@cosmicdrift/kumiko-framework 0.102.1 → 0.104.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.102.1",
+  "version": "0.104.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -181,7 +181,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.102.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.104.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/auth-routes.ts

@@ -299,33 +299,17 @@ export type AuthRoutesConfig = {
 
 export type PasswordResetConfig = {
   // Qualified name of the request handler (the one that emits either
-  // { kind: "reset-requested", ... } or { kind: "no-op" }).
+  // { kind: "reset-requested", ... } or { kind: "no-op" }). The handler
+  // builds the magic-link and sends the mail via delivery (ctx.notify) — the
+  // route only dispatches and returns the silent-success envelope.
   requestHandler: string;
   // Qualified name of the confirm handler (token + newPassword → set).
   confirmHandler: string;
-  // Invoked only when the request handler returns kind=reset-requested.
-  // Given the signed token + target email, the callback builds the URL
-  // into the caller's app and hands it to whatever delivery channel the
-  // app wires up. Errors bubble as 5xx so silent drop-on-send can't hide
-  // an outgoing-mail outage behind a green response.
-  sendResetEmail: (args: { email: string; resetUrl: string; expiresAt: string }) => Promise<void>;
-  // Base URL of the app that hosts the reset form. The route appends
-  // `?token=…` so you should NOT include a trailing `?` or `#`. Example:
-  //   "https://app.example.com/reset-password"
-  appResetUrl: string;
 };
 
 export type EmailVerificationConfig = {
   requestHandler: string;
   confirmHandler: string;
-  sendVerificationEmail: (args: {
-    email: string;
-    verificationUrl: string;
-    expiresAt: string;
-  }) => Promise<void>;
-  // URL of the app page that receives the `?token=…` parameter and POSTs
-  // it to /auth/verify-email on submit.
-  appVerifyUrl: string;
 };
 
 // Tenant-Invite Magic-Link. Drei Accept-Branches für klare Separation:
@@ -334,28 +318,20 @@ export type EmailVerificationConfig = {
 //   - signupCompleteHandler: anon User mit neuer email (Branch 3)
 // Branch 2+3 minten JWT analog signup-confirm.
 export type InviteConfig = {
-  // Qualified handler names
+  // Qualified handler names. invite-create dispatches the invite mail itself
+  // via delivery (ctx.notify); the route layer only wires the accept branches.
   readonly acceptHandler: string;
   readonly acceptWithLoginHandler: string;
   readonly signupCompleteHandler: string;
-  // Mail-Callback. Token-URL wird von der App-Page (z.B. /invite/accept)
-  // an den User geschickt; der Frontend leitet je nach User-State (eingeloggt
-  // / anon mit existing-email / anon mit neuer email) auf den passenden
-  // Branch-Endpoint.
-  readonly sendInviteEmail: (args: {
-    email: string;
-    inviteUrl: string;
-    expiresAt: string;
-    role: string;
-  }) => Promise<void>;
-  readonly appAcceptUrl: string;
 };
 
 // Magic-Link Self-Signup. Anders als reset/verify NICHT HMAC-signed —
-// der Token ist opaque random, Redis ist Source of Truth. Confirm
-// returnt `{ kind: "auth-session", session, tenantKey }` analog zu
-// loginHandler, sodass die Route JWT minten + Cookies setzen kann
-// (Auto-Login direkt nach Activation, kein zweiter login-Roundtrip).
+// der Token ist opaque random, Redis ist Source of Truth. The request
+// handler dispatches the activation mail via delivery (ctx.notify); the
+// route only forwards the dispatch. Confirm returnt
+// `{ kind: "auth-session", session, tenantKey }` analog zu loginHandler,
+// sodass die Route JWT minten + Cookies setzen kann (Auto-Login direkt
+// nach Activation, kein zweiter login-Roundtrip).
 export type SignupConfig = {
   // Qualified name of the request handler (typisch
   // AuthHandlers.signupRequest).
@@ -364,16 +340,6 @@ export type SignupConfig = {
   // AuthHandlers.signupConfirm). Returnt SessionUser-Shape — die
   // Route wickelt das wie einen erfolgreichen login.
   confirmHandler: string;
-  // Mail-Callback. Token-URL wird als `${appActivationUrl}?token=…`
-  // an die App-Page geleitet.
-  sendActivationEmail: (args: {
-    email: string;
-    activationUrl: string;
-    expiresAt: string;
-  }) => Promise<void>;
-  // Base URL of the app page that receives the `?token=…` parameter
-  // (typisch /signup/complete). KEIN trailing `?` oder `#`.
-  appActivationUrl: string;
 };
 
