@cosmicdrift/kumiko-bundled-features 0.338.0 → 0.339.0

package/dist/billing-foundation/consumer-protection/termination-notify.d.ts

@@ -0,0 +1,18 @@
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { ProviderCancelOutcome } from "../events.js";
+import type { ConsumerProtectionOptions } from "../types.js";
+import type { ConsentLocale } from "./consent-text.js";
+import { type OperatorNoticeDeclaration } from "./termination-mail.js";
+import type { OperatorNoticeReason } from "./termination-texts.js";
+export type OperatorNoticePlan = {
+    readonly locale: ConsentLocale;
+    readonly requestId: string;
+    readonly receivedAtIso: string;
+    readonly channel: "public" | "account";
+    readonly declaration: OperatorNoticeDeclaration;
+    readonly reasons: readonly OperatorNoticeReason[];
+    readonly tenantId?: string;
+    readonly providerCancel?: ProviderCancelOutcome;
+};
+export declare function requireNotify(ctx: HandlerContext): NonNullable<HandlerContext["notify"]>;
+export declare function notifyOperator(ctx: HandlerContext, consumerProtection: ConsumerProtectionOptions, plan: OperatorNoticePlan): Promise<void>;

package/dist/billing-foundation/consumer-protection/termination-notify.js

@@ -0,0 +1,21 @@
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE } from "../constants.js";
+import { renderOperatorNotice } from "./termination-mail.js";
+export function requireNotify(ctx) {
+    if (!ctx.notify) {
+        throw new InternalError({
+            message: "billing-foundation:termination: ctx.notify unavailable — the delivery feature must be mounted",
+        });
+    }
+    return ctx.notify;
+}
+export async function notifyOperator(ctx, consumerProtection, plan) {
+    await requireNotify(ctx)(CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE, {
+        route: { email: consumerProtection.operatorEmail },
+        data: renderOperatorNotice({
+            ...plan,
+            operatorEmail: consumerProtection.operatorEmail,
+        }),
+        priority: "critical",
+    });
+}

package/dist/billing-foundation/consumer-protection/termination-pages.js

@@ -1,6 +1,7 @@
 // Public § 312k pages (/legal/kuendigen, /legal/cancel): form → review → confirm,
 // no JavaScript. Every echoed value goes through escapeHtml/escapeHtmlAttr.
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { getCookie } from "hono/cookie";
 import { securePageHeaders, wrapInLayout } from "../../page-render/index.js";
 import { SubscriptionFoundationHandlers } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS } from "../events.js";
@@ -171,14 +172,42 @@ function resultPage(locale, receivedAtIso, requestId) {
     return htmlResponse(locale, page.resultTitle, body, 200);
 }
 const RATE_LIMITED_CODE = "rate_limited";
+const TENANT_HEADER = "x-tenant";
+const TENANT_COOKIE = "kumiko_tenant";
+// Exactly what the anonymous tenant resolution reads. The resolver and its
+// trust rules still decide; the re-entry only sees what a direct /api/write
+// from this client would see. Never the session cookie or Authorization (the
+// handler is anonymous) and never X-Forwarded-For (the resolved clientIp
+// travels as env).
+const FORWARDED_TENANT_HEADERS = [
+    "host",
+    "x-forwarded-host",
+    "x-forwarded-proto",
+    TENANT_HEADER,
+];
+function reentryHeaders(c) {
+    const headers = new Headers({ "content-type": "application/json" });
+    for (const name of FORWARDED_TENANT_HEADERS) {
+        const value = c.req.header(name);
+        if (value !== undefined)
+            headers.set(name, value);
+    }
+    const tenantCookie = getCookie(c, TENANT_COOKIE);
+    if (tenantCookie !== undefined) {
+        headers.set("cookie", `${TENANT_COOKIE}=${encodeURIComponent(tenantCookie)}`);
+    }
+    return headers;
+}
 async function submitDeclaration(c, app, clientIp, values, locale) {
     // deps.write only resolves a session user under /api/*; this page lives
     // outside it, so it re-enters the dispatcher through the app like the
     // user-export by-token route. The resolved clientIp as env keeps the
-    // handler's per-IP rate limit per visitor instead of one shared bucket.
+    // handler's per-IP rate limit per visitor instead of one shared bucket;
+    // the forwarded host headers let a host-based tenant resolver see this
+    // visitor's host.
     const response = await app.fetch(new Request(`${new URL(c.req.url).origin}/api/write`, {
         method: "POST",
-        headers: { "content-type": "application/json" },
+        headers: reentryHeaders(c),
         body: JSON.stringify({
             type: SubscriptionFoundationHandlers.requestContractTermination,
             payload: payloadOf(values, locale),

