@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/dist/user-data-rights/lib/default-mailers.js

@@ -1,65 +1,94 @@
-// Default send*Email-Callbacks fuer die GDPR-Notifications, backed by einem
-// mail-transport (mail-foundation). Damit muss eine App keinen Callback-Code
-// schreiben: sie mountet mail-foundation + einen mail-transport-* und setzt
-// fuer Export-Mails appExportDownloadUrl — fertig. Uebergibt sie eigene
-// send*Email-Opts, greifen diese Defaults nicht (Opt-Override im feature.ts).
+// Default send*Email callbacks for the GDPR notifications. The app writes no
+// callback code: it mounts delivery + channel-email (+ the template stack) and
+// sets appExportDownloadUrl for export mails. Own send*Email options win over
+// these defaults (opt-override in feature.ts).
 //
-// Jeder Callback rendert das Template (email-templates.ts) und versendet ueber
-// den per-Tenant aufgeloesten EmailTransport. `resolveTransport` kommt im Job-
-// Lane aus makeTenantMailTransportResolver, im Request-Lane direkt aus
-// createTransportForTenant(ctx, ...).
+// Export-ready/-failed and deletion-requested go through ctx.notify addressed
+// to the user, so delivery resolves the address and the attempt row carries
+// the recipientId the forget path erases. Deletion-executed cannot: the user
+// is gone by then, and an attempt row written after the erasure would be new
+// personal data. It renders the seeded template and sends over the tenant's
+// mail transport, with no delivery log.
 import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
-import { hasMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
-import { normalizeGdprMailLocale, renderDeletionExecutedEmail, renderDeletionRequestedEmail, renderExportFailedEmail, renderExportReadyEmail, } from "../email-templates.js";
-// mail-foundation ist eine Soft-Dep von user-data-rights. Die Default-Mailer
-// greifen nur wenn mindestens ein mail-transport-* registriert ist — sonst
-// kann ohnehin nichts versendet werden und die App bleibt beim bisherigen
-// "kein Callback → keine Email"-Verhalten.
+import { hasMailTranslations, mailT } from "@cosmicdrift/kumiko-framework/i18n";
+import { DELIVERY_CHANNEL_EXTENSION } from "../../delivery/index.js";
+import { collectRendererPlugins, createRendererFoundationApi, } from "../../renderer-foundation/index.js";
+import { formatGdprMailTimestamp, normalizeGdprMailLocale, } from "../email-templates.js";
+import { GdprMailNotificationTypes, gdprMailTemplateLocale } from "../mail-notifications.js";
+// The notify-based defaults need the delivery pipeline with an email channel.
+export function isGdprMailDeliveryAvailable(registry) {
+    return registry
+        .getExtensionUsages(DELIVERY_CHANNEL_EXTENSION)
+        .some((usage) => usage.entityName === "email");
+}
 export function isMailTransportAvailable(registry) {
     return registry.getExtensionUsages(MAIL_TRANSPORT_EXTENSION).length > 0;
 }
+export function isMailRendererAvailable(registry) {
+    return collectRendererPlugins(registry).some((plugin) => plugin.kinds.includes("mail"));
+}
 // Per-recipient locale wins (user.locale); mailDefaults.locale is the fallback
-// for unknown/unsupported user.locale values; the template itself defaults to en.
-function localeFor(userLocale, defaults) {
+// for unknown/unsupported user.locale values; a locale without a template for
+// this notification falls back to en.
+function mailLocaleFor(notificationType, userLocale, defaults) {
     const user = normalizeGdprMailLocale(userLocale);
-    if (user !== undefined && hasMailTranslations(user))
-        return user;
-    return defaults.locale;
+    const preferred = user !== undefined && hasMailTranslations(user) ? user : defaults.locale;
+    return gdprMailTemplateLocale(notificationType, preferred ?? "en");
+}
+function appNameFor(locale, defaults) {
+    return defaults.appName ?? mailT(locale, "gdpr.mail.appNameDefault");
 }
-export function makeDefaultExportReadyEmail(resolveTransport, defaults = {}) {
+// Delivery failures come back as results, not throws; the callers' best-effort
+// handling only sees them if they throw.
+async function notifyImmediately(notify, notificationType, options) {
+    const result = await notify(notificationType, { ...options, immediate: true });
+    const failed = result.deliveries.find((delivery) => delivery.status === "failed");
+    if (failed) {
+        throw new Error(`${notificationType} delivery failed: ${failed.error ?? "unknown"}`);
+    }
+}
+export function makeDefaultExportReadyEmail(notifyFor, defaults = {}) {
     return async (args) => {
-        const transport = await resolveTransport(args.tenantId);
-        const { subject, html, text } = renderExportReadyEmail({
-            downloadUrl: args.downloadUrl,
-            expiresAt: args.expiresAt,
-            locale: localeFor(args.userLocale, defaults),
