@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/dist/admin-shell/feature.d.ts

@@ -12,6 +12,9 @@ export type CreateAdminShellOptions = {
      *  Requires cap-overview mounted. Default false — apps that don't mount cap-overview
      *  must not get a nav entry pointing at a screen that doesn't exist. */
     readonly includeCapOverview?: boolean;
+    /** Tenant nav → document-designer:nav:templates, platform nav → document-designer:nav:platform-templates.
+     *  Requires document-designer mounted (a separate package, so no import here). Default false. */
+    readonly includeDocumentDesigner?: boolean;
     /** When false, only overview screens + nav are registered — app owns r.workspace(). Default true. */
     readonly registerWorkspaces?: boolean;
     /** Metric list the overview panels are built from — pass the SAME list to

package/dist/admin-shell/feature.js

@@ -11,10 +11,11 @@ export function createAdminShellFeature(options = {}) {
     const platformWsId = options.workspaceIds?.platform ?? DEFAULT_PLATFORM_WORKSPACE_ID;
     const includeTierAdmin = options.includeTierAdmin ?? true;
     const includeCapOverview = options.includeCapOverview ?? false;
+    const includeDocumentDesigner = options.includeDocumentDesigner ?? false;
     const registerWorkspaces = options.registerWorkspaces ?? true;
     const metrics = options.metrics ?? DEFAULT_METRICS;
     return defineFeature(ADMIN_SHELL_FEATURE, (r) => {
-        r.describe("Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.");
+        r.describe("Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.");
         r.uiHints({
             displayLabel: "Admin Shell",
             category: "operations",
@@ -30,18 +31,22 @@ export function createAdminShellFeature(options = {}) {
             r.requires("tier-engine");
         if (includeCapOverview)
             r.requires("cap-overview");
+        if (includeDocumentDesigner)
+            r.requires("document-designer");
         r.translations({ keys: ADMIN_SHELL_I18N });
         const tenantNav = [
             "admin-shell:nav:tenant-overview",
             "tenant:nav:members",
             "audit:nav:audit-log",
             ...(includeCapOverview ? ["admin-shell:nav:my-caps"] : []),
+            ...(includeDocumentDesigner ? ["document-designer:nav:templates"] : []),
         ];
         const platformNav = [
             "admin-shell:nav:platform-overview",
             "admin-shell:nav:tenants",
             ...(includeCapOverview ? ["admin-shell:nav:tenant-caps"] : []),
             "jobs:nav:job-runs",
+            ...(includeDocumentDesigner ? ["document-designer:nav:platform-templates"] : []),
             ...(includeTierAdmin ? ["admin-shell:nav:tier-admin"] : []),
         ];
         r.screen({

package/dist/agent-tools/agent-manifest.js

@@ -1,5 +1,6 @@
 import { hasAccess, isAgentVisibleScreen, resolveAgentExposure, SYSTEM_ONLY_JSON_SCHEMA_KEY, } from "@cosmicdrift/kumiko-framework/engine";
 import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { recordManifestDenyQns } from "./manifest-deny-qns.js";
 /** The manifest surfaces one string per locale — a plural entry reads as its
@@ -124,7 +125,7 @@ export function systemOnlyPropertyNames(jsonSchema) {
     if (typeof properties !== "object" || properties === null)
         return [];
     return Object.entries(properties)
-        .filter(([, property]) => property[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true)
+        .filter(([, property]) => isPlainObject(property) && property[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true)
         .map(([name]) => name);
 }
 function withoutSystemOnlyProperties(jsonSchema) {

package/dist/agent-tools/filter-ops.d.ts

@@ -1,2 +1,2 @@
 export declare const FILTER_OPS: readonly ["eq", "ne", "lt", "gt", "lte", "gte", "in"];
-export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export { isPlainObject as isRecord } from "@cosmicdrift/kumiko-types/type-guards";

package/dist/agent-tools/filter-ops.js

@@ -1,4 +1,2 @@
 export const FILTER_OPS = ["eq", "ne", "lt", "gt", "lte", "gte", "in"];
-export function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
+export { isPlainObject as isRecord } from "@cosmicdrift/kumiko-types/type-guards";