package/dist/billing-foundation/consumer-protection/termination-record.d.ts

@@ -1,7 +1,7 @@
 import { type QueryHandlerDef, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type ProviderCancelOutcome } from "../events.js";
-import type { ResolvedBillingFoundationOptions } from "../types.js";
+import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
 import type { OperatorNoticeReason } from "./termination-texts.js";
 export declare const recordContractTerminationSchema: z.ZodObject<{
     requestId: z.ZodString;
@@ -22,6 +22,27 @@ export declare const recordContractTerminationSchema: z.ZodObject<{
         none: "none";
         "period-end": "period-end";
     }>;
+    receivedAtIso: z.ZodOptional<z.ZodString>;
+    locale: z.ZodOptional<z.ZodEnum<{
+        de: "de";
+        en: "en";
+    }>>;
+}, z.core.$strict>;
+export declare const declareContractTerminationSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    declarationType: z.ZodEnum<{
+        termination: "termination";
+        withdrawal: "withdrawal";
+    }>;
+    terminationKind: z.ZodEnum<{
+        extraordinary: "extraordinary";
+        ordinary: "ordinary";
+    }>;
+    receivedAtIso: z.ZodString;
+    locale: z.ZodEnum<{
+        de: "de";
+        en: "en";
+    }>;
 }, z.core.$strict>;
 export type RecordContractTerminationResult = {
     readonly receivedAtIso: string;
@@ -47,5 +68,6 @@ export declare const recordUnmatchedContractTerminationSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const terminableSubscriptionSchema: z.ZodObject<{}, z.core.$strict>;
 export declare function createTerminableSubscriptionQuery(): QueryHandlerDef;
-export declare function createRecordContractTerminationHandler(options: ResolvedBillingFoundationOptions): WriteHandlerDef;
+export declare function createDeclareContractTerminationHandler(): WriteHandlerDef;
+export declare function createRecordContractTerminationHandler(options: ResolvedBillingFoundationOptions, consumerProtection: ConsumerProtectionOptions): WriteHandlerDef;
 export declare function createRecordUnmatchedContractTerminationHandler(): WriteHandlerDef;

