@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.363.0

package/dist/user-data-rights/feature.js

@@ -1,7 +1,10 @@
 // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312 (feature.ts > 300 lines)
 import { UNKNOWN_CLIENT_IP } from "@cosmicdrift/kumiko-framework/api";
-import { createSystemConfig, defineFeature, EXT_USER_DATA, i18nKey, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemConfig, createSystemUser, defineFeature, EXT_USER_DATA, i18nKey, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { createMetricsHandle, createNoopMetricsHandle, } from "@cosmicdrift/kumiko-framework/observability";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { createConfigAccessor } from "../config/index.js";
 import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks.js";
 import { EXPORT_SECTION_EXTENSION_NAME, PRIVACY_CENTER_SCREEN_ID, STATUS_OPTION_KEY_PREFIX, USER_ME_QUERY, UserDataRightsHandlers, } from "./constants.js";
 import { cancelDeletionWrite } from "./handlers/cancel-deletion.write.js";
@@ -21,21 +24,30 @@ import { requestExportWrite } from "./handlers/request-export.write.js";
 import { restrictAccountWrite } from "./handlers/restrict-account.write.js";
 import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.write.js";
 import { USER_DATA_RIGHTS_I18N } from "./i18n.js";
-import { isMailTransportAvailable, makeDefaultDeletionExecutedEmail, makeDefaultExportFailedEmail, makeDefaultExportReadyEmail, } from "./lib/default-mailers.js";
+import { isGdprMailDeliveryAvailable, isMailRendererAvailable, isMailTransportAvailable, makeDefaultDeletionExecutedEmail, makeDefaultExportFailedEmail, makeDefaultExportReadyEmail, } from "./lib/default-mailers.js";
 import { makeTenantMailTransportResolver } from "./lib/mail-transport-resolver.js";
 import { resolveAppTenantModel } from "./lib/resolve-tenant-model.js";
 import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver.js";
+import { registerGdprMails } from "./mail-notifications.js";
 import { EXPORT_CLEANUP_BACKLOG_AGE_METRIC, EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC, runExportJobs, } from "./run-export-jobs.js";
 import { runForgetCleanup, sanitizeReasonForLog, } from "./run-forget-cleanup.js";
 import { downloadAttemptEntity } from "./schema/download-attempt.js";
 import { exportDownloadTokenEntity } from "./schema/download-token.js";
 import { exportJobEntity } from "./schema/export-job.js";
 import { downloadAttemptListScreen, exportJobDetailScreen, exportJobListScreen, } from "./screens.js";
+function isMailTransportMountedWithoutDelivery(features) {
+    const names = new Set(features.map((feature) => feature.name));
+    const hasTransport = [...names].some((name) => name.startsWith("mail-transport-"));
+    return (names.has("mail-foundation") &&
+        hasTransport &&
+        !(names.has("delivery") && names.has("channel-email")));
+}
 export function createUserDataRightsFeature(opts = {}) {
     // One-shot operator warning (the export cron fires daily — warn once per
     // process, not every run). Lives in the factory scope so the cron closure
     // shares it across runs.
     let warnedMissingExportUrl = false;
+    let warnedMissingMailDelivery = false;
     const showDeletion = opts.privacyCenterShowDeletion ?? true;
     return defineFeature("user-data-rights", (r) => {
         r.describe('Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion`, plus the anonymous email-verified `request-deletion-by-email` + `confirm-deletion-by-token` flow for lockout-safe self-service, + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` \u2192 ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, "<entity>", { export, delete })` \u2014 the feature then orchestrates the export and forget pipelines across all registered hooks automatically. When `mail-foundation` and a `mail-transport-*` are mounted, it also sends the four GDPR notifications (export ready/failed, deletion requested/executed) itself with no app callback code, rendered in each recipient’s locale. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.');
@@ -61,7 +73,13 @@ export function createUserDataRightsFeature(opts = {}) {
         // EXT_USER_DATA channel owner: any r.useExtension(EXT_USER_DATA, ...)
         // usage already requires user-data-rights to be mounted.
         r.bootCheck(({ features }) => validateGdprHookCompleteness(features));
-        r.bootCheck(({ features }) => validateGdprPiiHookCoverage(features));
+        r.bootCheck(({ features }) => {
+            validateGdprPiiHookCoverage(features);
+            if (!warnedMissingMailDelivery && isMailTransportMountedWithoutDelivery(features)) {
+                warnedMissingMailDelivery = true;
+                createFallbackLogger("user-data-rights").warn("mail-foundation and a mail transport are mounted but delivery/channel-email are not — the default export and deletion-request mails need them and will not be sent");
+            }
+        });
         // App-level tenant-occupancy model. Default "multi-user" → tenant-scoped
         // contributors (e.g. credit) NEVER erase tenant data on a per-user forget
         // (would harm co-members). An app with one user per tenant sets this to
@@ -147,6 +165,7 @@ export function createUserDataRightsFeature(opts = {}) {
             access: { roles: ["SystemAdmin"] },
         });
         r.translations({ keys: USER_DATA_RIGHTS_I18N });
+        registerGdprMails(r);
         // Privacy-center dot-form labels (i18nKey()-marked below), duplicated in
         // web/i18n.ts's client bundle since privacy-center-screen.tsx renders
         // them client-side.
@@ -350,9 +369,7 @@ export function createUserDataRightsFeature(opts = {}) {
             handler: async (c, { app, clientIp }) => {
                 const url = new URL(c.req.url);
                 const parsedBody = await c.req.json().catch(() => null);
-                const token = parsedBody && typeof parsedBody === "object" && "token" in parsedBody