package/dist/agent-tools/tool-dispatch.js

@@ -1,10 +1,11 @@
 import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
 const SEARCH_RESULT_LIMIT = 10;
 const DEFAULT_LIST_LIMIT = 10;
 const MAX_LIST_LIMIT = 200;
 function isFilterOp(value) {
-    return typeof value === "string" && FILTER_OPS.includes(value);
+    return isOneOf(FILTER_OPS, value);
 }
 function buildSearchPayload(toolName, toolInput) {
     const query = toolInput["query"];

package/dist/audit/handlers/list.query.js

@@ -88,11 +88,15 @@ export const listQuery = defineQueryHandler({
             aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
         }, direction);
         const rows = await selectMany(ctx.db, eventsTable, where, {
-            // `id` as tie-breaker keeps the order total, so pages never overlap.
-            orderBy: [
-                { col: p.sort === "type" ? "type" : "createdAt", direction },
-                { col: "id", direction },
-            ],
+            // The id cursor only resumes an id-ordered listing. created_at comes from the
+            // transaction start and can run against insert order, so ordering by it would let
+            // a page boundary skip rows; only the type sort leaves id order (and is one page).
+            orderBy: p.sort === "type"
+                ? [
+                    { col: "type", direction },
+                    { col: "id", direction },
+                ]
+                : [{ col: "id", direction }],
             limit: p.limit,
         });
         const serialised = rows.map((r) => ({

package/dist/auth-email-password/bootstrap.d.ts

@@ -1,7 +1,8 @@
-import { makeDispatchSystemWrite, type SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, type RoleDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import { type Registry, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import type { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
 type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
@@ -18,9 +19,7 @@ export type BootstrapSeedDeps = {
     /** Writes as the system user with the given tenant roles in the seeded
      *  tenant; use it when the app gates tenant data on its own roles rather
      *  than SystemAdmin. */
-    readonly dispatchWriteAs: (args: Pick<SystemDispatchArgs, "handlerQn" | "payload"> & {
-        readonly roles: readonly string[];
-    }) => Promise<WriteResult>;
+    readonly dispatchWriteAs: (args: Omit<RoleDispatchArgs, "tenantId">) => Promise<WriteResult>;
 };
 export type BootstrapConfigValue = string | number | boolean;
 export type BootstrapTenant = {
@@ -54,6 +53,10 @@ export type BootstrapDeps = {
     readonly db: DbConnection;
     readonly redis: Redis;
     readonly dispatcher: Dispatcher;
+    /** With these, a rerun can compare `encrypted`/`piiEncrypted` config keys by
+     *  their decrypted value; without them such keys are rewritten on every run. */
+    readonly registry?: Registry;
+    readonly configCipher?: EnvelopeCipher;
 };
 export type BootstrapTenantOutcome = "created" | "exists";
 export type BootstrapInviteOutcome = "invited" | "resent" | "pending" | "active" | "cancelled" | "role-mismatch";

