@cosmicdrift/kumiko-bundled-features 0.378.0 → 0.379.0

package/dist/billing-foundation/consumer-protection/termination-record.js

@@ -7,10 +7,10 @@ import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { subscriptionAggregateId, terminationUnmatchedAggregateId } from "../aggregate-id.js";
 import { resolveProviderPlugin } from "../checkout-core.js";
-import { isTerminalSubscriptionStatus, SubscriptionCancelTimings } from "../constants.js";
-import { CONTRACT_TERMINATION_CHANNELS, CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_KINDS, CONTRACT_TERMINATION_REQUESTED_EVENT_QN, CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE, CONTRACT_TERMINATION_UNMATCHED_EVENT_QN, contractTerminationRequestedPayloadSchema, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
+import { CONTRACT_TERMINATION_CHANNELS, CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_KINDS, CONTRACT_TERMINATION_REQUESTED_EVENT_QN, CONTRACT_TERMINATION_REVOKED_EVENT_QN, CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE, CONTRACT_TERMINATION_UNMATCHED_EVENT_QN, contractTerminationRequestedPayloadSchema, contractTerminationRevokedPayloadSchema, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
 import { getSubscriptionForTenant } from "../get-subscription-for-tenant.js";
-import { CONSENT_LOCALES, FALLBACK_CONSENT_LOCALE } from "./consent-locale.js";
+import { isTerminalSubscriptionStatus, SubscriptionCancelTimings } from "../web/constants.js";
+import { CONSENT_LOCALES, FALLBACK_CONSENT_LOCALE, } from "../web/consumer-protection/consent-locale.js";
 import { notifyOperator } from "./termination-notify.js";
 import { isWithinWithdrawalPeriod } from "./withdrawal-period.js";
 const REQUESTED_CANCEL_TIMINGS = [
@@ -38,6 +38,7 @@ export const declareContractTerminationSchema = z
     terminationKind: z.enum(CONTRACT_TERMINATION_KINDS),
     receivedAtIso: z.string().min(1),
     locale: z.enum(CONSENT_LOCALES),
+    revocationTokenHash: z.string().length(64).optional(),
 })
     .strict();
 export const recordUnmatchedContractTerminationSchema = z
@@ -114,6 +115,42 @@ export function createDeclareContractTerminationHandler() {
         },
     };
 }
+function revokedRecordResult(receivedAtIso) {
+    return {
+        isSuccess: true,
+        data: {
+            receivedAtIso,
+            effectiveAtIso: null,
+            providerCancel: "none",
+            noticeReason: null,
+            withdrawalPeriodExpired: false,
+        },
+    };
+}
+// A revocation that landed during the provider cancel found nothing to take back yet.
+async function takeBackLateRevokedCancel(ctx, consumerProtection, args) {
+    const { payload, tenantId, receivedAtIso, providerCancel } = args;
+    // skip: nothing was cancelled at the provider, nothing to resume
+    if (providerCancel !== "period-end")
+        return;
+    const reasons = await resumeAtProvider(ctx, await getSubscriptionForTenant(ctx, tenantId));
+    // skip: resumed cleanly, the revocation notice already tells the operator
+    if (reasons.length === 0)
+        return;
+    await notifyOperator(ctx, consumerProtection, {
+        locale: payload.locale ?? FALLBACK_CONSENT_LOCALE,
+        requestId: payload.requestId,
+        receivedAtIso,
+        channel: "public",
+        declaration: {
+            declarationType: payload.declarationType,
+            terminationKind: payload.terminationKind,
+        },
+        reasons,
+        tenantId,
+        providerCancel,
+    });
+}
 export function createRecordContractTerminationHandler(options, consumerProtection) {
     return {
         name: "record-contract-termination",
@@ -153,6 +190,10 @@ export function createRecordContractTerminationHandler(options, consumerProtecti
                     },
                 };
             }
+            // A revoked public declaration never reaches the provider.
+            if (hasRevocation(stream.events, payload.requestId)) {
+                return revokedRecordResult(receivedAtIso);
+            }
             const withdrawalPeriodExpired = payload.declarationType === "withdrawal" &&
                 payload.when === SubscriptionCancelTimings.immediately &&
                 !isWithinWithdrawalPeriod(stream.events, options.now());
@@ -173,6 +214,16 @@ export function createRecordContractTerminationHandler(options, consumerProtecti
                 aggregateId: subscriptionAggregateId(tenantId),
                 aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
             });
+            // A revocation that landed during the provider call found no cancel to take back.
+            if (hasRevocation(streamAfterProviderCall.events, payload.requestId)) {
+                await takeBackLateRevokedCancel(ctx, consumerProtection, {
+                    payload,
+                    tenantId,
+                    receivedAtIso,
+                    providerCancel,
+                });
+                return revokedRecordResult(receivedAtIso);
+            }
             await streamAfterProviderCall.appendOne({
                 type: CONTRACT_TERMINATION_REQUESTED_EVENT_QN,
                 payload: recorded,
@@ -207,6 +258,28 @@ export function createRecordContractTerminationHandler(options, consumerProtecti
         },
     };
 }
+export function hasRevocation(events, requestId) {
+    return events.some((e) => e.type === CONTRACT_TERMINATION_REVOKED_EVENT_QN &&
+        contractTerminationRevokedPayloadSchema.safeParse(e.payload).data?.requestId === requestId);
+}
+export async function resumeAtProvider(ctx, subscription) {
+    if (subscription === null || isTerminalSubscriptionStatus(subscription.status)) {
+        return ["revocation_resume_manual"];
+    }
+    const plugin = findPlugin(ctx, subscription.providerName);
+    if (!plugin?.resumeSubscription)
+        return ["revocation_resume_manual"];
+    try {
+        await plugin.resumeSubscription(ctx, {
+            providerSubscriptionId: subscription.providerSubscriptionId,
+        });
+    }
+    catch (error) {
+        ctx.log?.warn(`[billing-foundation:revoke-contract-termination] provider resume failed: ${error instanceof Error ? error.message : String(error)}`);
+        return ["revocation_resume_failed"];
+    }
+    return [];
+}
 function findPlugin(ctx, providerName) {
     try {
         return resolveProviderPlugin(ctx, providerName).plugin;

