@cosmicdrift/kumiko-bundled-features 0.369.0 → 0.370.0

package/dist/delivery/attachment-ref.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import type { FileAttachmentRef, InlineAttachmentRef, RenderedPdfAttachmentRef } from "../renderer-foundation/index.js";
+import type { FileAttachmentRef, InlineAttachmentRef, RenderedPdfAttachmentRef } from "../renderer-foundation/index.ts";
 export type { FileAttachmentRef, InlineAttachmentRef, RenderedPdfAttachmentRef };
 export type EmailAttachmentRef = InlineAttachmentRef | FileAttachmentRef | RenderedPdfAttachmentRef;
 export declare const MAX_EMAIL_ATTACHMENTS = 20;

package/dist/delivery/attempt-log.d.ts

@@ -1,5 +1,5 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type DeliveryLogEntry } from "./types.js";
+import { type DeliveryLogEntry } from "./types.ts";
 export declare function appendAttemptEvent(db: DbConnection, registry: Registry, attemptId: string, entry: DeliveryLogEntry): Promise<void>;
 export declare function logAttempt(db: DbConnection, registry: Registry, entry: DeliveryLogEntry): Promise<string>;

package/dist/delivery/channel-context.d.ts

@@ -3,8 +3,8 @@ import { type DbConnection, type TenantDb } from "@cosmicdrift/kumiko-framework/
 import type { ConfigAccessor, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { type MailPayload } from "../renderer-foundation/index.js";
-import type { ChannelContext, RenderedMail } from "./types.js";
+import { type MailPayload } from "../renderer-foundation/index.ts";
+import type { ChannelContext, RenderedMail } from "./types.ts";
 export declare function createTemplateMailRenderer(db: DbConnection | TenantDb, registry: Registry, tenantId: TenantId, config: ConfigAccessor | undefined): (payload: MailPayload) => Promise<RenderedMail>;
 export declare function createEmailAttachmentReader(db: DbConnection | TenantDb, registry: Registry, tenantId: TenantId, config: ConfigAccessor | undefined, filesForTenant: (tenantId: string) => FileContext | undefined): NonNullable<ChannelContext["readAttachment"]>;
 export declare function buildChannelContext(db: DbConnection, registry: Registry, sseBroker: SseBroker | undefined, tenantId: TenantId, secrets?: SecretsContext, tenantConfig?: ConfigAccessor, filesForTenant?: (tenantId: string) => FileContext | undefined): ChannelContext;

package/dist/delivery/chat-webhook-channel.d.ts

@@ -1,5 +1,5 @@
-import { type ChatSendResult, type ChatWebhookRequest, type ChatWebhookTarget } from "./chat-webhook-sender.js";
-import type { ChannelMessage, ChannelResult, DeliveryChannel } from "./types.js";
+import { type ChatSendResult, type ChatWebhookRequest, type ChatWebhookTarget } from "./chat-webhook-sender.ts";
+import type { ChannelMessage, ChannelResult, DeliveryChannel } from "./types.ts";
 export type ChatWebhookChannelOptions = {
     readonly allowedHosts?: readonly string[];
     readonly requireHttps?: boolean;

package/dist/delivery/constants.d.ts

@@ -1,7 +1,7 @@
 import type { NotifyPriority } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DELIVERY_CHANNEL_EXTENSION: "deliveryChannel";
 export declare const EMAIL_CHANNEL_NAME: "email";
-export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.js";
+export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_RESUBSCRIBE_PATH, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobNames, DeliveryQueries, DeliveryStatus, type DeliveryStatusValue, } from "./public-names.ts";
 export declare function deliveryIdempotencyRedisKey(tenantId: string, key: string): string;
 export declare const deliveryPriorityRank: Record<NotifyPriority, number>;
 export declare const DeliveryJobs: {

