@cosmicdrift/kumiko-samples 0.362.0 → 0.364.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.362.0",
+  "version": "0.364.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.362.0",
+  "version": "0.364.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -106,6 +106,7 @@
     "./shared/single-use-token-store": "./src/shared/single-use-token-store.ts",
     "./shared/signed-token": "./src/shared/signed-token.ts",
     "./shared/row-bound-grant": "./src/shared/row-bound-grant.ts",
+    "./shared/mail-template-body": "./src/shared/mail-template-body.ts",
     "./delivery": "./src/delivery/index.ts",
     "./delivery/web": "./src/delivery/web/index.ts",
     "./channel-in-app": "./src/channel-in-app/index.ts",
@@ -115,7 +116,6 @@
     "./channel-discord": "./src/channel-discord/index.ts",
     "./channel-teams": "./src/channel-teams/index.ts",
     "./channel-telegram": "./src/channel-telegram/index.ts",
-    "./renderer-simple": "./src/renderer-simple/index.ts",
     "./renderer-pdf": "./src/renderer-pdf/index.ts",
     "./files-provider-s3": "./src/files-provider-s3/index.ts",
     "./rate-limiting": "./src/rate-limiting/index.ts",
@@ -131,6 +131,7 @@
     "./feature-toggles": "./src/feature-toggles/index.ts",
     "./feature-toggles/web": "./src/feature-toggles/web/index.ts",
     "./template-resolver": "./src/template-resolver/index.ts",
+    "./template-resolver/document-schema": "./src/template-resolver/document-schema.ts",
     "./template-resolver/seeding": "./src/template-resolver/seeding.ts",
     "./template-resolver/testing": "./src/template-resolver/testing.ts",
     "./template-resolver/web": "./src/template-resolver/web/index.ts",
@@ -156,9 +157,19 @@
     "@cosmicdrift/kumiko-types": "workspace:*",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
+    "@tiptap/core": "3.31.3",
+    "@tiptap/extension-link": "3.31.3",
+    "@tiptap/extension-list": "3.31.3",
+    "@tiptap/extension-table": "3.31.3",
+    "@tiptap/html": "3.31.3",
+    "@tiptap/extensions": "3.31.3",
+    "@tiptap/pm": "3.31.3",
+    "@tiptap/react": "3.31.3",
+    "@tiptap/starter-kit": "3.31.3",
     "@types/mailparser": "^3.4.6",
     "@types/qrcode": "^1.5.5",
     "clsx": "^2.1.1",
+    "happy-dom": "^20.11.2",
     "hono": "^4.13.1",
     "imapflow": "^1.7.8",
     "ioredis": "^5.10.1",
@@ -170,6 +181,7 @@
     "pdf-lib": "^1.17.1",
     "qrcode": "^1.5.4",
     "react": "^19.2.6",
+    "react-dom": "^19.2.6",
     "sharp": "^0.35.5",
     "stripe": "^22.6.2",
     "tailwind-merge": "^3.6.0",
@@ -517,6 +529,10 @@
         "types": "./dist/shared/row-bound-grant.d.ts",
         "default": "./dist/shared/row-bound-grant.js"
       },
+      "./shared/mail-template-body": {
+        "types": "./dist/shared/mail-template-body.d.ts",
+        "default": "./dist/shared/mail-template-body.js"
+      },
       "./delivery": {
         "types": "./dist/delivery/index.d.ts",
         "default": "./dist/delivery/index.js"
@@ -553,10 +569,6 @@
         "types": "./dist/channel-telegram/index.d.ts",
         "default": "./dist/channel-telegram/index.js"
       },
-      "./renderer-simple": {
-        "types": "./dist/renderer-simple/index.d.ts",
-        "default": "./dist/renderer-simple/index.js"
-      },
       "./renderer-pdf": {
         "types": "./dist/renderer-pdf/index.d.ts",
         "default": "./dist/renderer-pdf/index.js"
@@ -617,6 +629,10 @@
         "types": "./dist/template-resolver/index.d.ts",
         "default": "./dist/template-resolver/index.js"
       },
+      "./template-resolver/document-schema": {
+        "types": "./dist/template-resolver/document-schema.d.ts",
+        "default": "./dist/template-resolver/document-schema.js"
+      },
       "./template-resolver/seeding": {
         "types": "./dist/template-resolver/seeding.d.ts",
         "default": "./dist/template-resolver/seeding.js"
@@ -689,6 +705,7 @@
     "@testing-library/user-event": "^14.6.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*",
     "@cosmicdrift/kumiko-locale-es": "workspace:*",
+    "@cosmicdrift/kumiko-renderer-mail-html": "workspace:*",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/packages/bundled-features/src/admin-shell/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "includeDocumentDesigner lists the template navs in the admin workspaces",
+    "detail": "With includeDocumentDesigner, the tenant workspace shows document-designer:nav:templates and the platform workspace document-designer:nav:platform-templates. The option requires the document-designer feature and defaults to false."
+  },
   {
     "version": "0.330.0",
     "type": "breaking",

