@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/dist/auth-email-password/handlers/request-email-verification.write.js

@@ -1,8 +1,7 @@
 import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderVerifyEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signVerificationToken } from "../verification-token.js";
 import { createTokenRequestHandler, } from "./token-request-handler.js";
-const VERIFY_NOTIFICATION_TYPE = "auth-email-password:email-verification";
 // @wrapper-known semantic-alias
 export function createRequestEmailVerificationHandler(opts) {
     return createTokenRequestHandler({
@@ -17,7 +16,6 @@ export function createRequestEmailVerificationHandler(opts) {
         // unknown/deleted to keep the enumeration surface symmetric — the
         // caller sees the same 200 regardless of whether a token was minted.
         extraSilentSkip: (user) => user.emailVerified === true,
-        notificationType: VERIFY_NOTIFICATION_TYPE,
-        renderContent: renderVerifyEmail,
+        notificationType: AuthMailNotificationTypes.emailVerification,
     }, opts);
 }

package/dist/auth-email-password/handlers/request-password-reset.write.d.ts

@@ -3,4 +3,4 @@ export type RequestPasswordResetOptions = TokenRequestOptions;
 export type RequestResetData = TokenRequestData<"reset-requested">;
 export declare function createRequestPasswordResetHandler(opts: RequestPasswordResetOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-password-reset", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"reset-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"reset-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/request-password-reset.write.js

@@ -1,8 +1,7 @@
 import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderResetPasswordEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signResetToken } from "../reset-token.js";
 import { createTokenRequestHandler, } from "./token-request-handler.js";
-const RESET_NOTIFICATION_TYPE = "auth-email-password:password-reset";
 // @wrapper-known semantic-alias
 export function createRequestPasswordResetHandler(opts) {
     return createTokenRequestHandler({
@@ -17,7 +16,6 @@ export function createRequestPasswordResetHandler(opts) {
         // non-deleted user can initiate a reset regardless of verification
         // state. The sessions feature handles the post-change revocation.
         extraSilentSkip: () => false,
-        notificationType: RESET_NOTIFICATION_TYPE,
-        renderContent: renderResetPasswordEmail,
+        notificationType: AuthMailNotificationTypes.passwordReset,
     }, opts);
 }

package/dist/auth-email-password/handlers/reset-password.write.d.ts

@@ -7,4 +7,4 @@ export declare function createResetPasswordHandler(opts: ResetPasswordOptions):
     newPassword: z.ZodString;
 }, z.core.$strip>, {
     kind: "password-reset";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/signup-confirm.write.d.ts

@@ -27,5 +27,5 @@ type ClaimedHandover = {
 export declare function createSignupConfirmHandler(opts?: SignupConfirmOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"signup-confirm", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export {};

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -23,6 +23,7 @@ import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { ConflictError, InternalError, reraiseAsKumikoError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { findSignupHandoverProvider, registrationLocaleFromRequest, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, } from "../../shared/index.js";
 // kumiko-lint-ignore cross-feature-import signup-confirm reads tenants.key for slug-uniqueness check (TOCTOU + DB-unique-index zusammen)
@@ -44,10 +45,8 @@ const SIGNUP_CONFIRM_PROVISION_REASON = "provisions a new tenant, its first user
 // directly against SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE would never
 // match; this reads the same field the framework itself uses.
 function isBenignClaimRejection(error) {
-    return (typeof error.details === "object" &&
-        error.details !== null &&
-        error.details["reason"] ===
-            SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE);
+    return (isPlainObject(error.details) &&
+        error.details["reason"] === SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE);
 }
 // Rides the caller's tx. A benign claim rejection (nothing was written) logs
 // and yields undefined; any other failure — including a real DB error, which