package/dist/delivery/delivery-service.d.ts

@@ -5,8 +5,8 @@ import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
 import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
-import { type DeliveryChannel, type DeliveryService } from "./types.js";
-import { type UnsubscribeLinkConfig } from "./unsubscribe-link.js";
+import { type DeliveryChannel, type DeliveryService } from "./types.ts";
+import { type UnsubscribeLinkConfig } from "./unsubscribe-link.ts";
 export declare function redactedMessageOf(err: unknown): string;
 export type RateLimitConfig = {
     readonly redis: Redis;

package/dist/delivery/feature.js

@@ -10,6 +10,7 @@ import { resubscribeAddressWrite } from "./handlers/resubscribe-address.write.js
 import { resubscribeUserWrite } from "./handlers/resubscribe-user.write.js";
 import { setPreferenceWrite } from "./handlers/set-preference.write.js";
 import { unsubscribeAddressWrite } from "./handlers/unsubscribe-address.write.js";
+import { unsubscribePageChromeQuery } from "./handlers/unsubscribe-page-chrome.query.js";
 import { unsubscribeUserWrite } from "./handlers/unsubscribe-user.write.js";
 import { DELIVERY_I18N } from "./i18n.js";
 import { deliveryRenderJob, deliverySendJob } from "./jobs.js";
@@ -156,6 +157,7 @@ export function createDeliveryFeature(options) {
         const queries = {
             log: r.queryHandler({ ...logQuery, access: { roles: resolvedAccess } }),
             preferences: r.queryHandler(preferencesQuery),
+            unsubscribePageChrome: r.queryHandler(unsubscribePageChromeQuery),
         };
         r.screen({
             id: DELIVERY_LOG_SCREEN_ID,

package/dist/delivery/handlers/log.query.d.ts

@@ -1,6 +1,6 @@
 import { type DeliveryErrorCode, type NotifyPriority } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import type { DeliveryStatusValue } from "../constants.js";
+import type { DeliveryStatusValue } from "../constants.ts";
 export declare const logQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"log", z.ZodObject<{
     cursor: z.ZodOptional<z.ZodString>;
     limit: z.ZodDefault<z.ZodNumber>;

package/dist/delivery/handlers/unsubscribe-page-chrome.query.d.ts

@@ -0,0 +1,5 @@
+import * as z from "zod";
+import { type MailChrome } from "../../renderer-foundation/index.ts";
+export declare const unsubscribePageChromeQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"unsubscribePageChrome", z.ZodObject<{
+    locale: z.ZodString;
+}, z.core.$strip>, MailChrome | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/delivery/handlers/unsubscribe-page-chrome.query.js

@@ -0,0 +1,44 @@
+import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import * as z from "zod";
+import { collectRendererPlugins, createRendererFoundationApi, RendererError, } from "../../renderer-foundation/index.js";
+function mailChromePlugin(plugins, tenantId) {
+    try {
+        const plugin = createRendererFoundationApi(plugins).createRendererForTenant({
+            tenantId,
+            kind: "mail",
+        });
+        return plugin.readMailChrome === undefined ? null : plugin;
+    }
+    catch (e) {
+        if (e instanceof RendererError && e.code === "no_plugin_for_kind")
+            return null;
+        throw e;
+    }
+}
+export const unsubscribePageChromeQuery = defineQueryHandler({
+    name: "unsubscribePageChrome",
+    schema: z.object({ locale: z.string().min(2).max(35) }),
+    access: { roles: access.systemAdmin },
+    // Only reachable via createUnsubscribeRoutes' dispatchSystemQuery once verify()
+    // proved the token signature.
+    agent: { expose: false },
+    description: "Returns the tenant's mail brand row and footer resolved for one locale, or null without a mail renderer; dispatched by the signed unsubscribe route to dress its pages like the mail, not meant for UI callers.",
+    handler: async (query, ctx) => {
+        const { tenantId } = query.user;
+        if (!ctx.systemDb) {
+            throw new InternalError({
+                message: "unsubscribePageChrome: ctx.systemDb missing on a system-scoped handler",
+            });
+        }
+        const plugin = mailChromePlugin(collectRendererPlugins(ctx.registry), tenantId);
+        if (plugin?.readMailChrome === undefined)
+            return null;
+        return plugin.readMailChrome({ locale: query.payload.locale }, {
+            db: ctx.systemDb.assertTenantMatch(tenantId),
+            registry: ctx.registry,
+            tenantId,
+            ...(ctx.config !== undefined && { config: ctx.config }),
+        });
+    },
+});

