@cosmicdrift/kumiko-samples 0.368.0 → 0.369.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.368.0",
+  "version": "0.369.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.368.0",
+  "version": "0.369.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/channel-email/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "The tenant mail transport applies per notification",
+    "detail": "r.notification(name, { tenantTransport: true }) marks a notification whose mails go through the tenant's own mail transport. channel-email consults its tenantTransport resolver only for these (also under a renamedFrom name); every other notification, such as password reset or sign-in mails, always takes the app transport, even when the tenant has a provider. With tenantTransport set, transport may be omitted: a mail that then has no transport fails with missing_credentials instead of throwing. The template test mail (template-resolver send-test) now gets the tenant config in its channel context and uses the template's notification, so it leaves through the same transport as the real mail.",
+    "migration": "Apps that pass tenantTransport to createChannelEmailFeature add `tenantTransport: true` to every r.notification whose mails should go through the tenant's provider; without the flag those mails now go through the app transport. Apps without an app SMTP server can drop transport and keep tenantTransport."
+  },
   {
     "version": "0.367.0",
     "type": "improvement",

package/packages/bundled-features/src/channel-email/email-channel.ts

@@ -6,6 +6,7 @@ import {
   type AttachmentOrigin,
   type ChannelContext,
   type ChannelMessage,
+  currentNotificationType,
   DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
   DELIVERY_UNSUBSCRIBE_PATH,
   type DeliveryChannel,
@@ -163,18 +164,36 @@ async function resolveAttachments(
   return { kind: "resolved", attachments: resolved };
 }
 
-export type EmailChannelOptions = {
-  /** The app-wide transport, used for every tenant `tenantTransport` returns null for. */
-  readonly transport: EmailTransport;
-  /** Resolves the sending tenant's own transport, null when it has none. Built per send and
-   *  never cached, so a provider change applies to the next mail; a throw fails the send. */
-  readonly tenantTransport?: (ctx: ChannelContext) => Promise<EmailTransport | null>;
+/** Resolves the sending tenant's own transport, null when it has none. Built per send and
+ *  never cached, so a provider change applies to the next mail; a throw fails the send. */
+export type TenantTransportResolver = (ctx: ChannelContext) => Promise<EmailTransport | null>;
+
+// The app transport may only be left out when tenant transports exist: a channel with
+// neither could never send.
+type EmailChannelTransports =
+  | {
+      /** The app-wide transport for every mail that does not go through a tenant transport. */
+      readonly transport: EmailTransport;
+      /** Used only for notifications declared with `tenantTransport: true`. */
+      readonly tenantTransport?: TenantTransportResolver;
+    }
+  | {
+      readonly transport?: undefined;
+      readonly tenantTransport: TenantTransportResolver;
+    };
+
+export type EmailChannelOptions = EmailChannelTransports & {
   readonly resolveEmail: (
     userId: string,
     ctx: { db: unknown; tenantId: TenantId },
   ) => Promise<string | null>;
 };
 
+function isTenantTransportNotification(ctx: ChannelContext, notificationType: string): boolean {
+  const current = currentNotificationType(ctx.registry, notificationType);
+  return ctx.registry.getAllNotifications().get(current)?.tenantTransport === true;
+}
+
 export function createEmailChannel(options: EmailChannelOptions): DeliveryChannel {
   const { transport, resolveEmail, tenantTransport } = options;
 
@@ -213,8 +232,12 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
     };
   }
 
-  async function transportFor(ctx: ChannelContext): Promise<EmailTransport> {
+  async function transportFor(
+    message: ChannelMessage,
+    ctx: ChannelContext,
+  ): Promise<EmailTransport | undefined> {
     if (tenantTransport === undefined) return transport;
+    if (!isTenantTransportNotification(ctx, message.notificationType)) return transport;
     return (await tenantTransport(ctx)) ?? transport;
   }
 
@@ -260,7 +283,15 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
         return { status: "failed", error: "send_failed", address };
       }
       const resolvedAttachments = resolution.attachments;
-      const sendTransport = await transportFor(ctx);
+      const sendTransport = await transportFor(message, ctx);
+      if (sendTransport === undefined) {
+        // Configuration, not a transient error: a retry cannot conjure a transport.
+        createFallbackLogger("delivery").warn("no mail transport for this mail, send failed", {
+          tenantId: ctx.tenantId,
+          notificationType: message.notificationType,
+        });
+        return { status: "failed", error: "missing_credentials", address };
+      }
       await sendTransport.send(
         guardEmailMessage({
           to: address,

package/packages/bundled-features/src/channel-email/feature.ts

@@ -10,7 +10,7 @@ export function createChannelEmailFeature(options: EmailChannelOptions): Feature
 
   return defineFeature("channel-email", (r) => {
     r.describe(
-      "Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send each tenant's mail through its own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.",
+      "Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send the notifications declared with `tenantTransport: true` through the sending tenant's own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`; every other notification (password reset, sign-in) always goes through the app `transport`. `transport` may be left out when `tenantTransport` is set; a mail that then has no transport fails with `missing_credentials`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.",
     );
     r.uiHints({
       displayLabel: "Email Channel",

