@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/dist/auth-mfa/hmac-token-codec.js

@@ -1,5 +1,6 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 function hmacSign(input, secret) {
     return createHmac("sha256", secret).update(input).digest("base64url");
 }
@@ -8,13 +9,12 @@ function hmacSign(input, secret) {
 // replayed as a challenge token), since both share the same secret and payload shape.
 export function createHmacTokenCodec(domain, isPayload) {
     function splitEncodedBody(value) {
-        if (typeof value !== "object" || value === null)
+        if (!isPlainObject(value))
             return null;
-        const v = value;
-        const expiresAtMs = v["expiresAtMs"];
+        const expiresAtMs = value["expiresAtMs"];
         if (typeof expiresAtMs !== "number")
             return null;
-        const { expiresAtMs: _drop, ...rest } = v;
+        const { expiresAtMs: _drop, ...rest } = value;
         return isPayload(rest) ? { payload: rest, expiresAtMs } : null;
     }
     return {

package/dist/auth-mfa/mfa-challenge-token.js

@@ -1,10 +1,10 @@
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { createHmacTokenCodec } from "./hmac-token-codec.js";
 function isPayload(value) {
-    if (typeof value !== "object" || value === null)
+    if (!isPlainObject(value))
         return false;
-    const v = value;
-    return typeof v["userId"] === "string" && typeof v["tenantId"] === "string";
+    return typeof value["userId"] === "string" && typeof value["tenantId"] === "string";
 }
 // Domain-separated from mfa-preauth-setup (see hmac-token-codec). Single-use is
 // enforced by the consumer via burnToken (purpose "mfa-challenge"); this codec

package/dist/auth-mfa/mfa-preauth-setup-token.js

@@ -1,10 +1,10 @@
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { createHmacTokenCodec } from "./hmac-token-codec.js";
 function isPayload(value) {
-    if (typeof value !== "object" || value === null)
+    if (!isPlainObject(value))
         return false;
-    const v = value;
-    return typeof v["userId"] === "string" && typeof v["tenantId"] === "string";
+    return typeof value["userId"] === "string" && typeof value["tenantId"] === "string";
 }
 // Domain "mfa-preauth-setup" must never equal the challenge domain: a setup
 // token has to fail verification as a challenge token and vice versa. The

package/dist/auth-mfa/mfa-setup-token.js

@@ -11,6 +11,7 @@
 // generated secret material, not just re-derive it from a lookup.
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 function sign(input, secret) {
     return createHmac("sha256", secret).update(input).digest("base64url");
 }
@@ -22,15 +23,14 @@ export function signMfaSetupToken(payload, ttlMinutes, secret, now = Temporal.No
     return { token: `${bodyB64}.${signature}`, expiresAt };
 }
 function isEncodedBody(value) {
-    if (typeof value !== "object" || value === null)
+    if (!isPlainObject(value))
         return false;
-    const v = value;
-    return (typeof v["userId"] === "string" &&
-        typeof v["totpSecretBase32"] === "string" &&
-        Array.isArray(v["recoveryCodeHashes"]) &&
-        v["recoveryCodeHashes"].every((h) => typeof h === "string") &&
-        typeof v["expiresAtMs"] === "number" &&
-        (v["tenantId"] === undefined || typeof v["tenantId"] === "string"));
+    return (typeof value["userId"] === "string" &&
+        typeof value["totpSecretBase32"] === "string" &&
+        Array.isArray(value["recoveryCodeHashes"]) &&
+        value["recoveryCodeHashes"].every((h) => typeof h === "string") &&
+        typeof value["expiresAtMs"] === "number" &&
+        (value["tenantId"] === undefined || typeof value["tenantId"] === "string"));
 }
 export function verifyMfaSetupToken(token, secret, now = Temporal.Now.instant()) {
     const parts = token.split(".");

