@cosmicdrift/kumiko-bundled-features 0.365.1 → 0.367.0

package/dist/channel-teams/feature.js

@@ -9,8 +9,8 @@ export function createChannelTeamsFeature(options = {}) {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
-        r.requires("secrets");
+        r.requires({ features: ["delivery"] });
+        r.requires({ features: ["secrets"] });
         const webhookTarget = resolveChatWebhookTarget({ defaultAllowedHosts: TEAMS_DEFAULT_ALLOWED_HOSTS }, options);
         const webhooks = r.secretNamespace("webhooks", {
             label: {

package/dist/channel-telegram/feature.js

@@ -10,8 +10,8 @@ export function createChannelTelegramFeature(options = {}) {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
-        r.requires("secrets");
+        r.requires({ features: ["delivery"] });
+        r.requires({ features: ["secrets"] });
         const botToken = r.secret("botToken", {
             label: { en: "Telegram bot token" },
             hint: {

package/dist/compliance-profiles/feature.js

@@ -22,7 +22,7 @@ export function createComplianceProfilesFeature(options) {
         // Context, Profile-Selection ist eigene Entity, sub-processor-Liste
         // sind Constants. Wenn S1.4+ Cross-Feature-Reads dazukommen, kommt
         // r.requires hier rein.
-        r.entity("tenant-compliance-profile", tenantComplianceProfileEntity);
+        r.entity({ name: "tenant-compliance-profile", ...tenantComplianceProfileEntity });
         r.exposesApi("compliance.forTenant");
         const handlers = {
             setProfile: r.writeHandler({ ...setProfileWrite, access: { roles: resolvedAccess } }),

package/dist/compliance-profiles-ops/index.js

@@ -7,7 +7,7 @@
 // a separate feature (mirrors folders-user-data/notes-history-user-data)
 // rather than folded into compliance-profiles: this is the one genuinely
 // cross-tenant capability in the picker's orbit, and it alone needs
-// r.systemScope() + a hard r.requires("tenant") — apps that only want the
+// r.systemScope() + a hard r.requires({ features: ["tenant"] }) — apps that only want the
 // per-tenant picker (the vast majority) stay unaffected.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { tenantsMissingProfileQuery } from "./handlers/tenants-missing-profile.query.js";
@@ -19,8 +19,8 @@ export const complianceProfilesOpsFeature = defineFeature("compliance-profiles-o
         recommended: false,
     });
     r.systemScope();
-    r.requires("compliance-profiles");
-    r.requires("tenant");
+    r.requires({ features: ["compliance-profiles"] });
+    r.requires({ features: ["tenant"] });
     const queries = {
         tenantsMissingProfile: r.queryHandler(tenantsMissingProfileQuery),
     };

package/dist/config/feature.js

@@ -24,7 +24,7 @@ export function createConfigFeature() {
         // projection write in one TX. Subscribers that need config-change
         // semantics listen to those auto-events via r.multiStreamProjection
         // (see docs/plans/architecture/event-sourcing-pivot.md §4.7).
-        r.entity("config-value", configValueEntity);
+        r.entity({ name: "config-value", ...configValueEntity });
         const handlers = {
             set: r.writeHandler(setWrite),
             reset: r.writeHandler(resetWrite),

package/dist/custom-fields/feature.js

@@ -10,7 +10,7 @@
 // (crypto-shredding, event ciphertext, forget pipeline).
 //
 // **Was diese Feature liefert (B1 + B2, 2026-05-23):**
-//   1. r.entity("field-definition") — Definition-Storage (event-sourced).
+//   1. r.entity({ name: "field-definition" }) — Definition-Storage (event-sourced).
 //   2. define-tenant-field / define-system-field — RBAC write-handlers für
 //      Definition-CRUD.
 //   3. delete-tenant-field / delete-system-field — RBAC write-handlers.
@@ -75,7 +75,7 @@ function registerCustomFields(r, variant) {
         category: "data",
         recommended: false,
     });
-    r.entity("field-definition", fieldDefinitionEntity);
+    r.entity({ name: "field-definition", ...fieldDefinitionEntity });
     // Event-types — qualified als "custom-fields:event:<short-name>".
     // Returned EventDefs liefern .name als compile-time literal-typed string,
     // den Handler + MSP-keys konsumieren statt Template-Literal-Konstruktion.

