  // Builds the structured mail body from the magic-link + expiry. Per-flow
+  // (renderResetPasswordEmail / renderVerifyEmail).
+  readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
 };
 
 export type TokenRequestOptions = {
   readonly hmacSecret: string;
   readonly tokenTtlMinutes?: number;
+  // App page that receives the magic-link; the handler appends `?token=…`.
+  readonly appUrl: string;
+  readonly appName?: string;
+  readonly locale?: AuthMailLocale;
 };
 
 export function createTokenRequestHandler<TName extends string, TSuccessKind extends string>(
@@ -103,6 +116,24 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
       }
 
       const { token, expiresAt } = spec.sign(user.id, ttl, opts.hmacSecret);
+
+      await dispatchMagicLinkMail(
+        ctx.notify,
+        {
+          handlerName: spec.handlerName,
+          notificationType: spec.notificationType,
+          renderContent: spec.renderContent,
+        },
+        {
+          email: user.email,
+          appUrl: opts.appUrl,
+          token,
+          expiresAt: expiresAt.toString(),
+          ...(opts.appName !== undefined && { appName: opts.appName }),
+          ...(opts.locale !== undefined && { locale: opts.locale }),
+        },
+      );
+
       const data: TokenRequestData<TSuccessKind> = {
         kind: spec.successKind,
         email: user.email,

package/src/auth-email-password/index.ts

@@ -1,27 +1,16 @@
-// Factory für app-spezifische Auth-Mail-Configs. Baut passwordReset,
-// emailVerification, signup und invite Setups gegen mailSender + Render-
-// Funktionen — eliminiert Duplikate zwischen kumiko-studio, publicstatus
-// und solon (jede App hatte identische send*Email-Wrapper kopiert).
-export {
-  type AuthMailerConfig,
-  type AuthPaths,
-  type CreateAuthMailerConfigArgs,
-  createAuthMailerConfig,
-  DEFAULT_AUTH_PATHS,
-  makeAuthPaths,
-} from "./auth-mailer";
+// Convention paths for the auth pages (reset/verify/signup/invite); apps build
+// their magic-link appUrls from these. All mail now goes through delivery.
+export { type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers } from "./constants";
-// Default-HTML-Renderer für die Reset-Password + Verify-Email Mails.
-// Apps wiren die `sendResetEmail` / `sendVerificationEmail` callbacks
-// im framework-config — diese Renderer können als one-liner genutzt
-// werden, oder die App schreibt einen eigenen Renderer für Branding.
+// Renderers for the auth mails. All four magic-link flows (reset, verify,
+// signup-activation, invite) emit structured AuthMailContent through delivery
+// (ctx.notify).
 export type {
+  AuthMailContent,
   AuthMailLocale,
-  RenderActivationEmailArgs,
-  RenderedEmail,
+  AuthMailSection,
   RenderInviteEmailArgs,
-  RenderResetPasswordEmailArgs,
-  RenderVerifyEmailArgs,
+  RenderTokenContentArgs,
 } from "./email-templates";
 export {
   renderActivationEmail,

package/src/auth-email-password/magic-link-mail.ts

@@ -0,0 +1,62 @@
+// Shared dispatch for the magic-link mails (password-reset, email-verification,
+// signup-activation). All three follow the same delivery shape: append the
+// token to the app page, render structured content, and notify the recipient
+// email directly (route:{email} skips preferences — the recipient may not have
+// a user account yet — and critical priority keeps a security mail
+// non-unsubscribable). No r.notification is declared; buildMessage falls back
+// to the structured `data` for the renderer.
+
+import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "./email-templates";
+
+// Per-flow constants: which notification type to dispatch and how to render the
+// body. renderContent is the flow's template (renderResetPasswordEmail / … /
+// renderActivationEmail), all unified on RenderTokenContentArgs → AuthMailContent.
+export type MagicLinkMailSpec = {
+  readonly handlerName: string;
+  readonly notificationType: string;
+  readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
+};
+
+// Per-request values: the recipient + the app page that receives the token, plus
+// optional presentation. appUrl is the bare page URL; the token is appended here.
+export type MagicLinkMailParams = {
+  readonly email: string;
+  readonly appUrl: string;
+  readonly token: string;
+  readonly expiresAt: string;
+  readonly appName?: string;
+  readonly locale?: AuthMailLocale;
+};
+
+function appendToken(appUrl: string, token: string): string {
+  const sep = appUrl.includes("?") ? "&" : "?";
+  return `${appUrl}${sep}token=${encodeURIComponent(token)}`;
+}
+
+export async function dispatchMagicLinkMail(
+  notify: NotifyFn | undefined,
+  spec: MagicLinkMailSpec,
+  params: MagicLinkMailParams,
+): Promise<void> {
+  // delivery is a hard requirement when a magic-link flow is mounted (see
+  // feature.ts r.requires), so notify is always wired — this guard is a
+  // defensive boot-invariant, not a runtime branch.
+  if (!notify) {
+    throw new InternalError({
+      message: `${spec.handlerName}: ctx.notify unavailable — the delivery feature must be mounted`,
+    });
+  }
+  const content = spec.renderContent({
+    url: appendToken(params.appUrl, params.token),
+    expiresAt: params.expiresAt,
+    ...(params.locale !== undefined && { locale: params.locale }),
+    ...(params.appName !== undefined && { appName: params.appName }),
+  });
+  await notify(spec.notificationType, {
+    route: { email: params.email },
+    data: content,
+    priority: "critical",
+  });
+}

