@cosmicdrift/kumiko-dev-server 0.102.2 → 0.105.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-dev-server",
-  "version": "0.102.2",
+  "version": "0.105.0",
   "description": "Development server bootstrap for Kumiko apps. Bundles the client, mints dev-JWTs, injects the resolved AppSchema, and seeds an admin. Not for production.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -50,8 +50,8 @@
     "kumiko-schema-check": "./bin/kumiko-schema-check.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-bundled-features": "0.102.2",
-    "@cosmicdrift/kumiko-framework": "0.102.2",
+    "@cosmicdrift/kumiko-bundled-features": "0.105.0",
+    "@cosmicdrift/kumiko-framework": "0.105.0",
     "ts-morph": "^28.0.0"
   },
   "publishConfig": {

package/src/__tests__/boot-extra-context.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { createDeliveryFeature } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { createSecretsFeature } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createRegistry, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -6,8 +7,10 @@ import type { MasterKeyProvider } from "@cosmicdrift/kumiko-framework/secrets";
 import { buildBootExtraContext } from "../run-prod-app";
 
 // Pins runProdApp's framework-default-provider autowire (buildBootExtraContext):
-// textContent unconditional, secrets feature-gated, KEK-env trap avoided, and
-// the money-horse regression (no secrets feature → no forced KEK → no throw).
+// textContent unconditional, secrets feature-gated, KEK-env trap avoided, the
+// money-horse regression (no secrets feature → no forced KEK → no throw), and
+// the delivery _notifyFactory wiring that makes ctx.notify work in prod (only
+// test-wired before — runProdApp/runDevApp call THIS, not createDeliveryTestContext).
 
 // db is never touched at construction time — createTextContentApi /
 // createSecretsContext only store the handle and query lazily. A bare stub
@@ -30,6 +33,29 @@ describe("buildBootExtraContext — framework-default provider autowire", () =>
     expect(typeof (ctx["textContent"] as { getBlock?: unknown }).getBlock).toBe("function");
     expect(ctx["secrets"]).toBeUndefined();
     expect(ctx["configResolver"]).toBeUndefined();
+    expect(ctx["_notifyFactory"]).toBeUndefined();
+  });
+
+  test("delivery feature mounted → _notifyFactory wired (ctx.notify works in prod)", () => {
+    const ctx = buildBootExtraContext({
+      db: fakeDb,
+      features: [createDeliveryFeature()],
+      envSource: {},
+      registry,
+      hasAuth: false,
+    });
+    expect(typeof ctx["_notifyFactory"]).toBe("function");
+  });
+
+  test("no delivery feature → _notifyFactory not wired", () => {
+    const ctx = buildBootExtraContext({
+      db: fakeDb,
+      features: [otherFeature],
+      envSource: {},
+      registry,
+      hasAuth: false,
+    });
+    expect(ctx["_notifyFactory"]).toBeUndefined();
   });
 
   test("secrets feature mounted + valid KEK env → ctx.secrets wired", () => {

package/src/__tests__/compose-features-wiring.integration.test.ts

@@ -16,10 +16,10 @@
 // Test fährt den vollen HTTP-Roundtrip und kann den dispatch-error nicht
 // übersehen.
 //
-// Kein Mocking: setupTestStack bootet echte DB + Redis. Die
-// sendResetEmail-callback (analog runProdApp's createAuthMailerConfig)
-// schreibt in ein lokales Array — gewollter Capture-Spy ohne vitest-
-// Mock-API (CLAUDE.md "Kein Mock in *.integration.ts").
+// Kein Mocking: setupTestStack bootet echte DB + Redis. reset/verify mailen
+// via delivery (ctx.notify → channel-email); der In-Memory-Transport fängt
+// die echte Mail ab — gewollter Capture ohne Mock-API (CLAUDE.md "Kein Mock
+// in *.integration.ts").
 
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
@@ -28,10 +28,25 @@ import {
   AuthHandlers,
   hashPassword,
 } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import {
+  createChannelEmailFeature,
+  createInMemoryTransport,
+} from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import {
   configValuesTable,
   createConfigResolver,
 } from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  createDeliveryFeature,
+  createDeliveryTestContext,
+  notificationPreferencesTable,
+} from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { createRendererFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/renderer-foundation";
+import {
+  createRendererSimpleFeature,
+  simpleRenderer,
+} from "@cosmicdrift/kumiko-bundled-features/renderer-simple";
+import { createTemplateResolverFeature } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { tenantEntity, tenantMembershipsTable } from "@cosmicdrift/kumiko-bundled-features/tenant";
 import { seedTenantMembership } from "@cosmicdrift/kumiko-bundled-features/tenant/testing";
 import { UserHandlers, userEntity, userTable } from "@cosmicdrift/kumiko-bundled-features/user";
@@ -53,38 +68,59 @@ const APP_VERIFY_URL = "https://app.example.com/verify-email";
 const TEST_TENANT_ID: TenantId = "00000000-0000-4000-8000-000000000001" as TenantId;
 const systemAdmin = TestUsers.systemAdmin;
 