package/dist/billing-foundation/consumer-protection/termination-record.js

@@ -8,8 +8,10 @@ import * as z from "zod";
 import { subscriptionAggregateId, terminationUnmatchedAggregateId } from "../aggregate-id.js";
 import { resolveProviderPlugin } from "../checkout-core.js";
 import { isTerminalSubscriptionStatus, SubscriptionCancelTimings } from "../constants.js";
-import { CONTRACT_TERMINATION_CHANNELS, CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS, CONTRACT_TERMINATION_REQUESTED_EVENT_QN, CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE, CONTRACT_TERMINATION_UNMATCHED_EVENT_QN, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
+import { CONTRACT_TERMINATION_CHANNELS, CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_KINDS, CONTRACT_TERMINATION_REQUESTED_EVENT_QN, CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE, CONTRACT_TERMINATION_UNMATCHED_EVENT_QN, contractTerminationRequestedPayloadSchema, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
 import { getSubscriptionForTenant } from "../get-subscription-for-tenant.js";
+import { CONSENT_LOCALES, FALLBACK_CONSENT_LOCALE } from "./consent-locale.js";
+import { notifyOperator } from "./termination-notify.js";
 const REQUESTED_CANCEL_TIMINGS = [
     SubscriptionCancelTimings.periodEnd,
     SubscriptionCancelTimings.immediately,
@@ -22,6 +24,19 @@ export const recordContractTerminationSchema = z
     terminationKind: z.enum(CONTRACT_TERMINATION_KINDS),
     channel: z.enum(CONTRACT_TERMINATION_CHANNELS),
     when: z.enum(REQUESTED_CANCEL_TIMINGS),
+    // The public job passes the time the declaration arrived and the declarant's
+    // locale, so the record and a provider-problem notice do not take the job's.
+    receivedAtIso: z.string().min(1).optional(),
+    locale: z.enum(CONSENT_LOCALES).optional(),
+})
+    .strict();
+export const declareContractTerminationSchema = z
+    .object({
+    requestId: z.string().min(1).max(100),
+    declarationType: z.enum(CONTRACT_TERMINATION_DECLARATION_TYPES),
+    terminationKind: z.enum(CONTRACT_TERMINATION_KINDS),
+    receivedAtIso: z.string().min(1),
+    locale: z.enum(CONSENT_LOCALES),
 })
     .strict();
 export const recordUnmatchedContractTerminationSchema = z
@@ -49,7 +64,56 @@ export function createTerminableSubscriptionQuery() {
         },
     };
 }
-export function createRecordContractTerminationHandler(options) {
+async function cancelAtProvider(ctx, tenantId, when, receivedAtIso) {
+    // skip: a withdrawal over the public channel makes no provider call
+    if (when === "none")
+        return { providerCancel: "none", effectiveAtIso: null, noticeReason: null };
+    const subscription = await getSubscriptionForTenant(ctx, tenantId);
+    if (subscription === null || isTerminalSubscriptionStatus(subscription.status)) {
+        return { providerCancel: "none", effectiveAtIso: null, noticeReason: "no_active_subscription" };
+    }
+    const plugin = findPlugin(ctx, subscription.providerName);
+    if (!plugin?.cancelSubscription) {
+        return { providerCancel: "none", effectiveAtIso: null, noticeReason: "provider_cannot_cancel" };
+    }
+    try {
+        await plugin.cancelSubscription(ctx, {
+            providerSubscriptionId: subscription.providerSubscriptionId,
+            when,
+        });
+    }
+    catch (error) {
+        ctx.log?.warn(`[billing-foundation:record-contract-termination] provider cancel failed for tenant ${tenantId}: ${error instanceof Error ? error.message : String(error)}`);
+        return { providerCancel: "none", effectiveAtIso: null, noticeReason: "provider_error" };
+    }
+    return {
+        providerCancel: when,
+        effectiveAtIso: when === SubscriptionCancelTimings.immediately
+            ? receivedAtIso
+            : subscription.currentPeriodEnd.toString(),
+        noticeReason: null,
+    };
+}
+export function createDeclareContractTerminationHandler() {
+    return {
+        name: "declare-contract-termination",
+        agent: { expose: false },
+        schema: declareContractTerminationSchema,
+        access: { roles: access.system },
+        handler: async (event, ctx) => {
+            // @cast-boundary engine-payload — dispatcher-zod-validated payload
+            const payload = event.payload;
+            const stream = await ctx.fetchForWriting({
+                aggregateId: subscriptionAggregateId(event.user.tenantId),
+                aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+            });
+            const declared = payload;
+            await stream.appendOne({ type: CONTRACT_TERMINATION_DECLARED_EVENT_QN, payload: declared });
+            return { isSuccess: true, data: { declared: true } };
+        },
+    };
+}
