@cosmicdrift/kumiko-bundled-features 0.338.0 → 0.340.0

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -75,7 +75,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 return invalidInviteToken();
             let committed = false;
             try {
-                const invitation = await fetchOne(ctx.db.unsafeRaw("reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant"), tenantInvitationsTable, { id: invitationId });
+                const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, { id: invitationId });
                 if (!invitation || invitation.status !== INVITATION_STATUS.pending)
                     return invalidInviteToken();
                 const invitationTenantId = invitation.tenantId;
@@ -111,7 +111,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 if (!statusGate.ok)
                     return statusGate.result;
                 const userId = userRow.id;
-                const dbConn = ctx.db.unsafeRaw("adds the membership and accepts the invitation in the invitation's tenant, which differs from the caller's tenant");
+                const dbConn = ctx.db.unsafeRaw();
                 const grant = await grantInvitedMembershipRole(dbConn, {
                     userId,
                     tenantId: invitationTenantId,

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -33,8 +33,6 @@ const InviteAcceptSchema = z.object({
 });
 const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 const INVITE_ACCEPT_ESCAPE_HATCH_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant. Adds the membership and accepts the invitation in the invitation's tenant, which differs from the caller's tenant.";
-const READ_PENDING_INVITATION_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant";
-const ADD_MEMBERSHIP_INVITATION_TENANT_REASON = "adds the membership and accepts the invitation in the invitation's tenant, which differs from the caller's tenant";
 export function createInviteAcceptHandler() {
     return defineWriteHandler({
         name: "invite-accept",
@@ -67,7 +65,7 @@ export function createInviteAcceptHandler() {
                 return invalidInviteToken();
             let committed = false;
             try {
-                const invitation = await fetchOne(ctx.db.unsafeRaw(READ_PENDING_INVITATION_REASON), tenantInvitationsTable, { id: invitationId });
+                const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, { id: invitationId });
                 if (!invitation || invitation.status !== INVITATION_STATUS.pending)
                     return invalidInviteToken();
                 const invitationTenantId = invitation.tenantId;
@@ -88,7 +86,7 @@ export function createInviteAcceptHandler() {
                 }
                 // Executor instead of dispatcher.writeAs(addMember): addMember only
                 // accepts SystemAdmin, createSystemUser carries "system".
-                const dbConn = ctx.db.unsafeRaw(ADD_MEMBERSHIP_INVITATION_TENANT_REASON);
+                const dbConn = ctx.db.unsafeRaw();
                 const grant = await grantInvitedMembershipRole(dbConn, {
                     userId: event.user.id,
                     tenantId: invitationTenantId,

package/dist/auth-email-password/handlers/invite-info.query.js

@@ -45,7 +45,9 @@ export const inviteInfoQuery = defineQueryHandler({
         const invitationId = await getInvitationIdForToken(ctx.redis, query.payload.token);
         if (!invitationId)
             throwInvalidInviteToken();
-        const invitation = await fetchOne(ctx.db.unsafeRaw(READ_PENDING_INVITATION_REASON), tenantInvitationsTable, { id: invitationId });
+        const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, {
+            id: invitationId,
+        });
         if (!invitation || invitation.status !== INVITATION_STATUS.pending) {
             throwInvalidInviteToken();
         }

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -41,8 +41,6 @@ const InviteSignupCompleteSchema = z.object({
 });
 const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 const INVITE_SIGNUP_COMPLETE_ESCAPE_HATCH_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant. Creates the user and adds the membership and accepts the invitation in the invitation's tenant, before any caller tenant context exists.";
-const READ_PENDING_INVITATION_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant";
-const CREATE_USER_AND_MEMBERSHIP_INVITATION_TENANT_REASON = "creates the user and adds the membership and accepts the invitation in the invitation's tenant, before any caller tenant context exists";
 export function createInviteSignupCompleteHandler() {
     return defineWriteHandler({
         name: "invite-signup-complete",
@@ -66,7 +64,7 @@ export function createInviteSignupCompleteHandler() {
                 return invalidInviteToken();
             let committed = false;
             try {
-                const invitation = await fetchOne(ctx.db.unsafeRaw(READ_PENDING_INVITATION_REASON), tenantInvitationsTable, { id: invitationId });
+                const invitation = await fetchOne(ctx.db.unsafeRaw(), tenantInvitationsTable, { id: invitationId });
                 if (!invitation || invitation.status !== INVITATION_STATUS.pending)
                     return invalidInviteToken();
                 const invitationTenantId = invitation.tenantId;
@@ -89,7 +87,7 @@ export function createInviteSignupCompleteHandler() {
                 // signup-confirm), emailVerified=true wegen Magic-Link.
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
-                const dbConn = ctx.db.unsafeRaw(CREATE_USER_AND_MEMBERSHIP_INVITATION_TENANT_REASON);
+                const dbConn = ctx.db.unsafeRaw();
                 const { id: userId } = await seedUserWithPassword(dbConn, {
                     email: invitationEmail,
                     password: event.payload.password,

