@cosmicdrift/kumiko-samples 0.362.0 → 0.364.0

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -30,6 +30,12 @@ import {
 } from "./handlers/signup-request.write.js";
 import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
+import {
+  AUTH_MAIL_VARIABLES,
+  authMailLocalizedTemplate,
+  INVITE_MAIL_VARIABLES,
+  sendsMagicLinkMail,
+} from "./mail-notifications.js";
 
 /**
  * Env-vars contract for the `auth-email-password` feature.
@@ -199,17 +205,32 @@ export function createAuthEmailPasswordFeature(
     // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
     // via ctx.notify → delivery must be mounted. Fail closed at boot instead
     // of silently dropping the mail.
-    if (
-      opts.passwordReset ||
-      opts.emailVerification ||
-      opts.signup ||
-      opts.invite ||
-      opts.accountUnlock
-    ) {
-      r.requires("delivery");
-    }
+    if (sendsMagicLinkMail(opts)) r.requires("delivery");
     r.envSchema(authEmailPasswordEnvSchema);
 
+    // Declared unconditionally: apps also issue the activation link from their
+    // own flows (issueSignupActivation) without enabling the signup option.
+    r.notification("password-reset", {
+      variables: AUTH_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("passwordReset"),
+    });
+    r.notification("account-unlock", {
+      variables: AUTH_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("accountUnlock"),
+    });
+    r.notification("email-verification", {
+      variables: AUTH_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("emailVerification"),
+    });
+    r.notification("signup-activation", {
+      variables: AUTH_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("signupActivation"),
+    });
+    r.notification("invite", {
+      variables: INVITE_MAIL_VARIABLES,
+      localizedTemplate: authMailLocalizedTemplate("invite"),
+    });
+
     const handlers = {
       login: r.writeHandler(
         createLoginHandler({

package/packages/bundled-features/src/auth-email-password/handlers/change-password.write.ts

@@ -1,5 +1,4 @@
 import {
-  access,
   createSystemUser,
   defineWriteHandler,
   SYSTEM_TENANT_ID,
@@ -20,7 +19,12 @@ export const changePasswordWrite = defineWriteHandler({
     oldPassword: z.string().min(1),
     newPassword: passwordSchema,
   }),
-  access: { roles: access.authenticated },
+  access: {
+    openToAll: {
+      reason:
+        "Self-service: acts only on event.user.id and re-checks the caller's current password; invited members hold only an app role, so a fixed role list would lock them out.",
+    },
+  },
   escapeHatch: {
     grants: ["systemIdentity"],
     reason:

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -55,12 +55,10 @@ import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
 import { userTable } from "../../user/schema/user.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
 import type { AuthMailLocale } from "../email-templates.js";
-import { renderInviteEmail } from "../email-templates.js";
 import { inviteAlreadyAccepted } from "../errors.js";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
-
-const INVITE_NOTIFICATION_TYPE = "auth-email-password:invite";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 
 type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
 
@@ -247,8 +245,8 @@ async function issueInvitation(
     ctx.notify,
     {
       handlerName: "invite-create",
-      notificationType: INVITE_NOTIFICATION_TYPE,
-      renderContent: (renderArgs) => renderInviteEmail({ ...renderArgs, role: request.role }),
+      notificationType: AuthMailNotificationTypes.invite,
+      fallbackAppName: "Workspace",
     },
     {
       email,
@@ -257,6 +255,7 @@ async function issueInvitation(
       expiresAt: expiresAt.toString(),
       issuedAt: issuedAt.toString(),
       timeZone: ctx.tz.user,
+      role: request.role,
       ...(opts.appName !== undefined && { appName: opts.appName }),
       locale,
     },

package/packages/bundled-features/src/auth-email-password/handlers/logout.write.ts

@@ -1,4 +1,4 @@
-import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 
 // Logout — JWT is stateless, so server-side we only return OK. A future
@@ -7,7 +7,12 @@ import * as z from "zod";
 export const logoutWrite = defineWriteHandler({
   name: "logout",
   schema: z.object({}),
-  access: { roles: access.authenticated },
+  access: {
+    openToAll: {
+      reason:
+        "Self-service: touches no data, any signed-in member must be able to sign out regardless of which role they hold.",
+    },
+  },
   description:
     "Acknowledges a sign-out for the authenticated caller so the client can discard its token; the JWT is stateless, so no server-side session state changes here.",
   perform: stepsPipeline(({ r }) => [

package/packages/bundled-features/src/auth-email-password/handlers/request-account-unlock.write.ts

