@cosmicdrift/kumiko-samples 0.339.0 → 0.341.0

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -23,8 +23,15 @@ import {
   access,
   assignableAppRolesOf,
   defineWriteHandler,
+  type HandlerContext,
+  type SessionUser,
+  type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  InternalError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
@@ -40,14 +47,19 @@ import {
   reservedMembershipRoleError,
   unassignableMembershipRoleError,
 } from "../../tenant/membership-roles.js";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
 import type { AuthMailLocale } from "../email-templates.js";
 import { renderInviteEmail } from "../email-templates.js";
+import { inviteAlreadyAccepted } from "../errors.js";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 
 const INVITE_NOTIFICATION_TYPE = "auth-email-password:invite";
 
+type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+
 const InviteCreateSchema = z.object({
   email: z.email(),
   role: z.string().min(1).max(50),
@@ -59,6 +71,7 @@ export type InviteCreateData = {
   readonly tenantId: string;
   readonly email: string;
   readonly role: string;
+  readonly globalRoles: readonly GlobalRole[];
   readonly expiresAt: string;
 };
 
@@ -97,15 +110,160 @@ function findRankedRole(roles: readonly string[]): string | undefined {
   return roles.find((role) => findForbiddenRoleAssignment(["system"], [role], []) === undefined);
 }
 
-export function createInviteCreateHandler(opts: InviteCreateOptions) {
+type InviteIssueRequest = {
+  readonly email: string;
+  readonly role: string;
+  readonly globalRoles: readonly GlobalRole[];
+};
+
+function checkAssignableInviteRole(
+  opts: InviteCreateOptions,
+  inviterRoles: readonly string[],
+  role: string,
+  ctx: HandlerContext,
+): WriteFailure | undefined {
+  const forbiddenRole = findForbiddenMembershipRole([role]);
+  if (forbiddenRole !== undefined) return writeFailure(reservedMembershipRoleError(forbiddenRole));
+
+  const elevationForbidden = findForbiddenRoleAssignment(
+    inviterRoles,
+    [role],
+    [],
+    assignableAppRolesOf(ctx.registry),
+  );
+  if (
+    elevationForbidden !== undefined &&
+    !opts.additionalAssignableRoles?.includes(elevationForbidden)
+  ) {
+    return writeFailure(unassignableMembershipRoleError(elevationForbidden));
+  }
+
+  if (opts.canAssignRole && !opts.canAssignRole(inviterRoles, role)) {
+    return writeFailure(unassignableMembershipRoleError(role));
+  }
+  return undefined;
+}
+
+async function issueInvitation(
+  opts: InviteCreateOptions,
+  ttlSeconds: number,
+  request: InviteIssueRequest,
+  inviter: SessionUser,
+  ctx: HandlerContext,
+  refuseAccepted = false,
+): Promise<WriteResult<InviteCreateData>> {
+  if (!ctx.redis) {
+    return writeFailure(
+      new InternalError({ message: "invite-create requires ctx.redis for token store" }),
+    );
+  }
+
+  const email = request.email.toLowerCase();
+  const tenantId = inviter.tenantId;
+  const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
+
+  // The unique index allows one row per (tenantId, email). Whatever its
+  // status, a re-invite resets it to pending with a fresh token.
+  const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
+
+  let invitationId: string;
+  if (existing) {
+    // Provisioning callers (waitlist) must not flip an accepted invite back to
+    // pending: that would let them cancel a live membership's invitation.
+    // The tenant-admin path keeps resetting because re-inviting a member is
+    // how roles get re-assigned.
+    if (refuseAccepted && existing["status"] === INVITATION_STATUS.accepted) {
+      return inviteAlreadyAccepted();
+    }
+    invitationId = existing["id"] as string; // @cast-boundary db-row
+    const existingVersion = existing["version"] as number; // @cast-boundary db-row
+    // At most one live invite token per invitation: invalidate
+    // whatever's there before minting the new one.
+    await invalidateExistingInviteToken(ctx.redis, invitationId);
+
+    const updateResult = await executor.update(
+      {
+        id: invitationId,
+        version: existingVersion,
+        changes: {
+          role: request.role,
+          // Always written, also as []: a tenant-admin resend must drop
+          // global roles a previous system invite put on this row.
+          globalRoles: [...request.globalRoles],
+          status: INVITATION_STATUS.pending,
+          invitedBy: inviter.id,
+          expiresAt,
+        },
+      },
+      inviter,
+      ctx.db,
+    );
+    if (!updateResult.isSuccess) return updateResult;
+  } else {
+    const createResult = await executor.create(
+      {
+        email,
+        role: request.role,
+        globalRoles: [...request.globalRoles],
+        status: INVITATION_STATUS.pending,
+        invitedBy: inviter.id,
+        expiresAt,
+      },
+      inviter,
+      ctx.db,
+    );
+    if (!createResult.isSuccess) return createResult;
+    invitationId = (createResult.data as { id: string }).id; // @cast-boundary engine-payload
+  }
+
+  const token = generateToken();
+  await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
+
+  const locale = resolveHandlerMailLocale(ctx, opts.locale);
+
+  await dispatchMagicLinkMail(
+    ctx.notify,
+    {
+      handlerName: "invite-create",
+      notificationType: INVITE_NOTIFICATION_TYPE,
+      renderContent: (renderArgs) => renderInviteEmail({ ...renderArgs, role: request.role }),
+    },
+    {
+      email,
+      appUrl: opts.appUrl,
+      token,
+      expiresAt: expiresAt.toString(),
+      ...(opts.appName !== undefined && { appName: opts.appName }),
+      locale,
+    },
+  );
+
+  return {
+    isSuccess: true,
+    data: {
+      kind: "invite-created",
+      invitationId,
+      tenantId,
+      email,
+      role: request.role,
+      globalRoles: request.globalRoles,
+      expiresAt: expiresAt.toString(),
+    },
+  };
+}
+
+function assertAppDefinedAdditionalRoles(opts: InviteCreateOptions): void {
   const rankedRole = findRankedRole(opts.additionalAssignableRoles ?? []);
   if (rankedRole !== undefined) {
     throw new Error(
       `[auth-email-password] invite.additionalAssignableRoles must list app-defined roles only; "${rankedRole}" is a framework-ranked role`,
     );
   }
-  const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES;
-  const ttlSeconds = ttlMinutes * 60;
+}
+
+export function createInviteCreateHandler(opts: InviteCreateOptions) {
+  assertAppDefinedAdditionalRoles(opts);
+  const ttlSeconds = (opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES) * 60;
 