package/dist/custom-fields/wire-for-entity.js

@@ -28,8 +28,8 @@ export function customFieldsField() {
 // Consumer-side:
 //
 //   defineFeature("property-mgmt", (r) => {
-//     r.entity("property", propertyEntity);  // muss customFieldsField() haben
-//     r.requires(CUSTOM_FIELDS_FEATURE_NAME);
+//     r.entity({ name: "property", ...propertyEntity });  // muss customFieldsField() haben
+//     r.requires({ features: [CUSTOM_FIELDS_FEATURE_NAME] });
 //     wireCustomFieldsFor(r, "property", propertyTable);
 //   });
 //
@@ -158,18 +158,22 @@ export function wireCustomFieldsFor(r, entityName, entityTable) {
     });
     // postQuery-hook: flatten row.customFields jsonb auf root-level der
     // API-response. Spec-Promise Z.4 "indistinguishable von Stammfeldern".
-    r.hook("postQuery", { allOf: entityName }, async ({ rows }) => ({
-        rows: rows.map((row) => {
-            const customFields = row["customFields"];
-            if (customFields && typeof customFields === "object" && !Array.isArray(customFields)) {
-                return {
-                    ...customFields, // @cast-boundary db-row jsonb runtime-untyped
-                    ...row, // base fields win: a custom fieldKey named `id`/`name` must not shadow the real column
-                };
-            }
-            return row;
+    r.hook({
+        type: "postQuery",
+        target: { allOf: entityName },
+        handler: async ({ rows }) => ({
+            rows: rows.map((row) => {
+                const customFields = row["customFields"];
+                if (customFields && typeof customFields === "object" && !Array.isArray(customFields)) {
+                    return {
+                        ...customFields, // @cast-boundary db-row jsonb runtime-untyped
+                        ...row, // base fields win: a custom fieldKey named `id`/`name` must not shadow the real column
+                    };
+                }
+                return row;
+            }),
         }),
-    }));
+    });
     // Search-Payload-Extension: customFields-keys flach ins Index-Doc.
     // Anders als postQuery-hook (der ALLE keys merged) trägt der Search-
     // Contributor nur die als searchable=true definierten fields bei. v1

package/dist/data-retention/feature.js

@@ -37,7 +37,7 @@ export function createDataRetentionFeature() {
             category: "compliance",
             recommended: false,
         });
-        r.entity("tenant-retention-override", tenantRetentionOverrideEntity);
+        r.entity({ name: "tenant-retention-override", ...tenantRetentionOverrideEntity });
         // S2.D3: Cross-Feature-API fuer Forget-Flow + Cleanup-Job
         r.exposesApi("retention.policyFor");
         r.queryHandler(policyForQuery);

package/dist/data-retention/presets.d.ts

@@ -1,9 +1,9 @@
 import type { RetentionDef } from "@cosmicdrift/kumiko-framework/engine";
 /**
- * Pro Entity-Name gemappte Retention-Policy. Entity-Namen sind der
- * String aus r.entity("name", ...) — kebab-case oder lowercase.
- * Cleanup-Job iteriert alle bekannten Entities; was nicht im Preset
- * steht, fällt auf Entity-Default (Layer 1) zurück.
+ * Retention policy keyed by entity name, i.e. the `name` from
+ * r.entity({ name, ... }) (kebab-case or lowercase). The cleanup job walks
+ * all known entities; anything missing from the preset falls back to the
+ * entity default (layer 1).
  */
 export type RetentionPreset = Readonly<Record<string, RetentionDef>>;
 export type RetentionPresetKey = "default" | "dsgvo-basic" | "dsgvo-hgb" | "swiss-dsg";

