@cosmicdrift/kumiko-samples 0.362.0 → 0.363.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.362.0",
+  "version": "0.363.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.362.0",
+  "version": "0.363.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -115,7 +115,6 @@
     "./channel-discord": "./src/channel-discord/index.ts",
     "./channel-teams": "./src/channel-teams/index.ts",
     "./channel-telegram": "./src/channel-telegram/index.ts",
-    "./renderer-simple": "./src/renderer-simple/index.ts",
     "./renderer-pdf": "./src/renderer-pdf/index.ts",
     "./files-provider-s3": "./src/files-provider-s3/index.ts",
     "./rate-limiting": "./src/rate-limiting/index.ts",
@@ -131,6 +130,7 @@
     "./feature-toggles": "./src/feature-toggles/index.ts",
     "./feature-toggles/web": "./src/feature-toggles/web/index.ts",
     "./template-resolver": "./src/template-resolver/index.ts",
+    "./template-resolver/document-schema": "./src/template-resolver/document-schema.ts",
     "./template-resolver/seeding": "./src/template-resolver/seeding.ts",
     "./template-resolver/testing": "./src/template-resolver/testing.ts",
     "./template-resolver/web": "./src/template-resolver/web/index.ts",
@@ -156,9 +156,19 @@
     "@cosmicdrift/kumiko-types": "workspace:*",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
+    "@tiptap/core": "3.31.3",
+    "@tiptap/extension-link": "3.31.3",
+    "@tiptap/extension-list": "3.31.3",
+    "@tiptap/extension-table": "3.31.3",
+    "@tiptap/html": "3.31.3",
+    "@tiptap/extensions": "3.31.3",
+    "@tiptap/pm": "3.31.3",
+    "@tiptap/react": "3.31.3",
+    "@tiptap/starter-kit": "3.31.3",
     "@types/mailparser": "^3.4.6",
     "@types/qrcode": "^1.5.5",
     "clsx": "^2.1.1",
+    "happy-dom": "^20.11.2",
     "hono": "^4.13.1",
     "imapflow": "^1.7.8",
     "ioredis": "^5.10.1",
@@ -553,10 +563,6 @@
         "types": "./dist/channel-telegram/index.d.ts",
         "default": "./dist/channel-telegram/index.js"
       },
-      "./renderer-simple": {
-        "types": "./dist/renderer-simple/index.d.ts",
-        "default": "./dist/renderer-simple/index.js"
-      },
       "./renderer-pdf": {
         "types": "./dist/renderer-pdf/index.d.ts",
         "default": "./dist/renderer-pdf/index.js"
@@ -617,6 +623,10 @@
         "types": "./dist/template-resolver/index.d.ts",
         "default": "./dist/template-resolver/index.js"
       },
+      "./template-resolver/document-schema": {
+        "types": "./dist/template-resolver/document-schema.d.ts",
+        "default": "./dist/template-resolver/document-schema.js"
+      },
       "./template-resolver/seeding": {
         "types": "./dist/template-resolver/seeding.d.ts",
         "default": "./dist/template-resolver/seeding.js"
@@ -689,6 +699,7 @@
     "@testing-library/user-event": "^14.6.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*",
     "@cosmicdrift/kumiko-locale-es": "workspace:*",
+    "@cosmicdrift/kumiko-renderer-mail-html": "workspace:*",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/packages/bundled-features/src/admin-shell/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "includeDocumentDesigner lists the template navs in the admin workspaces",
+    "detail": "With includeDocumentDesigner, the tenant workspace shows document-designer:nav:templates and the platform workspace document-designer:nav:platform-templates. The option requires the document-designer feature and defaults to false."
+  },
   {
     "version": "0.330.0",
     "type": "breaking",

