@cosmicdrift/kumiko-bundled-features 0.339.0 → 0.341.0

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -28,6 +28,8 @@ import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } fr
 import { findForbiddenMembershipRole, reservedMembershipRoleError, } from "../../tenant/membership-roles.js";
 // kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
 import { seedTenantMembership } from "../../tenant/seeding.js";
+// kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
+import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import existence-check
 import { userTable } from "../../user/schema/user.js";
 import { invalidInviteToken } from "../errors.js";
@@ -70,6 +72,7 @@ export function createInviteSignupCompleteHandler() {
                 const invitationTenantId = invitation.tenantId;
                 const invitationEmail = await decryptStoredPii(invitation.email, "email", "auth:invite-signup-complete");
                 const invitationRole = invitation.role;
+                const invitationGlobalRoles = parseInvitedGlobalRoles(invitation.globalRoles);
                 const invitationVersion = invitation.version;
                 // User-Not-Exists-Check: wenn die Email schon registriert ist,
                 // muss der User Branch 2 (acceptWithLogin) nutzen. Hier ist
@@ -93,6 +96,7 @@ export function createInviteSignupCompleteHandler() {
                     password: event.payload.password,
                     displayName: invitationEmail.split("@")[0] ?? invitationEmail,
                     emailVerified: true,
+                    ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
                 });
                 // Membership-Add via seed-helper (gleiches Pattern wie
                 // provisionSignupAccount — bypassed addMember access-check
@@ -121,7 +125,7 @@ export function createInviteSignupCompleteHandler() {
                     tenantId: invitationTenantId,
                     // buildSessionRoles calls stripForbiddenMembershipRoles internally —
                     // a reserved role on the invitation itself must never reach the session.
-                    roles: buildSessionRoles([], [invitationRole]),
+                    roles: buildSessionRoles(invitationGlobalRoles, [invitationRole]),
                 };
                 committed = true;
                 return {

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -54,6 +54,7 @@ export function createSignupRequestHandler(opts) {
         schema: SignupRequestSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
         description: "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
         escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },
         handler: async (event, ctx) => {

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -27,6 +27,7 @@ export function createTokenRequestHandler(spec, opts) {
         schema: RequestTokenSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
         escapeHatch: {
             reason: "Anonymous requester has no session — looks up the target user by email via " +
                 "ctx.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",

package/dist/auth-email-password/index.d.ts

@@ -1,5 +1,7 @@
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
 export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
+export type { BootstrapConfigValue, BootstrapDeps, BootstrapInvite, BootstrapInviteOutcome, BootstrapPlan, BootstrapReport, BootstrapSeedDeps, BootstrapSystemAdmin, BootstrapTenant, BootstrapTenantOutcome, } from "./bootstrap.js";
+export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
 export type { AuthMailContent, AuthMailLocale, AuthMailSection, RenderInviteEmailArgs, RenderTokenContentArgs, } from "./email-templates.js";
 export { renderActivationEmail, renderInviteEmail, renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, } from "./email-templates.js";

package/dist/auth-email-password/index.js

@@ -6,6 +6,7 @@
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
 export { DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
+export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
 export { renderActivationEmail, renderInviteEmail, renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, } from "./email-templates.js";
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";

package/dist/auth-email-password/invite-token-store.d.ts

@@ -28,3 +28,6 @@ export declare function deleteInviteToken(redis: Redis, args: {
 /** Burn release for failed-accept paths (DB error etc.) so a legitimate
  *  retry isn't blocked by a stale burn marker. */
 export declare const unburnInviteToken: (redis: Redis, token: string) => Promise<void>;
+/** Whether the invitation still has an unexpired, unconsumed token — Redis TTL
+ *  is the single truth for invite expiry (see the module comment). */
+export declare function hasLiveInviteToken(redis: Redis, invitationId: string): Promise<boolean>;

package/dist/auth-email-password/invite-token-store.js

@@ -58,3 +58,8 @@ export async function deleteInviteToken(redis, args) {
 /** Burn release for failed-accept paths (DB error etc.) so a legitimate
  *  retry isn't blocked by a stale burn marker. */
 export const unburnInviteToken = store.unburn;
+/** Whether the invitation still has an unexpired, unconsumed token — Redis TTL
+ *  is the single truth for invite expiry (see the module comment). */
+export async function hasLiveInviteToken(redis, invitationId) {
+    return (await store.getTokenHashForSubject(redis, invitationId)) !== null;
+}

