@cosmicdrift/kumiko-bundled-features 0.206.0 → 0.208.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.206.0",
+  "version": "0.208.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.206.0",
-    "@cosmicdrift/kumiko-framework": "0.206.0",
-    "@cosmicdrift/kumiko-headless": "0.206.0",
-    "@cosmicdrift/kumiko-renderer": "0.206.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.206.0",
-    "@cosmicdrift/kumiko-types": "0.206.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.208.0",
+    "@cosmicdrift/kumiko-framework": "0.208.0",
+    "@cosmicdrift/kumiko-headless": "0.208.0",
+    "@cosmicdrift/kumiko-renderer": "0.208.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.208.0",
+    "@cosmicdrift/kumiko-types": "0.208.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -159,6 +159,7 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@types/qrcode": "^1.5.5"
+    "@types/qrcode": "^1.5.5",
+    "@cosmicdrift/kumiko-locale-de": "0.208.0"
   }
 }

package/src/admin-shell/__tests__/admin-shell.boot.test.ts

@@ -141,7 +141,7 @@ describe("admin-shell boot + workspace composition", () => {
 
   test("admin-shell registers server translations bundle", () => {
     const shell = createAdminShellFeature();
-    expect(shell.translations?.["admin-shell:nav.tenantOverview"]?.["de"]).toBe("Übersicht");
+    expect(shell.translations?.["admin-shell:nav.tenantOverview"]?.["en"]).toBe("Overview");
     expect(shell.translations?.["screen:tenant-overview.title"]?.["en"]).toBe("Overview");
   });
 });

package/src/admin-shell/i18n.ts

@@ -2,35 +2,32 @@
 // Pure-Data i18n keys for admin-shell (server r.translations + client pivot).
 // Without these keys nav labels and workspace tabs render raw QNs in the shell.
 
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly en: string };
 
 export const ADMIN_SHELL_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:tenant-overview.title": { de: "Übersicht", en: "Overview" },
-  "screen:platform-overview.title": { de: "Übersicht", en: "Overview" },
-  "admin-shell:workspace.tenant": { de: "Administration", en: "Administration" },
-  "admin-shell:workspace.platform": { de: "Plattform", en: "Platform" },
-  "admin-shell:nav.tenantOverview": { de: "Übersicht", en: "Overview" },
-  "admin-shell:nav.platformOverview": { de: "Übersicht", en: "Overview" },
-  "admin-shell:nav.tenants": { de: "Mandanten", en: "Tenants" },
-  "admin-shell:nav.tierAdmin": { de: "Tier zuweisen", en: "Assign tier" },
-  "admin-shell:overview.tenantTitle": { de: "Administration", en: "Administration" },
-  "admin-shell:overview.platformTitle": { de: "Plattform", en: "Platform" },
-  "admin-shell:overview.loading": { de: "Lade…", en: "Loading…" },
+  "screen:tenant-overview.title": { en: "Overview" },
+  "screen:platform-overview.title": { en: "Overview" },
+  "admin-shell:workspace.tenant": { en: "Administration" },
+  "admin-shell:workspace.platform": { en: "Platform" },
+  "admin-shell:nav.tenantOverview": { en: "Overview" },
+  "admin-shell:nav.platformOverview": { en: "Overview" },
+  "admin-shell:nav.tenants": { en: "Tenants" },
+  "admin-shell:nav.tierAdmin": { en: "Assign tier" },
+  "admin-shell:overview.tenantTitle": { en: "Administration" },
+  "admin-shell:overview.platformTitle": { en: "Platform" },
+  "admin-shell:overview.loading": { en: "Loading…" },
   "admin-shell:overview.pendingInvitations": {
-    de: "Ausstehende Einladungen",
     en: "Pending invitations",
   },
-  "admin-shell:overview.members": { de: "Mitglieder", en: "Members" },
+  "admin-shell:overview.members": { en: "Members" },
   "admin-shell:overview.missingConfig": {
-    de: "Fehlende Konfiguration",
     en: "Missing configuration",
   },
   "admin-shell:overview.missingConfigHint": {
-    de: "Pflichtfelder in den Einstellungen prüfen",
     en: "Check required settings",
   },
-  "admin-shell:overview.tenants": { de: "Mandanten", en: "Tenants" },
-  "admin-shell:overview.users": { de: "Benutzer", en: "Users" },
-  "admin-shell:overview.failedJobs": { de: "Fehlgeschlagene Jobs", en: "Failed jobs" },
-  "admin-shell:overview.failedJobsHint": { de: "Job-Runs prüfen", en: "Review job runs" },
+  "admin-shell:overview.tenants": { en: "Tenants" },
+  "admin-shell:overview.users": { en: "Users" },
+  "admin-shell:overview.failedJobs": { en: "Failed jobs" },
+  "admin-shell:overview.failedJobsHint": { en: "Review job runs" },
 };