package/dist/delivery/channel-context.js

@@ -92,6 +92,7 @@ export function buildChannelContext(db, registry, sseBroker, tenantId, secrets,
         sseBroker,
         tenantId,
         secrets,
+        config: tenantConfig,
         renderMail: createTemplateMailRenderer(db, registry, tenantId, tenantConfig),
         ...(filesForTenant !== undefined && {
             readAttachment: createEmailAttachmentReader(db, registry, tenantId, tenantConfig, filesForTenant),

package/dist/delivery/db/queries/address-opt-outs.d.ts

@@ -2,4 +2,4 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 export type AddressOptOutKey = string;
 export declare function addressOptOutKey(addressHash: string, channel: string): AddressOptOutKey;
-export declare function selectOptedOutAddresses(db: DbConnection, tenantId: TenantId, notificationType: string, addressHashes: readonly string[]): Promise<ReadonlySet<AddressOptOutKey>>;
+export declare function selectOptedOutAddresses(db: DbConnection, tenantId: TenantId, notificationTypeNames: readonly string[], addressHashes: readonly string[]): Promise<ReadonlySet<AddressOptOutKey>>;

package/dist/delivery/db/queries/address-opt-outs.js

@@ -7,9 +7,13 @@ export function addressOptOutKey(addressHash, channel) {
 // ("*") semantics for address opt-outs, the token that creates a row always
 // carries one concrete notificationType/channel pair. One query covers every
 // recipient of a notify() call.
-export async function selectOptedOutAddresses(db, tenantId, notificationType, addressHashes) {
+export async function selectOptedOutAddresses(db, tenantId, notificationTypeNames, addressHashes) {
     if (addressHashes.length === 0)
         return new Set();
-    const rows = await selectMany(db, notificationAddressOptOutsTable, { tenantId, notificationType, addressHash: { in: addressHashes } });
+    const rows = await selectMany(db, notificationAddressOptOutsTable, {
+        tenantId,
+        notificationType: { in: notificationTypeNames },
+        addressHash: { in: addressHashes },
+    });
     return new Set(rows.map((row) => addressOptOutKey(row.addressHash, row.channel)));
 }

package/dist/delivery/db/queries/preferences.d.ts

@@ -5,4 +5,4 @@ export type NotificationPreferenceRow = {
     readonly channel: string;
     readonly enabled: boolean;
 };
-export declare function selectNotificationPreferences(db: DbConnection, tenantId: TenantId, userId: string, notificationType: string, channelName: string): Promise<readonly NotificationPreferenceRow[]>;
+export declare function selectNotificationPreferences(db: DbConnection, tenantId: TenantId, userId: string, notificationTypeNames: readonly string[], channelName: string): Promise<readonly NotificationPreferenceRow[]>;

package/dist/delivery/db/queries/preferences.js

@@ -1,13 +1,13 @@
 import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 // @wrapper-known semantic-alias
-export async function selectNotificationPreferences(db, tenantId, userId, notificationType, channelName) {
+export async function selectNotificationPreferences(db, tenantId, userId, notificationTypeNames, channelName) {
     return unsafeReadRetrying(db, `SELECT notification_type AS "notificationType", channel, enabled
      FROM read_notification_preferences
      WHERE tenant_id = $1
        AND user_id = $2
        AND (
-         (notification_type = $3 AND channel = $4)
+         (notification_type = ANY($3::text[]) AND channel = $4)
          OR (notification_type = '*' AND channel = $4)
-         OR (notification_type = $3 AND channel = '*')
-       )`, [tenantId, userId, notificationType, channelName]);
+         OR (notification_type = ANY($3::text[]) AND channel = '*')
+       )`, [tenantId, userId, notificationTypeNames, channelName]);
 }

