@cosmicdrift/kumiko-samples 0.338.0 → 0.340.0

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-termination.ts

@@ -1,12 +1,17 @@
-import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../constants.js";
 import {
+  CONTRACT_TERMINATION_DECLARED_EVENT_QN,
+  CONTRACT_TERMINATION_DECLARED_EVENT_SHORT,
   CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT,
   CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT,
+  contractTerminationDeclaredPayloadSchema,
   contractTerminationRequestedPayloadSchema,
   contractTerminationUnmatchedPayloadSchema,
 } from "../events.js";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
 import {
+  createDeclareContractTerminationHandler,
   createRecordContractTerminationHandler,
   createRecordUnmatchedContractTerminationHandler,
   createTerminableSubscriptionQuery,
@@ -26,14 +31,55 @@ export function registerContractTermination(
     contractTerminationRequestedPayloadSchema,
     { piiFields: "none" },
   );
+  r.defineEvent(
+    CONTRACT_TERMINATION_DECLARED_EVENT_SHORT,
+    contractTerminationDeclaredPayloadSchema,
+    { piiFields: "none" },
+  );
   r.defineEvent(
     CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT,
     contractTerminationUnmatchedPayloadSchema,
     { piiFields: "none" },
   );
   r.queryHandler(createTerminableSubscriptionQuery());
-  r.writeHandler(createRecordContractTerminationHandler(options));
+  r.writeHandler(createDeclareContractTerminationHandler());
+  r.writeHandler(createRecordContractTerminationHandler(options, consumerProtection));
   r.writeHandler(createRecordUnmatchedContractTerminationHandler());
   r.writeHandler(createRequestContractTerminationHandler(options, consumerProtection));
   r.writeHandler(createTerminateContractHandler(options, consumerProtection));
+
+  // The provider cancel of a public declaration runs here, not in the
+  // request: matched and unmatched requests then do the same work and the
+  // response time does not tell whether the email belongs to a customer.
+  // The tenant comes from the stored trigger event (the job's system user).
+  r.job(
+    "cancel-on-public-termination-declared",
+    { trigger: { on: CONTRACT_TERMINATION_DECLARED_EVENT_QN }, runIn: "worker" },
+    async (payload, ctx) => {
+      const declared = contractTerminationDeclaredPayloadSchema.safeParse(payload);
+      // skip: trigger event carries no usable declaration
+      if (!declared.success) return;
+      const result = await ctx.writeAs(
+        createSystemUser(ctx.systemUser.tenantId),
+        SubscriptionFoundationHandlers.recordContractTermination,
+        {
+          requestId: declared.data.requestId,
+          declarationType: declared.data.declarationType,
+          terminationKind: declared.data.terminationKind,
+          channel: "public",
+          when:
+            declared.data.declarationType === "withdrawal"
+              ? "none"
+              : SubscriptionCancelTimings.periodEnd,
+          receivedAtIso: declared.data.receivedAtIso,
+          locale: declared.data.locale,
+        },
+      );
+      if (!result.isSuccess) {
+        throw new Error(
+          `billing-foundation:cancel-on-public-termination-declared: record-contract-termination failed: ${JSON.stringify(result.error)}`,
+        );
+      }
+    },
+  );
 }

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-mail.ts

@@ -24,6 +24,13 @@ export type TerminationDeclaration = {
   readonly reason?: string;
 };
 
