@cosmicdrift/kumiko-bundled-features 0.340.0 → 0.342.0

package/dist/auth-email-password/web/signup-screen.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // @runtime client
 // SignupScreen — Magic-Link-Self-Signup, Step 1.
 //
@@ -67,5 +67,5 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         }
     };
     const effectiveTitle = title ?? t("auth.signup.title");
-    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.signup.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.signup.successBody") })] }), _jsx(Button, { variant: "secondary", onClick: onResend, disabled: submitting, children: t("auth.signup.resend") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signup.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-email", label: t("auth.signup.email"), required: true, children: _jsx(Input, { kind: "email", id: "signup-email", name: "signup-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signup.submitting") : t("auth.signup.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.signup.haveAccount") })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, subtitle: subtitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.signup.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.signup.successBody") })] }), _jsx(Button, { variant: "secondary", onClick: onResend, disabled: submitting, children: t("auth.signup.resend") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signup.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-email", label: t("auth.signup.email"), required: true, children: _jsx(Input, { kind: "email", id: "signup-email", name: "signup-email", value: email, onChange: setEmail, disabled: submitting, required: true, autoComplete: "email" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signup.submitting") : t("auth.signup.submit") })] }), _jsx(Link, { href: loginHref, variant: "muted", className: "self-center", children: t("auth.signup.haveAccount") })] })) }));
 }

package/dist/auth-email-password/web/verify-email-screen.js

@@ -33,14 +33,14 @@ export function VerifyEmailScreen({ title, token: tokenProp, loginHref = "/login
         })();
     }, [status, token]);
     if (status === "missing-token") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }));
     }
     if (status === "verifying") {
         return (_jsx(AuthCard, { children: _jsx("div", { className: "p-6", children: _jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.verifyEmail.verifying") }) }) }));
     }
     if (status === "success") {
-        return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.successTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.verifyEmail.goToLogin") })] }) }));
+        return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.successTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.successBody") }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.verifyEmail.goToLogin") })] }));
     }
     // status === "error"
-    return (_jsx(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.verifyEmail.errorTitle"), children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.verifyEmail.errorBody") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.verifyEmail.goToLogin") })] }));
 }

package/dist/auth-mfa/config.d.ts

@@ -2,4 +2,4 @@ import { type ConfigKeyHandle } from "@cosmicdrift/kumiko-framework/engine";
 export declare const MFA_REQUIRED_POLICIES: readonly ["optional", "admins", "all"];
 export type MfaRequiredPolicy = (typeof MFA_REQUIRED_POLICIES)[number];
 export declare const mfaRequiredConfigHandle: ConfigKeyHandle<"select">;
-export declare function mfaRequiredConfigKey(): import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"select">;
+export declare function mfaRequiredConfigKey(defaultPolicy?: MfaRequiredPolicy): import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"select">;

package/dist/auth-mfa/config.js

@@ -8,15 +8,20 @@
 // UI). Flipping this away from "optional" before PR3 locks out every
 // unenrolled matching user with no recovery path. Fine for a tenant that
 // enrolls its admins out-of-band first; a footgun otherwise.
-import { createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+import { access, createTenantConfig, } from "@cosmicdrift/kumiko-framework/engine";
 export const MFA_REQUIRED_POLICIES = ["optional", "admins", "all"];
 export const mfaRequiredConfigHandle = {
     name: "auth-mfa:config:required",
     type: "select",
 };
-export function mfaRequiredConfigKey() {
+// Write access is machine-only: a TenantAdmin must not be able to relax the
+// policy back to "optional". The app-wide default comes from
+// `createAuthMfaFeature({ requiredPolicy })`, per-tenant overrides are set by
+// system writes (runBootstrap `tenants[].config`, jobs, SystemAdmin tooling).
+export function mfaRequiredConfigKey(defaultPolicy = "optional") {
     return createTenantConfig("select", {
-        default: "optional",
+        default: defaultPolicy,
         options: [...MFA_REQUIRED_POLICIES],
+        write: access.system,
     });
 }

package/dist/auth-mfa/feature.d.ts

@@ -1,10 +1,12 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type MfaRequiredPolicy } from "./config.js";
 import { type MfaCodeVerifier } from "./mfa-code-verifier.js";
 import { type MfaStatusChecker } from "./mfa-status-checker.js";
 export type AuthMfaFeatureOptions = {
     readonly setupTokenSecret: string;
     readonly issuer: string;
     readonly challengeTokenSecret: string;
+    readonly requiredPolicy?: MfaRequiredPolicy;
 };
 export type BindMfaRevokeAllOtherSessions = (revoker: (userId: string, currentSid: string | undefined) => Promise<number>) => void;
 export declare function bindMfaRevokeAllOtherSessionsFromFeature(feature: FeatureDefinition): BindMfaRevokeAllOtherSessions | undefined;

