@cosmicdrift/kumiko-bundled-features 0.368.0 → 0.369.0

package/dist/channel-email/email-channel.d.ts

@@ -2,15 +2,23 @@ import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type ChannelContext, type DeliveryChannel, type EmailAttachmentRef } from "../delivery/index.js";
 import type { EmailTransport } from "./types.js";
 export declare function fileAttachmentsFrom(data: Readonly<Record<string, unknown>> | undefined, messageLocale?: string): readonly EmailAttachmentRef[];
-export type EmailChannelOptions = {
-    /** The app-wide transport, used for every tenant `tenantTransport` returns null for. */
+/** Resolves the sending tenant's own transport, null when it has none. Built per send and
+ *  never cached, so a provider change applies to the next mail; a throw fails the send. */
+export type TenantTransportResolver = (ctx: ChannelContext) => Promise<EmailTransport | null>;
+type EmailChannelTransports = {
+    /** The app-wide transport for every mail that does not go through a tenant transport. */
     readonly transport: EmailTransport;
-    /** Resolves the sending tenant's own transport, null when it has none. Built per send and
-     *  never cached, so a provider change applies to the next mail; a throw fails the send. */
-    readonly tenantTransport?: (ctx: ChannelContext) => Promise<EmailTransport | null>;
+    /** Used only for notifications declared with `tenantTransport: true`. */
+    readonly tenantTransport?: TenantTransportResolver;
+} | {
+    readonly transport?: undefined;
+    readonly tenantTransport: TenantTransportResolver;
+};
+export type EmailChannelOptions = EmailChannelTransports & {
     readonly resolveEmail: (userId: string, ctx: {
         db: unknown;
         tenantId: TenantId;
     }) => Promise<string | null>;
 };
 export declare function createEmailChannel(options: EmailChannelOptions): DeliveryChannel;
+export {};

package/dist/channel-email/email-channel.js

@@ -1,7 +1,7 @@
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
-import { DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, DELIVERY_UNSUBSCRIBE_PATH, EMAIL_CHANNEL_NAME, fileAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, renderedPdfAttachmentRefSchema, } from "../delivery/index.js";
+import { currentNotificationType, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, DELIVERY_UNSUBSCRIBE_PATH, EMAIL_CHANNEL_NAME, fileAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, renderedPdfAttachmentRefSchema, } from "../delivery/index.js";
 import { decryptStoredPii, extensionForResourceContentType } from "../shared/index.js";
 import { guardEmailMessage } from "./pii-guard.js";
 // Envelope (From / Reply-To / threading headers) rides on the channel data —
@@ -121,6 +121,10 @@ async function resolveAttachments(sources, ctx) {
     }
     return { kind: "resolved", attachments: resolved };
 }
+function isTenantTransportNotification(ctx, notificationType) {
+    const current = currentNotificationType(ctx.registry, notificationType);
+    return ctx.registry.getAllNotifications().get(current)?.tenantTransport === true;
+}
 export function createEmailChannel(options) {
     const { transport, resolveEmail, tenantTransport } = options;
     // Render runs in the delivery.render job, decoupled from the SMTP send so
@@ -150,9 +154,11 @@ export function createEmailChannel(options) {
             ...(attachments !== undefined && { attachments }),
         };
     }
-    async function transportFor(ctx) {
+    async function transportFor(message, ctx) {
         if (tenantTransport === undefined)
             return transport;
+        if (!isTenantTransportNotification(ctx, message.notificationType))
+            return transport;
         return (await tenantTransport(ctx)) ?? transport;
     }
     return {
@@ -189,7 +195,15 @@ export function createEmailChannel(options) {
                 return { status: "failed", error: "send_failed", address };
             }
             const resolvedAttachments = resolution.attachments;
-            const sendTransport = await transportFor(ctx);
+            const sendTransport = await transportFor(message, ctx);
+            if (sendTransport === undefined) {
+                // Configuration, not a transient error: a retry cannot conjure a transport.
+                createFallbackLogger("delivery").warn("no mail transport for this mail, send failed", {
+                    tenantId: ctx.tenantId,
+                    notificationType: message.notificationType,
+                });
+                return { status: "failed", error: "missing_credentials", address };
+            }
             await sendTransport.send(guardEmailMessage({
                 to: address,
                 subject,

package/dist/channel-email/feature.js

@@ -4,7 +4,7 @@ import { createEmailChannel } from "./email-channel.js";
 export function createChannelEmailFeature(options) {
     const channel = createEmailChannel(options);
     return defineFeature("channel-email", (r) => {
-        r.describe("Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send each tenant's mail through its own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.");
+        r.describe("Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send the notifications declared with `tenantTransport: true` through the sending tenant's own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`; every other notification (password reset, sign-in) always goes through the app `transport`. `transport` may be left out when `tenantTransport` is set; a mail that then has no transport fails with `missing_credentials`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.");
         r.uiHints({
             displayLabel: "Email Channel",
             category: "notifications",

package/dist/channel-email/index.d.ts

@@ -1,4 +1,4 @@
-export { createEmailChannel, type EmailChannelOptions } from "./email-channel.js";
+export { createEmailChannel, type EmailChannelOptions, type TenantTransportResolver, } from "./email-channel.js";
 export { createChannelEmailFeature } from "./feature.js";
 export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.js";
 export { createSmtpTransport, createSmtpTransportFromEnv, type SmtpEnv, type SmtpTransportOptions, } from "./smtp-transport.js";

package/dist/channel-email/index.js

@@ -1,4 +1,4 @@
-export { createEmailChannel } from "./email-channel.js";
+export { createEmailChannel, } from "./email-channel.js";
 export { createChannelEmailFeature } from "./feature.js";
 export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.js";
 export { createSmtpTransport, createSmtpTransportFromEnv, } from "./smtp-transport.js";