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -104,7 +104,7 @@ export function createSignupConfirmHandler() {
                 // Fallback bei Kollision (siehe generateUniqueName).
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
-                const dbConn = ctx.db.unsafeRaw(SIGNUP_CONFIRM_PROVISION_REASON);
+                const dbConn = ctx.db.unsafeRaw();
                 const tenantKey = await generateUniqueName({
                     isAvailable: async (slug) => {
                         const existing = await fetchOne(dbConn, tenantTable, { key: slug });

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -123,7 +123,7 @@ export function createSignupRequestHandler(opts) {
                 else {
                     try {
                         const verified = await provider.verifyGrant({
-                            db: ctx.db.unsafeRaw(HANDOVER_GRANT_VERIFY_REASON),
+                            db: ctx.db.unsafeRaw(),
                             registry: ctx.registry,
                             entityType,
                             token: grantToken,

package/dist/auth-email-password/web/auth-gate.d.ts

@@ -23,9 +23,19 @@ export type LoginRouteOptions = {
     readonly onAuthenticated?: () => void;
 };
 export declare function createLoginRoute(opts?: LoginRouteOptions): ComponentType<Record<string, never>>;
-export declare function makeAuthGate(opts?: LoginRouteOptions): ComponentType<{
+export type AuthGateOptions = LoginRouteOptions & {
+    /** Login page outside the SPA (root-relative path or http(s) URL). Unauthenticated
+     *  visitors are sent there with `next=<current path>`; the built-in login screen
+     *  is not rendered. */
+    readonly loginUrl?: string;
+};
+export type SessionAuthGateOptions = AuthGateOptions & {
+    /** Where logout navigates to (root-relative path or http(s) URL). Without it, logout reloads the page. */
+    readonly postLogoutUrl?: string;
+};
+export declare function makeAuthGate(opts?: AuthGateOptions): ComponentType<{
     children: ReactNode;
 }>;
-export declare function makeSessionAuthGate(opts?: LoginRouteOptions): ComponentType<{
+export declare function makeSessionAuthGate(opts?: SessionAuthGateOptions): ComponentType<{
     children: ReactNode;
 }>;

package/dist/auth-email-password/web/auth-gate.js

@@ -10,6 +10,7 @@ import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 // (nur `{ children }`-Prop). Der Sample kann so einen eigenen Login-
 // Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
 import { useEffect, useState } from "react";
+import { assertNavigableUrl, buildLoginRedirectUrl } from "./auth-redirect.js";
 import { LoginScreen } from "./login-screen.js";
 import { SessionProvider, useSession } from "./session.js";
 import { SessionBootstrapErrorScreen } from "./session-bootstrap-error.js";
@@ -77,12 +78,32 @@ export function createLoginRoute(opts = {}) {
     }
     return LoginRoute;
 }
+function redirectToLoginUrl(loginUrl) {
+    const { origin, pathname, search, hash } = window.location;
+    // Compared before `next` is appended: the target always differs from the current
+    // URL once it carries next, so a gate mounted on the login page itself would loop.
+    const loginLocation = new URL(loginUrl, origin);
+    if (loginLocation.origin === origin && loginLocation.pathname === pathname)
+        return;
+    window.location.replace(buildLoginRedirectUrl(loginUrl, `${pathname}${search}${hash}`, origin));
+}
 export function makeAuthGate(opts = {}) {
+    const { loginUrl } = opts;
+    if (loginUrl !== undefined)
+        assertNavigableUrl(loginUrl, "loginUrl");
     const LoginRoute = createLoginRoute(opts);
     function AuthGate({ children }) {
         const { status } = useSession();
+        const redirectsToLoginUrl = loginUrl !== undefined && status === "unauthenticated";
+        // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+        useEffect(() => {
+            if (redirectsToLoginUrl)
+                redirectToLoginUrl(loginUrl);
+        }, [redirectsToLoginUrl]);
         if (status === "authenticated")
             return _jsx(_Fragment, { children: children });
+        if (redirectsToLoginUrl)
+            return null;
         return _jsx(LoginRoute, {});
     }
     return AuthGate;
@@ -91,9 +112,12 @@ export function makeAuthGate(opts = {}) {
 // /calculator) doesn't mount the session bootstrap — createKumikoApp stacks
 // providers outside all gates, so SessionProvider can't be a provider anymore.
 export function makeSessionAuthGate(opts = {}) {
+    const { postLogoutUrl } = opts;
+    if (postLogoutUrl !== undefined)
+        assertNavigableUrl(postLogoutUrl, "postLogoutUrl");
     const AuthGate = makeAuthGate(opts);
     function SessionAuthGate({ children }) {
-        return (_jsx(SessionProvider, { children: _jsx(AuthGate, { children: children }) }));
+        return (_jsx(SessionProvider, { postLogoutUrl: postLogoutUrl, children: _jsx(AuthGate, { children: children }) }));
     }
     return SessionAuthGate;
 }