package/packages/bundled-features/src/admin-shell/feature.ts

@@ -36,6 +36,9 @@ export type CreateAdminShellOptions = {
    *  Requires cap-overview mounted. Default false — apps that don't mount cap-overview
    *  must not get a nav entry pointing at a screen that doesn't exist. */
   readonly includeCapOverview?: boolean;
+  /** Tenant nav → document-designer:nav:templates, platform nav → document-designer:nav:platform-templates.
+   *  Requires document-designer mounted (a separate package, so no import here). Default false. */
+  readonly includeDocumentDesigner?: boolean;
   /** When false, only overview screens + nav are registered — app owns r.workspace(). Default true. */
   readonly registerWorkspaces?: boolean;
   /** Metric list the overview panels are built from — pass the SAME list to
@@ -49,12 +52,13 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
   const platformWsId = options.workspaceIds?.platform ?? DEFAULT_PLATFORM_WORKSPACE_ID;
   const includeTierAdmin = options.includeTierAdmin ?? true;
   const includeCapOverview = options.includeCapOverview ?? false;
+  const includeDocumentDesigner = options.includeDocumentDesigner ?? false;
   const registerWorkspaces = options.registerWorkspaces ?? true;
   const metrics = options.metrics ?? DEFAULT_METRICS;
 
   return defineFeature(ADMIN_SHELL_FEATURE, (r) => {
     r.describe(
-      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
+      "Registers tenant-admin and platform-admin workspaces with provider nav into owner-feature screens (`tenant:screen:members`, `audit:screen:audit-log`, `tenant:screen:tenant-list`, `jobs:screen:job-runs`, optional `tier-engine:screen:tier-admin`, optional `cap-overview:screen:my-caps`/`cap-overview:screen:tenant-cap-list`, optional `document-designer` template navs) and the two overview dashboards, built from the metrics list (`metrics` option, default DEFAULT_METRICS). Mount after user, tenant, audit, jobs, metrics and metrics-system; pass `workspaceIds` to match app URL conventions (e.g. Studio `d`/`s`, PublicStatus `admin`/`sysadmin`). Client: `adminShellClient()`, `tenantClient()`, `auditClient()`, `jobsClient()`, optional `tierEngineClient()`.",
     );
     r.uiHints({
       displayLabel: "Admin Shell",
@@ -69,6 +73,7 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
     r.requires("metrics-system");
     if (includeTierAdmin) r.requires("tier-engine");
     if (includeCapOverview) r.requires("cap-overview");
+    if (includeDocumentDesigner) r.requires("document-designer");
 
     r.translations({ keys: ADMIN_SHELL_I18N });
 
@@ -77,12 +82,14 @@ export function createAdminShellFeature(options: CreateAdminShellOptions = {}):
       "tenant:nav:members",
       "audit:nav:audit-log",
       ...(includeCapOverview ? (["admin-shell:nav:my-caps"] as const) : []),
+      ...(includeDocumentDesigner ? (["document-designer:nav:templates"] as const) : []),
     ];
     const platformNav: string[] = [
       "admin-shell:nav:platform-overview",
       "admin-shell:nav:tenants",
       ...(includeCapOverview ? (["admin-shell:nav:tenant-caps"] as const) : []),
       "jobs:nav:job-runs",
+      ...(includeDocumentDesigner ? (["document-designer:nav:platform-templates"] as const) : []),
       ...(includeTierAdmin ? (["admin-shell:nav:tier-admin"] as const) : []),
     ];
 