package/dist/billing-foundation/consumer-protection/termination-request.js

@@ -8,13 +8,15 @@ import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";
 import { UserQueries } from "../../user/index.js";
-import { CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, SubscriptionCancelTimings, SubscriptionFoundationHandlers, SubscriptionFoundationQueries, } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS, } from "../events.js";
 import { purchaseRolesOf } from "../plan-catalog.js";
+import { CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, SubscriptionCancelTimings, SubscriptionFoundationHandlers, SubscriptionFoundationQueries, } from "../web/constants.js";
 import { resolveConsentLocale } from "./consent-text.js";
+import { openStoredUserEmail } from "./stored-user-email.js";
 import { terminationReceiptVariables } from "./termination-mail.js";
 import { notifyOperator, requireNotify } from "./termination-notify.js";
 import { mayMailReceipt } from "./termination-receipt-limit.js";
+import { createRevocationToken, revocationUrl } from "./termination-revoke.js";
 const EXTRAORDINARY_REASON_MESSAGE = "reason is required for an extraordinary termination";
 const authUserRowSchema = z.object({
     id: z.string().min(1),
@@ -66,6 +68,7 @@ async function sendTerminationMails(ctx, consumerProtection, plan) {
                     terminationKind: plan.declaration.terminationKind,
                 },
                 operatorEmail: consumerProtection.operatorEmail,
+                ...(plan.revokeUrl !== undefined && { revokeUrl: plan.revokeUrl }),
             }),
             locale: plan.locale,
             priority: "critical",
@@ -77,7 +80,8 @@ async function sendTerminationMails(ctx, consumerProtection, plan) {
     // skip: no operator notice needed for this declaration
     if (reasons.length === 0)
         return;
-    await notifyOperator(ctx, consumerProtection, { ...plan, reasons });
+    const { revokeUrl: _revokeUrl, ...noticePlan } = plan;
+    await notifyOperator(ctx, consumerProtection, { ...noticePlan, reasons });
 }
 // Tenants the entered email can terminate a contract for: tenants where the
 // user holds a purchase role and the subscription is not terminal. Every identity
@@ -128,13 +132,32 @@ export function createRequestContractTerminationHandler(options, consumerProtect
             const reasons = [];
             const locale = resolveConsentLocale(payload.locale);
             let matchedTenantId;
+            let revokeUrl;
             const candidates = await findTerminableTenantIds(ctx, options, event.user.tenantId, payload.email);
             const [onlyCandidate] = candidates;
             if (candidates.length === 1 && onlyCandidate !== undefined) {
                 matchedTenantId = onlyCandidate;
-                const declared = await ctx.writeAs(createSystemUser(onlyCandidate), SubscriptionFoundationHandlers.declareContractTermination, { requestId, declarationType, terminationKind, receivedAtIso, locale });
-                if (!declared.isSuccess)
+                const revocation = createRevocationToken();
+                const declared = await ctx.writeAs(createSystemUser(onlyCandidate), SubscriptionFoundationHandlers.declareContractTermination, {
+                    requestId,
+                    declarationType,
+                    terminationKind,
+                    receivedAtIso,
+                    locale,
+                    revocationTokenHash: revocation.tokenHash,
+                });
+                if (!declared.isSuccess) {
                     reasons.push("recording_failed");
+                }
+                else if (options.baseUrl !== undefined) {
+                    revokeUrl = revocationUrl({
+                        baseUrl: options.baseUrl,
+                        locale,
+                        requestId,
+                        token: revocation.token,
+                        tenantId: onlyCandidate,
+                    });
+                }
             }
             else {
                 reasons.push(candidates.length === 0 ? "unmatched" : "ambiguous");
@@ -166,6 +189,7 @@ export function createRequestContractTerminationHandler(options, consumerProtect
                 },
                 reasons,
                 ...(matchedTenantId !== undefined && { tenantId: matchedTenantId }),
+                ...(revokeUrl !== undefined && { revokeUrl }),
             });
             return {
                 isSuccess: true,
@@ -192,7 +216,10 @@ export function createTerminateContractHandler(options, consumerProtection) {
             const caller = authUserRowSchema.safeParse(await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, {
                 id: event.user.id,
             }));
-            if (!caller.success || !caller.data.email || caller.data.isDeleted === true) {
+            const callerEmail = caller.success && caller.data.email && caller.data.isDeleted !== true
+                ? await openStoredUserEmail(caller.data.email, "billing-foundation:terminate-contract")
+                : null;
+            if (callerEmail === null) {
                 throw new InternalError({
                     message: "billing-foundation:terminate-contract: calling user has no email on record",
                 });
@@ -218,7 +245,7 @@ export function createTerminateContractHandler(options, consumerProtection) {
                 declaration: {
                     declarationType,
                     terminationKind,
-                    email: caller.data.email,
+                    email: callerEmail,
                     ...(payload.reason !== undefined && { reason: payload.reason }),
                 },
                 reasons: [