package/dist/auth-email-password/bootstrap.js

@@ -4,14 +4,14 @@
 // exactly as for any other writer. Nobody gets a role before accepting: the
 // invitation row holds membership role + global roles until the invitee
 // accepts through the regular invite-accept routes.
-import { makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, makeDispatchWriteAs, } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
 import { ConfigHandlers } from "../config/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap compares against the stored config row to stay idempotent
-import { findConfigRow } from "../config/write-helpers.js";
+import { configRowHoldsValue, findConfigRow } from "../config/write-helpers.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
 import { TenantHandlers } from "../tenant/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
@@ -78,8 +78,10 @@ async function applyTenantConfig(deps, tenant) {
     const applied = [];
     for (const [key, value] of Object.entries(tenant.config ?? {})) {
         const existing = await findConfigRow(deps.db, key, tenant.id, null);
-        if (existing?.value === JSON.stringify(value))
+        const serialized = JSON.stringify(value);
+        if (await configRowHoldsValue(existing, deps.registry?.getConfigKey(key), deps.configCipher, key, serialized)) {
             continue;
+        }
         const result = await deps.dispatcher.write(ConfigHandlers.set, { key, value, scope: ConfigScopes.tenant }, 
         // SystemAdmin on top of the system role: keys with the default tenant
         // write access (admin roles) reject a bare system user, system-only keys
@@ -125,6 +127,11 @@ async function decideInvite(deps, invite) {
     }
     if (invitation.status === INVITATION_STATUS.accepted)
         return "active";
+    // The plan dropped a global role (e.g. an admin moved to tenants[].invites):
+    // the stored invitation would still grant it on accept, so it is re-issued.
+    if (storedGlobalRoles.some((role) => !invite.globalRoles.some((planned) => planned === role))) {
+        return "resent";
+    }
     if (await hasLiveInviteToken(deps.redis, invitation.id))
         return "pending";
     return "resent";
@@ -135,6 +142,7 @@ function isMailingOutcome(outcome) {
 export async function bootstrapTenants(deps, plan) {
     const plannedInvites = planInvites(plan);
     const dispatchSystemWrite = makeDispatchSystemWrite(deps.dispatcher);
+    const dispatchWriteAsRoles = makeDispatchWriteAs(deps.dispatcher);
     const tenants = [];
     for (const tenant of plan.tenants) {
         const outcome = await ensureTenant(deps, tenant);
@@ -144,7 +152,7 @@ export async function bootstrapTenants(deps, plan) {
                 tenantId: tenant.id,
                 db: deps.db,
                 dispatchSystemWrite,
-                dispatchWriteAs: ({ handlerQn, payload, roles }) => deps.dispatcher.write(handlerQn, payload, createSystemUser(tenant.id, roles)),
+                dispatchWriteAs: (args) => dispatchWriteAsRoles({ ...args, tenantId: tenant.id }),
             });
         }
         const configApplied = await applyTenantConfig(deps, tenant);

package/dist/auth-email-password/email-rate-limits.d.ts

@@ -0,0 +1,4 @@
+import type { PayloadRateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+export declare const AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS: number;
+export declare const AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS = 3;
+export declare const AUTH_EMAIL_PAYLOAD_RATE_LIMITS: readonly PayloadRateLimitOption[];

package/dist/auth-email-password/email-rate-limits.js

@@ -0,0 +1,13 @@
+// The bucket counts across all IPs, so a long window would let an attacker who
+// knows an address lock its owner out of recovery/signup for the whole window.
+// A short one still throttles mail bombing but clears within minutes.
+export const AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS = 15 * 60;
+export const AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS = 3;
+export const AUTH_EMAIL_PAYLOAD_RATE_LIMITS = [
+    {
+        per: { payloadField: "email" },
+        limit: AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS,
+        windowSeconds: AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS,
+        normalize: "email",
+    },
+];

package/dist/auth-email-password/email-templates.d.ts

@@ -1,35 +1,13 @@
 export type AuthMailLocale = string;
 export declare const AUTH_MAIL_EN: Readonly<Record<string, string>>;
-export type RenderTokenContentArgs = {
-    readonly url: string;
+export type TokenMailTiming = {
     readonly expiresAt: string;
-    readonly locale?: AuthMailLocale;
-    /** Optional app name for subject + intro. Default from auth.mail.appNameDefault. */
-    readonly appName?: string;
     /** ISO instant the token was issued; the validity duration is measured from it. Default: now. */
     readonly issuedAt?: string;
     /** IANA zone the expiry time is shown in. Default "UTC"; an invalid zone falls back to "UTC". */
     readonly timeZone?: string;
 };
-export type RenderInviteEmailArgs = RenderTokenContentArgs & {
-    readonly role: string;
+export declare function tokenMailExpiry(args: TokenMailTiming, locale: string): {
+    readonly validFor: string;
+    readonly validUntil: string;
 };
-export type AuthMailSection = {
-    readonly text: string;
-} | {
-    readonly button: {
-        readonly label: string;
-        readonly url: string;
-    };
-};
-export type AuthMailContent = {
-    readonly subject: string;
-    readonly header: string;
-    readonly sections: readonly AuthMailSection[];
-    readonly footer: string;
-};
-export declare function renderResetPasswordEmail(args: RenderTokenContentArgs): AuthMailContent;
-export declare function renderUnlockAccountEmail(args: RenderTokenContentArgs): AuthMailContent;
-export declare function renderVerifyEmail(args: RenderTokenContentArgs): AuthMailContent;
-export declare function renderActivationEmail(args: RenderTokenContentArgs): AuthMailContent;
-export declare function renderInviteEmail(args: RenderInviteEmailArgs): AuthMailContent;