-type CapturedReset = { email: string; resetUrl: string; expiresAt: string };
-type CapturedVerify = { email: string; verificationUrl: string; expiresAt: string };
+// Pulls the magic-link out of the rendered mail HTML — the renderer-simple
+// button carries it as the only href. Replaces the old callback-captured
+// resetUrl now that reset/verify mail via delivery.
+function tokenUrlFromHtml(html: string): URL {
+  const match = html.match(/href="([^"]*\?token=[^"]*)"/);
+  if (!match?.[1]) throw new Error("no magic-link href in mail html");
+  return new URL(match[1]);
+}
 
 async function bootStack(
   authOptionsKind: "with-both" | "with-reset-only" | "without-auth-options",
-): Promise<{
-  stack: TestStack;
-  resetEmails: CapturedReset[];
-  verifyEmails: CapturedVerify[];
-}> {
-  const resetEmails: CapturedReset[] = [];
-  const verifyEmails: CapturedVerify[] = [];
+): Promise<{ stack: TestStack; emailTransport: ReturnType<typeof createInMemoryTransport> }> {
+  const emailTransport = createInMemoryTransport();
 
   // Genau das was runProdApp/runDevApp machen würde — composeFeatures als
-  // single-source der Feature-Liste, je nach authOptionsKind variiert die
-  // Konfiguration. Dieser Test cared explizit um die DURCHREICHE — also
-  // dass das Wrapper-API-Object an createAuthEmailPasswordFeature ankommt.
-  const features = composeFeatures([], {
-    includeBundled: true,
-    ...(authOptionsKind !== "without-auth-options" && {
-      authOptions: {
-        passwordReset: { hmacSecret: RESET_HMAC, tokenTtlMinutes: 15 },
-        ...(authOptionsKind === "with-both" && {
-          emailVerification: { hmacSecret: VERIFY_HMAC, tokenTtlMinutes: 60, mode: "off" },
-        }),
-      },
-    }),
-  });
+  // single-source der Feature-Liste. delivery + channel-email kommen als
+  // App-Features dazu, weil reset/verify ihre Mail via ctx.notify schicken.
+  const features = composeFeatures(
+    [
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async () => "unused@test.local",
+      }),
+    ],
+    {
+      includeBundled: true,
+      ...(authOptionsKind !== "without-auth-options" && {
+        authOptions: {
+          passwordReset: { hmacSecret: RESET_HMAC, tokenTtlMinutes: 15, appUrl: APP_RESET_URL },
+          ...(authOptionsKind === "with-both" && {
+            emailVerification: {
+              hmacSecret: VERIFY_HMAC,
+              tokenTtlMinutes: 60,
+              mode: "off",
+              appUrl: APP_VERIFY_URL,
+            },
+          }),
+        },
+      }),
+    },
+  );
 
   const stack = await setupTestStack({
     features,
-    extraContext: { configResolver: createConfigResolver() },
+    extraContext: (deps) => ({
+      ...createDeliveryTestContext(deps),
+      configResolver: createConfigResolver(),
+    }),
     authConfig: {
       membershipQuery: "tenant:query:memberships",
       loginHandler: AuthHandlers.login,
@@ -93,19 +129,11 @@ async function bootStack(
       passwordReset: {
         requestHandler: AuthHandlers.requestPasswordReset,
         confirmHandler: AuthHandlers.resetPassword,
-        appResetUrl: APP_RESET_URL,
-        sendResetEmail: async (args) => {
-          resetEmails.push(args);
-        },
       },
       ...(authOptionsKind === "with-both" && {
         emailVerification: {
           requestHandler: AuthHandlers.requestEmailVerification,
           confirmHandler: AuthHandlers.verifyEmail,
-          appVerifyUrl: APP_VERIFY_URL,
-          sendVerificationEmail: async (args) => {
-            verifyEmails.push(args);
-          },
         },
       }),
     },
@@ -113,9 +141,13 @@ async function bootStack(
 
   await unsafeCreateEntityTable(stack.db, userEntity);
   await unsafeCreateEntityTable(stack.db, tenantEntity);
-  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
 
-  return { stack, resetEmails, verifyEmails };
+  return { stack, emailTransport };
 }
 
 async function seedUser(
@@ -154,8 +186,7 @@ describe("composeFeatures wiring — passwordReset", () => {
   beforeEach(async () => {
     await deleteMany(suite.stack.db, userTable, {});
     await deleteMany(suite.stack.db, tenantMembershipsTable, {});
-    suite.resetEmails.length = 0;
-    suite.verifyEmails.length = 0;
+    suite.emailTransport.sent.length = 0;
   });
 
   test("full reset roundtrip: request → email → reset → login with new password", async () => {
@@ -170,15 +201,15 @@ describe("composeFeatures wiring — passwordReset", () => {
       email: "alice@example.com",
     });
     expect(requestRes.status).toBe(200);
-    expect(suite.resetEmails).toHaveLength(1);
-    const captured = suite.resetEmails[0];
-    if (!captured) throw new Error("no email captured");
-    expect(captured.email).toBe("alice@example.com");
-
-    // Token aus URL extrahieren — wie der echte User es täte (Mail klicken,
-    // Browser parsed query-string). Das macht dieser Test "echter" als ein
-    // signResetToken-Bypass: er pinst den vollen URL-zu-Handler-Roundtrip.
-    const resetUrl = new URL(captured.resetUrl);
+    expect(suite.emailTransport.sent).toHaveLength(1);
+    const sent = suite.emailTransport.sent[0];
+    if (!sent) throw new Error("no email sent");
+    expect(sent.to).toBe("alice@example.com");
+
+    // Token aus der Mail-URL extrahieren — wie der echte User es täte (Mail
+    // klicken, Browser parsed query-string). Das pinst den vollen
+    // URL-zu-Handler-Roundtrip über delivery.
+    const resetUrl = tokenUrlFromHtml(sent.html);
     expect(`${resetUrl.origin}${resetUrl.pathname}`).toBe(APP_RESET_URL);
     const token = resetUrl.searchParams.get("token");
     expect(token).toBeTruthy();
@@ -228,8 +259,7 @@ describe("composeFeatures wiring — emailVerification", () => {
   beforeEach(async () => {
     await deleteMany(suite.stack.db, userTable, {});
     await deleteMany(suite.stack.db, tenantMembershipsTable, {});
-    suite.resetEmails.length = 0;
-    suite.verifyEmails.length = 0;
+    suite.emailTransport.sent.length = 0;
   });
 