 // Extract `ip` and `user-agent` for the sessionCreator.
@@ -560,10 +526,6 @@ export function createAuthRoutes(
       dispatcher,
       path: Routes.authRequestPasswordReset,
       requestHandler: pr.requestHandler,
-      successKind: "reset-requested",
-      appBaseUrl: pr.appResetUrl,
-      sendEmail: ({ email, url, expiresAt }) =>
-        pr.sendResetEmail({ email, resetUrl: url, expiresAt }), // @wrapper-known semantic-alias
     });
     registerTokenConfirmRoute({
       api,
@@ -582,10 +544,6 @@ export function createAuthRoutes(
       dispatcher,
       path: Routes.authRequestEmailVerification,
       requestHandler: ev.requestHandler,
-      successKind: "verification-requested",
-      appBaseUrl: ev.appVerifyUrl,
-      sendEmail: ({ email, url, expiresAt }) =>
-        ev.sendVerificationEmail({ email, verificationUrl: url, expiresAt }), // @wrapper-known semantic-alias
     });
     registerTokenConfirmRoute({
       api,
@@ -607,10 +565,6 @@ export function createAuthRoutes(
       dispatcher,
       path: Routes.authSignupRequest,
       requestHandler: sg.requestHandler,
-      successKind: "signup-requested",
-      appBaseUrl: sg.appActivationUrl,
-      sendEmail: ({ email, url, expiresAt }) =>
-        sg.sendActivationEmail({ email, activationUrl: url, expiresAt }), // @wrapper-known semantic-alias
     });
 
     api.post(Routes.authSignupConfirm, async (c) => {
@@ -955,37 +909,19 @@ export function createAuthRoutes(
 }
 
 // --- shared route builders for token flows ---------------------------------
-// Password-reset and email-verification share the exact same HTTP-shape:
-// request-route emits a token → optional sendEmail callback → silent-success,
-// confirm-route validates token + does the state change → typed failure or
-// 200. Before this extraction both flows carried ~45 LOC of nearly-identical
-// body-parse / dispatch / url-build / response plumbing. The helpers keep
-// the public-facing silent-success invariant in one place — changing how
-// the framework handles "invalid_body" on a public token endpoint is now
-// one edit, not two.
-
-type TokenRequestData = {
-  kind: string;
-  email: string;
-  token: string;
-  expiresAt: string;
-};
-
-type TokenNoOp = { kind: "no-op" };
+// Password-reset, email-verification and signup share the exact same request
+// HTTP-shape: parse body → dispatch the request handler → always-200 (no
+// enumeration). The handler mints the token AND dispatches the magic-link mail
+// via delivery (ctx.notify); the route never sees the token. confirm-route
+// validates the token + does the state change → typed failure or 200. Keeping
+// the silent-success invariant in one place means changing how the framework
+// handles "invalid_body" on a public token endpoint is one edit, not three.
 
 function registerTokenRequestRoute(opts: {
   api: Hono;
   dispatcher: Dispatcher;
   path: string;
   requestHandler: string;
-  // Discriminator the feature handler emits when it actually minted a token
-  // (vs. the silent no-op for unknown/already-handled users).
-  successKind: string;
-  // Base URL of the receiving app page. `?token=…` is appended with proper
-  // separator handling so the caller's URL may or may not carry existing
-  // query params.
-  appBaseUrl: string;
-  sendEmail: (args: { email: string; url: string; expiresAt: string }) => Promise<void>;
 }): void {
   const body = RequestTokenBody;
   opts.api.post(opts.path, async (c) => {
@@ -995,30 +931,11 @@ function registerTokenRequestRoute(opts: {
     // anything from the shape of their input.
     if (!parsed.success) return c.json({ isSuccess: true });
 
-    const result = await opts.dispatcher.write(
-      opts.requestHandler,
-      { email: parsed.data.email },
-      GUEST_USER,
-    );
-
+    // The handler dispatches the magic-link mail via delivery before returning.
     // Handler-level failures (only legitimate reason: misconfiguration) are
-    // silently swallowed — observability logs capture them for ops.
-    if (result.isSuccess) {
-      // @cast-boundary engine-payload — generic dispatcher.write result narrowed by handler-emitted kind
-      const data = result.data as TokenRequestData | TokenNoOp;
-      if (data.kind === opts.successKind) {
-        // TS narrowt nicht durch generic successKind (string, kein literal) —
-        // die kind-Gleichheit garantiert den TokenRequestData-Branch hier.
-        const requested = data as TokenRequestData; // @cast-boundary engine-payload
-        const sep = opts.appBaseUrl.includes("?") ? "&" : "?";
-        const url = `${opts.appBaseUrl}${sep}token=${encodeURIComponent(requested.token)}`;
-        await opts.sendEmail({
-          email: requested.email,
-          url,
-          expiresAt: requested.expiresAt,
-        });
-      }
-    }
+    // silently swallowed — observability logs capture them for ops — so the
+    // response shape stays uniform for unknown vs. known emails.
+    await opts.dispatcher.write(opts.requestHandler, { email: parsed.data.email }, GUEST_USER);
 
     return c.json({ isSuccess: true });
   });