@cosmicdrift/kumiko-bundled-features 0.320.0 → 0.322.0

package/src/channel-email/__tests__/email-channel.test.ts

@@ -100,3 +100,95 @@ describe("email channel envelope", () => {
     expect(sent.headers).toBeUndefined();
   });
 });
+
+describe("email channel List-Unsubscribe headers", () => {
+  test("unsubscribeUrl on the framework route sets both headers", async () => {
+    const transport = createInMemoryTransport();
+    const unsubscribeUrl = "https://app.example/api/delivery/unsubscribe?token=abc";
+    const message: ChannelMessage = {
+      notificationType: "x",
+      title: "t",
+      body: "b",
+      data: { subject: "t", body: "b", unsubscribeUrl },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.headers).toEqual({
+      "List-Unsubscribe": `<${unsubscribeUrl}>`,
+      "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
+    });
+  });
+
+  test("unsubscribeUrl on a foreign path sets no headers", async () => {
+    const transport = createInMemoryTransport();
+    const message: ChannelMessage = {
+      notificationType: "x",
+      title: "t",
+      body: "b",
+      data: {
+        subject: "t",
+        body: "b",
+        unsubscribeUrl: "https://app.example/subscribe/unsubscribe?token=abc",
+      },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.headers).toBeUndefined();
+  });
+
+  test("an unparseable unsubscribeUrl sets no headers", async () => {
+    const transport = createInMemoryTransport();
+    const message: ChannelMessage = {
+      notificationType: "x",
+      title: "t",
+      body: "b",
+      data: { subject: "t", body: "b", unsubscribeUrl: "not a url" },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.headers).toBeUndefined();
+  });
+
+  test("no unsubscribeUrl sets no headers", async () => {
+    const transport = createInMemoryTransport();
+    const message: ChannelMessage = {
+      notificationType: "x",
+      title: "t",
+      body: "b",
+      data: { subject: "t", body: "b" },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.headers).toBeUndefined();
+  });
+
+  test('an explicit data.headers["List-Unsubscribe"] wins over the auto header', async () => {
+    const transport = createInMemoryTransport();
+    const unsubscribeUrl = "https://app.example/api/delivery/unsubscribe?token=abc";
+    const message: ChannelMessage = {
+      notificationType: "x",
+      title: "t",
+      body: "b",
+      data: {
+        subject: "t",
+        body: "b",
+        unsubscribeUrl,
+        headers: { "List-Unsubscribe": "<mailto:override@example.com>" },
+      },
+    };
+    await channelWith(transport).send("mieter@example.com", message, ctx, rendered);
+
+    const [sent] = transport.sent;
+    if (!sent) throw new Error("expected a sent mail");
+    expect(sent.headers?.["List-Unsubscribe"]).toBe("<mailto:override@example.com>");
+    expect(sent.headers?.["List-Unsubscribe-Post"]).toBe("List-Unsubscribe=One-Click");
+  });
+});

package/src/channel-email/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.321.0",
+    "type": "improvement",
+    "title": "Automatic List-Unsubscribe / List-Unsubscribe-Post headers for messages that carry a framework unsubscribeUrl",
+    "detail": "`createEmailChannel`'s `send()` now sets `List-Unsubscribe: <url>` and\n`List-Unsubscribe-Post: List-Unsubscribe=One-Click` whenever the\nnotification's `data.unsubscribeUrl` is an `http(s)` URL whose path is\nthe delivery feature's `DELIVERY_UNSUBSCRIBE_PATH` — only that route can\nhonor a one-click POST. An explicit `data.headers[\"List-Unsubscribe\"]`\n(or `-Post`) still wins over the automatic value. Apps whose\n`unsubscribeUrl` points somewhere else (their own page, a foreign path)\nget no automatic headers.",
+    "migration": "No action needed for apps already using the framework's unsubscribe\nroute via `data.unsubscribeUrl`. Apps with a GET-only unsubscribe page of\ntheir own keep getting no `List-Unsubscribe-Post` header, since a\none-click POST there would 404 or no-op."
+  }
+]

package/src/channel-email/email-channel.ts

@@ -1,10 +1,12 @@
 import type { DbRow } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type {
-  ChannelMessage,
-  DeliveryChannel,
-  NotificationRenderer,
-  RenderedMessage,
+import {
+  type ChannelMessage,
+  DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
+  DELIVERY_UNSUBSCRIBE_PATH,
+  type DeliveryChannel,
+  type NotificationRenderer,
+  type RenderedMessage,
 } from "../delivery";
 import { guardEmailMessage } from "./pii-guard";
 import type { EmailTransport } from "./types";
@@ -24,6 +26,26 @@ function stringHeaders(raw: unknown): Readonly<Record<string, string>> | undefin
   return Object.keys(out).length > 0 ? out : undefined;
 }
 