package/packages/bundled-features/src/admin-shell/feature.ts

@@ -36,6 +36,9 @@ export type CreateAdminShellOptions = {
    *  Requires cap-overview mounted. Default false — apps that don't mount cap-overview
    *  must not get a nav entry pointing at a screen that doesn't exist. */
   readonly includeCapOverview?: boolean;
+  /** Tenant nav → document-designer:nav:templates, platform nav → document-designer:nav:platform-templates.
+   *  Requires document-designer mounted (a separate package, so no import here). Default false. */
+  readonly includeDocumentDesigner?: boolean;
   /** When false, only overview screens + nav are registered — app owns r.workspace(). Default true. */
   readonly registerWorkspaces?: boolean;
   /** Metric list the overview panels are built from — pass the SAME list to
@@ -49,12 +52,13 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
   const platformWsId = options.workspaceIds?.platform ?? DEFAULT_PLATFORM_WORKSPACE_ID;
   const includeTierAdmin = options.includeTierAdmin ?? true;
   const includeCapOverview = options.includeCapOverview ?? false;
+  const includeDocumentDesigner = options.includeDocumentDesigner ?? false;
   const registerWorkspaces = options.registerWorkspaces ?? true;
   const metrics = options.metrics ?? DEFAULT_METRICS;
 
   return defineFeature(ADMIN_SHELL_FEATURE, (r) => {
     r.describe(
-      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
+      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
     );
     r.uiHints({
       displayLabel: "Admin Shell",
@@ -69,6 +73,7 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
     r.requires("metrics-system");
     if (includeTierAdmin) r.requires("tier-engine");
     if (includeCapOverview) r.requires("cap-overview");
+    if (includeDocumentDesigner) r.requires("document-designer");
 
     r.translations({ keys: ADMIN_SHELL_I18N });
 
@@ -77,12 +82,14 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
       "tenant:nav:members",
       "audit:nav:audit-log",
       ...(includeCapOverview ? (["admin-shell:nav:my-caps"] as const) : []),
+      ...(includeDocumentDesigner ? (["document-designer:nav:templates"] as const) : []),
     ];
     const platformNav: string[] = [
       "admin-shell:nav:platform-overview",
       "admin-shell:nav:tenants",
       ...(includeCapOverview ? (["admin-shell:nav:tenant-caps"] as const) : []),
       "jobs:nav:job-runs",
+      ...(includeDocumentDesigner ? (["document-designer:nav:platform-templates"] as const) : []),
       ...(includeTierAdmin ? (["admin-shell:nav:tier-admin"] as const) : []),
     ];
 

package/packages/bundled-features/src/agent-tools/agent-manifest.ts

@@ -18,6 +18,7 @@ import {
   SYSTEM_ONLY_JSON_SCHEMA_KEY,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { recordManifestDenyQns } from "./manifest-deny-qns.js";
 import type {
@@ -199,7 +200,7 @@ export function systemOnlyPropertyNames(jsonSchema: Record<string, unknown>): re
   if (typeof properties !== "object" || properties === null) return [];
   return Object.entries(properties)
     .filter(
-      ([, property]) => (property as Record<string, unknown>)[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true,
+      ([, property]) => isPlainObject(property) && property[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true,
     )
     .map(([name]) => name);
 }
@@ -243,9 +244,7 @@ function buildHandlerEntry(
     // A handler whose schema can't be expressed as JSON Schema (transforms,
     // z.instanceof, ...) is unusable for an agent tool call — leave it out
     // rather than ship a broken tool.
-    inputSchema = withoutSystemOnlyProperties(
-      z.toJSONSchema(def.schema, { io: "input" }) as Record<string, unknown>,
-    );
+    inputSchema = withoutSystemOnlyProperties(z.toJSONSchema(def.schema, { io: "input" }));
   } catch {
     return undefined;
   }

package/packages/bundled-features/src/agent-tools/filter-ops.ts

@@ -1,5 +1,3 @@
 export const FILTER_OPS = ["eq", "ne", "lt", "gt", "lte", "gte", "in"] as const;
 
-export function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
+export { isPlainObject as isRecord } from "@cosmicdrift/kumiko-types/type-guards";

package/packages/bundled-features/src/agent-tools/tool-catalog.ts

@@ -137,9 +137,7 @@ function addToolsForListHandler(
     addTool(sink, tool, { kind: "search", entityName, qn });
   }
 
-  for (const [fieldName, field] of Object.entries(
-    entity.fields as Record<string, FieldDefinition>,
-  )) {
+  for (const [fieldName, field] of Object.entries(entity.fields)) {
     if (!isFilterable(field) || !isReadableWithoutRowCondition(field, roles)) continue;
     const fieldSchema = jsonSchemaTypeForField(field);
     if (!fieldSchema) continue;

package/packages/bundled-features/src/agent-tools/tool-dispatch.ts

@@ -1,5 +1,6 @@
 import type { SessionUser, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
 import type { ToolDispatchDescriptor } from "./types.js";
 