package/dist/auth-email-password/web/auth-redirect.d.ts

@@ -0,0 +1,5 @@
+export declare const NEXT_QUERY_PARAM = "next";
+export declare function isSafeNextPath(candidate: unknown): candidate is string;
+export declare function readNextFromSearch(search: string): string | null;
+export declare function assertNavigableUrl(url: string, optionName: string): void;
+export declare function buildLoginRedirectUrl(loginUrl: string, returnPath: string, currentOrigin: string): string;

package/dist/auth-email-password/web/auth-redirect.js

@@ -0,0 +1,58 @@
+// @runtime client
+// Redirect targets for external login pages. `next` travels through the query
+// string, so anything read back from it is untrusted: only same-origin
+// root-relative paths pass (no "//host", no "/\host", no scheme).
+export const NEXT_QUERY_PARAM = "next";
+function hasControlOrWhitespace(candidate) {
+    for (let i = 0; i < candidate.length; i++) {
+        const code = candidate.charCodeAt(i);
+        if (code <= 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+// The URL parse is a backstop: browsers strip tabs/newlines, so "/\t/evil.com"
+// would otherwise normalize to "//evil.com" past the leading-slash check.
+export function isSafeNextPath(candidate) {
+    if (typeof candidate !== "string" || !candidate.startsWith("/"))
+        return false;
+    if (candidate[1] === "/" || candidate.includes("\\"))
+        return false;
+    if (hasControlOrWhitespace(candidate))
+        return false;
+    try {
+        const parsed = new URL(candidate, "https://next.invalid");
+        return parsed.origin === "https://next.invalid" && !parsed.pathname.startsWith("//");
+    }
+    catch {
+        return false;
+    }
+}
+export function readNextFromSearch(search) {
+    const candidate = new URLSearchParams(search).get(NEXT_QUERY_PARAM);
+    return isSafeNextPath(candidate) ? candidate : null;
+}
+// loginUrl/postLogoutUrl come from app code (trusted), but a typo like
+// "javascript:" must fail at startup instead of becoming a navigation target.
+export function assertNavigableUrl(url, optionName) {
+    // skip: a safe root-relative path needs no protocol check
+    if (url.startsWith("/") && isSafeNextPath(url))
+        return;
+    let protocol;
+    try {
+        protocol = new URL(url).protocol;
+    }
+    catch {
+        throw new Error(`${optionName} must be a root-relative path or an http(s) URL, got "${url}"`);
+    }
+    if (protocol !== "http:" && protocol !== "https:") {
+        throw new Error(`${optionName} must be a root-relative path or an http(s) URL, got "${url}"`);
+    }
+}
+export function buildLoginRedirectUrl(loginUrl, returnPath, currentOrigin) {
+    const target = new URL(loginUrl, currentOrigin);
+    if (isSafeNextPath(returnPath))
+        target.searchParams.set(NEXT_QUERY_PARAM, returnPath);
+    const isSameOrigin = target.origin === currentOrigin;
+    return isSameOrigin ? `${target.pathname}${target.search}${target.hash}` : target.href;
+}

package/dist/auth-email-password/web/client-plugin.d.ts

@@ -1,6 +1,6 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ComponentType, ReactNode } from "react";
-import { type MfaSetupComponentProps, type MfaVerifyComponentProps } from "./auth-gate.js";
+import { type AuthGateOptions, type MfaSetupComponentProps, type MfaVerifyComponentProps } from "./auth-gate.js";
 import type { LoginScreenProps } from "./login-screen.js";
 export type EmailPasswordClientOptions = {
     /** Eigener Login-Screen. Default: der shadcn-stylte LoginScreen
@@ -19,6 +19,13 @@ export type EmailPasswordClientOptions = {
      *  as mfaVerifyScreen above. Apps not mounting auth-mfa simply don't
      *  pass this. */
     readonly mfaSetupScreen?: ComponentType<MfaSetupComponentProps>;
+    /** Login page outside the SPA (root-relative path or http(s) URL). Unauthenticated
+     *  visitors are redirected there with `next=<current path>` instead of seeing the
+     *  built-in login screen. Read `next` back with readNextFromSearch (same-origin
+     *  paths only). */
+    readonly loginUrl?: AuthGateOptions["loginUrl"];
+    /** Where logout navigates to (root-relative path or http(s) URL). Default: reload. */
+    readonly postLogoutUrl?: string;
     /** Key-Overrides pro Locale. Wird mit den Default-Bundles (de/en)
      *  aus `translations.ts` gemerged — jeder hier gesetzte Key gewinnt.
      *  Für Branding ("Sign in" → "Login to Acme") oder weitere Sprachen

