@cosmicdrift/kumiko-bundled-features 0.377.0 → 0.379.0

package/dist/auth-mfa/handlers/verify.write.js

@@ -5,13 +5,13 @@ import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared/index.js";
 import { USER_STATUS, UserQueries } from "../../user/index.js";
-import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants.js";
 import { findUserMfaRow } from "../db/queries.js";
 import { invalidChallengeToken, invalidTotpCode, tooManyAttempts } from "../errors.js";
 import { verifyMfaChallengeToken } from "../mfa-challenge-token.js";
 import { clearMfaVerifyAttempts, getMfaVerifyLockoutState, recordFailedMfaVerifyAttempt, } from "../mfa-verify-attempts.js";
 import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.js";
 import { verifyMfaFactor } from "../verify-factor.js";
+import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../web/constants.js";
 const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
     entityName: "user-mfa",
 });

package/dist/auth-mfa/index.d.ts

@@ -1,6 +1,5 @@
 export { base32Decode } from "./base32.ts";
 export { type MfaRequiredPolicy, mfaRequiredConfigHandle } from "./config.ts";
-export { AUTH_MFA_FEATURE, AuthMfaHandlers, AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./constants.ts";
 export { authMfaEnvSchema, mfaTokenSecretsEnvSchema } from "./env.ts";
 export type { AuthMfaFeatureOptions } from "./feature.ts";
 export { createAuthMfaFeature } from "./feature.ts";
@@ -10,3 +9,4 @@ export type { MfaCodeVerifier, MfaCodeVerifyResult } from "./mfa-code-verifier.t
 export type { MfaStatusChecker, MfaStatusCheckResult } from "./mfa-status-checker.ts";
 export { userMfaEntity, userMfaTable } from "./schema/user-mfa.ts";
 export { type MfaTokenSecretOverrides, type MfaTokenSecretsEnv, type ResolvedMfaTokenSecrets, resolveMfaTokenSecrets, resolveMfaTokenSecretsFromEnv, } from "./token-secrets.ts";
+export { AUTH_MFA_FEATURE, AuthMfaHandlers, AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./web/constants.ts";

package/dist/auth-mfa/index.js

@@ -1,8 +1,8 @@
 export { base32Decode } from "./base32.js";
 export { mfaRequiredConfigHandle } from "./config.js";
-export { AUTH_MFA_FEATURE, AuthMfaHandlers, AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./constants.js";
 export { authMfaEnvSchema, mfaTokenSecretsEnvSchema } from "./env.js";
 export { createAuthMfaFeature } from "./feature.js";
 export { bindMfaRevokeAllOtherSessionsFromFeature, bindMfaTokenSecretsFromFeature, bindRevokeAllPatTokensFromFeature, mfaStatusCheckerFromFeature, mfaVerifierFromFeature, } from "./feature-exports.js";
 export { userMfaEntity, userMfaTable } from "./schema/user-mfa.js";
 export { resolveMfaTokenSecrets, resolveMfaTokenSecretsFromEnv, } from "./token-secrets.js";
+export { AUTH_MFA_FEATURE, AuthMfaHandlers, AuthMfaQueries, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./web/constants.js";

package/dist/auth-mfa/mfa-status-checker.js

@@ -1,10 +1,10 @@
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { access, declareEscapeHatch, } from "@cosmicdrift/kumiko-framework/engine";
 import { mfaRequiredConfigHandle, mfaRequiredConfigKey } from "./config.js";
-import { MFA_CHALLENGE_TOKEN_TTL_MINUTES, MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES, } from "./constants.js";
 import { findUserMfaRow } from "./db/queries.js";
 import { signMfaChallengeToken } from "./mfa-challenge-token.js";
 import { signMfaPreauthSetupToken } from "./mfa-preauth-setup-token.js";
+import { MFA_CHALLENGE_TOKEN_TTL_MINUTES, MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES, } from "./web/constants.js";
 export function createMfaStatusChecker(opts) {
     return async (ctx, userId, tenantId, roles) => {
         declareEscapeHatch({

package/dist/auth-mfa/screens.js

@@ -1,5 +1,5 @@
 import { i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { AuthMfaHandlers, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./constants.js";
+import { AuthMfaHandlers, MFA_DISABLE_SCREEN_ID, MFA_ENABLE_SCREEN_ID, MFA_REGENERATE_RECOVERY_SCREEN_ID, } from "./web/constants.js";
 // Declarative TOTP-enrollment screen: mint (no input) -> reveal QR/secret/
 // recovery-codes -> confirm with a 6-digit code. `setupToken` is carried
 // from the mint payload into the confirm payload but never listed in

package/dist/auth-mfa/web/client-plugin.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Client-Feature-Factory für auth-mfa — mirrors emailPasswordClient()'s
 // shape so apps register both the same way:
 // createKumikoApp({ clientFeatures: [emailPasswordClient(), authMfaClient()] }).