package/dist/delivery/index.d.ts

@@ -1,20 +1,20 @@
-export { sanitizePdfAttachmentFileName } from "../shared/index.js";
-export { hashUnsubscribeAddress } from "./address-opt-out.js";
-export { DELIVERY_ENVELOPE_DATA_KEYS, type EmailAttachmentRef, emailAttachmentRefSchema, type FileAttachmentRef, fileAttachmentRefSchema, type InlineAttachmentRef, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, type RenderedPdfAttachmentRef, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
-export { type AttemptLogRetentionOptions, DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
-export { buildChannelContext, createEmailAttachmentReader, createTemplateMailRenderer, } from "./channel-context.js";
-export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";
-export { type ChatSendFailureCode, type ChatSendResult, type ChatWebhookRequest, type ChatWebhookResponse, type ChatWebhookTarget, chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.js";
-export type { DeliveryStatusValue } from "./constants.js";
-export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, EMAIL_CHANNEL_NAME, } from "./constants.js";
-export { collectChannels, createDeliveryService, type DeliveryServiceOptions, type KillSwitchResolver, type RateLimitConfig, } from "./delivery-service.js";
-export { createDeliveryFeature, type DeliveryFeatureOptions } from "./feature.js";
-export { type UnsubscribeAddressPayload, unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.js";
-export { currentNotificationType } from "./notification-type-aliases.js";
-export { createDeliveryNotifyFactory } from "./notify-factory.js";
-export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.js";
-export { type CreateDeliveryTestContextOptions, createDeliveryTestContext } from "./testing.js";
-export { type AttachmentOrigin, type ChannelContext, type ChannelMessage, type ChannelResult, type DeliveryChannel, type DeliveryChannelMode, type DeliveryChannelPlugin, type DeliveryLogEntry, type DeliveryService, isDeliveryChannelPlugin, type RenderedMessage, } from "./types.js";
-export { type AddressUnsubscribeTokenPayload, createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, renderUnsubscribeResultPage, signAddressUnsubscribeToken, signUnsubscribeToken, type UnsubscribeResultPage, type UnsubscribeRouteOptions, type UnsubscribeTokenPayload, } from "./unsubscribe.js";
-export type { UnsubscribeLinkConfig } from "./unsubscribe-link.js";
-export { UNSUBSCRIBE_PAGE_EN } from "./unsubscribe-page-strings.js";
+export { sanitizePdfAttachmentFileName } from "../shared/index.ts";
+export { hashUnsubscribeAddress } from "./address-opt-out.ts";
+export { DELIVERY_ENVELOPE_DATA_KEYS, type EmailAttachmentRef, emailAttachmentRefSchema, type FileAttachmentRef, fileAttachmentRefSchema, type InlineAttachmentRef, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, type RenderedPdfAttachmentRef, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.ts";
+export { type AttemptLogRetentionOptions, DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.ts";
+export { buildChannelContext, createEmailAttachmentReader, createTemplateMailRenderer, } from "./channel-context.ts";
+export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.ts";
+export { type ChatSendFailureCode, type ChatSendResult, type ChatWebhookRequest, type ChatWebhookResponse, type ChatWebhookTarget, chatConnectionNameSchema, chatWebhookUrlSchema, checkChatWebhookTarget, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, truncateChars, } from "./chat-webhook-sender.ts";
+export type { DeliveryStatusValue } from "./constants.ts";
+export { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, DELIVERY_CHANNEL_EXTENSION, DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID, DELIVERY_UNSUBSCRIBE_PATH, DeliveryErrors, DeliveryHandlers, DeliveryJobs, DeliveryQueries, DeliveryStatus, EMAIL_CHANNEL_NAME, } from "./constants.ts";
+export { collectChannels, createDeliveryService, type DeliveryServiceOptions, type KillSwitchResolver, type RateLimitConfig, } from "./delivery-service.ts";
+export { createDeliveryFeature, type DeliveryFeatureOptions } from "./feature.ts";
+export { type UnsubscribeAddressPayload, unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.ts";
+export { currentNotificationType } from "./notification-type-aliases.ts";
+export { createDeliveryNotifyFactory } from "./notify-factory.ts";
+export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.ts";
+export { type CreateDeliveryTestContextOptions, createDeliveryTestContext } from "./testing.ts";
+export { type AttachmentOrigin, type ChannelContext, type ChannelMessage, type ChannelResult, type DeliveryChannel, type DeliveryChannelMode, type DeliveryChannelPlugin, type DeliveryLogEntry, type DeliveryService, isDeliveryChannelPlugin, type RenderedMessage, } from "./types.ts";
+export { type AddressUnsubscribeTokenPayload, createUnsubscribeRoutes, DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, renderUnsubscribeResultPage, signAddressUnsubscribeToken, signUnsubscribeToken, type UnsubscribeResultPage, type UnsubscribeRouteOptions, type UnsubscribeTokenPayload, } from "./unsubscribe.ts";
+export type { UnsubscribeLinkConfig } from "./unsubscribe-link.ts";
+export { UNSUBSCRIBE_PAGE_EN } from "./unsubscribe-page-strings.ts";