-                    ? parsedBody.token
-                    : undefined;
+                const token = isPlainObject(parsedBody) ? parsedBody["token"] : undefined;
                 if (typeof token !== "string" || token.length === 0) {
                     return c.json({ error: "missing_token" }, 400);
                 }
@@ -426,31 +443,27 @@ export function createUserDataRightsFeature(opts = {}) {
                 // versendet der Cron die Export-Notifications selbst (Default-Templates).
                 // Der Resolver baut den per-Tenant-Transport aus configResolver — gleiche
                 // Bruecke wie buildStorageProvider.
-                const exportMailResolver = isMailTransportAvailable(exportRegistry)
-                    ? makeTenantMailTransportResolver({
-                        registry: exportRegistry,
-                        configResolver: ctx.configResolver,
-                        secrets: ctx.secrets,
-                        db: exportDb,
-                        userId: exportUserId,
-                        handlerName: "user-data-rights:run-export-jobs",
-                    })
+                // The cron runs across tenants: each mail needs a notify bound to the
+                // recipient's tenant (template override, channel config).
+                const notifyFactory = ctx._notifyFactory;
+                const exportNotifyFor = notifyFactory !== undefined && isGdprMailDeliveryAvailable(exportRegistry)
+                    ? (tenantId) => notifyFactory(createSystemUser(tenantId), tenantId)
                     : undefined;
                 const sendExportReadyEmail = opts.sendExportReadyEmail ??
-                    (exportMailResolver && opts.appExportDownloadUrl !== undefined
-                        ? makeDefaultExportReadyEmail(exportMailResolver, opts.mailDefaults)
+                    (exportNotifyFor && opts.appExportDownloadUrl !== undefined
+                        ? makeDefaultExportReadyEmail(exportNotifyFor, opts.mailDefaults)
                         : undefined);
                 const sendExportFailedEmail = opts.sendExportFailedEmail ??
-                    (exportMailResolver
-                        ? makeDefaultExportFailedEmail(exportMailResolver, opts.mailDefaults)
+                    (exportNotifyFor
+                        ? makeDefaultExportFailedEmail(exportNotifyFor, opts.mailDefaults)
                         : undefined);
-                if (exportMailResolver &&
+                if (exportNotifyFor &&
                     !opts.sendExportReadyEmail &&
                     opts.appExportDownloadUrl === undefined &&
                     !warnedMissingExportUrl) {
                     warnedMissingExportUrl = true;
                     // biome-ignore lint/suspicious/noConsole: one-shot operator visibility for misconfig
-                    console.warn("[user-data-rights:run-export-jobs] mail transport mounted but appExportDownloadUrl unset — default export-ready emails disabled (export-failed + deletion mails still send)");
+                    console.warn("[user-data-rights:run-export-jobs] mail delivery mounted but appExportDownloadUrl unset — default export-ready emails disabled (export-failed + deletion mails still send)");
                 }
                 await runExportJobs({
                     db: exportDb,
@@ -508,21 +521,26 @@ export function createUserDataRightsFeature(opts = {}) {
                     db: forgetDb,
                     userId: forgetUserId,
                 });
-                // C6 — Default-Mail beim delete-flip wenn kein Callback gesetzt + ein
-                // mail-transport gemountet ist (gleiche per-Tenant-Bruecke wie Export).
-                const forgetMailResolver = isMailTransportAvailable(forgetRegistry)
-                    ? makeTenantMailTransportResolver({
-                        registry: forgetRegistry,
-                        configResolver: ctx.configResolver,
-                        secrets: ctx.secrets,
-                        db: forgetDb,
-                        userId: forgetUserId,
-                        handlerName: "user-data-rights:run-forget-cleanup",
-                    })
-                    : undefined;
+                // Without an app callback the default mail goes out when a mail transport and a
+                // mail renderer are mounted. The user is already erased here, so it bypasses the
+                // delivery log: an attempt row would be new personal data.
+                const forgetConfigResolver = ctx.configResolver;
                 const sendDeletionExecutedEmail = opts.sendDeletionExecutedEmail ??
-                    (forgetMailResolver
-                        ? makeDefaultDeletionExecutedEmail(forgetMailResolver, opts.mailDefaults)
+                    (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+                        ? makeDefaultDeletionExecutedEmail({
+                            registry: forgetRegistry,
+                            db: forgetDb,
+                            resolveTransport: makeTenantMailTransportResolver({
+                                registry: forgetRegistry,
+                                configResolver: forgetConfigResolver,
+                                secrets: ctx.secrets,
+                                db: forgetDb,
+                                userId: forgetUserId,
+                                handlerName: "user-data-rights:run-forget-cleanup",
+                            }),
+                            configFor: (tenantId) => forgetConfigResolver &&
+                                createConfigAccessor(forgetRegistry, forgetConfigResolver, tenantId, forgetUserId, forgetDb),
+                        }, opts.mailDefaults)
                         : undefined);
                 const forgetResult = await runForgetCleanup({
                     db: forgetDb,