@@ -1,5 +1,5 @@
 import { AUTH_UNLOCK_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderUnlockAccountEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signUnlockToken } from "../unlock-token.js";
 import {
   createTokenRequestHandler,
@@ -7,8 +7,6 @@ import {
   type TokenRequestOptions,
 } from "./token-request-handler.js";
 
-const UNLOCK_NOTIFICATION_TYPE = "auth-email-password:account-unlock";
-
 export type RequestAccountUnlockOptions = TokenRequestOptions;
 
 // Public shape re-exported for callers that build custom routes on top of
@@ -32,8 +30,7 @@ export function createRequestAccountUnlockHandler(opts: RequestAccountUnlockOpti
       // locked right now. Confirming just clears the (possibly already
       // empty) lockout state — harmless no-op if they weren't locked.
       extraSilentSkip: () => false,
-      notificationType: UNLOCK_NOTIFICATION_TYPE,
-      renderContent: renderUnlockAccountEmail,
+      notificationType: AuthMailNotificationTypes.accountUnlock,
     },
     opts,
   );

package/packages/bundled-features/src/auth-email-password/handlers/request-email-verification.write.ts

@@ -1,5 +1,5 @@
 import { AUTH_VERIFY_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderVerifyEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signVerificationToken } from "../verification-token.js";
 import {
   createTokenRequestHandler,
@@ -7,8 +7,6 @@ import {
   type TokenRequestOptions,
 } from "./token-request-handler.js";
 
-const VERIFY_NOTIFICATION_TYPE = "auth-email-password:email-verification";
-
 export type RequestEmailVerificationOptions = TokenRequestOptions;
 
 export type RequestVerificationData = TokenRequestData<"verification-requested">;
@@ -29,8 +27,7 @@ export function createRequestEmailVerificationHandler(opts: RequestEmailVerifica
       // unknown/deleted to keep the enumeration surface symmetric — the
       // caller sees the same 200 regardless of whether a token was minted.
       extraSilentSkip: (user) => user.emailVerified === true,
-      notificationType: VERIFY_NOTIFICATION_TYPE,
-      renderContent: renderVerifyEmail,
+      notificationType: AuthMailNotificationTypes.emailVerification,
     },
     opts,
   );

package/packages/bundled-features/src/auth-email-password/handlers/request-password-reset.write.ts

@@ -1,5 +1,5 @@
 import { AUTH_RESET_DEFAULT_TTL_MINUTES, AuthErrors } from "../constants.js";
-import { renderResetPasswordEmail } from "../email-templates.js";
+import { AuthMailNotificationTypes } from "../mail-notifications.js";
 import { signResetToken } from "../reset-token.js";
 import {
   createTokenRequestHandler,
@@ -7,8 +7,6 @@ import {
   type TokenRequestOptions,
 } from "./token-request-handler.js";
 
-const RESET_NOTIFICATION_TYPE = "auth-email-password:password-reset";
-
 export type RequestPasswordResetOptions = TokenRequestOptions;
 
 // Public shape re-exported for callers that build custom routes on top of
@@ -31,8 +29,7 @@ export function createRequestPasswordResetHandler(opts: RequestPasswordResetOpti
       // non-deleted user can initiate a reset regardless of verification
       // state. The sessions feature handles the post-change revocation.
       extraSilentSkip: () => false,
-      notificationType: RESET_NOTIFICATION_TYPE,
-      renderContent: renderResetPasswordEmail,
+      notificationType: AuthMailNotificationTypes.passwordReset,
     },
     opts,
   );

package/packages/bundled-features/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -36,6 +36,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/errors";
 import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import {
   findSignupHandoverProvider,
@@ -100,10 +101,8 @@ const SIGNUP_CONFIRM_PROVISION_REASON =
 // match; this reads the same field the framework itself uses.
 function isBenignClaimRejection(error: WriteErrorInfo): boolean {
   return (
-    typeof error.details === "object" &&
-    error.details !== null &&
-    (error.details as Record<string, unknown>)["reason"] ===
-      SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE
+    isPlainObject(error.details) &&
+    error.details["reason"] === SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE
   );
 }
 

package/packages/bundled-features/src/auth-email-password/handlers/signup-request.write.ts