package/dist/auth-mfa/{constants.js → web/constants.js}

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure constants — client-marked so auth-mfa/web/ may import handler QNs
 // and the screen id without pulling the feature's server runtime barrel.
 // Qualified write-handler names — feature is registered as "auth-mfa", each

package/dist/auth-mfa/web/i18n.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Default-Bundles für die auth-mfa Feature-UI. Merged in mit
 // authMfaClient() analog zu emailPasswordClient() aus auth-email-password.
 // Keys folgen `auth.mfa.<area>.<slug>`.

package/dist/auth-mfa/web/index.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Public exports für die Browser-Seite des auth-mfa Features. Sub-Path-
 // Export `@cosmicdrift/kumiko-bundled-features/auth-mfa/web` — Server-Seite
 // (defineFeature) bleibt frei von React-/DOM-Deps, siehe auth-email-

package/dist/auth-mfa/web/mfa-client.js

@@ -1,4 +1,3 @@
-// @runtime client
 // Browser-Seite von POST /api/auth/mfa/verify — completes the two-step
 // login LoginScreen started when the server responded mfaRequired. Same
 // fetch/CSRF pattern as auth-email-password's login() (pre-session, no

package/dist/auth-mfa/web/mfa-disable-dialog.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // MfaDisableDialog — confirm-with-code before turning MFA off. Uses the
 // generic Dialog primitive (unlike MfaRegenerateRecoveryDialog): disable is
 // single-step, no state to preserve after confirm, so
@@ -12,7 +11,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // by the caller, not the dialog).
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
-import { AuthMfaHandlers } from "../constants.js";
+import { AuthMfaHandlers } from "./constants.js";
 // kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaDisableDialog({ open, onOpenChange, onDisabled, onError, }) {
     const t = useTranslation();

package/dist/auth-mfa/web/mfa-recovery-codes-reveal.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // MfaRecoveryCodesReveal — one-time display of a fresh recovery-code set,
 // with an acknowledge-then-dismiss gate. Standalone so MfaRegenerateRecovery-
 // Dialog's caller can render it after the dialog closes — the codes only

package/dist/auth-mfa/web/mfa-regenerate-recovery-dialog.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-// @runtime client
 // MfaRegenerateRecoveryDialog — confirm-with-code, then the caller reveals
 // the new codes. The reveal itself can't live inside this Dialog: Dialog
 // closes in a `finally` right after onConfirm resolves (see profile-screen.
@@ -9,7 +8,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // (or equivalent) once the dialog has closed.
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
-import { AuthMfaHandlers } from "../constants.js";
+import { AuthMfaHandlers } from "./constants.js";
 // kumiko-lint-ignore no-custom-primitives Uses usePrimitives().Dialog internally, name is an MFA domain action, not a primitive reimplementation
 export function MfaRegenerateRecoveryDialog({ open, onOpenChange, onRegenerated, onError, }) {
     const t = useTranslation();