   test("emailVerification authOption durchgereicht → request handler dispatched", async () => {
@@ -242,11 +272,11 @@ describe("composeFeatures wiring — emailVerification", () => {
       email: "bob@example.com",
     });
     expect(res.status).toBe(200);
-    expect(suite.verifyEmails).toHaveLength(1);
-    const captured = suite.verifyEmails[0];
-    if (!captured) throw new Error("no verification email captured");
-    expect(captured.email).toBe("bob@example.com");
-    const verifyUrl = new URL(captured.verificationUrl);
+    expect(suite.emailTransport.sent).toHaveLength(1);
+    const sent = suite.emailTransport.sent[0];
+    if (!sent) throw new Error("no verification email sent");
+    expect(sent.to).toBe("bob@example.com");
+    const verifyUrl = tokenUrlFromHtml(sent.html);
     expect(`${verifyUrl.origin}${verifyUrl.pathname}`).toBe(APP_VERIFY_URL);
     expect(verifyUrl.searchParams.get("token")).toBeTruthy();
   });
@@ -274,8 +304,7 @@ describe("composeFeatures wiring — asymmetric activation", () => {
   beforeEach(async () => {
     await deleteMany(suite.stack.db, userTable, {});
     await deleteMany(suite.stack.db, tenantMembershipsTable, {});
-    suite.resetEmails.length = 0;
-    suite.verifyEmails.length = 0;
+    suite.emailTransport.sent.length = 0;
   });
 
   test("nur passwordReset gesetzt → reset-flow live, verify-flow fail-closed", async () => {
@@ -286,17 +315,17 @@ describe("composeFeatures wiring — asymmetric activation", () => {
       email: "alice@example.com",
     });
     expect(resetRes.status).toBe(200);
-    expect(suite.resetEmails).toHaveLength(1);
+    expect(suite.emailTransport.sent).toHaveLength(1);
 
     // Verify-Routes sind in dieser bootStack-Variante NICHT gemounted
     // (authConfig.emailVerification fehlt). Der Endpoint existiert also
     // gar nicht — Hono returnt 404. Unterscheidet sich vom 200-silent-
-    // success-Pfad: hier ist die ROUTE selbst nicht da.
+    // success-Pfad: hier ist die ROUTE selbst nicht da. Kein zweites Mail.
     const verifyRes = await suite.stack.http.raw("POST", "/api/auth/request-email-verification", {
       email: "alice@example.com",
     });
     expect(verifyRes.status).toBe(404);
-    expect(suite.verifyEmails).toHaveLength(0);
+    expect(suite.emailTransport.sent).toHaveLength(1);
   });
 });
 
@@ -328,7 +357,7 @@ describe("composeFeatures wiring — fail-closed ohne authOptions", () => {
   afterEach(async () => {
     await deleteMany(suite.stack.db, userTable, {});
     await deleteMany(suite.stack.db, tenantMembershipsTable, {});
-    suite.resetEmails.length = 0;
+    suite.emailTransport.sent.length = 0;
   });
 
   test("authOptions fehlt → POST returnt enumeration-safe 200, ABER NULL Mails (der echte Bug-Beweis)", async () => {
@@ -348,6 +377,6 @@ describe("composeFeatures wiring — fail-closed ohne authOptions", () => {
     // Bug. Diese Asymmetrie zwischen den beiden describe-Blöcken IST
     // der Test.
     expect(res.status).toBe(200);
-    expect(suite.resetEmails).toHaveLength(0);
+    expect(suite.emailTransport.sent).toHaveLength(0);
   });
 });

package/src/__tests__/compose-features.test.ts

@@ -40,7 +40,7 @@ describe("composeFeatures", () => {
   test("authOptions.passwordReset → request-password-reset + reset-password handlers registriert", () => {
     const features = composeFeatures([noopFeature], {
       includeBundled: true,
-      authOptions: { passwordReset: { hmacSecret: HMAC_SECRET } },
+      authOptions: { passwordReset: { hmacSecret: HMAC_SECRET, appUrl: "https://app/reset" } },
     });
     const auth = features.find((f) => f.name === "auth-email-password");
     expect(auth).toBeDefined();
@@ -53,7 +53,7 @@ describe("composeFeatures", () => {
   test("authOptions.emailVerification → request-email-verification + verify-email handlers registriert", () => {
     const features = composeFeatures([noopFeature], {
       includeBundled: true,
-      authOptions: { emailVerification: { hmacSecret: HMAC_SECRET } },
+      authOptions: { emailVerification: { hmacSecret: HMAC_SECRET, appUrl: "https://app/verify" } },
     });
     const auth = features.find((f) => f.name === "auth-email-password");
     expect(auth).toBeDefined();
@@ -63,6 +63,19 @@ describe("composeFeatures", () => {
     expect(handlerNames).toContain("verify-email");
   });
 