package/dist/auth-mfa/feature.js

@@ -87,7 +87,7 @@ export function createAuthMfaFeature(opts) {
         // the app boots clean and the first MFA login dies at runtime on an
         // unknown handler instead of failing at mount time.
         r.requires("tenant");
-        r.config("required", mfaRequiredConfigKey());
+        r.config("required", mfaRequiredConfigKey(opts.requiredPolicy));
         // Declarative secretMint screen — mint (no input) -> reveal QR/secret/
         // recovery-codes -> confirm with a code. App places it via r.nav in its
         // logged-in settings area (see personal-access-tokens/feature.ts for the
@@ -154,6 +154,7 @@ export function createAuthMfaFeature(opts) {
         // at app-boot time.
         const checkMfaStatus = createMfaStatusChecker({
             challengeTokenSecret: opts.challengeTokenSecret,
+            ...(opts.requiredPolicy && { requiredPolicy: opts.requiredPolicy }),
         });
         // No late-bind needed — same reasoning as checkMfaStatus: only needs the
         // HandlerContext the caller already has.

package/dist/auth-mfa/mfa-status-checker.d.ts

@@ -1,4 +1,5 @@
 import { type HandlerContext, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type MfaRequiredPolicy } from "./config.js";
 export type MfaStatusCheckResult = {
     readonly required: false;
 } | {
@@ -11,4 +12,5 @@ export type MfaStatusCheckResult = {
 export type MfaStatusChecker = (ctx: HandlerContext, userId: string, tenantId: TenantId, roles: readonly string[]) => Promise<MfaStatusCheckResult>;
 export declare function createMfaStatusChecker(opts: {
     readonly challengeTokenSecret: string;
+    readonly requiredPolicy?: MfaRequiredPolicy;
 }): MfaStatusChecker;

package/dist/auth-mfa/mfa-status-checker.js

@@ -26,7 +26,7 @@ export function createMfaStatusChecker(opts) {
         // user's tenant needs.
         // @cast-boundary engine-payload — "select" config values are validated
         // against the declared `options` at write-time by the config feature.
-        const policy = ((await ctx.configResolver?.get(mfaRequiredConfigHandle.name, mfaRequiredConfigKey(), tenantId, userId, scopedDb)) ?? "optional");
+        const policy = ((await ctx.configResolver?.get(mfaRequiredConfigHandle.name, mfaRequiredConfigKey(opts.requiredPolicy), tenantId, userId, scopedDb)) ?? "optional");
         if (policy === "optional")
             return { required: false };
         const buildSetupToken = () => signMfaPreauthSetupToken({ userId, tenantId }, MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES, opts.challengeTokenSecret).token;

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -127,9 +127,9 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
         e?.preventDefault();
         void confirmSetup();
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: _jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
-                        ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
-                        : t(reasonToKey(error)) })) : null, !setup && (_jsx(Section, { testId: "mfa-setup-preauth-intro", actions: _jsx(Button, { variant: "primary", onClick: () => void startSetup(), loading: busy, disabled: busy, children: t("auth.mfa.setup.start") }), children: _jsx("span", { className: "text-sm text-muted-foreground", children: t("auth.mfa.setup.intro") }) })), setup && (_jsx(Form, { onSubmit: onSubmit, children: _jsxs(Section, { testId: "mfa-setup-preauth-setup", actions: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }), children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") }), _jsx("div", { className: "h-40 w-40", 
-                                        // biome-ignore lint/security/noDangerouslySetInnerHtml: qrcode-generated SVG, no user input
-                                        dangerouslySetInnerHTML: { __html: setup.qrSvg } }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }) }));
+    return (_jsxs(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
+                    ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
+                    : t(reasonToKey(error)) })) : null, !setup && (_jsx(Section, { testId: "mfa-setup-preauth-intro", actions: _jsx(Button, { variant: "primary", onClick: () => void startSetup(), loading: busy, disabled: busy, children: t("auth.mfa.setup.start") }), children: _jsx("span", { className: "text-sm text-muted-foreground", children: t("auth.mfa.setup.intro") }) })), setup && (_jsx(Form, { onSubmit: onSubmit, children: _jsxs(Section, { testId: "mfa-setup-preauth-setup", actions: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }), children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") }), _jsx("div", { className: "h-40 w-40", 
+                                    // biome-ignore lint/security/noDangerouslySetInnerHtml: qrcode-generated SVG, no user input
+                                    dangerouslySetInnerHTML: { __html: setup.qrSvg } }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
 }