package/dist/auth-email-password/magic-link-mail.js

@@ -44,6 +44,7 @@ export async function dispatchMagicLinkMail(notify, spec, params) {
     await notify(spec.notificationType, {
         route: { email: params.email },
         data: content,
+        locale,
         priority: "critical",
     });
 }

package/dist/auth-mfa/config.d.ts

@@ -2,4 +2,4 @@ import { type ConfigKeyHandle } from "@cosmicdrift/kumiko-framework/engine";
 export declare const MFA_REQUIRED_POLICIES: readonly ["optional", "admins", "all"];
 export type MfaRequiredPolicy = (typeof MFA_REQUIRED_POLICIES)[number];
 export declare const mfaRequiredConfigHandle: ConfigKeyHandle<"select">;
-export declare function mfaRequiredConfigKey(): import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"select">;
+export declare function mfaRequiredConfigKey(defaultPolicy?: MfaRequiredPolicy): import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"select">;

package/dist/auth-mfa/config.js

@@ -8,15 +8,20 @@
 // UI). Flipping this away from "optional" before PR3 locks out every
 // unenrolled matching user with no recovery path. Fine for a tenant that
 // enrolls its admins out-of-band first; a footgun otherwise.
-import { createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+import { access, createTenantConfig, } from "@cosmicdrift/kumiko-framework/engine";
 export const MFA_REQUIRED_POLICIES = ["optional", "admins", "all"];
 export const mfaRequiredConfigHandle = {
     name: "auth-mfa:config:required",
     type: "select",
 };
-export function mfaRequiredConfigKey() {
+// Write access is machine-only: a TenantAdmin must not be able to relax the
+// policy back to "optional". The app-wide default comes from
+// `createAuthMfaFeature({ requiredPolicy })`, per-tenant overrides are set by
+// system writes (runBootstrap `tenants[].config`, jobs, SystemAdmin tooling).
+export function mfaRequiredConfigKey(defaultPolicy = "optional") {
     return createTenantConfig("select", {
-        default: "optional",
+        default: defaultPolicy,
         options: [...MFA_REQUIRED_POLICIES],
+        write: access.system,
     });
 }

package/dist/auth-mfa/feature.d.ts

@@ -1,10 +1,12 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type MfaRequiredPolicy } from "./config.js";
 import { type MfaCodeVerifier } from "./mfa-code-verifier.js";
 import { type MfaStatusChecker } from "./mfa-status-checker.js";
 export type AuthMfaFeatureOptions = {
     readonly setupTokenSecret: string;
     readonly issuer: string;
     readonly challengeTokenSecret: string;
+    readonly requiredPolicy?: MfaRequiredPolicy;
 };
 export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => void;
 export declare function bindMfaRevokeAllOtherSessionsFromFeature(feature: FeatureDefinition): BindMfaRevokeAllOtherSessions | undefined;

package/dist/auth-mfa/feature.js

@@ -87,7 +87,7 @@ export function createAuthMfaFeature(opts) {
         // the app boots clean and the first MFA login dies at runtime on an
         // unknown handler instead of failing at mount time.
         r.requires("tenant");
-        r.config("required", mfaRequiredConfigKey());
+        r.config("required", mfaRequiredConfigKey(opts.requiredPolicy));
         // Declarative secretMint screen — mint (no input) -> reveal QR/secret/
         // recovery-codes -> confirm with a code. App places it via r.nav in its
         // logged-in settings area (see personal-access-tokens/feature.ts for the
@@ -154,6 +154,7 @@ export function createAuthMfaFeature(opts) {
         // at app-boot time.
         const checkMfaStatus = createMfaStatusChecker({
             challengeTokenSecret: opts.challengeTokenSecret,
+            ...(opts.requiredPolicy && { requiredPolicy: opts.requiredPolicy }),
         });
         // No late-bind needed — same reasoning as checkMfaStatus: only needs the
         // HandlerContext the caller already has.