+  test("authOptions.signup → signup-request + signup-confirm handlers registriert", () => {
+    const features = composeFeatures([noopFeature], {
+      includeBundled: true,
+      authOptions: { signup: { appUrl: "https://app/signup/complete" } },
+    });
+    const auth = features.find((f) => f.name === "auth-email-password");
+    expect(auth).toBeDefined();
+    if (!auth) return;
+    const handlerNames = Array.from(Object.keys(auth.writeHandlers));
+    expect(handlerNames).toContain("signup-request");
+    expect(handlerNames).toContain("signup-confirm");
+  });
+
   test("OHNE authOptions → KEINE reset/verify-handlers (anti-default-deploy-bug)", () => {
     // Genau der Bug der vom Review-Agent gefangen wurde: composeFeatures
     // ohne authOptions registriert die handler nicht. Wenn jemand das

package/src/__tests__/resolve-auth-mail.test.ts

@@ -28,11 +28,13 @@ describe("resolveAuthMail", () => {
 
   test("mail + SMTP_HOST → all four flows wired from DEFAULT_AUTH_PATHS", () => {
     const out = resolveAuthMail(withMail, "secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.appResetUrl).toBe("https://app.example.com/reset-password");
-    expect(out.emailVerification?.appVerifyUrl).toBe("https://app.example.com/verify-email");
-    expect(out.signup?.appActivationUrl).toBe("https://app.example.com/signup/complete");
-    expect(out.invite?.appAcceptUrl).toBe("https://app.example.com/invite/accept");
-    expect(typeof out.passwordReset?.sendResetEmail).toBe("function");
+    // All four flows carry appUrl as feature options — each handler mails via
+    // delivery (ctx.notify); no callback wiring remains.
+    expect(out.passwordReset?.appUrl).toBe("https://app.example.com/reset-password");
+    expect(out.emailVerification?.appUrl).toBe("https://app.example.com/verify-email");
+    expect(out.signup?.appUrl).toBe("https://app.example.com/signup/complete");
+    expect(out.invite?.appUrl).toBe("https://app.example.com/invite/accept");
+    expect(out.passwordReset?.hmacSecret).toBe("secret");
   });
 
   test("mail but NO SMTP_HOST → null-transport guard, flows stay unwired", () => {
@@ -46,14 +48,13 @@ describe("resolveAuthMail", () => {
       ...withMail,
       passwordReset: {
         hmacSecret: "h",
-        appResetUrl: "https://custom.example.com/pw",
-        sendResetEmail: async () => {},
+        appUrl: "https://custom.example.com/pw",
       },
     };
     const out = resolveAuthMail(explicit, "secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.appResetUrl).toBe("https://custom.example.com/pw");
+    expect(out.passwordReset?.appUrl).toBe("https://custom.example.com/pw");
     // other flows still come from the mail default
-    expect(out.signup?.appActivationUrl).toBe("https://app.example.com/signup/complete");
+    expect(out.signup?.appUrl).toBe("https://app.example.com/signup/complete");
   });
 
   test("paths override only affects the named path", () => {
@@ -62,7 +63,7 @@ describe("resolveAuthMail", () => {
       mail: { baseUrl: "https://app.example.com", paths: { resetPassword: "/pw" } },
     };
     const out = resolveAuthMail(pathsOverride, "secret", { SMTP_HOST: "localhost" });
-    expect(out.passwordReset?.appResetUrl).toBe("https://app.example.com/pw");
-    expect(out.emailVerification?.appVerifyUrl).toBe("https://app.example.com/verify-email");
+    expect(out.passwordReset?.appUrl).toBe("https://app.example.com/pw");
+    expect(out.emailVerification?.appUrl).toBe("https://app.example.com/verify-email");
   });
 });

package/src/__tests__/run-dev-app.integration.test.ts

@@ -5,7 +5,7 @@
 // run-prod-app forwarding pair. Without it a typo or wrong spread-key on the dev
 // path would silently drop the fail-closed guard and dev/prod would diverge.
 
-import { afterEach, describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import type { KumikoServerHandle } from "../create-kumiko-server";
 import { runDevApp } from "../run-dev-app";
@@ -24,10 +24,17 @@ const ADMIN = {
 };
 
 let handle: KumikoServerHandle | undefined;
+const savedJwtSecret = process.env["JWT_SECRET"];
+
+beforeEach(() => {
+  process.env["JWT_SECRET"] = "test-rundev-secret-32-chars-min!!!!";
+});
 
 afterEach(async () => {
   await handle?.stop();
   handle = undefined;
+  if (savedJwtSecret === undefined) delete process.env["JWT_SECRET"];
+  else process.env["JWT_SECRET"] = savedJwtSecret;
 });
 