package/dist/auth-mfa/web/mfa-verify-screen.js

@@ -52,7 +52,7 @@ export function MfaVerifyScreen({ challengeToken, title, subtitle, submitLabel,
         e?.preventDefault();
         void doSubmit();
     };
-    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsx("div", { className: "p-6 pt-0 flex flex-col gap-4", children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
-                            ? t("auth.mfa.verify.submitting")
-                            : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }) }));
+    return (_jsx(AuthCard, { title: title ?? t("auth.mfa.verify.title"), subtitle: subtitle ?? t("auth.mfa.verify.subtitle"), children: _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "mfa-verify-code", label: t("auth.mfa.verify.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-verify-code", name: "mfa-verify-code", value: code, onChange: setCode, disabled: submitting, required: true, autoComplete: "one-time-code" }) }), error !== null ? _jsx(Banner, { variant: "error", children: t(reasonToKey(error)) }) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
+                        ? t("auth.mfa.verify.submitting")
+                        : (submitLabel ?? t("auth.mfa.verify.submit")) }), onCancel ? (_jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: submitting, children: t("auth.mfa.verify.backToLogin") })) : null] }) }));
 }

package/dist/billing-foundation/consumer-protection/issue-confirmation.js

@@ -138,6 +138,7 @@ export function createIssueContractConfirmationHandler(options, consumerProtecti
             await ctx.notify(CONTRACT_CONFIRMATION_NOTIFICATION_TYPE, {
                 route: { email: recipient.data.email },
                 data: content,
+                locale,
                 priority: "critical",
             });
             return {

package/dist/billing-foundation/consumer-protection/termination-mail.js

@@ -41,6 +41,7 @@ export function renderTerminationReceipt(args) {
         subject,
         header: subject,
         sections: [
+            { text: texts.receiptGreeting },
             { text: texts.receiptIntro },
             { text: `${texts.receivedAt}: ${formatReceivedAt(args.receivedAtIso, args.locale)}` },
             { text: `${texts.requestId}: ${args.requestId}` },

package/dist/billing-foundation/consumer-protection/termination-notify.js

@@ -16,6 +16,7 @@ export async function notifyOperator(ctx, consumerProtection, plan) {
             ...plan,
             operatorEmail: consumerProtection.operatorEmail,
         }),
+        locale: plan.locale,
         priority: "critical",
     });
 }

package/dist/billing-foundation/consumer-protection/termination-pages.d.ts

@@ -1,8 +1,15 @@
 import type { AnonymousExtraRoute } from "@cosmicdrift/kumiko-framework/api";
+import { type PublicPageWrapLayout } from "../../page-render/index.js";
 import type { ConsentLocale } from "./consent-text.js";
 export type ContractTerminationRoutesOptions = {
     readonly paths?: Readonly<Partial<Record<ConsentLocale, string>>>;
+    /** Layout around every page (form, review, result, 429, error). Default:
+     *  the minimal `wrapInLayout` skeleton. The page headers (CSP with
+     *  `script-src 'none'`, framing, no-store) stay with the framework, so the
+     *  layout must work without JavaScript and only returns the HTML string. */
+    readonly wrapLayout?: PublicPageWrapLayout;
 };
 /** GET + POST pages for de (`/legal/kuendigen`) and en (`/legal/cancel`);
- *  mount via the app's `extraRoutes`. */
+ *  mount via the app's `extraRoutes`. The other trailing-slash form of each
+ *  path 301-redirects (GET/HEAD) to the configured path. */
 export declare function createContractTerminationRoutes(options?: ContractTerminationRoutesOptions): AnonymousExtraRoute[];