package/dist/auth-email-password/handlers/signup-request.write.d.ts

@@ -29,4 +29,4 @@ export declare function createSignupRequestHandler(opts: SignupRequestOptions):
         entityType: z.ZodString;
         token: z.ZodString;
     }, z.core.$strip>>;
-}, z.core.$strip>, SignupRequestData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SignupRequestData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -24,6 +24,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { findSignupHandoverProvider } from "../../shared/index.js";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
 import { resolveHandlerMailLocale } from "../magic-link-mail.js";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.js";
 import { issueSignupActivation } from "../signup-activation.js";
@@ -48,7 +49,7 @@ export function createSignupRequestHandler(opts) {
         schema: SignupRequestSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
+        additionalRateLimits: AUTH_EMAIL_PAYLOAD_RATE_LIMITS,
         description: "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
         escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },
         handler: async (event, ctx) => {

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -6,4 +6,4 @@ export type SwitchTenantMfaGateData = {
 export declare function createSwitchTenantMfaGateHandler(opts: Pick<LoginHandlerOptions, "mfaStatusChecker">): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"switch-tenant-mfa-gate", z.ZodObject<{
     userId: z.ZodString;
     tenantId: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/token-request-handler.d.ts

@@ -1,7 +1,7 @@
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { type AuthUserRow } from "../auth-user-row.js";
-import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "../email-templates.js";
+import type { AuthMailLocale } from "../email-templates.js";
 export type TokenRequestSuccess<K extends string> = {
     readonly kind: K;
     readonly email: string;
@@ -25,7 +25,6 @@ export type TokenRequestSpec<TName extends string, TSuccessKind extends string>
     readonly notConfiguredI18nKey: string;
     readonly extraSilentSkip: (user: AuthUserRow) => boolean;
     readonly notificationType: string;
-    readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
 };
 export type TokenRequestOptions = {
     readonly hmacSecret: string;
@@ -42,4 +41,4 @@ export type TokenRequestOptions = {
 };
 export declare function createTokenRequestHandler<TName extends string, TSuccessKind extends string>(spec: TokenRequestSpec<TName, TSuccessKind>, opts: TokenRequestOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<TName, z.ZodObject<{
     email: z.ZodEmail;
-}, z.core.$strip>, TokenRequestData<TSuccessKind>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, TokenRequestData<TSuccessKind>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -17,6 +17,7 @@ import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { UserQueries } from "../../user/index.js";
 import { parseAuthUserRow } from "../auth-user-row.js";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 const RequestTokenSchema = z.object({
     email: z.email(),
@@ -33,7 +34,7 @@ export function createTokenRequestHandler(spec, opts) {
         schema: RequestTokenSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
+        additionalRateLimits: AUTH_EMAIL_PAYLOAD_RATE_LIMITS,
         escapeHatch: {
             grants: ["systemIdentity"],
             reason: "Anonymous requester has no session — looks up the target user by email via " +
@@ -67,7 +68,6 @@ export function createTokenRequestHandler(spec, opts) {
             await dispatchMagicLinkMail(ctx.notify, {
                 handlerName: spec.handlerName,
                 notificationType: spec.notificationType,
-                renderContent: spec.renderContent,
             }, {
                 // Row value is ciphertext with an active KMS; the byte-exact
                 // lookup above guarantees the payload IS the stored plaintext.

package/dist/auth-email-password/handlers/verify-email.write.d.ts

@@ -9,4 +9,4 @@ export type VerifyEmailData = {
 };
 export declare function createVerifyEmailHandler(opts: VerifyEmailOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"verify-email", z.ZodObject<{
     token: z.ZodString;
-}, z.core.$strip>, VerifyEmailData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, VerifyEmailData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/index.d.ts