 describe("runDevApp — auth allowedOrigins forwarding (#399/1)", () => {

package/src/compose-features.ts

@@ -13,6 +13,7 @@
 
 import {
   type AuthEmailPasswordOptions,
+  type AuthMailLocale,
   createAuthEmailPasswordFeature,
   type EmailVerificationOptions,
   type InviteOptions,
@@ -94,51 +95,49 @@ export type AuthOptionsCarrier = {
  *  gesetzt sind (composeFeatures default-deny: KEINE handler in der
  *  Registry registriert, /api/auth/request-password-reset etc. bleiben
  *  401/404). */
+type MailFlowFields = {
+  readonly appUrl: string;
+  readonly tokenTtlMinutes?: number;
+  readonly appName?: string;
+  readonly locale?: AuthMailLocale;
+};
+
+// The magic-link mail fields shared by all four flows. Conditional spreads omit
+// undefined keys (exactOptionalPropertyTypes) and avoid the property-write that
+// trips noPropertyAccessFromIndexSignature on the type-aliased option shapes.
+// reset/verify layer hmacSecret (+ mode) on top.
+function pickMailFields(src: MailFlowFields): MailFlowFields {
+  return {
+    appUrl: src.appUrl,
+    ...(src.tokenTtlMinutes !== undefined && { tokenTtlMinutes: src.tokenTtlMinutes }),
+    ...(src.appName !== undefined && { appName: src.appName }),
+    ...(src.locale !== undefined && { locale: src.locale }),
+  };
+}
+
 export function buildComposeAuthOptions(
   auth: AuthOptionsCarrier | undefined,
 ): AuthEmailPasswordOptions | undefined {
   if (!auth) return undefined;
   const opts: { -readonly [K in keyof AuthEmailPasswordOptions]: AuthEmailPasswordOptions[K] } = {};
   if (auth.passwordReset) {
-    const reset: { -readonly [K in keyof PasswordResetOptions]: PasswordResetOptions[K] } = {
+    opts.passwordReset = {
       hmacSecret: auth.passwordReset.hmacSecret,
+      ...pickMailFields(auth.passwordReset),
     };
-    if (auth.passwordReset.tokenTtlMinutes !== undefined) {
-      reset.tokenTtlMinutes = auth.passwordReset.tokenTtlMinutes;
-    }
-    opts.passwordReset = reset;
   }
   if (auth.emailVerification) {
-    const verify: { -readonly [K in keyof EmailVerificationOptions]: EmailVerificationOptions[K] } =
-      {
-        hmacSecret: auth.emailVerification.hmacSecret,
-      };
-    if (auth.emailVerification.tokenTtlMinutes !== undefined) {
-      verify.tokenTtlMinutes = auth.emailVerification.tokenTtlMinutes;
-    }
-    if (auth.emailVerification.mode !== undefined) {
-      verify.mode = auth.emailVerification.mode;
-    }
-    opts.emailVerification = verify;
+    opts.emailVerification = {
+      hmacSecret: auth.emailVerification.hmacSecret,
+      ...pickMailFields(auth.emailVerification),
+      ...(auth.emailVerification.mode !== undefined && { mode: auth.emailVerification.mode }),
+    };
   }
   if (auth.signup) {
-    // Plain object statt mapped-type — SignupOptions ist type-alias auf
-    // SignupRequestOptions, der TS-mapped-type-Pfad löst's als
-    // index-signature auf (TS noPropertyAccessFromIndexSignature klagt
-    // dann beim Property-write). Plain shape ist klar UND funktioniert.
-    const signup: { tokenTtlMinutes?: number } = {};
-    if (auth.signup.tokenTtlMinutes !== undefined) {
-      signup.tokenTtlMinutes = auth.signup.tokenTtlMinutes;
-    }
-    opts.signup = signup;
+    opts.signup = pickMailFields(auth.signup);
   }
   if (auth.invite) {
-    // Plain object analog signup (gleicher type-alias-issue).
-    const invite: { tokenTtlMinutes?: number } = {};
-    if (auth.invite.tokenTtlMinutes !== undefined) {
-      invite.tokenTtlMinutes = auth.invite.tokenTtlMinutes;
-    }
-    opts.invite = invite;
+    opts.invite = pickMailFields(auth.invite);
   }
   return opts.passwordReset || opts.emailVerification || opts.signup || opts.invite
     ? opts

package/src/run-dev-app.ts

@@ -73,7 +73,12 @@ import type {
   PasswordResetSetup,
   SignupSetup,
 } from "./run-prod-app";
-import { addConfigAccessorFactory, buildBootExtraContext, resolveAuthMail } from "./run-prod-app";
+import {
+  addConfigAccessorFactory,
+  buildBootExtraContext,
+  requireEnv,
+  resolveAuthMail,
+} from "./run-prod-app";
 