package/dist/config/web/i18n.js

@@ -27,9 +27,8 @@ export const defaultTranslations = {
         "config.errors.invalidScope": "This scope is not allowed for this key.",
         "config.errors.unknownKey": "Unknown configuration key.",
         "config.errors.unknownExtensionPlugin": "This provider is not available.",
-        "config.settings.extensionSelectorHint": "Choose a provider and save. Its settings appear below.",
+        "config.settings.extensionSelectorHint": "Choose a provider. Its settings appear below and are saved together with it.",
         "config.settings.provider": "Provider",
-        "config.settings.saveProvider": "Save provider",
         "config.settings.audience.system": "Applies to every tenant unless a tenant sets its own value.",
         "config.settings.audience.tenant": "Applies to everyone in this tenant. Platform defaults are shown where nothing is set here.",
         "config.settings.audience.user": "Only applies to you.",

package/dist/delivery/feature.js

@@ -19,7 +19,7 @@ export function createDeliveryFeature(options) {
     const resolvedAccess = options?.access ?? access.admin;
     const attemptLogRetentionDays = resolveAttemptLogRetentionDays(options?.attemptLogRetentionDays);
     return defineFeature("delivery", (r) => {
-        r.describe("The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (`runProdApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.");
+        r.describe("The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (the `runProdApp` and `runDevApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. An app serving its own (e.g. legacy) unsubscribe links renders the same result page with `renderUnsubscribeResultPage({ kind, locale })`. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.");
         r.uiHints({
             displayLabel: "Notifications \u00b7 Dispatch Core",
             category: "notifications",

package/dist/delivery/index.d.ts

@@ -2,7 +2,7 @@ export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
 export { DELIVERY_ENVELOPE_DATA_KEYS, type EmailAttachmentRef, emailAttachmentRefSchema, type FileAttachmentRef, fileAttachmentRefSchema, type InlineAttachmentRef, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, type RenderedPdfAttachmentRef, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
 export { type AttemptLogRetentionOptions, DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
-export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
+export { buildChannelContext, createEmailAttachmentReader, createTemplateMailRenderer, } from "./channel-context.js";
 export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";
 export { type ChatSendFailureCode, type ChatSendResult, type ChatWebhookRequest, type ChatWebhookResponse, type ChatWebhookTarget, chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
 export type { DeliveryStatusValue } from "./constants.js";
@@ -10,10 +10,11 @@ export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_CHANNEL_EXTENSION, DELI
 export { collectChannels, createDeliveryService, type DeliveryServiceOptions, type KillSwitchResolver, type RateLimitConfig, } from "./delivery-service.js";
 export { createDeliveryFeature, type DeliveryFeatureOptions } from "./feature.js";
 export { type UnsubscribeAddressPayload, unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.js";
+export { currentNotificationType } from "./notification-type-aliases.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.js";
 export { type CreateDeliveryTestContextOptions, createDeliveryTestContext } from "./testing.js";
 export { type AttachmentOrigin, type ChannelContext, type ChannelMessage, type ChannelResult, type DeliveryChannel, type DeliveryChannelMode, type DeliveryChannelPlugin, type DeliveryLogEntry, type DeliveryService, isDeliveryChannelPlugin, type RenderedMessage, } from "./types.js";
-export { type AddressUnsubscribeTokenPayload, createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, signAddressUnsubscribeToken, signUnsubscribeToken, type UnsubscribeRouteOptions, type UnsubscribeTokenPayload, } from "./unsubscribe.js";
+export { type AddressUnsubscribeTokenPayload, createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, renderUnsubscribeResultPage, signAddressUnsubscribeToken, signUnsubscribeToken, type UnsubscribeResultPage, type UnsubscribeRouteOptions, type UnsubscribeTokenPayload, } from "./unsubscribe.js";
 export type { UnsubscribeLinkConfig } from "./unsubscribe-link.js";
 export { UNSUBSCRIBE_PAGE_EN } from "./unsubscribe-page-strings.js";

package/dist/delivery/index.js

@@ -2,16 +2,17 @@ export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
 export { DELIVERY_ENVELOPE_DATA_KEYS, emailAttachmentRefSchema, fileAttachmentRefSchema, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
 export { DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
-export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
+export { buildChannelContext, createEmailAttachmentReader, createTemplateMailRenderer, } from "./channel-context.js";
 export { chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";
 export { chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
 export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, EMAIL_CHANNEL_NAME, } from "./constants.js";
 export { collectChannels, createDeliveryService, } from "./delivery-service.js";
 export { createDeliveryFeature } from "./feature.js";
 export { unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.js";
+export { currentNotificationType } from "./notification-type-aliases.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.js";
 export { createDeliveryTestContext } from "./testing.js";
 export { isDeliveryChannelPlugin, } from "./types.js";
-export { createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, signAddressUnsubscribeToken, signUnsubscribeToken, } from "./unsubscribe.js";
+export { createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, renderUnsubscribeResultPage, signAddressUnsubscribeToken, signUnsubscribeToken, } from "./unsubscribe.js";
 export { UNSUBSCRIBE_PAGE_EN } from "./unsubscribe-page-strings.js";

package/dist/delivery/unsubscribe.d.ts

@@ -34,4 +34,17 @@ export declare function signUnsubscribeToken(payload: UnsubscribeTokenPayload, s
  */
 export declare function signAddressUnsubscribeToken(payload: AddressUnsubscribeTokenPayload, secret: string): Promise<string>;
 export declare const DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE: "List-Unsubscribe=One-Click";
+export type UnsubscribeResultPage = {
+    readonly kind: "unsubscribed";
+    readonly resubscribeToken?: string;
+} | {
+    readonly kind: "resubscribed";
+} | {
+    readonly kind: "failed";
+};
+/** The plain result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`. */
+export declare function renderUnsubscribeResultPage(page: UnsubscribeResultPage & {
+    readonly locale?: string | undefined;
+}): string;
 export declare function createUnsubscribeRoutes(options: UnsubscribeRouteOptions): readonly ExtraRouteDefinition[];