+// Only the framework's own unsubscribe route can honor a one-click POST.
+function listUnsubscribeHeaders(
+  data: Readonly<Record<string, unknown>> | undefined,
+): Readonly<Record<string, string>> | undefined {
+  const rawUrl = data?.["unsubscribeUrl"];
+  if (typeof rawUrl !== "string") return undefined;
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return undefined;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return undefined;
+  if (url.pathname !== DELIVERY_UNSUBSCRIBE_PATH) return undefined;
+  return {
+    "List-Unsubscribe": `<${url.toString()}>`,
+    "List-Unsubscribe-Post": DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
+  };
+}
+
 function emailEnvelopeFrom(data: Readonly<Record<string, unknown>> | undefined): {
   from?: string;
   replyTo?: string;
@@ -32,7 +54,10 @@ function emailEnvelopeFrom(data: Readonly<Record<string, unknown>> | undefined):
   if (!data) return {};
   const from = typeof data["from"] === "string" ? data["from"] : undefined;
   const replyTo = typeof data["replyTo"] === "string" ? data["replyTo"] : undefined;
-  const headers = stringHeaders(data["headers"]);
+  const autoHeaders = listUnsubscribeHeaders(data);
+  const explicitHeaders = stringHeaders(data["headers"]);
+  const headers =
+    autoHeaders || explicitHeaders ? { ...autoHeaders, ...explicitHeaders } : undefined;
   return { ...(from && { from }), ...(replyTo && { replyTo }), ...(headers && { headers }) };
 }
 

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -28,6 +28,7 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
+import { assertIrreversibleOperationAllowed } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -267,7 +268,7 @@ export const forgetSubjectWrite = defineWriteHandler({
     "Irreversibly crypto-shreds one user, tenant or record subject by erasing its encryption key, nulling its blind indexes, purging its search documents and closing the user's login, for supervisory-authority requests and operator recovery outside the automated Art. 17 cleanup pipeline.",
   // Erasing the subject key is irreversible: there is no undo, so an agent must
   // not be able to reach it at all.
-  agent: { expose: false },
+  agent: { expose: false, risk: "high" },
   escapeHatch: {
     reason:
       "denial audit append names the prober's own tenant stream on the outside-transaction db; " +
@@ -276,6 +277,7 @@ export const forgetSubjectWrite = defineWriteHandler({
       "lifecycle update and PAT revoke run on the SYSTEM user stream.",
   },
   handler: async (event, ctx) => {
+    assertIrreversibleOperationAllowed("forget-subject key erase");
     const kms = configuredPiiSubjectKms();
     if (!kms) {
       return writeFailure(

package/src/delivery/__tests__/delivery.integration.test.ts

@@ -64,7 +64,7 @@ import {
 import { createDeliveryTestContext } from "../testing";
 import type { DeliveryService } from "../types";
 import {
-  createUnsubscribeRoute,
+  createUnsubscribeRoutes,
   signAddressUnsubscribeToken,
   signUnsubscribeToken,
 } from "../unsubscribe";
@@ -76,6 +76,16 @@ let db: DbConnection;
 let deliveryService: DeliveryService;
 const UNSUBSCRIBE_SECRET = "test-stack-unsubscribe-secret-32-chars-min!!";
 
+// Mirrors a confirmation-page form submit / RFC-8058 one-click POST: token in
+// a form-urlencoded body, same encoding both senders use.
+function postUnsubscribe(token: string) {
+  return stack.app.request(DELIVERY_UNSUBSCRIBE_PATH, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: `token=${encodeURIComponent(token)}`,
+  });
+}
+
 // Email test infrastructure
 const emailTransport = createInMemoryTransport();
 const testEmail = (userId: string | number) => `user-${userId}@test.com`;
@@ -373,7 +383,7 @@ beforeAll(async () => {
       deliveryService = ctx.deliveryService;
       return ctx;
     },
-    extraRoutes: [createUnsubscribeRoute({ secret: UNSUBSCRIBE_SECRET })],
+    extraRoutes: [...createUnsubscribeRoutes({ secret: UNSUBSCRIBE_SECRET })],
   });
   db = stack.db;
 