@@ -48,7 +49,7 @@ type PayloadResult =
   | { readonly ok: false; readonly error: string };
 
 function isFilterOp(value: unknown): value is FilterOp {
-  return typeof value === "string" && (FILTER_OPS as readonly string[]).includes(value);
+  return isOneOf(FILTER_OPS, value);
 }
 
 function buildSearchPayload(

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "AuthMailContent is removed",
+    "detail": "The sections-based content type only fed the retired renderer-simple. Auth mails are template notifications with variables, so nothing builds or consumes AuthMailContent anymore.",
+    "migration": "Drop AuthMailContent imports; the auth mail text lives in the seeded templates and is overridden per tenant in the template editor."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Auth mails are notifications with seeded templates, render*Email is gone",
+    "detail": "password-reset, account-unlock, email-verification, signup-activation and invite are declared as r.notification with a localized template and variables, seeded as system templates at boot and rendered by renderer-mail-html, so a tenant can override the text in the template editor. A locale without its own subject key falls back to en, because the renderer has no locale fallback. AuthMailNotificationTypes is exported for the qualified names.",
+    "migration": "The notification types are now `auth-email-password:notify:<name>` (before: the plain names). Update delivery preferences, preference rows and tests that reference the old names. renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, renderActivationEmail, renderInviteEmail, AuthMailSection, RenderTokenContentArgs and RenderInviteEmailArgs are removed; AuthMailContent stays. An app that mounts auth-email-password now needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html (composeRendererStack() from dev-server mounts all of them; with includeBundled, composeFeatures adds whichever is missing). Boot fails with a clear error otherwise, and apps without the template tables need a schema migration (`kumiko schema generate`). kumiko-schema-check counts the three as implicit features of every HAS_AUTH app, so its check fails until that migration exists. Tests that read the token from a mail use the text part (`mail.text`); the html part encodes `=` as `&#x3D;`."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/auth-email-password/email-templates.ts

@@ -1,14 +1,11 @@
-// Default renderers for the transactional auth mails. All four magic-link flows
-// (password-reset, email-verification, signup-activation, invite) emit
-// structured AuthMailContent that the handler hands to delivery (ctx.notify) —
-// renderer-simple turns it into HTML. Apps wanting their own branding swap the
-// renderer; these templates are deliberately plain so the renderer (and the
-// operator reading the mailer log) can rely on them.
+// English texts and expiry formatting for the transactional auth mails. The
+// mail bodies are built from these keys into stored templates (see
+// mail-notifications.ts).
 //
 // English ships here. Other languages register via @cosmicdrift/kumiko-locale-*
 // (localeDe() / localeEs() call registerMailTranslations).
 
-import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 
 export type AuthMailLocale = string;
@@ -56,138 +53,14 @@ export const AUTH_MAIL_EN: Readonly<Record<string, string>> = {
 
 registerMailTranslations("en", AUTH_MAIL_EN);
 
-export type RenderTokenContentArgs = {
-  readonly url: string;
+export type TokenMailTiming = {
   readonly expiresAt: string;
-  readonly locale?: AuthMailLocale;
-  /** Optional app name for subject + intro. Default from auth.mail.appNameDefault. */
-  readonly appName?: string;
   /** ISO instant the token was issued; the validity duration is measured from it. Default: now. */
   readonly issuedAt?: string;
   /** IANA zone the expiry time is shown in. Default "UTC"; an invalid zone falls back to "UTC". */
   readonly timeZone?: string;
 };
 