package/dist/delivery/unsubscribe.js

@@ -272,23 +272,30 @@ function confirmationPage(token, locale) {
 <button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.confirmButton"))}</button>
 </form>`);
 }
-function unsubscribedPage(resubscribeToken, locale) {
-    const lang = pageLocale(locale);
-    return htmlPage(lang, mailT(lang, "mail.unsubscribe.doneTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>
+/** The plain result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`. */
+export function renderUnsubscribeResultPage(page) {
+    const lang = pageLocale(page.locale);
+    switch (page.kind) {
+        case "unsubscribed": {
+            const undoForm = page.resubscribeToken === undefined
+                ? ""
+                : `
 <form method="post" action="${DELIVERY_RESUBSCRIBE_PATH}">
-<input type="hidden" name="token" value="${escapeHtmlAttr(resubscribeToken)}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(page.resubscribeToken)}">
 <button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.undoButton"))}</button>
-</form>`);
-}
-function resubscribedPage(locale) {
-    const lang = pageLocale(locale);
-    return htmlPage(lang, mailT(lang, "mail.unsubscribe.resubscribedTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`);
-}
-function failedPage(locale) {
-    const lang = pageLocale(locale);
-    const message = mailT(lang, "mail.unsubscribe.failed");
-    return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
+</form>`;
+            return htmlPage(lang, mailT(lang, "mail.unsubscribe.doneTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>${undoForm}`);
+        }
+        case "resubscribed":
+            return htmlPage(lang, mailT(lang, "mail.unsubscribe.resubscribedTitle"), `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`);
+        case "failed": {
+            const message = mailT(lang, "mail.unsubscribe.failed");
+            return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
+        }
+    }
 }
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
 function isFormRequest(contentType) {
     return contentType?.includes("application/x-www-form-urlencoded") === true;
 }
@@ -350,9 +357,13 @@ export function createUnsubscribeRoutes(options) {
             // (e.g. events-table missing, DB down) behind a misleading 400.
             const succeeded = await dispatchUnsubscribeWrite(verified, deps);
             if (!succeeded) {
-                return c.html(failedPage(verified.locale), 500, { "Cache-Control": "no-store" });
+                return c.html(renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }), 500, NO_STORE_HEADERS);
             }
-            return c.html(unsubscribedPage(await signResubscribeToken(verified, encodedSecret), verified.locale), 200, { "Cache-Control": "no-store" });
+            return c.html(renderUnsubscribeResultPage({
+                kind: "unsubscribed",
+                resubscribeToken: await signResubscribeToken(verified, encodedSecret),
+                locale: verified.locale,
+            }), 200, NO_STORE_HEADERS);
         },
     });
     // Undo direction: token only from the JSON/form body, never the query
@@ -368,22 +379,16 @@ export function createUnsubscribeRoutes(options) {
             // The undo button on the unsubscribed page posts a form; a browser should land on a page.
             if (isFormRequest(c.req.header("content-type"))) {
                 return outcome === "success"
-                    ? c.html(resubscribedPage(verified.locale), 200, { "Cache-Control": "no-store" })
-                    : c.html(failedPage(verified.locale), outcome === "limit_reached" ? 409 : 500, {
-                        "Cache-Control": "no-store",
-                    });
+                    ? c.html(renderUnsubscribeResultPage({ kind: "resubscribed", locale: verified.locale }), 200, NO_STORE_HEADERS)
+                    : c.html(renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }), outcome === "limit_reached" ? 409 : 500, NO_STORE_HEADERS);
             }
             if (outcome === "limit_reached") {
-                return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, {
-                    "Cache-Control": "no-store",
-                });
+                return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, NO_STORE_HEADERS);
             }
             if (outcome === "failed") {
-                return c.json({ error: { code: "resubscribe_failed" } }, 500, {
-                    "Cache-Control": "no-store",
-                });
+                return c.json({ error: { code: "resubscribe_failed" } }, 500, NO_STORE_HEADERS);
             }
-            return c.json({ isSuccess: true }, 200, { "Cache-Control": "no-store" });
+            return c.json({ isSuccess: true }, 200, NO_STORE_HEADERS);
         },
     });
     return [confirmRoute, writeRoute, resubscribeRoute];

package/dist/mail-foundation/feature.d.ts

@@ -46,6 +46,10 @@ export type MailTransportContext = {
  */
 export type MailTransportPlugin = {
     readonly build: (ctx: MailTransportContext, tenantId: string) => Promise<EmailTransport>;
+    /** `false` keeps the provider out of the generated settings: it can still be set by a
+     *  seed or config write, but a tenant admin is never offered it (e.g. a test inbox
+     *  that swallows every mail). */
+    readonly selectableInSettings?: false;
 };
 export declare function isMailTransportPlugin(o: unknown): o is MailTransportPlugin;
 declare module "@cosmicdrift/kumiko-framework/engine" {

package/dist/mail-foundation/feature.js

@@ -33,6 +33,7 @@
 import { withPiiCiphertextGuard, } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { requireDefined } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { access, createSystemUser, createTenantConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { MAIL_FOUNDATION_I18N } from "./i18n.js";
 const FEATURE_NAME = "mail-foundation";
 // Extension-point name for transport-provider plugins (mail-transport-smtp,
 // mail-transport-brevo-api, ...).
@@ -47,7 +48,7 @@ export function isMailTransportPlugin(o) {
 // =============================================================================
 export function createMailFoundationFeature() {
     return defineFeature(FEATURE_NAME, (r) => {
-        r.describe("Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature` so a tenant with a provider configured sends delivery mails through its own transport and other tenants through the app transport.");
+        r.describe("Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature`: notifications declared with `tenantTransport: true` then go through the tenant's own transport when it has a provider and through the app transport otherwise. Tenant admins pick the provider and fill in its settings on the generated Email sending settings screen; an empty provider is a valid choice and means the platform sends.");
         r.uiHints({
             displayLabel: "Mail Transport Foundation",
             category: "notifications",
@@ -64,24 +65,27 @@ export function createMailFoundationFeature() {
                 // delivery's extendsRegistrar.
             },
         });
-        // Provider-selector. Default empty so the boot-validator throws if a
-        // tenant tries to send mail without first picking + setting up a
-        // provider — better than a silent fallback. The actual list of valid
-        // values lives in the registered plugins, not here — Designer-UI can
-        // render `getExtensionUsages("mailTransport").map(u => u.entityName)`
-        // as the option-list.
+        // Empty = this tenant has no own provider: tenantMailTransport yields null and
+        // channel-email uses the app transport, so empty is a valid choice a tenant can
+        // return to (reset in the settings mask) and readiness must not flag it.
+        // createTransportForTenant still throws on empty.
         const providerConfigKey = r.config("provider", createTenantConfig("text", {
             default: "",
-            // required: without a chosen provider createTransportForTenant throws —
-            // readiness used to report ready:true and the first mail send
-            // surfaced the UnconfiguredError (280/1).
-            required: true,
-            write: access.roles("TenantAdmin", "SystemAdmin"),
+            // No SystemAdmin: a platform-level provider would be inherited by every tenant,
+            // whose own credentials (tenant secrets) are missing, and break all their mail.
+            write: access.withSystem(access.roles("TenantAdmin")),
             read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+            mask: {
+                title: "mail-foundation.provider",
+                description: "mail-foundation.provider.description",
+                icon: "mail",
+                order: 1,
+            },
         }));
         // Readiness gating: transport-plugins' required keys/secrets count only
         // while their plugin is the one this key selects.
         r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
+        r.translations({ keys: MAIL_FOUNDATION_I18N });
         return {
             /** Config-key-handle for the provider-selector. */
             providerConfigKey,