package/src/admin-shell/web/i18n.ts

@@ -1,16 +1,11 @@
 // @runtime client
 // Client pivot of ADMIN_SHELL_I18N — same keys as server r.translations bundle.
 
-import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import {
+  type TranslationsByLocale,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
 import { ADMIN_SHELL_I18N } from "../i18n";
 
-const LOCALES = ["de", "en"] as const;
-
-export const defaultTranslations: TranslationsByLocale = Object.fromEntries(
-  LOCALES.map((locale) => [
-    locale,
-    Object.fromEntries(
-      Object.entries(ADMIN_SHELL_I18N).map(([key, value]) => [key, value[locale]]),
-    ),
-  ]),
-);
+export const defaultTranslations: TranslationsByLocale =
+  translationsByLocaleFromKeys(ADMIN_SHELL_I18N);

package/src/audit/i18n.ts

@@ -1,31 +1,31 @@
 // @runtime client
 // Server + client i18n for audit (nav labels + AuditLogScreen).
 
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly en: string };
 
 export const AUDIT_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:audit-log.title": { de: "Audit-Log", en: "Audit log" },
-  "screen:audit-log-detail.title": { de: "Ereignis", en: "Event" },
-  "audit:nav.auditLog": { de: "Audit", en: "Audit" },
-  "audit.log.title": { de: "Audit-Log", en: "Audit log" },
-  "audit.log.loading": { de: "Lade Ereignisse…", en: "Loading events…" },
-  "audit.log.empty": { de: "Keine Ereignisse.", en: "No events." },
-  "audit.log.newest": { de: "Neueste", en: "Newest" },
-  "audit.log.older": { de: "Ältere laden", en: "Load older" },
-  "audit.log.col.when": { de: "Zeit", en: "When" },
-  "audit.log.col.type": { de: "Ereignis", en: "Event" },
-  "audit.log.col.aggregate": { de: "Aggregate", en: "Aggregate" },
-  "audit.log.col.actor": { de: "Akteur", en: "Actor" },
-  "audit.log.filter.eventType": { de: "Ereignistyp", en: "Event type" },
-  "audit.log.filter.aggregateType": { de: "Aggregate-Typ", en: "Aggregate type" },
-  "audit.log.filter.from": { de: "Von", en: "From" },
-  "audit.log.filter.to": { de: "Bis", en: "To" },
-  "audit.log.filter.apply": { de: "Filtern", en: "Filter" },
-  "audit.log.filter.reset": { de: "Zurücksetzen", en: "Reset" },
-  "audit.log.details": { de: "Details", en: "Details" },
-  "audit.log.detail.loading": { de: "Lade Ereignis…", en: "Loading event…" },
-  "audit.log.detail.missing": { de: "Ereignis nicht gefunden.", en: "Event not found." },
-  "audit.log.detail.payload": { de: "Ereignis-Payload", en: "Event payload" },
-  "audit.log.detail.metadata": { de: "Metadaten", en: "Metadata" },
-  "audit.log.detail.field.id": { de: "Ereignis-ID", en: "Event ID" },
+  "screen:audit-log.title": { en: "Audit log" },
+  "screen:audit-log-detail.title": { en: "Event" },
+  "audit:nav.auditLog": { en: "Audit" },
+  "audit.log.title": { en: "Audit log" },
+  "audit.log.loading": { en: "Loading events…" },
+  "audit.log.empty": { en: "No events." },
+  "audit.log.newest": { en: "Newest" },
+  "audit.log.older": { en: "Load older" },
+  "audit.log.col.when": { en: "When" },
+  "audit.log.col.type": { en: "Event" },
+  "audit.log.col.aggregate": { en: "Aggregate" },
+  "audit.log.col.actor": { en: "Actor" },
+  "audit.log.filter.eventType": { en: "Event type" },
+  "audit.log.filter.aggregateType": { en: "Aggregate type" },
+  "audit.log.filter.from": { en: "From" },
+  "audit.log.filter.to": { en: "To" },
+  "audit.log.filter.apply": { en: "Filter" },
+  "audit.log.filter.reset": { en: "Reset" },
+  "audit.log.details": { en: "Details" },
+  "audit.log.detail.loading": { en: "Loading event…" },
+  "audit.log.detail.missing": { en: "Event not found." },
+  "audit.log.detail.payload": { en: "Event payload" },
+  "audit.log.detail.metadata": { en: "Metadata" },
+  "audit.log.detail.field.id": { en: "Event ID" },
 };