package/dist/billing-foundation/consumer-protection/termination-revoke.d.ts

@@ -0,0 +1,28 @@
+import { type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.ts";
+import type { ConsentLocale } from "./consent-text.ts";
+export declare const REVOCATION_PATHS: Readonly<Record<ConsentLocale, string>>;
+export type RevocationOutcome = "revoked" | "already-revoked" | "too-late" | "invalid";
+export declare function createRevocationToken(): {
+    readonly token: string;
+    readonly tokenHash: string;
+};
+export declare function revocationUrl(args: {
+    readonly baseUrl: string;
+    readonly locale: ConsentLocale;
+    readonly requestId: string;
+    readonly token: string;
+    readonly tenantId: string;
+}): string;
+export declare const revokeContractTerminationSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    token: z.ZodString;
+    tenantId: z.ZodUUID;
+}, z.core.$strict>;
+export declare const recordContractTerminationRevocationSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    token: z.ZodString;
+}, z.core.$strict>;
+export declare function createRevokeContractTerminationHandler(): WriteHandlerDef;
+export declare function createRecordContractTerminationRevocationHandler(options: ResolvedBillingFoundationOptions, consumerProtection: ConsumerProtectionOptions): WriteHandlerDef;

package/dist/billing-foundation/consumer-protection/termination-revoke.js

@@ -0,0 +1,149 @@
+// "This cancellation was not me": the signed link in the receipt mail of a
+// matched public declaration takes the cancellation back until it takes effect.
+// The anonymous handler only routes to the declaration's tenant; the system
+// handler checks the token and does the work.
+import { createHash, timingSafeEqual } from "node:crypto";
+import { access, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import * as z from "zod";
+import { subscriptionAggregateId } from "../aggregate-id.js";
+import { CONTRACT_TERMINATION_DECLARED_EVENT_QN, CONTRACT_TERMINATION_REQUESTED_EVENT_QN, CONTRACT_TERMINATION_REVOKED_EVENT_QN, contractTerminationDeclaredPayloadSchema, contractTerminationRequestedPayloadSchema, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
+import { getSubscriptionForTenant } from "../get-subscription-for-tenant.js";
+import { SubscriptionFoundationHandlers } from "../web/constants.js";
+import { notifyOperator } from "./termination-notify.js";
+import { hasRevocation, resumeAtProvider } from "./termination-record.js";
+export const REVOCATION_PATHS = {
+    de: "/legal/kuendigen/zuruecknehmen",
+    en: "/legal/cancel/revoke",
+};
+const TOKEN_BYTES = 32;
+export function createRevocationToken() {
+    const token = Buffer.from(crypto.getRandomValues(new Uint8Array(TOKEN_BYTES))).toString("base64url");
+    return { token, tokenHash: hashRevocationToken(token) };
+}
+function hashRevocationToken(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
+function tokenMatchesHash(token, expectedHash) {
+    const actual = Buffer.from(hashRevocationToken(token));
+    const expected = Buffer.from(expectedHash);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+export function revocationUrl(args) {
+    // Origin only: a baseUrl path prefix would not match the routes mounted at the root.
+    const url = new URL(REVOCATION_PATHS[args.locale], new URL(args.baseUrl).origin);
+    url.searchParams.set("r", args.requestId);
+    url.searchParams.set("t", args.token);
+    url.searchParams.set("tenant", args.tenantId);
+    return url.toString();
+}
+const revocationFieldsSchema = {
+    requestId: z.string().min(1).max(100),
+    token: z.string().min(1).max(200),
+};
+export const revokeContractTerminationSchema = z
+    .object({ ...revocationFieldsSchema, tenantId: z.uuid() })
+    .strict();
+export const recordContractTerminationRevocationSchema = z.object(revocationFieldsSchema).strict();
+function parseOutcome(data) {
+    const parsed = z
+        .object({ outcome: z.enum(["revoked", "already-revoked", "too-late", "invalid"]) })
+        .safeParse(data);
+    return parsed.success ? parsed.data.outcome : "invalid";
+}
+export function createRevokeContractTerminationHandler() {
+    return {
+        name: "revoke-contract-termination",
+        description: 'Public "this was not me" link of the § 312k receipt mail: takes a public cancellation back until it takes effect; an unknown request and a wrong token answer the same.',
+        schema: revokeContractTerminationSchema,
+        access: { roles: ["anonymous"] },
+        rateLimit: { per: "ip+handler", limit: 5, windowSeconds: 600 },
+        // The link only knows baseUrl, which may be a host that resolves no tenant; the token alone authorizes.