package/dist/billing-foundation/constants.d.ts

@@ -3,11 +3,11 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export declare const BILLING_FOUNDATION_FEATURE: "billing-foundation";
 export declare const SUBSCRIPTION_PROVIDER_EXTENSION: "subscriptionProvider";
 /** delivery notification type of the § 312f contract confirmation mail. */
-export declare const CONTRACT_CONFIRMATION_NOTIFICATION_TYPE: "billing-foundation:contract-confirmation";
+export declare const CONTRACT_CONFIRMATION_NOTIFICATION_TYPE: "billing-foundation:notify:contract-confirmation";
 /** delivery notification types of the § 312k termination receipt and the
  *  operator notice. */
-export declare const CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE: "billing-foundation:contract-termination-receipt";
-export declare const CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE: "billing-foundation:contract-termination-operator-notice";
+export declare const CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE: "billing-foundation:notify:contract-termination-receipt";
+export declare const CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE: "billing-foundation:notify:contract-termination-operator-notice";
 export declare const SubscriptionFoundationHandlers: {
     /** Programmatic entry-point für den webhook-handler. Receives the
      *  parsed SubscriptionEvent (vom Plugin schon verifiziert) + macht

package/dist/billing-foundation/constants.js

@@ -1,17 +1,18 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 // @runtime client
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 // Feature name
 export const BILLING_FOUNDATION_FEATURE = "billing-foundation";
 // Extension-point name fuer Provider-Plugins (subscription-stripe,
 // subscription-mollie, ...).
 export const SUBSCRIPTION_PROVIDER_EXTENSION = "subscriptionProvider";
 /** delivery notification type of the § 312f contract confirmation mail. */
-export const CONTRACT_CONFIRMATION_NOTIFICATION_TYPE = "billing-foundation:contract-confirmation";
+export const CONTRACT_CONFIRMATION_NOTIFICATION_TYPE = "billing-foundation:notify:contract-confirmation";
 /** delivery notification types of the § 312k termination receipt and the
  *  operator notice. */
-export const CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE = "billing-foundation:contract-termination-receipt";
-export const CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE = "billing-foundation:contract-termination-operator-notice";
+export const CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE = "billing-foundation:notify:contract-termination-receipt";
+export const CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE = "billing-foundation:notify:contract-termination-operator-notice";
 // Qualified write handler names (QN format: scope:type:name).
 export const SubscriptionFoundationHandlers = {
     /** Programmatic entry-point für den webhook-handler. Receives the
@@ -195,5 +196,5 @@ export const DEFAULT_PURCHASE_ROLES = ["TenantAdmin", "SystemAdmin"];
 // `<plugin-name>:config:price-to-tier`-Key.
 export const TERMINATION_SCOPES = ["tenant-host", "platform"];
 export function isTerminationScope(value) {
-    return TERMINATION_SCOPES.includes(value);
+    return isOneOf(TERMINATION_SCOPES, value);
 }