package/dist/delivery/delivery-service.d.ts

@@ -6,6 +6,7 @@ import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import { type DeliveryChannel, type DeliveryService } from "./types.js";
+import { type UnsubscribeLinkConfig } from "./unsubscribe-link.js";
 export declare function redactedMessageOf(err: unknown): string;
 export type RateLimitConfig = {
     readonly redis: Redis;
@@ -28,6 +29,7 @@ export type DeliveryServiceOptions = {
     readonly tenantConfigFor?: (tenantId: TenantId) => ConfigAccessor;
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
     readonly log?: Logger;
+    readonly unsubscribeLinks?: UnsubscribeLinkConfig;
 };
 export declare function collectChannels(registry: Registry): DeliveryChannel[];
 export declare function createDeliveryService(options: DeliveryServiceOptions): DeliveryService;

package/dist/delivery/delivery-service.js

@@ -9,10 +9,12 @@ import { redactErrorText } from "../shared/index.js";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
 import { appendAttemptEvent, logAttempt } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank, } from "./constants.js";
+import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank, EMAIL_CHANNEL_NAME, } from "./constants.js";
 import { addressOptOutKey, selectOptedOutAddresses, } from "./db/queries/address-opt-outs.js";
 import { selectNotificationPreferences } from "./db/queries/preferences.js";
+import { notificationTypeNames } from "./notification-type-aliases.js";
 import { isDeliveryChannelPlugin, } from "./types.js";
+import { buildUnsubscribeUrl, unsubscribeLinkOrigin, } from "./unsubscribe-link.js";
 export function redactedMessageOf(err) {
     return redactErrorText(err instanceof Error ? err.message : String(err));
 }
@@ -27,7 +29,7 @@ export function collectChannels(registry) {
     });
 }
 export function createDeliveryService(options) {
-    const { db, registry, sseBroker, channels, tenantUserIdsQuery, rateLimit, isChannelKilled, idempotencyRedis, jobRunner, secrets, filesForTenant, tenantConfigFor, escapeHatchAuditSink, log, } = options;
+    const { db, registry, sseBroker, channels, tenantUserIdsQuery, rateLimit, isChannelKilled, idempotencyRedis, jobRunner, secrets, filesForTenant, tenantConfigFor, escapeHatchAuditSink, log, unsubscribeLinks, } = options;
     const idemRedis = idempotencyRedis ?? rateLimit?.redis;
     const logError = createFallbackLogger("delivery", log);
     // Rate limit check: atomic INCR + TTL + over-limit rollback via server-side
@@ -254,6 +256,31 @@ export function createDeliveryService(options) {
             });
         }
     }
+    // A caller-supplied unsubscribeUrl wins; the recipient comes from the server-side notify
+    // context, never from the notification data.
+    async function withUnsubscribeUrl(message, channelName, recipient, channelCtx) {
+        if (!unsubscribeLinks || channelName !== EMAIL_CHANNEL_NAME)
+            return message;
+        if (registry.getAllNotifications().get(message.notificationType)?.unsubscribe !== true) {
+            return message;
+        }
+        const supplied = message.data?.["unsubscribeUrl"];
+        if (typeof supplied === "string" && supplied !== "")
+            return message;
+        const origin = await unsubscribeLinkOrigin(unsubscribeLinks, channelCtx, (reason) => logError.warn(`unsubscribe link falls back to the app origin: ${reason}`, {
+            tenantId: channelCtx.tenantId,
+            notificationType: message.notificationType,
+        }));
+        const unsubscribeUrl = await buildUnsubscribeUrl(unsubscribeLinks, origin, recipient, {
+            tenantId: channelCtx.tenantId,
+            notificationType: message.notificationType,
+            channel: channelName,
+            locale: message.locale,
+        });
+        return unsubscribeUrl === undefined
+            ? message
+            : { ...message, data: { ...message.data, unsubscribeUrl } };
+    }
     function buildMessage(notificationType, data, channelName, locale) {
         // Look up per-channel template from notification definition
         const notifDef = registry.getAllNotifications().get(notificationType);
@@ -292,7 +319,7 @@ export function createDeliveryService(options) {
             if (addressHash !== undefined)
                 addressHashes.add(addressHash);
         }
-        return selectOptedOutAddresses(run.db, tenantId, notificationType, [...addressHashes]);
+        return selectOptedOutAddresses(run.db, tenantId, notificationTypeNames(registry, notificationType), [...addressHashes]);
     }
     function isAddressSuppressed(suppressed, address, channelName) {
         const addressHash = hashUnsubscribeAddress(address);
@@ -354,13 +381,19 @@ export function createDeliveryService(options) {
     //   { type: "orderAssigned", channel: "*", enabled: true }  enables orderAssigned everywhere
     //   → orderAssigned on inApp: disabled (conservative) unless an exact entry overrides.
     async function isChannelEnabled(run, userId, tenantId, notificationType, channelName) {
-        const prefs = await selectNotificationPreferences(run.db, tenantId, userId, notificationType, channelName);
+        const prefs = await selectNotificationPreferences(run.db, tenantId, userId, notificationTypeNames(registry, notificationType), channelName);
         if (prefs.length === 0)
             return true;
         // Exact match (both specific) wins over any wildcard
         const exact = prefs.find((p) => p.notificationType === notificationType && p.channel === channelName);
         if (exact)
             return exact.enabled;
+        // Rows stored under a former name: the user's choice from before the rename
+        const aliasExact = prefs.filter((p) => p.notificationType !== "*" &&
+            p.notificationType !== notificationType &&
+            p.channel === channelName);
+        if (aliasExact.length > 0)
+            return !aliasExact.some((p) => p.enabled === false);
         // Only wildcards matched: any disabled entry disables delivery (deterministic
         // and conservative — DB ordering no longer decides the outcome).
         return !prefs.some((p) => p.enabled === false);
@@ -428,7 +461,7 @@ export function createDeliveryService(options) {
                     run,
                     channel,
                     address,
-                    message,
+                    message: await withUnsubscribeUrl(message, channel.name, { kind: "user", userId }, channelCtx),
                     channelCtx,
                     tenantId,
                     recipientId: userId,
@@ -501,7 +534,7 @@ export function createDeliveryService(options) {
                     run,
                     channel,
                     address,
-                    message,
+                    message: await withUnsubscribeUrl(message, channel.name, { kind: "address", address }, channelCtx),
                     channelCtx,
                     tenantId,
                     recipientId,