package/dist/user-data-rights/handlers/cancel-deletion.write.d.ts

@@ -2,5 +2,5 @@ import * as z from "zod";
 export declare const cancelDeletionWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"cancel-deletion", z.ZodObject<{}, z.core.$strip>, {
     userId: string;
     status: "active";
-    gracePeriodEnd: string | null;
+    gracePeriodEnd: null;
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user-data-rights/handlers/cancel-deletion.write.js

@@ -54,12 +54,13 @@ export const cancelDeletionWrite = defineWriteHandler({
         });
         // gracePeriodEnd=null im Response symmetrisch zu request-deletion's
         // ISO-Timestamp — Frontend kann beide Endpoints uniform behandeln.
+        const gracePeriodEnd = null;
         return {
             isSuccess: true,
             data: {
                 userId: event.user.id,
                 status: USER_STATUS.Active,
-                gracePeriodEnd: null,
+                gracePeriodEnd,
             },
         };
     },

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -1,9 +1,8 @@
-import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { USER_STATUS } from "../../user/index.js";
-import { isMailTransportAvailable, makeDefaultDeletionRequestedEmail, } from "../lib/default-mailers.js";
+import { isGdprMailDeliveryAvailable, makeDefaultDeletionRequestedEmail, } from "../lib/default-mailers.js";
 import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
 // POST /api/user/request-deletion (S2.U5a) — DSGVO Art. 17 Forget-Antrag.
 // Flippt status=Active → deletionRequested, setzt gracePeriodEnd aus dem
@@ -34,12 +33,11 @@ export function createRequestDeletionHandler(opts = {}) {
             if (!res.ok)
                 return writeFailure(res.error);
             const { gracePeriodEnd, userEmail, userLocale } = res;
-            // App-Callback hat Vorrang; sonst greift die mail-foundation-Default-Mail
-            // (Request-Lane → ctx.config vorhanden, createTransportForTenant direkt).
-            // Ohne gemounteten mail-transport bleibt send undefined → keine Mail.
+            // The app callback wins; otherwise the default mail goes through ctx.notify after
+            // the commit. Without delivery and an email channel there is no sender and no mail.
             const send = opts.sendDeletionRequestedEmail ??
-                (isMailTransportAvailable(ctx.registry)
-                    ? makeDefaultDeletionRequestedEmail((tenantId) => createTransportForTenant(ctx, tenantId, "user-data-rights:request-deletion"), opts.mailDefaults)
+                (ctx.notify !== undefined && isGdprMailDeliveryAvailable(ctx.registry)
+                    ? makeDefaultDeletionRequestedEmail(ctx.notify, opts.mailDefaults)
                     : undefined);
             // Best-effort Email-Notification. Send-Failure darf das Write nicht
             // killen — siehe Type-Doc oben.