@@ -793,7 +803,7 @@ describe("flow 6: user preferences", () => {
 // --- Flow 7: Unsubscribe endpoint ---
 
 describe("flow 7: unsubscribe endpoint", () => {
-  test("signed unsubscribe token disables preference", async () => {
+  test("GET renders a confirmation page and writes nothing", async () => {
     const token = await signUnsubscribeToken(
       {
         userId: user2.id,
@@ -806,10 +816,37 @@ describe("flow 7: unsubscribe endpoint", () => {
 
     const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`);
     expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("<form");
+    expect(html).toContain('method="post"');
+
+    const prefs = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      DeliveryQueries.preferences,
+      {},
+      user2,
+    );
+    const pref = prefs.rows.find(
+      (r) => r["notificationType"] === "app:notify:announcement" && r["channel"] === "inApp",
+    );
+    expect(pref).toBeUndefined();
+  });
+
+  test("POST with a form-urlencoded body disables the preference", async () => {
+    const token = await signUnsubscribeToken(
+      {
+        userId: user2.id,
+        tenantId: user2.tenantId,
+        notificationType: "app:notify:announcement",
+        channel: "inApp",
+      },
+      UNSUBSCRIBE_SECRET,
+    );
+
+    const res = await postUnsubscribe(token);
+    expect(res.status).toBe(200);
     const text = await res.text();
     expect(text).toContain("unsubscribed");
 
-    // Verify preference was created
     const prefs = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
       DeliveryQueries.preferences,
       {},
@@ -822,6 +859,36 @@ describe("flow 7: unsubscribe endpoint", () => {
     expect(pref?.["enabled"]).toBe(false);
   });
 
+  test("RFC 8058 one-click POST (token in query, List-Unsubscribe=One-Click body) disables the preference", async () => {
+    const token = await signUnsubscribeToken(
+      {
+        userId: user2.id,
+        tenantId: user2.tenantId,
+        notificationType: "app:notify:one-click",
+        channel: "inApp",
+      },
+      UNSUBSCRIBE_SECRET,
+    );
+
+    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: "List-Unsubscribe=One-Click",
+    });
+    expect(res.status).toBe(200);
+
+    const prefs = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      DeliveryQueries.preferences,
+      {},
+      user2,
+    );
+    const pref = prefs.rows.find(
+      (r) => r["notificationType"] === "app:notify:one-click" && r["channel"] === "inApp",
+    );
+    expect(pref).toBeDefined();
+    expect(pref?.["enabled"]).toBe(false);
+  });
+
   test("preference row belongs to the token's userId, not the dispatching system user", async () => {
     const token = await signUnsubscribeToken(
       {
@@ -833,7 +900,7 @@ describe("flow 7: unsubscribe endpoint", () => {
       UNSUBSCRIBE_SECRET,
     );
 
-    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`);
+    const res = await postUnsubscribe(token);
     expect(res.status).toBe(200);
 
     const rows = await selectMany(db, notificationPreferencesTable, {
@@ -845,14 +912,24 @@ describe("flow 7: unsubscribe endpoint", () => {
     expect(rows[0]?.["enabled"]).toBe(false);
   });
 
-  test("invalid token returns 400", async () => {
-    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=invalid-jwt-token`);
-    expect(res.status).toBe(400);
+  test("invalid token returns 400 for both GET and POST", async () => {
+    const getRes = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=invalid-jwt-token`);
+    expect(getRes.status).toBe(400);
+    const getBody = (await getRes.json()) as { error?: { code?: string } };
+    expect(getBody.error?.code).toBe("unsubscribe_token_invalid");
+
+    const postRes = await postUnsubscribe("invalid-jwt-token");
+    expect(postRes.status).toBe(400);
+    const postBody = (await postRes.json()) as { error?: { code?: string } };
+    expect(postBody.error?.code).toBe("unsubscribe_token_invalid");
   });
 