-            appName: defaults.appName,
+        const type = GdprMailNotificationTypes.exportReady;
+        const locale = mailLocaleFor(type, args.userLocale, defaults);
+        // immediate: the plain magic-link token must not land in a delivery job payload.
+        await notifyImmediately(notifyFor(args.tenantId), type, {
+            to: args.userId,
+            locale,
+            data: {
+                appName: appNameFor(locale, defaults),
+                actionUrl: args.downloadUrl,
+                validUntil: formatGdprMailTimestamp(args.expiresAt),
+            },
         });
-        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
-export function makeDefaultExportFailedEmail(resolveTransport, defaults = {}) {
+export function makeDefaultExportFailedEmail(notifyFor, defaults = {}) {
     return async (args) => {
-        const transport = await resolveTransport(args.tenantId);
-        const { subject, html, text } = renderExportFailedEmail({
-            locale: localeFor(args.userLocale, defaults),
-            appName: defaults.appName,
+        const type = GdprMailNotificationTypes.exportFailed;
+        const locale = mailLocaleFor(type, args.userLocale, defaults);
+        await notifyImmediately(notifyFor(args.tenantId), type, {
+            to: args.userId,
+            locale,
+            data: { appName: appNameFor(locale, defaults) },
         });
-        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
-export function makeDefaultDeletionRequestedEmail(resolveTransport, defaults = {}) {
+export function makeDefaultDeletionRequestedEmail(notify, defaults = {}) {
     return async (args) => {
-        const transport = await resolveTransport(args.tenantId);
-        const { subject, html, text } = renderDeletionRequestedEmail({
-            gracePeriodEnd: args.gracePeriodEnd,
-            locale: localeFor(args.userLocale, defaults),
-            appName: defaults.appName,
+        const type = GdprMailNotificationTypes.deletionRequested;
+        const locale = mailLocaleFor(type, args.userLocale, defaults);
+        await notify(type, {
+            to: args.userId,
+            locale,
+            data: {
+                appName: appNameFor(locale, defaults),
+                deletionDate: formatGdprMailTimestamp(args.gracePeriodEnd),
+            },
         });
-        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
-export function makeDefaultDeletionExecutedEmail(resolveTransport, defaults = {}) {
+export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
     return async (args) => {
         // Der User ist global, der Mail-Transport per-Tenant — wir senden ueber den
         // Transport des ersten Memberships. Orphan-User (0 Memberships) liefert
@@ -69,12 +98,35 @@ export function makeDefaultDeletionExecutedEmail(resolveTransport, defaults = {}
             // skip: orphan user has no tenant whose transport could send the mail
             return;
         }
-        const transport = await resolveTransport(tenantId);
-        const { subject, html, text } = renderDeletionExecutedEmail({
-            executedAt: args.executedAt,
-            locale: localeFor(args.userLocale, defaults),
-            appName: defaults.appName,
+        const type = GdprMailNotificationTypes.deletionExecuted;
+        const locale = mailLocaleFor(type, args.userLocale, defaults);
+        const plugin = createRendererFoundationApi(collectRendererPlugins(deps.registry)).createRendererForTenant({ tenantId, kind: "mail" });
+        const config = deps.configFor(tenantId);
+        const rendered = await plugin.render({
+            kind: "mail",
+            payload: {
+                slug: type,
+                locale,
+                variables: {
+                    appName: appNameFor(locale, defaults),
+                    executedAt: formatGdprMailTimestamp(args.executedAt),
+                },
+            },
+        }, {
+            db: deps.db,
+            registry: deps.registry,
+            tenantId,
+            ...(config !== undefined && { config }),
+        });
+        if (rendered.kind !== "mail") {
+            throw new Error(`deletion-executed mail: renderer answered with kind "${rendered.kind}"`);
+        }
+        const transport = await deps.resolveTransport(tenantId);
+        await transport.send({
+            to: args.userEmail,
+            subject: rendered.subject,
+            html: rendered.html,
+            text: rendered.text,
         });
-        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -51,7 +51,7 @@ export async function updateUserLifecycle(conn, userId, changes, options) {
     });
 }
 export async function backfillUserLifecycleEvents(conn) {
-    const rows = (await selectMany(conn, userTable, {}));
+    const rows = await selectMany(conn, userTable, {});
     let backfilled = 0;
     const failed = [];
     for (const row of rows) {