package/dist/user-data-rights/lib/default-mailers.d.ts

@@ -1,5 +1,6 @@
 import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { ConfigAccessor, NotifyFn, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type GdprMailLocale } from "../email-templates.js";
 import type { SendDeletionRequestedEmailFn } from "../handlers/request-deletion.write.js";
 import type { SendExportFailedEmailFn, SendExportReadyEmailFn } from "../run-export-jobs.js";
@@ -8,10 +9,17 @@ export type GdprMailDefaults = {
     readonly locale?: GdprMailLocale;
     readonly appName?: string;
 };
+export declare function isGdprMailDeliveryAvailable(registry: Registry): boolean;
 export declare function isMailTransportAvailable(registry: Registry): boolean;
-type TransportResolver = (tenantId: string) => Promise<EmailTransport>;
-export declare function makeDefaultExportReadyEmail(resolveTransport: TransportResolver, defaults?: GdprMailDefaults): SendExportReadyEmailFn;
-export declare function makeDefaultExportFailedEmail(resolveTransport: TransportResolver, defaults?: GdprMailDefaults): SendExportFailedEmailFn;
-export declare function makeDefaultDeletionRequestedEmail(resolveTransport: TransportResolver, defaults?: GdprMailDefaults): SendDeletionRequestedEmailFn;
-export declare function makeDefaultDeletionExecutedEmail(resolveTransport: TransportResolver, defaults?: GdprMailDefaults): SendDeletionExecutedEmailFn;
-export {};
+export declare function isMailRendererAvailable(registry: Registry): boolean;
+export type NotifyForTenant = (tenantId: TenantId) => NotifyFn;
+export declare function makeDefaultExportReadyEmail(notifyFor: NotifyForTenant, defaults?: GdprMailDefaults): SendExportReadyEmailFn;
+export declare function makeDefaultExportFailedEmail(notifyFor: NotifyForTenant, defaults?: GdprMailDefaults): SendExportFailedEmailFn;
+export declare function makeDefaultDeletionRequestedEmail(notify: NotifyFn, defaults?: GdprMailDefaults): SendDeletionRequestedEmailFn;
+export type DeletionExecutedMailDeps = {
+    readonly registry: Registry;
+    readonly db: DbConnection;
+    readonly resolveTransport: (tenantId: string) => Promise<EmailTransport>;
+    readonly configFor: (tenantId: TenantId) => ConfigAccessor | undefined;
+};
+export declare function makeDefaultDeletionExecutedEmail(deps: DeletionExecutedMailDeps, defaults?: GdprMailDefaults): SendDeletionExecutedEmailFn;