package/dist/auth-mfa/web/mfa-setup-preauth-screen.js

@@ -1,7 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
-// Consumers that type-check this source never include the ambient declaration on their own.
-/// <reference path="./qrcode-browser.d.ts" />
 // Pre-auth twin of the declarative auth-mfa-enable secretMint screen: a user
 // blocked at login by MFA enforcement and not yet enrolled lands here
 // straight out of the login flow — there is no session yet. Identity comes
@@ -17,9 +14,6 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // has useSession() in scope) must call refresh() there, otherwise the app
 // stays "unauthenticated" until the next reload.
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
-// qrcode's package.json#browser remap avoids Node-only deps (yargs/pngjs)
-// for bundlers that honor it — Metro doesn't, hence the explicit subpath.
-import QRCode from "qrcode/lib/browser.js";
 import { useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only component, the feature's server barrel has no web/ re-export
 import { AuthCard } from "../../auth-email-password/web/index.js";
@@ -50,7 +44,7 @@ function reasonToKey(reason) {
 }
 export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title, subtitle, onSuccess, onCancel, }) {
     const t = useTranslation();
-    const { Button, Banner, Field, Form, Input, Section } = usePrimitives();
+    const { Button, Banner, Field, Form, Input, Section, SecretReveal } = usePrimitives();
     const [setup, setSetup] = useState(null);
     const [acknowledged, setAcknowledged] = useState(false);
     const [code, setCode] = useState("");
@@ -68,18 +62,11 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
                 setRetryAfterSeconds(res.error.retryAfterSeconds ?? null);
                 return;
             }
-            // errorCorrectionLevel "H" (~30% redundancy) — more resilient to
-            // camera/lighting issues than the default, no downside for a code
-            // this short-lived.
-            const qrSvg = await QRCode.toString(res.data.otpauthUri, {
-                type: "svg",
-                errorCorrectionLevel: "H",
-            });
             setSetup({
                 setupToken: res.data.setupToken,
                 secretParam: extractSecret(res.data.otpauthUri),
                 recoveryCodes: res.data.recoveryCodes,
-                qrSvg,
+                otpauthUri: res.data.otpauthUri,
             });
             setAcknowledged(false);
             setCode("");
@@ -129,7 +116,13 @@ export function MfaSetupPreauthScreen({ preauthSetupToken, accountLabel, title,
     };
     return (_jsxs(AuthCard, { title: title ?? t("auth.mfa.setup.title"), subtitle: subtitle ?? t("auth.mfa.setup.subtitle"), children: [error !== null ? (_jsx(Banner, { variant: "error", children: error === "too_many_attempts" && retryAfterSeconds !== null
                     ? t("auth.mfa.errors.tooManyAttemptsWithSeconds", { seconds: retryAfterSeconds })
-                    : t(reasonToKey(error)) })) : null, !setup && (_jsxs(Section, { testId: "mfa-setup-preauth-intro", children: [_jsx("span", { className: "text-sm text-muted-foreground", children: t("auth.mfa.setup.intro") }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { variant: "primary", onClick: () => void startSetup(), loading: busy, disabled: busy, children: t("auth.mfa.setup.start") }) })] })), setup && (_jsx(Form, { onSubmit: onSubmit, children: _jsxs(Section, { testId: "mfa-setup-preauth-setup", children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") }), _jsx("div", { className: "h-40 w-40", 
-                                    // biome-ignore lint/security/noDangerouslySetInnerHtml: qrcode-generated SVG, no user input
-                                    dangerouslySetInnerHTML: { __html: setup.qrSvg } }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
+                    : t(reasonToKey(error)) })) : null, !setup && (_jsxs(Section, { testId: "mfa-setup-preauth-intro", children: [_jsx("span", { className: "text-sm text-muted-foreground", children: t("auth.mfa.setup.intro") }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { variant: "primary", onClick: () => void startSetup(), loading: busy, disabled: busy, children: t("auth.mfa.setup.start") }) })] })), setup && (_jsx(Form, { onSubmit: onSubmit, children: _jsxs(Section, { testId: "mfa-setup-preauth-setup", children: [_jsxs("div", { className: "flex flex-col items-center gap-2 text-center", children: [SecretReveal !== undefined ? (_jsx(SecretReveal, { values: [
+                                        {
+                                            label: t("auth.mfa.enable.scanTitle"),
+                                            value: setup.otpauthUri,
+                                            qr: true,
+                                            copyable: false,
+                                            multiline: false,
+                                        },
+                                    ], copyLabel: t("kumiko.secretMint.copy"), copiedLabel: t("kumiko.secretMint.copied"), testId: "mfa-setup-preauth-qr" })) : (_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.scanTitle") })), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.manualEntry") }), _jsx("code", { className: "inline-block break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.secretParam })] }), _jsxs("div", { className: "flex flex-col gap-2", children: [_jsx("span", { className: "text-sm font-semibold", children: t("auth.mfa.enable.recoveryTitle") }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("auth.mfa.enable.recoveryHint") }), _jsx("code", { className: "block whitespace-pre-wrap break-all rounded bg-muted px-3 py-2 font-mono text-sm", children: setup.recoveryCodes.join("\n") }), _jsx(Field, { id: "mfa-setup-preauth-ack", label: t("auth.mfa.enable.acknowledge"), children: _jsx(Input, { kind: "boolean", id: "mfa-setup-preauth-ack", name: "mfa-setup-preauth-ack", value: acknowledged, onChange: setAcknowledged }) })] }), _jsx(Field, { id: "mfa-setup-preauth-code", label: t("auth.mfa.enable.code"), required: true, children: _jsx(Input, { kind: "text", id: "mfa-setup-preauth-code", name: "mfa-setup-preauth-code", value: code, onChange: setCode, disabled: busy || !acknowledged, autoComplete: "one-time-code" }) }), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { type: "submit", variant: "primary", loading: busy, disabled: busy || !acknowledged || code.length !== 6, children: t("auth.mfa.setup.confirm") }) })] }) })), onCancel ? (_jsx("div", { className: "flex justify-center", children: _jsx(Button, { type: "button", variant: "secondary", onClick: onCancel, disabled: busy, children: t("auth.mfa.verify.backToLogin") }) })) : null] }));
 }