-  test("missing token returns 400", async () => {
-    const res = await stack.app.request(DELIVERY_UNSUBSCRIBE_PATH);
-    expect(res.status).toBe(400);
+  test("missing token returns 400 for both GET and POST", async () => {
+    const getRes = await stack.app.request(DELIVERY_UNSUBSCRIBE_PATH);
+    expect(getRes.status).toBe(400);
+
+    const postRes = await stack.app.request(DELIVERY_UNSUBSCRIBE_PATH, { method: "POST" });
+    expect(postRes.status).toBe(400);
   });
 
   test("normal user cannot dispatch the unsubscribe write handlers directly", async () => {
@@ -895,7 +972,7 @@ describe("flow 7: unsubscribe endpoint", () => {
       .setIssuedAt()
       .sign(new TextEncoder().encode(UNSUBSCRIBE_SECRET));
 
-    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${tamperedIssuer}`);
+    const res = await postUnsubscribe(tamperedIssuer);
     expect(res.status).toBe(400);
     const body = (await res.json()) as { error?: { code?: string; message?: string } };
     expect(body.error?.code).toBe("unsubscribe_token_invalid");
@@ -912,7 +989,7 @@ describe("flow 7: unsubscribe endpoint", () => {
 
   test("a real stack session JWT is rejected at the unsubscribe route", async () => {
     const sessionToken = await stack.jwt.sign(user1);
-    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${sessionToken}`);
+    const res = await postUnsubscribe(sessionToken);
     expect(res.status).toBe(400);
     const body = (await res.json()) as { error?: { code?: string } };
     expect(body.error?.code).toBe("unsubscribe_token_invalid");
@@ -1573,11 +1650,10 @@ describe("flow 16: repeated unsubscribe clicks are idempotent", () => {
       UNSUBSCRIBE_SECRET,
     );
 
-    const url = `${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`;
     const results = await Promise.all([
-      stack.app.request(url),
-      stack.app.request(url),
-      stack.app.request(url),
+      postUnsubscribe(token),
+      postUnsubscribe(token),
+      postUnsubscribe(token),
     ]);
 
     // All three requests complete with 200 — no duplicate-key crashes
@@ -1964,12 +2040,12 @@ describe("flow 19: address unsubscribe (route-based sends, no user account)", ()
       },
       UNSUBSCRIBE_SECRET,
     );
-    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`);
+    const res = await postUnsubscribe(token);
     expect(res.status).toBe(200);
     expect(await res.text()).toContain("unsubscribed");
 
     // Clicking twice must stay a no-op (one row, no crash).
-    const res2 = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`);
+    const res2 = await postUnsubscribe(token);
     expect(res2.status).toBe(200);
     const optOutRows = await selectMany(db, notificationAddressOptOutsTable, {
       notificationType: "app:notify:address-unsub-19a",
@@ -2035,7 +2111,7 @@ describe("flow 19: address unsubscribe (route-based sends, no user account)", ()
       FOREIGN_JWT_SECRET,
     );
 
-    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${forgedToken}`);
+    const res = await postUnsubscribe(forgedToken);
     expect(res.status).toBe(400);
 
     const rows = await selectMany(db, notificationAddressOptOutsTable, {
@@ -2077,7 +2153,7 @@ describe("flow 19: address unsubscribe (route-based sends, no user account)", ()
       },
       UNSUBSCRIBE_SECRET,
     );
-    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`);
+    const res = await postUnsubscribe(token);
     expect(res.status).toBe(200);
 
     await deliveryService.notify(
@@ -2125,7 +2201,7 @@ describe("flow 19: address unsubscribe (route-based sends, no user account)", ()
       { tenantId: user1.tenantId, address, notificationType, channel: "email" },
       UNSUBSCRIBE_SECRET,
     );
-    const res = await stack.app.request(`${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`);
+    const res = await postUnsubscribe(token);
     expect(res.status).toBe(200);
 
     emailTransport.sent.length = 0;
@@ -2175,11 +2251,10 @@ describe("flow 19: address unsubscribe (route-based sends, no user account)", ()
       UNSUBSCRIBE_SECRET,
     );
 