@@ -25,6 +25,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { findSignupHandoverProvider, type SignupHandoverBinding } from "../../shared/index.js";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
 import type { AuthMailLocale } from "../email-templates.js";
 import { resolveHandlerMailLocale } from "../magic-link-mail.js";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.js";
@@ -79,7 +80,7 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
     schema: SignupRequestSchema,
     access: { roles: ["anonymous"] },
     rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-    additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
+    additionalRateLimits: AUTH_EMAIL_PAYLOAD_RATE_LIMITS,
     description:
       "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
     escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },

package/packages/bundled-features/src/auth-email-password/handlers/token-request-handler.ts

@@ -19,11 +19,8 @@ import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { UserQueries } from "../../user/index.js";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row.js";
-import type {
-  AuthMailContent,
-  AuthMailLocale,
-  RenderTokenContentArgs,
-} from "../email-templates.js";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
+import type { AuthMailLocale } from "../email-templates.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 
 const RequestTokenSchema = z.object({
@@ -67,13 +64,9 @@ export type TokenRequestSpec<TName extends string, TSuccessKind extends string>
   // soft-deleted". Verification skips when emailVerified is already true;
   // password-reset has no extra condition (returns false).
   readonly extraSilentSkip: (user: AuthUserRow) => boolean;
-  // Notification type dispatched via ctx.notify on success. No r.notification
-  // is declared (the recipient is an anonymous email, not a userId) — the
-  // route:{email} path delivers directly and buildMessage falls back to data.
+  // Trigger-less r.notification dispatched via ctx.notify on success; the
+  // recipient is an anonymous email, so route:{email} delivers directly.
   readonly notificationType: string;
-  // Builds the structured mail body from the magic-link + expiry. Per-flow
-  // (renderResetPasswordEmail / renderVerifyEmail).
-  readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
 };
 
 export type TokenRequestOptions = {
@@ -107,7 +100,7 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
     schema: RequestTokenSchema,
     access: { roles: ["anonymous"] },
     rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-    additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
+    additionalRateLimits: AUTH_EMAIL_PAYLOAD_RATE_LIMITS,
     escapeHatch: {
       grants: ["systemIdentity"],
       reason:
@@ -154,7 +147,6 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
         {
           handlerName: spec.handlerName,
           notificationType: spec.notificationType,
-          renderContent: spec.renderContent,
         },
         {
           // Row value is ciphertext with an active KMS; the byte-exact

package/packages/bundled-features/src/auth-email-password/index.ts

@@ -21,23 +21,7 @@ export type {
 } from "./bootstrap.js";
 export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
-// Renderers for the auth mails. All four magic-link flows (reset, verify,
-// signup-activation, invite) emit structured AuthMailContent through delivery
-// (ctx.notify).
-export type {
-  AuthMailContent,
-  AuthMailLocale,
-  AuthMailSection,
-  RenderInviteEmailArgs,
-  RenderTokenContentArgs,
-} from "./email-templates.js";
-export {
-  renderActivationEmail,
-  renderInviteEmail,
-  renderResetPasswordEmail,
-  renderUnlockAccountEmail,
-  renderVerifyEmail,
-} from "./email-templates.js";
+export type { AuthMailLocale } from "./email-templates.js";
 export type {
   AccountLockoutOptions,
   AccountUnlockOptions,
@@ -48,6 +32,7 @@ export type {
   SignupOptions,
 } from "./feature.js";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
+export { AuthMailNotificationTypes } from "./mail-notifications.js";
 export {
   AUTH_SELF_REGISTRATION_FEATURE,
   createAuthSelfRegistrationToggleFeature,

package/packages/bundled-features/src/auth-email-password/magic-link-mail.ts

@@ -1,24 +1,24 @@
 // Shared dispatch for the magic-link mails (password-reset, email-verification,
-// signup-activation). All three follow the same delivery shape: append the
-// token to the app page, render structured content, and notify the recipient
-// email directly (route:{email} skips preferences — the recipient may not have
-// a user account yet — and critical priority keeps a security mail
-// non-unsubscribable). No r.notification is declared; buildMessage falls back
-// to the structured `data` for the renderer.
+// account-unlock, signup-activation, invite). All follow the same delivery
+// shape: append the token to the app page and notify the recipient email
+// directly (route:{email} skips preferences — the recipient may not have a user
+// account yet — and critical priority keeps a security mail non-unsubscribable).
+// Each mail type is a trigger-less r.notification whose stored template renders
+// from the variables passed here.
 