package/dist/delivery/feature.js

@@ -19,7 +19,7 @@ export function createDeliveryFeature(options) {
     const resolvedAccess = options?.access ?? access.admin;
     const attemptLogRetentionDays = resolveAttemptLogRetentionDays(options?.attemptLogRetentionDays);
     return defineFeature("delivery", (r) => {
-        r.describe('The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: "deferred" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: "dispatched", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app\'s `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message\'s `data.unsubscribeUrl` points at the unsubscribe route.');
+        r.describe("The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (`runProdApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.");
         r.uiHints({
             displayLabel: "Notifications \u00b7 Dispatch Core",
             category: "notifications",
@@ -27,18 +27,22 @@ export function createDeliveryFeature(options) {
         });
         r.systemScope();
         // delivery-log's tenantId column has refEntity: "tenant:tenant" (boot-checked).
-        r.requires("tenant");
+        r.requires({ features: ["tenant"] });
         // Backing table: the (tenant,user,type,channel) uniqueIndex lives only on
         // the physical table, not on the entity fields, so the generator would
         // otherwise omit it → duplicate preference rows on concurrent upserts.
-        r.entity("notification-preference", notificationPreferenceEntity, {
-            table: notificationPreferencesTable,
+        r.entity({
+            name: "notification-preference",
+            ...notificationPreferenceEntity,
+            backingTable: notificationPreferencesTable,
         });
         // Same ride-along reason as notification-preference above: the
         // (tenant,addressHash,type,channel) uniqueIndex lives only on the
         // physical table.
-        r.entity("notification-address-opt-out", notificationAddressOptOutEntity, {
-            table: notificationAddressOptOutsTable,
+        r.entity({
+            name: "notification-address-opt-out",
+            ...notificationAddressOptOutEntity,
+            backingTable: notificationAddressOptOutsTable,
         });
         r.storeTable(deliveryAttemptsTableMeta, {
             reason: "read_side.delivery_attempt_log",