package/dist/mail-foundation/i18n.d.ts

@@ -0,0 +1,14 @@
+export declare const MAIL_FOUNDATION_I18N: {
+    readonly "screen:mail-foundation-tenant.title": {
+        readonly en: "Email sending";
+    };
+    readonly "mail-foundation.settings": {
+        readonly en: "Email sending";
+    };
+    readonly "mail-foundation.provider": {
+        readonly en: "Own mail server";
+    };
+    readonly "mail-foundation.provider.description": {
+        readonly en: "Without one, the platform sends the mails. Reset the choice to go back to that.";
+    };
+};

package/dist/mail-foundation/i18n.js

@@ -0,0 +1,8 @@
+export const MAIL_FOUNDATION_I18N = {
+    "screen:mail-foundation-tenant.title": { en: "Email sending" },
+    "mail-foundation.settings": { en: "Email sending" },
+    "mail-foundation.provider": { en: "Own mail server" },
+    "mail-foundation.provider.description": {
+        en: "Without one, the platform sends the mails. Reset the choice to go back to that.",
+    },
+};

package/dist/mail-transport-inmemory/feature.js

@@ -69,6 +69,9 @@ export function createMailTransportInMemoryFeature() {
         // extension-point "mailTransport" definiert.
         r.requires({ features: ["mail-foundation"] });
         const plugin = {
+            // Solon and studio mount it next to smtp in production; offering it there would
+            // let a tenant admin route every mail into process memory.
+            selectableInSettings: false,
             build: async (_ctx, tenantId) => {
                 // Returns the per-tenant buffer. Identity-stable across calls so the
                 // demo inbox keeps accumulating.
@@ -76,6 +79,9 @@ export function createMailTransportInMemoryFeature() {
             }, // @wrapper-known semantic-alias
         };
         r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
+        r.translations({
+            keys: { "mail-transport-inmemory.settings": { en: "Test inbox (in memory)" } },
+        });
     }, { dedupeOptions: {} });
 }
 /** @deprecated Use createMailTransportInMemoryFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */

package/dist/mail-transport-smtp/config-keys.d.ts

@@ -0,0 +1,7 @@
+export declare const SMTP_CONFIG_KEYS: {
+    host: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"text">;
+    port: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"number">;
+    secure: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"boolean">;
+    authUser: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"text">;
+    from: import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"text">;
+};

package/dist/mail-transport-smtp/config-keys.js

@@ -0,0 +1,65 @@
+import { access, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+// No SystemAdmin write: the password is a tenant secret, so platform-level SMTP keys
+// could never form a working transport (see mail-foundation's provider key).
+const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
+const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
+// required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+export const SMTP_CONFIG_KEYS = {
+    host: createTenantConfig("text", {
+        required: true,
+        default: "",
+        write: tenantAdminWrite,
+        read: tenantAdminRead,
+        mask: {
+            title: "mail-transport-smtp.host",
+            description: "mail-transport-smtp.host.description",
+            icon: "server",
+            order: 1,
+        },
+    }),
+    port: createTenantConfig("number", {
+        default: 587,
+        bounds: { min: 1, max: 65535 },
+        write: tenantAdminWrite,
+        mask: {
+            title: "mail-transport-smtp.port",
+            description: "mail-transport-smtp.port.description",
+            icon: "hash",
+            order: 2,
+        },
+    }),
+    secure: createTenantConfig("boolean", {
+        default: false,
+        write: tenantAdminWrite,
+        mask: {
+            title: "mail-transport-smtp.secure",
+            description: "mail-transport-smtp.secure.description",
+            icon: "lock",
+            order: 3,
+        },
+    }),
+    authUser: createTenantConfig("text", {
+        required: true,
+        default: "",
+        write: tenantAdminWrite,
+        read: tenantAdminRead,
+        mask: {
+            title: "mail-transport-smtp.authUser",
+            description: "mail-transport-smtp.authUser.description",
+            icon: "user",
+            order: 4,
+        },
+    }),
+    from: createTenantConfig("text", {
+        required: true,
+        default: "",
+        write: tenantAdminWrite,
+        read: tenantAdminRead,
+        mask: {
+            title: "mail-transport-smtp.from",
+            description: "mail-transport-smtp.from.description",
+            icon: "mail",
+            order: 5,
+        },
+    }),
+};

package/dist/mail-transport-smtp/feature.d.ts

@@ -11,8 +11,8 @@ export declare function createMailTransportSmtpFeature(): import("@cosmicdrift/k
             readonly host: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
             readonly port: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
             readonly secure: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"boolean">;
-            readonly from: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
             readonly authUser: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+            readonly from: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
         };
         /** Secret-handle for the SMTP password. */
         password: import("@cosmicdrift/kumiko-types/feature").SecretKeyHandle;
@@ -27,8 +27,8 @@ export declare const mailTransportSmtpFeature: import("@cosmicdrift/kumiko-types
             readonly host: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
             readonly port: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"number">;
             readonly secure: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"boolean">;
-            readonly from: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
             readonly authUser: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
+            readonly from: import("@cosmicdrift/kumiko-types/config").ConfigKeyHandle<"text">;
         };
         /** Secret-handle for the SMTP password. */
         password: import("@cosmicdrift/kumiko-types/feature").SecretKeyHandle;