package/packages/bundled-features/src/agent-tools/agent-manifest.ts

@@ -18,6 +18,7 @@ import {
   SYSTEM_ONLY_JSON_SCHEMA_KEY,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { recordManifestDenyQns } from "./manifest-deny-qns.js";
 import type {
@@ -199,7 +200,7 @@ export function systemOnlyPropertyNames(jsonSchema: Record<string, unknown>): re
   if (typeof properties !== "object" || properties === null) return [];
   return Object.entries(properties)
     .filter(
-      ([, property]) => (property as Record<string, unknown>)[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true,
+      ([, property]) => isPlainObject(property) && property[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true,
     )
     .map(([name]) => name);
 }
@@ -243,9 +244,7 @@ function buildHandlerEntry(
     // A handler whose schema can't be expressed as JSON Schema (transforms,
     // z.instanceof, ...) is unusable for an agent tool call — leave it out
     // rather than ship a broken tool.
-    inputSchema = withoutSystemOnlyProperties(
-      z.toJSONSchema(def.schema, { io: "input" }) as Record<string, unknown>,
-    );
+    inputSchema = withoutSystemOnlyProperties(z.toJSONSchema(def.schema, { io: "input" }));
   } catch {
     return undefined;
   }

package/packages/bundled-features/src/agent-tools/filter-ops.ts

@@ -1,5 +1,3 @@
 export const FILTER_OPS = ["eq", "ne", "lt", "gt", "lte", "gte", "in"] as const;
 
-export function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
+export { isPlainObject as isRecord } from "@cosmicdrift/kumiko-types/type-guards";

package/packages/bundled-features/src/agent-tools/tool-catalog.ts

@@ -137,9 +137,7 @@ function addToolsForListHandler(
     addTool(sink, tool, { kind: "search", entityName, qn });
   }
 
-  for (const [fieldName, field] of Object.entries(
-    entity.fields as Record<string, FieldDefinition>,
-  )) {
+  for (const [fieldName, field] of Object.entries(entity.fields)) {
     if (!isFilterable(field) || !isReadableWithoutRowCondition(field, roles)) continue;
     const fieldSchema = jsonSchemaTypeForField(field);
     if (!fieldSchema) continue;

package/packages/bundled-features/src/agent-tools/tool-dispatch.ts

@@ -1,5 +1,6 @@
 import type { SessionUser, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
 import type { ToolDispatchDescriptor } from "./types.js";
 
@@ -48,7 +49,7 @@ type PayloadResult =
   | { readonly ok: false; readonly error: string };
 
 function isFilterOp(value: unknown): value is FilterOp {
-  return typeof value === "string" && (FILTER_OPS as readonly string[]).includes(value);
+  return isOneOf(FILTER_OPS, value);
 }
 
 function buildSearchPayload(

package/packages/bundled-features/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Audit list pages by id unless sorted by type",
+    "detail": "An explicit createdAt sort pages in id order so keyset pagination no longer skips rows."
+  },
   {
     "version": "0.361.0",
     "type": "fix",

package/packages/bundled-features/src/audit/handlers/list.query.ts

@@ -117,11 +117,16 @@ export const listQuery = defineQueryHandler({
       createdAt: unknown;
       createdBy: string;
     }>(ctx.db, eventsTable, where, {
-      // `id` as tie-breaker keeps the order total, so pages never overlap.
-      orderBy: [
-        { col: p.sort === "type" ? "type" : "createdAt", direction },
-        { col: "id", direction },
-      ],
+      // The id cursor only resumes an id-ordered listing. created_at comes from the
+      // transaction start and can run against insert order, so ordering by it would let
+      // a page boundary skip rows; only the type sort leaves id order (and is one page).
+      orderBy:
+        p.sort === "type"
+          ? [
+              { col: "type", direction },
+              { col: "id", direction },
+            ]
+          : [{ col: "id", direction }],
       limit: p.limit,
     });
 