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
-import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "./email-templates.js";
+import { mailT, resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
+import { type AuthMailLocale, tokenMailExpiry } from "./email-templates.js";
+import { authMailTemplateLocale } from "./mail-notifications.js";
 
-// Per-flow constants: which notification type to dispatch and how to render the
-// body. renderContent is the flow's template (renderResetPasswordEmail / … /
-// renderActivationEmail), all unified on RenderTokenContentArgs → AuthMailContent.
+// Per-flow constants: which notification type to dispatch. fallbackAppName
+// replaces the translated default when the flow has no app name of its own.
 export type MagicLinkMailSpec = {
   readonly handlerName: string;
   readonly notificationType: string;
-  readonly renderContent: (args: RenderTokenContentArgs) => AuthMailContent;
+  readonly fallbackAppName?: string;
 };
 
 // Per-request values: the recipient + the app page that receives the token, plus
@@ -36,6 +36,8 @@ export type MagicLinkMailParams = {
   readonly locale?: AuthMailLocale;
   readonly issuedAt?: string;
   readonly timeZone?: string;
+  // Invite mails name the role the recipient is invited as.
+  readonly role?: string;
 };
 
 function resolveAppUrl(appUrl: string | ((locale: string) => string), locale: string): string {
@@ -75,18 +77,24 @@ export async function dispatchMagicLinkMail(
   // mailT already root-falls-back; appUrl must use the same negotiated tag
   // or language-in-path apps 404 on e.g. /de-AT/activate.
   const urlLocale = resolveMailLocale(locale);
-  const content = spec.renderContent({
-    url: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
-    expiresAt: params.expiresAt,
-    ...(params.locale !== undefined && { locale: params.locale }),
-    ...(params.appName !== undefined && { appName: params.appName }),
-    ...(params.issuedAt !== undefined && { issuedAt: params.issuedAt }),
-    ...(params.timeZone !== undefined && { timeZone: params.timeZone }),
-  });
+  const { validFor, validUntil } = tokenMailExpiry(
+    {
+      expiresAt: params.expiresAt,
+      ...(params.issuedAt !== undefined && { issuedAt: params.issuedAt }),
+      ...(params.timeZone !== undefined && { timeZone: params.timeZone }),
+    },
+    locale,
+  );
   await notify(spec.notificationType, {
     route: { email: params.email },
-    data: content,
-    locale,
+    data: {
+      appName: params.appName ?? spec.fallbackAppName ?? mailT(locale, "auth.mail.appNameDefault"),
+      actionUrl: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
+      validFor,
+      validUntil,
+      ...(params.role !== undefined && { role: params.role }),
+    },
+    locale: authMailTemplateLocale(spec.notificationType, locale),
     priority: "critical",
   });
 }