+/** The operator notice for a provider problem has no declarant data at all. */
+export type OperatorNoticeDeclaration = Pick<
+  TerminationDeclaration,
+  "declarationType" | "terminationKind"
+> &
+  Partial<Omit<TerminationDeclaration, "declarationType" | "terminationKind">>;
+
 const TIME_ZONE_BY_LOCALE: Readonly<Record<ConsentLocale, string>> = {
   de: "Europe/Berlin",
   en: "UTC",
@@ -44,7 +51,7 @@ export function formatReceivedAt(iso: string, locale: ConsentLocale): string {
 }
 
 function declarationLines(
-  declaration: TerminationDeclaration,
+  declaration: OperatorNoticeDeclaration,
   locale: ConsentLocale,
 ): readonly { readonly text: string }[] {
   const texts = TERMINATION_TEXTS[locale];
@@ -52,7 +59,7 @@ function declarationLines(
     `${texts.declarationType}: ${texts.declarationTypeLabel[declaration.declarationType]}`,
     `${texts.terminationKind}: ${texts.terminationKindLabel[declaration.terminationKind]}`,
     ...(declaration.name !== undefined ? [`${texts.name}: ${declaration.name}`] : []),
-    `${texts.email}: ${declaration.email}`,
+    ...(declaration.email !== undefined ? [`${texts.email}: ${declaration.email}`] : []),
     ...(declaration.customerReference
       ? [`${texts.customerReference}: ${declaration.customerReference}`]
       : []),
@@ -96,7 +103,7 @@ export type RenderOperatorNoticeArgs = {
   readonly requestId: string;
   readonly receivedAtIso: string;
   readonly channel: "public" | "account";
-  readonly declaration: TerminationDeclaration;
+  readonly declaration: OperatorNoticeDeclaration;
   readonly reasons: readonly OperatorNoticeReason[];
   readonly tenantId?: string;
   readonly providerCancel?: ProviderCancelOutcome;

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-notify.ts

@@ -0,0 +1,44 @@
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE } from "../constants.js";
+import type { ProviderCancelOutcome } from "../events.js";
+import type { ConsumerProtectionOptions } from "../types.js";
+import type { ConsentLocale } from "./consent-text.js";
+import { type OperatorNoticeDeclaration, renderOperatorNotice } from "./termination-mail.js";
+import type { OperatorNoticeReason } from "./termination-texts.js";
+
+export type OperatorNoticePlan = {
+  readonly locale: ConsentLocale;
+  readonly requestId: string;
+  readonly receivedAtIso: string;
+  readonly channel: "public" | "account";
+  readonly declaration: OperatorNoticeDeclaration;
+  readonly reasons: readonly OperatorNoticeReason[];
+  readonly tenantId?: string;
+  readonly providerCancel?: ProviderCancelOutcome;
+};
+
+export function requireNotify(ctx: HandlerContext): NonNullable<HandlerContext["notify"]> {
+  if (!ctx.notify) {
+    throw new InternalError({
+      message:
+        "billing-foundation:termination: ctx.notify unavailable — the delivery feature must be mounted",
+    });
+  }
+  return ctx.notify;
+}
+
+export async function notifyOperator(
+  ctx: HandlerContext,
+  consumerProtection: ConsumerProtectionOptions,
+  plan: OperatorNoticePlan,
+): Promise<void> {
+  await requireNotify(ctx)(CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE, {
+    route: { email: consumerProtection.operatorEmail },
+    data: renderOperatorNotice({
+      ...plan,
+      operatorEmail: consumerProtection.operatorEmail,
+    }),
+    priority: "critical",
+  });
+}

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-pages.ts

@@ -4,6 +4,7 @@
 import type { AnonymousExtraRoute } from "@cosmicdrift/kumiko-framework/api";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import type { Context } from "hono";
+import { getCookie } from "hono/cookie";
 import { securePageHeaders, wrapInLayout } from "../../page-render/index.js";
 import { SubscriptionFoundationHandlers } from "../constants.js";
 import { CONTRACT_TERMINATION_DECLARATION_TYPES, CONTRACT_TERMINATION_KINDS } from "../events.js";
@@ -247,6 +248,33 @@ type WriteResponseBody = {
 
 const RATE_LIMITED_CODE = "rate_limited";
 