package/dist/auth-mfa/web/mfa-verify-screen.js

@@ -1,5 +1,4 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-// @runtime client
 // Login-Challenge-Step, gerendert wenn LoginScreen's onMfaChallenge feuert
 // (/auth/login antwortete mfaRequired). Stilistisch wie login-screen.tsx:
 // useState + direkter fetch-Call, kein Dispatcher — es existiert noch kein

package/dist/billing-foundation/checkout-core.js

@@ -4,8 +4,8 @@
 // and the price/subscription-state gate that turns a bare priceId-driven
 // checkout into a plan-aware one. Internal — not re-exported from index.ts.
 import { ConflictError, FeatureDisabledError, UnconfiguredError, UnprocessableError, } from "@cosmicdrift/kumiko-framework/errors";
-import { BILLING_FOUNDATION_FEATURE, isSubscriptionBlockingCheckout, SUBSCRIPTION_PROVIDER_EXTENSION, } from "./constants.js";
 import { getSubscriptionForTenant } from "./get-subscription-for-tenant.js";
+import { BILLING_FOUNDATION_FEATURE, isSubscriptionBlockingCheckout, SUBSCRIPTION_PROVIDER_EXTENSION, } from "./web/constants.js";
 /** Narrows a `readonly string[]` to the non-empty tuple shape `z.enum`
  *  needs. Callers only reach this with a catalog's `plans` — the feature
  *  factory already rejected an empty `plans` array at mount time, so the

package/dist/billing-foundation/consumer-protection/consent-text.d.ts

@@ -1,5 +1,5 @@
-import type { ConsentLocale } from "./consent-locale.ts";
-export { CONSENT_LOCALES, type ConsentLocale, FALLBACK_CONSENT_LOCALE, resolveConsentLocale, } from "./consent-locale.ts";
+import type { ConsentLocale } from "../web/consumer-protection/consent-locale.ts";
+export { CONSENT_LOCALES, type ConsentLocale, FALLBACK_CONSENT_LOCALE, resolveConsentLocale, } from "../web/consumer-protection/consent-locale.ts";
 export type ConsentTexts = {
     readonly earlyPerformance: string;
     readonly withdrawalLoss: string;

package/dist/billing-foundation/consumer-protection/consent-text.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-export { CONSENT_LOCALES, FALLBACK_CONSENT_LOCALE, resolveConsentLocale, } from "./consent-locale.js";
+export { CONSENT_LOCALES, FALLBACK_CONSENT_LOCALE, resolveConsentLocale, } from "../web/consumer-protection/consent-locale.js";
 export const CONSENT_TEXTS = {
     de: {
         earlyPerformance: "Ich verlange ausdrücklich, dass der Anbieter vor Ablauf der Widerrufsfrist mit der Ausführung des Vertrags beginnt.",

package/dist/billing-foundation/consumer-protection/issue-confirmation.js

@@ -9,10 +9,11 @@ import * as z from "zod";
 import { requireTemplateResolver, TEXT_BLOCK_KIND } from "../../template-resolver/index.js";
 import { UserQueries } from "../../user/index.js";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
-import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../constants.js";
 import { CHECKOUT_CONSENT_RECORDED_EVENT_QN, CONTRACT_CONFIRMATION_ISSUED_EVENT_QN, checkoutConsentRecordedPayloadSchema, contractConfirmationIssuedPayloadSchema, PAYMENT_AGGREGATE_TYPE, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
+import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../web/constants.js";
 import { contractConfirmationVariables } from "./confirmation-mail.js";
 import { resolveConsentLocale } from "./consent-text.js";
+import { openStoredUserEmail } from "./stored-user-email.js";
 export const issueContractConfirmationSchema = z
     .object({
     consentId: z.string().min(1).max(100),
@@ -100,7 +101,10 @@ export function createIssueContractConfirmationHandler(options, consumerProtecti
             const recipient = recipientRowSchema.safeParse(await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
                 id: consent.actorUserId,
             }));
-            if (!recipient.success || recipient.data.isDeleted === true) {
+            const recipientEmail = recipient.success && recipient.data.isDeleted !== true
+                ? await openStoredUserEmail(recipient.data.email, "billing-foundation:issue-contract-confirmation")
+                : null;
+            if (!recipient.success || recipientEmail === null) {
                 ctx.log?.warn(`[billing-foundation:issue-contract-confirmation] recipient of consent ${payload.consentId} not found; no mail sent`);
                 return {
                     isSuccess: true,
@@ -158,7 +162,7 @@ export function createIssueContractConfirmationHandler(options, consumerProtecti
             };
             await stream.appendOne({ type: CONTRACT_CONFIRMATION_ISSUED_EVENT_QN, payload: issued });
             await ctx.notify(CONTRACT_CONFIRMATION_NOTIFICATION_TYPE, {
-                route: { email: recipient.data.email },
+                route: { email: recipientEmail },
                 data: variables,
                 locale,
                 priority: "critical",