+export function createRecordContractTerminationHandler(options, consumerProtection) {
     return {
         name: "record-contract-termination",
         agent: { expose: false },
@@ -64,43 +128,30 @@ export function createRecordContractTerminationHandler(options) {
                     message: "billing-foundation: the public channel never cancels at the provider immediately",
                 });
             }
-            const receivedAtIso = options.now().toString();
+            const receivedAtIso = payload.receivedAtIso ?? options.now().toString();
             const stream = await ctx.fetchForWriting({
                 aggregateId: subscriptionAggregateId(tenantId),
                 aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
             });
-            let providerCancel = "none";
-            let effectiveAtIso = null;
-            let noticeReason = null;
-            if (payload.when !== "none") {
-                const subscription = await getSubscriptionForTenant(ctx, tenantId);
-                if (subscription === null || isTerminalSubscriptionStatus(subscription.status)) {
-                    noticeReason = "no_active_subscription";
-                }
-                else {
-                    const plugin = findPlugin(ctx, subscription.providerName);
-                    if (!plugin?.cancelSubscription) {
-                        noticeReason = "provider_cannot_cancel";
-                    }
-                    else {
-                        try {
-                            await plugin.cancelSubscription(ctx, {
-                                providerSubscriptionId: subscription.providerSubscriptionId,
-                                when: payload.when,
-                            });
-                            providerCancel = payload.when;
-                            effectiveAtIso =
-                                payload.when === SubscriptionCancelTimings.immediately
-                                    ? receivedAtIso
-                                    : subscription.currentPeriodEnd.toString();
-                        }
-                        catch (error) {
-                            ctx.log?.warn(`[billing-foundation:record-contract-termination] provider cancel failed for tenant ${tenantId}: ${error instanceof Error ? error.message : String(error)}`);
-                            noticeReason = "provider_error";
-                        }
-                    }
-                }
+            // The public job runs at least once: a second run must not call the
+            // provider or append again.
+            const alreadyRecorded = stream.events
+                .map((e) => e.type === CONTRACT_TERMINATION_REQUESTED_EVENT_QN
+                ? contractTerminationRequestedPayloadSchema.safeParse(e.payload).data
+                : undefined)
+                .find((recordedPayload) => recordedPayload?.requestId === payload.requestId);
+            if (alreadyRecorded) {
+                return {
+                    isSuccess: true,
+                    data: {
+                        receivedAtIso: alreadyRecorded.receivedAtIso,
+                        effectiveAtIso: alreadyRecorded.effectiveAtIso,
+                        providerCancel: alreadyRecorded.providerCancel,
+                        noticeReason: null,
+                    },
+                };
             }
+            const { providerCancel, effectiveAtIso, noticeReason } = await cancelAtProvider(ctx, tenantId, payload.when, receivedAtIso);
             const recorded = {
                 requestId: payload.requestId,
                 declarationType: payload.declarationType,
@@ -114,6 +165,23 @@ export function createRecordContractTerminationHandler(options) {
                 type: CONTRACT_TERMINATION_REQUESTED_EVENT_QN,
                 payload: recorded,
             });
+            // The account path reports the provider outcome to its caller and the
+            // operator in its own mail; the public path has nobody else to tell.
+            if (payload.channel === "public" && noticeReason !== null) {
+                await notifyOperator(ctx, consumerProtection, {
+                    locale: payload.locale ?? FALLBACK_CONSENT_LOCALE,
+                    requestId: payload.requestId,
+                    receivedAtIso,
+                    channel: "public",
+                    declaration: {
+                        declarationType: payload.declarationType,
+                        terminationKind: payload.terminationKind,
+                    },
+                    reasons: [noticeReason],
+                    tenantId,
+                    providerCancel,
+                });
+            }
             return {
                 isSuccess: true,
                 data: {