-    const url = `${DELIVERY_UNSUBSCRIBE_PATH}?token=${token}`;
     const results = await Promise.all([
-      stack.app.request(url),
-      stack.app.request(url),
-      stack.app.request(url),
+      postUnsubscribe(token),
+      postUnsubscribe(token),
+      postUnsubscribe(token),
     ]);
 
     for (const res of results) {

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.321.0",
+    "type": "breaking",
+    "title": "Unsubscribe route splits into a non-writing GET confirmation page and a writing POST (RFC 8058)",
+    "detail": "`createUnsubscribeRoute({ secret })`, which mounted a single `GET` route\nthat wrote the opt-out as a side effect of the request, is replaced by\n`createUnsubscribeRoutes({ secret })`, which returns both routes for the\nsame path: `GET` renders a confirmation page (`<form method=\"post\">`) and\nperforms no write; `POST` performs the write, reading the token from a\nform-urlencoded body first, then the query string as a fallback (so an\nRFC-8058 one-click client that POSTs `token=` only in the URL still works).\nToken verification and error mapping (`400 unsubscribe_token_invalid`) are\nunchanged and shared between both routes.",
+    "migration": "Replace `extraRoutes: [createUnsubscribeRoute({ secret })]` with\n`extraRoutes: [...createUnsubscribeRoutes({ secret })]`.\n\nUnsubscribe links already mailed out before this upgrade now show a\nconfirmation page on click instead of unsubscribing immediately — the\nrecipient must submit the form (or a one-click mail client must POST) to\ncomplete the opt-out. If the app rendered its own confirmation page in\nfront of the old GET link, it can be removed; the framework route now\ncovers that step."
+  },
   {
     "version": "0.315.0",
     "type": "fix",

package/src/delivery/feature.ts

@@ -44,7 +44,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
   const resolvedAccess = options?.access ?? access.admin;
   return defineFeature("delivery", (r) => {
     r.describe(
-      "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe links are served by `createUnsubscribeRoute({ secret })` mounted via the app's `extraRoutes` at `GET /api/delivery/unsubscribe?token=`; sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret.",
+      "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe`: `GET ?token=` renders a confirmation page (no write), `POST` performs the opt-out (RFC 8058 one-click, token from the form body or query) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at this route.",
     );
     r.uiHints({
       displayLabel: "Notifications \u00b7 Dispatch Core",

package/src/delivery/handlers/unsubscribe-address.write.ts

@@ -11,7 +11,7 @@ export const unsubscribeAddressWrite = defineWriteHandler({
     channel: z.string().min(1),
   }),
   access: { roles: access.systemAdmin },
-  // Only reachable via createUnsubscribeRoute's dispatchSystemWrite, once
+  // Only reachable via createUnsubscribeRoutes' POST dispatchSystemWrite, once
   // verify() has already proven the address-token signature — not a surface
   // for the agent tool-picker to offer a user directly.
   agent: { expose: false },

package/src/delivery/handlers/unsubscribe-user.write.ts

@@ -11,7 +11,7 @@ export const unsubscribeUserWrite = defineWriteHandler({
     channel: z.string().min(1),
   }),
   access: { roles: access.systemAdmin },
-  // Only reachable via createUnsubscribeRoute's dispatchSystemWrite, once
+  // Only reachable via createUnsubscribeRoutes' POST dispatchSystemWrite, once
   // verify() has already proven the user-token signature — not a surface for
   // the agent tool-picker to offer a user directly.
   agent: { expose: false },

package/src/delivery/index.ts

@@ -43,7 +43,8 @@ export {
 } from "./types";
 export {
   type AddressUnsubscribeTokenPayload,
-  createUnsubscribeRoute,
+  createUnsubscribeRoutes,
+  DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
   signAddressUnsubscribeToken,
   signUnsubscribeToken,
   type UnsubscribeRouteOptions,

package/src/delivery/public-names.ts

@@ -10,7 +10,7 @@ export const DeliveryHandlers = {
 } as const;
 
 // Fixed so links mailed out today keep working — the unsubscribe route is
-// mounted at this exact path via `extraRoutes: [createUnsubscribeRoute(...)]`.
+// mounted at this exact path via `extraRoutes: [...createUnsubscribeRoutes(...)]`.
 export const DELIVERY_UNSUBSCRIBE_PATH = "/api/delivery/unsubscribe" as const;
 
 export const DeliveryQueries = {