package/packages/bundled-features/src/auth-email-password/bootstrap.ts

@@ -7,23 +7,26 @@
 
 import {
   makeDispatchSystemWrite,
-  type SystemDispatchArgs,
+  makeDispatchWriteAs,
+  type RoleDispatchArgs,
 } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   ConfigScopes,
   createSystemUser,
+  type Registry,
   type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import type { Redis } from "ioredis";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
 import { ConfigHandlers } from "../config/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap compares against the stored config row to stay idempotent
-import { findConfigRow } from "../config/write-helpers.js";
+import { configRowHoldsValue, findConfigRow } from "../config/write-helpers.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
 import { TenantHandlers } from "../tenant/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
@@ -55,9 +58,7 @@ export type BootstrapSeedDeps = {
   /** Writes as the system user with the given tenant roles in the seeded
    *  tenant; use it when the app gates tenant data on its own roles rather
    *  than SystemAdmin. */
-  readonly dispatchWriteAs: (
-    args: Pick<SystemDispatchArgs, "handlerQn" | "payload"> & { readonly roles: readonly string[] },
-  ) => Promise<WriteResult>;
+  readonly dispatchWriteAs: (args: Omit<RoleDispatchArgs, "tenantId">) => Promise<WriteResult>;
 };
 
 export type BootstrapConfigValue = string | number | boolean;
@@ -96,6 +97,10 @@ export type BootstrapDeps = {
   readonly db: DbConnection;
   readonly redis: Redis;
   readonly dispatcher: Dispatcher;
+  /** With these, a rerun can compare `encrypted`/`piiEncrypted` config keys by
+   *  their decrypted value; without them such keys are rewritten on every run. */
+  readonly registry?: Registry;
+  readonly configCipher?: EnvelopeCipher;
 };
 
 export type BootstrapTenantOutcome = "created" | "exists";
@@ -216,7 +221,18 @@ async function applyTenantConfig(
   const applied: string[] = [];
   for (const [key, value] of Object.entries(tenant.config ?? {})) {
     const existing = await findConfigRow(deps.db, key, tenant.id, null);
-    if (existing?.value === JSON.stringify(value)) continue;
+    const serialized = JSON.stringify(value);
+    if (
+      await configRowHoldsValue(
+        existing,
+        deps.registry?.getConfigKey(key),
+        deps.configCipher,
+        key,
+        serialized,
+      )
+    ) {
+      continue;
+    }
     const result = await deps.dispatcher.write(
       ConfigHandlers.set,
       { key, value, scope: ConfigScopes.tenant },
@@ -266,6 +282,11 @@ async function decideInvite(
     return "role-mismatch";
   }
   if (invitation.status === INVITATION_STATUS.accepted) return "active";
+  // The plan dropped a global role (e.g. an admin moved to tenants[].invites):
+  // the stored invitation would still grant it on accept, so it is re-issued.
+  if (storedGlobalRoles.some((role) => !invite.globalRoles.some((planned) => planned === role))) {
+    return "resent";
+  }
   if (await hasLiveInviteToken(deps.redis, invitation.id)) return "pending";
   return "resent";
 }
@@ -280,6 +301,7 @@ export async function bootstrapTenants(
 ): Promise<BootstrapReport> {
   const plannedInvites = planInvites(plan);
   const dispatchSystemWrite = makeDispatchSystemWrite(deps.dispatcher);
+  const dispatchWriteAsRoles = makeDispatchWriteAs(deps.dispatcher);
 
   const tenants: Array<BootstrapReport["tenants"][number]> = [];
   for (const tenant of plan.tenants) {
@@ -290,8 +312,7 @@ export async function bootstrapTenants(
         tenantId: tenant.id,
         db: deps.db,
         dispatchSystemWrite,
-        dispatchWriteAs: ({ handlerQn, payload, roles }) =>
-          deps.dispatcher.write(handlerQn, payload, createSystemUser(tenant.id, roles)),
+        dispatchWriteAs: (args) => dispatchWriteAsRoles({ ...args, tenantId: tenant.id }),
       });
     }
     const configApplied = await applyTenantConfig(deps, tenant);