package/packages/bundled-features/src/channel-email/index.ts

@@ -1,4 +1,8 @@
-export { createEmailChannel, type EmailChannelOptions } from "./email-channel.js";
+export {
+  createEmailChannel,
+  type EmailChannelOptions,
+  type TenantTransportResolver,
+} from "./email-channel.js";
 export { createChannelEmailFeature } from "./feature.js";
 export { guardEmailMessage, withPiiCiphertextGuard } from "./pii-guard.js";
 export {

package/packages/bundled-features/src/config/web/i18n.ts

@@ -32,9 +32,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "config.errors.unknownKey": "Unknown configuration key.",
     "config.errors.unknownExtensionPlugin": "This provider is not available.",
     "config.settings.extensionSelectorHint":
-      "Choose a provider and save. Its settings appear below.",
+      "Choose a provider. Its settings appear below and are saved together with it.",
     "config.settings.provider": "Provider",
-    "config.settings.saveProvider": "Save provider",
     "config.settings.audience.system":
       "Applies to every tenant unless a tenant sets its own value.",
     "config.settings.audience.tenant":

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "improvement",
+    "title": "Unsubscribe links in dev and a reusable result page",
+    "detail": "runDevApp accepts unsubscribe: { secret, tenantOrigin? } like runProdApp, mounts the unsubscribe routes and signs the links (base URL from auth.mail.baseUrl or APP_BASE_URL). Both share resolveUnsubscribeWiring from server-runtime. delivery exports renderUnsubscribeResultPage({ kind: \"unsubscribed\" | \"resubscribed\" | \"failed\", locale, resubscribeToken? }), the page the unsubscribe routes answer with, for apps that serve their own (e.g. legacy) unsubscribe links; without a resubscribeToken it offers no undo button."
+  },
   {
     "version": "0.367.0",
     "type": "improvement",

package/packages/bundled-features/src/delivery/feature.ts

@@ -61,7 +61,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
   const attemptLogRetentionDays = resolveAttemptLogRetentionDays(options?.attemptLogRetentionDays);
   return defineFeature("delivery", (r) => {
     r.describe(
-      "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (`runProdApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
+      "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (the `runProdApp` and `runDevApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. An app serving its own (e.g. legacy) unsubscribe links renders the same result page with `renderUnsubscribeResultPage({ kind, locale })`. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
     );
     r.uiHints({
       displayLabel: "Notifications \u00b7 Dispatch Core",

package/packages/bundled-features/src/delivery/index.ts

@@ -20,7 +20,11 @@ export {
   DEFAULT_ATTEMPT_LOG_RETENTION_DAYS,
   runAttemptLogRetention,
 } from "./attempt-log-retention.js";
-export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
+export {
+  buildChannelContext,
+  createEmailAttachmentReader,
+  createTemplateMailRenderer,
+} from "./channel-context.js";
 export {
   type ChatWebhookChannelOptions,
   chatMessageText,
@@ -67,6 +71,7 @@ export {
   type UnsubscribeAddressPayload,
   unsubscribeAddressPayloadSchema,
 } from "./handlers/unsubscribe-address.write.js";
+export { currentNotificationType } from "./notification-type-aliases.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
 export {
   deliveryAttemptsTable,
@@ -93,8 +98,10 @@ export {
   type AddressUnsubscribeTokenPayload,
   createUnsubscribeRoutes,
   DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
+  renderUnsubscribeResultPage,
   signAddressUnsubscribeToken,
   signUnsubscribeToken,
+  type UnsubscribeResultPage,
   type UnsubscribeRouteOptions,
   type UnsubscribeTokenPayload,
 } from "./unsubscribe.js";

package/packages/bundled-features/src/delivery/unsubscribe.ts

@@ -415,33 +415,48 @@ function confirmationPage(token: string, locale: string | undefined): string {
   );
 }
 
-function unsubscribedPage(resubscribeToken: string, locale: string | undefined): string {
-  const lang = pageLocale(locale);
-  return htmlPage(
-    lang,
-    mailT(lang, "mail.unsubscribe.doneTitle"),
-    `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>
+export type UnsubscribeResultPage =
+  // Without a resubscribeToken the page offers no undo button.
+  | { readonly kind: "unsubscribed"; readonly resubscribeToken?: string }
+  | { readonly kind: "resubscribed" }
+  | { readonly kind: "failed" };
+
+/** The plain result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`. */
+export function renderUnsubscribeResultPage(
+  page: UnsubscribeResultPage & { readonly locale?: string | undefined },
+): string {
+  const lang = pageLocale(page.locale);
+  switch (page.kind) {
+    case "unsubscribed": {
+      const undoForm =
+        page.resubscribeToken === undefined
+          ? ""
+          : `
 <form method="post" action="${DELIVERY_RESUBSCRIBE_PATH}">
-<input type="hidden" name="token" value="${escapeHtmlAttr(resubscribeToken)}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(page.resubscribeToken)}">
 <button type="submit">${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.undoButton"))}</button>
-</form>`,
-  );
-}
-
-function resubscribedPage(locale: string | undefined): string {
-  const lang = pageLocale(locale);
-  return htmlPage(
-    lang,
-    mailT(lang, "mail.unsubscribe.resubscribedTitle"),
-    `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`,
-  );
+</form>`;
+      return htmlPage(
+        lang,
+        mailT(lang, "mail.unsubscribe.doneTitle"),
+        `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.doneMessage"))}</p>${undoForm}`,
+      );
+    }
+    case "resubscribed":
+      return htmlPage(
+        lang,
+        mailT(lang, "mail.unsubscribe.resubscribedTitle"),
+        `<p>${escapeHtmlAttr(mailT(lang, "mail.unsubscribe.resubscribedMessage"))}</p>`,
+      );
+    case "failed": {
+      const message = mailT(lang, "mail.unsubscribe.failed");
+      return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
+    }
+  }
 }
 