package/dist/billing-foundation/consumer-protection/confirmation-mail.d.ts

@@ -1,18 +1,37 @@
 import type { CheckoutConsentRecordedPayload } from "../events.js";
-export type ContractConfirmationSection = {
+import { type ConsentLocale } from "./consent-text.js";
+type ConfirmationLabels = {
+    readonly subject: string;
+    readonly intro: string;
+    readonly plan: string;
+    readonly item: string;
+    readonly oneOffPayment: string;
+    readonly price: string;
+    readonly oneOff: string;
+    readonly contractStart: string;
+    readonly currentPeriodEnd: string;
+    readonly consentHeading: string;
+    readonly consentGivenAt: string;
+    readonly termsHeading: string;
+    readonly contact: string;
+    readonly intervals: Readonly<Record<string, {
+        one: string;
+        many: string;
+    }>>;
+    readonly every: string;
+};
+export declare const CONFIRMATION_LABELS: Readonly<Record<ConsentLocale, ConfirmationLabels>>;
+type TextRow = {
     readonly text: string;
-} | {
-    readonly heading: string;
-} | {
-    readonly markdown: string;
 };
-export type ContractConfirmationContent = {
-    readonly subject: string;
-    readonly header: string;
-    readonly sections: readonly ContractConfirmationSection[];
-    readonly footer: string;
+/** Variables of the contract confirmation template. */
+export type ContractConfirmationVariables = {
+    readonly contractLines: readonly TextRow[];
+    readonly consentGivenAt: string;
+    readonly termsParagraphs: readonly TextRow[];
+    readonly operatorEmail: string;
 };
-export type RenderContractConfirmationArgs = {
+export type ContractConfirmationArgs = {
     readonly consent: CheckoutConsentRecordedPayload;
     readonly timeZone: string;
     /** Translated plan name; falls back to the raw tier. */
@@ -26,6 +45,5 @@ export type RenderContractConfirmationArgs = {
     readonly operatorEmail: string;
     readonly termsContent: string;
 };
-/** Structured mail content (header/sections/footer) for the email channel's
- *  renderer; the renderer owns HTML escaping, this only builds plain text. */
-export declare function renderContractConfirmation(args: RenderContractConfirmationArgs): ContractConfirmationContent;
+export declare function contractConfirmationVariables(args: ContractConfirmationArgs): ContractConfirmationVariables;
+export {};