-export type RenderInviteEmailArgs = RenderTokenContentArgs & { readonly role: string };
-
-export type AuthMailSection =
-  | { readonly text: string }
-  | { readonly button: { readonly label: string; readonly url: string } };
-
-export type AuthMailContent = {
-  readonly subject: string;
-  readonly header: string;
-  readonly sections: readonly AuthMailSection[];
-  readonly footer: string;
-};
-
-function tokenMailContent(spec: {
-  readonly subject: string;
-  readonly header: string;
-  readonly greeting: string;
-  readonly intro: string;
-  readonly buttonLabel: string;
-  readonly buttonUrl: string;
-  readonly expiry: string;
-  readonly ignore: string;
-}): AuthMailContent {
-  return {
-    subject: spec.subject,
-    header: spec.header,
-    sections: [
-      { text: spec.greeting },
-      { text: spec.intro },
-      { button: { label: spec.buttonLabel, url: spec.buttonUrl } },
-      { text: spec.expiry },
-    ],
-    footer: spec.ignore,
-  };
-}
-
-function t(locale: string, key: string, params?: Readonly<Record<string, string>>): string {
-  return mailT(locale, key, params);
-}
-
-function appNameFor(args: RenderTokenContentArgs): string {
-  const locale = args.locale ?? "en";
-  return args.appName ?? t(locale, "auth.mail.appNameDefault");
-}
-
-export function renderResetPasswordEmail(args: RenderTokenContentArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.reset.subject", { app }),
-    header: t(locale, "auth.mail.reset.button"),
-    greeting: t(locale, "auth.mail.reset.greeting"),
-    intro: t(locale, "auth.mail.reset.intro", { app }),
-    buttonLabel: t(locale, "auth.mail.reset.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.reset.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.reset.ignore"),
-  });
-}
-
-export function renderUnlockAccountEmail(args: RenderTokenContentArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.unlock.subject", { app }),
-    header: t(locale, "auth.mail.unlock.button"),
-    greeting: t(locale, "auth.mail.unlock.greeting"),
-    intro: t(locale, "auth.mail.unlock.intro", { app }),
-    buttonLabel: t(locale, "auth.mail.unlock.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.unlock.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.unlock.ignore"),
-  });
-}
-
-export function renderVerifyEmail(args: RenderTokenContentArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.verify.subject", { app }),
-    header: t(locale, "auth.mail.verify.button"),
-    greeting: t(locale, "auth.mail.verify.greeting"),
-    intro: t(locale, "auth.mail.verify.intro", { app }),
-    buttonLabel: t(locale, "auth.mail.verify.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.verify.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.verify.ignore"),
-  });
-}
-
-export function renderActivationEmail(args: RenderTokenContentArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.activation.subject", { app }),
-    header: t(locale, "auth.mail.activation.button"),
-    greeting: t(locale, "auth.mail.activation.greeting"),
-    intro: t(locale, "auth.mail.activation.intro", { app }),
-    buttonLabel: t(locale, "auth.mail.activation.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.activation.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.activation.ignore"),
-  });
-}
-
-export function renderInviteEmail(args: RenderInviteEmailArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = args.appName ?? "Workspace";
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.invite.subject", { app }),
-    header: t(locale, "auth.mail.invite.button"),
-    greeting: t(locale, "auth.mail.invite.greeting"),
-    intro: t(locale, "auth.mail.invite.intro", { app, role: args.role }),
-    buttonLabel: t(locale, "auth.mail.invite.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.invite.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.invite.ignore"),
-  });
-}
-
 const MS_PER_MINUTE = 60_000;
 const MS_PER_HOUR = 60 * MS_PER_MINUTE;
 const MS_PER_DAY = 24 * MS_PER_HOUR;
@@ -241,18 +114,19 @@ function formatWhen(expiresAt: Temporal.Instant, locale: string, timeZone: strin
   }
 }
 
-function expiryParams(
-  args: RenderTokenContentArgs,
+// Formatted as text here because the stored template only knows plain variables.
+export function tokenMailExpiry(
+  args: TokenMailTiming,
   locale: string,
-): { readonly duration: string; readonly when: string } {
+): { readonly validFor: string; readonly validUntil: string } {
   try {
     const expiresAt = Temporal.Instant.from(args.expiresAt);
     const issuedAt = args.issuedAt ? Temporal.Instant.from(args.issuedAt) : Temporal.Now.instant();
     return {
-      duration: formatDuration(expiresAt.epochMilliseconds - issuedAt.epochMilliseconds, locale),
-      when: formatWhen(expiresAt, locale, args.timeZone ?? "UTC"),
+      validFor: formatDuration(expiresAt.epochMilliseconds - issuedAt.epochMilliseconds, locale),
+      validUntil: formatWhen(expiresAt, locale, args.timeZone ?? "UTC"),
     };
   } catch {
-    return { duration: args.expiresAt, when: args.expiresAt };
+    return { validFor: args.expiresAt, validUntil: args.expiresAt };
   }
 }