package/dist/mail-transport-smtp/feature.js

@@ -28,9 +28,11 @@ import { createSmtpTransport, } from "@cosmicdrift/kumiko-bundled-features/chann
 import { BlockedHostError, HostResolutionError, mailAllowedPrivateHostsEnvSchema, readAllowedPrivateMailHostsFromEnv, requireDefined, requireNonEmpty, requireSecretSet, resolveMailConnectTarget, } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
 import { MAIL_TRANSPORT_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { SMTP_CONFIG_KEYS } from "./config-keys.js";
+import { MAIL_TRANSPORT_SMTP_I18N } from "./i18n.js";
 const FEATURE_NAME = "mail-transport-smtp";
 const log = createFallbackLogger(FEATURE_NAME);
 // Operator escape hatch for an internal relay or a dev/test SMTP server
@@ -77,38 +79,8 @@ export function createMailTransportSmtpFeature() {
             // required: true ↔ the missing-secret throw in readPassword — keep in sync.
             required: true,
         });
-        // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
-        const configKeys = r.config({
-            keys: {
-                host: createTenantConfig("text", {
-                    required: true,
-                    default: "",
-                    write: access.roles("TenantAdmin", "SystemAdmin"),
-                    read: access.roles("TenantAdmin", "SystemAdmin"),
-                }),
-                port: createTenantConfig("number", {
-                    default: 587,
-                    bounds: { min: 1, max: 65535 },
-                    write: access.roles("TenantAdmin", "SystemAdmin"),
-                }),
-                secure: createTenantConfig("boolean", {
-                    default: false,
-                    write: access.roles("TenantAdmin", "SystemAdmin"),
-                }),
-                from: createTenantConfig("text", {
-                    required: true,
-                    default: "",
-                    write: access.roles("TenantAdmin", "SystemAdmin"),
-                    read: access.roles("TenantAdmin", "SystemAdmin"),
-                }),
-                authUser: createTenantConfig("text", {
-                    required: true,
-                    default: "",
-                    write: access.roles("TenantAdmin", "SystemAdmin"),
-                    read: access.roles("TenantAdmin", "SystemAdmin"),
-                }),
-            },
-        });
+        const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
+        r.translations({ keys: MAIL_TRANSPORT_SMTP_I18N });
         // Plugin: register against mail-foundation's "mailTransport" extension.
         // `entityName` "smtp" is what tenants set in mail-foundation's
         // `provider` config-key to pick this transport.

package/dist/mail-transport-smtp/i18n.d.ts

@@ -0,0 +1,41 @@
+export declare const MAIL_TRANSPORT_SMTP_I18N: {
+    readonly "mail-transport-smtp.settings": {
+        readonly en: "SMTP server";
+    };
+    readonly "mail-transport-smtp.settings.secrets": {
+        readonly en: "SMTP sign-in";
+    };
+    readonly "mail-transport-smtp.settings.description": {
+        readonly en: "The connection details come from your mail provider, for example Brevo, Postmark, Amazon SES or your own server.";
+    };
+    readonly "mail-transport-smtp.host": {
+        readonly en: "Server address";
+    };
+    readonly "mail-transport-smtp.host.description": {
+        readonly en: "Host name of the SMTP server, for example smtp.example.com.";
+    };
+    readonly "mail-transport-smtp.port": {
+        readonly en: "Port number";
+    };
+    readonly "mail-transport-smtp.port.description": {
+        readonly en: "Usually 587. Use 465 when your provider asks for SSL/TLS.";
+    };
+    readonly "mail-transport-smtp.secure": {
+        readonly en: "SSL/TLS from the start";
+    };
+    readonly "mail-transport-smtp.secure.description": {
+        readonly en: "Turn on for port 465. Leave off for 587, which switches to encryption by itself.";
+    };
+    readonly "mail-transport-smtp.authUser": {
+        readonly en: "User name";
+    };
+    readonly "mail-transport-smtp.authUser.description": {
+        readonly en: "Login name at the SMTP server, often an email address.";
+    };
+    readonly "mail-transport-smtp.from": {
+        readonly en: "Sender address";
+    };
+    readonly "mail-transport-smtp.from.description": {
+        readonly en: "The address mails are sent from, for example status@example.com. Your provider must allow it.";
+    };
+};

package/dist/mail-transport-smtp/i18n.js

@@ -0,0 +1,28 @@
+export const MAIL_TRANSPORT_SMTP_I18N = {
+    // Also the option label of mail-foundation's provider select.
+    "mail-transport-smtp.settings": { en: "SMTP server" },
+    "mail-transport-smtp.settings.secrets": { en: "SMTP sign-in" },
+    "mail-transport-smtp.settings.description": {
+        en: "The connection details come from your mail provider, for example Brevo, Postmark, Amazon SES or your own server.",
+    },
+    "mail-transport-smtp.host": { en: "Server address" },
+    "mail-transport-smtp.host.description": {
+        en: "Host name of the SMTP server, for example smtp.example.com.",
+    },
+    "mail-transport-smtp.port": { en: "Port number" },
+    "mail-transport-smtp.port.description": {
+        en: "Usually 587. Use 465 when your provider asks for SSL/TLS.",
+    },
+    "mail-transport-smtp.secure": { en: "SSL/TLS from the start" },
+    "mail-transport-smtp.secure.description": {
+        en: "Turn on for port 465. Leave off for 587, which switches to encryption by itself.",
+    },
+    "mail-transport-smtp.authUser": { en: "User name" },
+    "mail-transport-smtp.authUser.description": {
+        en: "Login name at the SMTP server, often an email address.",
+    },
+    "mail-transport-smtp.from": { en: "Sender address" },
+    "mail-transport-smtp.from.description": {
+        en: "The address mails are sent from, for example status@example.com. Your provider must allow it.",
+    },
+};