+        tenantlessAnonymous: true,
+        escapeHatch: {
+            reason: "Anonymous revoker has no session — writes as the system user of the tenant named in the link; only a declared event in that tenant whose revocationTokenHash matches the link token lets the revocation through, every other case answers the same generic invalid.",
+        },
+        handler: async (event, ctx) => {
+            // @cast-boundary engine-payload — dispatcher-zod-validated payload
+            const payload = event.payload;
+            const result = await ctx.writeAs(createSystemUser(payload.tenantId), SubscriptionFoundationHandlers.recordContractTerminationRevocation, { requestId: payload.requestId, token: payload.token });
+            return {
+                isSuccess: true,
+                data: { outcome: result.isSuccess ? parseOutcome(result.data) : "invalid" },
+            };
+        },
+    };
+}
+export function createRecordContractTerminationRevocationHandler(options, consumerProtection) {
+    return {
+        name: "record-contract-termination-revocation",
+        agent: { expose: false },
+        schema: recordContractTerminationRevocationSchema,
+        access: { roles: access.system },
+        handler: async (event, ctx) => {
+            // @cast-boundary engine-payload — dispatcher-zod-validated payload
+            const payload = event.payload;
+            const tenantId = event.user.tenantId;
+            const outcome = (value) => ({
+                isSuccess: true,
+                data: { outcome: value },
+            });
+            const stream = await ctx.fetchForWriting({
+                aggregateId: subscriptionAggregateId(tenantId),
+                aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+            });
+            const declared = stream.events
+                .filter((e) => e.type === CONTRACT_TERMINATION_DECLARED_EVENT_QN)
+                .map((e) => contractTerminationDeclaredPayloadSchema.safeParse(e.payload).data)
+                .find((candidate) => candidate?.requestId === payload.requestId);
+            if (declared?.revocationTokenHash === undefined ||
+                !tokenMatchesHash(payload.token, declared.revocationTokenHash)) {
+                return outcome("invalid");
+            }
+            if (hasRevocation(stream.events, payload.requestId))
+                return outcome("already-revoked");
+            const requested = stream.events
+                .filter((e) => e.type === CONTRACT_TERMINATION_REQUESTED_EVENT_QN)
+                .map((e) => contractTerminationRequestedPayloadSchema.safeParse(e.payload).data)
+                .find((candidate) => candidate?.requestId === payload.requestId);
+            const subscription = await getSubscriptionForTenant(ctx, tenantId);
+            const effectiveAtIso = requested?.effectiveAtIso ?? subscription?.currentPeriodEnd.toString();
+            const now = options.now();
+            if (effectiveAtIso !== undefined &&
+                Temporal.Instant.compare(now, Temporal.Instant.from(effectiveAtIso)) >= 0) {
+                return outcome("too-late");
+            }
+            const reasons = ["revoked"];
+            if (requested?.providerCancel === "period-end") {
+                reasons.push(...(await resumeAtProvider(ctx, subscription)));
+            }
+            // Re-fetch after the external call, like record-contract-termination.
+            const streamAfterProviderCall = await ctx.fetchForWriting({
+                aggregateId: subscriptionAggregateId(tenantId),
+                aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+            });
+            const revoked = {
+                requestId: payload.requestId,
+                revokedAtIso: now.toString(),
+            };
+            await streamAfterProviderCall.appendOne({
+                type: CONTRACT_TERMINATION_REVOKED_EVENT_QN,
+                payload: revoked,
+            });
+            await notifyOperator(ctx, consumerProtection, {
+                locale: declared.locale,
+                requestId: declared.requestId,
+                receivedAtIso: declared.receivedAtIso,
+                channel: "public",
+                declaration: {
+                    declarationType: declared.declarationType,
+                    terminationKind: declared.terminationKind,
+                },
+                reasons,
+                tenantId,
+                ...(requested !== undefined && { providerCancel: requested.providerCancel }),
+            });
+            return outcome("revoked");
+        },
+    };
+}