-function failedPage(locale: string | undefined): string {
-  const lang = pageLocale(locale);
-  const message = mailT(lang, "mail.unsubscribe.failed");
-  return htmlPage(lang, message, `<p>${escapeHtmlAttr(message)}</p>`);
-}
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" } as const;
 
 function isFormRequest(contentType: string | undefined): boolean {
   return contentType?.includes("application/x-www-form-urlencoded") === true;
@@ -516,12 +531,20 @@ export function createUnsubscribeRoutes(
       // (e.g. events-table missing, DB down) behind a misleading 400.
       const succeeded = await dispatchUnsubscribeWrite(verified, deps);
       if (!succeeded) {
-        return c.html(failedPage(verified.locale), 500, { "Cache-Control": "no-store" });
+        return c.html(
+          renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }),
+          500,
+          NO_STORE_HEADERS,
+        );
       }
       return c.html(
-        unsubscribedPage(await signResubscribeToken(verified, encodedSecret), verified.locale),
+        renderUnsubscribeResultPage({
+          kind: "unsubscribed",
+          resubscribeToken: await signResubscribeToken(verified, encodedSecret),
+          locale: verified.locale,
+        }),
         200,
-        { "Cache-Control": "no-store" },
+        NO_STORE_HEADERS,
       );
     },
   });
@@ -540,22 +563,28 @@ export function createUnsubscribeRoutes(
       // The undo button on the unsubscribed page posts a form; a browser should land on a page.
       if (isFormRequest(c.req.header("content-type"))) {
         return outcome === "success"
-          ? c.html(resubscribedPage(verified.locale), 200, { "Cache-Control": "no-store" })
-          : c.html(failedPage(verified.locale), outcome === "limit_reached" ? 409 : 500, {
-              "Cache-Control": "no-store",
-            });
+          ? c.html(
+              renderUnsubscribeResultPage({ kind: "resubscribed", locale: verified.locale }),
+              200,
+              NO_STORE_HEADERS,
+            )
+          : c.html(
+              renderUnsubscribeResultPage({ kind: "failed", locale: verified.locale }),
+              outcome === "limit_reached" ? 409 : 500,
+              NO_STORE_HEADERS,
+            );
       }
       if (outcome === "limit_reached") {
-        return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, {
-          "Cache-Control": "no-store",
-        });
+        return c.json(
+          { error: { code: DeliveryErrors.resubscribeLimitReached } },
+          409,
+          NO_STORE_HEADERS,
+        );
       }
       if (outcome === "failed") {
-        return c.json({ error: { code: "resubscribe_failed" } }, 500, {
-          "Cache-Control": "no-store",
-        });
+        return c.json({ error: { code: "resubscribe_failed" } }, 500, NO_STORE_HEADERS);
       }
-      return c.json({ isSuccess: true }, 200, { "Cache-Control": "no-store" });
+      return c.json({ isSuccess: true }, 200, NO_STORE_HEADERS);
     },
   });
 

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -45,6 +45,7 @@ import {
   type Registry,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { MAIL_FOUNDATION_I18N } from "./i18n.js";
 
 const FEATURE_NAME = "mail-foundation";
 
@@ -102,6 +103,10 @@ export type MailTransportContext = {
  */
 export type MailTransportPlugin = {
   readonly build: (ctx: MailTransportContext, tenantId: string) => Promise<EmailTransport>;
+  /** `false` keeps the provider out of the generated settings: it can still be set by a
+   *  seed or config write, but a tenant admin is never offered it (e.g. a test inbox
+   *  that swallows every mail). */
+  readonly selectableInSettings?: false;
 };
 
 // extension-usage `options` is engine-payload (unknown) — structurally validate
@@ -125,7 +130,7 @@ export function createMailFoundationFeature() {
     FEATURE_NAME,
     (r) => {
       r.describe(
-        "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature` so a tenant with a provider configured sends delivery mails through its own transport and other tenants through the app transport.",
+        "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending \u2014 use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature`: notifications declared with `tenantTransport: true` then go through the tenant's own transport when it has a provider and through the app transport otherwise. Tenant admins pick the provider and fill in its settings on the generated Email sending settings screen; an empty provider is a valid choice and means the platform sends.",
       );
       r.uiHints({
         displayLabel: "Mail Transport Foundation",
@@ -145,28 +150,32 @@ export function createMailFoundationFeature() {
         },
       });
 