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,55 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A loginUrl builder that throws no longer crashes the app tree",
+    "detail": "The auth gate resolves the login redirect once per location change and, when the builder returns an invalid URL or throws, logs the error and shows the built-in login screen instead of throwing during render."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "How to send an auth mail after the render*Email helpers were removed in 0.363.0",
+    "detail": "No runtime change. The 0.363.0 breaking entry lists renderActivationEmail, renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail and renderInviteEmail as removed but does not say how app code that rendered one of these mails itself now sends it. This entry adds that recipe.",
+    "migration": "App code that rendered an auth mail itself and passed the result as `data`, for example `notify(\"auth-email-password:signup-activation\", { route: { email }, data: renderActivationEmail({ url, expiresAt, locale, appName }), priority: \"critical\" })`, breaks twice since 0.363.0: the helper is gone and the notification type is now `auth-email-password:notify:signup-activation`. The stored template renders subject and body; the app only passes template variables.\nFor a signup activation link, call `issueSignupActivation({ redis, notify: ctx.notify, email, appUrl, appName, locale, timeZone, tokenTtlMinutes, onTokenStored })` from `@cosmicdrift/kumiko-bundled-features/auth-email-password` (only redis, notify, email and appUrl are required). It drops any live signup token for the email, stores a new one under the keys signup-confirm reads and sends the mail. `appUrl` is the bare activation page; a function `(locale) => url` picks the page per locale.\nIf the app stores the token itself and only needs the mail, call `ctx.notify(AuthMailNotificationTypes.signupActivation, { route: { email }, data: { appName, actionUrl, validFor, validUntil }, locale, priority: \"critical\" })`. `AuthMailNotificationTypes` comes from `@cosmicdrift/kumiko-bundled-features/auth-email-password`. All four variables are required strings: ctx.notify checks them against the declared template variables and throws an InternalError on a missing or invalid one, which fails the write. `actionUrl` is the page URL with `token=<encodeURIComponent(token)>` appended as a query parameter and must be an http, https or mailto URL. `validFor` and `validUntil` come from `tokenMailExpiry({ expiresAt, issuedAt, timeZone }, locale)` in `@cosmicdrift/kumiko-bundled-features/auth-email-password/email-templates`. Only send a `locale` that has a template for the type, because the renderer has no locale fallback and a locale without a template sends nothing: use `resolveMailLocale(locale)` when `hasMailTranslationKey(resolveMailLocale(locale), \"auth.mail.activation.subject\")` is true (both from `@cosmicdrift/kumiko-framework/i18n`), otherwise `\"en\"`. The other mails use the subject keys `auth.mail.reset.subject`, `auth.mail.unlock.subject`, `auth.mail.verify.subject` and `auth.mail.invite.subject`.\nThe other auth mails work the same way with `AuthMailNotificationTypes.passwordReset`, `.accountUnlock`, `.emailVerification` and `.invite`; the invite mail also needs a `role` variable."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "seedAdminGuarded rewrites the admin email only when its blind index is missing or stale",
+    "detail": "rewriteSeededUserEmail returns early when the stored email blind index already matches the expected value, so repeated boots no longer re-encrypt the email and grow the user event stream. The row version is now checked with a type guard instead of a cast."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Bootstrap reruns no longer rewrite encrypted config or restore dropped global roles",
+    "detail": "Declarative bootstrap compares encrypted and piiEncrypted config keys by their decrypted value, so a matching rerun writes nothing, and re-issues an invitation whose stored global roles are no longer in the plan. makeDispatchWriteAs is exported from the framework api."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Email payload buckets ignore plus-tags and case; auth requests are capped at 3 per 15 minutes",
+    "detail": "additionalRateLimits accepts normalize: email, which lowercases and strips the plus-tag before hashing, and bucket keys are scoped by tenant and handler. Signup and token requests (reset, unlock, verification) and the waitlist default use it with a 3-request, 900-second window."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Password change and logout work for members with only an app role or TenantAdmin",
+    "detail": "Both handlers required User, Admin or SystemAdmin and answered 403 access_denied for invited members holding a single custom role. They are now open to every signed-in user, like the other self-service handlers; anonymous callers are still rejected."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "AuthMailContent is removed",
+    "detail": "The sections-based content type only fed the retired renderer-simple. Auth mails are template notifications with variables, so nothing builds or consumes AuthMailContent anymore.",
+    "migration": "Drop AuthMailContent imports; the auth mail text lives in the seeded templates and is overridden per tenant in the template editor."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Auth mails are notifications with seeded templates, render*Email is gone",
+    "detail": "password-reset, account-unlock, email-verification, signup-activation and invite are declared as r.notification with a localized template and variables, seeded as system templates at boot and rendered by renderer-mail-html, so a tenant can override the text in the template editor. A locale without its own subject key falls back to en, because the renderer has no locale fallback. AuthMailNotificationTypes is exported for the qualified names.",
+    "migration": "The notification types are now `auth-email-password:notify:<name>` (before: the plain names). Update delivery preferences, preference rows and tests that reference the old names. renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, renderActivationEmail, renderInviteEmail, AuthMailSection, RenderTokenContentArgs and RenderInviteEmailArgs are removed; AuthMailContent stays. An app that mounts auth-email-password now needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html (composeRendererStack() from dev-server mounts all of them; with includeBundled, composeFeatures adds whichever is missing). Boot fails with a clear error otherwise, and apps without the template tables need a schema migration (`kumiko schema generate`). kumiko-schema-check counts the three as implicit features of every HAS_AUTH app, so its check fails until that migration exists. Tests that read the token from a mail use the text part (`mail.text`); the html part encodes `=` as `&#x3D;`."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/auth-email-password/email-rate-limits.ts