package/dist/billing-foundation/consumer-protection/termination-texts.d.ts

@@ -16,6 +16,8 @@ export type TerminationTexts = {
     readonly receiptIntro: string;
     readonly receiptNextSteps: string;
     readonly receiptRevoke: (operatorEmail: string) => string;
+    readonly receiptNotMe: string;
+    readonly receiptNotMeLink: string;
     readonly contact: string;
     readonly operatorSubject: Readonly<Record<ContractTerminationDeclarationType, string>>;
     readonly operatorIntro: string;
@@ -57,7 +59,21 @@ export type PageTexts = {
     readonly errorGeneric: string;
     readonly rateLimitedTitle: string;
     readonly rateLimitedBody: string;
+    readonly revoke: RevokePageTexts;
 };
-export declare const OPERATOR_NOTICE_REASONS: readonly ["unmatched", "ambiguous", "withdrawal", "extraordinary", "provider_cannot_cancel", "provider_error", "no_active_subscription", "recording_failed", "withdrawal_period_expired", "receipt_rate_limited"];
+export type RevokePageTexts = {
+    readonly confirmTitle: string;
+    readonly confirmLead: string;
+    readonly confirmButton: string;
+    readonly revokedTitle: string;
+    readonly revokedBody: string;
+    readonly alreadyRevokedTitle: string;
+    readonly alreadyRevokedBody: string;
+    readonly tooLateTitle: string;
+    readonly tooLateBody: string;
+    readonly invalidTitle: string;
+    readonly invalidBody: string;
+};
+export declare const OPERATOR_NOTICE_REASONS: readonly ["unmatched", "ambiguous", "withdrawal", "extraordinary", "provider_cannot_cancel", "provider_error", "no_active_subscription", "recording_failed", "withdrawal_period_expired", "receipt_rate_limited", "revoked", "revocation_resume_manual", "revocation_resume_failed"];
 export type OperatorNoticeReason = (typeof OPERATOR_NOTICE_REASONS)[number];
 export declare const TERMINATION_TEXTS: Readonly<Record<ConsentLocale, TerminationTexts>>;