package/dist/delivery/handlers/resubscribe-address.write.js

@@ -2,6 +2,7 @@ import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { removeAddressOptOut } from "../address-opt-out.js";
+import { currentNotificationType, notificationTypeNames } from "../notification-type-aliases.js";
 export const resubscribeAddressWrite = defineWriteHandler({
     name: "resubscribeAddress",
     schema: z.object({
@@ -18,7 +19,8 @@ export const resubscribeAddressWrite = defineWriteHandler({
     agent: { expose: false, risk: "high" },
     description: "Removes a no-account address opt-out for one notificationType/channel combination; dispatched by the signed resubscribe route, not meant for UI callers.",
     handler: async (event, ctx) => {
-        const { addressHash, notificationType, channel } = event.payload;
+        const { addressHash, channel } = event.payload;
+        const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
         const { tenantId } = event.user;
         if (!ctx.systemDb) {
             throw new InternalError({
@@ -26,14 +28,16 @@ export const resubscribeAddressWrite = defineWriteHandler({
             });
         }
         const db = ctx.systemDb.assertTenantMatch(tenantId);
-        const result = await removeAddressOptOut(db, event.user, {
-            tenantId,
-            addressHash,
-            notificationType,
-            channel,
-        });
-        if (!result.isSuccess)
-            return result;
+        for (const name of notificationTypeNames(ctx.registry, notificationType)) {
+            const result = await removeAddressOptOut(db, event.user, {
+                tenantId,
+                addressHash,
+                notificationType: name,
+                channel,
+            });
+            if (!result.isSuccess)
+                return result;
+        }
         return { isSuccess: true, data: { notificationType, channel } };
     },
 });

package/dist/delivery/handlers/resubscribe-user.write.js

@@ -1,6 +1,7 @@
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { currentNotificationType } from "../notification-type-aliases.js";
 import { upsertPreference } from "../upsert-preference.js";
 export const resubscribeUserWrite = defineWriteHandler({
     name: "resubscribeUser",
@@ -16,7 +17,8 @@ export const resubscribeUserWrite = defineWriteHandler({
     agent: { expose: false },
     description: "Re-enables one notification type and channel combination for the userId carried in a verified unsubscribe token; dispatched by the signed resubscribe route, not meant for UI callers.",
     handler: async (event, ctx) => {
-        const { userId, notificationType, channel } = event.payload;
+        const { userId, channel } = event.payload;
+        const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
         const { tenantId } = event.user;
         if (!ctx.systemDb) {
             throw new InternalError({

package/dist/delivery/handlers/set-preference.write.js

@@ -1,6 +1,7 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { currentNotificationType } from "../notification-type-aliases.js";
 import { upsertPreference } from "../upsert-preference.js";
 export const setPreferenceWrite = defineWriteHandler({
     name: "setPreference",
@@ -18,7 +19,8 @@ export const setPreferenceWrite = defineWriteHandler({
     },
     description: "Enables or disables one notification type and channel combination for the calling user, where either side may be the wildcard * as a catch-all; use it when a user changes their own notification settings.",
     handler: async (event, ctx) => {
-        const { notificationType, channel, enabled } = event.payload;
+        const { channel, enabled } = event.payload;
+        const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
         const { id: userId, tenantId } = event.user;
         // delivery runs in system-scope (feature.ts r.systemScope()) — ctx.systemDb
         // is guaranteed there. No client-supplied userId exists on this payload;