package/dist/billing-foundation/consumer-protection/termination-request.js

@@ -8,11 +8,12 @@ import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";
 import { UserQueries } from "../../user/index.js";
-import { CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE, CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, SubscriptionCancelTimings, SubscriptionFoundationHandlers, SubscriptionFoundationQueries, } from "../constants.js";
+import { CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, SubscriptionCancelTimings, SubscriptionFoundationHandlers, SubscriptionFoundationQueries, } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS, } from "../events.js";
 import { purchaseRolesOf } from "../plan-catalog.js";
 import { resolveConsentLocale } from "./consent-text.js";
-import { renderOperatorNotice, renderTerminationReceipt, } from "./termination-mail.js";
+import { renderTerminationReceipt } from "./termination-mail.js";
+import { notifyOperator, requireNotify } from "./termination-notify.js";
 const TENANT_ADMIN_ROLE = "TenantAdmin";
 const EXTRAORDINARY_REASON_MESSAGE = "reason is required for an extraordinary termination";
 const authUserRowSchema = z.object({
@@ -52,12 +53,7 @@ function needsOperatorNotice(declaration) {
     ];
 }
 async function sendTerminationMails(ctx, consumerProtection, plan) {
-    if (!ctx.notify) {
-        throw new InternalError({
-            message: "billing-foundation:termination: ctx.notify unavailable — the delivery feature must be mounted",
-        });
-    }
-    await ctx.notify(CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, {
+    await requireNotify(ctx)(CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, {
         route: { email: plan.declaration.email },
         data: renderTerminationReceipt({
             locale: plan.locale,
@@ -71,21 +67,7 @@ async function sendTerminationMails(ctx, consumerProtection, plan) {
     // skip: no operator notice needed for this declaration
     if (plan.reasons.length === 0)
         return;
-    await ctx.notify(CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE, {
-        route: { email: consumerProtection.operatorEmail },
-        data: renderOperatorNotice({
-            locale: plan.locale,
-            requestId: plan.requestId,
-            receivedAtIso: plan.receivedAtIso,
-            channel: plan.channel,
-            declaration: plan.declaration,
-            reasons: plan.reasons,
-            operatorEmail: consumerProtection.operatorEmail,
-            ...(plan.tenantId !== undefined && { tenantId: plan.tenantId }),
-            ...(plan.providerCancel !== undefined && { providerCancel: plan.providerCancel }),
-        }),
-        priority: "critical",
-    });
+    await notifyOperator(ctx, consumerProtection, plan);
 }
 // Tenants the entered email can terminate a contract for: tenants where the
 // user is TenantAdmin and the subscription is not terminal. Every identity
@@ -122,6 +104,7 @@ export function createRequestContractTerminationHandler(options, consumerProtect
         schema: requestContractTerminationSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 5, windowSeconds: 600 },
+        ...(consumerProtection.terminationScope === "platform" && { tenantlessAnonymous: true }),
         escapeHatch: {
             reason: "Anonymous declarant has no session — finds the contract by email via ctx.queryAs(system, user:find-for-auth) and tenant:memberships; the tenant written to comes only from those lookups.",
         },
@@ -132,29 +115,15 @@ export function createRequestContractTerminationHandler(options, consumerProtect
             const receivedAtIso = options.now().toString();
             const { declarationType, terminationKind } = payload;
             const reasons = [];
+            const locale = resolveConsentLocale(payload.locale);
             let matchedTenantId;
-            let providerCancel;
             const candidates = await findTerminableTenantIds(ctx, event.user.tenantId, payload.email);
             const [onlyCandidate] = candidates;
             if (candidates.length === 1 && onlyCandidate !== undefined) {
                 matchedTenantId = onlyCandidate;
-                const recorded = await ctx.writeAs(createSystemUser(onlyCandidate), SubscriptionFoundationHandlers.recordContractTermination, {
-                    requestId,
-                    declarationType,
-                    terminationKind,
-                    channel: "public",
-                    when: declarationType === "withdrawal" ? "none" : SubscriptionCancelTimings.periodEnd,
-                });
-                if (recorded.isSuccess) {
-                    // @cast-boundary engine-payload — our own record handler's return shape
-                    const data = recorded.data;
-                    providerCancel = data.providerCancel;
-                    if (data.noticeReason !== null)
-                        reasons.push(data.noticeReason);
-                }
-                else {
+                const declared = await ctx.writeAs(createSystemUser(onlyCandidate), SubscriptionFoundationHandlers.declareContractTermination, { requestId, declarationType, terminationKind, receivedAtIso, locale });
+                if (!declared.isSuccess)
                     reasons.push("recording_failed");
-                }
             }
             else {
                 reasons.push(candidates.length === 0 ? "unmatched" : "ambiguous");
@@ -170,7 +139,7 @@ export function createRequestContractTerminationHandler(options, consumerProtect
             }
             reasons.push(...needsOperatorNotice(payload));
             await sendTerminationMails(ctx, consumerProtection, {
-                locale: resolveConsentLocale(payload.locale),
+                locale,
                 requestId,
                 receivedAtIso,
                 channel: "public",
@@ -186,7 +155,6 @@ export function createRequestContractTerminationHandler(options, consumerProtect
                 },
                 reasons,
                 ...(matchedTenantId !== undefined && { tenantId: matchedTenantId }),
-                ...(providerCancel !== undefined && { providerCancel }),
             });
             return {
                 isSuccess: true,