package/packages/bundled-features/src/auth-email-password/mail-notifications.ts

@@ -0,0 +1,158 @@
+import {
+  type NotificationLocalizedTemplate,
+  QnTypes,
+  qn,
+  type TemplateVariables,
+  templateVariable,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  hasMailTranslationKey,
+  listMailLocales,
+  mailT,
+  resolveMailLocale,
+} from "@cosmicdrift/kumiko-framework/i18n";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { AUTH_EMAIL_PASSWORD_FEATURE } from "./constants.js";
+
+export const AUTH_MAIL_KINDS = {
+  passwordReset: { name: "password-reset", translationKey: "reset" },
+  accountUnlock: { name: "account-unlock", translationKey: "unlock" },
+  emailVerification: { name: "email-verification", translationKey: "verify" },
+  signupActivation: { name: "signup-activation", translationKey: "activation" },
+  invite: { name: "invite", translationKey: "invite" },
+} as const;
+
+export type AuthMailKind = keyof typeof AUTH_MAIL_KINDS;
+
+type MagicLinkFlowOptions = Partial<
+  Record<"passwordReset" | "emailVerification" | "signup" | "invite" | "accountUnlock", unknown>
+>;
+
+export function sendsMagicLinkMail(flows: MagicLinkFlowOptions): boolean {
+  return Boolean(
+    flows.passwordReset ||
+      flows.emailVerification ||
+      flows.signup ||
+      flows.invite ||
+      flows.accountUnlock,
+  );
+}
+
+function authMailType(kind: AuthMailKind): string {
+  return qn(AUTH_EMAIL_PASSWORD_FEATURE, QnTypes.notify, AUTH_MAIL_KINDS[kind].name);
+}
+
+export const AuthMailNotificationTypes: Readonly<Record<AuthMailKind, string>> = {
+  passwordReset: authMailType("passwordReset"),
+  accountUnlock: authMailType("accountUnlock"),
+  emailVerification: authMailType("emailVerification"),
+  signupActivation: authMailType("signupActivation"),
+  invite: authMailType("invite"),
+};
+
+function subjectKey(kind: AuthMailKind): string {
+  return `auth.mail.${AUTH_MAIL_KINDS[kind].translationKey}.subject`;
+}
+
+const ALL_AUTH_MAIL_KINDS: readonly AuthMailKind[] = [
+  "passwordReset",
+  "accountUnlock",
+  "emailVerification",
+  "signupActivation",
+  "invite",
+];
+
+const SUBJECT_KEY_BY_TYPE: ReadonlyMap<string, string> = new Map(
+  ALL_AUTH_MAIL_KINDS.map((kind) => [AuthMailNotificationTypes[kind], subjectKey(kind)]),
+);
+
+// A registered locale whose bundle lacks the subject key has no template (see
+// authMailLocalizedTemplate); the renderer has no locale fallback, so the
+// sender must pick a locale that has one or the mail would not go out at all.
+export function authMailTemplateLocale(notificationType: string, requestedLocale: string): string {
+  const locale = resolveMailLocale(requestedLocale);
+  const key = SUBJECT_KEY_BY_TYPE.get(notificationType);
+  return key !== undefined && hasMailTranslationKey(locale, key) ? locale : "en";
+}
+
+export const AUTH_MAIL_VARIABLES: TemplateVariables = {
+  appName: templateVariable.text({ required: true }),
+  actionUrl: templateVariable.link({ required: true }),
+  validFor: templateVariable.text({ required: true }),
+  validUntil: templateVariable.text({ required: true }),
+};
+
+export const INVITE_MAIL_VARIABLES: TemplateVariables = {
+  ...AUTH_MAIL_VARIABLES,
+  role: templateVariable.text({ required: true }),
+};
+
+// Translation placeholder -> template variable. The markers survive HTML
+// escaping, so only the translated text is escaped, never the placeholders.
+const PLACEHOLDER_VARIABLES: Readonly<Record<string, string>> = {
+  app: "appName",
+  duration: "validFor",
+  when: "validUntil",
+  role: "role",
+};
+const MARKER_OPEN = "\uE000";
+const MARKER_CLOSE = "\uE001";
+const MARKER_PATTERN = new RegExp(`${MARKER_OPEN}(\\w+)${MARKER_CLOSE}`, "g");
+
+function markers(): Readonly<Record<string, string>> {
+  return Object.fromEntries(
+    Object.keys(PLACEHOLDER_VARIABLES).map((name) => [
+      name,
+      `${MARKER_OPEN}${name}${MARKER_CLOSE}`,
+    ]),
+  );
+}
+
+function translatedHtml(locale: string, key: string): string {
+  return escapeHtml(mailT(locale, key, markers())).replace(MARKER_PATTERN, (_, name: string) => {
+    const variable = PLACEHOLDER_VARIABLES[name];
+    return variable === undefined
+      ? ""
+      : `<span data-variable="${escapeHtmlAttr(variable)}"></span>`;
+  });
+}
+
+function mailBody(locale: string, translationKey: string): string {
+  const html = (part: string) => translatedHtml(locale, `auth.mail.${translationKey}.${part}`);
+  return [
+    `<p>${html("greeting")}</p>`,
+    `<p>${html("intro")}</p>`,
+    `<p><a data-button href="{{actionUrl}}">${html("button")}</a></p>`,
+    `<p>${html("expiry")}</p>`,
+    `<p>${html("ignore")}</p>`,
+  ].join("");
+}
+
+// Evaluated when the registry is built, after every locale feature has
+// registered its mail translations. English always ships; another locale only
+// gets a template when it has its own subject, so a missing translation never
+// silently becomes an English mail in that locale's slot.
+export function authMailLocalizedTemplate(kind: AuthMailKind): () => NotificationLocalizedTemplate {
+  const { translationKey } = AUTH_MAIL_KINDS[kind];
+  const kindSubjectKey = subjectKey(kind);
+  return () => {
+    const locales = [
+      "en",
+      ...listMailLocales().filter(
+        (locale) => locale !== "en" && hasMailTranslationKey(locale, kindSubjectKey),
+      ),
+    ];
+    return Object.fromEntries(
+      locales.map((locale) => [
+        locale,
+        {
+          body: mailBody(locale, translationKey),
+          meta: {
+            subject: mailT(locale, kindSubjectKey, { app: "{{appName}}" }),
+            category: "transactional" as const,
+          },
+        },
+      ]),
+    );
+  };
+}