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -30,6 +30,12 @@ import {
 } from "./handlers/signup-request.write.js";
 import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
+import {
+  AUTH_MAIL_VARIABLES,
+  authMailLocalizedTemplate,
+  INVITE_MAIL_VARIABLES,
+  sendsMagicLinkMail,
+} from "./mail-notifications.js";
 
 /**
  * Env-vars contract for the `auth-email-password` feature.
@@ -199,17 +205,32 @@ export function createAuthEmailPasswordFeature(
     // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
     // via ctx.notify → delivery must be mounted. Fail closed at boot instead
     // of silently dropping the mail.
-    if (
-      opts.passwordReset ||
-      opts.emailVerification ||
-      opts.signup ||
-      opts.invite ||
-      opts.accountUnlock
-    ) {
-      r.requires("delivery");
-    }
+    if (sendsMagicLinkMail(opts)) r.requires("delivery");
     r.envSchema(authEmailPasswordEnvSchema);
 
+    // Declared unconditionally: apps also issue the activation link from their
+    // own flows (issueSignupActivation) without enabling the signup option.
+    r.notification("password-reset", {
+      variables: AUTH_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("passwordReset"),
+    });
+    r.notification("account-unlock", {
+      variables: AUTH_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("accountUnlock"),
+    });
+    r.notification("email-verification", {
+      variables: AUTH_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("emailVerification"),
+    });
+    r.notification("signup-activation", {
+      variables: AUTH_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("signupActivation"),
+    });
+    r.notification("invite", {
+      variables: INVITE_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("invite"),
+    });
+
     const handlers = {
       login: r.writeHandler(
         createLoginHandler({

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -55,12 +55,10 @@ import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
 import { userTable } from "../../user/schema/user.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
 import type { AuthMailLocale } from "../email-templates.js";
-import { renderInviteEmail } from "../email-templates.js";
 import { inviteAlreadyAccepted } from "../errors.js";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
-
-const INVITE_NOTIFICATION_TYPE = "auth-email-password:invite";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 
 type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
 
@@ -247,8 +245,8 @@ async function issueInvitation(
     ctx.notify,
     {
       handlerName: "invite-create",
-      notificationType: INVITE_NOTIFICATION_TYPE,
-      renderContent: (renderArgs) => renderInviteEmail({ ...renderArgs, role: request.role }),
+      notificationType: AuthMailNotificationTypes.invite,
+      fallbackAppName: "Workspace",
     },
     {
       email,
@@ -257,6 +255,7 @@ async function issueInvitation(
       expiresAt: expiresAt.toString(),
       issuedAt: issuedAt.toString(),
       timeZone: ctx.tz.user,
+      role: request.role,
       ...(opts.appName !== undefined && { appName: opts.appName }),
       locale,
     },

package/packages/bundled-features/src/auth-email-password/handlers/request-account-unlock.write.ts

@@ -1,5 +1,5 @@
 import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderUnlockAccountEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signUnlockToken } from "../unlock-token.js";
 import {
   createTokenRequestHandler,
@@ -7,8 +7,6 @@ import {
   type TokenRequestOptions,
 } from "./token-request-handler.js";
 
-const UNLOCK_NOTIFICATION_TYPE = "auth-email-password:account-unlock";
-
 export type RequestAccountUnlockOptions = TokenRequestOptions;
 
 // Public shape re-exported for callers that build custom routes on top of
@@ -32,8 +30,7 @@ export function createRequestAccountUnlockHandler(opts: RequestAccountUnlockOpti
       // locked right now. Confirming just clears the (possibly already
       // empty) lockout state — harmless no-op if they weren't locked.
       extraSilentSkip: () => false,
-      notificationType: UNLOCK_NOTIFICATION_TYPE,
-      renderContent: renderUnlockAccountEmail,
+      notificationType: AuthMailNotificationTypes.accountUnlock,
     },
     opts,
   );

package/packages/bundled-features/src/auth-email-password/handlers/request-email-verification.write.ts