package/dist/user-data-rights/mail-notifications.d.ts

@@ -0,0 +1,13 @@
+import { type FeatureRegistrar, type NotificationLocalizedTemplate, type TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+declare const ALL_GDPR_MAIL_KINDS: readonly ["exportReady", "exportFailed", "deletionRequested", "deletionExecuted"];
+export type GdprMailKind = (typeof ALL_GDPR_MAIL_KINDS)[number];
+export declare const GDPR_MAIL_KINDS: Readonly<Record<GdprMailKind, {
+    readonly name: string;
+    readonly translationKey: string;
+}>>;
+export declare const GdprMailNotificationTypes: Readonly<Record<GdprMailKind, string>>;
+export declare function gdprMailTemplateLocale(notificationType: string, requestedLocale: string): string;
+export declare const GDPR_MAIL_VARIABLES: Readonly<Record<GdprMailKind, TemplateVariables>>;
+export declare function gdprMailLocalizedTemplate(kind: GdprMailKind): () => NotificationLocalizedTemplate;
+export declare function registerGdprMails(r: FeatureRegistrar): void;
+export {};

package/dist/user-data-rights/mail-notifications.js

@@ -0,0 +1,118 @@
+import { QnTypes, qn, templateVariable, } from "@cosmicdrift/kumiko-framework/engine";
+import { hasMailTranslationKey, listMailLocales, mailT, resolveMailLocale, } from "@cosmicdrift/kumiko-framework/i18n";
+import { escapeHtml } from "@cosmicdrift/kumiko-headless";
+import { mailParagraph } from "../shared/index.js";
+import { USER_DATA_RIGHTS_FEATURE } from "./constants.js";
+const ALL_GDPR_MAIL_KINDS = [
+    "exportReady",
+    "exportFailed",
+    "deletionRequested",
+    "deletionExecuted",
+];
+export const GDPR_MAIL_KINDS = {
+    exportReady: { name: "export-ready", translationKey: "exportReady" },
+    exportFailed: { name: "export-failed", translationKey: "exportFailed" },
+    deletionRequested: { name: "deletion-requested", translationKey: "deletionRequested" },
+    deletionExecuted: { name: "deletion-executed", translationKey: "deletionExecuted" },
+};
+export const GdprMailNotificationTypes = {
+    exportReady: gdprMailType("exportReady"),
+    exportFailed: gdprMailType("exportFailed"),
+    deletionRequested: gdprMailType("deletionRequested"),
+    deletionExecuted: gdprMailType("deletionExecuted"),
+};
+function gdprMailType(kind) {
+    return qn(USER_DATA_RIGHTS_FEATURE, QnTypes.notify, GDPR_MAIL_KINDS[kind].name);
+}
+function subjectKey(kind) {
+    return `gdpr.mail.${GDPR_MAIL_KINDS[kind].translationKey}.subject`;
+}
+const SUBJECT_KEY_BY_TYPE = new Map(ALL_GDPR_MAIL_KINDS.map((kind) => [GdprMailNotificationTypes[kind], subjectKey(kind)]));
+// A registered locale whose bundle lacks the subject key has no template (see
+// gdprMailLocalizedTemplate); the renderer has no locale fallback, so the
+// sender must pick a locale that has one or the mail would not go out at all.
+export function gdprMailTemplateLocale(notificationType, requestedLocale) {
+    const locale = resolveMailLocale(requestedLocale);
+    const key = SUBJECT_KEY_BY_TYPE.get(notificationType);
+    return key !== undefined && hasMailTranslationKey(locale, key) ? locale : "en";
+}
+const appName = () => templateVariable.text({ required: true });
+export const GDPR_MAIL_VARIABLES = {
+    exportReady: {
+        appName: appName(),
+        actionUrl: templateVariable.link({ required: true }),
+        validUntil: templateVariable.text({ required: true }),
+    },
+    exportFailed: { appName: appName() },
+    deletionRequested: {
+        appName: appName(),
+        deletionDate: templateVariable.text({ required: true }),
+    },
+    deletionExecuted: { appName: appName(), executedAt: templateVariable.text({ required: true }) },
+};
+// Translation placeholder -> template variable per kind.
+const PLACEHOLDER_SLOTS = {
+    exportReady: { app: "{appName}", when: "{validUntil}" },
+    exportFailed: { app: "{appName}" },
+    deletionRequested: { app: "{appName}", when: "{deletionDate}" },
+    deletionExecuted: { app: "{appName}", when: "{executedAt}" },
+};
+function paragraph(kind, locale, part) {
+    const { translationKey } = GDPR_MAIL_KINDS[kind];
+    return mailParagraph(mailT(locale, `gdpr.mail.${translationKey}.${part}`, PLACEHOLDER_SLOTS[kind]));
+}
+function greeting(locale) {
+    return mailParagraph(mailT(locale, "gdpr.mail.greeting"));
+}
+function mailBody(kind, locale) {
+    switch (kind) {
+        case "exportReady":
+            return [
+                greeting(locale),
+                paragraph(kind, locale, "intro"),
+                `<p><a data-button href="{{actionUrl}}">${escapeHtml(mailT(locale, "gdpr.mail.exportReady.button"))}</a></p>`,
+                paragraph(kind, locale, "expiry"),
+            ].join("");
+        case "exportFailed":
+            return [greeting(locale), paragraph(kind, locale, "intro")].join("");
+        case "deletionRequested":
+            return [
+                greeting(locale),
+                paragraph(kind, locale, "intro"),
+                paragraph(kind, locale, "cancel"),
+            ].join("");
+        case "deletionExecuted":
+            return [greeting(locale), paragraph(kind, locale, "intro")].join("");
+    }
+}
+// Evaluated when the registry is built, after every locale feature has
+// registered its mail translations. English always ships; another locale only
+// gets a template when it has its own subject, so a missing translation never
+// silently becomes an English mail in that locale's slot.
+export function gdprMailLocalizedTemplate(kind) {
+    const kindSubjectKey = subjectKey(kind);
+    return () => {
+        const locales = [
+            "en",
+            ...listMailLocales().filter((locale) => locale !== "en" && hasMailTranslationKey(locale, kindSubjectKey)),
+        ];
+        return Object.fromEntries(locales.map((locale) => [
+            locale,
+            {
+                body: mailBody(kind, locale),
+                meta: {
+                    subject: mailT(locale, kindSubjectKey, { app: "{{appName}}" }),
+                    category: "transactional",
+                },
+            },
+        ]));
+    };
+}
+export function registerGdprMails(r) {
+    for (const kind of ALL_GDPR_MAIL_KINDS) {
+        r.notification(GDPR_MAIL_KINDS[kind].name, {
+            variables: GDPR_MAIL_VARIABLES[kind],
+            localizedTemplate: gdprMailLocalizedTemplate(kind),
+        });
+    }
+}