package/dist/user-data-rights/lib/default-mailers.js

@@ -1,65 +1,94 @@
-// Default send*Email-Callbacks fuer die GDPR-Notifications, backed by einem
-// mail-transport (mail-foundation). Damit muss eine App keinen Callback-Code
-// schreiben: sie mountet mail-foundation + einen mail-transport-* und setzt
-// fuer Export-Mails appExportDownloadUrl — fertig. Uebergibt sie eigene
-// send*Email-Opts, greifen diese Defaults nicht (Opt-Override im feature.ts).
+// Default send*Email callbacks for the GDPR notifications. The app writes no
+// callback code: it mounts delivery + channel-email (+ the template stack) and
+// sets appExportDownloadUrl for export mails. Own send*Email options win over
+// these defaults (opt-override in feature.ts).
 //
-// Jeder Callback rendert das Template (email-templates.ts) und versendet ueber
-// den per-Tenant aufgeloesten EmailTransport. `resolveTransport` kommt im Job-
-// Lane aus makeTenantMailTransportResolver, im Request-Lane direkt aus
-// createTransportForTenant(ctx, ...).
+// Export-ready/-failed and deletion-requested go through ctx.notify addressed
+// to the user, so delivery resolves the address and the attempt row carries
+// the recipientId the forget path erases. Deletion-executed cannot: the user
+// is gone by then, and an attempt row written after the erasure would be new
+// personal data. It renders the seeded template and sends over the tenant's
+// mail transport, with no delivery log.
 import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
-import { hasMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
-import { normalizeGdprMailLocale, renderDeletionExecutedEmail, renderDeletionRequestedEmail, renderExportFailedEmail, renderExportReadyEmail, } from "../email-templates.js";
-// mail-foundation ist eine Soft-Dep von user-data-rights. Die Default-Mailer
-// greifen nur wenn mindestens ein mail-transport-* registriert ist — sonst
-// kann ohnehin nichts versendet werden und die App bleibt beim bisherigen
-// "kein Callback → keine Email"-Verhalten.
+import { hasMailTranslations, mailT } from "@cosmicdrift/kumiko-framework/i18n";
+import { DELIVERY_CHANNEL_EXTENSION } from "../../delivery/index.js";
+import { collectRendererPlugins, createRendererFoundationApi, } from "../../renderer-foundation/index.js";
+import { formatGdprMailTimestamp, normalizeGdprMailLocale, } from "../email-templates.js";
+import { GdprMailNotificationTypes, gdprMailTemplateLocale } from "../mail-notifications.js";
+// The notify-based defaults need the delivery pipeline with an email channel.
+export function isGdprMailDeliveryAvailable(registry) {
+    return registry
+        .getExtensionUsages(DELIVERY_CHANNEL_EXTENSION)
+        .some((usage) => usage.entityName === "email");
+}
 export function isMailTransportAvailable(registry) {
     return registry.getExtensionUsages(MAIL_TRANSPORT_EXTENSION).length > 0;
 }
+export function isMailRendererAvailable(registry) {
+    return collectRendererPlugins(registry).some((plugin) => plugin.kinds.includes("mail"));
+}
 // Per-recipient locale wins (user.locale); mailDefaults.locale is the fallback
-// for unknown/unsupported user.locale values; the template itself defaults to en.
-function localeFor(userLocale, defaults) {
+// for unknown/unsupported user.locale values; a locale without a template for
+// this notification falls back to en.
+function mailLocaleFor(notificationType, userLocale, defaults) {
     const user = normalizeGdprMailLocale(userLocale);
-    if (user !== undefined && hasMailTranslations(user))
-        return user;
-    return defaults.locale;
+    const preferred = user !== undefined && hasMailTranslations(user) ? user : defaults.locale;
+    return gdprMailTemplateLocale(notificationType, preferred ?? "en");
+}
+function appNameFor(locale, defaults) {
+    return defaults.appName ?? mailT(locale, "gdpr.mail.appNameDefault");
 }
-export function makeDefaultExportReadyEmail(resolveTransport, defaults = {}) {
+// Delivery failures come back as results, not throws; the callers' best-effort
+// handling only sees them if they throw.
+async function notifyImmediately(notify, notificationType, options) {
+    const result = await notify(notificationType, { ...options, immediate: true });
+    const failed = result.deliveries.find((delivery) => delivery.status === "failed");
+    if (failed) {
+        throw new Error(`${notificationType} delivery failed: ${failed.error ?? "unknown"}`);
+    }
+}
+export function makeDefaultExportReadyEmail(notifyFor, defaults = {}) {
     return async (args) => {
-        const transport = await resolveTransport(args.tenantId);
-        const { subject, html, text } = renderExportReadyEmail({