package/dist/auth-email-password/web/client-plugin.js

@@ -17,6 +17,8 @@ export function emailPasswordClient(options = {}) {
                 loginScreenProps: options.loginScreenProps,
                 mfaVerifyScreen: options.mfaVerifyScreen,
                 mfaSetupScreen: options.mfaSetupScreen,
+                loginUrl: options.loginUrl,
+                postLogoutUrl: options.postLogoutUrl,
             }),
         ],
         translations,

package/dist/auth-email-password/web/index.d.ts

@@ -3,8 +3,9 @@ export type { AuthTokenFailure, CurrentUserProfile, LoginFailure, LoginRequest,
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export type { AuthCardProps, AuthShellRenderer } from "./auth-form-primitives.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
-export type { LoginRouteOptions, MfaSetupComponentProps, MfaVerifyComponentProps, } from "./auth-gate.js";
+export type { AuthGateOptions, LoginRouteOptions, MfaSetupComponentProps, MfaVerifyComponentProps, SessionAuthGateOptions, } from "./auth-gate.js";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";
+export { buildLoginRedirectUrl, isSafeNextPath, NEXT_QUERY_PARAM, readNextFromSearch, } from "./auth-redirect.js";
 export type { EmailPasswordClientFeature, EmailPasswordClientOptions, } from "./client-plugin.js";
 export { emailPasswordClient } from "./client-plugin.js";
 export type { ConfirmAccountUnlockScreenProps } from "./confirm-account-unlock-screen.js";

package/dist/auth-email-password/web/index.js

@@ -8,6 +8,7 @@ export { defaultTranslations, mergeTranslations } from "../i18n.js";
 export { AuthRequestError, confirmAccountUnlock, confirmSignup, requestAccountUnlock, requestEmailVerification, requestPasswordReset, requestSignup, resetPassword, toLoginResponse, verifyEmail, } from "./auth-client.js";
 export { AuthCard, AuthShellProvider, useAuthShell } from "./auth-form-primitives.js";
 export { createLoginRoute, makeAuthGate, makeSessionAuthGate } from "./auth-gate.js";
+export { buildLoginRedirectUrl, isSafeNextPath, NEXT_QUERY_PARAM, readNextFromSearch, } from "./auth-redirect.js";
 export { emailPasswordClient } from "./client-plugin.js";
 export { ConfirmAccountUnlockScreen } from "./confirm-account-unlock-screen.js";
 export { DefaultTopbarActions } from "./default-topbar-actions.js";

package/dist/auth-email-password/web/session.d.ts

@@ -40,7 +40,9 @@ export declare function computeActiveRoles(user: CurrentUserProfile | null, acti
  *  Code nutzt SessionProvider + useSession; direkter Context-Zugriff ist
  *  für Tests/Stories. */
 export declare const SessionContext: import("react").Context<SessionApi | undefined>;
-export declare function SessionProvider({ children }: {
+export declare function SessionProvider({ children, postLogoutUrl, }: {
     readonly children: ReactNode;
+    /** Logout navigates here instead of reloading. Validated by makeSessionAuthGate. */
+    readonly postLogoutUrl?: string;
 }): ReactNode;
 export declare function useSession(): SessionApi;