package/dist/billing-foundation/consumer-protection/confirmation-mail.js

@@ -1,6 +1,9 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { CONSENT_TEXTS, resolveConsentLocale } from "./consent-text.js";
-const LABELS = {
+import { Marked } from "marked";
+import { isAllowedDocumentLinkHref, isDocumentPlaceholderHref, } from "../../template-resolver/index.js";
+import { resolveConsentLocale } from "./consent-text.js";
+export const CONFIRMATION_LABELS = {
     de: {
         subject: "Vertragsbestätigung",
         intro: "Vielen Dank für deine Bestellung. Hiermit bestätigen wir den Vertragsschluss mit folgendem Inhalt.",
@@ -47,7 +50,7 @@ const LABELS = {
     },
 };
 function formatPrice(consent, locale) {
-    const labels = LABELS[locale];
+    const labels = CONFIRMATION_LABELS[locale];
     if (consent.unitAmount === null || consent.currency === null)
         return "-";
     let amount;
@@ -89,40 +92,79 @@ function formatDate(iso, locale, timeZone) {
         timeZoneName: "short",
     }).format(epochMilliseconds);
 }
-/** Structured mail content (header/sections/footer) for the email channel's
- *  renderer; the renderer owns HTML escaping, this only builds plain text. */
-export function renderContractConfirmation(args) {
+// One richText row of inline HTML per Markdown block. The sanitizer shows a rejected
+// row as escaped text, so author HTML, images and refused links stay plain text.
+const ROW_END = "\n\n";
+function isMailLinkHref(href) {
+    return isAllowedDocumentLinkHref(href) && !isDocumentPlaceholderHref(href);
+}
+const inlineHtmlMarkdown = new Marked({ gfm: false, breaks: false });
+inlineHtmlMarkdown.use({
+    renderer: {
+        heading({ tokens }) {
+            const headingHtml = this.parser.parseInline(tokens);
+            return `<strong>${headingHtml}</strong>${ROW_END}`;
+        },
+        paragraph({ tokens }) {
+            return `${this.parser.parseInline(tokens)}${ROW_END}`;
+        },
+        code: ({ text }) => `${escapeHtml(text)}${ROW_END}`,
+        blockquote({ tokens }) {
+            return this.parser.parse(tokens);
+        },
+        list({ items }) {
+            return items.map((item) => this.parser.parse(item.tokens)).join("");
+        },
+        hr: () => "",
+        space: () => "",
+        del({ tokens }) {
+            return this.parser.parseInline(tokens);
+        },
+        br: () => " ",
+        html: ({ text }) => escapeHtml(text),
+        image: ({ text }) => escapeHtml(text),
+        text(token) {
+            // Only block-level text (a list item's own text) carries inline child tokens.
+            return "tokens" in token && token.tokens
+                ? `${this.parser.parseInline(token.tokens)}${ROW_END}`
+                : escapeHtml(token.text);
+        },
+        link({ href, tokens }) {
+            const labelHtml = this.parser.parseInline(tokens);
+            if (isMailLinkHref(href))
+                return `<a href="${escapeHtmlAttr(href)}">${labelHtml}</a>`;
+            return labelHtml === escapeHtml(href) ? labelHtml : `${labelHtml} (${escapeHtml(href)})`;
+        },
+    },
+});
+function termsParagraphsOf(markdown) {
+    return inlineHtmlMarkdown
+        .parse(markdown, { async: false })
+        .split(/\n\s*\n/)
+        .map((row) => row.replace(/\s+/g, " ").trim())
+        .filter((row) => row.length > 0)
+        .map((text) => ({ text }));
+}
+export function contractConfirmationVariables(args) {
     const locale = resolveConsentLocale(args.consent.locale);
-    const labels = LABELS[locale];
-    const texts = CONSENT_TEXTS[locale];
-    const { consent } = args;
-    const { timeZone } = args;
+    const labels = CONFIRMATION_LABELS[locale];
+    const { consent, timeZone } = args;
     const subjectLine = consent.mode === "payment"
         ? `${labels.item}: ${args.itemLabel ?? labels.oneOffPayment}`
         : `${labels.plan}: ${args.tierLabel ?? consent.tier ?? labels.oneOffPayment}`;
-    const contractLines = [
-        subjectLine,
-        `${labels.price}: ${formatPrice(consent, locale)}`,
-        `${labels.contractStart}: ${formatDate(args.contractStartIso, locale, timeZone)}`,
-        ...(args.currentPeriodEndIso !== undefined
-            ? [`${labels.currentPeriodEnd}: ${formatDate(args.currentPeriodEndIso, locale, timeZone)}`]
-            : []),
-    ];
     const vatNote = args.vatNote[locale] ?? args.vatNote[resolveConsentLocale()];
     return {
-        subject: labels.subject,
-        header: labels.subject,
-        sections: [
-            { text: labels.intro },
-            ...contractLines.map((text) => ({ text })),
-            ...(vatNote !== undefined ? [{ text: vatNote }] : []),
-            { heading: labels.consentHeading },
-            { text: texts.earlyPerformance },
-            { text: texts.withdrawalLoss },
-            { text: `${labels.consentGivenAt}: ${formatDate(args.consentGivenAtIso, locale, timeZone)}` },
-            { heading: labels.termsHeading },
-            { markdown: args.termsContent },
-        ],
-        footer: `${labels.contact} ${args.operatorEmail}`,
+        contractLines: [
+            subjectLine,
+            `${labels.price}: ${formatPrice(consent, locale)}`,
+            `${labels.contractStart}: ${formatDate(args.contractStartIso, locale, timeZone)}`,
+            ...(args.currentPeriodEndIso !== undefined
+                ? [`${labels.currentPeriodEnd}: ${formatDate(args.currentPeriodEndIso, locale, timeZone)}`]
+                : []),
+            ...(vatNote !== undefined ? [vatNote] : []),
+        ].map((text) => ({ text })),
+        consentGivenAt: formatDate(args.consentGivenAtIso, locale, timeZone),
+        termsParagraphs: termsParagraphsOf(args.termsContent),
+        operatorEmail: args.operatorEmail,
     };
 }