package/dist/delivery/notify-factory.d.ts

@@ -1,5 +1,5 @@
 import type { NotifyFactory } from "@cosmicdrift/kumiko-framework/engine";
-import type { DeliveryService } from "./types.js";
+import type { DeliveryService } from "./types.ts";
 export declare function createDeliveryNotifyFactory(deliveryService: Pick<DeliveryService, "notify">, options?: {
     readonly deliverQueuedInline?: boolean;
 }): NotifyFactory;

package/dist/delivery/public-names.d.ts

@@ -11,6 +11,7 @@ export declare const DELIVERY_RESUBSCRIBE_PATH: "/api/delivery/resubscribe";
 export declare const DeliveryQueries: {
     readonly log: "delivery:query:log";
     readonly preferences: "delivery:query:preferences";
+    readonly unsubscribePageChrome: "delivery:query:unsubscribe-page-chrome";
 };
 export declare const DELIVERY_LOG_SCREEN_ID: "delivery-log";
 export declare const DELIVERY_STATUS_CELL_COMPONENT: "DeliveryStatusCell";

package/dist/delivery/public-names.js

@@ -20,6 +20,7 @@ export const DELIVERY_RESUBSCRIBE_PATH = "/api/delivery/resubscribe";
 export const DeliveryQueries = {
     log: "delivery:query:log",
     preferences: "delivery:query:preferences",
+    unsubscribePageChrome: "delivery:query:unsubscribe-page-chrome",
 };
 export const DELIVERY_LOG_SCREEN_ID = "delivery-log";
 // Client column-renderer registered for the delivery-log screen's status

package/dist/delivery/testing.d.ts

@@ -6,9 +6,9 @@ import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
-import type { KillSwitchResolver, RateLimitConfig } from "./delivery-service.js";
-import type { DeliveryService } from "./types.js";
-import type { UnsubscribeLinkConfig } from "./unsubscribe-link.js";
+import type { KillSwitchResolver, RateLimitConfig } from "./delivery-service.ts";
+import type { DeliveryService } from "./types.ts";
+import type { UnsubscribeLinkConfig } from "./unsubscribe-link.ts";
 export type CreateDeliveryTestContextOptions = {
     readonly tenantUserIdsQuery?: string;
     readonly rateLimit?: RateLimitConfig;