package/src/audit/web/i18n.ts

@@ -1,12 +1,8 @@
 // @runtime client
-import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import {
+  type TranslationsByLocale,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
 import { AUDIT_I18N } from "../i18n";
 
-const LOCALES = ["de", "en"] as const;
-
-export const defaultTranslations: TranslationsByLocale = Object.fromEntries(
-  LOCALES.map((locale) => [
-    locale,
-    Object.fromEntries(Object.entries(AUDIT_I18N).map(([key, value]) => [key, value[locale]])),
-  ]),
-);
+export const defaultTranslations: TranslationsByLocale = translationsByLocaleFromKeys(AUDIT_I18N);

package/src/auth-email-password/__tests__/email-templates.test.ts

@@ -4,6 +4,8 @@
 // dort. Diese Tests prüfen daher die strukturierte Content, nicht HTML.
 
 import { describe, expect, test } from "bun:test";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
+import { localeDeBundle } from "@cosmicdrift/kumiko-locale-de";
 import type { AuthMailContent } from "../email-templates";
 import { renderResetPasswordEmail, renderVerifyEmail } from "../email-templates";
 
@@ -18,6 +20,8 @@ function textOf(content: AuthMailContent): string {
   return content.sections.map((section) => ("text" in section ? section.text : "")).join(" ");
 }
 
+registerMailTranslations("de", localeDeBundle);
+
 describe("renderResetPasswordEmail", () => {
   const baseArgs = {
     url: "https://acme.example/reset?token=t-abc123",

package/src/auth-email-password/email-templates.ts

@@ -5,33 +5,71 @@
 // renderer; these templates are deliberately plain so the renderer (and the
 // operator reading the mailer log) can rely on them.
 //
-// Locale: de + en. Apps with other languages render themselves.
+// English ships here. Other languages register via @cosmicdrift/kumiko-locale-*
+// (localeDe() / localeEs() call registerMailTranslations).
 
+import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "temporal-polyfill";
 