+const TENANT_HEADER = "x-tenant";
+const TENANT_COOKIE = "kumiko_tenant";
+// Exactly what the anonymous tenant resolution reads. The resolver and its
+// trust rules still decide; the re-entry only sees what a direct /api/write
+// from this client would see. Never the session cookie or Authorization (the
+// handler is anonymous) and never X-Forwarded-For (the resolved clientIp
+// travels as env).
+const FORWARDED_TENANT_HEADERS = [
+  "host",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  TENANT_HEADER,
+] as const;
+
+function reentryHeaders(c: Context): Headers {
+  const headers = new Headers({ "content-type": "application/json" });
+  for (const name of FORWARDED_TENANT_HEADERS) {
+    const value = c.req.header(name);
+    if (value !== undefined) headers.set(name, value);
+  }
+  const tenantCookie = getCookie(c, TENANT_COOKIE);
+  if (tenantCookie !== undefined) {
+    headers.set("cookie", `${TENANT_COOKIE}=${encodeURIComponent(tenantCookie)}`);
+  }
+  return headers;
+}
+
 async function submitDeclaration(
   c: Context,
   app: { fetch: (request: Request, env?: unknown) => Response | Promise<Response> },
@@ -261,11 +289,13 @@ async function submitDeclaration(
   // deps.write only resolves a session user under /api/*; this page lives
   // outside it, so it re-enters the dispatcher through the app like the
   // user-export by-token route. The resolved clientIp as env keeps the
-  // handler's per-IP rate limit per visitor instead of one shared bucket.
+  // handler's per-IP rate limit per visitor instead of one shared bucket;
+  // the forwarded host headers let a host-based tenant resolver see this
+  // visitor's host.
   const response = await app.fetch(
     new Request(`${new URL(c.req.url).origin}/api/write`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: reentryHeaders(c),
       body: JSON.stringify({
         type: SubscriptionFoundationHandlers.requestContractTermination,
         payload: payloadOf(values, locale),

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-record.ts

@@ -5,6 +5,7 @@
 
 import {
   access,
+  type HandlerContext,
   type QueryHandlerDef,
   SYSTEM_ROLE,
   type WriteHandlerDef,
@@ -17,17 +18,22 @@ import { isTerminalSubscriptionStatus, SubscriptionCancelTimings } from "../cons
 import {
   CONTRACT_TERMINATION_CHANNELS,
   CONTRACT_TERMINATION_DECLARATION_TYPES,
+  CONTRACT_TERMINATION_DECLARED_EVENT_QN,
   CONTRACT_TERMINATION_KINDS,
   CONTRACT_TERMINATION_REQUESTED_EVENT_QN,
   CONTRACT_TERMINATION_UNMATCHED_AGGREGATE_TYPE,
   CONTRACT_TERMINATION_UNMATCHED_EVENT_QN,
+  type ContractTerminationDeclaredPayload,
   type ContractTerminationRequestedPayload,
   type ContractTerminationUnmatchedPayload,
+  contractTerminationRequestedPayloadSchema,
   type ProviderCancelOutcome,
   SUBSCRIPTION_AGGREGATE_TYPE,
 } from "../events.js";
 import { getSubscriptionForTenant } from "../get-subscription-for-tenant.js";
-import type { ResolvedBillingFoundationOptions } from "../types.js";
+import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
+import { CONSENT_LOCALES, FALLBACK_CONSENT_LOCALE } from "./consent-locale.js";
+import { notifyOperator } from "./termination-notify.js";
 import type { OperatorNoticeReason } from "./termination-texts.js";
 