package/dist/auth-email-password/web/session.js

@@ -92,7 +92,7 @@ function toBootstrapFailure(err) {
     }
     return { httpStatus: null, retryAfterSeconds: null, failedAtEpochMs: Date.now() };
 }
-export function SessionProvider({ children }) {
+export function SessionProvider({ children, postLogoutUrl, }) {
     const [state, setState] = useState(INITIAL);
     // Never rejects, so bootstrap can't strand the UI on "loading" forever.
     const doRefresh = useCallback(async () => {
@@ -128,6 +128,12 @@ export function SessionProvider({ children }) {
     }, [doRefresh]);
     const logout = useCallback(async () => {
         await logoutApi();
+        if (postLogoutUrl !== undefined && typeof window !== "undefined") {
+            // State stays untouched: flipping to unauthenticated would let an AuthGate
+            // with loginUrl race this navigation to its own redirect.
+            window.location.assign(postLogoutUrl);
+            return;
+        }
         setState(UNAUTHENTICATED);
         // Hard-Reload: React-Tree, dispatcher-live-Caches, EventSource —
         // alles fliegt auf Null. Nach Logout ist das der billigste Weg zu
@@ -136,7 +142,7 @@ export function SessionProvider({ children }) {
         if (typeof window !== "undefined") {
             window.location.reload();
         }
-    }, []);
+    }, [postLogoutUrl]);
     const switchTenant = useCallback(async (tenantId) => {
         await switchTenantApi(tenantId);
         // Tenant-Wechsel rotiert JWT + Cookies. React-Tree enthält

package/dist/auth-mfa/feature.js

@@ -105,7 +105,7 @@ export function createAuthMfaFeature(opts) {
             escapeHatch: {
                 reason: REENCRYPT_ESCAPE_HATCH_REASON,
             },
-            handler: (payload, ctx) => mfaReencryptJob(payload, ctx, ctx.db.unsafeRaw(REENCRYPT_ESCAPE_HATCH_REASON)),
+            handler: (payload, ctx) => mfaReencryptJob(payload, ctx, ctx.db.unsafeRaw()),
         });
         r.entity("user-mfa", userMfaEntity);
         // Late-bound by run-prod-app once the sessions feature (if mounted) has

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.js

@@ -91,7 +91,7 @@ export function createEnableConfirmPreauthHandler(opts) {
                 return invalidSetupToken();
             // "system" mode: no session exists yet, tenantId comes from the
             // verified token, mirroring enable-start-preauth.write.ts.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw("reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant"), tenantId, "system");
+            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const existing = await findUserMfaRow(scopedDb, scopedUser);
             if (existing)

package/dist/auth-mfa/handlers/enable-start-preauth.write.js

@@ -44,7 +44,7 @@ export function createEnableStartPreauthHandler(opts) {
             // "system" mode: the guest dispatch identity's own tenantId is
             // meaningless here — the preauthSetupToken is the source of truth
             // for which tenant's row to read, mirroring verify.write.ts.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw(ENABLE_START_PREAUTH_TENANT_REASON), tenantId, "system");
+            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const existing = await findUserMfaRow(scopedDb, scopedUser);
             if (existing)

package/dist/auth-mfa/handlers/verify.write.js

@@ -68,7 +68,7 @@ export function createMfaVerifyHandler(opts) {
             // "system" mode: this handler runs with a guest identity whose own
             // tenantId is meaningless here — the challenge token is the source
             // of truth for which tenant's row to read.
-            const scopedDb = createTenantDb(ctx.db.unsafeRaw("reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant"), tenantId, "system");
+            const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
             const scopedUser = { id: userId, tenantId, roles: ["User"] };
             const row = await findUserMfaRow(scopedDb, scopedUser);
             // MFA got disabled between login and verify (race, or a stale

package/dist/auth-mfa/mfa-code-verifier.js

@@ -14,7 +14,7 @@ export function createMfaCodeVerifier() {
         declareEscapeHatch({
             reason: "reads the MFA enrollment of the user being re-authenticated on the caller's handler context; the calling handler declares its own escapeHatch",
         });
-        const scopedDb = createTenantDb(ctx.db.unsafeRaw("reads the MFA enrollment of the user being re-authenticated"), tenantId, "system");
+        const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
         const row = await findUserMfaRow(scopedDb, { id: userId, tenantId, roles: [] });
         if (!row)
             return { enrolled: false, ok: false };

package/dist/auth-mfa/mfa-status-checker.js

@@ -10,7 +10,7 @@ export function createMfaStatusChecker(opts) {
         declareEscapeHatch({
             reason: "reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant, on the caller's handler context; the calling handler declares its own escapeHatch",
         });
-        const scopedDb = createTenantDb(ctx.db.unsafeRaw("reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant"), tenantId, "system");
+        const scopedDb = createTenantDb(ctx.db.unsafeRaw(), tenantId, "system");
         const scopedUser = { id: userId, tenantId, roles: ["User"] };
         const row = await findUserMfaRow(scopedDb, scopedUser);
         if (row) {