package/dist/billing-foundation/consumer-protection/termination-texts.js

@@ -24,18 +24,18 @@ export const TERMINATION_TEXTS = {
         customerReference: "Kundennummer / Referenz",
         reasonFieldLabel: "Begründung",
         receiptSubject: {
-            termination: "Eingangsbestätigung Ihrer Kündigung",
-            withdrawal: "Eingangsbestätigung Ihres Widerrufs",
+            termination: "Eingangsbestätigung deiner Kündigung",
+            withdrawal: "Eingangsbestätigung deines Widerrufs",
         },
-        receiptIntro: "wir bestätigen den Eingang Ihrer Erklärung mit folgendem Inhalt. Diese E-Mail ist eine Eingangsbestätigung, keine Bestätigung der Wirksamkeit.",
-        receiptNextSteps: "Wir prüfen Ihre Erklärung und melden uns, sobald sie bearbeitet ist oder wir Rückfragen haben.",
-        receiptRevoke: (operatorEmail) => `Haben Sie diese Erklärung nicht abgegeben oder möchten Sie sie zurücknehmen? Schreiben Sie uns bitte umgehend an ${operatorEmail}.`,
-        contact: "Fragen richten Sie bitte an",
+        receiptIntro: "wir bestätigen den Eingang deiner Erklärung mit folgendem Inhalt. Diese E-Mail ist eine Eingangsbestätigung, keine Bestätigung der Wirksamkeit.",
+        receiptNextSteps: "Wir prüfen deine Erklärung und melden uns, sobald sie bearbeitet ist oder wir Rückfragen haben.",
+        receiptRevoke: (operatorEmail) => `Hast du diese Erklärung nicht abgegeben oder möchtest du sie zurücknehmen? Schreib uns bitte umgehend an ${operatorEmail}.`,
+        contact: "Fragen richtest du bitte an",
         operatorSubject: {
             termination: "Kündigung: Bearbeitung nötig",
             withdrawal: "Widerruf: Bearbeitung nötig",
         },
-        operatorIntro: "Es ist eine Erklärung eingegangen, die Ihre Bearbeitung braucht.",
+        operatorIntro: "Es ist eine Erklärung eingegangen, die bearbeitet werden muss.",
         operatorReasons: {
             unmatched: "Kein passender Vertrag zur angegebenen E-Mail gefunden",
             ambiguous: "Die angegebene E-Mail passt zu mehreren Verträgen",
@@ -58,8 +58,8 @@ export const TERMINATION_TEXTS = {
         },
         page: {
             title: "Vertrag kündigen oder widerrufen",
-            lead: "Mit diesem Formular erklären Sie die Kündigung oder den Widerruf Ihres Vertrags. Sie brauchen dafür kein Kundenkonto.",
-            declarationTypeHeading: "Was möchten Sie erklären?",
+            lead: "Mit diesem Formular erklärst du die Kündigung oder den Widerruf deines Vertrags. Du brauchst dafür kein Kundenkonto.",
+            declarationTypeHeading: "Was möchtest du erklären?",
             kindHeading: "Art der Kündigung",
             reasonHint: "Pflicht bei außerordentlicher Kündigung.",
             earliestDate: "Die Kündigung gilt zum nächstmöglichen Zeitpunkt.",
@@ -68,23 +68,23 @@ export const TERMINATION_TEXTS = {
             customerReferenceLabel: "Kundennummer (optional)",
             reasonLabel: "Begründung",
             reviewButton: "Weiter zur Prüfung",
-            reviewTitle: "Bitte prüfen Sie Ihre Angaben",
-            reviewLead: "Erst mit dem Klick auf den Button unten wird Ihre Erklärung abgegeben.",
+            reviewTitle: "Bitte prüfe deine Angaben",
+            reviewLead: "Erst mit dem Klick auf den Button unten wird deine Erklärung abgegeben.",
             confirmButton: { termination: "Jetzt kündigen", withdrawal: "Jetzt widerrufen" },
             backButton: "Angaben ändern",
-            resultTitle: "Ihre Erklärung ist eingegangen",
-            resultLead: "Wir haben Ihre Erklärung erhalten und senden Ihnen eine Eingangsbestätigung.",
+            resultTitle: "Deine Erklärung ist eingegangen",
+            resultLead: "Wir haben deine Erklärung erhalten und senden dir eine Eingangsbestätigung.",
             resultReceivedAt: "Eingegangen am",
             resultRequestId: "Vorgangsnummer",
-            resultMailNote: "Die Eingangsbestätigung geht an die von Ihnen angegebene E-Mail-Adresse.",
-            errorsHeading: "Bitte korrigieren Sie Ihre Angaben",
-            errorName: "Bitte geben Sie Ihren Namen an.",
-            errorEmail: "Bitte geben Sie eine gültige E-Mail-Adresse an.",
+            resultMailNote: "Die Eingangsbestätigung geht an die von dir angegebene E-Mail-Adresse.",
+            errorsHeading: "Bitte korrigiere deine Angaben",
+            errorName: "Bitte gib deinen Namen an.",
+            errorEmail: "Bitte gib eine gültige E-Mail-Adresse an.",
             errorReason: "Bei einer außerordentlichen Kündigung ist eine Begründung nötig.",
-            errorChoice: "Bitte wählen Sie eine Erklärung und die Art der Kündigung.",
-            errorGeneric: "Ihre Erklärung konnte nicht verarbeitet werden. Bitte versuchen Sie es erneut.",
+            errorChoice: "Bitte wähle eine Erklärung und die Art der Kündigung.",
+            errorGeneric: "Deine Erklärung konnte nicht verarbeitet werden. Bitte versuch es erneut.",
             rateLimitedTitle: "Zu viele Anfragen",
-            rateLimitedBody: "Von Ihrer Adresse kamen zu viele Anfragen. Bitte versuchen Sie es später erneut.",
+            rateLimitedBody: "Von deiner Adresse kamen zu viele Anfragen. Bitte versuch es später erneut.",
         },
     },
     en: {