 const REQUESTED_CANCEL_TIMINGS = [
@@ -43,6 +49,20 @@ export const recordContractTerminationSchema = z
     terminationKind: z.enum(CONTRACT_TERMINATION_KINDS),
     channel: z.enum(CONTRACT_TERMINATION_CHANNELS),
     when: z.enum(REQUESTED_CANCEL_TIMINGS),
+    // The public job passes the time the declaration arrived and the declarant's
+    // locale, so the record and a provider-problem notice do not take the job's.
+    receivedAtIso: z.string().min(1).optional(),
+    locale: z.enum(CONSENT_LOCALES).optional(),
+  })
+  .strict();
+
+export const declareContractTerminationSchema = z
+  .object({
+    requestId: z.string().min(1).max(100),
+    declarationType: z.enum(CONTRACT_TERMINATION_DECLARATION_TYPES),
+    terminationKind: z.enum(CONTRACT_TERMINATION_KINDS),
+    receivedAtIso: z.string().min(1),
+    locale: z.enum(CONSENT_LOCALES),
   })
   .strict();
 
@@ -85,8 +105,71 @@ export function createTerminableSubscriptionQuery(): QueryHandlerDef {
   };
 }
 
+type ProviderCancelResult = Pick<
+  RecordContractTerminationResult,
+  "providerCancel" | "effectiveAtIso" | "noticeReason"
+>;
+
+async function cancelAtProvider(
+  ctx: HandlerContext,
+  tenantId: string,
+  when: (typeof REQUESTED_CANCEL_TIMINGS)[number],
+  receivedAtIso: string,
+): Promise<ProviderCancelResult> {
+  // skip: a withdrawal over the public channel makes no provider call
+  if (when === "none") return { providerCancel: "none", effectiveAtIso: null, noticeReason: null };
+  const subscription = await getSubscriptionForTenant(ctx, tenantId);
+  if (subscription === null || isTerminalSubscriptionStatus(subscription.status)) {
+    return { providerCancel: "none", effectiveAtIso: null, noticeReason: "no_active_subscription" };
+  }
+  const plugin = findPlugin(ctx, subscription.providerName);
+  if (!plugin?.cancelSubscription) {
+    return { providerCancel: "none", effectiveAtIso: null, noticeReason: "provider_cannot_cancel" };
+  }
+  try {
+    await plugin.cancelSubscription(ctx, {
+      providerSubscriptionId: subscription.providerSubscriptionId,
+      when,
+    });
+  } catch (error) {
+    ctx.log?.warn(
+      `[billing-foundation:record-contract-termination] provider cancel failed for tenant ${tenantId}: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    return { providerCancel: "none", effectiveAtIso: null, noticeReason: "provider_error" };
+  }
+  return {
+    providerCancel: when,
+    effectiveAtIso:
+      when === SubscriptionCancelTimings.immediately
+        ? receivedAtIso
+        : subscription.currentPeriodEnd.toString(),
+    noticeReason: null,
+  };
+}
+
+export function createDeclareContractTerminationHandler(): WriteHandlerDef {
+  return {
+    name: "declare-contract-termination",
+    agent: { expose: false },
+    schema: declareContractTerminationSchema,
+    access: { roles: access.system },
+    handler: async (event, ctx) => {
+      // @cast-boundary engine-payload — dispatcher-zod-validated payload
+      const payload = event.payload as z.infer<typeof declareContractTerminationSchema>;
+      const stream = await ctx.fetchForWriting({
+        aggregateId: subscriptionAggregateId(event.user.tenantId),
+        aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+      });
+      const declared: ContractTerminationDeclaredPayload = payload;
+      await stream.appendOne({ type: CONTRACT_TERMINATION_DECLARED_EVENT_QN, payload: declared });
+      return { isSuccess: true as const, data: { declared: true } };
+    },
+  };
+}
+
 export function createRecordContractTerminationHandler(
   options: ResolvedBillingFoundationOptions,
+  consumerProtection: ConsumerProtectionOptions,
 ): WriteHandlerDef {
   return {
     name: "record-contract-termination",
@@ -104,45 +187,40 @@ export function createRecordContractTerminationHandler(
         });
       }
 
-      const receivedAtIso = options.now().toString();
+      const receivedAtIso = payload.receivedAtIso ?? options.now().toString();
       const stream = await ctx.fetchForWriting({
         aggregateId: subscriptionAggregateId(tenantId),
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
       });
 