package/dist/user-data-rights/web/privacy-center-screen.js

@@ -12,6 +12,7 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
 // declarative fields/actions instead (feature.ts).
 import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { postWithDownload } from "@cosmicdrift/kumiko-renderer-web";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { useEffect, useState } from "react";
 import { EXPORT_JOB_STATUS, UserDataRightsHandlers, UserDataRightsQueries, } from "../constants.js";
 // Export-Job läuft async (worker-Lane-Cron, ~1 Min). Solange er pending/running
@@ -21,7 +22,7 @@ const EXPORT_POLL_MS = 4000;
 // Dispatcher-Failures tragen i18nKey nur wenn der Handler einen setzt —
 // Boundary-Read mit generischem Fallback.
 function failureKey(error) {
-    const key = error?.i18nKey; // @cast-boundary dispatcher-error
+    const key = propertyOf(error, "i18nKey");
     return typeof key === "string" ? key : "userDataRights.privacyCenter.errors.generic";
 }
 // Roher ISO-Instant → nur der Datums-Teil ist relevant; reiner String-Slice,

package/dist/user-profile/handlers/change-email.write.d.ts

@@ -5,4 +5,4 @@ export declare const changeEmailWrite: import("@cosmicdrift/kumiko-types/define-
 }, z.core.$strip>, {
     kind: string;
     email: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/user-profile/web/profile-screen.js