package/dist/billing-foundation/consumer-protection/termination-texts.js

@@ -9,6 +9,9 @@ export const OPERATOR_NOTICE_REASONS = [
     "recording_failed",
     "withdrawal_period_expired",
     "receipt_rate_limited",
+    "revoked",
+    "revocation_resume_manual",
+    "revocation_resume_failed",
 ];
 export const TERMINATION_TEXTS = {
     de: {
@@ -33,6 +36,8 @@ export const TERMINATION_TEXTS = {
         receiptIntro: "wir bestätigen den Eingang deiner Erklärung mit folgendem Inhalt. Diese E-Mail ist eine Eingangsbestätigung, keine Bestätigung der Wirksamkeit.",
         receiptNextSteps: "Wir prüfen deine Erklärung und melden uns, sobald sie bearbeitet ist oder wir Rückfragen haben.",
         receiptRevoke: (operatorEmail) => `Hast du diese Erklärung nicht abgegeben oder möchtest du sie zurücknehmen? Schreib uns bitte umgehend an ${operatorEmail}.`,
+        receiptNotMe: "Wurde diese Erklärung nicht von dir abgegeben? Dann nimm die Kündigung bis zu ihrem Wirksamwerden hier zurück:",
+        receiptNotMeLink: "Diese Kündigung war ich nicht",
         contact: "Fragen richtest du bitte an",
         operatorSubject: {
             termination: "Kündigung: Bearbeitung nötig",
@@ -50,6 +55,9 @@ export const TERMINATION_TEXTS = {
             recording_failed: "Die Erklärung konnte nicht gespeichert werden",
             withdrawal_period_expired: "Widerruf nach Ablauf der Widerrufsfrist: zum Periodenende gekündigt, Anspruch prüfen",
             receipt_rate_limited: "Keine Eingangsbestätigung versendet: Limit pro Empfängeradresse erreicht",
+            revoked: "Die Erklärung wurde vom Postfachinhaber über „Diese Kündigung war ich nicht“ zurückgenommen",
+            revocation_resume_manual: "Die Kündigung beim Zahlungsanbieter bitte manuell zurücknehmen (keine Schnittstelle dafür)",
+            revocation_resume_failed: "Die Kündigung beim Zahlungsanbieter konnte nicht zurückgenommen werden, bitte manuell zurücknehmen",
         },
         noticeReasons: "Grund der Benachrichtigung",
         channel: "Kanal",
@@ -90,6 +98,19 @@ export const TERMINATION_TEXTS = {
             errorGeneric: "Deine Erklärung konnte nicht verarbeitet werden. Bitte versuch es erneut.",
             rateLimitedTitle: "Zu viele Anfragen",
             rateLimitedBody: "Von deiner Adresse kamen zu viele Anfragen. Bitte versuch es später erneut.",
+            revoke: {
+                confirmTitle: "Kündigung zurücknehmen?",
+                confirmLead: "Mit dem Klick auf den Button unten nimmst du die Kündigung zurück. Dein Vertrag läuft dann weiter.",
+                confirmButton: "Diese Kündigung war ich nicht",
+                revokedTitle: "Die Kündigung ist zurückgenommen",
+                revokedBody: "Dein Vertrag läuft weiter. Wir haben den Betreiber informiert.",
+                alreadyRevokedTitle: "Schon zurückgenommen",
+                alreadyRevokedBody: "Diese Kündigung wurde bereits zurückgenommen.",
+                tooLateTitle: "Zu spät für die Rücknahme",
+                tooLateBody: "Die Kündigung ist bereits wirksam geworden. Bitte schreib dem Betreiber, die Adresse steht in der Eingangsbestätigung.",
+                invalidTitle: "Link ungültig",
+                invalidBody: "Dieser Link ist ungültig oder abgelaufen. Bitte schreib dem Betreiber, die Adresse steht in der Eingangsbestätigung.",
+            },
         },
     },
     en: {
@@ -114,6 +135,8 @@ export const TERMINATION_TEXTS = {
         receiptIntro: "We confirm receipt of your declaration with the following content. This email is a receipt, not a confirmation that the declaration is effective.",
         receiptNextSteps: "We will review your declaration and get back to you once it is processed or if we have questions.",
         receiptRevoke: (operatorEmail) => `If you did not make this declaration or want to take it back, please write to ${operatorEmail} right away.`,
+        receiptNotMe: "Did you not make this declaration? Then take the termination back here until it takes effect:",
+        receiptNotMeLink: "I did not request this cancellation",
         contact: "Questions go to",
         operatorSubject: {
             termination: "Termination: action needed",
@@ -131,6 +154,9 @@ export const TERMINATION_TEXTS = {
             recording_failed: "The declaration could not be stored",
             withdrawal_period_expired: "Withdrawal after the withdrawal period: cancelled at period end, review the claim",
             receipt_rate_limited: "No receipt mail sent: the per-recipient limit was reached",
+            revoked: 'The declaration was taken back by the mailbox owner ("I did not request this cancellation")',
+            revocation_resume_manual: "Undo the cancellation at the payment provider manually (no API for it)",
+            revocation_resume_failed: "Undoing the cancellation at the payment provider failed, undo it manually",
         },
         noticeReasons: "Reason for this notice",
         channel: "Channel",
@@ -171,6 +197,19 @@ export const TERMINATION_TEXTS = {
             errorGeneric: "Your declaration could not be processed. Please try again.",
             rateLimitedTitle: "Too many requests",
             rateLimitedBody: "Too many requests came from your address. Please try again later.",
+            revoke: {
+                confirmTitle: "Take the cancellation back?",
+                confirmLead: "Click the button below to take the cancellation back. Your contract then continues.",
+                confirmButton: "I did not request this cancellation",
+                revokedTitle: "The cancellation was taken back",
+                revokedBody: "Your contract continues. We informed the operator.",
+                alreadyRevokedTitle: "Already taken back",
+                alreadyRevokedBody: "This cancellation was already taken back.",
+                tooLateTitle: "Too late to take it back",
+                tooLateBody: "The cancellation has already taken effect. Please write to the operator, the address is in the receipt.",
+                invalidTitle: "Invalid link",
+                invalidBody: "This link is invalid or has expired. Please write to the operator, the address is in the receipt.",
+            },
         },
     },
 };