package/dist/billing-foundation/consumer-protection/termination-pages.js

@@ -2,12 +2,13 @@
 // no JavaScript. Every echoed value goes through escapeHtml/escapeHtmlAttr.
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { getCookie } from "hono/cookie";
-import { securePageHeaders, wrapInLayout } from "../../page-render/index.js";
+import { redirectToCanonicalPath, securePageHeaders, slashVariantOf, wrapInLayout, } from "../../page-render/index.js";
 import { SubscriptionFoundationHandlers } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS } from "../events.js";
 import { formatReceivedAt } from "./termination-mail.js";
 import { requestContractTerminationSchema } from "./termination-request.js";
 import { TERMINATION_TEXTS } from "./termination-texts.js";
+const PAGE_SLUG = "contract-termination";
 const DEFAULT_PATHS = {
     de: "/legal/kuendigen",
     en: "/legal/cancel",
@@ -42,11 +43,15 @@ function pageHeaders() {
         "x-frame-options": "DENY",
     };
 }
-function htmlResponse(locale, title, bodyHtml, status) {
-    return new Response(wrapInLayout({ title, bodyHtml, lang: locale }), {
-        status,
-        headers: pageHeaders(),
-    });
+function htmlResponse(ctx, title, bodyHtml, status) {
+    const root = `<div data-kumiko-page="${PAGE_SLUG}">\n${bodyHtml}\n</div>`;
+    return new Response(ctx.wrapLayout({
+        title,
+        bodyHtml: root,
+        lang: ctx.locale,
+        slug: PAGE_SLUG,
+        alternates: ctx.alternates,
+    }), { status, headers: pageHeaders() });
 }
 function isOneOf(options, value) {
     return options.includes(value);
@@ -109,30 +114,32 @@ function radioGroup(name, options, labels, selected) {
         .join("");
 }
 function textField(name, label, value, attributes) {
-    return `<p><label>${escapeHtml(label)}<br><input type="${escapeHtmlAttr(attributes.type ?? "text")}" name="${name}" value="${escapeHtmlAttr(value)}" maxlength="${attributes.maxlength}"${attributes.required ? " required" : ""}></label></p>`;
+    return `<p data-kumiko-field-group="${name}"><label>${escapeHtml(label)}<br><input type="${escapeHtmlAttr(attributes.type ?? "text")}" name="${name}" value="${escapeHtmlAttr(value)}" maxlength="${attributes.maxlength}"${attributes.required ? " required" : ""}></label></p>`;
 }
-function formPage(locale, path, values, messages, status) {
+function formPage(ctx, values, messages, status) {
+    const { locale, path } = ctx;
     const texts = TERMINATION_TEXTS[locale];
     const { page } = texts;
     const body = `<h1>${escapeHtml(page.title)}</h1>
 <p>${escapeHtml(page.lead)}</p>
 ${errorsHtml(messages, page)}
-<form method="post" action="${escapeHtmlAttr(path)}">
+<form method="post" action="${escapeHtmlAttr(path)}" data-kumiko-form="contract-termination">
 <input type="hidden" name="step" value="review">
-<fieldset><legend>${escapeHtml(page.declarationTypeHeading)}</legend>${radioGroup("declarationType", CONTRACT_TERMINATION_DECLARATION_TYPES, texts.declarationTypeLabel, values.declarationType)}</fieldset>
-<fieldset><legend>${escapeHtml(page.kindHeading)}</legend>${radioGroup("terminationKind", CONTRACT_TERMINATION_KINDS, texts.terminationKindLabel, values.terminationKind)}<p>${escapeHtml(page.earliestDate)}</p></fieldset>
+<fieldset data-kumiko-field-group="declarationType"><legend>${escapeHtml(page.declarationTypeHeading)}</legend>${radioGroup("declarationType", CONTRACT_TERMINATION_DECLARATION_TYPES, texts.declarationTypeLabel, values.declarationType)}</fieldset>
+<fieldset data-kumiko-field-group="terminationKind"><legend>${escapeHtml(page.kindHeading)}</legend>${radioGroup("terminationKind", CONTRACT_TERMINATION_KINDS, texts.terminationKindLabel, values.terminationKind)}<p>${escapeHtml(page.earliestDate)}</p></fieldset>
 ${textField("name", page.nameLabel, values.name, { required: true, maxlength: 200 })}
 ${textField("email", page.emailLabel, values.email, { type: "email", required: true, maxlength: 254 })}
 ${textField("customerReference", page.customerReferenceLabel, values.customerReference, { maxlength: 200 })}
-<p><label>${escapeHtml(page.reasonLabel)} (${escapeHtml(page.reasonHint)})<br><textarea name="reason" rows="5" maxlength="2000">${escapeHtml(values.reason)}</textarea></label></p>
-<p><button type="submit">${escapeHtml(page.reviewButton)}</button></p>
+<p data-kumiko-field-group="reason"><label>${escapeHtml(page.reasonLabel)} (${escapeHtml(page.reasonHint)})<br><textarea name="reason" rows="5" maxlength="2000">${escapeHtml(values.reason)}</textarea></label></p>
+<p><button type="submit" data-kumiko-button="review">${escapeHtml(page.reviewButton)}</button></p>
 </form>`;
-    return htmlResponse(locale, page.title, body, status);
+    return htmlResponse(ctx, page.title, body, status);
 }
 function hiddenInputs(values) {
     return FORM_FIELDS.map((field) => `<input type="hidden" name="${field}" value="${escapeHtmlAttr(values[field])}">`).join("\n");
 }
-function reviewPage(locale, path, values) {
+function reviewPage(ctx, values) {
+    const { locale, path } = ctx;
     const texts = TERMINATION_TEXTS[locale];
     const { page } = texts;
     // validationMessages already proved the enum values.
@@ -147,7 +154,7 @@ function reviewPage(locale, path, values) {
         : `<tr><th scope="row">${escapeHtml(label)}</th><td>${escapeHtml(value)}</td></tr>`;
     const body = `<h1>${escapeHtml(page.reviewTitle)}</h1>
 <p>${escapeHtml(page.reviewLead)}</p>