package/dist/billing-foundation/events.d.ts

@@ -108,6 +108,25 @@ export declare const contractTerminationRequestedPayloadSchema: z.ZodObject<{
     }>;
 }, z.core.$strip>;
 export type ContractTerminationRequestedPayload = z.infer<typeof contractTerminationRequestedPayloadSchema>;
+export declare const CONTRACT_TERMINATION_DECLARED_EVENT_SHORT: "contract-termination-declared";
+export declare const CONTRACT_TERMINATION_DECLARED_EVENT_QN: "billing-foundation:event:contract-termination-declared";
+export declare const contractTerminationDeclaredPayloadSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    declarationType: z.ZodEnum<{
+        termination: "termination";
+        withdrawal: "withdrawal";
+    }>;
+    terminationKind: z.ZodEnum<{
+        extraordinary: "extraordinary";
+        ordinary: "ordinary";
+    }>;
+    receivedAtIso: z.ZodString;
+    locale: z.ZodEnum<{
+        de: "de";
+        en: "en";
+    }>;
+}, z.core.$strip>;
+export type ContractTerminationDeclaredPayload = z.infer<typeof contractTerminationDeclaredPayloadSchema>;
 export declare const CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE: "contract-termination-unmatched";
 export declare const CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT: "contract-termination-unmatched";
 export declare const CONTRACT_TERMINATION_UNMATCHED_EVENT_QN: "billing-foundation:event:contract-termination-unmatched";

package/dist/billing-foundation/events.js

@@ -11,6 +11,7 @@
 // type ohne payload-discriminator.
 import * as z from "zod";
 import { BILLING_FOUNDATION_FEATURE, SubscriptionStatuses } from "./constants.js";
+import { CONSENT_LOCALES } from "./consumer-protection/consent-locale.js";
 // Aggregate-type für den event-store. Eine subscription pro Tenant ist
 // ein stream; der subscriptionAggregateId-helper liefert die stream-id.
 export const SUBSCRIPTION_AGGREGATE_TYPE = "subscription";
@@ -138,6 +139,17 @@ export const contractTerminationRequestedPayloadSchema = z.object({
     effectiveAtIso: z.string().min(1).nullable(),
     providerCancel: z.enum(PROVIDER_CANCEL_OUTCOMES),
 });
+// A public declaration matched to this tenant. The provider cancel runs in a
+// job triggered by this event, so the request itself only looks up and appends.
+export const CONTRACT_TERMINATION_DECLARED_EVENT_SHORT = "contract-termination-declared";
+export const CONTRACT_TERMINATION_DECLARED_EVENT_QN = `${BILLING_FOUNDATION_FEATURE}:event:${CONTRACT_TERMINATION_DECLARED_EVENT_SHORT}`;
+export const contractTerminationDeclaredPayloadSchema = z.object({
+    requestId: z.string().min(1).max(100),
+    declarationType: z.enum(CONTRACT_TERMINATION_DECLARATION_TYPES),
+    terminationKind: z.enum(CONTRACT_TERMINATION_KINDS),
+    receivedAtIso: z.string().min(1),
+    locale: z.enum(CONSENT_LOCALES),
+});
 export const CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE = "contract-termination-unmatched";
 export const CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT = "contract-termination-unmatched";
 export const CONTRACT_TERMINATION_UNMATCHED_EVENT_QN = `${BILLING_FOUNDATION_FEATURE}:event:${CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT}`;

package/dist/billing-foundation/handlers/create-checkout-session.write.js

@@ -44,7 +44,7 @@ const createCheckoutSessionSchema = z.object({
 export function createCheckoutSessionHandler(options) {
     const consumerProtection = options.consumerProtection;
     const schema = consumerProtection
-        ? createCheckoutSessionSchema.extend({ consent: consentPayloadSchema })
+        ? createCheckoutSessionSchema.extend({ consent: consentPayloadSchema.optional() })
         : createCheckoutSessionSchema;
     return {
         name: "create-checkout-session",
@@ -57,7 +57,7 @@ export function createCheckoutSessionHandler(options) {
             // @cast-boundary engine-payload — dispatcher-zod-validated payload
             const payload = event.payload;
             const mode = payload.mode ?? "subscription";
-            const consent = consumerProtection && payload.consent
+            const consent = consumerProtection
                 ? await prepareConsent(ctx, consumerProtection, payload.consent, mode)
                 : undefined;
             const result = await openCheckout(ctx, { baseUrl: options.baseUrl, catalog: options.catalog, now: options.now }, {