@@ -3,10 +3,10 @@ export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from
 export type { BootstrapConfigValue, BootstrapDeps, BootstrapInvite, BootstrapInviteOutcome, BootstrapPlan, BootstrapReport, BootstrapSeedDeps, BootstrapSystemAdmin, BootstrapTenant, BootstrapTenantOutcome, } from "./bootstrap.js";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
-export type { AuthMailContent, AuthMailLocale, AuthMailSection, RenderInviteEmailArgs, RenderTokenContentArgs, } from "./email-templates.js";
-export { renderActivationEmail, renderInviteEmail, renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, } from "./email-templates.js";
+export type { AuthMailLocale } from "./email-templates.js";
 export type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOptions, EmailVerificationOptions, InviteOptions, PasswordResetOptions, SignupOptions, } from "./feature.js";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
+export { AuthMailNotificationTypes } from "./mail-notifications.js";
 export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.js";
 export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.js";
 export { type IssuedSignupActivation, type IssueSignupActivationArgs, issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";

package/dist/auth-email-password/index.js

@@ -8,8 +8,8 @@ export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
 export { DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
-export { renderActivationEmail, renderInviteEmail, renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, } from "./email-templates.js";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
+export { AuthMailNotificationTypes } from "./mail-notifications.js";
 export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.js";
 // Generic HMAC-signed single-purpose token helpers. Re-exported damit
 // app-spezifische out-of-band-Flows (subscriber-confirm, magic-links,

package/dist/auth-email-password/magic-link-mail.d.ts

@@ -1,9 +1,9 @@
 import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
-import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "./email-templates.js";
+import { type AuthMailLocale } from "./email-templates.js";
 export type MagicLinkMailSpec = {
     readonly handlerName: string;
     readonly notificationType: string;
-    readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
+    readonly fallbackAppName?: string;
 };
 export type MagicLinkMailParams = {
     readonly email: string;
@@ -14,6 +14,7 @@ export type MagicLinkMailParams = {
     readonly locale?: AuthMailLocale;
     readonly issuedAt?: string;
     readonly timeZone?: string;
+    readonly role?: string;
 };
 export declare function resolveHandlerMailLocale(ctx: {
     readonly locale?: string;

package/dist/auth-email-password/magic-link-mail.js

@@ -1,13 +1,15 @@
 // Shared dispatch for the magic-link mails (password-reset, email-verification,
-// signup-activation). All three follow the same delivery shape: append the
-// token to the app page, render structured content, and notify the recipient
-// email directly (route:{email} skips preferences — the recipient may not have
-// a user account yet — and critical priority keeps a security mail
-// non-unsubscribable). No r.notification is declared; buildMessage falls back
-// to the structured `data` for the renderer.
+// account-unlock, signup-activation, invite). All follow the same delivery
+// shape: append the token to the app page and notify the recipient email
+// directly (route:{email} skips preferences — the recipient may not have a user
+// account yet — and critical priority keeps a security mail non-unsubscribable).
+// Each mail type is a trigger-less r.notification whose stored template renders
+// from the variables passed here.
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
+import { mailT, resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
+import { tokenMailExpiry } from "./email-templates.js";
+import { authMailTemplateLocale } from "./mail-notifications.js";
 function resolveAppUrl(appUrl, locale) {
     return typeof appUrl === "function" ? appUrl(locale) : appUrl;
 }
@@ -35,18 +37,21 @@ export async function dispatchMagicLinkMail(notify, spec, params) {
     // mailT already root-falls-back; appUrl must use the same negotiated tag
     // or language-in-path apps 404 on e.g. /de-AT/activate.
     const urlLocale = resolveMailLocale(locale);
-    const content = spec.renderContent({
-        url: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
+    const { validFor, validUntil } = tokenMailExpiry({
         expiresAt: params.expiresAt,
-        ...(params.locale !== undefined && { locale: params.locale }),
-        ...(params.appName !== undefined && { appName: params.appName }),
         ...(params.issuedAt !== undefined && { issuedAt: params.issuedAt }),
         ...(params.timeZone !== undefined && { timeZone: params.timeZone }),
-    });
+    }, locale);
     await notify(spec.notificationType, {
         route: { email: params.email },
-        data: content,
-        locale,
+        data: {
+            appName: params.appName ?? spec.fallbackAppName ?? mailT(locale, "auth.mail.appNameDefault"),
+            actionUrl: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
+            validFor,
+            validUntil,
+            ...(params.role !== undefined && { role: params.role }),
+        },
+        locale: authMailTemplateLocale(spec.notificationType, locale),
         priority: "critical",
     });
 }