package/dist/billing-foundation/events.d.ts

@@ -25,6 +25,7 @@ export declare const subscriptionEventPayloadSchema: z.ZodObject<{
     currentPeriodEndIso: z.ZodString;
     cancelAtIso: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     consentId: z.ZodOptional<z.ZodString>;
+    providerEventAtIso: z.ZodOptional<z.ZodISODateTime>;
 }, z.core.$strip>;
 export type SubscriptionEventPayload = z.infer<typeof subscriptionEventPayloadSchema>;
 export type SubscriptionEventHeaders = {
@@ -127,8 +128,16 @@ export declare const contractTerminationDeclaredPayloadSchema: z.ZodObject<{
         de: "de";
         en: "en";
     }>;
+    revocationTokenHash: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ContractTerminationDeclaredPayload = z.infer<typeof contractTerminationDeclaredPayloadSchema>;
+export declare const CONTRACT_TERMINATION_REVOKED_EVENT_SHORT: "contract-termination-revoked";
+export declare const CONTRACT_TERMINATION_REVOKED_EVENT_QN: "billing-foundation:event:contract-termination-revoked";
+export declare const contractTerminationRevokedPayloadSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    revokedAtIso: z.ZodString;
+}, z.core.$strip>;
+export type ContractTerminationRevokedPayload = z.infer<typeof contractTerminationRevokedPayloadSchema>;
 export declare const CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE: "contract-termination-unmatched";
 export declare const CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT: "contract-termination-unmatched";
 export declare const CONTRACT_TERMINATION_UNMATCHED_EVENT_QN: "billing-foundation:event:contract-termination-unmatched";

package/dist/billing-foundation/events.js

@@ -10,8 +10,8 @@
 // accounting-export, churn-analytics) listenen direkt auf den event-
 // type ohne payload-discriminator.
 import * as z from "zod";
-import { BILLING_FOUNDATION_FEATURE, SubscriptionStatuses } from "./constants.js";
-import { CONSENT_LOCALES } from "./consumer-protection/consent-locale.js";
+import { BILLING_FOUNDATION_FEATURE, SubscriptionStatuses } from "./web/constants.js";
+import { CONSENT_LOCALES } from "./web/consumer-protection/consent-locale.js";
 // Aggregate-type für den event-store. Eine subscription pro Tenant ist
 // ein stream; der subscriptionAggregateId-helper liefert die stream-id.
 export const SUBSCRIPTION_AGGREGATE_TYPE = "subscription";
@@ -56,6 +56,8 @@ export const subscriptionEventPayloadSchema = z.object({
     // doesn't report cancelAt at all — projection.ts tells the two apart.
     cancelAtIso: z.string().min(1).nullable().optional(),
     consentId: z.string().min(1).max(100).optional(),
+    // When the provider emitted the event; lets process-event drop late deliveries.
+    providerEventAtIso: z.iso.datetime().optional(),
 });
 // =============================================================================
 // payment-received — one-off-payments (checkout mode "payment")
@@ -151,6 +153,16 @@ export const contractTerminationDeclaredPayloadSchema = z.object({
     terminationKind: z.enum(CONTRACT_TERMINATION_KINDS),
     receivedAtIso: z.string().min(1),
     locale: z.enum(CONSENT_LOCALES),
+    // sha256 hex of the "this was not me" link token; events written before the
+    // link existed carry none and cannot be revoked.
+    revocationTokenHash: z.string().length(64).optional(),
+});
+// The mailbox owner took a public declaration back ("this was not me").
+export const CONTRACT_TERMINATION_REVOKED_EVENT_SHORT = "contract-termination-revoked";
+export const CONTRACT_TERMINATION_REVOKED_EVENT_QN = `${BILLING_FOUNDATION_FEATURE}:event:${CONTRACT_TERMINATION_REVOKED_EVENT_SHORT}`;
+export const contractTerminationRevokedPayloadSchema = z.object({
+    requestId: z.string().min(1).max(100),
+    revokedAtIso: z.string().min(1),
 });
 export const CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE = "contract-termination-unmatched";
 export const CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT = "contract-termination-unmatched";