@@ -0,0 +1,16 @@
+import type { PayloadRateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+
+// The bucket counts across all IPs, so a long window would let an attacker who
+// knows an address lock its owner out of recovery/signup for the whole window.
+// A short one still throttles mail bombing but clears within minutes.
+export const AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS = 15 * 60;
+export const AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS = 3;
+
+export const AUTH_EMAIL_PAYLOAD_RATE_LIMITS: readonly PayloadRateLimitOption[] = [
+  {
+    per: { payloadField: "email" },
+    limit: AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS,
+    windowSeconds: AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS,
+    normalize: "email",
+  },
+];

package/packages/bundled-features/src/auth-email-password/email-templates.ts

@@ -1,14 +1,11 @@
-// Default renderers for the transactional auth mails. All four magic-link flows
-// (password-reset, email-verification, signup-activation, invite) emit
-// structured AuthMailContent that the handler hands to delivery (ctx.notify) —
-// renderer-simple turns it into HTML. Apps wanting their own branding swap the
-// renderer; these templates are deliberately plain so the renderer (and the
-// operator reading the mailer log) can rely on them.
+// English texts and expiry formatting for the transactional auth mails. The
+// mail bodies are built from these keys into stored templates (see
+// mail-notifications.ts).
 //
 // English ships here. Other languages register via @cosmicdrift/kumiko-locale-*
 // (localeDe() / localeEs() call registerMailTranslations).
 
-import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 
 export type AuthMailLocale = string;
@@ -56,138 +53,14 @@ export const AUTH_MAIL_EN: Readonly<Record<string, string>> = {
 
 registerMailTranslations("en", AUTH_MAIL_EN);
 
-export type RenderTokenContentArgs = {
-  readonly url: string;
+export type TokenMailTiming = {
   readonly expiresAt: string;
-  readonly locale?: AuthMailLocale;
-  /** Optional app name for subject + intro. Default from auth.mail.appNameDefault. */
-  readonly appName?: string;
   /** ISO instant the token was issued; the validity duration is measured from it. Default: now. */
   readonly issuedAt?: string;
   /** IANA zone the expiry time is shown in. Default "UTC"; an invalid zone falls back to "UTC". */
   readonly timeZone?: string;
 };
 