package/dist/auth-email-password/mail-notifications.d.ts

@@ -0,0 +1,32 @@
+import { type NotificationLocalizedTemplate, type TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+export declare const AUTH_MAIL_KINDS: {
+    readonly passwordReset: {
+        readonly name: "password-reset";
+        readonly translationKey: "reset";
+    };
+    readonly accountUnlock: {
+        readonly name: "account-unlock";
+        readonly translationKey: "unlock";
+    };
+    readonly emailVerification: {
+        readonly name: "email-verification";
+        readonly translationKey: "verify";
+    };
+    readonly signupActivation: {
+        readonly name: "signup-activation";
+        readonly translationKey: "activation";
+    };
+    readonly invite: {
+        readonly name: "invite";
+        readonly translationKey: "invite";
+    };
+};
+export type AuthMailKind = keyof typeof AUTH_MAIL_KINDS;
+type MagicLinkFlowOptions = Partial<Record<"passwordReset" | "emailVerification" | "signup" | "invite" | "accountUnlock", unknown>>;
+export declare function sendsMagicLinkMail(flows: MagicLinkFlowOptions): boolean;
+export declare const AuthMailNotificationTypes: Readonly<Record<AuthMailKind, string>>;
+export declare function authMailTemplateLocale(notificationType: string, requestedLocale: string): string;
+export declare const AUTH_MAIL_VARIABLES: TemplateVariables;
+export declare const INVITE_MAIL_VARIABLES: TemplateVariables;
+export declare function authMailLocalizedTemplate(kind: AuthMailKind): () => NotificationLocalizedTemplate;
+export {};