-<table>
+<table data-kumiko-review-table>
 ${row(texts.declarationType, texts.declarationTypeLabel[declarationType])}
 ${row(texts.terminationKind, texts.terminationKindLabel[terminationKind])}
 ${row(texts.name, values.name)}
@@ -155,21 +162,22 @@ ${row(texts.email, values.email)}
 ${row(texts.customerReference, values.customerReference)}
 ${row(texts.reasonFieldLabel, values.reason)}
 </table>
-<form method="post" action="${escapeHtmlAttr(path)}">
+<form method="post" action="${escapeHtmlAttr(path)}" data-kumiko-form="contract-termination-review">
 ${hiddenInputs(values)}
-<button type="submit" name="step" value="confirm">${escapeHtml(page.confirmButton[declarationType])}</button>
-<button type="submit" name="step" value="edit">${escapeHtml(page.backButton)}</button>
+<button type="submit" name="step" value="confirm" data-kumiko-button="confirm">${escapeHtml(page.confirmButton[declarationType])}</button>
+<button type="submit" name="step" value="edit" data-kumiko-button="back">${escapeHtml(page.backButton)}</button>
 </form>`;
-    return htmlResponse(locale, page.reviewTitle, body, 200);
+    return htmlResponse(ctx, page.reviewTitle, body, 200);
 }
-function resultPage(locale, receivedAtIso, requestId) {
+function resultPage(ctx, receivedAtIso, requestId) {
+    const { locale } = ctx;
     const { page } = TERMINATION_TEXTS[locale];
     const body = `<h1>${escapeHtml(page.resultTitle)}</h1>
 <p>${escapeHtml(page.resultLead)}</p>
 <p>${escapeHtml(page.resultReceivedAt)}: <strong>${escapeHtml(formatReceivedAt(receivedAtIso, locale))}</strong></p>
 <p>${escapeHtml(page.resultRequestId)}: <code>${escapeHtml(requestId)}</code></p>
 <p>${escapeHtml(page.resultMailNote)}</p>`;
-    return htmlResponse(locale, page.resultTitle, body, 200);
+    return htmlResponse(ctx, page.resultTitle, body, 200);
 }
 const RATE_LIMITED_CODE = "rate_limited";
 const TENANT_HEADER = "x-tenant";
@@ -227,14 +235,27 @@ async function submitDeclaration(c, app, clientIp, values, locale) {
     }
     return { kind: "failed" };
 }
-function routesFor(locale, path) {
+function routesFor(ctx) {
+    const { locale, path } = ctx;
+    const slashVariant = slashVariantOf(path);
     return [
         {
             method: "GET",
             path,
             entry: "anonymous",
-            handler: () => formPage(locale, path, EMPTY_FORM, [], 200),
+            handler: () => formPage(ctx, EMPTY_FORM, [], 200),
         },
+        // GET also serves HEAD; POST gets no alias (a redirect would drop the body).
+        ...(slashVariant === null
+            ? []
+            : [
+                {
+                    method: "GET",
+                    path: slashVariant,
+                    entry: "anonymous",
+                    handler: (c) => redirectToCanonicalPath(c.req.url, path),
+                },
+            ]),
         {
             method: "POST",
             path,
@@ -242,27 +263,33 @@ function routesFor(locale, path) {
             handler: async (c, deps) => {
                 const { step, values } = await readForm(c);
                 if (step === "edit")
-                    return formPage(locale, path, values, [], 200);
+                    return formPage(ctx, values, [], 200);
                 const messages = validationMessages(values, locale);
                 if (messages.length > 0)
-                    return formPage(locale, path, values, messages, 400);
+                    return formPage(ctx, values, messages, 400);
                 if (step !== "confirm")
-                    return reviewPage(locale, path, values);
+                    return reviewPage(ctx, values);
                 const outcome = await submitDeclaration(c, deps.app, deps.clientIp, values, locale);
                 const { page } = TERMINATION_TEXTS[locale];
                 if (outcome.kind === "received") {
-                    return resultPage(locale, outcome.receivedAtIso, outcome.requestId);
+                    return resultPage(ctx, outcome.receivedAtIso, outcome.requestId);
                 }
                 if (outcome.kind === "rate-limited") {
-                    return htmlResponse(locale, page.rateLimitedTitle, `<h1>${escapeHtml(page.rateLimitedTitle)}</h1><p>${escapeHtml(page.rateLimitedBody)}</p>`, 429);
+                    return htmlResponse(ctx, page.rateLimitedTitle, `<h1>${escapeHtml(page.rateLimitedTitle)}</h1><p>${escapeHtml(page.rateLimitedBody)}</p>`, 429);
                 }
-                return formPage(locale, path, values, [page.errorGeneric], 400);
+                return formPage(ctx, values, [page.errorGeneric], 400);
             },
         },
     ];
 }
 /** GET + POST pages for de (`/legal/kuendigen`) and en (`/legal/cancel`);
- *  mount via the app's `extraRoutes`. */
+ *  mount via the app's `extraRoutes`. The other trailing-slash form of each
+ *  path 301-redirects (GET/HEAD) to the configured path. */
 export function createContractTerminationRoutes(options = {}) {
-    return ["de", "en"].flatMap((locale) => routesFor(locale, options.paths?.[locale] ?? DEFAULT_PATHS[locale]));
+    const alternates = {
+        de: options.paths?.de ?? DEFAULT_PATHS.de,
+        en: options.paths?.en ?? DEFAULT_PATHS.en,
+    };
+    const wrapLayout = options.wrapLayout ?? wrapInLayout;
+    return ["de", "en"].flatMap((locale) => routesFor({ locale, path: alternates[locale], wrapLayout, alternates }));
 }