-export type RenderInviteEmailArgs = RenderTokenContentArgs & { readonly role: string };
-
-export type AuthMailSection =
-  | { readonly text: string }
-  | { readonly button: { readonly label: string; readonly url: string } };
-
-export type AuthMailContent = {
-  readonly subject: string;
-  readonly header: string;
-  readonly sections: readonly AuthMailSection[];
-  readonly footer: string;
-};
-
-function tokenMailContent(spec: {
-  readonly subject: string;
-  readonly header: string;
-  readonly greeting: string;
-  readonly intro: string;
-  readonly buttonLabel: string;
-  readonly buttonUrl: string;
-  readonly expiry: string;
-  readonly ignore: string;
-}): AuthMailContent {
-  return {
-    subject: spec.subject,
-    header: spec.header,
-    sections: [
-      { text: spec.greeting },
-      { text: spec.intro },
-      { button: { label: spec.buttonLabel, url: spec.buttonUrl } },
-      { text: spec.expiry },
-    ],
-    footer: spec.ignore,
-  };
-}
-
-function t(locale: string, key: string, params?: Readonly<Record<string, string>>): string {
-  return mailT(locale, key, params);
-}
-
-function appNameFor(args: RenderTokenContentArgs): string {
-  const locale = args.locale ?? "en";
-  return args.appName ?? t(locale, "auth.mail.appNameDefault");
-}
-
-export function renderResetPasswordEmail(args: RenderTokenContentArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.reset.subject", { app }),
-    header: t(locale, "auth.mail.reset.button"),
-    greeting: t(locale, "auth.mail.reset.greeting"),
-    intro: t(locale, "auth.mail.reset.intro", { app }),
-    buttonLabel: t(locale, "auth.mail.reset.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.reset.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.reset.ignore"),
-  });
-}
-
-export function renderUnlockAccountEmail(args: RenderTokenContentArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.unlock.subject", { app }),
-    header: t(locale, "auth.mail.unlock.button"),
-    greeting: t(locale, "auth.mail.unlock.greeting"),
-    intro: t(locale, "auth.mail.unlock.intro", { app }),
-    buttonLabel: t(locale, "auth.mail.unlock.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.unlock.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.unlock.ignore"),
-  });
-}
-
-export function renderVerifyEmail(args: RenderTokenContentArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.verify.subject", { app }),
-    header: t(locale, "auth.mail.verify.button"),
-    greeting: t(locale, "auth.mail.verify.greeting"),
-    intro: t(locale, "auth.mail.verify.intro", { app }),
-    buttonLabel: t(locale, "auth.mail.verify.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.verify.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.verify.ignore"),
-  });
-}
-
-export function renderActivationEmail(args: RenderTokenContentArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.activation.subject", { app }),
-    header: t(locale, "auth.mail.activation.button"),
-    greeting: t(locale, "auth.mail.activation.greeting"),
-    intro: t(locale, "auth.mail.activation.intro", { app }),
-    buttonLabel: t(locale, "auth.mail.activation.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.activation.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.activation.ignore"),
-  });
-}
-
-export function renderInviteEmail(args: RenderInviteEmailArgs): AuthMailContent {
-  const locale = args.locale ?? "en";
-  const app = args.appName ?? "Workspace";
-  return tokenMailContent({
-    subject: t(locale, "auth.mail.invite.subject", { app }),
-    header: t(locale, "auth.mail.invite.button"),
-    greeting: t(locale, "auth.mail.invite.greeting"),
-    intro: t(locale, "auth.mail.invite.intro", { app, role: args.role }),
-    buttonLabel: t(locale, "auth.mail.invite.button"),
-    buttonUrl: args.url,
-    expiry: t(locale, "auth.mail.invite.expiry", expiryParams(args, locale)),
-    ignore: t(locale, "auth.mail.invite.ignore"),
-  });
-}
-
 const MS_PER_MINUTE = 60_000;
 const MS_PER_HOUR = 60 * MS_PER_MINUTE;
 const MS_PER_DAY = 24 * MS_PER_HOUR;
@@ -241,18 +114,19 @@ function formatWhen(expiresAt: Temporal.Instant, locale: string, timeZone: strin
   }
 }
 
-function expiryParams(
-  args: RenderTokenContentArgs,
+// Formatted as text here because the stored template only knows plain variables.
+export function tokenMailExpiry(
+  args: TokenMailTiming,
   locale: string,
-): { readonly duration: string; readonly when: string } {
+): { readonly validFor: string; readonly validUntil: string } {
   try {
     const expiresAt = Temporal.Instant.from(args.expiresAt);
     const issuedAt = args.issuedAt ? Temporal.Instant.from(args.issuedAt) : Temporal.Now.instant();
     return {
-      duration: formatDuration(expiresAt.epochMilliseconds - issuedAt.epochMilliseconds, locale),
-      when: formatWhen(expiresAt, locale, args.timeZone ?? "UTC"),
+      validFor: formatDuration(expiresAt.epochMilliseconds - issuedAt.epochMilliseconds, locale),
+      validUntil: formatWhen(expiresAt, locale, args.timeZone ?? "UTC"),
     };
   } catch {
-    return { duration: args.expiresAt, when: args.expiresAt };
+    return { validFor: args.expiresAt, validUntil: args.expiresAt };
   }
 }