-export type AuthMailLocale = "de" | "en";
+export type AuthMailLocale = string;
+
+const AUTH_MAIL_EN: Readonly<Record<string, string>> = {
+  "auth.mail.appNameDefault": "Account",
+  "auth.mail.reset.subject": "{app} — Reset your password",
+  "auth.mail.reset.greeting": "Hi,",
+  "auth.mail.reset.intro":
+    "you requested a password reset for {app}. Click the link below to set a new password:",
+  "auth.mail.reset.button": "Reset password",
+  "auth.mail.reset.expiry": "The link expires on {when}.",
+  "auth.mail.reset.ignore":
+    "If you didn't request a reset, you can safely ignore this email — your password won't change.",
+  "auth.mail.verify.subject": "{app} — Verify your email",
+  "auth.mail.verify.greeting": "Welcome,",
+  "auth.mail.verify.intro": "please verify your email address for {app} to activate your account:",
+  "auth.mail.verify.button": "Verify email",
+  "auth.mail.verify.expiry": "The link expires on {when}.",
+  "auth.mail.verify.ignore": "If you didn't create this account, you can ignore this email.",
+  "auth.mail.activation.subject": "{app} — Activate your account",
+  "auth.mail.activation.greeting": "Welcome,",
+  "auth.mail.activation.intro":
+    "click the link below to activate your {app} account. The next step is choosing your password:",
+  "auth.mail.activation.button": "Activate account",
+  "auth.mail.activation.expiry": "The link expires on {when}.",
+  "auth.mail.activation.ignore":
+    "If you didn't sign up, you can ignore this email — no account is created until you open the link.",
+  "auth.mail.invite.subject": "{app} — Workspace invitation",
+  "auth.mail.invite.greeting": "Hi,",
+  "auth.mail.invite.intro":
+    "you've been invited to a {app} workspace as {role}. Click the link below to accept:",
+  "auth.mail.invite.button": "Accept invitation",
+  "auth.mail.invite.expiry": "The link expires on {when}.",
+  "auth.mail.invite.ignore": "If you weren't expecting this invitation, you can ignore this email.",
+  "auth.mail.unlock.subject": "{app} — Unlock your account",
+  "auth.mail.unlock.greeting": "Hi,",
+  "auth.mail.unlock.intro":
+    "your {app} account was temporarily locked after several failed sign-in attempts. Click the link below to unlock it immediately:",
+  "auth.mail.unlock.button": "Unlock account",
+  "auth.mail.unlock.expiry": "The link expires on {when}.",
+  "auth.mail.unlock.ignore":
+    "If you didn't trigger this lock, you can ignore this email — the lock expires on its own.",
+};
+
+registerMailTranslations("en", AUTH_MAIL_EN);
 
-// Unified args for the structured token-mail renderers (reset + verify).
-// `url` is the fully-built magic-link — the handler already appended ?token=.
 export type RenderTokenContentArgs = {
   readonly url: string;
   readonly expiresAt: string;
   readonly locale?: AuthMailLocale;
-  /** Optional: App-Name fürs Subject + Header. Default "Account". */
+  /** Optional app name for subject + intro. Default from auth.mail.appNameDefault. */
   readonly appName?: string;
 };
 
-// Invite adds the role to the unified token-content args; `url` is the fully-
-// built magic-link (the handler already appended ?token=).
 export type RenderInviteEmailArgs = RenderTokenContentArgs & { readonly role: string };
 
 export type AuthMailSection =
   | { readonly text: string }
   | { readonly button: { readonly label: string; readonly url: string } };
 
-// Structured content the magic-link handlers pass as the delivery `data`
-// payload: renderer-simple turns header/sections/footer into HTML, the
-// email-channel reads `subject`. No pre-rendered HTML — the renderer owns layout.
 export type AuthMailContent = {
   readonly subject: string;
   readonly header: string;
@@ -39,95 +77,6 @@ export type AuthMailContent = {
   readonly footer: string;
 };
 