package/packages/bundled-features/src/auth-email-password/signup-activation.ts

@@ -9,15 +9,15 @@ import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import type { Redis } from "ioredis";
 import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "./constants.js";
-import { renderActivationEmail } from "./email-templates.js";
 import { dispatchMagicLinkMail } from "./magic-link-mail.js";
+import { AuthMailNotificationTypes } from "./mail-notifications.js";
 import {
   invalidateExistingSignupToken,
   normalizeEmail,
   storeSignupToken,
 } from "./signup-token-store.js";
 
-export const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = "auth-email-password:signup-activation";
+export const SIGNUP_ACTIVATION_NOTIFICATION_TYPE = AuthMailNotificationTypes.signupActivation;
 
 export type IssueSignupActivationArgs = {
   readonly redis: Redis;
@@ -65,7 +65,6 @@ export async function issueSignupActivation(
     {
       handlerName: "signup-request",
       notificationType: SIGNUP_ACTIVATION_NOTIFICATION_TYPE,
-      renderContent: renderActivationEmail,
     },
     {
       email,

package/packages/bundled-features/src/auth-email-password/web/auth-gate.tsx

@@ -10,7 +10,7 @@
 // Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
 
 import { useLocale } from "@cosmicdrift/kumiko-renderer";
-import { type ComponentType, type ReactNode, useEffect, useState } from "react";
+import { type ComponentType, type ReactNode, useEffect, useMemo, useState } from "react";
 import {
   assertNavigableUrl,
   buildLoginRedirectUrl,
@@ -204,6 +204,21 @@ export function resolveLoginRedirect(
   };
 }
 
+// A throwing loginUrl builder must not take the whole app tree down in render;
+// null falls through to the built-in login screen.
+function resolveLoginRedirectOrNull(
+  loginUrl: string | LoginUrlBuilder,
+  locale: string,
+  location: Pick<Location, "origin" | "pathname" | "search" | "hash">,
+): LoginRedirect | null {
+  try {
+    return resolveLoginRedirect(loginUrl, locale, location);
+  } catch (error) {
+    console.error("Auth gate: loginUrl could not be resolved, showing the built-in login", error);
+    return null;
+  }
+}
+
 export function makeAuthGate(opts: AuthGateOptions = {}): ComponentType<{
   children: ReactNode;
 }> {
@@ -213,10 +228,14 @@ export function makeAuthGate(opts: AuthGateOptions = {}): ComponentType<{
   function AuthGate({ children }: { readonly children: ReactNode }): ReactNode {
     const { status } = useSession();
     const locale = useLocale().locale();
-    const loginRedirect =
-      loginUrl !== undefined && status === "unauthenticated"
-        ? resolveLoginRedirect(loginUrl, locale, window.location)
-        : null;
+    const { origin, pathname, search, hash } = window.location;
+    const loginRedirect = useMemo(
+      () =>
+        loginUrl !== undefined && status === "unauthenticated"
+          ? resolveLoginRedirectOrNull(loginUrl, locale, { origin, pathname, search, hash })
+          : null,
+      [status, locale, origin, pathname, search, hash],
+    );
     const redirectUrl = loginRedirect?.kind === "redirect" ? loginRedirect.url : null;
     // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
     useEffect(() => {