package/dist/billing-foundation/consumer-protection/termination-request.js

@@ -62,6 +62,7 @@ async function sendTerminationMails(ctx, consumerProtection, plan) {
             declaration: plan.declaration,
             operatorEmail: consumerProtection.operatorEmail,
         }),
+        locale: plan.locale,
         priority: "critical",
     });
     // skip: no operator notice needed for this declaration
@@ -104,6 +105,7 @@ export function createRequestContractTerminationHandler(options, consumerProtect
         schema: requestContractTerminationSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 5, windowSeconds: 600 },
+        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
         ...(consumerProtection.terminationScope === "platform" && { tenantlessAnonymous: true }),
         escapeHatch: {
             reason: "Anonymous declarant has no session — finds the contract by email via ctx.queryAs(system, user:find-for-auth) and tenant:memberships; the tenant written to comes only from those lookups.",

package/dist/billing-foundation/consumer-protection/termination-texts.d.ts

@@ -12,6 +12,7 @@ export type TerminationTexts = {
     readonly customerReference: string;
     readonly reasonFieldLabel: string;
     readonly receiptSubject: Readonly<Record<ContractTerminationDeclarationType, string>>;
+    readonly receiptGreeting: string;
     readonly receiptIntro: string;
     readonly receiptNextSteps: string;
     readonly receiptRevoke: (operatorEmail: string) => string;

package/dist/billing-foundation/consumer-protection/termination-texts.js

@@ -27,6 +27,7 @@ export const TERMINATION_TEXTS = {
             termination: "Eingangsbestätigung deiner Kündigung",
             withdrawal: "Eingangsbestätigung deines Widerrufs",
         },
+        receiptGreeting: "Hallo,",
         receiptIntro: "wir bestätigen den Eingang deiner Erklärung mit folgendem Inhalt. Diese E-Mail ist eine Eingangsbestätigung, keine Bestätigung der Wirksamkeit.",
         receiptNextSteps: "Wir prüfen deine Erklärung und melden uns, sobald sie bearbeitet ist oder wir Rückfragen haben.",
         receiptRevoke: (operatorEmail) => `Hast du diese Erklärung nicht abgegeben oder möchtest du sie zurücknehmen? Schreib uns bitte umgehend an ${operatorEmail}.`,
@@ -105,7 +106,8 @@ export const TERMINATION_TEXTS = {
             termination: "Receipt for your termination",
             withdrawal: "Receipt for your withdrawal",
         },
-        receiptIntro: "we confirm receipt of your declaration with the following content. This email is a receipt, not a confirmation that the declaration is effective.",
+        receiptGreeting: "Hello,",
+        receiptIntro: "We confirm receipt of your declaration with the following content. This email is a receipt, not a confirmation that the declaration is effective.",
         receiptNextSteps: "We will review your declaration and get back to you once it is processed or if we have questions.",
         receiptRevoke: (operatorEmail) => `If you did not make this declaration or want to take it back, please write to ${operatorEmail} right away.`,
         contact: "Questions go to",