-      // Provider-selector. Default empty so the boot-validator throws if a
-      // tenant tries to send mail without first picking + setting up a
-      // provider — better than a silent fallback. The actual list of valid
-      // values lives in the registered plugins, not here — Designer-UI can
-      // render `getExtensionUsages("mailTransport").map(u => u.entityName)`
-      // as the option-list.
+      // Empty = this tenant has no own provider: tenantMailTransport yields null and
+      // channel-email uses the app transport, so empty is a valid choice a tenant can
+      // return to (reset in the settings mask) and readiness must not flag it.
+      // createTransportForTenant still throws on empty.
       const providerConfigKey = r.config(
         "provider",
         createTenantConfig("text", {
           default: "",
-          // required: without a chosen provider createTransportForTenant throws —
-          // readiness used to report ready:true and the first mail send
-          // surfaced the UnconfiguredError (280/1).
-          required: true,
-          write: access.roles("TenantAdmin", "SystemAdmin"),
+          // No SystemAdmin: a platform-level provider would be inherited by every tenant,
+          // whose own credentials (tenant secrets) are missing, and break all their mail.
+          write: access.withSystem(access.roles("TenantAdmin")),
           read: access.roles("TenantAdmin", "SystemAdmin", "User"),
+          mask: {
+            title: "mail-foundation.provider",
+            description: "mail-foundation.provider.description",
+            icon: "mail",
+            order: 1,
+          },
         }),
       );
       // Readiness gating: transport-plugins' required keys/secrets count only
       // while their plugin is the one this key selects.
       r.extensionSelector(MAIL_TRANSPORT_EXTENSION, providerConfigKey);
 
+      r.translations({ keys: MAIL_FOUNDATION_I18N });
+
       return {
         /** Config-key-handle for the provider-selector. */
         providerConfigKey,

package/packages/bundled-features/src/mail-foundation/i18n.ts

@@ -0,0 +1,8 @@
+export const MAIL_FOUNDATION_I18N = {
+  "screen:mail-foundation-tenant.title": { en: "Email sending" },
+  "mail-foundation.settings": { en: "Email sending" },
+  "mail-foundation.provider": { en: "Own mail server" },
+  "mail-foundation.provider.description": {
+    en: "Without one, the platform sends the mails. Reset the choice to go back to that.",
+  },
+} as const;

package/packages/bundled-features/src/mail-transport-inmemory/feature.ts

@@ -89,6 +89,9 @@ export function createMailTransportInMemoryFeature() {
       r.requires({ features: ["mail-foundation"] });
 
       const plugin: MailTransportPlugin = {
+        // Solon and studio mount it next to smtp in production; offering it there would
+        // let a tenant admin route every mail into process memory.
+        selectableInSettings: false,
         build: async (_ctx: MailTransportContext, tenantId: string): Promise<EmailTransport> => {
           // Returns the per-tenant buffer. Identity-stable across calls so the
           // demo inbox keeps accumulating.
@@ -96,6 +99,9 @@ export function createMailTransportInMemoryFeature() {
         }, // @wrapper-known semantic-alias
       };
       r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
+      r.translations({
+        keys: { "mail-transport-inmemory.settings": { en: "Test inbox (in memory)" } },
+      });
     },
     { dedupeOptions: {} },
   );

package/packages/bundled-features/src/mail-transport-smtp/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "breaking",
+    "title": "Tenant admins edit their own SMTP server on the Email sending screen",
+    "detail": "mail-foundation's provider key and the SMTP keys (host, port, SSL/TLS, user name, sender address) carry settings masks, so the generated Settings-Hub shows tenant admins one Email sending form: the provider choice, the chosen provider's connection fields and its password, each field with a help text and every label in English, German and Spanish, saved together by one Save button in one /api/batch. Switching the provider swaps the fields at once; fields of a provider that is not selected are not saved. A selector owner's selection screen (`<owner>-tenant-selection`) now carries the plugins' config keys (field id `<owner>-<key>`) and secrets (field id `<plugin>-<key>`, listed in the new ConfigEditScreenDefinition.secretKeys) behind a visible condition on the provider field; the separate `<plugin>-tenant` and `<plugin>-tenant-secrets` screens and their dashboard panels are gone, and so is the `config.settings.saveProvider` label. A secret with its own writeRoles stays on the global secrets screen. Boot validation checks every secretKeys field (tenant scope, writeOnly text, declared secret). The configEdit renderer loads secretKeys fields from secrets:query:list (set or unset, no preview), writes them with secrets:write:set or secrets:write:delete in the same batch, and leaves hidden fields out. The provider key is no longer required: empty means the tenant has no own server and the platform sends, so readiness no longer reports it as missing (createTransportForTenant still throws on an empty provider). The provider and SMTP keys are written by TenantAdmin and the system identity, no longer by SystemAdmin, because a platform-level provider would reach every tenant without that tenant's password. The secrets set and delete handlers also admit the system identity, so server code stores a tenant secret via dispatchSystemWrite through the same key and value checks as an admin; the settings screens keep showing only the human roles. The provider choice shows each plugin's `<feature>.settings` name, also for a plugin without settings of its own, and keeps the English name when a locale feature mounted earlier declares the same key in its own language only. A MailTransportPlugin with `selectableInSettings: false` stays allowed on the server but is not offered in the form; the in-memory transport sets it, because apps mount it next to smtp in production and a tenant admin picking it would drop every mail. A plugin's secrets section takes an optional `<feature>.settings.secrets` title (SMTP password under \"SMTP sign-in\").",
+    "migration": "E2E specs that used the testIds `dashboard-panel-<plugin>-tenant`, `dashboard-panel-<plugin>-tenant-secrets` or the separate secret input of these screens address the fields of `<owner>-tenant-selection` instead (one Save). Code that wrote these keys as a SystemAdmin user writes them as the tenant's TenantAdmin or via dispatchSystemWrite. Apps that relied on readiness flagging an empty provider check it themselves."
+  },
   {
     "version": "0.326.1",
     "type": "fix",