package/src/auth-email-password/__tests__/auth-mailer.test.ts

@@ -1,138 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { createInMemoryTransport } from "../../channel-email";
-import { createAuthMailerConfig } from "../auth-mailer";
-
-function makeArgs(overrides?: Record<string, unknown>) {
-  const mailSender = createInMemoryTransport();
-  return {
-    mailSender,
-    hmacSecret: "test-hmac-secret",
-    baseUrl: "https://admin.example.com",
-    paths: {
-      resetPassword: "/reset-password",
-      verifyEmail: "/verify-email",
-      signupComplete: "/signup/complete",
-      inviteAccept: "/invite/accept",
-    },
-    appName: "TestApp",
-    locale: "en" as const,
-    ...overrides,
-  };
-}
-
-describe("createAuthMailerConfig", () => {
-  test("returns all 4 setups", () => {
-    const config = createAuthMailerConfig(makeArgs());
-    expect(config.passwordReset).toBeDefined();
-    expect(config.emailVerification).toBeDefined();
-    expect(config.signup).toBeDefined();
-    expect(config.invite).toBeDefined();
-  });
-
-  test("constructs URLs from baseUrl + paths", () => {
-    const config = createAuthMailerConfig(makeArgs());
-    expect(config.passwordReset.appResetUrl).toBe("https://admin.example.com/reset-password");
-    expect(config.emailVerification.appVerifyUrl).toBe("https://admin.example.com/verify-email");
-    expect(config.signup.appActivationUrl).toBe("https://admin.example.com/signup/complete");
-    expect(config.invite.appAcceptUrl).toBe("https://admin.example.com/invite/accept");
-  });
-
-  test("forwards hmacSecret", () => {
-    const config = createAuthMailerConfig(makeArgs());
-    expect(config.passwordReset.hmacSecret).toBe("test-hmac-secret");
-    expect(config.emailVerification.hmacSecret).toBe("test-hmac-secret");
-  });
-
-  test("sendResetEmail calls mailSender.send with rendered content", async () => {
-    const args = makeArgs();
-    const config = createAuthMailerConfig(args);
-
-    await config.passwordReset.sendResetEmail({
-      email: "user@example.com",
-      resetUrl: "https://admin.example.com/reset?token=abc",
-      expiresAt: "2026-06-09T12:00:00.000Z",
-    });
-
-    expect(args.mailSender.sent).toHaveLength(1);
-    expect(args.mailSender.sent[0]!.to).toBe("user@example.com");
-    expect(args.mailSender.sent[0]!.subject).toContain("TestApp");
-    expect(args.mailSender.sent[0]!.subject).toContain("Reset");
-    expect(args.mailSender.sent[0]!.html).toContain("https://admin.example.com/reset?token=abc");
-  });
-
-  test("sendVerificationEmail calls mailSender.send", async () => {
-    const args = makeArgs();
-    const config = createAuthMailerConfig(args);
-
-    await config.emailVerification.sendVerificationEmail({
-      email: "user@example.com",
-      verificationUrl: "https://admin.example.com/verify?token=abc",
-      expiresAt: "2026-06-09T12:00:00.000Z",
-    });
-
-    expect(args.mailSender.sent).toHaveLength(1);
-    expect(args.mailSender.sent[0]!.to).toBe("user@example.com");
-    expect(args.mailSender.sent[0]!.subject).toContain("TestApp");
-    expect(args.mailSender.sent[0]!.subject).toContain("Verify");
-  });
-
-  test("sendActivationEmail calls mailSender.send", async () => {
-    const args = makeArgs();
-    const config = createAuthMailerConfig(args);
-
-    await config.signup.sendActivationEmail({
-      email: "user@example.com",
-      activationUrl: "https://admin.example.com/signup/complete?token=abc",
-      expiresAt: "2026-06-09T12:00:00.000Z",
-    });
-
-    expect(args.mailSender.sent).toHaveLength(1);
-    expect(args.mailSender.sent[0]!.to).toBe("user@example.com");
-    expect(args.mailSender.sent[0]!.subject).toContain("TestApp");
-  });
-
-  test("sendInviteEmail calls mailSender.send with role", async () => {
-    const args = makeArgs();
-    const config = createAuthMailerConfig(args);
-
-    await config.invite.sendInviteEmail({
-      email: "user@example.com",
-      inviteUrl: "https://admin.example.com/invite/accept?token=abc",
-      expiresAt: "2026-06-09T12:00:00.000Z",
-      role: "Admin",
-    });
-
-    expect(args.mailSender.sent).toHaveLength(1);
-    expect(args.mailSender.sent[0]!.to).toBe("user@example.com");
-    expect(args.mailSender.sent[0]!.subject).toContain("TestApp");
-    expect(args.mailSender.sent[0]!.html).toContain("Admin");
-  });
-
-  test("uses defaults when appName is omitted", () => {
-    const config = createAuthMailerConfig(makeArgs({ appName: undefined }));
-    expect(config.passwordReset.appResetUrl).toBeDefined();
-  });
-
-  test("emailVerificationMode is absent when not provided", () => {
-    const config = createAuthMailerConfig(makeArgs());
-    expect("mode" in config.emailVerification).toBe(false);
-  });
-
-  test("emailVerificationMode is set when provided", () => {
-    const config = createAuthMailerConfig(makeArgs({ emailVerificationMode: "strict" }));
-    expect(config.emailVerification).toHaveProperty("mode", "strict");
-  });
-
-  test("locale 'de' renders German subject", async () => {
-    const args = makeArgs({ locale: "de" });
-    const config = createAuthMailerConfig(args);
-
-    await config.passwordReset.sendResetEmail({
-      email: "user@example.com",
-      resetUrl: "https://example.com/reset?token=abc",
-      expiresAt: "2026-06-09T12:00:00.000Z",
-    });
-
-    expect(args.mailSender.sent[0]!.subject).toContain("Passwort");
-  });
-});