package/dist/billing-foundation/consumer-protection/consent-gate.d.ts

@@ -22,6 +22,9 @@ export type OrderItem = {
     readonly labelKey: string;
     readonly params?: Readonly<Record<string, string | number>>;
 };
+/** Throws an InternalError (an app configuration fault, not a buyer error) for a
+ *  label the consent event could not store. */
+export declare function assertValidOrderItem(item: OrderItem | undefined, priceId: string): void;
 export type ConsentPriceDetails = {
     readonly tier: string | null;
     readonly priceId: string;

package/dist/billing-foundation/consumer-protection/consent-gate.js

@@ -2,12 +2,12 @@
 // validate + prepare before the provider call, record only after it succeeded.
 import { createHash } from "node:crypto";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
+import { InternalError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { requireTemplateResolver, TEXT_BLOCK_KIND, TemplateNotFoundError, } from "../../template-resolver/index.js";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
-import { CHECKOUT_CONSENT_RECORDED_EVENT_QN, PAYMENT_AGGREGATE_TYPE, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
+import { CHECKOUT_CONSENT_RECORDED_EVENT_QN, checkoutConsentRecordedPayloadSchema, PAYMENT_AGGREGATE_TYPE, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
 import { consentTextVersion, resolveConsentLocale, submitMessageFor } from "./consent-text.js";
 // Optional at the schema level so a missing/unchecked consent reaches
 // prepareConsent and fails as 422 consent_required, not as a zod 400.
@@ -19,6 +19,25 @@ export const consentPayloadSchema = z
     locale: z.string().min(2).max(35),
 })
     .strict();
+// Bounds come from the event schema the label ends up in, so an app label that
+// passes here cannot fail the append after the provider session exists.
+const orderItemSchema = z.object({
+    labelKey: checkoutConsentRecordedPayloadSchema.shape.itemLabelKey.unwrap(),
+    params: checkoutConsentRecordedPayloadSchema.shape.itemLabelParams,
+});
+/** Throws an InternalError (an app configuration fault, not a buyer error) for a
+ *  label the consent event could not store. */
+export function assertValidOrderItem(item, priceId) {
+    // skip: subscription checkouts have no one-off order item
+    if (item === undefined)
+        return;
+    const parsed = orderItemSchema.safeParse(item);
+    if (!parsed.success) {
+        throw new InternalError({
+            message: `billing-foundation: consumerProtection.oneOffItemLabel returned an invalid label for priceId "${priceId}": ${parsed.error.message}`,
+        });
+    }
+}
 export async function prepareConsent(ctx, options, consent, mode) {
     if (!consent?.earlyPerformanceRequested || !consent.withdrawalLossAcknowledged) {
         throw new UnprocessableError("consent_required", {

package/dist/billing-foundation/consumer-protection/issue-confirmation.js

@@ -11,7 +11,7 @@ import { UserQueries } from "../../user/index.js";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
 import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../constants.js";
 import { CHECKOUT_CONSENT_RECORDED_EVENT_QN, CONTRACT_CONFIRMATION_ISSUED_EVENT_QN, checkoutConsentRecordedPayloadSchema, contractConfirmationIssuedPayloadSchema, PAYMENT_AGGREGATE_TYPE, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
-import { renderContractConfirmation } from "./confirmation-mail.js";
+import { contractConfirmationVariables } from "./confirmation-mail.js";
 import { resolveConsentLocale } from "./consent-text.js";
 export const issueContractConfirmationSchema = z
     .object({
@@ -128,7 +128,7 @@ export function createIssueContractConfirmationHandler(options, consumerProtecti
                 ? translatedOrUndefined(i18n.t(consent.itemLabelKey, locale, consent.itemLabelParams), consent.itemLabelKey)
                 : undefined;
             const issuedAtIso = options.now().toString();
-            const content = renderContractConfirmation({
+            const variables = contractConfirmationVariables({
                 consent,
                 timeZone: pickTimeZone(recipient.data.timezone, ctx.tz.tenant),
                 ...(tierLabel !== undefined && { tierLabel }),
@@ -159,7 +159,7 @@ export function createIssueContractConfirmationHandler(options, consumerProtecti
             await stream.appendOne({ type: CONTRACT_CONFIRMATION_ISSUED_EVENT_QN, payload: issued });
             await ctx.notify(CONTRACT_CONFIRMATION_NOTIFICATION_TYPE, {
                 route: { email: recipient.data.email },
-                data: content,
+                data: variables,
                 locale,
                 priority: "critical",
             });