package/dist/auth-email-password/email-templates.js

@@ -1,13 +1,10 @@
-// Default renderers for the transactional auth mails. All four magic-link flows
-// (password-reset, email-verification, signup-activation, invite) emit
-// structured AuthMailContent that the handler hands to delivery (ctx.notify) —
-// renderer-simple turns it into HTML. Apps wanting their own branding swap the
-// renderer; these templates are deliberately plain so the renderer (and the
-// operator reading the mailer log) can rely on them.
+// English texts and expiry formatting for the transactional auth mails. The
+// mail bodies are built from these keys into stored templates (see
+// mail-notifications.ts).
 //
 // English ships here. Other languages register via @cosmicdrift/kumiko-locale-*
 // (localeDe() / localeEs() call registerMailTranslations).
-import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export const AUTH_MAIL_EN = {
     "auth.mail.appNameDefault": "Account",
@@ -43,96 +40,6 @@ export const AUTH_MAIL_EN = {
     "auth.mail.unlock.ignore": "If you didn't trigger this lock, you can ignore this email — the lock expires on its own.",
 };
 registerMailTranslations("en", AUTH_MAIL_EN);
-function tokenMailContent(spec) {
-    return {
-        subject: spec.subject,
-        header: spec.header,
-        sections: [
-            { text: spec.greeting },
-            { text: spec.intro },
-            { button: { label: spec.buttonLabel, url: spec.buttonUrl } },
-            { text: spec.expiry },
-        ],
-        footer: spec.ignore,
-    };
-}
-function t(locale, key, params) {
-    return mailT(locale, key, params);
-}
-function appNameFor(args) {
-    const locale = args.locale ?? "en";
-    return args.appName ?? t(locale, "auth.mail.appNameDefault");
-}
-export function renderResetPasswordEmail(args) {
-    const locale = args.locale ?? "en";
-    const app = appNameFor(args);
-    return tokenMailContent({
-        subject: t(locale, "auth.mail.reset.subject", { app }),
-        header: t(locale, "auth.mail.reset.button"),
-        greeting: t(locale, "auth.mail.reset.greeting"),
-        intro: t(locale, "auth.mail.reset.intro", { app }),
-        buttonLabel: t(locale, "auth.mail.reset.button"),
-        buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.reset.expiry", expiryParams(args, locale)),
-        ignore: t(locale, "auth.mail.reset.ignore"),
-    });
-}
-export function renderUnlockAccountEmail(args) {
-    const locale = args.locale ?? "en";
-    const app = appNameFor(args);
-    return tokenMailContent({
-        subject: t(locale, "auth.mail.unlock.subject", { app }),
-        header: t(locale, "auth.mail.unlock.button"),
-        greeting: t(locale, "auth.mail.unlock.greeting"),
-        intro: t(locale, "auth.mail.unlock.intro", { app }),
-        buttonLabel: t(locale, "auth.mail.unlock.button"),
-        buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.unlock.expiry", expiryParams(args, locale)),
-        ignore: t(locale, "auth.mail.unlock.ignore"),
-    });
-}
-export function renderVerifyEmail(args) {
-    const locale = args.locale ?? "en";
-    const app = appNameFor(args);
-    return tokenMailContent({
-        subject: t(locale, "auth.mail.verify.subject", { app }),
-        header: t(locale, "auth.mail.verify.button"),
-        greeting: t(locale, "auth.mail.verify.greeting"),
-        intro: t(locale, "auth.mail.verify.intro", { app }),
-        buttonLabel: t(locale, "auth.mail.verify.button"),
-        buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.verify.expiry", expiryParams(args, locale)),
-        ignore: t(locale, "auth.mail.verify.ignore"),
-    });
-}
-export function renderActivationEmail(args) {
-    const locale = args.locale ?? "en";
-    const app = appNameFor(args);
-    return tokenMailContent({
-        subject: t(locale, "auth.mail.activation.subject", { app }),
-        header: t(locale, "auth.mail.activation.button"),
-        greeting: t(locale, "auth.mail.activation.greeting"),
-        intro: t(locale, "auth.mail.activation.intro", { app }),
-        buttonLabel: t(locale, "auth.mail.activation.button"),
-        buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.activation.expiry", expiryParams(args, locale)),
-        ignore: t(locale, "auth.mail.activation.ignore"),
-    });
-}
-export function renderInviteEmail(args) {
-    const locale = args.locale ?? "en";
-    const app = args.appName ?? "Workspace";
-    return tokenMailContent({
-        subject: t(locale, "auth.mail.invite.subject", { app }),
-        header: t(locale, "auth.mail.invite.button"),
-        greeting: t(locale, "auth.mail.invite.greeting"),
-        intro: t(locale, "auth.mail.invite.intro", { app, role: args.role }),
-        buttonLabel: t(locale, "auth.mail.invite.button"),
-        buttonUrl: args.url,
-        expiry: t(locale, "auth.mail.invite.expiry", expiryParams(args, locale)),
-        ignore: t(locale, "auth.mail.invite.ignore"),
-    });
-}
 const MS_PER_MINUTE = 60_000;
 const MS_PER_HOUR = 60 * MS_PER_MINUTE;
 const MS_PER_DAY = 24 * MS_PER_HOUR;
@@ -185,16 +92,17 @@ function formatWhen(expiresAt, locale, timeZone) {
         }
     }
 }
-function expiryParams(args, locale) {
+// Formatted as text here because the stored template only knows plain variables.
+export function tokenMailExpiry(args, locale) {
     try {
         const expiresAt = Temporal.Instant.from(args.expiresAt);
         const issuedAt = args.issuedAt ? Temporal.Instant.from(args.issuedAt) : Temporal.Now.instant();
         return {
-            duration: formatDuration(expiresAt.epochMilliseconds - issuedAt.epochMilliseconds, locale),
-            when: formatWhen(expiresAt, locale, args.timeZone ?? "UTC"),
+            validFor: formatDuration(expiresAt.epochMilliseconds - issuedAt.epochMilliseconds, locale),
+            validUntil: formatWhen(expiresAt, locale, args.timeZone ?? "UTC"),
         };
     }
     catch {
-        return { duration: args.expiresAt, when: args.expiresAt };
+        return { validFor: args.expiresAt, validUntil: args.expiresAt };
     }
 }