package/dist/billing-foundation/constants.d.ts

@@ -35,6 +35,10 @@ export declare const SubscriptionFoundationHandlers: {
      *  subscription stream and asks the provider to cancel (consumerProtection
      *  only). */
     readonly recordContractTermination: "billing-foundation:write:record-contract-termination";
+    /** System-only: records that a public declaration reached a tenant's
+     *  subscription stream; the event triggers the provider cancel job
+     *  (consumerProtection only). */
+    readonly declareContractTermination: "billing-foundation:write:declare-contract-termination";
     /** System-only: records a public declaration no single tenant could be
      *  matched to, on a system-tenant stream (consumerProtection only). */
     readonly recordUnmatchedContractTermination: "billing-foundation:write:record-unmatched-contract-termination";
@@ -128,3 +132,6 @@ export declare function isSubscriptionBlockingCheckout(sub: {
 export declare const SWITCHABLE_SUBSCRIPTION_STATUSES: ReadonlySet<string>;
 export declare function isSwitchableSubscriptionStatus(status: string): boolean;
 export declare const DEFAULT_PURCHASE_ROLES: readonly ["TenantAdmin", "SystemAdmin"];
+export declare const TERMINATION_SCOPES: readonly ["tenant-host", "platform"];
+export type TerminationScope = (typeof TERMINATION_SCOPES)[number];
+export declare function isTerminationScope(value: unknown): value is TerminationScope;

package/dist/billing-foundation/constants.js

@@ -46,6 +46,10 @@ export const SubscriptionFoundationHandlers = {
      *  subscription stream and asks the provider to cancel (consumerProtection
      *  only). */
     recordContractTermination: "billing-foundation:write:record-contract-termination",
+    /** System-only: records that a public declaration reached a tenant's
+     *  subscription stream; the event triggers the provider cancel job
+     *  (consumerProtection only). */
+    declareContractTermination: "billing-foundation:write:declare-contract-termination",
     /** System-only: records a public declaration no single tenant could be
      *  matched to, on a system-tenant stream (consumerProtection only). */
     recordUnmatchedContractTermination: "billing-foundation:write:record-unmatched-contract-termination",
@@ -198,3 +202,7 @@ export const DEFAULT_PURCHASE_ROLES = ["TenantAdmin", "SystemAdmin"];
 // Stripe-priceIds vs PayPal-plan-ids vs Apple-product-ids
 // unterschiedliche IDs sind. Jeder Plugin definiert seinen eigenen
 // `<plugin-name>:config:price-to-tier`-Key.
+export const TERMINATION_SCOPES = ["tenant-host", "platform"];
+export function isTerminationScope(value) {
+    return TERMINATION_SCOPES.includes(value);
+}

package/dist/billing-foundation/consumer-protection/confirmation-mail.js

@@ -3,17 +3,17 @@ import { CONSENT_TEXTS, resolveConsentLocale } from "./consent-text.js";
 const LABELS = {
     de: {
         subject: "Vertragsbestätigung",
-        intro: "vielen Dank für Ihre Bestellung. Hiermit bestätigen wir den Vertragsschluss mit folgendem Inhalt.",
+        intro: "vielen Dank für deine Bestellung. Hiermit bestätigen wir den Vertragsschluss mit folgendem Inhalt.",
         plan: "Tarif",
         oneOffPayment: "Einmalzahlung",
         price: "Preis",
         oneOff: "einmalig",
         contractStart: "Vertragsbeginn",
         currentPeriodEnd: "Aktueller Abrechnungszeitraum bis",
-        consentHeading: "Ihre Zustimmungen",
+        consentHeading: "Deine Zustimmungen",
         consentGivenAt: "Erteilt am",
         termsHeading: "Allgemeine Geschäftsbedingungen",
-        contact: "Fragen zu Ihrem Vertrag richten Sie bitte an",
+        contact: "Fragen zu deinem Vertrag richtest du bitte an",
         every: "alle",
         intervals: {
             day: { one: "Tag", many: "Tage" },

package/dist/billing-foundation/consumer-protection/consent-gate.d.ts

@@ -3,8 +3,8 @@ import * as z from "zod";
 import type { ConsumerProtectionOptions, ProviderPrice } from "../types.js";
 export type CheckoutMode = "subscription" | "payment";
 export declare const consentPayloadSchema: z.ZodObject<{
-    earlyPerformanceRequested: z.ZodLiteral<true>;
-    withdrawalLossAcknowledged: z.ZodLiteral<true>;
+    earlyPerformanceRequested: z.ZodBoolean;
+    withdrawalLossAcknowledged: z.ZodBoolean;
     consentTextVersion: z.ZodString;
     locale: z.ZodString;
 }, z.core.$strict>;
@@ -23,7 +23,7 @@ export type ConsentPriceDetails = {
     readonly priceId: string;
     readonly price: Pick<ProviderPrice, "unitAmount" | "currency" | "interval" | "intervalCount"> | null;
 };
-export declare function prepareConsent(ctx: HandlerContext, options: ConsumerProtectionOptions, consent: ConsentPayload, mode: CheckoutMode): Promise<PreparedConsent>;
+export declare function prepareConsent(ctx: HandlerContext, options: ConsumerProtectionOptions, consent: ConsentPayload | undefined, mode: CheckoutMode): Promise<PreparedConsent>;
 export declare function consentCheckoutFields(prepared: PreparedConsent): {
     readonly consentId: string;
     readonly locale: string;