package/dist/billing-foundation/consumer-protection/mail-notifications.d.ts

@@ -0,0 +1,8 @@
+import { type FeatureRegistrar, type NotificationLocalizedTemplate, type TemplateVariables } from "@cosmicdrift/kumiko-framework/engine";
+export declare const TERMINATION_RECEIPT_VARIABLES: TemplateVariables;
+export declare const OPERATOR_NOTICE_VARIABLES: TemplateVariables;
+export declare const CONTRACT_CONFIRMATION_VARIABLES: TemplateVariables;
+export declare function terminationReceiptTemplate(): NotificationLocalizedTemplate;
+export declare function operatorNoticeTemplate(): NotificationLocalizedTemplate;
+export declare function contractConfirmationTemplate(): NotificationLocalizedTemplate;
+export declare function registerConsumerProtectionMails(r: FeatureRegistrar): void;

package/dist/billing-foundation/consumer-protection/mail-notifications.js

@@ -0,0 +1,95 @@
+import { templateVariable, } from "@cosmicdrift/kumiko-framework/engine";
+import { mailHeading, mailParagraph, mailRepeatedRows } from "../../shared/index.js";
+import { CONFIRMATION_LABELS } from "./confirmation-mail.js";
+import { CONSENT_LOCALES, CONSENT_TEXTS } from "./consent-text.js";
+import { TERMINATION_TEXTS } from "./termination-texts.js";
+// Slot syntax for the translated texts: `{name}` becomes a template variable.
+const OPERATOR_EMAIL_SLOT = "{operatorEmail}";
+const textRows = () => templateVariable.list({ text: templateVariable.text({ required: true }) }, { required: true });
+export const TERMINATION_RECEIPT_VARIABLES = {
+    subject: templateVariable.text({ required: true }),
+    receivedAt: templateVariable.text({ required: true }),
+    requestId: templateVariable.text({ required: true }),
+    details: textRows(),
+    operatorEmail: templateVariable.text({ required: true }),
+};
+export const OPERATOR_NOTICE_VARIABLES = {
+    subject: templateVariable.text({ required: true }),
+    lines: textRows(),
+    operatorEmail: templateVariable.text({ required: true }),
+};
+export const CONTRACT_CONFIRMATION_VARIABLES = {
+    contractLines: textRows(),
+    consentGivenAt: templateVariable.text({ required: true }),
+    termsParagraphs: templateVariable.list({ text: templateVariable.richText({ required: true }) }, { required: true }),
+    operatorEmail: templateVariable.text({ required: true }),
+};
+function perLocale(build) {
+    return Object.fromEntries(CONSENT_LOCALES.map((locale) => {
+        const { body, subject } = build(locale);
+        return [locale, { body, meta: { subject, category: "transactional" } }];
+    }));
+}
+export function terminationReceiptTemplate() {
+    return perLocale((locale) => {
+        const texts = TERMINATION_TEXTS[locale];
+        return {
+            subject: "{{subject}}",
+            body: [
+                mailParagraph(texts.receiptGreeting),
+                mailParagraph(texts.receiptIntro),
+                mailParagraph(`${texts.receivedAt}: {receivedAt}`),
+                mailParagraph(`${texts.requestId}: {requestId}`),
+                mailRepeatedRows("details", "text"),
+                mailParagraph(texts.receiptNextSteps),
+                mailParagraph(texts.receiptRevoke(OPERATOR_EMAIL_SLOT)),
+                mailParagraph(`${texts.contact} {operatorEmail}`),
+            ].join(""),
+        };
+    });
+}
+export function operatorNoticeTemplate() {
+    return perLocale((locale) => ({
+        subject: "{{subject}}",
+        body: [
+            mailParagraph(TERMINATION_TEXTS[locale].operatorIntro),
+            mailRepeatedRows("lines", "text"),
+            mailParagraph("{operatorEmail}"),
+        ].join(""),
+    }));
+}
+export function contractConfirmationTemplate() {
+    return perLocale((locale) => {
+        const labels = CONFIRMATION_LABELS[locale];
+        const consent = CONSENT_TEXTS[locale];
+        return {
+            subject: labels.subject,
+            body: [
+                mailParagraph(labels.intro),
+                mailRepeatedRows("contractLines", "text"),
+                mailHeading(labels.consentHeading),
+                mailParagraph(consent.earlyPerformance),
+                mailParagraph(consent.withdrawalLoss),
+                mailParagraph(`${labels.consentGivenAt}: {consentGivenAt}`),
+                mailHeading(labels.termsHeading),
+                mailRepeatedRows("termsParagraphs", "text"),
+                mailParagraph(`${labels.contact} {operatorEmail}`),
+            ].join(""),
+        };
+    });
+}
+// The registered notification names are the tail of the QN types in constants.ts.
+export function registerConsumerProtectionMails(r) {
+    r.notification("contract-confirmation", {
+        variables: CONTRACT_CONFIRMATION_VARIABLES,
+        localizedTemplate: contractConfirmationTemplate,
+    });
+    r.notification("contract-termination-receipt", {
+        variables: TERMINATION_RECEIPT_VARIABLES,
+        localizedTemplate: terminationReceiptTemplate,
+    });
+    r.notification("contract-termination-operator-notice", {
+        variables: OPERATOR_NOTICE_VARIABLES,
+        localizedTemplate: operatorNoticeTemplate,
+    });
+}