package/dist/auth-mfa/mfa-status-checker.d.ts

@@ -1,4 +1,5 @@
 import { type HandlerContext, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type MfaRequiredPolicy } from "./config.js";
 export type MfaStatusCheckResult = {
     readonly required: false;
 } | {
@@ -11,4 +12,5 @@ export type MfaStatusCheckResult = {
 export type MfaStatusChecker = (ctx: HandlerContext, userId: string, tenantId: TenantId, roles: readonly string[]) => Promise<MfaStatusCheckResult>;
 export declare function createMfaStatusChecker(opts: {
     readonly challengeTokenSecret: string;
+    readonly requiredPolicy?: MfaRequiredPolicy;
 }): MfaStatusChecker;

package/dist/auth-mfa/mfa-status-checker.js

@@ -26,7 +26,7 @@ export function createMfaStatusChecker(opts) {
         // user's tenant needs.
         // @cast-boundary engine-payload — "select" config values are validated
         // against the declared `options` at write-time by the config feature.
-        const policy = ((await ctx.configResolver?.get(mfaRequiredConfigHandle.name, mfaRequiredConfigKey(), tenantId, userId, scopedDb)) ?? "optional");
+        const policy = ((await ctx.configResolver?.get(mfaRequiredConfigHandle.name, mfaRequiredConfigKey(opts.requiredPolicy), tenantId, userId, scopedDb)) ?? "optional");
         if (policy === "optional")
             return { required: false };
         const buildSetupToken = () => signMfaPreauthSetupToken({ userId, tenantId }, MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES, opts.challengeTokenSecret).token;

package/dist/billing-foundation/consumer-protection/issue-confirmation.js

@@ -138,6 +138,7 @@ export function createIssueContractConfirmationHandler(options, consumerProtecti
             await ctx.notify(CONTRACT_CONFIRMATION_NOTIFICATION_TYPE, {
                 route: { email: recipient.data.email },
                 data: content,
+                locale,
                 priority: "critical",
             });
             return {

package/dist/billing-foundation/consumer-protection/termination-mail.js

@@ -41,6 +41,7 @@ export function renderTerminationReceipt(args) {
         subject,
         header: subject,
         sections: [
+            { text: texts.receiptGreeting },
             { text: texts.receiptIntro },
             { text: `${texts.receivedAt}: ${formatReceivedAt(args.receivedAtIso, args.locale)}` },
             { text: `${texts.requestId}: ${args.requestId}` },

package/dist/billing-foundation/consumer-protection/termination-notify.js

@@ -16,6 +16,7 @@ export async function notifyOperator(ctx, consumerProtection, plan) {
             ...plan,
             operatorEmail: consumerProtection.operatorEmail,
         }),
+        locale: plan.locale,
         priority: "critical",
     });
 }

package/dist/billing-foundation/consumer-protection/termination-pages.d.ts

@@ -1,8 +1,15 @@
 import type { AnonymousExtraRoute } from "@cosmicdrift/kumiko-framework/api";
+import { type PublicPageWrapLayout } from "../../page-render/index.js";
 import type { ConsentLocale } from "./consent-text.js";
 export type ContractTerminationRoutesOptions = {
     readonly paths?: Readonly<Partial<Record<ConsentLocale, string>>>;
+    /** Layout around every page (form, review, result, 429, error). Default:
+     *  the minimal `wrapInLayout` skeleton. The page headers (CSP with
+     *  `script-src 'none'`, framing, no-store) stay with the framework, so the
+     *  layout must work without JavaScript and only returns the HTML string. */
+    readonly wrapLayout?: PublicPageWrapLayout;
 };
 /** GET + POST pages for de (`/legal/kuendigen`) and en (`/legal/cancel`);
- *  mount via the app's `extraRoutes`. */
+ *  mount via the app's `extraRoutes`. The other trailing-slash form of each
+ *  path 301-redirects (GET/HEAD) to the configured path. */
 export declare function createContractTerminationRoutes(options?: ContractTerminationRoutesOptions): AnonymousExtraRoute[];