-            downloadUrl: args.downloadUrl,
-            expiresAt: args.expiresAt,
-            locale: localeFor(args.userLocale, defaults),
-            appName: defaults.appName,
+        const type = GdprMailNotificationTypes.exportReady;
+        const locale = mailLocaleFor(type, args.userLocale, defaults);
+        // immediate: the plain magic-link token must not land in a delivery job payload.
+        await notifyImmediately(notifyFor(args.tenantId), type, {
+            to: args.userId,
+            locale,
+            data: {
+                appName: appNameFor(locale, defaults),
+                actionUrl: args.downloadUrl,
+                validUntil: formatGdprMailTimestamp(args.expiresAt),
+            },
         });
-        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
-export function makeDefaultExportFailedEmail(resolveTransport, defaults = {}) {
+export function makeDefaultExportFailedEmail(notifyFor, defaults = {}) {
     return async (args) => {
-        const transport = await resolveTransport(args.tenantId);
-        const { subject, html, text } = renderExportFailedEmail({
-            locale: localeFor(args.userLocale, defaults),
-            appName: defaults.appName,
+        const type = GdprMailNotificationTypes.exportFailed;
+        const locale = mailLocaleFor(type, args.userLocale, defaults);
+        await notifyImmediately(notifyFor(args.tenantId), type, {
+            to: args.userId,
+            locale,
+            data: { appName: appNameFor(locale, defaults) },
         });
-        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
-export function makeDefaultDeletionRequestedEmail(resolveTransport, defaults = {}) {
+export function makeDefaultDeletionRequestedEmail(notify, defaults = {}) {
     return async (args) => {
-        const transport = await resolveTransport(args.tenantId);
-        const { subject, html, text } = renderDeletionRequestedEmail({
-            gracePeriodEnd: args.gracePeriodEnd,
-            locale: localeFor(args.userLocale, defaults),
-            appName: defaults.appName,
+        const type = GdprMailNotificationTypes.deletionRequested;
+        const locale = mailLocaleFor(type, args.userLocale, defaults);
+        await notify(type, {
+            to: args.userId,
+            locale,
+            data: {
+                appName: appNameFor(locale, defaults),
+                deletionDate: formatGdprMailTimestamp(args.gracePeriodEnd),
+            },
         });
-        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }
-export function makeDefaultDeletionExecutedEmail(resolveTransport, defaults = {}) {
+export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
     return async (args) => {
         // Der User ist global, der Mail-Transport per-Tenant — wir senden ueber den
         // Transport des ersten Memberships. Orphan-User (0 Memberships) liefert
@@ -69,12 +98,35 @@ export function makeDefaultDeletionExecutedEmail(resolveTransport, defaults = {}
             // skip: orphan user has no tenant whose transport could send the mail
             return;
         }
-        const transport = await resolveTransport(tenantId);
-        const { subject, html, text } = renderDeletionExecutedEmail({
-            executedAt: args.executedAt,
-            locale: localeFor(args.userLocale, defaults),
-            appName: defaults.appName,
+        const type = GdprMailNotificationTypes.deletionExecuted;
+        const locale = mailLocaleFor(type, args.userLocale, defaults);
+        const plugin = createRendererFoundationApi(collectRendererPlugins(deps.registry)).createRendererForTenant({ tenantId, kind: "mail" });
+        const config = deps.configFor(tenantId);
+        const rendered = await plugin.render({
+            kind: "mail",
+            payload: {
+                slug: type,
+                locale,
+                variables: {
+                    appName: appNameFor(locale, defaults),
+                    executedAt: formatGdprMailTimestamp(args.executedAt),
+                },
+            },
+        }, {
+            db: deps.db,
+            registry: deps.registry,
+            tenantId,
+            ...(config !== undefined && { config }),
+        });
+        if (rendered.kind !== "mail") {
+            throw new Error(`deletion-executed mail: renderer answered with kind "${rendered.kind}"`);
+        }
+        const transport = await deps.resolveTransport(tenantId);
+        await transport.send({
+            to: args.userEmail,
+            subject: rendered.subject,
+            html: rendered.html,
+            text: rendered.text,
         });
-        await transport.send({ to: args.userEmail, subject, html, text });
     };
 }