@@ -8,6 +8,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // (../../user-data-rights/web/privacy-center-screen.tsx), which this file
 // mirrors.
 import { useDispatcher, usePrimitives, useTranslation, } from "@cosmicdrift/kumiko-renderer";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { useState } from "react";
 import { AuthHandlers } from "../../auth-email-password/constants.js";
 import { requestEmailVerification } from "../../auth-email-password/web/index.js";
@@ -15,7 +16,7 @@ import { UserProfileHandlers } from "../constants.js";
 // Dispatcher failures carry an i18nKey only when the handler sets one —
 // boundary read with a generic fallback.
 function failureKey(error) {
-    const key = error?.i18nKey; // @cast-boundary dispatcher-error
+    const key = propertyOf(error, "i18nKey");
     return typeof key === "string" ? key : "profile.errors.generic";
 }
 function StatusBanner({ status }) {

package/dist/waitlist/feature.js

@@ -7,6 +7,7 @@ import { rejectHandler } from "./handlers/reject.write.js";
 import { createSubmitHandler } from "./handlers/submit.write.js";
 import { WAITLIST_I18N } from "./i18n.js";
 import { adminAccess } from "./lib.js";
+import { WAITLIST_ADMIN_NOTICE_RECORD, WAITLIST_ADMIN_NOTICE_VARIABLES, WAITLIST_CONFIRMATION_VARIABLES, waitlistAdminNoticeTemplate, waitlistConfirmationTemplate, } from "./mail.js";
 import { waitlistListScreen } from "./screens.js";
 import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.js";
 export function createWaitlistFeature(opts = {}) {
@@ -16,6 +17,15 @@ export function createWaitlistFeature(opts = {}) {
         r.systemScope();
         r.requires("tenant", "auth-email-password", "user-data-rights");
         r.translations({ keys: WAITLIST_I18N });
+        r.notification("confirmation", {
+            variables: WAITLIST_CONFIRMATION_VARIABLES,
+            localizedTemplate: waitlistConfirmationTemplate,
+        });
+        r.notification("admin-notice", {
+            variables: WAITLIST_ADMIN_NOTICE_VARIABLES,
+            record: WAITLIST_ADMIN_NOTICE_RECORD,
+            localizedTemplate: waitlistAdminNoticeTemplate,
+        });
         r.entity("waitlistEntry", waitlistEntryEntity);
         r.writeHandler(createSubmitHandler(opts));
         r.writeHandler(createInviteHandler(opts.invite));

package/dist/waitlist/handlers/invite.write.d.ts

@@ -6,4 +6,4 @@ export type WaitlistInviteData = {
 };
 export declare function createInviteHandler(invite?: WaitlistInviteOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite", import("zod").ZodObject<{
     id: import("zod").ZodUUID;
-}, import("zod/v4/core").$strict>, WaitlistInviteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strict>, WaitlistInviteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/waitlist/handlers/reject.write.d.ts

@@ -4,4 +4,4 @@ export type WaitlistRejectData = {
 };
 export declare const rejectHandler: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"reject", import("zod").ZodObject<{
     id: import("zod").ZodUUID;
-}, import("zod/v4/core").$strict>, WaitlistRejectData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strict>, WaitlistRejectData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/waitlist/handlers/submit.write.d.ts

@@ -10,4 +10,4 @@ export declare function createSubmitHandler(opts: WaitlistOptions): import("@cos
     message: import("zod").ZodOptional<import("zod").ZodString>;
     locale: import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string, string>>;
     website: import("zod").ZodOptional<import("zod").ZodString>;
-}, import("zod/v4/core").$strict>, WaitlistSubmitData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strict>, WaitlistSubmitData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/waitlist/handlers/submit.write.js

@@ -4,7 +4,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../constants.js";
 import { normalizeEmail, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
-import { renderWaitlistAdminNoticeEmail, renderWaitlistConfirmationEmail, resolveWaitlistAdminMailLocale, resolveWaitlistMailLocale, } from "../mail.js";
+import { resolveWaitlistAdminMailLocale, resolveWaitlistMailLocale, waitlistAdminNoticeVariables, waitlistConfirmationVariables, } from "../mail.js";
 import { DEFAULT_SUBMIT_EMAIL_RATE_LIMITS, DEFAULT_SUBMIT_RATE_LIMIT, } from "../options.js";
 import { WaitlistSubmitSchema } from "../payloads.js";
 // pg_advisory_xact_lock namespace (int4): 'wlst' as ASCII, disjoint from the
@@ -81,7 +81,7 @@ export function createSubmitHandler(opts) {
                 return created;
             await sendBestEffort(ctx, "confirmation", (notify) => notify(WAITLIST_NOTIFICATION_TYPES.confirmation, {
                 route: { email },
-                data: renderWaitlistConfirmationEmail({
+                data: waitlistConfirmationVariables({
                     locale: payload.locale,
                     appName: opts.appName,
                 }),
@@ -95,12 +95,11 @@ export function createSubmitHandler(opts) {
                     return;
                 await notify(WAITLIST_NOTIFICATION_TYPES.adminNotice, {
                     route: { email: adminRecipient },
-                    data: renderWaitlistAdminNoticeEmail({
+                    data: waitlistAdminNoticeVariables({
                         name: payload.name,
                         email,
                         company: payload.company,
                         message: payload.message,
-                        adminLocale: ctx.locale,
                     }),
                     priority: "normal",
                     locale: resolveWaitlistAdminMailLocale(ctx.locale),