-      let providerCancel: ProviderCancelOutcome = "none";
-      let effectiveAtIso: string | null = null;
-      let noticeReason: RecordContractTerminationResult["noticeReason"] = null;
-
-      if (payload.when !== "none") {
-        const subscription = await getSubscriptionForTenant(ctx, tenantId);
-        if (subscription === null || isTerminalSubscriptionStatus(subscription.status)) {
-          noticeReason = "no_active_subscription";
-        } else {
-          const plugin = findPlugin(ctx, subscription.providerName);
-          if (!plugin?.cancelSubscription) {
-            noticeReason = "provider_cannot_cancel";
-          } else {
-            try {
-              await plugin.cancelSubscription(ctx, {
-                providerSubscriptionId: subscription.providerSubscriptionId,
-                when: payload.when,
-              });
-              providerCancel = payload.when;
-              effectiveAtIso =
-                payload.when === SubscriptionCancelTimings.immediately
-                  ? receivedAtIso
-                  : subscription.currentPeriodEnd.toString();
-            } catch (error) {
-              ctx.log?.warn(
-                `[billing-foundation:record-contract-termination] provider cancel failed for tenant ${tenantId}: ${error instanceof Error ? error.message : String(error)}`,
-              );
-              noticeReason = "provider_error";
-            }
-          }
-        }
+      // The public job runs at least once: a second run must not call the
+      // provider or append again.
+      const alreadyRecorded = stream.events
+        .map((e) =>
+          e.type === CONTRACT_TERMINATION_REQUESTED_EVENT_QN
+            ? contractTerminationRequestedPayloadSchema.safeParse(e.payload).data
+            : undefined,
+        )
+        .find((recordedPayload) => recordedPayload?.requestId === payload.requestId);
+      if (alreadyRecorded) {
+        return {
+          isSuccess: true as const,
+          data: {
+            receivedAtIso: alreadyRecorded.receivedAtIso,
+            effectiveAtIso: alreadyRecorded.effectiveAtIso,
+            providerCancel: alreadyRecorded.providerCancel,
+            noticeReason: null,
+          } satisfies RecordContractTerminationResult,
+        };
       }
 
+      const { providerCancel, effectiveAtIso, noticeReason } = await cancelAtProvider(
+        ctx,
+        tenantId,
+        payload.when,
+        receivedAtIso,
+      );
+
       const recorded: ContractTerminationRequestedPayload = {
         requestId: payload.requestId,
         declarationType: payload.declarationType,
@@ -157,6 +235,24 @@ export function createRecordContractTerminationHandler(
         payload: recorded,
       });
 
+      // The account path reports the provider outcome to its caller and the
+      // operator in its own mail; the public path has nobody else to tell.
+      if (payload.channel === "public" && noticeReason !== null) {
+        await notifyOperator(ctx, consumerProtection, {
+          locale: payload.locale ?? FALLBACK_CONSENT_LOCALE,
+          requestId: payload.requestId,
+          receivedAtIso,
+          channel: "public",
+          declaration: {
+            declarationType: payload.declarationType,
+            terminationKind: payload.terminationKind,
+          },
+          reasons: [noticeReason],
+          tenantId,
+          providerCancel,
+        });
+      }
+
       return {
         isSuccess: true as const,
         data: {

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-request.ts

@@ -16,7 +16,6 @@ import * as z from "zod";
 import { TenantQueries } from "../../tenant/index.js";
 import { UserQueries } from "../../user/index.js";
 import {
-  CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE,
   CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE,
   SubscriptionCancelTimings,
   SubscriptionFoundationHandlers,
@@ -31,12 +30,9 @@ import {
 } from "../events.js";
 import { purchaseRolesOf } from "../plan-catalog.js";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.js";
-import { type ConsentLocale, resolveConsentLocale } from "./consent-text.js";
-import {
-  renderOperatorNotice,
-  renderTerminationReceipt,
-  type TerminationDeclaration,
-} from "./termination-mail.js";
+import { resolveConsentLocale } from "./consent-text.js";
+import { renderTerminationReceipt, type TerminationDeclaration } from "./termination-mail.js";
+import { notifyOperator, type OperatorNoticePlan, requireNotify } from "./termination-notify.js";
 import type { RecordContractTerminationResult } from "./termination-record.js";
 import type { OperatorNoticeReason } from "./termination-texts.js";
 