 export type RunDevAppAuthOptions = {
   /** Admin user to seed at boot. Idempotent — re-runs in persistent-DB
@@ -210,15 +215,10 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
   // auseinanderdriften können).
   const envSource = options.envSource ?? process.env;
   // auth.mail → normalisiert in die expliziten Flow-Felder (symmetrisch zu
-  // runProdApp). hmacSecret = JWT_SECRET-env mit Dev-Fallback (der Dev-Server
-  // mintet JWTs selbst; der Reset-Token-HMAC teilt denselben Key wie in den
-  // Apps). Ab hier IMMER effectiveAuth statt options.auth.
+  // runProdApp). hmacSecret = JWT_SECRET-env (fail-fast, symmetrisch zu
+  // runProdApp). Ab hier IMMER effectiveAuth statt options.auth.
   const effectiveAuth = options.auth
-    ? resolveAuthMail(
-        options.auth,
-        envSource["JWT_SECRET"] ?? "kumiko-dev-auth-mail-hmac-fallback-secret",
-        envSource,
-      )
+    ? resolveAuthMail(options.auth, requireEnv("JWT_SECRET", envSource, "runDevApp"), envSource)
     : undefined;
   const composeAuthOptions = buildComposeAuthOptions(effectiveAuth);
   const features = composeFeatures(options.features, {
@@ -318,6 +318,7 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
       envSource,
       registry: deps.registry,
       hasAuth: false,
+      sseBroker: deps.sseBroker,
       ...(options.masterKey && { masterKey: options.masterKey }),
     });
     const base = typeof cfgExtra === "function" ? cfgExtra(deps) : (cfgExtra ?? {});
@@ -395,24 +396,18 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
           passwordReset: {
             requestHandler: AuthHandlers.requestPasswordReset,
             confirmHandler: AuthHandlers.resetPassword,
-            sendResetEmail: effectiveAuth.passwordReset.sendResetEmail,
-            appResetUrl: effectiveAuth.passwordReset.appResetUrl,
           },
         }),
         ...(effectiveAuth.emailVerification && {
           emailVerification: {
             requestHandler: AuthHandlers.requestEmailVerification,
             confirmHandler: AuthHandlers.verifyEmail,
-            sendVerificationEmail: effectiveAuth.emailVerification.sendVerificationEmail,
-            appVerifyUrl: effectiveAuth.emailVerification.appVerifyUrl,
           },
         }),
         ...(effectiveAuth.signup && {
           signup: {
             requestHandler: AuthHandlers.signupRequest,
             confirmHandler: AuthHandlers.signupConfirm,
-            sendActivationEmail: effectiveAuth.signup.sendActivationEmail,
-            appActivationUrl: effectiveAuth.signup.appActivationUrl,
           },
         }),
         ...(effectiveAuth.invite && {
@@ -420,8 +415,6 @@ export async function runDevApp(options: RunDevAppOptions): Promise<KumikoServer
             acceptHandler: AuthHandlers.inviteAccept,
             acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
             signupCompleteHandler: AuthHandlers.inviteSignupComplete,
-            sendInviteEmail: effectiveAuth.invite.sendInviteEmail,
-            appAcceptUrl: effectiveAuth.invite.appAcceptUrl,
           },
         }),
       },

package/src/run-prod-app.ts

@@ -27,10 +27,8 @@
 import {
   AuthErrors,
   AuthHandlers,
-  type AuthMailerConfig,
   type AuthMailLocale,
   type AuthPaths,
-  createAuthMailerConfig,
   type EmailVerificationOptions,
   type InviteOptions,
   makeAuthPaths,
@@ -47,6 +45,11 @@ import {
   createConfigAccessorFactory,
   createConfigResolver,
 } from "@cosmicdrift/kumiko-bundled-features/config";
+import {
+  collectChannels,
+  createDeliveryService,
+  DELIVERY_FEATURE,
+} from "@cosmicdrift/kumiko-bundled-features/delivery";
 import {
   createSecretsContext,
   SECRETS_FEATURE_NAME,
@@ -79,6 +82,7 @@ import {
   type EffectiveFeaturesResolver,
   type FeatureDefinition,
   findTierResolverUsage,
+  type NotifyFactory,
   type Registry,
   type TenantId,
   type TierResolverPlugin,
@@ -159,11 +163,15 @@ export function buildBunServeOptions(
 // `src` defaults to process.env but is threaded from the caller's envSource
 // so the boot-path reads the SAME env-quelle that was validated above —
 // injected dummies in test-mode must not silently fall back to process.env.
-function requireEnv(name: string, src: Record<string, string | undefined> = process.env): string {
+export function requireEnv(
+  name: string,
+  src: Record<string, string | undefined> = process.env,
+  context = "runProdApp",
+): string {
   const value = src[name];
   if (value === undefined || value === "") {
     throw new Error(
-      `runProdApp: required env var "${name}" is missing or empty. ` +
+      `${context}: required env var "${name}" is missing or empty. ` +
         `Set it in your container env / .env.production / Coolify secrets.`,
     );
   }
@@ -229,62 +237,27 @@ function makeDryRunHandle(): ProdAppHandle {
 
 /** Wrapper-API für den Password-Reset-Flow.
  *
- *  Setup = Feature-Options (PasswordResetOptions = hmacSecret +
- *  tokenTtlMinutes) PLUS die Mail-Side die der Wrapper an die
- *  auth-routes-config durchreicht (sendResetEmail-callback +
- *  appResetUrl). Apps geben EINEN Block; run{Prod,Dev}App splittet
- *  intern auf composeFeatures(authOptions) für die Feature-Options
- *  und auth-routes-config für die Mail-Side. extends-Beziehung
- *  pinst die Synchronität: jede Feature-Option ist auch Wrapper-Option. */
-export type PasswordResetSetup = PasswordResetOptions & {
-  readonly sendResetEmail: (args: {
-    email: string;
-    resetUrl: string;
-    expiresAt: string;
-  }) => Promise<void>;
-  /** App-URL des ResetPasswordScreen. Framework appended `?token=…`;
-   *  KEIN trailing `?` oder `#`. Beispiel: "https://admin.example.com/reset-password" */
-  readonly appResetUrl: string;
-};
+ *  Seit der delivery-Migration trägt PasswordResetOptions selbst `appUrl`
+ *  (+ appName/locale) und der Handler mailt via ctx.notify — kein
+ *  sendResetEmail-Callback mehr. Apps geben `auth.mail` (Convenience,
+ *  resolveAuthMail baut die appUrl) ODER einen expliziten Block. */
+export type PasswordResetSetup = PasswordResetOptions;
 