package/dist/waitlist/mail.d.ts

@@ -1,15 +1,28 @@
-import type { AuthMailContent } from "../auth-email-password/index.js";
+import { type NotificationLocalizedTemplate, type NotificationRecordMapping, type TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
 export type WaitlistMailLocale = "en" | "de" | "es";
 export declare function resolveWaitlistMailLocale(locale: string | undefined): WaitlistMailLocale;
-export declare function renderWaitlistConfirmationEmail(args: {
+export declare const WAITLIST_CONFIRMATION_VARIABLES: TemplateVariables;
+export declare const WAITLIST_ADMIN_NOTICE_RECORD: NotificationRecordMapping;
+export declare const WAITLIST_ADMIN_NOTICE_VARIABLES: TemplateVariables;
+export declare function waitlistConfirmationVariables(args: {
     readonly locale: string | undefined;
     readonly appName?: string | undefined;
-}): AuthMailContent;
+}): {
+    readonly subject: string;
+    readonly intro: string;
+    readonly footer: string;
+};
+export declare function waitlistConfirmationTemplate(): NotificationLocalizedTemplate;
 export declare function resolveWaitlistAdminMailLocale(adminLocale: string | undefined): "en" | "de";
-export declare function renderWaitlistAdminNoticeEmail(args: {
+export declare function waitlistAdminNoticeVariables(args: {
     readonly name: string;
     readonly email: string;
     readonly company: string | undefined;
     readonly message: string | undefined;
-    readonly adminLocale: string | undefined;
-}): AuthMailContent;
+}): {
+    readonly name: string;
+    readonly details: readonly {
+        readonly text: string;
+    }[];
+};
+export declare function waitlistAdminNoticeTemplate(): NotificationLocalizedTemplate;