package/packages/bundled-features/src/mail-transport-smtp/config-keys.ts

@@ -0,0 +1,67 @@
+import { access, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+
+// No SystemAdmin write: the password is a tenant secret, so platform-level SMTP keys
+// could never form a working transport (see mail-foundation's provider key).
+const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
+const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
+
+// required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+export const SMTP_CONFIG_KEYS = {
+  host: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.host",
+      description: "mail-transport-smtp.host.description",
+      icon: "server",
+      order: 1,
+    },
+  }),
+  port: createTenantConfig("number", {
+    default: 587,
+    bounds: { min: 1, max: 65535 },
+    write: tenantAdminWrite,
+    mask: {
+      title: "mail-transport-smtp.port",
+      description: "mail-transport-smtp.port.description",
+      icon: "hash",
+      order: 2,
+    },
+  }),
+  secure: createTenantConfig("boolean", {
+    default: false,
+    write: tenantAdminWrite,
+    mask: {
+      title: "mail-transport-smtp.secure",
+      description: "mail-transport-smtp.secure.description",
+      icon: "lock",
+      order: 3,
+    },
+  }),
+  authUser: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.authUser",
+      description: "mail-transport-smtp.authUser.description",
+      icon: "user",
+      order: 4,
+    },
+  }),
+  from: createTenantConfig("text", {
+    required: true,
+    default: "",
+    write: tenantAdminWrite,
+    read: tenantAdminRead,
+    mask: {
+      title: "mail-transport-smtp.from",
+      description: "mail-transport-smtp.from.description",
+      icon: "mail",
+      order: 5,
+    },
+  }),
+};

package/packages/bundled-features/src/mail-transport-smtp/feature.ts

@@ -47,9 +47,11 @@ import {
   type MailTransportPlugin,
 } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
-import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { SMTP_CONFIG_KEYS } from "./config-keys.js";
+import { MAIL_TRANSPORT_SMTP_I18N } from "./i18n.js";
 
 const FEATURE_NAME = "mail-transport-smtp";
 
@@ -107,38 +109,9 @@ export function createMailTransportSmtpFeature() {
         required: true,
       });
 
-      // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
-      const configKeys = r.config({
-        keys: {
-          host: createTenantConfig("text", {
-            required: true,
-            default: "",
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-            read: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-          port: createTenantConfig("number", {
-            default: 587,
-            bounds: { min: 1, max: 65535 },
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-          secure: createTenantConfig("boolean", {
-            default: false,
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-          from: createTenantConfig("text", {
-            required: true,
-            default: "",
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-            read: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-          authUser: createTenantConfig("text", {
-            required: true,
-            default: "",
-            write: access.roles("TenantAdmin", "SystemAdmin"),
-            read: access.roles("TenantAdmin", "SystemAdmin"),
-          }),
-        },
-      });
+      const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
+
+      r.translations({ keys: MAIL_TRANSPORT_SMTP_I18N });
 
       // Plugin: register against mail-foundation's "mailTransport" extension.
       // `entityName` "smtp" is what tenants set in mail-foundation's

package/packages/bundled-features/src/mail-transport-smtp/i18n.ts

@@ -0,0 +1,28 @@
+export const MAIL_TRANSPORT_SMTP_I18N = {
+  // Also the option label of mail-foundation's provider select.
+  "mail-transport-smtp.settings": { en: "SMTP server" },
+  "mail-transport-smtp.settings.secrets": { en: "SMTP sign-in" },
+  "mail-transport-smtp.settings.description": {
+    en: "The connection details come from your mail provider, for example Brevo, Postmark, Amazon SES or your own server.",
+  },
+  "mail-transport-smtp.host": { en: "Server address" },
+  "mail-transport-smtp.host.description": {
+    en: "Host name of the SMTP server, for example smtp.example.com.",
+  },
+  "mail-transport-smtp.port": { en: "Port number" },
+  "mail-transport-smtp.port.description": {
+    en: "Usually 587. Use 465 when your provider asks for SSL/TLS.",
+  },
+  "mail-transport-smtp.secure": { en: "SSL/TLS from the start" },
+  "mail-transport-smtp.secure.description": {
+    en: "Turn on for port 465. Leave off for 587, which switches to encryption by itself.",
+  },
+  "mail-transport-smtp.authUser": { en: "User name" },
+  "mail-transport-smtp.authUser.description": {
+    en: "Login name at the SMTP server, often an email address.",
+  },
+  "mail-transport-smtp.from": { en: "Sender address" },
+  "mail-transport-smtp.from.description": {
+    en: "The address mails are sent from, for example status@example.com. Your provider must allow it.",
+  },
+} as const;

package/packages/bundled-features/src/secrets/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "fix",
+    "title": "secrets:write:set and secrets:write:delete join the request transaction",
+    "detail": "Both handlers ran on the boot database connection, so in an /api/batch a later failing command rolled back the config writes but kept the stored secret. They now run on the request transaction (escape hatch unsafeRaw, reason documented on the handler), so a batch of config and secret writes is stored as a whole or not at all."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/packages/bundled-features/src/secrets/feature.ts