package/src/auth-email-password/auth-mailer.ts

@@ -1,153 +0,0 @@
-import type { EmailTransport } from "../channel-email";
-import type { AuthMailLocale } from "./email-templates";
-import {
-  renderActivationEmail,
-  renderInviteEmail,
-  renderResetPasswordEmail,
-  renderVerifyEmail,
-} from "./email-templates";
-import type {
-  EmailVerificationOptions,
-  InviteOptions,
-  PasswordResetOptions,
-  SignupOptions,
-} from "./feature";
-
-/**
- * Komplette Konfiguration für die 4 Auth-Mail-Flows einer App.
- *
- * Strukturell kompatibel mit den `*Setup`-Typen aus
- * `@cosmicdrift/kumiko-dev-server` (`PasswordResetSetup`,
- * `EmailVerificationSetup`, `SignupSetup`, `InviteSetup`).
- */
-export type AuthMailerConfig = {
-  readonly passwordReset: PasswordResetOptions & {
-    readonly appResetUrl: string;
-    readonly sendResetEmail: (args: {
-      email: string;
-      resetUrl: string;
-      expiresAt: string;
-    }) => Promise<void>;
-  };
-  readonly emailVerification: EmailVerificationOptions & {
-    readonly appVerifyUrl: string;
-    readonly sendVerificationEmail: (args: {
-      email: string;
-      verificationUrl: string;
-      expiresAt: string;
-    }) => Promise<void>;
-  };
-  readonly signup: SignupOptions & {
-    readonly appActivationUrl: string;
-    readonly sendActivationEmail: (args: {
-      email: string;
-      activationUrl: string;
-      expiresAt: string;
-    }) => Promise<void>;
-  };
-  readonly invite: InviteOptions & {
-    readonly appAcceptUrl: string;
-    readonly sendInviteEmail: (args: {
-      email: string;
-      inviteUrl: string;
-      expiresAt: string;
-      role: string;
-    }) => Promise<void>;
-  };
-};
-
-/** Pfad-Konstanten der 4 Auth-Seiten (relativ zur App-baseUrl). */
-export type AuthPaths = {
-  readonly resetPassword: string;
-  readonly verifyEmail: string;
-  readonly signupComplete: string;
-  readonly inviteAccept: string;
-};
-
-/** Konventions-Pfade — alle Kumiko-Apps nutzen dieselben. Apps überschreiben
- *  nur die Ausnahme via `makeAuthPaths({ ... })`. */
-export const DEFAULT_AUTH_PATHS: AuthPaths = {
-  resetPassword: "/reset-password",
-  verifyEmail: "/verify-email",
-  signupComplete: "/signup/complete",
-  inviteAccept: "/invite/accept",
-};
-
-export function makeAuthPaths(overrides: Partial<AuthPaths> = {}): AuthPaths {
-  return { ...DEFAULT_AUTH_PATHS, ...overrides };
-}
-
-export type CreateAuthMailerConfigArgs = {
-  readonly mailSender: EmailTransport;
-  readonly hmacSecret: string;
-  /** Basis-URL der App inkl. Schema (z.B. "https://admin.example.com").
-   *  Die factory hängt paths.resetPassword etc. an. */