package/dist/secrets/feature.d.ts

@@ -22,6 +22,7 @@ export declare const secretsEnvSchema: z.ZodObject<{
 }, z.core.$strip>;
 export { createSecretsContext, type SecretsContext, type SecretsContextOptions, TENANT_SECRET_READ_EVENT, } from "./secrets-context.js";
 export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.js";
+export declare const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 export declare function requireSecretsContext(ctx: {
     readonly secrets?: SecretsContext;
     readonly _userId?: string | undefined;

package/dist/secrets/feature.js

@@ -1,4 +1,4 @@
-import { defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature, SYSTEM_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import * as z from "zod";
@@ -44,6 +44,9 @@ export const secretsEnvSchema = z.object({
 });
 export { createSecretsContext, TENANT_SECRET_READ_EVENT, } from "./secrets-context.js";
 export { tenantSecretsTable } from "./table.js";
+// The settings form saves config values and secrets in one /api/batch; the secret
+// write has to join that transaction so a rejected command rolls it back too.
+export const JOIN_REQUEST_TRANSACTION_REASON = "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
 // AppContext carries ctx.secrets via extraContext. requireSecretsContext
 // wraps that raw context so every `.get(...)` call auto-includes the
 // current user + handler as audit metadata — feature code can't forget
@@ -90,10 +93,19 @@ function resolveSecretsAccess(opts) {
         return { roles: opts.roles };
     return DEFAULT_SECRETS_ACCESS;
 }
+// Server-side system writes (dispatchSystemWrite, e.g. a wire hook migrating credentials) take the
+// same declared-key gate, value check and cache-sync announce as an admin instead of bypassing them
+// via SecretsContext.set. The system role is in-process only and never minted into a session.
+function withSystemWriter(rule) {
+    if (!("roles" in rule) || rule.roles.includes(SYSTEM_ROLE))
+        return rule;
+    return { ...rule, roles: [SYSTEM_ROLE, ...rule.roles] };
+}
 export function createSecretsFeature(opts = {}) {
     const access = resolveSecretsAccess(opts);
+    const writeAccess = withSystemWriter(access);
     return defineFeature(SECRETS_FEATURE_NAME, (r) => {
-        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins).');
+        r.describe('Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: "secrets:write:set", payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.');
         r.uiHints({
             displayLabel: "Tenant Secrets",
             category: "infrastructure",
@@ -128,8 +140,8 @@ export function createSecretsFeature(opts = {}) {
         // The rotation job deliberately reaches for ctx.db.unsafeRaw() (raw,
         // cross-tenant) because rotation is a deployment-wide operation — no
         // feature-wide r.systemScope() needed.
-        r.writeHandler(createSetHandler(access));
-        r.writeHandler(createDeleteHandler(access));
+        r.writeHandler(createSetHandler(writeAccess));
+        r.writeHandler(createDeleteHandler(writeAccess));
         r.queryHandler(createListHandler(access));
         // Manual-only by design: ops triggers rotation after a KEK version flip.
         // BullMQ delivers to exactly one worker, so running it against a busy

package/dist/secrets/handlers/delete.write.js

@@ -3,7 +3,7 @@ import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { requireSecretsContext } from "../feature.js";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
 export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
@@ -14,8 +14,9 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
             key: z.string().min(1).max(100),
         }),
         access,
+        escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:delete");
+            const secrets = requireSecretsContext(ctx, "secrets:write:delete").withRunner(ctx.db.unsafeRaw());
             const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
                 allowUndeclared: true,
             });

package/dist/secrets/handlers/set.write.js

@@ -2,7 +2,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { requireSecretsContext } from "../feature.js";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
@@ -21,8 +21,9 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
             hint: z.string().max(200).optional(),
         }),
         access,
+        escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
         handler: async (event, ctx) => {
-            const secrets = requireSecretsContext(ctx, "secrets:write:set");
+            const secrets = requireSecretsContext(ctx, "secrets:write:set").withRunner(ctx.db.unsafeRaw());
             const { key, value, redactedPreview, hint } = event.payload;
             // Preview-priority: explicit payload param > feature-declared redact
             // (via r.secret()) > generic default. A feature that declared a

package/dist/template-resolver/constants.d.ts

@@ -23,7 +23,6 @@ export declare const HEX_COLOR_PATTERN: RegExp;
 export declare const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export declare const DEFAULT_PDF_LAYOUT_SLUG = "default";
 export declare const MAIL_PREVIEW_MAX_BYTES: number;
-export declare const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
 export declare const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 export { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 export declare const FALLBACK_LOCALE = "de";

package/dist/template-resolver/constants.js

@@ -59,7 +59,6 @@ export const DEFAULT_MAIL_LAYOUT_SLUG = "default";
 export const DEFAULT_PDF_LAYOUT_SLUG = "default";
 // The mail transport enforces no size limit of its own; 10 MiB is a common provider ceiling.
 export const MAIL_PREVIEW_MAX_BYTES = 10 * 1024 * 1024;
-export const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
 export const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 // System-Templates leben unter der canonical SYSTEM_TENANT_ID-Sentinel-UUID.
 // Re-Export aus framework — single source of truth, vermeidet Drift.