package/dist/channel-discord/discord-channel.d.ts

@@ -1,5 +1,9 @@
 import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.js";
 export type DiscordChannelOptions = ChatWebhookChannelOptions;
+export declare const DISCORD_SECRET_KEYS: {
+    readonly webhookPrefix: "channel-discord:webhooks.";
+    readonly webhookKeyFor: (connection: string) => string;
+};
 export declare const DISCORD_DEFAULT_ALLOWED_HOSTS: readonly ["discord.com", "discordapp.com"];
 export declare const DISCORD_WEBHOOK_PATH_PREFIX = "/api/webhooks/";
 export declare const DISCORD_CONTENT_MAX_CHARS = 2000;

package/dist/channel-discord/discord-channel.js

@@ -1,4 +1,8 @@
 import { chatMessageText, createChatWebhookChannel, truncateChars, } from "../delivery/index.js";
+export const DISCORD_SECRET_KEYS = {
+    webhookPrefix: "channel-discord:webhooks.",
+    webhookKeyFor: (connection) => `channel-discord:webhooks.${connection}`,
+};
 export const DISCORD_DEFAULT_ALLOWED_HOSTS = ["discord.com", "discordapp.com"];
 export const DISCORD_WEBHOOK_PATH_PREFIX = "/api/webhooks/";
 export const DISCORD_CONTENT_MAX_CHARS = 2000;

package/dist/channel-discord/feature.js

@@ -1,6 +1,6 @@
-import { chatConnectionNameSchema, DELIVERY_CHANNEL_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { chatConnectionNameSchema, chatWebhookUrlSchema, DELIVERY_CHANNEL_EXTENSION, resolveChatWebhookTarget, } from "@cosmicdrift/kumiko-bundled-features/delivery";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { createDiscordChannel } from "./discord-channel.js";
+import { createDiscordChannel, DISCORD_DEFAULT_ALLOWED_HOSTS, DISCORD_WEBHOOK_PATH_PREFIX, } from "./discord-channel.js";
 export function createChannelDiscordFeature(options = {}) {
     return defineFeature("channel-discord", (r) => {
         r.describe('Posts delivery notifications to a Discord webhook, registered as the `discord` channel in the delivery system. Tenant-owned chat target: reach it only via `ctx.notify(type, { route: { discord: "<connection name>" } })`. The webhook URL is a tenant secret under `channel-discord:webhooks.<connection name>`; only the connection name is logged. Mentions are disabled and content is cut to 2000 characters. Requires `delivery` and `secrets`. Host allowlist (discord.com, discordapp.com, path /api/webhooks/), https-only and the request timeout are app options of `createChannelDiscordFeature(opts)`, never tenant config.');
@@ -11,6 +11,10 @@ export function createChannelDiscordFeature(options = {}) {
         });
         r.requires("delivery");
         r.requires("secrets");
+        const webhookTarget = resolveChatWebhookTarget({
+            defaultAllowedHosts: DISCORD_DEFAULT_ALLOWED_HOSTS,
+            requiredPathPrefix: DISCORD_WEBHOOK_PATH_PREFIX,
+        }, options);
         const webhooks = r.secretNamespace("webhooks", {
             label: { en: "Discord webhooks", de: "Discord-Webhooks", es: "Webhooks de Discord" },
             hint: {
@@ -20,6 +24,7 @@ export function createChannelDiscordFeature(options = {}) {
             },
             scope: "tenant",
             nameSchema: chatConnectionNameSchema,
+            valueSchema: chatWebhookUrlSchema(webhookTarget),
         });
         const channel = createDiscordChannel(options, webhooks.keyFor);
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "discord", {

package/dist/channel-discord/index.d.ts

@@ -1,2 +1,2 @@
-export { createDiscordChannel, type DiscordChannelOptions } from "./discord-channel.js";
+export { createDiscordChannel, DISCORD_DEFAULT_ALLOWED_HOSTS, DISCORD_SECRET_KEYS, DISCORD_WEBHOOK_PATH_PREFIX, type DiscordChannelOptions, } from "./discord-channel.js";
 export { createChannelDiscordFeature } from "./feature.js";

package/dist/channel-discord/index.js

@@ -1,2 +1,2 @@
-export { createDiscordChannel } from "./discord-channel.js";
+export { createDiscordChannel, DISCORD_DEFAULT_ALLOWED_HOSTS, DISCORD_SECRET_KEYS, DISCORD_WEBHOOK_PATH_PREFIX, } from "./discord-channel.js";
 export { createChannelDiscordFeature } from "./feature.js";