package/dist/billing-foundation/consumer-protection/mail-notifications.js

@@ -1,5 +1,5 @@
 import { templateVariable, } from "@cosmicdrift/kumiko-framework/engine";
-import { mailHeading, mailParagraph, mailRepeatedRows } from "../../shared/index.js";
+import { mailHeading, mailParagraph, mailParagraphWithLink, mailRepeatedRows, } from "../../shared/index.js";
 import { CONFIRMATION_LABELS } from "./confirmation-mail.js";
 import { CONSENT_LOCALES, CONSENT_TEXTS } from "./consent-text.js";
 import { TERMINATION_TEXTS } from "./termination-texts.js";
@@ -12,6 +12,7 @@ export const TERMINATION_RECEIPT_VARIABLES = {
     requestId: templateVariable.text({ required: true }),
     details: textRows(),
     operatorEmail: templateVariable.text({ required: true }),
+    revokeUrl: templateVariable.link(),
 };
 export const OPERATOR_NOTICE_VARIABLES = {
     subject: templateVariable.text({ required: true }),
@@ -43,6 +44,7 @@ export function terminationReceiptTemplate() {
                 mailRepeatedRows("details", "text"),
                 mailParagraph(texts.receiptNextSteps),
                 mailParagraph(texts.receiptRevoke(OPERATOR_EMAIL_SLOT)),
+                mailParagraphWithLink(texts.receiptNotMe, texts.receiptNotMeLink, "revokeUrl").replace("<p>", '<p data-if="revokeUrl">'),
                 mailParagraph(`${texts.contact} {operatorEmail}`),
             ].join(""),
         };

package/dist/billing-foundation/consumer-protection/register-consent.js

@@ -1,6 +1,6 @@
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
-import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants.js";
 import { CHECKOUT_CONSENT_RECORDED_EVENT_SHORT, CONTRACT_CONFIRMATION_ISSUED_EVENT_SHORT, checkoutConsentRecordedPayloadSchema, contractConfirmationIssuedPayloadSchema, INVOICE_PAID_EVENT_QN, PAYMENT_RECEIVED_EVENT_QN, SUBSCRIPTION_CREATED_EVENT_QN, SUBSCRIPTION_UPDATED_EVENT_QN, } from "../events.js";
+import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../web/constants.js";
 import { createIssueContractConfirmationHandler } from "./issue-confirmation.js";
 import { registerConsumerProtectionMails } from "./mail-notifications.js";
 import { registerContractTermination } from "./register-termination.js";

package/dist/billing-foundation/consumer-protection/register-termination.js

@@ -1,10 +1,14 @@
-import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../constants.js";
-import { CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_DECLARED_EVENT_SHORT, CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT, CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT, contractTerminationDeclaredPayloadSchema, contractTerminationRequestedPayloadSchema, contractTerminationUnmatchedPayloadSchema, } from "../events.js";
+import { CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_DECLARED_EVENT_SHORT, CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT, CONTRACT_TERMINATION_REVOKED_EVENT_SHORT, CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT, contractTerminationDeclaredPayloadSchema, contractTerminationRequestedPayloadSchema, contractTerminationRevokedPayloadSchema, contractTerminationUnmatchedPayloadSchema, } from "../events.js";
+import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../web/constants.js";
 import { createDeclareContractTerminationHandler, createRecordContractTerminationHandler, createRecordUnmatchedContractTerminationHandler, createTerminableSubscriptionQuery, } from "./termination-record.js";
 import { createRequestContractTerminationHandler, createTerminateContractHandler, } from "./termination-request.js";
+import { createRecordContractTerminationRevocationHandler, createRevokeContractTerminationHandler, } from "./termination-revoke.js";
 export function registerContractTermination(r, options, consumerProtection) {
     r.defineEvent(CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT, contractTerminationRequestedPayloadSchema, { piiFields: "none" });
     r.defineEvent(CONTRACT_TERMINATION_DECLARED_EVENT_SHORT, contractTerminationDeclaredPayloadSchema, { piiFields: "none" });
+    r.defineEvent(CONTRACT_TERMINATION_REVOKED_EVENT_SHORT, contractTerminationRevokedPayloadSchema, {
+        piiFields: "none",
+    });
     r.defineEvent(CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT, contractTerminationUnmatchedPayloadSchema, { piiFields: "none" });
     r.queryHandler(createTerminableSubscriptionQuery());
     r.writeHandler(createDeclareContractTerminationHandler());
@@ -12,6 +16,8 @@ export function registerContractTermination(r, options, consumerProtection) {
     r.writeHandler(createRecordUnmatchedContractTerminationHandler());
     r.writeHandler(createRequestContractTerminationHandler(options, consumerProtection));
     r.writeHandler(createTerminateContractHandler(options, consumerProtection));
+    r.writeHandler(createRevokeContractTerminationHandler());
+    r.writeHandler(createRecordContractTerminationRevocationHandler(options, consumerProtection));
     // The provider cancel of a public declaration runs here, not in the
     // request: matched and unmatched requests then do the same work and the
     // response time does not tell whether the email belongs to a customer.