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -51,7 +51,7 @@ export async function updateUserLifecycle(conn, userId, changes, options) {
     });
 }
 export async function backfillUserLifecycleEvents(conn) {
-    const rows = (await selectMany(conn, userTable, {}));
+    const rows = await selectMany(conn, userTable, {});
     let backfilled = 0;
     const failed = [];
     for (const row of rows) {

package/dist/user-data-rights/mail-notifications.d.ts

@@ -0,0 +1,13 @@
+import { type FeatureRegistrar, type NotificationLocalizedTemplate, type TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+declare const ALL_GDPR_MAIL_KINDS: readonly ["exportReady", "exportFailed", "deletionRequested", "deletionExecuted"];
+export type GdprMailKind = (typeof ALL_GDPR_MAIL_KINDS)[number];
+export declare const GDPR_MAIL_KINDS: Readonly<Record<GdprMailKind, {
+    readonly name: string;
+    readonly translationKey: string;
+}>>;
+export declare const GdprMailNotificationTypes: Readonly<Record<GdprMailKind, string>>;
+export declare function gdprMailTemplateLocale(notificationType: string, requestedLocale: string): string;
+export declare const GDPR_MAIL_VARIABLES: Readonly<Record<GdprMailKind, TemplateVariables>>;
+export declare function gdprMailLocalizedTemplate(kind: GdprMailKind): () => NotificationLocalizedTemplate;
+export declare function registerGdprMails(r: FeatureRegistrar): void;
+export {};

package/dist/user-data-rights/mail-notifications.js

@@ -0,0 +1,118 @@
+import { QnTypes, qn, templateVariable, } from "@cosmicdrift/kumiko-framework/engine";
+import { hasMailTranslationKey, listMailLocales, mailT, resolveMailLocale, } from "@cosmicdrift/kumiko-framework/i18n";
+import { escapeHtml } from "@cosmicdrift/kumiko-headless";
+import { mailParagraph } from "../shared/index.js";
+import { USER_DATA_RIGHTS_FEATURE } from "./constants.js";
+const ALL_GDPR_MAIL_KINDS = [
+    "exportReady",
+    "exportFailed",
+    "deletionRequested",
+    "deletionExecuted",
+];
+export const GDPR_MAIL_KINDS = {
+    exportReady: { name: "export-ready", translationKey: "exportReady" },
+    exportFailed: { name: "export-failed", translationKey: "exportFailed" },
+    deletionRequested: { name: "deletion-requested", translationKey: "deletionRequested" },
+    deletionExecuted: { name: "deletion-executed", translationKey: "deletionExecuted" },
+};
+export const GdprMailNotificationTypes = {
+    exportReady: gdprMailType("exportReady"),
+    exportFailed: gdprMailType("exportFailed"),
+    deletionRequested: gdprMailType("deletionRequested"),
+    deletionExecuted: gdprMailType("deletionExecuted"),
+};
+function gdprMailType(kind) {
+    return qn(USER_DATA_RIGHTS_FEATURE, QnTypes.notify, GDPR_MAIL_KINDS[kind].name);
+}
+function subjectKey(kind) {
+    return `gdpr.mail.${GDPR_MAIL_KINDS[kind].translationKey}.subject`;
+}
+const SUBJECT_KEY_BY_TYPE = new Map(ALL_GDPR_MAIL_KINDS.map((kind) => [GdprMailNotificationTypes[kind], subjectKey(kind)]));
+// A registered locale whose bundle lacks the subject key has no template (see
+// gdprMailLocalizedTemplate); the renderer has no locale fallback, so the
+// sender must pick a locale that has one or the mail would not go out at all.
+export function gdprMailTemplateLocale(notificationType, requestedLocale) {
+    const locale = resolveMailLocale(requestedLocale);
+    const key = SUBJECT_KEY_BY_TYPE.get(notificationType);
+    return key !== undefined && hasMailTranslationKey(locale, key) ? locale : "en";
+}
+const appName = () => templateVariable.text({ required: true });
+export const GDPR_MAIL_VARIABLES = {
+    exportReady: {
+        appName: appName(),
+        actionUrl: templateVariable.link({ required: true }),
+        validUntil: templateVariable.text({ required: true }),
+    },
+    exportFailed: { appName: appName() },
+    deletionRequested: {
+        appName: appName(),
+        deletionDate: templateVariable.text({ required: true }),
+    },
+    deletionExecuted: { appName: appName(), executedAt: templateVariable.text({ required: true }) },
+};
+// Translation placeholder -> template variable per kind.
+const PLACEHOLDER_SLOTS = {
+    exportReady: { app: "{appName}", when: "{validUntil}" },
+    exportFailed: { app: "{appName}" },
+    deletionRequested: { app: "{appName}", when: "{deletionDate}" },
+    deletionExecuted: { app: "{appName}", when: "{executedAt}" },
+};
+function paragraph(kind, locale, part) {
+    const { translationKey } = GDPR_MAIL_KINDS[kind];
+    return mailParagraph(mailT(locale, `gdpr.mail.${translationKey}.${part}`, PLACEHOLDER_SLOTS[kind]));
+}
+function greeting(locale) {
+    return mailParagraph(mailT(locale, "gdpr.mail.greeting"));
+}
+function mailBody(kind, locale) {
+    switch (kind) {
+        case "exportReady":
+            return [
+                greeting(locale),
+                paragraph(kind, locale, "intro"),
+                `<p><a data-button href="{{actionUrl}}">${escapeHtml(mailT(locale, "gdpr.mail.exportReady.button"))}</a></p>`,
+                paragraph(kind, locale, "expiry"),
+            ].join("");
+        case "exportFailed":
+            return [greeting(locale), paragraph(kind, locale, "intro")].join("");
+        case "deletionRequested":
+            return [
+                greeting(locale),
+                paragraph(kind, locale, "intro"),
+                paragraph(kind, locale, "cancel"),
+            ].join("");
+        case "deletionExecuted":
+            return [greeting(locale), paragraph(kind, locale, "intro")].join("");
+    }
+}
+// Evaluated when the registry is built, after every locale feature has
+// registered its mail translations. English always ships; another locale only
+// gets a template when it has its own subject, so a missing translation never
+// silently becomes an English mail in that locale's slot.
+export function gdprMailLocalizedTemplate(kind) {
+    const kindSubjectKey = subjectKey(kind);
+    return () => {
+        const locales = [
+            "en",
+            ...listMailLocales().filter((locale) => locale !== "en" && hasMailTranslationKey(locale, kindSubjectKey)),
+        ];
+        return Object.fromEntries(locales.map((locale) => [
+            locale,
+            {
+                body: mailBody(kind, locale),
+                meta: {
+                    subject: mailT(locale, kindSubjectKey, { app: "{{appName}}" }),
+                    category: "transactional",
+                },
+            },
+        ]));
+    };
+}
+export function registerGdprMails(r) {
+    for (const kind of ALL_GDPR_MAIL_KINDS) {
+        r.notification(GDPR_MAIL_KINDS[kind].name, {
+            variables: GDPR_MAIL_VARIABLES[kind],
+            localizedTemplate: gdprMailLocalizedTemplate(kind),
+        });
+    }
+}