package/dist/auth-email-password/feature.js

@@ -19,6 +19,7 @@ import { createSignupConfirmHandler } from "./handlers/signup-confirm.write.js";
 import { createSignupRequestHandler, } from "./handlers/signup-request.write.js";
 import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
+import { AUTH_MAIL_VARIABLES, authMailLocalizedTemplate, INVITE_MAIL_VARIABLES, sendsMagicLinkMail, } from "./mail-notifications.js";
 /**
  * Env-vars contract for the `auth-email-password` feature.
  *
@@ -85,14 +86,31 @@ export function createAuthEmailPasswordFeature(opts = {}) {
         // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
         // via ctx.notify → delivery must be mounted. Fail closed at boot instead
         // of silently dropping the mail.
-        if (opts.passwordReset ||
-            opts.emailVerification ||
-            opts.signup ||
-            opts.invite ||
-            opts.accountUnlock) {
+        if (sendsMagicLinkMail(opts))
             r.requires("delivery");
-        }
         r.envSchema(authEmailPasswordEnvSchema);
+        // Declared unconditionally: apps also issue the activation link from their
+        // own flows (issueSignupActivation) without enabling the signup option.
+        r.notification("password-reset", {
+            variables: AUTH_MAIL_VARIABLES,
+            localizedTemplate: authMailLocalizedTemplate("passwordReset"),
+        });
+        r.notification("account-unlock", {
+            variables: AUTH_MAIL_VARIABLES,
+            localizedTemplate: authMailLocalizedTemplate("accountUnlock"),
+        });
+        r.notification("email-verification", {
+            variables: AUTH_MAIL_VARIABLES,
+            localizedTemplate: authMailLocalizedTemplate("emailVerification"),
+        });
+        r.notification("signup-activation", {
+            variables: AUTH_MAIL_VARIABLES,
+            localizedTemplate: authMailLocalizedTemplate("signupActivation"),
+        });
+        r.notification("invite", {
+            variables: INVITE_MAIL_VARIABLES,
+            localizedTemplate: authMailLocalizedTemplate("invite"),
+        });
         const handlers = {
             login: r.writeHandler(createLoginHandler({
                 strictEmailVerification: strictVerification,