@@ -106,29 +102,14 @@ function needsOperatorNotice(declaration: {
   ];
 }
 
-type TerminationMailPlan = {
-  readonly locale: ConsentLocale;
-  readonly requestId: string;
-  readonly receivedAtIso: string;
-  readonly channel: "public" | "account";
-  readonly declaration: TerminationDeclaration;
-  readonly reasons: readonly OperatorNoticeReason[];
-  readonly tenantId?: string;
-  readonly providerCancel?: ProviderCancelOutcome;
-};
+type TerminationMailPlan = OperatorNoticePlan & { readonly declaration: TerminationDeclaration };
 
 async function sendTerminationMails(
   ctx: HandlerContext,
   consumerProtection: ConsumerProtectionOptions,
   plan: TerminationMailPlan,
 ): Promise<void> {
-  if (!ctx.notify) {
-    throw new InternalError({
-      message:
-        "billing-foundation:termination: ctx.notify unavailable — the delivery feature must be mounted",
-    });
-  }
-  await ctx.notify(CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, {
+  await requireNotify(ctx)(CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, {
     route: { email: plan.declaration.email },
     data: renderTerminationReceipt({
       locale: plan.locale,
@@ -141,21 +122,7 @@ async function sendTerminationMails(
   });
   // skip: no operator notice needed for this declaration
   if (plan.reasons.length === 0) return;
-  await ctx.notify(CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE, {
-    route: { email: consumerProtection.operatorEmail },
-    data: renderOperatorNotice({
-      locale: plan.locale,
-      requestId: plan.requestId,
-      receivedAtIso: plan.receivedAtIso,
-      channel: plan.channel,
-      declaration: plan.declaration,
-      reasons: plan.reasons,
-      operatorEmail: consumerProtection.operatorEmail,
-      ...(plan.tenantId !== undefined && { tenantId: plan.tenantId }),
-      ...(plan.providerCancel !== undefined && { providerCancel: plan.providerCancel }),
-    }),
-    priority: "critical",
-  });
+  await notifyOperator(ctx, consumerProtection, plan);
 }
 
 // Tenants the entered email can terminate a contract for: tenants where the
@@ -212,6 +179,7 @@ export function createRequestContractTerminationHandler(
     schema: requestContractTerminationSchema,
     access: { roles: ["anonymous"] },
     rateLimit: { per: "ip+handler", limit: 5, windowSeconds: 600 },
+    ...(consumerProtection.terminationScope === "platform" && { tenantlessAnonymous: true }),
     escapeHatch: {
       reason:
         "Anonymous declarant has no session — finds the contract by email via ctx.queryAs(system, user:find-for-auth) and tenant:memberships; the tenant written to comes only from those lookups.",
@@ -223,32 +191,19 @@ export function createRequestContractTerminationHandler(
       const receivedAtIso = options.now().toString();
       const { declarationType, terminationKind } = payload;
       const reasons: OperatorNoticeReason[] = [];
+      const locale = resolveConsentLocale(payload.locale);
       let matchedTenantId: string | undefined;
-      let providerCancel: ProviderCancelOutcome | undefined;
 