package/dist/delivery/handlers/unsubscribe-address.write.d.ts

@@ -1,4 +1,10 @@
 import * as z from "zod";
+export declare const unsubscribeAddressPayloadSchema: z.ZodObject<{
+    addressHash: z.ZodString;
+    notificationType: z.ZodString;
+    channel: z.ZodString;
+}, z.core.$strip>;
+export type UnsubscribeAddressPayload = z.infer<typeof unsubscribeAddressPayloadSchema>;
 export declare const unsubscribeAddressWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"unsubscribeAddress", z.ZodObject<{
     addressHash: z.ZodString;
     notificationType: z.ZodString;

package/dist/delivery/handlers/unsubscribe-address.write.js

@@ -2,13 +2,17 @@ import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { upsertAddressOptOut } from "../address-opt-out.js";
+import { currentNotificationType } from "../notification-type-aliases.js";
+// Also the payload an app job receives with `trigger: { on: DeliveryHandlers.unsubscribeAddress }`
+// after a committed address opt-out (the tenant is the job's `ctx.triggeredBy.tenantId`).
+export const unsubscribeAddressPayloadSchema = z.object({
+    addressHash: z.string().min(1),
+    notificationType: z.string().min(1),
+    channel: z.string().min(1),
+});
 export const unsubscribeAddressWrite = defineWriteHandler({
     name: "unsubscribeAddress",
-    schema: z.object({
-        addressHash: z.string().min(1),
-        notificationType: z.string().min(1),
-        channel: z.string().min(1),
-    }),
+    schema: unsubscribeAddressPayloadSchema,
     access: { roles: access.systemAdmin },
     // Only reachable via createUnsubscribeRoutes' POST dispatchSystemWrite, once
     // verify() has already proven the address-token signature — not a surface
@@ -16,7 +20,8 @@ export const unsubscribeAddressWrite = defineWriteHandler({
     agent: { expose: false },
     description: "Records a no-account address opt-out for one notificationType/channel combination; dispatched by the signed unsubscribe route, not meant for UI callers.",
     handler: async (event, ctx) => {
-        const { addressHash, notificationType, channel } = event.payload;
+        const { addressHash, channel } = event.payload;
+        const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
         const { tenantId } = event.user;
         if (!ctx.systemDb) {
             throw new InternalError({

package/dist/delivery/handlers/unsubscribe-user.write.js

@@ -1,6 +1,7 @@
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { currentNotificationType } from "../notification-type-aliases.js";
 import { upsertPreference } from "../upsert-preference.js";
 export const unsubscribeUserWrite = defineWriteHandler({
     name: "unsubscribeUser",
@@ -18,7 +19,8 @@ export const unsubscribeUserWrite = defineWriteHandler({
     handler: async (event, ctx) => {
         // userId comes from the payload, not event.user.id — the caller here is
         // the system user dispatchSystemWrite runs as, not the user unsubscribing.
-        const { userId, notificationType, channel } = event.payload;
+        const { userId, channel } = event.payload;
+        const notificationType = currentNotificationType(ctx.registry, event.payload.notificationType);
         const { tenantId } = event.user;
         if (!ctx.systemDb) {
             throw new InternalError({

package/dist/delivery/index.d.ts

@@ -9,8 +9,11 @@ export type { DeliveryStatusValue } from "./constants.js";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, EMAIL_CHANNEL_NAME, } from "./constants.js";
 export { collectChannels, createDeliveryService, type DeliveryServiceOptions, type KillSwitchResolver, type RateLimitConfig, } from "./delivery-service.js";
 export { createDeliveryFeature, type DeliveryFeatureOptions } from "./feature.js";
+export { type UnsubscribeAddressPayload, unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.js";
 export { type CreateDeliveryTestContextOptions, createDeliveryTestContext } from "./testing.js";
 export { type AttachmentOrigin, type ChannelContext, type ChannelMessage, type ChannelResult, type DeliveryChannel, type DeliveryChannelMode, type DeliveryChannelPlugin, type DeliveryLogEntry, type DeliveryService, isDeliveryChannelPlugin, type RenderedMessage, } from "./types.js";
 export { type AddressUnsubscribeTokenPayload, createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, signAddressUnsubscribeToken, signUnsubscribeToken, type UnsubscribeRouteOptions, type UnsubscribeTokenPayload, } from "./unsubscribe.js";
+export type { UnsubscribeLinkConfig } from "./unsubscribe-link.js";
+export { UNSUBSCRIBE_PAGE_EN } from "./unsubscribe-page-strings.js";