package/dist/user-data-rights/web/privacy-center-screen.js

@@ -12,6 +12,7 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
 // declarative fields/actions instead (feature.ts).
 import { useDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { postWithDownload } from "@cosmicdrift/kumiko-renderer-web";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { useEffect, useState } from "react";
 import { EXPORT_JOB_STATUS, UserDataRightsHandlers, UserDataRightsQueries, } from "../constants.js";
 // Export-Job läuft async (worker-Lane-Cron, ~1 Min). Solange er pending/running
@@ -21,7 +22,7 @@ const EXPORT_POLL_MS = 4000;
 // Dispatcher-Failures tragen i18nKey nur wenn der Handler einen setzt —
 // Boundary-Read mit generischem Fallback.
 function failureKey(error) {
-    const key = error?.i18nKey; // @cast-boundary dispatcher-error
+    const key = propertyOf(error, "i18nKey");
     return typeof key === "string" ? key : "userDataRights.privacyCenter.errors.generic";
 }
 // Roher ISO-Instant → nur der Datums-Teil ist relevant; reiner String-Slice,

package/dist/user-profile/web/profile-screen.js

@@ -8,6 +8,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // (../../user-data-rights/web/privacy-center-screen.tsx), which this file
 // mirrors.
 import { useDispatcher, usePrimitives, useTranslation, } from "@cosmicdrift/kumiko-renderer";
+import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { useState } from "react";
 import { AuthHandlers } from "../../auth-email-password/constants.js";
 import { requestEmailVerification } from "../../auth-email-password/web/index.js";
@@ -15,7 +16,7 @@ import { UserProfileHandlers } from "../constants.js";
 // Dispatcher failures carry an i18nKey only when the handler sets one —
 // boundary read with a generic fallback.
 function failureKey(error) {
-    const key = error?.i18nKey; // @cast-boundary dispatcher-error
+    const key = propertyOf(error, "i18nKey");
     return typeof key === "string" ? key : "profile.errors.generic";
 }
 function StatusBanner({ status }) {