-const STRINGS = {
-  de: {
-    resetSubject: (app: string) => `${app} — Passwort zurücksetzen`,
-    resetGreeting: "Hallo,",
-    // guard:dup-ok — false positive: i18n-String-Template, gleiche Arrow-Struktur wie anonymous fn in collect-table-metas
-    resetIntro: (app: string) =>
-      `du hast den Reset deines Passworts für ${app} angefordert. Klicke auf den folgenden Link, um ein neues Passwort zu setzen:`,
-    resetButton: "Passwort zurücksetzen",
-    resetExpiry: (when: string) => `Der Link läuft am ${when} ab.`,
-    resetIgnore:
-      "Falls du keinen Reset angefordert hast, kannst du diese E-Mail einfach ignorieren — dein Passwort bleibt unverändert.",
-    verifySubject: (app: string) => `${app} — E-Mail bestätigen`,
-    verifyGreeting: "Willkommen,",
-    verifyIntro: (app: string) =>
-      `bitte bestätige deine E-Mail-Adresse für ${app}, um dein Konto zu aktivieren:`,
-    verifyButton: "E-Mail bestätigen",
-    verifyExpiry: (when: string) => `Der Link läuft am ${when} ab.`,
-    verifyIgnore: "Falls du dieses Konto nicht angelegt hast, kannst du diese E-Mail ignorieren.",
-    activationSubject: (app: string) => `${app} — Account aktivieren`,
-    activationGreeting: "Willkommen,",
-    activationIntro: (app: string) =>
-      `klicke auf den folgenden Link, um deinen ${app}-Account zu aktivieren. Im nächsten Schritt setzt du dein Passwort:`,
-    activationButton: "Account aktivieren",
-    activationExpiry: (when: string) => `Der Link läuft am ${when} ab.`,
-    activationIgnore:
-      "Falls du dich nicht registriert hast, kannst du diese E-Mail ignorieren — es wird kein Account erstellt, solange du den Link nicht öffnest.",
-    inviteSubject: (app: string) => `${app} — Einladung zum Workspace`,
-    inviteGreeting: "Hallo,",
-    inviteIntro: (app: string, role: string) =>
-      `du wurdest zu einem ${app}-Workspace als ${role} eingeladen. Klicke auf den folgenden Link, um die Einladung anzunehmen:`,
-    inviteButton: "Einladung annehmen",
-    inviteExpiry: (when: string) => `Der Link läuft am ${when} ab.`,
-    inviteIgnore:
-      "Falls du diese Einladung nicht erwartet hast, kannst du diese E-Mail ignorieren.",
-    unlockSubject: (app: string) => `${app} — Konto entsperren`,
-    unlockGreeting: "Hallo,",
-    unlockIntro: (app: string) =>
-      `dein ${app}-Konto wurde nach mehreren fehlgeschlagenen Anmeldeversuchen vorübergehend gesperrt. Klicke auf den folgenden Link, um es sofort zu entsperren:`,
-    unlockButton: "Konto entsperren",
-    unlockExpiry: (when: string) => `Der Link läuft am ${when} ab.`,
-    unlockIgnore:
-      "Falls du diese Sperre nicht ausgelöst hast, kannst du diese E-Mail ignorieren — die Sperre läuft von selbst ab.",
-  },
-  en: {
-    resetSubject: (app: string) => `${app} — Reset your password`,
-    resetGreeting: "Hi,",
-    resetIntro: (app: string) =>
-      `you requested a password reset for ${app}. Click the link below to set a new password:`,
-    resetButton: "Reset password",
-    resetExpiry: (when: string) => `The link expires on ${when}.`,
-    resetIgnore:
-      "If you didn't request a reset, you can safely ignore this email — your password won't change.",
-    verifySubject: (app: string) => `${app} — Verify your email`,
-    verifyGreeting: "Welcome,",
-    verifyIntro: (app: string) =>
-      `please verify your email address for ${app} to activate your account:`,
-    verifyButton: "Verify email",
-    verifyExpiry: (when: string) => `The link expires on ${when}.`,
-    verifyIgnore: "If you didn't create this account, you can ignore this email.",
-    activationSubject: (app: string) => `${app} — Activate your account`,
-    activationGreeting: "Welcome,",
-    activationIntro: (app: string) =>
-      `click the link below to activate your ${app} account. The next step is choosing your password:`,
-    activationButton: "Activate account",
-    activationExpiry: (when: string) => `The link expires on ${when}.`,
-    activationIgnore:
-      "If you didn't sign up, you can ignore this email — no account is created until you open the link.",
-    inviteSubject: (app: string) => `${app} — Workspace invitation`,
-    inviteGreeting: "Hi,",
-    inviteIntro: (app: string, role: string) =>
-      `you've been invited to a ${app} workspace as ${role}. Click the link below to accept:`,
-    inviteButton: "Accept invitation",
-    inviteExpiry: (when: string) => `The link expires on ${when}.`,
-    inviteIgnore: "If you weren't expecting this invitation, you can ignore this email.",
-    unlockSubject: (app: string) => `${app} — Unlock your account`,
-    unlockGreeting: "Hi,",
-    unlockIntro: (app: string) =>
-      `your ${app} account was temporarily locked after several failed sign-in attempts. Click the link below to unlock it immediately:`,
-    unlockButton: "Unlock account",
-    unlockExpiry: (when: string) => `The link expires on ${when}.`,
-    unlockIgnore:
-      "If you didn't trigger this lock, you can ignore this email — the lock expires on its own.",
-  },
-} as const;
-
-// Structured content for the delivery path. header = action title (CTA label),
-// sections = greeting/intro/button/expiry, footer = the "ignore if not you"
-// reassurance. The old plain-text fallback-URL link drops out — renderer-simple
-// has no link-text section and the button carries the URL.
 function tokenMailContent(spec: {
   readonly subject: string;
   readonly header: string;
@@ -151,91 +100,90 @@ function tokenMailContent(spec: {
   };
 }
 