-  readonly baseUrl: string;
-  /** Pfad-Konstanten für die Auth-Seiten. Default: DEFAULT_AUTH_PATHS. */
-  readonly paths?: AuthPaths;
-  /** App-Name für Mail-Subject + Body. Default "Account". */
-  readonly appName?: string;
-  /** Locale für die Mail-Templates. Default "de". */
-  readonly locale?: AuthMailLocale;
-  /** Email-verification mode. Default undefined (kein Gate).
-   *  "strict" blockt Login solange `emailVerified=false`.
-   *  "off" mountet die Routes ohne login-gating. */
-  readonly emailVerificationMode?: "strict" | "off";
-};
-
-/**
- * Factory für `AuthMailerConfig` — baut die 4 Auth-Mail-Setups
- * (passwordReset / emailVerification / signup / invite) inklusive
- * `send*Email`-Wrapper + URL-Konstruktion.
- *
- * Jede App ruft das einmal auf und spreadet das Resultat in die
- * `auth`-Option von `runProdApp` / `runDevApp`.
- */
-export function createAuthMailerConfig(args: CreateAuthMailerConfigArgs): AuthMailerConfig {
-  const appName = args.appName ?? "Account";
-  const locale = args.locale ?? "de";
-  const paths = args.paths ?? DEFAULT_AUTH_PATHS;
-  return {
-    passwordReset: {
-      hmacSecret: args.hmacSecret,
-      appResetUrl: `${args.baseUrl}${paths.resetPassword}`,
-      sendResetEmail: async ({ email, resetUrl, expiresAt }) => {
-        await args.mailSender.send({
-          to: email,
-          ...renderResetPasswordEmail({ resetUrl, expiresAt, locale, appName }),
-        });
-      },
-    },
-    emailVerification: {
-      hmacSecret: args.hmacSecret,
-      ...(args.emailVerificationMode !== undefined && {
-        mode: args.emailVerificationMode,
-      }),
-      appVerifyUrl: `${args.baseUrl}${paths.verifyEmail}`,
-      sendVerificationEmail: async ({ email, verificationUrl, expiresAt }) => {
-        await args.mailSender.send({
-          to: email,
-          ...renderVerifyEmail({ verificationUrl, expiresAt, locale, appName }),
-        });
-      },
-    },
-    signup: {
-      appActivationUrl: `${args.baseUrl}${paths.signupComplete}`,
-      sendActivationEmail: async ({ email, activationUrl, expiresAt }) => {
-        await args.mailSender.send({
-          to: email,
-          ...renderActivationEmail({ activationUrl, expiresAt, locale, appName }),
-        });
-      },
-    },
-    invite: {
-      appAcceptUrl: `${args.baseUrl}${paths.inviteAccept}`,
-      sendInviteEmail: async ({ email, inviteUrl, expiresAt, role }) => {
-        await args.mailSender.send({
-          to: email,
-          ...renderInviteEmail({ inviteUrl, expiresAt, role, locale, appName }),
-        });
-      },
-    },
-  };
-}