 /** Wrapper-API für den Email-Verification-Flow. Symmetrisch zu
- *  PasswordResetSetup — extends EmailVerificationOptions + Mail-Side. */
-export type EmailVerificationSetup = EmailVerificationOptions & {
-  readonly sendVerificationEmail: (args: {
-    email: string;
-    verificationUrl: string;
-    expiresAt: string;
-  }) => Promise<void>;
-  readonly appVerifyUrl: string;
-};
-
-/** Wrapper-API für Magic-Link Self-Signup. Mirror der existing
- *  PasswordResetSetup-Struktur — Feature-Options (tokenTtlMinutes,
- *  tokenLength) plus die Mail-Side die der Wrapper an die auth-routes-
- *  config durchreicht. Anders als reset/verify gibt's KEIN hmacSecret —
- *  Signup-Tokens sind opaque random in Redis, nicht HMAC-signed. */
-export type SignupSetup = SignupOptions & {
-  readonly sendActivationEmail: (args: {
-    email: string;
-    activationUrl: string;
-    expiresAt: string;
-  }) => Promise<void>;
-  readonly appActivationUrl: string;
-};
-
-/** Wrapper-API für Tenant-Invite Magic-Link. Drei accept-Branches im
- *  framework, der Wrapper reicht NUR die Mail-Side + appAcceptUrl
- *  durch — handler-names sind hardcoded in run-prod-app aus
+ *  PasswordResetSetup — = EmailVerificationOptions (appUrl via delivery). */
+export type EmailVerificationSetup = EmailVerificationOptions;
+
+/** Wrapper-API für Magic-Link Self-Signup. = SignupOptions (appUrl, die
+ *  Mail geht via delivery/ctx.notify wie reset/verify). Anders als reset/
+ *  verify gibt's KEIN hmacSecret — Signup-Tokens sind opaque random in
+ *  Redis, nicht HMAC-signed. */
+export type SignupSetup = SignupOptions;
+
+/** Wrapper-API für Tenant-Invite Magic-Link. = InviteOptions (appUrl, die
+ *  Invite-Mail geht via delivery wie reset/verify/signup). Drei accept-
+ *  Branches im framework; handler-names sind hardcoded in run-prod-app aus
  *  AuthHandlers (analog signup). */
-export type InviteSetup = InviteOptions & {
-  readonly sendInviteEmail: (args: {
-    email: string;
-    inviteUrl: string;
-    expiresAt: string;
-    role: string;
-  }) => Promise<void>;
-  readonly appAcceptUrl: string;
-};
+export type InviteSetup = InviteOptions;
 
 /** Auth-Mail-Convenience-Optionen — shared zwischen runProdApp + runDevApp.
  *  Verdrahtet alle 4 Mail-Flows aus einem env-SMTP-Transport + Standard-
@@ -319,9 +292,9 @@ export type RunProdAppAuthOptions = {
    *  (legacy-Verhalten, Karten­haus existing-Apps unangefasst). */
   readonly sessions?: ProdSessionsOption;
   /** Auth-Mail-Convenience: verdrahtet alle 4 Mail-Flows (passwordReset,
-   *  emailVerification, signup, invite) aus einem SMTP-Transport-aus-env +
-   *  Standard-Templates. Ersetzt das per-App hand-gerollte
-   *  `createSmtpTransportFromEnv` + `createAuthMailerConfig`-Wrapper-Trio.
+   *  emailVerification, signup, invite) aus `auth.mail.baseUrl` + Standard-
+   *  Pfaden. Alle vier mailen via delivery (ctx.notify) — ersetzt das per-App
+   *  hand-gerollte `send*Email`-Callback-Wiring.
    *
    *  Null-Transport-Guard: ohne `SMTP_HOST`-env wird KEIN Mail-Flow
    *  verdrahtet (Routes blieben sonst 500). Eine App die einen einzelnen
@@ -636,6 +609,25 @@ function envHasMasterKek(env: Record<string, string | undefined>): boolean {
   return Object.entries(env).some(([k, v]) => MASTER_KEK_VAR.test(k) && !!v);
 }
 