package/dist/auth-email-password/mail-notifications.js

@@ -0,0 +1,116 @@
+import { QnTypes, qn, templateVariable, } from "@cosmicdrift/kumiko-framework/engine";
+import { hasMailTranslationKey, listMailLocales, mailT, resolveMailLocale, } from "@cosmicdrift/kumiko-framework/i18n";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { AUTH_EMAIL_PASSWORD_FEATURE } from "./constants.js";
+export const AUTH_MAIL_KINDS = {
+    passwordReset: { name: "password-reset", translationKey: "reset" },
+    accountUnlock: { name: "account-unlock", translationKey: "unlock" },
+    emailVerification: { name: "email-verification", translationKey: "verify" },
+    signupActivation: { name: "signup-activation", translationKey: "activation" },
+    invite: { name: "invite", translationKey: "invite" },
+};
+export function sendsMagicLinkMail(flows) {
+    return Boolean(flows.passwordReset ||
+        flows.emailVerification ||
+        flows.signup ||
+        flows.invite ||
+        flows.accountUnlock);
+}
+function authMailType(kind) {
+    return qn(AUTH_EMAIL_PASSWORD_FEATURE, QnTypes.notify, AUTH_MAIL_KINDS[kind].name);
+}
+export const AuthMailNotificationTypes = {
+    passwordReset: authMailType("passwordReset"),
+    accountUnlock: authMailType("accountUnlock"),
+    emailVerification: authMailType("emailVerification"),
+    signupActivation: authMailType("signupActivation"),
+    invite: authMailType("invite"),
+};
+function subjectKey(kind) {
+    return `auth.mail.${AUTH_MAIL_KINDS[kind].translationKey}.subject`;
+}
+const ALL_AUTH_MAIL_KINDS = [
+    "passwordReset",
+    "accountUnlock",
+    "emailVerification",
+    "signupActivation",
+    "invite",
+];
+const SUBJECT_KEY_BY_TYPE = new Map(ALL_AUTH_MAIL_KINDS.map((kind) => [AuthMailNotificationTypes[kind], subjectKey(kind)]));
+// A registered locale whose bundle lacks the subject key has no template (see
+// authMailLocalizedTemplate); the renderer has no locale fallback, so the
+// sender must pick a locale that has one or the mail would not go out at all.
+export function authMailTemplateLocale(notificationType, requestedLocale) {
+    const locale = resolveMailLocale(requestedLocale);
+    const key = SUBJECT_KEY_BY_TYPE.get(notificationType);
+    return key !== undefined && hasMailTranslationKey(locale, key) ? locale : "en";
+}
+export const AUTH_MAIL_VARIABLES = {
+    appName: templateVariable.text({ required: true }),
+    actionUrl: templateVariable.link({ required: true }),
+    validFor: templateVariable.text({ required: true }),
+    validUntil: templateVariable.text({ required: true }),
+};
+export const INVITE_MAIL_VARIABLES = {
+    ...AUTH_MAIL_VARIABLES,
+    role: templateVariable.text({ required: true }),
+};
+// Translation placeholder -> template variable. The markers survive HTML
+// escaping, so only the translated text is escaped, never the placeholders.
+const PLACEHOLDER_VARIABLES = {
+    app: "appName",
+    duration: "validFor",
+    when: "validUntil",
+    role: "role",
+};
+const MARKER_OPEN = "\uE000";
+const MARKER_CLOSE = "\uE001";
+const MARKER_PATTERN = new RegExp(`${MARKER_OPEN}(\\w+)${MARKER_CLOSE}`, "g");
+function markers() {
+    return Object.fromEntries(Object.keys(PLACEHOLDER_VARIABLES).map((name) => [
+        name,
+        `${MARKER_OPEN}${name}${MARKER_CLOSE}`,
+    ]));
+}
+function translatedHtml(locale, key) {
+    return escapeHtml(mailT(locale, key, markers())).replace(MARKER_PATTERN, (_, name) => {
+        const variable = PLACEHOLDER_VARIABLES[name];
+        return variable === undefined
+            ? ""
+            : `<span data-variable="${escapeHtmlAttr(variable)}"></span>`;
+    });
+}
+function mailBody(locale, translationKey) {
+    const html = (part) => translatedHtml(locale, `auth.mail.${translationKey}.${part}`);
+    return [
+        `<p>${html("greeting")}</p>`,
+        `<p>${html("intro")}</p>`,
+        `<p><a data-button href="{{actionUrl}}">${html("button")}</a></p>`,
+        `<p>${html("expiry")}</p>`,
+        `<p>${html("ignore")}</p>`,
+    ].join("");
+}
+// Evaluated when the registry is built, after every locale feature has
+// registered its mail translations. English always ships; another locale only
+// gets a template when it has its own subject, so a missing translation never
+// silently becomes an English mail in that locale's slot.
+export function authMailLocalizedTemplate(kind) {
+    const { translationKey } = AUTH_MAIL_KINDS[kind];
+    const kindSubjectKey = subjectKey(kind);
+    return () => {
+        const locales = [
+            "en",
+            ...listMailLocales().filter((locale) => locale !== "en" && hasMailTranslationKey(locale, kindSubjectKey)),
+        ];
+        return Object.fromEntries(locales.map((locale) => [
+            locale,
+            {
+                body: mailBody(locale, translationKey),
+                meta: {
+                    subject: mailT(locale, kindSubjectKey, { app: "{{appName}}" }),
+                    category: "transactional",
+                },
+            },
+        ]));
+    };
+}

package/dist/auth-email-password/signup-activation.d.ts

@@ -1,6 +1,6 @@
 import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
 import type { Redis } from "ioredis";
-export declare const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = "auth-email-password:signup-activation";
+export declare const SIGNUP_ACTIVATION_NOTIFICATION_TYPE: string;
 export type IssueSignupActivationArgs = {
     readonly redis: Redis;
     readonly notify: NotifyFn | undefined;