package/dist/billing-foundation/consumer-protection/termination-pages.js

@@ -2,12 +2,13 @@
 // no JavaScript. Every echoed value goes through escapeHtml/escapeHtmlAttr.
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { getCookie } from "hono/cookie";
-import { securePageHeaders, wrapInLayout } from "../../page-render/index.js";
+import { redirectToCanonicalPath, securePageHeaders, slashVariantOf, wrapInLayout, } from "../../page-render/index.js";
 import { SubscriptionFoundationHandlers } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS } from "../events.js";
 import { formatReceivedAt } from "./termination-mail.js";
 import { requestContractTerminationSchema } from "./termination-request.js";
 import { TERMINATION_TEXTS } from "./termination-texts.js";
+const PAGE_SLUG = "contract-termination";
 const DEFAULT_PATHS = {
     de: "/legal/kuendigen",
     en: "/legal/cancel",
@@ -42,11 +43,15 @@ function pageHeaders() {
         "x-frame-options": "DENY",
     };
 }
-function htmlResponse(locale, title, bodyHtml, status) {
-    return new Response(wrapInLayout({ title, bodyHtml, lang: locale }), {
-        status,
-        headers: pageHeaders(),
-    });
+function htmlResponse(ctx, title, bodyHtml, status) {
+    const root = `<div data-kumiko-page="${PAGE_SLUG}">\n${bodyHtml}\n</div>`;
+    return new Response(ctx.wrapLayout({
+        title,
+        bodyHtml: root,
+        lang: ctx.locale,
+        slug: PAGE_SLUG,
+        alternates: ctx.alternates,
+    }), { status, headers: pageHeaders() });
 }
 function isOneOf(options, value) {
     return options.includes(value);
@@ -109,30 +114,32 @@ function radioGroup(name, options, labels, selected) {
         .join("");
 }
 function textField(name, label, value, attributes) {
-    return `<p><label>${escapeHtml(label)}<br><input type="${escapeHtmlAttr(attributes.type ?? "text")}" name="${name}" value="${escapeHtmlAttr(value)}" maxlength="${attributes.maxlength}"${attributes.required ? " required" : ""}></label></p>`;
+    return `<p data-kumiko-field-group="${name}"><label>${escapeHtml(label)}<br><input type="${escapeHtmlAttr(attributes.type ?? "text")}" name="${name}" value="${escapeHtmlAttr(value)}" maxlength="${attributes.maxlength}"${attributes.required ? " required" : ""}></label></p>`;
 }
-function formPage(locale, path, values, messages, status) {
+function formPage(ctx, values, messages, status) {
+    const { locale, path } = ctx;
     const texts = TERMINATION_TEXTS[locale];
     const { page } = texts;
     const body = `<h1>${escapeHtml(page.title)}</h1>
 <p>${escapeHtml(page.lead)}</p>
 ${errorsHtml(messages, page)}
-<form method="post" action="${escapeHtmlAttr(path)}">
+<form method="post" action="${escapeHtmlAttr(path)}" data-kumiko-form="contract-termination">
 <input type="hidden" name="step" value="review">
-<fieldset><legend>${escapeHtml(page.declarationTypeHeading)}</legend>${radioGroup("declarationType", CONTRACT_TERMINATION_DECLARATION_TYPES, texts.declarationTypeLabel, values.declarationType)}</fieldset>
-<fieldset><legend>${escapeHtml(page.kindHeading)}</legend>${radioGroup("terminationKind", CONTRACT_TERMINATION_KINDS, texts.terminationKindLabel, values.terminationKind)}<p>${escapeHtml(page.earliestDate)}</p></fieldset>
+<fieldset data-kumiko-field-group="declarationType"><legend>${escapeHtml(page.declarationTypeHeading)}</legend>${radioGroup("declarationType", CONTRACT_TERMINATION_DECLARATION_TYPES, texts.declarationTypeLabel, values.declarationType)}</fieldset>
+<fieldset data-kumiko-field-group="terminationKind"><legend>${escapeHtml(page.kindHeading)}</legend>${radioGroup("terminationKind", CONTRACT_TERMINATION_KINDS, texts.terminationKindLabel, values.terminationKind)}<p>${escapeHtml(page.earliestDate)}</p></fieldset>
 ${textField("name", page.nameLabel, values.name, { required: true, maxlength: 200 })}
 ${textField("email", page.emailLabel, values.email, { type: "email", required: true, maxlength: 254 })}
 ${textField("customerReference", page.customerReferenceLabel, values.customerReference, { maxlength: 200 })}
-<p><label>${escapeHtml(page.reasonLabel)} (${escapeHtml(page.reasonHint)})<br><textarea name="reason" rows="5" maxlength="2000">${escapeHtml(values.reason)}</textarea></label></p>
-<p><button type="submit">${escapeHtml(page.reviewButton)}</button></p>
+<p data-kumiko-field-group="reason"><label>${escapeHtml(page.reasonLabel)} (${escapeHtml(page.reasonHint)})<br><textarea name="reason" rows="5" maxlength="2000">${escapeHtml(values.reason)}</textarea></label></p>
+<p><button type="submit" data-kumiko-button="review">${escapeHtml(page.reviewButton)}</button></p>
 </form>`;
-    return htmlResponse(locale, page.title, body, status);
+    return htmlResponse(ctx, page.title, body, status);
 }
 function hiddenInputs(values) {
     return FORM_FIELDS.map((field) => `<input type="hidden" name="${field}" value="${escapeHtmlAttr(values[field])}">`).join("\n");
 }
-function reviewPage(locale, path, values) {
+function reviewPage(ctx, values) {
+    const { locale, path } = ctx;
     const texts = TERMINATION_TEXTS[locale];
     const { page } = texts;
     // validationMessages already proved the enum values.
@@ -147,7 +154,7 @@ function reviewPage(locale, path, values) {
         : `<tr><th scope="row">${escapeHtml(label)}</th><td>${escapeHtml(value)}</td></tr>`;
     const body = `<h1>${escapeHtml(page.reviewTitle)}</h1>
 <p>${escapeHtml(page.reviewLead)}</p>