package/dist/billing-foundation/consumer-protection/register-consent.js

@@ -2,6 +2,7 @@ import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js"
 import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants.js";
 import { CHECKOUT_CONSENT_RECORDED_EVENT_SHORT, CONTRACT_CONFIRMATION_ISSUED_EVENT_SHORT, checkoutConsentRecordedPayloadSchema, contractConfirmationIssuedPayloadSchema, INVOICE_PAID_EVENT_QN, PAYMENT_RECEIVED_EVENT_QN, SUBSCRIPTION_CREATED_EVENT_QN, SUBSCRIPTION_UPDATED_EVENT_QN, } from "../events.js";
 import { createIssueContractConfirmationHandler } from "./issue-confirmation.js";
+import { registerConsumerProtectionMails } from "./mail-notifications.js";
 import { registerContractTermination } from "./register-termination.js";
 const CONFIRMATION_TRIGGERS = [
     {
@@ -22,6 +23,7 @@ function isConfirmableSubscriptionStatus(status) {
 }
 export function registerConsumerProtection(r, options, consumerProtection) {
     r.requires("template-resolver", "delivery", "user", "tenant");
+    registerConsumerProtectionMails(r);
     registerContractTermination(r, options, consumerProtection);
     r.defineEvent(CHECKOUT_CONSENT_RECORDED_EVENT_SHORT, checkoutConsentRecordedPayloadSchema, {
         piiFields: "none",