       const candidates = await findTerminableTenantIds(ctx, event.user.tenantId, payload.email);
       const [onlyCandidate] = candidates;
       if (candidates.length === 1 && onlyCandidate !== undefined) {
         matchedTenantId = onlyCandidate;
-        const recorded = await ctx.writeAs(
+        const declared = await ctx.writeAs(
           createSystemUser(onlyCandidate),
-          SubscriptionFoundationHandlers.recordContractTermination,
-          {
-            requestId,
-            declarationType,
-            terminationKind,
-            channel: "public",
-            when: declarationType === "withdrawal" ? "none" : SubscriptionCancelTimings.periodEnd,
-          },
+          SubscriptionFoundationHandlers.declareContractTermination,
+          { requestId, declarationType, terminationKind, receivedAtIso, locale },
         );
-        if (recorded.isSuccess) {
-          // @cast-boundary engine-payload — our own record handler's return shape
-          const data = recorded.data as RecordContractTerminationResult;
-          providerCancel = data.providerCancel;
-          if (data.noticeReason !== null) reasons.push(data.noticeReason);
-        } else {
-          reasons.push("recording_failed");
-        }
+        if (!declared.isSuccess) reasons.push("recording_failed");
       } else {
         reasons.push(candidates.length === 0 ? "unmatched" : "ambiguous");
         const recorded = await ctx.writeAs(
@@ -267,7 +222,7 @@ export function createRequestContractTerminationHandler(
       reasons.push(...needsOperatorNotice(payload));
 
       await sendTerminationMails(ctx, consumerProtection, {
-        locale: resolveConsentLocale(payload.locale),
+        locale,
         requestId,
         receivedAtIso,
         channel: "public",
@@ -283,7 +238,6 @@ export function createRequestContractTerminationHandler(
         },
         reasons,
         ...(matchedTenantId !== undefined && { tenantId: matchedTenantId }),
-        ...(providerCancel !== undefined && { providerCancel }),
       });
 