-<table>
+<table data-kumiko-review-table>
 ${row(texts.declarationType, texts.declarationTypeLabel[declarationType])}
 ${row(texts.terminationKind, texts.terminationKindLabel[terminationKind])}
 ${row(texts.name, values.name)}
@@ -155,21 +162,22 @@ ${row(texts.email, values.email)}
 ${row(texts.customerReference, values.customerReference)}
 ${row(texts.reasonFieldLabel, values.reason)}
 </table>
-<form method="post" action="${escapeHtmlAttr(path)}">
+<form method="post" action="${escapeHtmlAttr(path)}" data-kumiko-form="contract-termination-review">
 ${hiddenInputs(values)}
-<button type="submit" name="step" value="confirm">${escapeHtml(page.confirmButton[declarationType])}</button>
-<button type="submit" name="step" value="edit">${escapeHtml(page.backButton)}</button>
+<button type="submit" name="step" value="confirm" data-kumiko-button="confirm">${escapeHtml(page.confirmButton[declarationType])}</button>
+<button type="submit" name="step" value="edit" data-kumiko-button="back">${escapeHtml(page.backButton)}</button>
 </form>`;
-    return htmlResponse(locale, page.reviewTitle, body, 200);
+    return htmlResponse(ctx, page.reviewTitle, body, 200);
 }
-function resultPage(locale, receivedAtIso, requestId) {
+function resultPage(ctx, receivedAtIso, requestId) {
+    const { locale } = ctx;
     const { page } = TERMINATION_TEXTS[locale];
     const body = `<h1>${escapeHtml(page.resultTitle)}</h1>
 <p>${escapeHtml(page.resultLead)}</p>
 <p>${escapeHtml(page.resultReceivedAt)}: <strong>${escapeHtml(formatReceivedAt(receivedAtIso, locale))}</strong></p>
 <p>${escapeHtml(page.resultRequestId)}: <code>${escapeHtml(requestId)}</code></p>
 <p>${escapeHtml(page.resultMailNote)}</p>`;
-    return htmlResponse(locale, page.resultTitle, body, 200);
+    return htmlResponse(ctx, page.resultTitle, body, 200);
 }
 const RATE_LIMITED_CODE = "rate_limited";
 const TENANT_HEADER = "x-tenant";
@@ -227,14 +235,27 @@ async function submitDeclaration(c, app, clientIp, values, locale) {
     }
     return { kind: "failed" };
 }
-function routesFor(locale, path) {
+function routesFor(ctx) {
+    const { locale, path } = ctx;
+    const slashVariant = slashVariantOf(path);
     return [
         {
             method: "GET",
             path,
             entry: "anonymous",
-            handler: () => formPage(locale, path, EMPTY_FORM, [], 200),
+            handler: () => formPage(ctx, EMPTY_FORM, [], 200),
         },
+        // GET also serves HEAD; POST gets no alias (a redirect would drop the body).
+        ...(slashVariant === null
+            ? []
+            : [
+                {
+                    method: "GET",
+                    path: slashVariant,
+                    entry: "anonymous",
+                    handler: (c) => redirectToCanonicalPath(c.req.url, path),
+                },
+            ]),
         {
             method: "POST",
             path,
@@ -242,27 +263,33 @@ function routesFor(locale, path) {
             handler: async (c, deps) => {
                 const { step, values } = await readForm(c);
                 if (step === "edit")
-                    return formPage(locale, path, values, [], 200);
+                    return formPage(ctx, values, [], 200);
                 const messages = validationMessages(values, locale);
                 if (messages.length > 0)
-                    return formPage(locale, path, values, messages, 400);
+                    return formPage(ctx, values, messages, 400);
                 if (step !== "confirm")
-                    return reviewPage(locale, path, values);
+                    return reviewPage(ctx, values);
                 const outcome = await submitDeclaration(c, deps.app, deps.clientIp, values, locale);
                 const { page } = TERMINATION_TEXTS[locale];
                 if (outcome.kind === "received") {
-                    return resultPage(locale, outcome.receivedAtIso, outcome.requestId);
+                    return resultPage(ctx, outcome.receivedAtIso, outcome.requestId);
                 }
                 if (outcome.kind === "rate-limited") {
-                    return htmlResponse(locale, page.rateLimitedTitle, `<h1>${escapeHtml(page.rateLimitedTitle)}</h1><p>${escapeHtml(page.rateLimitedBody)}</p>`, 429);
+                    return htmlResponse(ctx, page.rateLimitedTitle, `<h1>${escapeHtml(page.rateLimitedTitle)}</h1><p>${escapeHtml(page.rateLimitedBody)}</p>`, 429);
                 }
-                return formPage(locale, path, values, [page.errorGeneric], 400);
+                return formPage(ctx, values, [page.errorGeneric], 400);
             },
         },
     ];
 }
 /** GET + POST pages for de (`/legal/kuendigen`) and en (`/legal/cancel`);
- *  mount via the app's `extraRoutes`. */
+ *  mount via the app's `extraRoutes`. The other trailing-slash form of each
+ *  path 301-redirects (GET/HEAD) to the configured path. */
 export function createContractTerminationRoutes(options = {}) {
-    return ["de", "en"].flatMap((locale) => routesFor(locale, options.paths?.[locale] ?? DEFAULT_PATHS[locale]));
+    const alternates = {
+        de: options.paths?.de ?? DEFAULT_PATHS.de,
+        en: options.paths?.en ?? DEFAULT_PATHS.en,
+    };
+    const wrapLayout = options.wrapLayout ?? wrapInLayout;
+    return ["de", "en"].flatMap((locale) => routesFor({ locale, path: alternates[locale], wrapLayout, alternates }));
 }