@@ -1,5 +1,5 @@
 import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderVerifyEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signVerificationToken } from "../verification-token.js";
 import {
   createTokenRequestHandler,
@@ -7,8 +7,6 @@ import {
   type TokenRequestOptions,
 } from "./token-request-handler.js";
 
-const VERIFY_NOTIFICATION_TYPE = "auth-email-password:email-verification";
-
 export type RequestEmailVerificationOptions = TokenRequestOptions;
 
 export type RequestVerificationData = TokenRequestData<"verification-requested">;
@@ -29,8 +27,7 @@ export function createRequestEmailVerificationHandler(opts: RequestEmailVerifica
       // unknown/deleted to keep the enumeration surface symmetric — the
       // caller sees the same 200 regardless of whether a token was minted.
       extraSilentSkip: (user) => user.emailVerified === true,
-      notificationType: VERIFY_NOTIFICATION_TYPE,
-      renderContent: renderVerifyEmail,
+      notificationType: AuthMailNotificationTypes.emailVerification,
     },
     opts,
   );

package/packages/bundled-features/src/auth-email-password/handlers/request-password-reset.write.ts

@@ -1,5 +1,5 @@
 import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderResetPasswordEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signResetToken } from "../reset-token.js";
 import {
   createTokenRequestHandler,
@@ -7,8 +7,6 @@ import {
   type TokenRequestOptions,
 } from "./token-request-handler.js";
 
-const RESET_NOTIFICATION_TYPE = "auth-email-password:password-reset";
-
 export type RequestPasswordResetOptions = TokenRequestOptions;
 
 // Public shape re-exported for callers that build custom routes on top of
@@ -31,8 +29,7 @@ export function createRequestPasswordResetHandler(opts: RequestPasswordResetOpti
       // non-deleted user can initiate a reset regardless of verification
       // state. The sessions feature handles the post-change revocation.
       extraSilentSkip: () => false,
-      notificationType: RESET_NOTIFICATION_TYPE,
-      renderContent: renderResetPasswordEmail,
+      notificationType: AuthMailNotificationTypes.passwordReset,
     },
     opts,
   );

package/packages/bundled-features/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -36,6 +36,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/errors";
 import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import {
   findSignupHandoverProvider,
@@ -100,10 +101,8 @@ const SIGNUP_CONFIRM_PROVISION_REASON =
 // match; this reads the same field the framework itself uses.
 function isBenignClaimRejection(error: WriteErrorInfo): boolean {
   return (
-    typeof error.details === "object" &&
-    error.details !== null &&
-    (error.details as Record<string, unknown>)["reason"] ===
-      SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE
+    isPlainObject(error.details) &&
+    error.details["reason"] === SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE
   );
 }
 

package/packages/bundled-features/src/auth-email-password/handlers/token-request-handler.ts

@@ -19,11 +19,7 @@ import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { UserQueries } from "../../user/index.js";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row.js";
-import type {
-  AuthMailContent,
-  AuthMailLocale,
-  RenderTokenContentArgs,
-} from "../email-templates.js";
+import type { AuthMailLocale } from "../email-templates.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 
 const RequestTokenSchema = z.object({
@@ -67,13 +63,9 @@ export type TokenRequestSpec<TName extends string, TSuccessKind extends string>
   // soft-deleted". Verification skips when emailVerified is already true;
   // password-reset has no extra condition (returns false).
   readonly extraSilentSkip: (user: AuthUserRow) => boolean;
-  // Notification type dispatched via ctx.notify on success. No r.notification
-  // is declared (the recipient is an anonymous email, not a userId) — the
-  // route:{email} path delivers directly and buildMessage falls back to data.
+  // Trigger-less r.notification dispatched via ctx.notify on success; the
+  // recipient is an anonymous email, so route:{email} delivers directly.
   readonly notificationType: string;
-  // Builds the structured mail body from the magic-link + expiry. Per-flow
-  // (renderResetPasswordEmail / renderVerifyEmail).
-  readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
 };
 
 export type TokenRequestOptions = {
@@ -154,7 +146,6 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
         {
           handlerName: spec.handlerName,
           notificationType: spec.notificationType,
-          renderContent: spec.renderContent,
         },
         {
           // Row value is ciphertext with an active KMS; the byte-exact