+// Prod/dev parity for ctx.notify: without this `_notifyFactory` is only wired
+// in tests (createDeliveryTestContext), so ctx.notify is undefined at runtime
+// and every notification silently skips. sseBroker optional (email/push don't
+// need it, in-app SSE does); no jobRunner → queued channels send inline.
+function buildDeliveryNotifyFactory(opts: {
+  readonly db: DbConnection;
+  readonly registry: Registry;
+  readonly sseBroker?: SseBroker;
+}): NotifyFactory {
+  const deliveryService = createDeliveryService({
+    db: opts.db,
+    registry: opts.registry,
+    channels: collectChannels(opts.registry),
+    ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+  });
+  return (user, tenantId) => (notificationType, options) =>
+    deliveryService.notify(notificationType, options, user, tenantId);
+}
+
 export function buildBootExtraContext(opts: {
   readonly db: DbConnection;
   readonly features: readonly FeatureDefinition[];
@@ -643,12 +635,21 @@ export function buildBootExtraContext(opts: {
   readonly registry: Registry;
   readonly hasAuth: boolean;
   readonly masterKey?: MasterKeyProvider;
+  readonly sseBroker?: SseBroker;
 }): Record<string, unknown> {
   const hasSecretsFeature = opts.features.some((f) => f.name === SECRETS_FEATURE_NAME);
   const wireSecrets =
     hasSecretsFeature && (opts.masterKey !== undefined || envHasMasterKek(opts.envSource));
+  const hasDeliveryFeature = opts.features.some((f) => f.name === DELIVERY_FEATURE);
   return {
     textContent: createTextContentApi(opts.db),
+    ...(hasDeliveryFeature && {
+      _notifyFactory: buildDeliveryNotifyFactory({
+        db: opts.db,
+        registry: opts.registry,
+        ...(opts.sseBroker && { sseBroker: opts.sseBroker }),
+      }),
+    }),
     ...(wireSecrets && {
       secrets: createSecretsContext({
         db: opts.db,
@@ -695,27 +696,44 @@ export function resolveAuthMail<T extends AuthMailNormalizable>(
   envSource: Record<string, string | undefined>,
 ): T {
   if (!auth.mail) return auth;
-  const mailSender = createSmtpTransportFromEnv(envSource, {
-    fallbackFrom: auth.mail.from ?? "noreply@localhost",
-  });
-  if (!mailSender) return auth;
-  const mc: AuthMailerConfig = createAuthMailerConfig({
-    mailSender,
-    hmacSecret,
-    baseUrl: auth.mail.baseUrl,
-    paths: makeAuthPaths(auth.mail.paths),
+  // SMTP-presence gate: ohne SMTP_HOST-env wird KEIN Flow verdrahtet (Routes
+  // blieben sonst 500). Der eigentliche Mail-Versand läuft über delivery
+  // (channel-email), nicht über diesen Transport — er ist nur der Detektor
+  // "ist Mail konfiguriert?".
+  if (
+    !createSmtpTransportFromEnv(envSource, { fallbackFrom: auth.mail.from ?? "noreply@localhost" })
+  ) {
+    return auth;
+  }
+  const paths = makeAuthPaths(auth.mail.paths);
+  // appName/locale fließen in alle vier Flow-Options (alle mailen via delivery).
+  const mailPresentation = {
     ...(auth.mail.appName !== undefined && { appName: auth.mail.appName }),
     ...(auth.mail.locale !== undefined && { locale: auth.mail.locale }),
-    ...(auth.mail.emailVerificationMode !== undefined && {
-      emailVerificationMode: auth.mail.emailVerificationMode,
-    }),
-  });
+  };
   return {
     ...auth,
-    passwordReset: auth.passwordReset ?? mc.passwordReset,
-    emailVerification: auth.emailVerification ?? mc.emailVerification,
-    signup: auth.signup ?? mc.signup,
-    invite: auth.invite ?? mc.invite,
+    passwordReset: auth.passwordReset ?? {
+      hmacSecret,
+      appUrl: `${auth.mail.baseUrl}${paths.resetPassword}`,
+      ...mailPresentation,
+    },
+    emailVerification: auth.emailVerification ?? {
+      hmacSecret,
+      appUrl: `${auth.mail.baseUrl}${paths.verifyEmail}`,
+      ...(auth.mail.emailVerificationMode !== undefined && {
+        mode: auth.mail.emailVerificationMode,
+      }),
+      ...mailPresentation,
+    },
+    signup: auth.signup ?? {
+      appUrl: `${auth.mail.baseUrl}${paths.signupComplete}`,
+      ...mailPresentation,
+    },
+    invite: auth.invite ?? {
+      appUrl: `${auth.mail.baseUrl}${paths.inviteAccept}`,
+      ...mailPresentation,
+    },
   };
 }
 
@@ -907,6 +925,7 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
     envSource,
     registry,
     hasAuth: !!effectiveAuth,
+    sseBroker,
     ...(options.masterKey && { masterKey: options.masterKey }),
   });
   const extraContext = addConfigAccessorFactory(
@@ -979,24 +998,18 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
           passwordReset: {
             requestHandler: AuthHandlers.requestPasswordReset,
             confirmHandler: AuthHandlers.resetPassword,
-            sendResetEmail: effectiveAuth.passwordReset.sendResetEmail,
-            appResetUrl: effectiveAuth.passwordReset.appResetUrl,
           },
         }),
         ...(effectiveAuth.emailVerification && {
           emailVerification: {
             requestHandler: AuthHandlers.requestEmailVerification,
             confirmHandler: AuthHandlers.verifyEmail,
-            sendVerificationEmail: effectiveAuth.emailVerification.sendVerificationEmail,
-            appVerifyUrl: effectiveAuth.emailVerification.appVerifyUrl,
           },
         }),
         ...(effectiveAuth.signup && {
           signup: {
             requestHandler: AuthHandlers.signupRequest,
             confirmHandler: AuthHandlers.signupConfirm,
-            sendActivationEmail: effectiveAuth.signup.sendActivationEmail,
-            appActivationUrl: effectiveAuth.signup.appActivationUrl,
           },
         }),
         ...(effectiveAuth.invite && {
@@ -1004,8 +1017,6 @@ export async function runProdApp(options: RunProdAppOptions): Promise<ProdAppHan
             acceptHandler: AuthHandlers.inviteAccept,
             acceptWithLoginHandler: AuthHandlers.inviteAcceptWithLogin,
             signupCompleteHandler: AuthHandlers.inviteSignupComplete,
-            sendInviteEmail: effectiveAuth.invite.sendInviteEmail,
-            appAcceptUrl: effectiveAuth.invite.appAcceptUrl,
           },
         }),
       },