package/dist/waitlist/mail.js

@@ -1,3 +1,5 @@
+import { templateVariable, } from "@cosmicdrift/kumiko-framework/engine";
+import { mailHeading, mailParagraph, mailRepeatedRows } from "../shared/index.js";
 const CONFIRMATION_STRINGS = {
     en: {
         subject: (app) => (app ? `You're on the ${app} waitlist` : "You're on the waitlist"),
@@ -42,32 +44,66 @@ export function resolveWaitlistMailLocale(locale) {
     const language = languageOf(locale);
     return isConfirmationLocale(language) ? language : "en";
 }
+export const WAITLIST_CONFIRMATION_VARIABLES = {
+    subject: templateVariable.text({ required: true }),
+    intro: templateVariable.text({ required: true }),
+    footer: templateVariable.text({ required: true }),
+};
+// Only `name` is a plain entry field; the details rows are composed from several fields.
+export const WAITLIST_ADMIN_NOTICE_RECORD = {
+    entity: "waitlistEntry",
+    map: { name: "name" },
+};
+export const WAITLIST_ADMIN_NOTICE_VARIABLES = {
+    name: templateVariable.text({ required: true }),
+    details: templateVariable.list({ text: templateVariable.text({ required: true }) }, { required: true }),
+};
+// The app name is optional, so the sentences that mention it are computed in
+// code and handed over as variables; the template keeps heading and structure.
 // The submitter's name stays out: the address is unverified, so any text in
 // this mail could be planted by whoever typed someone else's email.
-export function renderWaitlistConfirmationEmail(args) {
+export function waitlistConfirmationVariables(args) {
     const t = CONFIRMATION_STRINGS[resolveWaitlistMailLocale(args.locale)];
     return {
         subject: t.subject(args.appName),
-        header: t.header,
-        sections: [{ text: t.intro(args.appName) }],
+        intro: t.intro(args.appName),
         footer: t.footer(args.appName),
     };
 }
+export function waitlistConfirmationTemplate() {
+    return Object.fromEntries(Object.entries(CONFIRMATION_STRINGS).map(([locale, t]) => [
+        locale,
+        {
+            body: [mailHeading(t.header), mailParagraph("{intro}"), mailParagraph("{footer}")].join(""),
+            meta: { subject: "{{subject}}", category: "transactional" },
+        },
+    ]));
+}
 // Operator-facing, so the entrant's locale does not apply: en/de, en default.
 export function resolveWaitlistAdminMailLocale(adminLocale) {
     return languageOf(adminLocale) === "de" ? "de" : "en";
 }
-export function renderWaitlistAdminNoticeEmail(args) {
-    const t = ADMIN_NOTICE_STRINGS[resolveWaitlistAdminMailLocale(args.adminLocale)];
-    const details = [
-        `${args.name} <${args.email}>`,
-        ...(args.company ? [args.company] : []),
-        ...(args.message ? [args.message] : []),
-    ];
+export function waitlistAdminNoticeVariables(args) {
     return {
-        subject: t.subject(args.name),
-        header: t.header,
-        sections: [{ text: t.intro }, { text: details.join("\n") }],
-        footer: t.footer,
+        name: args.name,
+        details: [
+            `${args.name} <${args.email}>`,
+            ...(args.company ? [args.company] : []),
+            ...(args.message ? [args.message] : []),
+        ].map((text) => ({ text })),
     };
 }
+export function waitlistAdminNoticeTemplate() {
+    return Object.fromEntries(Object.entries(ADMIN_NOTICE_STRINGS).map(([locale, t]) => [
+        locale,
+        {
+            body: [
+                mailHeading(t.header),
+                mailParagraph(t.intro),
+                mailRepeatedRows("details", "text"),
+                mailParagraph(t.footer),
+            ].join(""),
+            meta: { subject: t.subject("{{name}}"), category: "transactional" },
+        },
+    ]));
+}

package/dist/waitlist/options.js

@@ -4,5 +4,5 @@ export const DEFAULT_SUBMIT_RATE_LIMIT = {
     windowSeconds: 10 * 60,
 };
 export const DEFAULT_SUBMIT_EMAIL_RATE_LIMITS = [
-    { per: { payloadField: "email" }, limit: 3, windowSeconds: 24 * 60 * 60 },
+    { per: { payloadField: "email" }, limit: 3, windowSeconds: 24 * 60 * 60, normalize: "email" },
 ];

package/dist/workflow-runner/event-trigger.js

@@ -8,7 +8,7 @@
 // wiring uses the unbound pool), so `workflow.run-started` and the rest of
 // the pipeline are not atomic. A throw from startAndRunWorkflow is recorded
 // as `workflow.run-failed` and swallowed, so the dispatcher moves on.
-import { buildPipelineSteps, createSystemUser, describeWorkflowStepError, getStep, SYSTEM_TENANT_ID, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RUN_FAILED_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
+import { buildPipelineSteps, createSystemUser, describeWorkflowStepError, getStep, SYSTEM_TENANT_ID, unwrapWorkflowStepError, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RUN_FAILED_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { workflowRunAggregateId } from "./aggregate-id.js";
 import { registerEventWakeup } from "./event-subscriber.js";
@@ -135,7 +135,7 @@ export function registerEventTrigger(r, workflow) {
                         runId,
                         workflowName: workflow.name,
                         stepIndex,
-                        error: String(error),
+                        error: String(unwrapWorkflowStepError(error)),
                     });
                     const failedPayload = {
                         workflowName: workflow.name,

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -30,7 +30,7 @@
 // resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so
 // a subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
+import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, unwrapWorkflowStepError, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
@@ -237,7 +237,12 @@ async function runResumedPipeline(ctx, input) {
         return { isSuccess: true, data: { outcome: "completed" } };
     }
     catch (error) {
-        log.warn("workflow run failed", { runId, workflowName, stepIndex, error: String(error) });
+        log.warn("workflow run failed", {
+            runId,
+            workflowName,
+            stepIndex,
+            error: String(unwrapWorkflowStepError(error)),
+        });
         // The input stepIndex is the suspended step; the failure happened at the step the resumed pass reached.
         const failedPayload = {
             workflowName,