package/dist/delivery/types.d.ts

@@ -3,9 +3,9 @@ import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigAccessor, DeliveryErrorCode, NotifyDeliveryStatus, NotifyDispatched, NotifyJobDispatcher, NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import type { MailPayload, RenderedTemplateRef } from "../renderer-foundation/index.js";
-import type { EmailAttachmentRef } from "./attachment-ref.js";
-import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
+import type { MailPayload, RenderedTemplateRef } from "../renderer-foundation/index.ts";
+import type { EmailAttachmentRef } from "./attachment-ref.ts";
+import { DELIVERY_CHANNEL_EXTENSION } from "./constants.ts";
 export type RenderedMail = {
     readonly subject: string;
     readonly html: string;

package/dist/delivery/unsubscribe-link.d.ts

@@ -1,5 +1,5 @@
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { ChannelContext } from "./types.js";
+import type { ChannelContext } from "./types.ts";
 /** Secret shared with `createUnsubscribeRoutes` plus the public origin the links point at. */
 export type UnsubscribeLinkConfig = {
     readonly secret: string;

package/dist/delivery/unsubscribe-page-strings.d.ts

@@ -5,7 +5,11 @@ export declare const UNSUBSCRIBE_PAGE_EN: {
     readonly "mail.unsubscribe.doneTitle": "Unsubscribed";
     readonly "mail.unsubscribe.doneMessage": "You have been unsubscribed.";
     readonly "mail.unsubscribe.undoButton": "Undo";
+    readonly "mail.unsubscribe.undoHint": "Unsubscribed by mistake? You can undo it within the next hour.";
     readonly "mail.unsubscribe.resubscribedTitle": "Subscribed again";
     readonly "mail.unsubscribe.resubscribedMessage": "You have been subscribed again.";
     readonly "mail.unsubscribe.failed": "That did not work. Please try again later.";
+    readonly "mail.unsubscribe.failedTitle": "Something went wrong";
+    readonly "mail.unsubscribe.invalidTitle": "Link no longer valid";
+    readonly "mail.unsubscribe.invalidMessage": "This link is invalid or has expired. Please use the unsubscribe link in a more recent email.";
 };

package/dist/delivery/unsubscribe-page-strings.js

@@ -8,8 +8,12 @@ export const UNSUBSCRIBE_PAGE_EN = {
     "mail.unsubscribe.doneTitle": "Unsubscribed",
     "mail.unsubscribe.doneMessage": "You have been unsubscribed.",
     "mail.unsubscribe.undoButton": "Undo",
+    "mail.unsubscribe.undoHint": "Unsubscribed by mistake? You can undo it within the next hour.",
     "mail.unsubscribe.resubscribedTitle": "Subscribed again",
     "mail.unsubscribe.resubscribedMessage": "You have been subscribed again.",
     "mail.unsubscribe.failed": "That did not work. Please try again later.",
+    "mail.unsubscribe.failedTitle": "Something went wrong",
+    "mail.unsubscribe.invalidTitle": "Link no longer valid",
+    "mail.unsubscribe.invalidMessage": "This link is invalid or has expired. Please use the unsubscribe link in a more recent email.",
 };
 registerMailTranslations("en", UNSUBSCRIBE_PAGE_EN);

package/dist/delivery/unsubscribe-page.d.ts

@@ -0,0 +1,27 @@
+import type { MailChrome } from "../renderer-foundation/index.ts";
+import "./unsubscribe-page-strings.ts";
+export type UnsubscribePageState = {
+    readonly kind: "confirm";
+    readonly token: string;
+} | {
+    readonly kind: "unsubscribed";
+    readonly resubscribeToken?: string;
+} | {
+    readonly kind: "resubscribed";
+} | {
+    readonly kind: "failed";
+} | {
+    readonly kind: "invalid";
+};
+export type UnsubscribePageInput = {
+    readonly state: UnsubscribePageState;
+    /** A locale with registered mail translations (see resolveMailLocale). */
+    readonly locale: string;
+    /** The tenant's mail look; without it the page shows the plain card. */
+    readonly chrome?: MailChrome | null | undefined;
+};
+export type RenderedUnsubscribePage = {
+    readonly html: string;
+    readonly contentSecurityPolicy: string;
+};
+export declare function renderUnsubscribePage(input: UnsubscribePageInput): RenderedUnsubscribePage;