       return {

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-texts.ts

@@ -90,21 +90,21 @@ export const TERMINATION_TEXTS: Readonly<Record<ConsentLocale, TerminationTexts>
     customerReference: "Kundennummer / Referenz",
     reasonFieldLabel: "Begründung",
     receiptSubject: {
-      termination: "Eingangsbestätigung Ihrer Kündigung",
-      withdrawal: "Eingangsbestätigung Ihres Widerrufs",
+      termination: "Eingangsbestätigung deiner Kündigung",
+      withdrawal: "Eingangsbestätigung deines Widerrufs",
     },
     receiptIntro:
-      "wir bestätigen den Eingang Ihrer Erklärung mit folgendem Inhalt. Diese E-Mail ist eine Eingangsbestätigung, keine Bestätigung der Wirksamkeit.",
+      "wir bestätigen den Eingang deiner Erklärung mit folgendem Inhalt. Diese E-Mail ist eine Eingangsbestätigung, keine Bestätigung der Wirksamkeit.",
     receiptNextSteps:
-      "Wir prüfen Ihre Erklärung und melden uns, sobald sie bearbeitet ist oder wir Rückfragen haben.",
+      "Wir prüfen deine Erklärung und melden uns, sobald sie bearbeitet ist oder wir Rückfragen haben.",
     receiptRevoke: (operatorEmail) =>
-      `Haben Sie diese Erklärung nicht abgegeben oder möchten Sie sie zurücknehmen? Schreiben Sie uns bitte umgehend an ${operatorEmail}.`,
-    contact: "Fragen richten Sie bitte an",
+      `Hast du diese Erklärung nicht abgegeben oder möchtest du sie zurücknehmen? Schreib uns bitte umgehend an ${operatorEmail}.`,
+    contact: "Fragen richtest du bitte an",
     operatorSubject: {
       termination: "Kündigung: Bearbeitung nötig",
       withdrawal: "Widerruf: Bearbeitung nötig",
     },
-    operatorIntro: "Es ist eine Erklärung eingegangen, die Ihre Bearbeitung braucht.",
+    operatorIntro: "Es ist eine Erklärung eingegangen, die bearbeitet werden muss.",
     operatorReasons: {
       unmatched: "Kein passender Vertrag zur angegebenen E-Mail gefunden",
       ambiguous: "Die angegebene E-Mail passt zu mehreren Verträgen",
@@ -127,8 +127,8 @@ export const TERMINATION_TEXTS: Readonly<Record<ConsentLocale, TerminationTexts>
     },
     page: {
       title: "Vertrag kündigen oder widerrufen",
-      lead: "Mit diesem Formular erklären Sie die Kündigung oder den Widerruf Ihres Vertrags. Sie brauchen dafür kein Kundenkonto.",
-      declarationTypeHeading: "Was möchten Sie erklären?",
+      lead: "Mit diesem Formular erklärst du die Kündigung oder den Widerruf deines Vertrags. Du brauchst dafür kein Kundenkonto.",
+      declarationTypeHeading: "Was möchtest du erklären?",
       kindHeading: "Art der Kündigung",
       reasonHint: "Pflicht bei außerordentlicher Kündigung.",
       earliestDate: "Die Kündigung gilt zum nächstmöglichen Zeitpunkt.",
@@ -137,25 +137,24 @@ export const TERMINATION_TEXTS: Readonly<Record<ConsentLocale, TerminationTexts>
       customerReferenceLabel: "Kundennummer (optional)",
       reasonLabel: "Begründung",
       reviewButton: "Weiter zur Prüfung",
-      reviewTitle: "Bitte prüfen Sie Ihre Angaben",
-      reviewLead: "Erst mit dem Klick auf den Button unten wird Ihre Erklärung abgegeben.",
+      reviewTitle: "Bitte prüfe deine Angaben",
+      reviewLead: "Erst mit dem Klick auf den Button unten wird deine Erklärung abgegeben.",
       confirmButton: { termination: "Jetzt kündigen", withdrawal: "Jetzt widerrufen" },
       backButton: "Angaben ändern",
-      resultTitle: "Ihre Erklärung ist eingegangen",
-      resultLead: "Wir haben Ihre Erklärung erhalten und senden Ihnen eine Eingangsbestätigung.",
+      resultTitle: "Deine Erklärung ist eingegangen",
+      resultLead: "Wir haben deine Erklärung erhalten und senden dir eine Eingangsbestätigung.",
       resultReceivedAt: "Eingegangen am",
       resultRequestId: "Vorgangsnummer",
-      resultMailNote: "Die Eingangsbestätigung geht an die von Ihnen angegebene E-Mail-Adresse.",
-      errorsHeading: "Bitte korrigieren Sie Ihre Angaben",
-      errorName: "Bitte geben Sie Ihren Namen an.",
-      errorEmail: "Bitte geben Sie eine gültige E-Mail-Adresse an.",
+      resultMailNote: "Die Eingangsbestätigung geht an die von dir angegebene E-Mail-Adresse.",
+      errorsHeading: "Bitte korrigiere deine Angaben",
+      errorName: "Bitte gib deinen Namen an.",
+      errorEmail: "Bitte gib eine gültige E-Mail-Adresse an.",
       errorReason: "Bei einer außerordentlichen Kündigung ist eine Begründung nötig.",
-      errorChoice: "Bitte wählen Sie eine Erklärung und die Art der Kündigung.",
-      errorGeneric:
-        "Ihre Erklärung konnte nicht verarbeitet werden. Bitte versuchen Sie es erneut.",
+      errorChoice: "Bitte wähle eine Erklärung und die Art der Kündigung.",
+      errorGeneric: "Deine Erklärung konnte nicht verarbeitet werden. Bitte versuch es erneut.",
       rateLimitedTitle: "Zu viele Anfragen",
       rateLimitedBody:
-        "Von Ihrer Adresse kamen zu viele Anfragen. Bitte versuchen Sie es später erneut.",
+        "Von deiner Adresse kamen zu viele Anfragen. Bitte versuch es später erneut.",
     },
   },
   en: {