package/dist/billing-foundation/consumer-protection/termination-request.js

@@ -62,6 +62,7 @@ async function sendTerminationMails(ctx, consumerProtection, plan) {
             declaration: plan.declaration,
             operatorEmail: consumerProtection.operatorEmail,
         }),
+        locale: plan.locale,
         priority: "critical",
     });
     // skip: no operator notice needed for this declaration
@@ -104,6 +105,7 @@ export function createRequestContractTerminationHandler(options, consumerProtect
         schema: requestContractTerminationSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 5, windowSeconds: 600 },
+        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
         ...(consumerProtection.terminationScope === "platform" && { tenantlessAnonymous: true }),
         escapeHatch: {
             reason: "Anonymous declarant has no session — finds the contract by email via ctx.queryAs(system, user:find-for-auth) and tenant:memberships; the tenant written to comes only from those lookups.",

package/dist/billing-foundation/consumer-protection/termination-texts.d.ts

@@ -12,6 +12,7 @@ export type TerminationTexts = {
     readonly customerReference: string;
     readonly reasonFieldLabel: string;
     readonly receiptSubject: Readonly<Record<ContractTerminationDeclarationType, string>>;
+    readonly receiptGreeting: string;
     readonly receiptIntro: string;
     readonly receiptNextSteps: string;
     readonly receiptRevoke: (operatorEmail: string) => string;