package/dist/delivery/unsubscribe-page.js

@@ -0,0 +1,192 @@
+import { createHash } from "node:crypto";
+import { mailT } from "@cosmicdrift/kumiko-framework/i18n";
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { DELIVERY_RESUBSCRIBE_PATH, DELIVERY_UNSUBSCRIBE_PATH } from "./public-names.js";
+import "./unsubscribe-page-strings.js";
+// Same values as the in-code mail layout of renderer-mail-html, so the page reads as the mail's sequel.
+const DEFAULT_ACCENT_COLOR = "#1f5468";
+const HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+const FONT_URL_PREFIX = "/assets/kumiko/fonts/ibm-plex-sans-latin-";
+function accentOf(chrome) {
+    const accent = chrome?.accentColor;
+    return accent !== undefined && HEX_COLOR.test(accent) ? accent : DEFAULT_ACCENT_COLOR;
+}
+function httpsOrigin(url) {
+    if (url === undefined)
+        return undefined;
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" ? parsed.origin : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function webHost(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.host : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const SAFE_LINK_URL = /^(https?:|mailto:)/i;
+function linkHtml(link) {
+    const url = link.url.trim();
+    if (!SAFE_LINK_URL.test(url) || link.label.trim() === "")
+        return "";
+    return `<a href="${escapeHtmlAttr(url)}">${escapeHtml(link.label)}</a>`;
+}
+// The style block is static apart from the validated hex accent and the markup carries
+// no style attributes, so the CSP admits exactly this block by its hash.
+function pageStyle(accent) {
+    return `@font-face{font-family:"IBM Plex Sans";font-style:normal;font-weight:400;font-display:swap;src:url("${FONT_URL_PREFIX}400.woff2") format("woff2")}
+@font-face{font-family:"IBM Plex Sans";font-style:normal;font-weight:600;font-display:swap;src:url("${FONT_URL_PREFIX}600.woff2") format("woff2")}
+:root{--accent:${accent}}
+*{box-sizing:border-box}
+html,body{margin:0;padding:0}
+body{background:#ecedea;color:#2a2f3a;font-family:"IBM Plex Sans",ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;font-size:16px;line-height:1.65;-webkit-font-smoothing:antialiased}
+.page{max-width:560px;margin:0 auto;padding:48px 16px}
+.card{background:#fff;border:1px solid #dcdfda;border-radius:14px;overflow:hidden}
+.accent{height:4px;background:var(--accent)}
+.brand{display:flex;align-items:center;gap:10px;padding:32px 40px 0}
+.brand img{height:28px;width:auto;max-width:140px;display:block}
+.tile{width:28px;height:28px;line-height:28px;border-radius:8px;background:var(--accent);color:#fff;font-weight:600;font-size:14px;text-align:center;flex:none}
+.name{font-size:15px;font-weight:600;color:#0b0d12}
+.suffix{font-size:13px;color:#5a6170}
+.content{padding:28px 40px 36px}
+h1{margin:0 0 8px;font-size:22px;line-height:1.3;font-weight:600;color:#0b0d12}
+p{margin:0}
+form{margin:24px 0 0}
+.button{display:inline-block;font:inherit;font-weight:600;font-size:15px;line-height:1.4;padding:10px 20px;border-radius:6px;border:1px solid var(--accent);background:var(--accent);color:#fff;cursor:pointer}
+.button.secondary{background:#fff;color:var(--accent)}
+.button:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+.hint{margin-top:24px;font-size:14px;color:#5a6170}
+.hint+form{margin-top:12px}
+.band{background:#fbfbfa;border-top:1px solid #ecedea;padding:16px 40px;font-size:13px;color:#5a6170}
+.band a{color:#4a515e}
+.footer{padding:20px 24px 0;text-align:center;font-size:12px;color:#5a6170}
+.footer a{color:#5a6170}
+@media (max-width:480px){.page{padding:24px 12px}.brand{padding:24px 20px 0}.content{padding:20px 20px 28px}.band{padding:14px 20px}h1{font-size:20px}.button{width:100%}}`;
+}
+function brandRowHtml(chrome) {
+    const name = chrome.tenantName.trim();
+    const initial = Array.from(name)[0]?.toLocaleUpperCase() ?? "";
+    const mark = httpsOrigin(chrome.logoUrl) !== undefined && chrome.logoUrl !== undefined
+        ? `<img src="${escapeHtmlAttr(chrome.logoUrl)}" alt="">`
+        : initial === ""
+            ? ""
+            : `<span class="tile" aria-hidden="true">${escapeHtml(initial)}</span>`;
+    const suffix = chrome.brandSuffix.trim();
+    if (mark === "" && name === "")
+        return "";
+    return `<div class="brand">${mark}${name === "" ? "" : `<span class="name">${escapeHtml(name)}</span>`}${suffix === "" ? "" : `<span class="suffix">${escapeHtml(suffix)}</span>`}</div>`;
+}