package/dist/billing-foundation/handlers/start-plan-checkout.write.js

@@ -14,7 +14,9 @@ export function createStartPlanCheckoutHandler(options, catalog) {
     }
     const consumerProtection = options.consumerProtection;
     const tierSchema = z.object({ tier: z.enum(plans) });
-    const schema = (consumerProtection ? tierSchema.extend({ consent: consentPayloadSchema }) : tierSchema).strict();
+    const schema = (consumerProtection
+        ? tierSchema.extend({ consent: consentPayloadSchema.optional() })
+        : tierSchema).strict();
     return {
         name: "start-plan-checkout",
         description: "Starts a hosted checkout for a plan tier when the tenant has no active subscription; the server picks price and redirect URLs.",
@@ -34,7 +36,7 @@ export function createStartPlanCheckoutHandler(options, catalog) {
                     message: `subscription-foundation: no live price resolved for tier "${payload.tier}"`,
                 });
             }
-            const consent = consumerProtection && payload.consent
+            const consent = consumerProtection
                 ? await prepareConsent(ctx, consumerProtection, payload.consent, "subscription")
                 : undefined;
             const baseUrl = options.baseUrl ?? "";

package/dist/billing-foundation/i18n.js

@@ -119,6 +119,9 @@ export const BILLING_FOUNDATION_I18N = {
     "billing-foundation.errors.priceUnavailable": {
         en: "This plan's price is temporarily unavailable.",
     },
+    "billing-foundation.errors.consentRequired": {
+        en: "Confirm both consent boxes before you continue.",
+    },
     "billing-foundation.errors.consentTextOutdated": {
         en: "The consent text has changed. Reload the page and confirm again.",
     },

package/dist/billing-foundation/tenant-destroy-hook.js

@@ -20,7 +20,7 @@ export const PAYMENT_TENANT_DESTROY_ARCHIVE_REASON = "tenant-destroy looks up th
 export async function subscriptionTenantDestroyHook(ctx) {
     declareEscapeHatch({ reason: SUBSCRIPTION_TENANT_DESTROY_ARCHIVE_REASON });
     const { profile } = await resolveProfileForTenant({
-        db: ctx.db.unsafeRaw(SUBSCRIPTION_TENANT_DESTROY_ARCHIVE_REASON),
+        db: ctx.db.unsafeRaw(),
         tenantId: ctx.tenantId,
     });
     const aggregateId = subscriptionAggregateId(ctx.tenantId);
@@ -30,7 +30,7 @@ export async function subscriptionTenantDestroyHook(ctx) {
     else {
         await ctx.db.deleteMany(subscriptionsProjectionTable, { id: aggregateId });
     }
-    await archiveStream(ctx.db.unsafeRaw(SUBSCRIPTION_TENANT_DESTROY_ARCHIVE_REASON), {
+    await archiveStream(ctx.db.unsafeRaw(), {
         tenantId: ctx.tenantId,
         aggregateId,
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
@@ -46,7 +46,7 @@ export async function subscriptionTenantDestroyHook(ctx) {
 export async function paymentTenantDestroyHook(ctx) {
     declareEscapeHatch({ reason: PAYMENT_TENANT_DESTROY_ARCHIVE_REASON });
     const { profile } = await resolveProfileForTenant({
-        db: ctx.db.unsafeRaw(PAYMENT_TENANT_DESTROY_ARCHIVE_REASON),
+        db: ctx.db.unsafeRaw(),
         tenantId: ctx.tenantId,
     });
     const aggregateId = paymentAggregateId(ctx.tenantId);
@@ -58,7 +58,7 @@ export async function paymentTenantDestroyHook(ctx) {
             tenantId: ctx.tenantId,
         });
     }
-    await archiveStream(ctx.db.unsafeRaw(PAYMENT_TENANT_DESTROY_ARCHIVE_REASON), {
+    await archiveStream(ctx.db.unsafeRaw(), {
         tenantId: ctx.tenantId,
         aggregateId,
         aggregateType: PAYMENT_AGGREGATE_TYPE,