package/dist/billing-foundation/consumer-protection/stored-user-email.d.ts

@@ -0,0 +1 @@
+export declare function openStoredUserEmail(stored: string, fallbackRequestId: string): Promise<string | null>;

package/dist/billing-foundation/consumer-protection/stored-user-email.js

@@ -0,0 +1,8 @@
+import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import { decryptStoredPii } from "../../shared/index.js";
+// findForAuth returns the stored column, which is ciphertext under an active KMS;
+// channel-email refuses to mail a ciphertext address. Null for an erased subject.
+export async function openStoredUserEmail(stored, fallbackRequestId) {
+    const email = await decryptStoredPii(stored, "email", fallbackRequestId);
+    return email === PII_ERASED_SENTINEL ? null : email;
+}

package/dist/billing-foundation/consumer-protection/termination-mail.d.ts

@@ -11,6 +11,8 @@ export type TerminationReceiptVariables = {
     readonly requestId: string;
     readonly details: readonly TextRow[];
     readonly operatorEmail: string;
+    /** Only a matched declaration carries the "this was not me" link. */
+    readonly revokeUrl?: string;
 };
 /** Variables of the operator notice template. */
 export type OperatorNoticeVariables = {
@@ -39,8 +41,10 @@ export type TerminationReceiptArgs = {
     readonly receivedAtIso: string;
     readonly declaration: ReceiptDeclaration;
     readonly operatorEmail: string;
+    readonly revokeUrl?: string;
 };
-/** The content must not depend on whether (or how) the declaration matched a contract. */
+/** Apart from the revoke link, the content must not depend on whether the declaration
+ *  matched a contract; the link only goes to the address the declarant entered. */
 export declare function terminationReceiptVariables(args: TerminationReceiptArgs): TerminationReceiptVariables;
 export type OperatorNoticeArgs = {
     readonly locale: ConsentLocale;

package/dist/billing-foundation/consumer-protection/termination-mail.js

@@ -32,7 +32,8 @@ function declarationLines(declaration, locale) {
     ];
     return lines.map((text) => ({ text }));
 }
-/** The content must not depend on whether (or how) the declaration matched a contract. */
+/** Apart from the revoke link, the content must not depend on whether the declaration
+ *  matched a contract; the link only goes to the address the declarant entered. */
 export function terminationReceiptVariables(args) {
     const texts = TERMINATION_TEXTS[args.locale];
     return {
@@ -41,6 +42,7 @@ export function terminationReceiptVariables(args) {
         requestId: args.requestId,
         details: declarationLines(args.declaration, args.locale),
         operatorEmail: args.operatorEmail,
+        ...(args.revokeUrl !== undefined && { revokeUrl: args.revokeUrl }),
     };
 }
 export function operatorNoticeVariables(args) {

package/dist/billing-foundation/consumer-protection/termination-notify.js

@@ -1,5 +1,5 @@
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE } from "../constants.js";
+import { CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE } from "../web/constants.js";
 import { operatorNoticeVariables } from "./termination-mail.js";
 export function requireNotify(ctx) {
     if (!ctx.notify) {