+function bandHtml(chrome) {
+    const host = chrome.siteUrl === undefined ? undefined : webHost(chrome.siteUrl);
+    if (host === undefined || chrome.siteUrl === undefined)
+        return "";
+    return `<div class="band"><a href="${escapeHtmlAttr(chrome.siteUrl)}">${escapeHtml(host)}</a></div>`;
+}
+function footerHtml(chrome) {
+    const text = chrome.footerText?.trim() ?? "";
+    const links = [chrome.imprint, chrome.privacy]
+        .map((link) => (link === undefined ? "" : linkHtml(link)))
+        .filter((html) => html !== "");
+    const lineHtmls = [
+        ...(text === "" ? [] : [escapeHtml(text)]),
+        ...(links.length === 0 ? [] : [links.join(" · ")]),
+    ];
+    const linesHtml = lineHtmls.join("<br>");
+    return linesHtml === "" ? "" : `<footer class="footer">${linesHtml}</footer>`;
+}
+function tokenForm(action, token, label, variant) {
+    return `<form method="post" action="${escapeHtmlAttr(action)}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(token)}">
+<button type="submit" class="${escapeHtmlAttr(variant)}">${escapeHtml(label)}</button>
+</form>`;
+}
+function pageText(state, lang) {
+    const paragraph = (key) => `<p>${escapeHtml(mailT(lang, key))}</p>`;
+    switch (state.kind) {
+        case "confirm":
+            return {
+                title: mailT(lang, "mail.unsubscribe.confirmTitle"),
+                bodyHtml: `${paragraph("mail.unsubscribe.confirmQuestion")}
+${tokenForm(DELIVERY_UNSUBSCRIBE_PATH, state.token, mailT(lang, "mail.unsubscribe.confirmButton"), "button")}`,
+            };
+        case "unsubscribed":
+            return {
+                title: mailT(lang, "mail.unsubscribe.doneTitle"),
+                bodyHtml: state.resubscribeToken === undefined
+                    ? paragraph("mail.unsubscribe.doneMessage")
+                    : `${paragraph("mail.unsubscribe.doneMessage")}
+<p class="hint">${escapeHtml(mailT(lang, "mail.unsubscribe.undoHint"))}</p>
+${tokenForm(DELIVERY_RESUBSCRIBE_PATH, state.resubscribeToken, mailT(lang, "mail.unsubscribe.undoButton"), "button secondary")}`,
+            };
+        case "resubscribed":
+            return {
+                title: mailT(lang, "mail.unsubscribe.resubscribedTitle"),
+                bodyHtml: paragraph("mail.unsubscribe.resubscribedMessage"),
+            };
+        case "failed":
+            return {
+                title: mailT(lang, "mail.unsubscribe.failedTitle"),
+                bodyHtml: paragraph("mail.unsubscribe.failed"),
+            };
+        case "invalid":
+            return {
+                title: mailT(lang, "mail.unsubscribe.invalidTitle"),
+                bodyHtml: paragraph("mail.unsubscribe.invalidMessage"),
+            };
+    }
+}
+// The page loads nothing but its own style block, the same-origin font and, with
+// branding, the tenant's https logo. Forms only post back to the same origin.
+function contentSecurityPolicy(style, chrome) {
+    const styleHash = createHash("sha256").update(style).digest("base64");
+    const logoOrigin = httpsOrigin(chrome?.logoUrl);
+    return [
+        "default-src 'none'",
+        `style-src 'sha256-${styleHash}'`,
+        "font-src 'self'",
+        `img-src 'self' data:${logoOrigin === undefined ? "" : ` ${logoOrigin}`}`,
+        "form-action 'self'",
+        "base-uri 'none'",
+        "frame-ancestors 'none'",
+    ].join("; ");
+}
+export function renderUnsubscribePage(input) {
+    const { state, locale, chrome } = input;
+    const { title, bodyHtml } = pageText(state, locale);
+    const style = pageStyle(accentOf(chrome));
+    const branded = chrome !== null && chrome !== undefined;
+    // html-ok: static CSS whose only variable is the hex-validated accent; escaping would break its quotes and the CSP hash.
+    const styleBlockHtml = `<style>${style}</style>`;
+    const html = `<!doctype html>
+<html lang="${escapeHtmlAttr(locale)}">
+<head>
+<meta charset="utf-8">
+<meta name="robots" content="noindex">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+${styleBlockHtml}
+</head>
+<body>
+<main class="page">
+<div class="card">
+<div class="accent"></div>
+${branded ? brandRowHtml(chrome) : ""}
+<div class="content">
+<h1>${escapeHtml(title)}</h1>
+${bodyHtml}
+</div>
+${branded ? bandHtml(chrome) : ""}
+</div>
+${branded ? footerHtml(chrome) : ""}
+</main>
+</body>
+</html>`;
+    return { html, contentSecurityPolicy: contentSecurityPolicy(style, chrome) };
+}