package/dist/auth-email-password/signup-activation.js

@@ -6,10 +6,10 @@
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "./constants.js";
-import { renderActivationEmail } from "./email-templates.js";
 import { dispatchMagicLinkMail } from "./magic-link-mail.js";
+import { AuthMailNotificationTypes } from "./mail-notifications.js";
 import { invalidateExistingSignupToken, normalizeEmail, storeSignupToken, } from "./signup-token-store.js";
-export const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = "auth-email-password:signup-activation";
+export const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = AuthMailNotificationTypes.signupActivation;
 export async function issueSignupActivation(args) {
     const ttlSeconds = (args.tokenTtlMinutes ?? AUTH_SIGNUP_DEFAULT_TTL_MINUTES) * 60;
     // At most one live signup token per email.
@@ -26,7 +26,6 @@ export async function issueSignupActivation(args) {
     await dispatchMagicLinkMail(args.notify, {
         handlerName: "signup-request",
         notificationType: SIGNUP_ACTIVATION_NOTIFICATION_TYPE,
-        renderContent: renderActivationEmail,
     }, {
         email,
         appUrl: args.appUrl,

package/dist/auth-email-password/web/auth-gate.js

@@ -10,7 +10,7 @@ import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 // (nur `{ children }`-Prop). Der Sample kann so einen eigenen Login-
 // Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
 import { useLocale } from "@cosmicdrift/kumiko-renderer";
-import { useEffect, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import { assertNavigableUrl, buildLoginRedirectUrl, followNextOrLandingAfterLogin, } from "./auth-redirect.js";
 import { LoginScreen } from "./login-screen.js";
 import { SessionProvider, useSession } from "./session.js";
@@ -102,6 +102,17 @@ export function resolveLoginRedirect(loginUrl, locale, { origin, pathname, searc
         url: typeof loginUrl === "function" ? target : buildLoginRedirectUrl(target, returnPath, origin),
     };
 }
+// A throwing loginUrl builder must not take the whole app tree down in render;
+// null falls through to the built-in login screen.
+function resolveLoginRedirectOrNull(loginUrl, locale, location) {
+    try {
+        return resolveLoginRedirect(loginUrl, locale, location);
+    }
+    catch (error) {
+        console.error("Auth gate: loginUrl could not be resolved, showing the built-in login", error);
+        return null;
+    }
+}
 export function makeAuthGate(opts = {}) {
     const { loginUrl } = opts;
     if (typeof loginUrl === "string")
@@ -110,9 +121,10 @@ export function makeAuthGate(opts = {}) {
     function AuthGate({ children }) {
         const { status } = useSession();
         const locale = useLocale().locale();
-        const loginRedirect = loginUrl !== undefined && status === "unauthenticated"
-            ? resolveLoginRedirect(loginUrl, locale, window.location)
-            : null;
+        const { origin, pathname, search, hash } = window.location;
+        const loginRedirect = useMemo(() => loginUrl !== undefined && status === "unauthenticated"
+            ? resolveLoginRedirectOrNull(loginUrl, locale, { origin, pathname, search, hash })
+            : null, [status, locale, origin, pathname, search, hash]);
         const redirectUrl = loginRedirect?.kind === "redirect" ? loginRedirect.url : null;
         // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
         useEffect(() => {

package/dist/auth-foundation/types.js

@@ -47,10 +47,7 @@ export function tokenShapeKey(shape) {
 // exactly one implementation must be registered (boot-fails on 0 or ≥2).
 export const EXT_SESSION_STORE = "sessionStore";
 export function isSessionStoreProvider(o) {
-    return (typeof o === "object" &&
-        o !== null &&
-        "build" in o &&
-        typeof o.build === "function");
+    return typeof o === "object" && o !== null && "build" in o && typeof o.build === "function";
 }
 // Tenant-resolution extension points (#1373). Both are single-provider and
 // optional — zero registered means today's single-tenant / header-cookie
@@ -69,8 +66,5 @@ export function isTenantResolverProvider(o) {
         isTenantResolverTrust(o.trust));
 }
 export function isTenantExistenceProvider(o) {
-    return (typeof o === "object" &&
-        o !== null &&
-        "build" in o &&
-        typeof o.build === "function");
+    return typeof o === "object" && o !== null && "build" in o && typeof o.build === "function";
 }