package/dist/billing-foundation/consumer-protection/register-termination.js

@@ -16,7 +16,17 @@ export function registerContractTermination(r, options, consumerProtection) {
     // request: matched and unmatched requests then do the same work and the
     // response time does not tell whether the email belongs to a customer.
     // The tenant comes from the stored trigger event (the job's system user).
-    r.job("cancel-on-public-termination-declared", { trigger: { on: CONTRACT_TERMINATION_DECLARED_EVENT_QN }, runIn: "worker" }, async (payload, ctx) => {
+    // Every declaration appends to the same subscription stream, so parallel runs
+    // and a declaration arriving mid-run hit version conflicts. Sequential runs
+    // rule out the first; a retry re-reads the stream and the requestId check in
+    // record-contract-termination keeps it from recording twice.
+    r.job("cancel-on-public-termination-declared", {
+        trigger: { on: CONTRACT_TERMINATION_DECLARED_EVENT_QN },
+        runIn: "worker",
+        concurrency: "sequential",
+        retries: 3,
+        backoff: "exponential",
+    }, async (payload, ctx) => {
         const declared = contractTerminationDeclaredPayloadSchema.safeParse(payload);
         // skip: trigger event carries no usable declaration
         if (!declared.success)

package/dist/billing-foundation/consumer-protection/termination-mail.d.ts

@@ -1,13 +1,22 @@
 import type { ContractTerminationDeclarationType, ContractTerminationKind, ProviderCancelOutcome } from "../events.js";
 import type { ConsentLocale } from "./consent-text.js";
 import { type OperatorNoticeReason } from "./termination-texts.js";
-export type TerminationMailContent = {
+type TextRow = {
+    readonly text: string;
+};
+/** Variables of the termination receipt template. */
+export type TerminationReceiptVariables = {
+    readonly subject: string;
+    readonly receivedAt: string;
+    readonly requestId: string;
+    readonly details: readonly TextRow[];
+    readonly operatorEmail: string;
+};
+/** Variables of the operator notice template. */
+export type OperatorNoticeVariables = {
     readonly subject: string;
-    readonly header: string;
-    readonly sections: readonly {
-        readonly text: string;
-    }[];
-    readonly footer: string;
+    readonly lines: readonly TextRow[];
+    readonly operatorEmail: string;
 };
 /** What the declarant entered; the only input of the receipt. */
 export type TerminationDeclaration = {
@@ -21,17 +30,19 @@ export type TerminationDeclaration = {
 /** The operator notice for a provider problem has no declarant data at all. */
 export type OperatorNoticeDeclaration = Pick<TerminationDeclaration, "declarationType" | "terminationKind"> & Partial<Omit<TerminationDeclaration, "declarationType" | "terminationKind">>;
 export declare function formatReceivedAt(iso: string, locale: ConsentLocale): string;
-export type RenderTerminationReceiptArgs = {
+/** The receipt carries enum fields only: free text from an anonymous caller
+ *  must not be echoed to an arbitrary address. */
+export type ReceiptDeclaration = Pick<TerminationDeclaration, "declarationType" | "terminationKind">;
+export type TerminationReceiptArgs = {
     readonly locale: ConsentLocale;
     readonly requestId: string;
     readonly receivedAtIso: string;
-    readonly declaration: TerminationDeclaration;
+    readonly declaration: ReceiptDeclaration;
     readonly operatorEmail: string;
 };
-/** Built from the declarant's own input only: the content must not depend on
- *  whether (or how) the declaration matched a contract. */
-export declare function renderTerminationReceipt(args: RenderTerminationReceiptArgs): TerminationMailContent;
-export type RenderOperatorNoticeArgs = {
+/** The content must not depend on whether (or how) the declaration matched a contract. */
+export declare function terminationReceiptVariables(args: TerminationReceiptArgs): TerminationReceiptVariables;
+export type OperatorNoticeArgs = {
     readonly locale: ConsentLocale;
     readonly requestId: string;
     readonly receivedAtIso: string;
@@ -42,4 +53,5 @@ export type RenderOperatorNoticeArgs = {
     readonly providerCancel?: ProviderCancelOutcome;
     readonly operatorEmail: string;
 };
-export declare function renderOperatorNotice(args: RenderOperatorNoticeArgs): TerminationMailContent;
+export declare function operatorNoticeVariables(args: OperatorNoticeArgs): OperatorNoticeVariables;
+export {};