+function t(locale: string, key: string, params?: Readonly<Record<string, string>>): string {
+  return mailT(locale, key, params);
+}
+
+function appNameFor(args: RenderTokenContentArgs): string {
+  const locale = args.locale ?? "en";
+  return args.appName ?? t(locale, "auth.mail.appNameDefault");
+}
+
 export function renderResetPasswordEmail(args: RenderTokenContentArgs): AuthMailContent {
   const locale = args.locale ?? "en";
-  const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");
-  const t = STRINGS[locale];
+  const app = appNameFor(args);
   return tokenMailContent({
-    subject: t.resetSubject(appName),
-    header: t.resetButton,
-    greeting: t.resetGreeting,
-    intro: t.resetIntro(appName),
-    buttonLabel: t.resetButton,
+    subject: t(locale, "auth.mail.reset.subject", { app }),
+    header: t(locale, "auth.mail.reset.button"),
+    greeting: t(locale, "auth.mail.reset.greeting"),
+    intro: t(locale, "auth.mail.reset.intro", { app }),
+    buttonLabel: t(locale, "auth.mail.reset.button"),
     buttonUrl: args.url,
-    expiry: t.resetExpiry(formatExpiry(args.expiresAt)),
-    ignore: t.resetIgnore,
+    expiry: t(locale, "auth.mail.reset.expiry", { when: formatExpiry(args.expiresAt) }),
+    ignore: t(locale, "auth.mail.reset.ignore"),
   });
 }
 
 export function renderUnlockAccountEmail(args: RenderTokenContentArgs): AuthMailContent {
   const locale = args.locale ?? "en";
-  const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");
-  const t = STRINGS[locale];
+  const app = appNameFor(args);
   return tokenMailContent({
-    subject: t.unlockSubject(appName),
-    header: t.unlockButton,
-    greeting: t.unlockGreeting,
-    intro: t.unlockIntro(appName),
-    buttonLabel: t.unlockButton,
+    subject: t(locale, "auth.mail.unlock.subject", { app }),
+    header: t(locale, "auth.mail.unlock.button"),
+    greeting: t(locale, "auth.mail.unlock.greeting"),
+    intro: t(locale, "auth.mail.unlock.intro", { app }),
+    buttonLabel: t(locale, "auth.mail.unlock.button"),
     buttonUrl: args.url,
-    expiry: t.unlockExpiry(formatExpiry(args.expiresAt)),
-    ignore: t.unlockIgnore,
+    expiry: t(locale, "auth.mail.unlock.expiry", { when: formatExpiry(args.expiresAt) }),
+    ignore: t(locale, "auth.mail.unlock.ignore"),
   });
 }
 