package/dist/billing-foundation/consumer-protection/termination-pages.js

@@ -4,11 +4,13 @@ import { getSessionCookies } from "@cosmicdrift/kumiko-framework/api";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-renderer/headless";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { getCookie } from "hono/cookie";
+import * as z from "zod";
 import { redirectToCanonicalPath, securePageHeaders, slashVariantOf, wrapInLayout, } from "../../page-render/index.js";
-import { SubscriptionFoundationHandlers } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS } from "../events.js";
+import { SubscriptionFoundationHandlers } from "../web/constants.js";
 import { formatReceivedAt } from "./termination-mail.js";
 import { requestContractTerminationSchema } from "./termination-request.js";
+import { REVOCATION_PATHS, revokeContractTerminationSchema, } from "./termination-revoke.js";
 import { TERMINATION_TEXTS } from "./termination-texts.js";
 const PAGE_SLUG = "contract-termination";
 const DEFAULT_PATHS = {
@@ -43,6 +45,8 @@ function pageHeaders() {
         ...headers,
         "content-security-policy": `${headers["content-security-policy"] ?? ""}; frame-ancestors 'none'; form-action 'self'`,
         "x-frame-options": "DENY",
+        // The revoke link carries its token in the query string.
+        "referrer-policy": "no-referrer",
     };
 }
 function htmlResponse(ctx, title, bodyHtml, status) {
@@ -205,7 +209,7 @@ function reentryHeaders(c) {
     }
     return headers;
 }
-async function submitDeclaration(c, app, clientIp, values, locale) {
+async function dispatchAnonymousWrite(c, app, clientIp, type, payload) {
     // deps.write only resolves a session user under /api/*; this page lives
     // outside it, so it re-enters the dispatcher through the app like the
     // user-export by-token route. The resolved clientIp as env keeps the
@@ -215,25 +219,112 @@ async function submitDeclaration(c, app, clientIp, values, locale) {
     const response = await app.fetch(new Request(`${new URL(c.req.url).origin}/api/write`, {
         method: "POST",
         headers: reentryHeaders(c),
-        body: JSON.stringify({
-            type: SubscriptionFoundationHandlers.requestContractTermination,
-            payload: payloadOf(values, locale),
-        }),
+        body: JSON.stringify({ type, payload }),
     }), clientIp);
     const parsed = await response.json().catch(() => null);
-    if (response.status === 429 || parsed?.error?.code === RATE_LIMITED_CODE) {
+    return {
+        rateLimited: response.status === 429 || parsed?.error?.code === RATE_LIMITED_CODE,
+        ok: response.ok && parsed?.isSuccess === true,
+        data: parsed?.data,
+    };
+}
+async function submitDeclaration(c, app, clientIp, values, locale) {
+    const response = await dispatchAnonymousWrite(c, app, clientIp, SubscriptionFoundationHandlers.requestContractTermination, payloadOf(values, locale));
+    if (response.rateLimited)
         return { kind: "rate-limited" };
-    }
-    const requestId = parsed?.data?.requestId;
-    const receivedAtIso = parsed?.data?.receivedAtIso;
-    if (response.ok &&
-        parsed?.isSuccess === true &&
-        typeof requestId === "string" &&
-        typeof receivedAtIso === "string") {
+    const requestId = response.data?.requestId;
+    const receivedAtIso = response.data?.receivedAtIso;
+    if (response.ok && typeof requestId === "string" && typeof receivedAtIso === "string") {
         return { kind: "received", requestId, receivedAtIso };
     }
     return { kind: "failed" };
 }
+const revocationOutcomeSchema = z.object({
+    outcome: z.enum(["revoked", "already-revoked", "too-late", "invalid"]),
+});
+// Missing or malformed link parameters answer like a wrong token.
+function revocationValuesOf(source) {
+    const text = (key) => {
+        const value = source[key];
+        return typeof value === "string" ? value : "";
+    };
+    const parsed = revokeContractTerminationSchema.safeParse({
+        requestId: text("r"),
+        token: text("t"),
+        tenantId: text("tenant"),
+    });
+    return parsed.success ? parsed.data : null;
+}
+async function submitRevocation(c, app, clientIp, values) {
+    const response = await dispatchAnonymousWrite(c, app, clientIp, SubscriptionFoundationHandlers.revokeContractTermination, values);
+    if (response.rateLimited)
+        return "rate-limited";
+    const outcome = revocationOutcomeSchema.safeParse(response.data);
+    return response.ok && outcome.success ? outcome.data.outcome : "invalid";
+}
+function revokeConfirmPage(ctx, revokePath, values) {
+    const { revoke } = TERMINATION_TEXTS[ctx.locale].page;
+    const hidden = [
+        ["r", values.requestId],
+        ["t", values.token],
+        ["tenant", values.tenantId],
+    ]
+        .map(([name, value]) => `<input type="hidden" name="${escapeHtmlAttr(name)}" value="${escapeHtmlAttr(value ?? "")}">`)
+        .join("\n");
+    const body = `<h1>${escapeHtml(revoke.confirmTitle)}</h1>
+<p>${escapeHtml(revoke.confirmLead)}</p>
+<form method="post" action="${escapeHtmlAttr(revokePath)}" data-kumiko-form="contract-termination-revoke">
+${hidden}
+<button type="submit" data-kumiko-button="revoke">${escapeHtml(revoke.confirmButton)}</button>
+</form>`;
+    return htmlResponse(ctx, revoke.confirmTitle, body, 200);
+}
+function revokeResultPage(ctx, outcome) {
+    const { page } = TERMINATION_TEXTS[ctx.locale];
+    const { revoke } = page;
+    const simple = (title, text, status) => htmlResponse(ctx, title, `<h1>${escapeHtml(title)}</h1><p>${escapeHtml(text)}</p>`, status);
+    switch (outcome) {
+        case "revoked":
+            return simple(revoke.revokedTitle, revoke.revokedBody, 200);
+        case "already-revoked":
+            return simple(revoke.alreadyRevokedTitle, revoke.alreadyRevokedBody, 200);
+        case "too-late":
+            return simple(revoke.tooLateTitle, revoke.tooLateBody, 200);
+        case "rate-limited":
+            return simple(page.rateLimitedTitle, page.rateLimitedBody, 429);
+        case "invalid":
+            return simple(revoke.invalidTitle, revoke.invalidBody, 400);
+    }
+}
+// GET only renders the confirmation form: mail scanners prefetch links, so the
+// state change waits for the POST.
+function revokeRoutesFor(ctx) {
+    const revokePath = REVOCATION_PATHS[ctx.locale];
+    return [
+        {
+            method: "GET",
+            path: revokePath,
+            entry: "anonymous",
+            handler: (c) => {
+                const values = revocationValuesOf(c.req.query());
+                return values === null
+                    ? revokeResultPage(ctx, "invalid")
+                    : revokeConfirmPage(ctx, revokePath, values);
+            },
+        },
+        {
+            method: "POST",
+            path: revokePath,
+            entry: "anonymous",
+            handler: async (c, deps) => {
+                const values = revocationValuesOf(await c.req.parseBody());
+                if (values === null)
+                    return revokeResultPage(ctx, "invalid");
+                return revokeResultPage(ctx, await submitRevocation(c, deps.app, deps.clientIp, values));
+            },
+        },
+    ];
+}
 function routesFor(ctx) {
     const { locale, path } = ctx;
     const slashVariant = slashVariantOf(path);
@@ -290,5 +381,8 @@ export function createContractTerminationRoutes(options = {}) {
         en: options.paths?.en ?? DEFAULT_PATHS.en,
     };
     const wrapLayout = options.wrapLayout ?? wrapInLayout;
-    return ["de", "en"].flatMap((locale) => routesFor({ locale, path: alternates[locale], wrapLayout, alternates }));
+    return ["de", "en"].flatMap((locale) => {
+        const pageContext = { locale, path: alternates[locale], wrapLayout, alternates };
+        return [...routesFor(pageContext), ...revokeRoutesFor(pageContext)];
+    });
 }