@@ -3,6 +3,7 @@ import {
   type AccessRule,
   defineFeature,
   type FeatureDefinition,
+  SYSTEM_ROLE,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
@@ -63,6 +64,11 @@ export {
 } from "./secrets-context.js";
 export { type StoredEnvelope, type StoredMetadata, tenantSecretsTable } from "./table.js";
 
+// The settings form saves config values and secrets in one /api/batch; the secret
+// write has to join that transaction so a rejected command rolls it back too.
+export const JOIN_REQUEST_TRANSACTION_REASON =
+  "the secret write runs on the request transaction so a failing batch rolls it back together with the config writes";
+
 // AppContext carries ctx.secrets via extraContext. requireSecretsContext
 // wraps that raw context so every `.get(...)` call auto-includes the
 // current user + handler as audit metadata — feature code can't forget
@@ -133,11 +139,20 @@ function resolveSecretsAccess(opts: SecretsFeatureOptions): AccessRule {
   return DEFAULT_SECRETS_ACCESS;
 }
 
+// Server-side system writes (dispatchSystemWrite, e.g. a wire hook migrating credentials) take the
+// same declared-key gate, value check and cache-sync announce as an admin instead of bypassing them
+// via SecretsContext.set. The system role is in-process only and never minted into a session.
+function withSystemWriter(rule: AccessRule): AccessRule {
+  if (!("roles" in rule) || rule.roles.includes(SYSTEM_ROLE)) return rule;
+  return { ...rule, roles: [SYSTEM_ROLE, ...rule.roles] };
+}
+
 export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureDefinition {
   const access = resolveSecretsAccess(opts);
+  const writeAccess = withSystemWriter(access);
   return defineFeature(SECRETS_FEATURE_NAME, (r) => {
     r.describe(
-      'Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins).',
+      'Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: ["TenantAdmin"] }; adopt the host\'s role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: "secrets:write:set", payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.',
     );
     r.uiHints({
       displayLabel: "Tenant Secrets",
@@ -177,8 +192,8 @@ export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureD
     // The rotation job deliberately reaches for ctx.db.unsafeRaw() (raw,
     // cross-tenant) because rotation is a deployment-wide operation — no
     // feature-wide r.systemScope() needed.
-    r.writeHandler(createSetHandler(access));
-    r.writeHandler(createDeleteHandler(access));
+    r.writeHandler(createSetHandler(writeAccess));
+    r.writeHandler(createDeleteHandler(writeAccess));
     r.queryHandler(createListHandler(access));
     // Manual-only by design: ops triggers rotation after a KEK version flip.
     // BullMQ delivers to exactly one worker, so running it against a busy

package/packages/bundled-features/src/secrets/handlers/delete.write.ts

@@ -3,7 +3,7 @@ import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { requireSecretsContext } from "../feature.js";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
 
 export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
@@ -16,8 +16,11 @@ export function createDeleteHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS)
       key: z.string().min(1).max(100),
     }),
     access,
+    escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
     handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, "secrets:write:delete");
+      const secrets = requireSecretsContext(ctx, "secrets:write:delete").withRunner(
+        ctx.db.unsafeRaw(),
+      );
       const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, event.payload.key, {
         allowUndeclared: true,
       });

package/packages/bundled-features/src/secrets/handlers/set.write.ts

@@ -2,7 +2,7 @@ import { type AccessRule, defineWriteHandler } from "@cosmicdrift/kumiko-framewo
 import * as z from "zod";
 import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
-import { requireSecretsContext } from "../feature.js";
+import { JOIN_REQUEST_TRANSACTION_REASON, requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 
 export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
@@ -23,8 +23,11 @@ export function createSetHandler(access: AccessRule = DEFAULT_SECRETS_ACCESS) {
       hint: z.string().max(200).optional(),
     }),
     access,
+    escapeHatch: { grants: ["unsafeRaw"], reason: JOIN_REQUEST_TRANSACTION_REASON },
     handler: async (event, ctx) => {
-      const secrets = requireSecretsContext(ctx, "secrets:write:set");
+      const secrets = requireSecretsContext(ctx, "secrets:write:set").withRunner(
+        ctx.db.unsafeRaw(),
+      );
       const { key, value, redactedPreview, hint } = event.payload;
 
       // Preview-priority: explicit payload param > feature-declared redact

package/packages/bundled-features/src/template-resolver/constants.ts

@@ -90,7 +90,6 @@ export const DEFAULT_PDF_LAYOUT_SLUG = "default";
 // The mail transport enforces no size limit of its own; 10 MiB is a common provider ceiling.
 export const MAIL_PREVIEW_MAX_BYTES = 10 * 1024 * 1024;
 
-export const TEST_MAIL_NOTIFICATION_TYPE = "template-resolver:test-mail";
 export const TEST_MAIL_SUBJECT_PREFIX = "[TEST] ";
 
 // System-Templates leben unter der canonical SYSTEM_TENANT_ID-Sentinel-UUID.

package/packages/bundled-features/src/template-resolver/handlers/send-test.write.ts