package/dist/template-resolver/handlers/send-test.write.js

@@ -3,7 +3,7 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import * as z from "zod";
 import { collectChannels, createEmailAttachmentReader, EMAIL_CHANNEL_NAME, } from "../../delivery/index.js";
 import { fileContextForTenant } from "../../file-foundation/index.js";
-import { TEST_MAIL_NOTIFICATION_TYPE, TEST_MAIL_SUBJECT_PREFIX } from "../constants.js";
+import { TEST_MAIL_SUBJECT_PREFIX } from "../constants.js";
 import { TemplateResolverErrors } from "../qualified-names.js";
 import { renderTemplatePreview } from "../template-preview.js";
 import { localeSchema, templateSlugSchema } from "./shared.js";
@@ -61,6 +61,7 @@ export const sendTestWrite = defineWriteHandler({
             sseBroker: undefined,
             tenantId: event.user.tenantId,
             secrets: ctx.secrets,
+            config: ctx.config,
             readAttachment: createEmailAttachmentReader(ctx.db, ctx.registry, event.user.tenantId, ctx.config, (tenantId) => fileContextForTenant(ctx, ctx.user.tenantId, tenantId)),
         };
         const address = (await channel.resolve?.(event.user.id, channelContext)) ?? null;
@@ -73,7 +74,8 @@ export const sendTestWrite = defineWriteHandler({
         let sentStatus;
         try {
             const result = await channel.send(address, {
-                notificationType: TEST_MAIL_NOTIFICATION_TYPE,
+                // The template slug is the notification name, so the test mail takes the transport the real mail takes.
+                notificationType: event.payload.slug,
                 title: subject,
                 body: undefined,
                 data: undefined,

package/dist/user-data-rights/feature.js

@@ -521,15 +521,18 @@ export function createUserDataRightsFeature(opts = {}) {
                     db: forgetDb,
                     userId: forgetUserId,
                 });
-                // Without an app callback the default mail goes out when a mail transport and a
-                // mail renderer are mounted. The user is already erased here, so it bypasses the
-                // delivery log: an attempt row would be new personal data.
+                // Without an app callback the default mail goes out when an email channel or a
+                // mail transport, plus a mail renderer, are mounted. The user is already erased
+                // here, so it bypasses the delivery log: an attempt row would be new personal data.
                 const forgetConfigResolver = ctx.configResolver;
                 const sendDeletionExecutedEmail = opts.sendDeletionExecutedEmail ??
-                    (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+                    ((isGdprMailDeliveryAvailable(forgetRegistry) ||
+                        isMailTransportAvailable(forgetRegistry)) &&
+                        isMailRendererAvailable(forgetRegistry)
                         ? makeDefaultDeletionExecutedEmail({
                             registry: forgetRegistry,
                             db: forgetDb,
+                            ...(ctx.secrets !== undefined && { secrets: ctx.secrets }),
                             resolveTransport: makeTenantMailTransportResolver({
                                 registry: forgetRegistry,
                                 configResolver: forgetConfigResolver,

package/dist/user-data-rights/lib/default-mailers.d.ts

@@ -1,6 +1,7 @@
 import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigAccessor, NotifyFn, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { type GdprMailLocale } from "../email-templates.js";
 import type { SendDeletionRequestedEmailFn } from "../handlers/request-deletion.write.js";
 import type { SendExportFailedEmailFn, SendExportReadyEmailFn } from "../run-export-jobs.js";
@@ -19,7 +20,9 @@ export declare function makeDefaultDeletionRequestedEmail(notify: NotifyFn, defa
 export type DeletionExecutedMailDeps = {
     readonly registry: Registry;
     readonly db: DbConnection;
+    /** Used only when no email delivery channel is mounted. */
     readonly resolveTransport: (tenantId: string) => Promise<EmailTransport>;
     readonly configFor: (tenantId: TenantId) => ConfigAccessor | undefined;
+    readonly secrets?: SecretsContext;
 };
 export declare function makeDefaultDeletionExecutedEmail(deps: DeletionExecutedMailDeps, defaults?: GdprMailDefaults): SendDeletionExecutedEmailFn;

package/dist/user-data-rights/lib/default-mailers.js

@@ -7,11 +7,11 @@
 // to the user, so delivery resolves the address and the attempt row carries
 // the recipientId the forget path erases. Deletion-executed cannot: the user
 // is gone by then, and an attempt row written after the erasure would be new
-// personal data. It renders the seeded template and sends over the tenant's
-// mail transport, with no delivery log.
+// personal data. It renders the seeded template and sends it straight through the
+// email channel (or, without one, the tenant's mail transport), with no delivery log.
 import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { hasMailTranslations, mailT } from "@cosmicdrift/kumiko-framework/i18n";
-import { DELIVERY_CHANNEL_EXTENSION } from "../../delivery/index.js";
+import { buildChannelContext, collectChannels, DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, } from "../../delivery/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, } from "../../renderer-foundation/index.js";
 import { formatGdprMailTimestamp, normalizeGdprMailLocale, } from "../email-templates.js";
 import { GdprMailNotificationTypes, gdprMailTemplateLocale } from "../mail-notifications.js";
@@ -88,6 +88,9 @@ export function makeDefaultDeletionRequestedEmail(notify, defaults = {}) {
         });
     };
 }
+function emailChannelOf(registry) {
+    return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
 export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
     return async (args) => {
         // Der User ist global, der Mail-Transport per-Tenant — wir senden ueber den
@@ -121,6 +124,25 @@ export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
         if (rendered.kind !== "mail") {
             throw new Error(`deletion-executed mail: renderer answered with kind "${rendered.kind}"`);
         }
+        // The channel picks the same transport as every other mail of this notification
+        // (the app transport unless it is declared tenantTransport), so a tenant without
+        // its own mail provider still gets the confirmation. channel.send writes no attempt row.
+        const channel = emailChannelOf(deps.registry);
+        if (channel !== undefined) {
+            const result = await channel.send(args.userEmail, {
+                notificationType: type,
+                title: rendered.subject,
+                body: undefined,
+                data: undefined,
+                locale,
+            }, buildChannelContext(deps.db, deps.registry, undefined, tenantId, deps.secrets, config), { subject: rendered.subject, html: rendered.html, text: rendered.text });
+            if (result.status !== "sent") {
+                // No address in the message: the user is already erased.
+                throw new Error(`deletion-executed mail not sent: ${result.error ?? result.status}`);
+            }
+            // skip: the channel delivered it, the transport fallback below is for apps without one
+            return;
+        }
         const transport = await deps.resolveTransport(tenantId);
         await transport.send({
             to: args.userEmail,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.368.0",
+  "version": "0.369.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -528,12 +528,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.368.0",
-    "@cosmicdrift/kumiko-framework": "0.368.0",
-    "@cosmicdrift/kumiko-headless": "0.368.0",
-    "@cosmicdrift/kumiko-renderer": "0.368.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.368.0",
-    "@cosmicdrift/kumiko-types": "0.368.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.369.0",
+    "@cosmicdrift/kumiko-framework": "0.369.0",
+    "@cosmicdrift/kumiko-headless": "0.369.0",
+    "@cosmicdrift/kumiko-renderer": "0.369.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.369.0",
+    "@cosmicdrift/kumiko-types": "0.369.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1086,12 +1086,12 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.368.0",
-    "@cosmicdrift/kumiko-locale-es": "0.368.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.368.0",
+    "@cosmicdrift/kumiko-locale-de": "0.369.0",
+    "@cosmicdrift/kumiko-locale-es": "0.369.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.369.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.368.0"
+    "@cosmicdrift/kumiko-testing": "0.369.0"
   },
   "peerDependencies": {
     "@cosmicdrift/kumiko-testing": ">=0.366.0 <1.0.0"