package/dist/billing-foundation/consumer-protection/termination-record.d.ts

@@ -1,6 +1,7 @@
-import { type QueryHandlerDef, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { type HandlerContext, type QueryHandlerDef, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { type ProviderCancelOutcome } from "../events.ts";
+import { type SubscriptionView } from "../get-subscription-for-tenant.ts";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.ts";
 import type { OperatorNoticeReason } from "./termination-texts.ts";
 export declare const recordContractTerminationSchema: z.ZodObject<{
@@ -43,6 +44,7 @@ export declare const declareContractTerminationSchema: z.ZodObject<{
         de: "de";
         en: "en";
     }>;
+    revocationTokenHash: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type RecordContractTerminationResult = {
     readonly receivedAtIso: string;
@@ -72,4 +74,9 @@ export declare const terminableSubscriptionSchema: z.ZodObject<{}, z.core.$stric
 export declare function createTerminableSubscriptionQuery(): QueryHandlerDef;
 export declare function createDeclareContractTerminationHandler(): WriteHandlerDef;
 export declare function createRecordContractTerminationHandler(options: ResolvedBillingFoundationOptions, consumerProtection: ConsumerProtectionOptions): WriteHandlerDef;
+export declare function hasRevocation(events: readonly {
+    type: string;
+    payload: unknown;
+}[], requestId: string): boolean;
+export declare function resumeAtProvider(ctx: HandlerContext, subscription: SubscriptionView | null): Promise<OperatorNoticeReason[]>;
 export declare function createRecordUnmatchedContractTerminationHandler(): WriteHandlerDef;