package/dist/delivery/unsubscribe.d.ts

@@ -1,6 +1,6 @@
 import { type ExtraRouteDefinition } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import "./unsubscribe-page-strings.js";
+import type { MailChrome } from "../renderer-foundation/index.ts";
 export type UnsubscribeTokenPayload = {
     readonly userId: string;
     readonly tenantId: TenantId;
@@ -41,10 +41,18 @@ export type UnsubscribeResultPage = {
     readonly kind: "resubscribed";
 } | {
     readonly kind: "failed";
+} | {
+    readonly kind: "invalid";
 };
-/** The plain result page the unsubscribe routes answer with, for apps serving their own
- *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`. */
+/** The result page the unsubscribe routes answer with, for apps serving their own
+ *  (e.g. legacy) unsubscribe links. Texts come from the mail translations of `locale`;
+ *  `chrome` (the mail renderer's readMailChrome) adds the tenant's brand row and footer.
+ *  Served under runProdApp's default CSP the style block and the same-origin font pass;
+ *  an https logo additionally needs its origin, e.g.
+ *  `securityHeaders: { csp: { extend: { "img-src": [logoOrigin] } } }`. A hand-written CSP
+ *  needs `style-src 'unsafe-inline'` as well. */
 export declare function renderUnsubscribeResultPage(page: UnsubscribeResultPage & {
     readonly locale?: string | undefined;
+    readonly chrome?: MailChrome | null | undefined;
 }): string;
 export declare function createUnsubscribeRoutes(options: UnsubscribeRouteOptions): readonly ExtraRouteDefinition[];