package/dist/auth-email-password/handlers/change-password.write.d.ts

@@ -4,4 +4,4 @@ export declare const changePasswordWrite: import("@cosmicdrift/kumiko-types/defi
     newPassword: z.ZodString;
 }, z.core.$strip>, {
     kind: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/change-password.write.js

@@ -1,4 +1,4 @@
-import { access, createSystemUser, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { hashPassword, verifyPassword } from "../../shared/index.js";
 import { UserHandlers, UserQueries } from "../../user/index.js";
@@ -14,7 +14,11 @@ export const changePasswordWrite = defineWriteHandler({
         oldPassword: z.string().min(1),
         newPassword: passwordSchema,
     }),
-    access: { roles: access.authenticated },
+    access: {
+        openToAll: {
+            reason: "Self-service: acts only on event.user.id and re-checks the caller's current password; invited members hold only an app role, so a fixed role list would lock them out.",
+        },
+    },
     escapeHatch: {
         grants: ["systemIdentity"],
         reason: "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, ...) " +

package/dist/auth-email-password/handlers/confirm-account-unlock.write.d.ts

@@ -6,4 +6,4 @@ export declare function createConfirmAccountUnlockHandler(opts: ConfirmAccountUn
     token: z.ZodString;
 }, z.core.$strip>, {
     kind: "account-unlocked";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-accept-with-login.write.d.ts

@@ -18,4 +18,4 @@ export declare function createInviteAcceptWithLoginHandler(opts?: InviteAcceptWi
     token: z.ZodString;
     email: z.ZodEmail;
     password: z.ZodString;
-}, z.core.$strip>, InviteAcceptWithLoginData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteAcceptWithLoginData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-accept.write.d.ts

@@ -8,4 +8,4 @@ export type InviteAcceptData = {
 };
 export declare function createInviteAcceptHandler(): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-accept", z.ZodObject<{
     token: z.ZodString;
-}, z.core.$strip>, InviteAcceptData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteAcceptData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -33,12 +33,12 @@ export type InviteCreateOptions = {
 export declare function createInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-create", z.ZodObject<{
     email: z.ZodEmail;
     role: z.ZodString;
-}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export declare function createSystemInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"system-invite-create", z.ZodObject<{
     email: z.ZodEmail;
     role: z.ZodString;
     globalRoles: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         SystemAdmin: "SystemAdmin";
     }>>>;
-}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export {};

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -33,11 +33,10 @@ import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
 // kumiko-lint-ignore cross-feature-import invitee lookup by email reads the user row
 import { userTable } from "../../user/schema/user.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
-import { renderInviteEmail } from "../email-templates.js";
 import { inviteAlreadyAccepted } from "../errors.js";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
-const INVITE_NOTIFICATION_TYPE = "auth-email-password:invite";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 const InviteCreateSchema = z.object({
     email: z.email(),
     role: z.string().min(1).max(50),
@@ -137,8 +136,8 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
     const locale = resolveHandlerMailLocale(ctx, opts.locale);
     await dispatchMagicLinkMail(ctx.notify, {
         handlerName: "invite-create",
-        notificationType: INVITE_NOTIFICATION_TYPE,
-        renderContent: (renderArgs) => renderInviteEmail({ ...renderArgs, role: request.role }),
+        notificationType: AuthMailNotificationTypes.invite,
+        fallbackAppName: "Workspace",
     }, {
         email,
         appUrl: opts.appUrl,
@@ -146,6 +145,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
         expiresAt: expiresAt.toString(),
         issuedAt: issuedAt.toString(),
         timeZone: ctx.tz.user,
+        role: request.role,
         ...(opts.appName !== undefined && { appName: opts.appName }),
         locale,
     });