 export function renderVerifyEmail(args: RenderTokenContentArgs): AuthMailContent {
   const locale = args.locale ?? "en";
-  const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");
-  const t = STRINGS[locale];
+  const app = appNameFor(args);
   return tokenMailContent({
-    subject: t.verifySubject(appName),
-    header: t.verifyButton,
-    greeting: t.verifyGreeting,
-    intro: t.verifyIntro(appName),
-    buttonLabel: t.verifyButton,
+    subject: t(locale, "auth.mail.verify.subject", { app }),
+    header: t(locale, "auth.mail.verify.button"),
+    greeting: t(locale, "auth.mail.verify.greeting"),
+    intro: t(locale, "auth.mail.verify.intro", { app }),
+    buttonLabel: t(locale, "auth.mail.verify.button"),
     buttonUrl: args.url,
-    expiry: t.verifyExpiry(formatExpiry(args.expiresAt)),
-    ignore: t.verifyIgnore,
+    expiry: t(locale, "auth.mail.verify.expiry", { when: formatExpiry(args.expiresAt) }),
+    ignore: t(locale, "auth.mail.verify.ignore"),
   });
 }
 
 export function renderActivationEmail(args: RenderTokenContentArgs): AuthMailContent {
   const locale = args.locale ?? "en";
-  const appName = args.appName ?? (locale === "de" ? "Konto" : "Account");
-  const t = STRINGS[locale];
+  const app = appNameFor(args);
   return tokenMailContent({
-    subject: t.activationSubject(appName),
-    header: t.activationButton,
-    greeting: t.activationGreeting,
-    intro: t.activationIntro(appName),
-    buttonLabel: t.activationButton,
+    subject: t(locale, "auth.mail.activation.subject", { app }),
+    header: t(locale, "auth.mail.activation.button"),
+    greeting: t(locale, "auth.mail.activation.greeting"),
+    intro: t(locale, "auth.mail.activation.intro", { app }),
+    buttonLabel: t(locale, "auth.mail.activation.button"),
     buttonUrl: args.url,
-    expiry: t.activationExpiry(formatExpiry(args.expiresAt)),
-    ignore: t.activationIgnore,
+    expiry: t(locale, "auth.mail.activation.expiry", { when: formatExpiry(args.expiresAt) }),
+    ignore: t(locale, "auth.mail.activation.ignore"),
   });
 }
 
 export function renderInviteEmail(args: RenderInviteEmailArgs): AuthMailContent {
   const locale = args.locale ?? "en";
-  const appName = args.appName ?? "Workspace";
-  const t = STRINGS[locale];
+  const app = args.appName ?? "Workspace";
   return tokenMailContent({
-    subject: t.inviteSubject(appName),
-    header: t.inviteButton,
-    greeting: t.inviteGreeting,
-    intro: t.inviteIntro(appName, args.role),
-    buttonLabel: t.inviteButton,
+    subject: t(locale, "auth.mail.invite.subject", { app }),
+    header: t(locale, "auth.mail.invite.button"),
+    greeting: t(locale, "auth.mail.invite.greeting"),
+    intro: t(locale, "auth.mail.invite.intro", { app, role: args.role }),
+    buttonLabel: t(locale, "auth.mail.invite.button"),
     buttonUrl: args.url,
-    expiry: t.inviteExpiry(formatExpiry(args.expiresAt)),
-    ignore: t.inviteIgnore,
+    expiry: t(locale, "auth.mail.invite.expiry", { when: formatExpiry(args.expiresAt) }),
+    ignore: t(locale, "auth.mail.invite.ignore"),
   });
 }
 
-// ISO-Timestamp aus dem Token-Handler ("2026-05-04T13:45:00.000Z") in
-// "2026-05-04 13:45 UTC" rendern. Locale-unabhängig damit der Mail-
-// Renderer keine locale-spezifischen Number-Formatter mitschleppt; UTC-
-// Suffix damit der User unabhängig von seiner Tz sieht wann der Link
-// abläuft. Bei un-parsbarem Input fällt's auf den raw-string zurück.
 function formatExpiry(iso: string): string {
   try {
     const z = Temporal.Instant.from(iso).toZonedDateTimeISO("UTC");