package/dist/channel-email/email-channel.js

@@ -44,6 +44,7 @@ function emailEnvelopeFrom(data) {
     if (!data)
         return {};
     const from = typeof data["from"] === "string" ? data["from"] : undefined;
+    const fromName = typeof data["fromName"] === "string" ? data["fromName"] : undefined;
     const replyTo = typeof data["replyTo"] === "string" ? data["replyTo"] : undefined;
     const autoHeaders = listUnsubscribeHeaders(data);
     const explicitHeaders = stringHeaders(data["headers"]);
@@ -55,7 +56,12 @@ function emailEnvelopeFrom(data) {
     const headers = (!overridesUnsubscribe && autoHeaders) || explicitHeaders
         ? { ...(overridesUnsubscribe ? undefined : autoHeaders), ...explicitHeaders }
         : undefined;
-    return { ...(from && { from }), ...(replyTo && { replyTo }), ...(headers && { headers }) };
+    return {
+        ...(from && { from }),
+        ...(fromName && { fromName }),
+        ...(replyTo && { replyTo }),
+        ...(headers && { headers }),
+    };
 }
 export function createEmailChannel(options) {
     const { transport, renderer, resolveEmail } = options;
@@ -73,6 +79,7 @@ export function createEmailChannel(options) {
         const html = await renderer.render({
             template: message.notificationType,
             variables,
+            locale: message.locale,
         });
         const subject = variables["subject"] ?? message.title; // @cast-boundary dynamic-key
         return { html, subject };

package/dist/channel-email/pii-guard.js

@@ -9,15 +9,16 @@ const CIPHERTEXT_RE = /kumiko-pii:v\d+:[^"\s<>\\]*/g;
 // blob); ciphertext in subject/body fails loud in dev and is redacted+logged
 // in prod.
 export function guardEmailMessage(message) {
-    // Every envelope address, not just `to`: a ciphertext From or Reply-To is
+    // Every envelope address, not just `to`: a ciphertext From, From-Name or Reply-To is
     // the same garbage as a ciphertext recipient — refuse rather than mail it.
     for (const [label, address] of [
-        ["recipient", message.to],
-        ["from", message.from],
-        ["reply-to", message.replyTo],
+        ["recipient address", message.to],
+        ["from address", message.from],
+        ["from name", message.fromName],
+        ["reply-to address", message.replyTo],
     ]) {
         if (address?.includes(CIPHERTEXT_MARKER)) {
-            throw new Error(`[channel-email] refusing to send: ${label} address is a PII ciphertext ` +
+            throw new Error(`[channel-email] refusing to send: ${label} is a PII ciphertext ` +
                 `("${PII_CIPHERTEXT_PREFIX}…") — decrypt the stored value before mailing (decryptStoredPii).`);
         }
     }

package/dist/channel-email/smtp-transport.js

@@ -16,6 +16,27 @@
 // Volume-Apps muss der Caller eine eigene Implementation mit
 // dedizierter Queue (BullMQ + retry) drüberlegen.
 import { createTransport } from "nodemailer";
+import addressparser from "nodemailer/lib/addressparser";
+function isControlCharacter(char) {
+    const code = char.charCodeAt(0);
+    return code <= 0x1f || code === 0x7f;
+}
+// Control characters in a display name would let a caller inject headers.
+function sanitizedDisplayName(name) {
+    const cleaned = name
+        ?.split("")
+        .map((char) => (isControlCharacter(char) ? " " : char))
+        .join("")
+        .trim();
+    return cleaned === undefined || cleaned === "" ? undefined : cleaned;
+}
+function fromHeader(address, fromName) {
+    const name = sanitizedDisplayName(fromName);
+    if (name === undefined)
+        return address;
+    const [parsed] = addressparser(address, { flatten: true });
+    return parsed?.address ? { name, address: parsed.address } : address;
+}
 export function createSmtpTransport(options) {
     const transporter = createTransport({
         host: options.host,
@@ -29,7 +50,7 @@ export function createSmtpTransport(options) {
     return {
         async send(message) {
             await transporter.sendMail({
-                from: message.from ?? options.from,
+                from: fromHeader(message.from ?? options.from, message.fromName),
                 to: message.to,
                 subject: message.subject,
                 html: message.html,

package/dist/channel-email/types.d.ts

@@ -3,6 +3,7 @@ export type EmailMessage = {
     readonly subject: string;
     readonly html: string;
     readonly from?: string;
+    readonly fromName?: string;
     readonly replyTo?: string;
     readonly headers?: Readonly<Record<string, string>>;
 };