package/dist/billing-foundation/consumer-protection/termination-texts.js

@@ -27,6 +27,7 @@ export const TERMINATION_TEXTS = {
             termination: "Eingangsbestätigung deiner Kündigung",
             withdrawal: "Eingangsbestätigung deines Widerrufs",
         },
+        receiptGreeting: "Hallo,",
         receiptIntro: "wir bestätigen den Eingang deiner Erklärung mit folgendem Inhalt. Diese E-Mail ist eine Eingangsbestätigung, keine Bestätigung der Wirksamkeit.",
         receiptNextSteps: "Wir prüfen deine Erklärung und melden uns, sobald sie bearbeitet ist oder wir Rückfragen haben.",
         receiptRevoke: (operatorEmail) => `Hast du diese Erklärung nicht abgegeben oder möchtest du sie zurücknehmen? Schreib uns bitte umgehend an ${operatorEmail}.`,
@@ -105,7 +106,8 @@ export const TERMINATION_TEXTS = {
             termination: "Receipt for your termination",
             withdrawal: "Receipt for your withdrawal",
         },
-        receiptIntro: "we confirm receipt of your declaration with the following content. This email is a receipt, not a confirmation that the declaration is effective.",
+        receiptGreeting: "Hello,",
+        receiptIntro: "We confirm receipt of your declaration with the following content. This email is a receipt, not a confirmation that the declaration is effective.",
         receiptNextSteps: "We will review your declaration and get back to you once it is processed or if we have questions.",
         receiptRevoke: (operatorEmail) => `If you did not make this declaration or want to take it back, please write to ${operatorEmail} right away.`,
         contact: "Questions go to",

package/dist/billing-foundation/projection.js

@@ -13,11 +13,10 @@
 // foundation production mounten müssen die Tabelle in ihre eigene
 // `drizzle/generate.ts` ergänzen (= via subscriptionsProjectionTable-
 // import). setupTestStack pusht sie automatisch via r.projection.table.
+import { insertOnConflictDoNothing, requireEntityTableMeta, upsertOnConflict, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { defineApply } from "@cosmicdrift/kumiko-framework/engine";
 import { paymentRowId } from "./aggregate-id.js";
-import { insertPaymentProjectionRow } from "./db/queries/payment-projection.js";
-import { upsertSubscriptionProjectionRow } from "./db/queries/subscription-projection.js";
 import { paymentEntity, subscriptionEntity } from "./entities.js";
 // Drizzle-table-instance aus dem entity-shape. Wird sowohl von der
 // projection-apply als auch von list-query / get-helper genutzt damit
@@ -27,6 +26,10 @@ export const subscriptionsProjectionTable = buildEntityTable("subscription", sub
 // raw drizzle-pgTable, not an r.entity — apps mounting billing-foundation in
 // production must add read_payments to their own drizzle/generate.ts too.
 export const paymentsProjectionTable = buildEntityTable("payment", paymentEntity);
+// Unbranded metas: the apply functions below ARE the executor of these
+// projections, so they may write through the typed helpers.
+const subscriptionsProjectionMeta = requireEntityTableMeta(subscriptionsProjectionTable, "subscription");
+const paymentsProjectionMeta = requireEntityTableMeta(paymentsProjectionTable, "payment");
 // =============================================================================
 // Shared helpers
 // =============================================================================
@@ -59,9 +62,7 @@ function cancelAtSetFromPayload(p) {
  *  on every apply including the initial create — a projection rebuild at a
  *  different wall-clock time must materialize the exact same row, and
  *  `getSubscriptionForTenant`'s `lastChangedAt` (staleness check for
- *  incomplete subscriptions) depends on that determinism. Raw `.unsafe()`
- *  bypasses the typed query-builder's Temporal.Instant-to-string coercion,
- *  hence the explicit `.toString()`. */
+ *  incomplete subscriptions) depends on that determinism. */
 async function upsert(tx, event, set, fullPayload) {
     // INSERT-fallback braucht ALL fields (NOT NULL constraints). Wenn
     // jemand nur teil-felder updated (z.B. invoice-payment-failed nur
@@ -69,38 +70,21 @@ async function upsert(tx, event, set, fullPayload) {
     // INSERT-Pfad und nur den teil-`set` für ON CONFLICT.
     const insertCols = {
         id: event.aggregateId,
-        tenant_id: event.tenantId,
-        provider_name: fullPayload.providerName,
-        provider_customer_id: fullPayload.providerCustomerId,
-        provider_subscription_id: fullPayload.providerSubscriptionId,
+        tenantId: event.tenantId,
+        providerName: fullPayload.providerName,
+        providerCustomerId: fullPayload.providerCustomerId,
+        providerSubscriptionId: fullPayload.providerSubscriptionId,
         status: fullPayload.status,
         tier: fullPayload.tier,
-        current_period_end: fullPayload.currentPeriodEndIso,
-        cancel_at: fullPayload.cancelAtIso ?? null,
-        modified_at: event.createdAt.toString(),
+        currentPeriodEnd: fullPayload.currentPeriodEndIso,
+        cancelAt: fullPayload.cancelAtIso ?? null,
+        modifiedAt: event.createdAt,
     };
-    // Map camelCase set-keys to snake_case DB columns.
-    const setMap = {
-        providerName: "provider_name",
-        providerCustomerId: "provider_customer_id",
-        providerSubscriptionId: "provider_subscription_id",
-        status: "status",
-        tier: "tier",
-        currentPeriodEnd: "current_period_end",
-        cancelAt: "cancel_at",
-    };
-    const insertParams = Object.values(insertCols);
-    const setEntries = Object.entries(set).filter(([, v]) => v !== undefined);
-    // modified_at is already bound as the last insertParams placeholder —
-    // reused (not re-pushed) for the ON CONFLICT SET clause below.
-    const setClauses = [`"modified_at" = $${insertParams.length}`];
-    const allParams = [...insertParams];
-    for (const [k, v] of setEntries) {
-        allParams.push(v);
-        setClauses.push(`"${setMap[k]}" = $${allParams.length}`);
-    }
-    const tableName = subscriptionsProjectionTable.tableName;
-    await upsertSubscriptionProjectionRow(tx, tableName, insertCols, setClauses, allParams);
+    const definedSet = Object.fromEntries(Object.entries(set).filter(([, v]) => v !== undefined));
+    await upsertOnConflict(tx, subscriptionsProjectionMeta, insertCols, {
+        conflictKeys: ["id"],
+        update: { modifiedAt: event.createdAt, ...definedSet },
+    });
 }
 // =============================================================================
 // Apply-functions — eine pro event-typ
@@ -164,17 +148,16 @@ export const applyInvoicePaymentFailed = defineApply(async (event, tx) => {
  *  the second tenant's row. ON CONFLICT DO NOTHING also makes a projection
  *  rebuild idempotent without mutating an existing row. */
 export const applyPaymentReceived = defineApply(async (event, tx) => {
-    const tableName = paymentsProjectionTable.tableName;
     const providerEventId = event.metadata.headers?.["providerEventId"];
     const providerName = event.metadata.headers?.["providerName"];
     if (typeof providerEventId !== "string" || typeof providerName !== "string") {
         throw new Error("applyPaymentReceived: event.metadata.headers is missing providerEventId/providerName — process-payment-event.write.ts always sets both");
     }
-    await insertPaymentProjectionRow(tx, tableName, {
+    await insertOnConflictDoNothing(tx, paymentsProjectionMeta, {
         id: paymentRowId(event.tenantId, providerName, providerEventId),
-        tenant_id: event.tenantId,
-        provider_name: event.payload.providerName,
-        provider_customer_id: event.payload.providerCustomerId,
-        price_id: event.payload.priceId,
+        tenantId: event.tenantId,
+        providerName: event.payload.providerName,
+        providerCustomerId: event.payload.providerCustomerId,
+        priceId: event.payload.priceId,
     });
 });