package/dist/billing-foundation/consumer-protection/consent-gate.js

@@ -8,15 +8,23 @@ import { requireTemplateResolver, TEXT_BLOCK_KIND, TemplateNotFoundError, } from
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
 import { CHECKOUT_CONSENT_RECORDED_EVENT_QN, PAYMENT_AGGREGATE_TYPE, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
 import { consentTextVersion, resolveConsentLocale, submitMessageFor } from "./consent-text.js";
+// Optional at the schema level so a missing/unchecked consent reaches
+// prepareConsent and fails as 422 consent_required, not as a zod 400.
 export const consentPayloadSchema = z
     .object({
-    earlyPerformanceRequested: z.literal(true),
-    withdrawalLossAcknowledged: z.literal(true),
+    earlyPerformanceRequested: z.boolean(),
+    withdrawalLossAcknowledged: z.boolean(),
     consentTextVersion: z.string().min(1).max(64),
     locale: z.string().min(2).max(35),
 })
     .strict();
 export async function prepareConsent(ctx, options, consent, mode) {
+    if (!consent?.earlyPerformanceRequested || !consent.withdrawalLossAcknowledged) {
+        throw new UnprocessableError("consent_required", {
+            i18nKey: "billing-foundation.errors.consentRequired",
+            message: "billing-foundation: both consent flags must be true to start a checkout",
+        });
+    }
     const locale = resolveConsentLocale(consent.locale);
     if (consent.consentTextVersion !== consentTextVersion(locale)) {
         throw new UnprocessableError("consent_text_outdated", {

package/dist/billing-foundation/consumer-protection/consent-text.js

@@ -4,8 +4,8 @@ export const CONSENT_TEXTS = {
     de: {
         earlyPerformance: "Ich verlange ausdrücklich, dass der Anbieter vor Ablauf der Widerrufsfrist mit der Ausführung des Vertrags beginnt.",
         withdrawalLoss: "Ich nehme zur Kenntnis, dass ich mein Widerrufsrecht verliere, sobald der Vertrag von dem Anbieter vollständig erfüllt ist, bei digitalen Inhalten sobald die Ausführung begonnen hat, nachdem ich ausdrücklich zugestimmt habe und bestätigt habe, dass ich dadurch mein Widerrufsrecht verliere.",
-        subscriptionSubmitMessage: "Kostenpflichtiges Abonnement: Es verlängert sich zum Ende jedes Abrechnungszeitraums automatisch, bis Sie es kündigen. Sie können jederzeit zum Ende des laufenden Zeitraums kündigen.",
-        paymentSubmitMessage: "Kostenpflichtige Einmalzahlung: Mit Klick auf den Button verpflichten Sie sich zur Zahlung.",
+        subscriptionSubmitMessage: "Kostenpflichtiges Abonnement: Es verlängert sich zum Ende jedes Abrechnungszeitraums automatisch, bis du es kündigst. Du kannst jederzeit zum Ende des laufenden Zeitraums kündigen.",
+        paymentSubmitMessage: "Kostenpflichtige Einmalzahlung: Mit Klick auf den Button verpflichtest du dich zur Zahlung.",
     },
     en: {
         earlyPerformance: "I expressly request that the provider begins performing the contract before the withdrawal period has expired.",

package/dist/billing-foundation/consumer-protection/register-termination.d.ts

@@ -1,3 +1,3 @@
-import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
 export declare function registerContractTermination(r: FeatureRegistrar, options: ResolvedBillingFoundationOptions, consumerProtection: ConsumerProtectionOptions): void;