package/dist/auth-mfa/feature.js

@@ -25,7 +25,7 @@ export function bindMfaRevokeAllOtherSessionsFromFeature(feature) {
     if (exports && typeof exports === "object" && "bindRevokeAllOtherSessions" in exports) {
         const { bindRevokeAllOtherSessions } = exports;
         if (typeof bindRevokeAllOtherSessions === "function") {
-            // @cast-boundary exports-walk — feature.exports is untyped by design
+            // @cast-boundary feature-exports — feature.exports is untyped by design
             return bindRevokeAllOtherSessions;
         }
     }
@@ -38,7 +38,7 @@ export function mfaStatusCheckerFromFeature(feature) {
     if (exports && typeof exports === "object" && "checkMfaStatus" in exports) {
         const { checkMfaStatus } = exports;
         if (typeof checkMfaStatus === "function") {
-            // @cast-boundary exports-walk — feature.exports is untyped by design
+            // @cast-boundary feature-exports — feature.exports is untyped by design
             return checkMfaStatus;
         }
     }
@@ -53,7 +53,7 @@ export function mfaVerifierFromFeature(feature) {
     if (exports && typeof exports === "object" && "verifyMfaCode" in exports) {
         const { verifyMfaCode } = exports;
         if (typeof verifyMfaCode === "function") {
-            // @cast-boundary exports-walk — feature.exports is untyped by design
+            // @cast-boundary feature-exports — feature.exports is untyped by design
             return verifyMfaCode;
         }
     }
@@ -68,7 +68,7 @@ export function bindRevokeAllPatTokensFromFeature(feature) {
     if (exports && typeof exports === "object" && "bindRevokeAllPatTokens" in exports) {
         const { bindRevokeAllPatTokens } = exports;
         if (typeof bindRevokeAllPatTokens === "function") {
-            // @cast-boundary exports-walk — feature.exports is untyped by design
+            // @cast-boundary feature-exports — feature.exports is untyped by design
             return bindRevokeAllPatTokens;
         }
     }

package/dist/auth-mfa/handlers/disable.write.d.ts

@@ -7,4 +7,4 @@ export declare function createDisableHandler(opts: DisableOptions): import("@cos
     code: z.ZodString;
 }, z.core.$strip>, {
     disabled: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.d.ts

@@ -13,4 +13,4 @@ export declare function createEnableConfirmPreauthHandler(opts: EnableConfirmPre
 }, z.core.$strip>, {
     kind: string;
     session: SessionUser;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/enable-confirm.write.d.ts

@@ -9,4 +9,4 @@ export declare function createEnableConfirmHandler(opts: EnableConfirmOptions):
     code: z.ZodString;
 }, z.core.$strip>, {
     enabled: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/enable-start-preauth.write.d.ts

@@ -11,4 +11,4 @@ export declare function createEnableStartPreauthHandler(opts: EnableStartPreauth
     setupToken: string;
     otpauthUri: string;
     recoveryCodes: string[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/enable-start.write.d.ts

@@ -10,4 +10,4 @@ export declare function createEnableStartHandler(opts: EnableStartOptions): impo
     otpauthUri: string;
     totpSecret: string;
     recoveryCodes: string[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/regenerate-recovery.write.d.ts

@@ -6,4 +6,4 @@ export declare function createRegenerateRecoveryHandler(opts: RegenerateRecovery
     code: z.ZodString;
 }, z.core.$strip>, {
     recoveryCodes: string[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/verify.write.d.ts

@@ -11,4 +11,4 @@ export declare function createMfaVerifyHandler(opts: MfaVerifyOptions): import("
 }, z.core.$strip>, {
     kind: string;
     session: SessionUser;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;