@@ -7,7 +7,7 @@ import {
   EMAIL_CHANNEL_NAME,
 } from "../../delivery/index.js";
 import { fileContextForTenant } from "../../file-foundation/index.js";
-import { TEST_MAIL_NOTIFICATION_TYPE, TEST_MAIL_SUBJECT_PREFIX } from "../constants.js";
+import { TEST_MAIL_SUBJECT_PREFIX } from "../constants.js";
 import { TemplateResolverErrors } from "../qualified-names.js";
 import { renderTemplatePreview } from "../template-preview.js";
 import { localeSchema, templateSlugSchema } from "./shared.js";
@@ -75,6 +75,7 @@ export const sendTestWrite = defineWriteHandler({
       sseBroker: undefined,
       tenantId: event.user.tenantId,
       secrets: ctx.secrets,
+      config: ctx.config,
       readAttachment: createEmailAttachmentReader(
         ctx.db,
         ctx.registry,
@@ -98,7 +99,8 @@ export const sendTestWrite = defineWriteHandler({
       const result = await channel.send(
         address,
         {
-          notificationType: TEST_MAIL_NOTIFICATION_TYPE,
+          // The template slug is the notification name, so the test mail takes the transport the real mail takes.
+          notificationType: event.payload.slug,
           title: subject,
           body: undefined,
           data: undefined,

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.369.0",
+    "type": "fix",
+    "title": "The \"account deleted\" mail is sent through channel-email when delivery is mounted",
+    "detail": "The default mailer for the Art. 17 deletion confirmation called createTransportForTenant directly, which threw for a tenant without its own mail provider. With delivery and channel-email mounted it now sends through the email channel like the other GDPR mails, over the app transport, without writing a delivery-attempt row for the already erased user. Without channel-email the previous path stays."
+  },
   {
     "version": "0.367.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -719,17 +719,20 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           userId: forgetUserId,
         });
 
-        // Without an app callback the default mail goes out when a mail transport and a
-        // mail renderer are mounted. The user is already erased here, so it bypasses the
-        // delivery log: an attempt row would be new personal data.
+        // Without an app callback the default mail goes out when an email channel or a
+        // mail transport, plus a mail renderer, are mounted. The user is already erased
+        // here, so it bypasses the delivery log: an attempt row would be new personal data.
         const forgetConfigResolver = ctx.configResolver;
         const sendDeletionExecutedEmail =
           opts.sendDeletionExecutedEmail ??
-          (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+          ((isGdprMailDeliveryAvailable(forgetRegistry) ||
+            isMailTransportAvailable(forgetRegistry)) &&
+          isMailRendererAvailable(forgetRegistry)
             ? makeDefaultDeletionExecutedEmail(
                 {
                   registry: forgetRegistry,
                   db: forgetDb,
+                  ...(ctx.secrets !== undefined && { secrets: ctx.secrets }),
                   resolveTransport: makeTenantMailTransportResolver({
                     registry: forgetRegistry,
                     configResolver: forgetConfigResolver,

package/packages/bundled-features/src/user-data-rights/lib/default-mailers.ts

@@ -7,8 +7,8 @@
 // to the user, so delivery resolves the address and the attempt row carries
 // the recipientId the forget path erases. Deletion-executed cannot: the user
 // is gone by then, and an attempt row written after the erasure would be new
-// personal data. It renders the seeded template and sends over the tenant's
-// mail transport, with no delivery log.
+// personal data. It renders the seeded template and sends it straight through the
+// email channel (or, without one, the tenant's mail transport), with no delivery log.
 
 import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
@@ -21,7 +21,14 @@ import type {
   TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { hasMailTranslations, mailT } from "@cosmicdrift/kumiko-framework/i18n";
-import { DELIVERY_CHANNEL_EXTENSION } from "../../delivery/index.js";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  buildChannelContext,
+  collectChannels,
+  DELIVERY_CHANNEL_EXTENSION,
+  type DeliveryChannel,
+  EMAIL_CHANNEL_NAME,
+} from "../../delivery/index.js";
 import {
   collectRendererPlugins,
   createRendererFoundationApi,
@@ -145,10 +152,16 @@ export function makeDefaultDeletionRequestedEmail(
 export type DeletionExecutedMailDeps = {
   readonly registry: Registry;
   readonly db: DbConnection;
+  /** Used only when no email delivery channel is mounted. */
   readonly resolveTransport: (tenantId: string) => Promise<EmailTransport>;
   readonly configFor: (tenantId: TenantId) => ConfigAccessor | undefined;
+  readonly secrets?: SecretsContext;
 };
 