package/dist/billing-foundation/feature.js

@@ -51,7 +51,6 @@
 // `subscription-provider-changed`-event-type später.
 import { defineFeature, EXT_TENANT_DATA, } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { BILLING_FOUNDATION_FEATURE, SUBSCRIPTION_PROVIDER_EXTENSION, SubscriptionFoundationHandlers, } from "./constants.js";
 import { registerConsumerProtection } from "./consumer-protection/register-consent.js";
 import { paymentEntity, subscriptionEntity } from "./entities.js";
 import { INVOICE_PAID_EVENT_QN, INVOICE_PAID_EVENT_SHORT, INVOICE_PAYMENT_FAILED_EVENT_QN, INVOICE_PAYMENT_FAILED_EVENT_SHORT, PAYMENT_AGGREGATE_TYPE, PAYMENT_RECEIVED_EVENT_QN, PAYMENT_RECEIVED_EVENT_SHORT, paymentEventPayloadSchema, SUBSCRIPTION_AGGREGATE_TYPE, SUBSCRIPTION_CANCELED_EVENT_QN, SUBSCRIPTION_CANCELED_EVENT_SHORT, SUBSCRIPTION_CREATED_EVENT_QN, SUBSCRIPTION_CREATED_EVENT_SHORT, SUBSCRIPTION_UPDATED_EVENT_QN, SUBSCRIPTION_UPDATED_EVENT_SHORT, subscriptionEventPayloadSchema, } from "./events.js";
@@ -69,6 +68,7 @@ import { applyInvoicePaid, applyInvoicePaymentFailed, applyPaymentReceived, appl
 import { createBillingPlansScreen } from "./screens.js";
 import { PAYMENT_TENANT_DESTROY_ARCHIVE_REASON, paymentTenantDestroyHook, SUBSCRIPTION_TENANT_DESTROY_ARCHIVE_REASON, subscriptionTenantDestroyHook, } from "./tenant-destroy-hook.js";
 import { validateOptions } from "./validate-options.js";
+import { BILLING_FOUNDATION_FEATURE, SUBSCRIPTION_PROVIDER_EXTENSION, SubscriptionFoundationHandlers, } from "./web/constants.js";
 export function createBillingFoundationFeature(options = {}) {
     validateOptions(options);
     // Handlers take the widened, string-tiered options — `TTier` only exists

package/dist/billing-foundation/handlers/process-event.write.d.ts

@@ -1,4 +1,5 @@
 import type { HandlerContext, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 export declare const processEventSchema: z.ZodObject<{
     providerEventId: z.ZodString;
@@ -22,11 +23,14 @@ export declare const processEventSchema: z.ZodObject<{
     tier: z.ZodString;
     currentPeriodEndIso: z.ZodString;
     cancelAtIso: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    providerEventAtIso: z.ZodOptional<z.ZodISODateTime>;
     consentId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ProcessEventPayload = z.infer<typeof processEventSchema>;
-export declare function appendSubscriptionEvent(ctx: HandlerContext, tenantId: string, payload: ProcessEventPayload): Promise<{
+export declare function clampProviderEventAt(payload: ProcessEventPayload, now: Temporal.Instant): ProcessEventPayload;
+export declare function appendSubscriptionEvent(ctx: HandlerContext, tenantId: string, rawPayload: ProcessEventPayload, now?: Temporal.Instant): Promise<{
     readonly duplicate: boolean;
+    readonly stale?: true;
     readonly subscriptionAggregateId: string;
 }>;
 export declare function createProcessEventHandler(now: () => Temporal.Instant): WriteHandlerDef;