package/dist/auth-email-password/handlers/invite-signup-complete.write.d.ts

@@ -13,4 +13,4 @@ export type InviteSignupCompleteOptions = Pick<LoginHandlerOptions, "mfaStatusCh
 export declare function createInviteSignupCompleteHandler(opts?: InviteSignupCompleteOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-signup-complete", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/login.write.d.ts

@@ -74,5 +74,5 @@ export declare function gateBuildSession(ctx: HandlerContext, userId: string, te
 export declare function createLoginHandler(opts?: LoginHandlerOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"login", z.ZodObject<{
     email: z.ZodEmail;
     password: z.ZodString;
-}, z.core.$strip>, LoginResult, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, LoginResult, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export {};

package/dist/auth-email-password/handlers/logout.write.d.ts

@@ -1,2 +1,2 @@
 import * as z from "zod";
-export declare const logoutWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"logout", z.ZodObject<{}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export declare const logoutWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"logout", z.ZodObject<{}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/logout.write.js

@@ -1,4 +1,4 @@
-import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 // Logout — JWT is stateless, so server-side we only return OK. A future
 // revocation list / session table can land here without changing the
@@ -6,7 +6,11 @@ import * as z from "zod";
 export const logoutWrite = defineWriteHandler({
     name: "logout",
     schema: z.object({}),
-    access: { roles: access.authenticated },
+    access: {
+        openToAll: {
+            reason: "Self-service: touches no data, any signed-in member must be able to sign out regardless of which role they hold.",
+        },
+    },
     description: "Acknowledges a sign-out for the authenticated caller so the client can discard its token; the JWT is stateless, so no server-side session state changes here.",
     perform: stepsPipeline(({ r }) => [
         r.step.return({ isSuccess: true, data: { kind: "logged-out" } }),

package/dist/auth-email-password/handlers/request-account-unlock.write.d.ts

@@ -3,4 +3,4 @@ export type RequestAccountUnlockOptions = TokenRequestOptions;
 export type RequestUnlockData = TokenRequestData<"unlock-requested">;
 export declare function createRequestAccountUnlockHandler(opts: RequestAccountUnlockOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-account-unlock", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"unlock-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"unlock-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/request-account-unlock.write.js

@@ -1,8 +1,7 @@
 import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderUnlockAccountEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signUnlockToken } from "../unlock-token.js";
 import { createTokenRequestHandler, } from "./token-request-handler.js";
-const UNLOCK_NOTIFICATION_TYPE = "auth-email-password:account-unlock";
 // @wrapper-known semantic-alias
 export function createRequestAccountUnlockHandler(opts) {
     return createTokenRequestHandler({
@@ -18,7 +17,6 @@ export function createRequestAccountUnlockHandler(opts) {
         // locked right now. Confirming just clears the (possibly already
         // empty) lockout state — harmless no-op if they weren't locked.
         extraSilentSkip: () => false,
-        notificationType: UNLOCK_NOTIFICATION_TYPE,
-        renderContent: renderUnlockAccountEmail,
+        notificationType: AuthMailNotificationTypes.accountUnlock,
     }, opts);
 }

package/dist/auth-email-password/handlers/request-email-verification.write.d.ts

@@ -3,4 +3,4 @@ export type RequestEmailVerificationOptions = TokenRequestOptions;
 export type RequestVerificationData = TokenRequestData<"verification-requested">;
 export declare function createRequestEmailVerificationHandler(opts: RequestEmailVerificationOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-email-verification", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"verification-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"verification-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;