+function emailChannelOf(registry: Registry): DeliveryChannel | undefined {
+  return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
+
 export function makeDefaultDeletionExecutedEmail(
   deps: DeletionExecutedMailDeps,
   defaults: GdprMailDefaults = {},
@@ -190,6 +203,30 @@ export function makeDefaultDeletionExecutedEmail(
     if (rendered.kind !== "mail") {
       throw new Error(`deletion-executed mail: renderer answered with kind "${rendered.kind}"`);
     }
+    // The channel picks the same transport as every other mail of this notification
+    // (the app transport unless it is declared tenantTransport), so a tenant without
+    // its own mail provider still gets the confirmation. channel.send writes no attempt row.
+    const channel = emailChannelOf(deps.registry);
+    if (channel !== undefined) {
+      const result = await channel.send(
+        args.userEmail,
+        {
+          notificationType: type,
+          title: rendered.subject,
+          body: undefined,
+          data: undefined,
+          locale,
+        },
+        buildChannelContext(deps.db, deps.registry, undefined, tenantId, deps.secrets, config),
+        { subject: rendered.subject, html: rendered.html, text: rendered.text },
+      );
+      if (result.status !== "sent") {
+        // No address in the message: the user is already erased.
+        throw new Error(`deletion-executed mail not sent: ${result.error ?? result.status}`);
+      }
+      // skip: the channel delivered it, the transport fallback below is for apps without one
+      return;
+    }
     const transport = await deps.resolveTransport(tenantId);
     await transport.send({
       to: args.userEmail,

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -407,7 +407,7 @@
     },
     {
       "name": "channel-email",
-      "description": "Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send each tenant's mail through its own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.",
+      "description": "Wires an `EmailTransport` (typically `mail-transport-smtp` in production, `createInMemoryTransport()` in tests) into the delivery system as the `email` channel. Requires `delivery`; pass an `EmailChannelOptions` with a `transport` and a `resolveEmail` function that maps a user ID to their email address. Mails render from stored templates (`renderer-mail-html`): a notification routed to this channel needs `template` + `meta` on `r.notification`, otherwise its delivery fails. Pass `tenantTransport: tenantMailTransport` (from `mail-foundation`) to send the notifications declared with `tenantTransport: true` through the sending tenant's own configured provider: a broken provider fails the send, a tenant without one uses the app `transport`; every other notification (password reset, sign-in) always goes through the app `transport`. `transport` may be left out when `tenantTransport` is set; a mail that then has no transport fails with `missing_credentials`. Notifications declared with `unsubscribe: true` get a signed `data.unsubscribeUrl` from delivery, which turns into the `List-Unsubscribe` headers.",
       "toggleableDefault": null,
       "requires": [
         "delivery"
@@ -725,7 +725,7 @@
     },
     {
       "name": "delivery",
-      "description": "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting — add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (`runProdApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
+      "description": "The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting — add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (the `runProdApp` and `runDevApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. An app serving its own (e.g. legacy) unsubscribe links renders the same result page with `renderUnsubscribeResultPage({ kind, locale })`. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.",
       "toggleableDefault": null,
       "requires": [
         "tenant"
@@ -1507,7 +1507,7 @@
     },
     {
       "name": "mail-foundation",
-      "description": "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending — use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature` so a tenant with a provider configured sends delivery mails through its own transport and other tenants through the app transport.",
+      "description": "Defines the `mailTransport` extension point and a per-tenant `provider` config key that selects which registered transport plugin to use at runtime. Call `createTransportForTenant(ctx, tenantId)` to get an `EmailTransport` ready for sending — use this feature together with at least one `mail-transport-*` feature; use `delivery` + `channel-email` instead when you need the full notification pipeline with delivery attempts and user preferences. Pass `tenantMailTransport` as `tenantTransport` to `createChannelEmailFeature`: notifications declared with `tenantTransport: true` then go through the tenant's own transport when it has a provider and through the app transport otherwise. Tenant admins pick the provider and fill in its settings on the generated Email sending settings screen; an empty provider is a valid choice and means the platform sends.",
       "toggleableDefault": null,
       "requires": [
         "config"
@@ -1531,8 +1531,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "TenantAdmin",
@@ -1603,8 +1603,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "TenantAdmin",
@@ -1624,8 +1624,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "TenantAdmin",
@@ -1645,8 +1645,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "TenantAdmin",
@@ -1669,8 +1669,8 @@
           },
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "all"
@@ -1689,8 +1689,8 @@
           "bounds": null,
           "pattern": null,
           "writeRoles": [
-            "TenantAdmin",
-            "SystemAdmin"
+            "system",
+            "TenantAdmin"
           ],
           "readRoles": [
             "all"
@@ -2191,7 +2191,7 @@
     },
     {
       "name": "secrets",
-      "description": "Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: [\"TenantAdmin\"] }; adopt the host's role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins).",
+      "description": "Stores arbitrary per-tenant secrets (API keys, tokens, credentials) encrypted at rest using AES-256 with a KEK loaded from `KUMIKO_SECRETS_MASTER_KEY_V1` (and successive versions for rotation). Read a secret in handlers via `ctx.secrets.get(tenantId, handle)`, which automatically appends a `tenantSecretRead` audit event so every access is traceable. A `rotate` job re-encrypts all envelopes after a KEK version bump. The `set`/`delete`/`list` handlers share one access rule — default { roles: [\"TenantAdmin\"] }; adopt the host's role vocabulary with createSecretsFeature({ roles }) or open it to every authenticated tenant user with { access: { openToAll: { reason } } } (larger blast radius: any tenant member can then read secret previews and write/delete secrets, not just admins). Server-side code writes a tenant secret with `dispatchSystemWrite({ handlerQn: \"secrets:write:set\", payload, tenantId })`: set and delete also admit the in-process system identity, so such writes pass the same declared-key and value checks.",
       "toggleableDefault": null,
       "requires": [],
       "optionalRequires": [],