package/dist/delivery/index.js

@@ -8,8 +8,10 @@ export { chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget,
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, EMAIL_CHANNEL_NAME, } from "./constants.js";
 export { collectChannels, createDeliveryService, } from "./delivery-service.js";
 export { createDeliveryFeature } from "./feature.js";
+export { unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.js";
 export { createDeliveryTestContext } from "./testing.js";
 export { isDeliveryChannelPlugin, } from "./types.js";
 export { createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, signAddressUnsubscribeToken, signUnsubscribeToken, } from "./unsubscribe.js";
+export { UNSUBSCRIBE_PAGE_EN } from "./unsubscribe-page-strings.js";

package/dist/delivery/notification-type-aliases.d.ts

@@ -0,0 +1,3 @@
+import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+export declare function notificationTypeNames(registry: Registry, type: string): readonly string[];
+export declare function currentNotificationType(registry: Registry, type: string): string;

package/dist/delivery/notification-type-aliases.js

@@ -0,0 +1,11 @@
+export function notificationTypeNames(registry, type) {
+    const renamedFrom = registry.getAllNotifications().get(type)?.renamedFrom ?? [];
+    return [type, ...renamedFrom];
+}
+export function currentNotificationType(registry, type) {
+    for (const [name, definition] of registry.getAllNotifications()) {
+        if (definition.renamedFrom?.includes(type))
+            return name;
+    }
+    return type;
+}

package/dist/delivery/testing.d.ts

@@ -8,6 +8,7 @@ import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import type { KillSwitchResolver, RateLimitConfig } from "./delivery-service.js";
 import type { DeliveryService } from "./types.js";
+import type { UnsubscribeLinkConfig } from "./unsubscribe-link.js";
 export type CreateDeliveryTestContextOptions = {
     readonly tenantUserIdsQuery?: string;
     readonly rateLimit?: RateLimitConfig;
@@ -19,6 +20,7 @@ export type CreateDeliveryTestContextOptions = {
     readonly idempotencyRedis?: Redis;
     readonly filesForTenant?: (tenantId: string) => FileContext | undefined;
     readonly tenantConfigFor?: (tenantId: TenantId) => ConfigAccessor;
+    readonly unsubscribeLinks?: UnsubscribeLinkConfig;
 };
 /**
  * Helper for setupTestStack: creates a DeliveryService + _notifyFactory for the test context.

package/dist/delivery/types.d.ts

@@ -1,6 +1,6 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { DeliveryErrorCode, NotifyDeliveryStatus, NotifyDispatched, NotifyJobDispatcher, NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { ConfigAccessor, DeliveryErrorCode, NotifyDeliveryStatus, NotifyDispatched, NotifyJobDispatcher, NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { MailPayload, RenderedTemplateRef } from "../renderer-foundation/index.js";
@@ -23,6 +23,7 @@ export type ChannelContext = {
     readonly sseBroker: SseBroker | undefined;
     readonly tenantId: TenantId;
     readonly secrets?: SecretsContext | undefined;
+    readonly config?: ConfigAccessor | undefined;
     readonly renderMail?: (payload: MailPayload) => Promise<RenderedMail>;
     readonly readAttachment?: (ref: EmailAttachmentRef, origin?: AttachmentOrigin) => Promise<{
         readonly content: Uint8Array;