package/dist/channel-discord/discord-channel.d.ts

@@ -1,5 +1,9 @@
 import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.js";
 export type DiscordChannelOptions = ChatWebhookChannelOptions;
+export declare const DISCORD_SECRET_KEYS: {
+    readonly webhookPrefix: "channel-discord:webhooks.";
+    readonly webhookKeyFor: (connection: string) => string;
+};
 export declare const DISCORD_DEFAULT_ALLOWED_HOSTS: readonly ["discord.com", "discordapp.com"];
 export declare const DISCORD_WEBHOOK_PATH_PREFIX = "/api/webhooks/";
 export declare const DISCORD_CONTENT_MAX_CHARS = 2000;

package/dist/channel-discord/discord-channel.js

@@ -1,4 +1,8 @@
 import { chatMessageText, createChatWebhookChannel, truncateChars, } from "../delivery/index.js";
+export const DISCORD_SECRET_KEYS = {
+    webhookPrefix: "channel-discord:webhooks.",
+    webhookKeyFor: (connection) => `channel-discord:webhooks.${connection}`,
+};
 export const DISCORD_DEFAULT_ALLOWED_HOSTS = ["discord.com", "discordapp.com"];
 export const DISCORD_WEBHOOK_PATH_PREFIX = "/api/webhooks/";
 export const DISCORD_CONTENT_MAX_CHARS = 2000;