package/src/channel-email/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "The tenant mail transport applies per notification",
+    "detail": "r.notification(name, { tenantTransport: true }) marks a notification whose mails go through the tenant's own mail transport. channel-email consults its tenantTransport resolver only for these (also under a renamedFrom name); every other notification, such as password reset or sign-in mails, always takes the app transport, even when the tenant has a provider. With tenantTransport set, transport may be omitted: a mail that then has no transport fails with missing_credentials instead of throwing. The template test mail (template-resolver send-test) now gets the tenant config in its channel context and uses the template's notification, so it leaves through the same transport as the real mail.",
+    "migration": "Apps that pass tenantTransport to createChannelEmailFeature add `tenantTransport: true` to every r.notification whose mails should go through the tenant's provider; without the flag those mails now go through the app transport. Apps without an app SMTP server can drop transport and keep tenantTransport."
+  },
   {
     "version": "0.367.0",
     "type": "improvement",

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "improvement",
+    "title": "Unsubscribe links in dev and a reusable result page",
+    "detail": "runDevApp accepts unsubscribe: { secret, tenantOrigin? } like runProdApp, mounts the unsubscribe routes and signs the links (base URL from auth.mail.baseUrl or APP_BASE_URL). Both share resolveUnsubscribeWiring from server-runtime. delivery exports renderUnsubscribeResultPage({ kind: \"unsubscribed\" | \"resubscribed\" | \"failed\", locale, resubscribeToken? }), the page the unsubscribe routes answer with, for apps that serve their own (e.g. legacy) unsubscribe links; without a resubscribeToken it offers no undo button."
+  },
   {
     "version": "0.367.0",
     "type": "improvement",

package/src/mail-transport-smtp/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "Tenant admins edit their own SMTP server on the Email sending screen",
+    "detail": "mail-foundation's provider key and the SMTP keys (host, port, SSL/TLS, user name, sender address) carry settings masks, so the generated Settings-Hub shows tenant admins one Email sending form: the provider choice, the chosen provider's connection fields and its password, each field with a help text and every label in English, German and Spanish, saved together by one Save button in one /api/batch. Switching the provider swaps the fields at once; fields of a provider that is not selected are not saved. A selector owner's selection screen (`<owner>-tenant-selection`) now carries the plugins' config keys (field id `<owner>-<key>`) and secrets (field id `<plugin>-<key>`, listed in the new ConfigEditScreenDefinition.secretKeys) behind a visible condition on the provider field; the separate `<plugin>-tenant` and `<plugin>-tenant-secrets` screens and their dashboard panels are gone, and so is the `config.settings.saveProvider` label. A secret with its own writeRoles stays on the global secrets screen. Boot validation checks every secretKeys field (tenant scope, writeOnly text, declared secret). The configEdit renderer loads secretKeys fields from secrets:query:list (set or unset, no preview), writes them with secrets:write:set or secrets:write:delete in the same batch, and leaves hidden fields out. The provider key is no longer required: empty means the tenant has no own server and the platform sends, so readiness no longer reports it as missing (createTransportForTenant still throws on an empty provider). The provider and SMTP keys are written by TenantAdmin and the system identity, no longer by SystemAdmin, because a platform-level provider would reach every tenant without that tenant's password. The secrets set and delete handlers also admit the system identity, so server code stores a tenant secret via dispatchSystemWrite through the same key and value checks as an admin; the settings screens keep showing only the human roles. The provider choice shows each plugin's `<feature>.settings` name, also for a plugin without settings of its own, and keeps the English name when a locale feature mounted earlier declares the same key in its own language only. A MailTransportPlugin with `selectableInSettings: false` stays allowed on the server but is not offered in the form; the in-memory transport sets it, because apps mount it next to smtp in production and a tenant admin picking it would drop every mail. A plugin's secrets section takes an optional `<feature>.settings.secrets` title (SMTP password under \"SMTP sign-in\").",
+    "migration": "E2E specs that used the testIds `dashboard-panel-<plugin>-tenant`, `dashboard-panel-<plugin>-tenant-secrets` or the separate secret input of these screens address the fields of `<owner>-tenant-selection` instead (one Save). Code that wrote these keys as a SystemAdmin user writes them as the tenant's TenantAdmin or via dispatchSystemWrite. Apps that relied on readiness flagging an empty provider check it themselves."
+  },
   {
     "version": "0.326.1",
     "type": "fix",

package/src/secrets/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "fix",
+    "title": "secrets:write:set and secrets:write:delete join the request transaction",
+    "detail": "Both handlers ran on the boot database connection, so in an /api/batch a later failing command rolled back the config writes but kept the stored secret. They now run on the request transaction (escape hatch unsafeRaw, reason documented on the handler), so a batch of config and secret writes is stored as a whole or not at all."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "fix",
+    "title": "The \"account deleted\" mail is sent through channel-email when delivery is mounted",
+    "detail": "The default mailer for the Art. 17 deletion confirmation called createTransportForTenant directly, which threw for a tenant without its own mail provider. With delivery and channel-email mounted it now sends through the email channel like the other GDPR mails, over the app transport, without writing a delivery-attempt row for the already erased user. Without channel-email the previous path stays."
+  },
   {
     "version": "0.367.0",
     "type": "fix",