package/dist/billing-foundation/consumer-protection/register-termination.js

@@ -1,12 +1,40 @@
-import { CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT, CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT, contractTerminationRequestedPayloadSchema, contractTerminationUnmatchedPayloadSchema, } from "../events.js";
-import { createRecordContractTerminationHandler, createRecordUnmatchedContractTerminationHandler, createTerminableSubscriptionQuery, } from "./termination-record.js";
+import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
+import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../constants.js";
+import { CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_DECLARED_EVENT_SHORT, CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT, CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT, contractTerminationDeclaredPayloadSchema, contractTerminationRequestedPayloadSchema, contractTerminationUnmatchedPayloadSchema, } from "../events.js";
+import { createDeclareContractTerminationHandler, createRecordContractTerminationHandler, createRecordUnmatchedContractTerminationHandler, createTerminableSubscriptionQuery, } from "./termination-record.js";
 import { createRequestContractTerminationHandler, createTerminateContractHandler, } from "./termination-request.js";
 export function registerContractTermination(r, options, consumerProtection) {
     r.defineEvent(CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT, contractTerminationRequestedPayloadSchema, { piiFields: "none" });
+    r.defineEvent(CONTRACT_TERMINATION_DECLARED_EVENT_SHORT, contractTerminationDeclaredPayloadSchema, { piiFields: "none" });
     r.defineEvent(CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT, contractTerminationUnmatchedPayloadSchema, { piiFields: "none" });
     r.queryHandler(createTerminableSubscriptionQuery());
-    r.writeHandler(createRecordContractTerminationHandler(options));
+    r.writeHandler(createDeclareContractTerminationHandler());
+    r.writeHandler(createRecordContractTerminationHandler(options, consumerProtection));
     r.writeHandler(createRecordUnmatchedContractTerminationHandler());
     r.writeHandler(createRequestContractTerminationHandler(options, consumerProtection));
     r.writeHandler(createTerminateContractHandler(options, consumerProtection));
+    // The provider cancel of a public declaration runs here, not in the
+    // request: matched and unmatched requests then do the same work and the
+    // response time does not tell whether the email belongs to a customer.
+    // The tenant comes from the stored trigger event (the job's system user).
+    r.job("cancel-on-public-termination-declared", { trigger: { on: CONTRACT_TERMINATION_DECLARED_EVENT_QN }, runIn: "worker" }, async (payload, ctx) => {
+        const declared = contractTerminationDeclaredPayloadSchema.safeParse(payload);
+        // skip: trigger event carries no usable declaration
+        if (!declared.success)
+            return;
+        const result = await ctx.writeAs(createSystemUser(ctx.systemUser.tenantId), SubscriptionFoundationHandlers.recordContractTermination, {
+            requestId: declared.data.requestId,
+            declarationType: declared.data.declarationType,
+            terminationKind: declared.data.terminationKind,
+            channel: "public",
+            when: declared.data.declarationType === "withdrawal"
+                ? "none"
+                : SubscriptionCancelTimings.periodEnd,
+            receivedAtIso: declared.data.receivedAtIso,
+            locale: declared.data.locale,
+        });
+        if (!result.isSuccess) {
+            throw new Error(`billing-foundation:cancel-on-public-termination-declared: record-contract-termination failed: ${JSON.stringify(result.error)}`);
+        }
+    });
 }

package/dist/billing-foundation/consumer-protection/termination-mail.d.ts

@@ -18,6 +18,8 @@ export type TerminationDeclaration = {
     readonly customerReference?: string;
     readonly reason?: string;
 };
+/** The operator notice for a provider problem has no declarant data at all. */
+export type OperatorNoticeDeclaration = Pick<TerminationDeclaration, "declarationType" | "terminationKind"> & Partial<Omit<TerminationDeclaration, "declarationType" | "terminationKind">>;
 export declare function formatReceivedAt(iso: string, locale: ConsentLocale): string;
 export type RenderTerminationReceiptArgs = {
     readonly locale: ConsentLocale;
@@ -34,7 +36,7 @@ export type RenderOperatorNoticeArgs = {
     readonly requestId: string;
     readonly receivedAtIso: string;
     readonly channel: "public" | "account";
-    readonly declaration: TerminationDeclaration;
+    readonly declaration: OperatorNoticeDeclaration;
     readonly reasons: readonly OperatorNoticeReason[];
     readonly tenantId?: string;
     readonly providerCancel?: ProviderCancelOutcome;

package/dist/billing-foundation/consumer-protection/termination-mail.js

@@ -24,7 +24,7 @@ function declarationLines(declaration, locale) {
         `${texts.declarationType}: ${texts.declarationTypeLabel[declaration.declarationType]}`,
         `${texts.terminationKind}: ${texts.terminationKindLabel[declaration.terminationKind]}`,
         ...(declaration.name !== undefined ? [`${texts.name}: ${declaration.name}`] : []),
-        `${texts.email}: ${declaration.email}`,
+        ...(declaration.email !== undefined ? [`${texts.email}: ${declaration.email}`] : []),
         ...(declaration.customerReference
             ? [`${texts.customerReference}: ${declaration.customerReference}`]
             : []),