   return defineWriteHandler<"invite-create", typeof InviteCreateSchema, InviteCreateData>({
     name: "invite-create",
@@ -114,119 +272,58 @@ export function createInviteCreateHandler(opts: InviteCreateOptions) {
     description:
       "Invites an email address into the caller's tenant with a chosen membership role, creating or reusing the invitation and mailing the invitee a fresh accept link; re-inviting the same address invalidates the previous link.",
     handler: async (event, ctx) => {
-      if (!ctx.redis) {
-        return writeFailure(
-          new InternalError({ message: "invite-create requires ctx.redis for token store" }),
-        );
-      }
-
-      const forbiddenRole = findForbiddenMembershipRole([event.payload.role]);
-      if (forbiddenRole !== undefined) {
-        return writeFailure(reservedMembershipRoleError(forbiddenRole));
-      }
-
-      const elevationForbidden = findForbiddenRoleAssignment(
+      const roleRejection = checkAssignableInviteRole(
+        opts,
         event.user.roles,
-        [event.payload.role],
-        [],
-        assignableAppRolesOf(ctx.registry),
+        event.payload.role,
+        ctx,
       );
-      if (
-        elevationForbidden !== undefined &&
-        !opts.additionalAssignableRoles?.includes(elevationForbidden)
-      ) {
-        return writeFailure(unassignableMembershipRoleError(elevationForbidden));
-      }
-
-      if (opts.canAssignRole && !opts.canAssignRole(event.user.roles, event.payload.role)) {
-        return writeFailure(unassignableMembershipRoleError(event.payload.role));
-      }
-
-      const email = event.payload.email.toLowerCase();
-      const tenantId = event.user.tenantId;
-      const expiresAt = Temporal.Now.instant().add({ seconds: ttlSeconds });
-
-      // Existing row für (tenantId, email) — unique-index garantiert
-      // max. eine Row. Status egal (cancelled/accepted/expired/pending);
-      // wir setzen sie auf pending zurück und vergeben einen frischen
-      // Token wenn der bisherige nicht mehr lebt.
-      const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
-
-      let invitationId: string;
-      let token: string;
-      if (existing) {
-        invitationId = existing["id"] as string; // @cast-boundary db-row
-        const existingVersion = existing["version"] as number; // @cast-boundary db-row
-        // At most one live invite token per invitation: invalidate
-        // whatever's there before minting the new one.
-        await invalidateExistingInviteToken(ctx.redis, invitationId);
-        token = generateToken();
-
-        const updateResult = await executor.update(
-          {
-            id: invitationId,
-            version: existingVersion,
-            changes: {
-              role: event.payload.role,
-              status: INVITATION_STATUS.pending,
-              invitedBy: event.user.id,
-              expiresAt,
-            },
-          },
-          event.user,
-          ctx.db,
-        );
-        if (!updateResult.isSuccess) return updateResult;
-      } else {
-        const createResult = await executor.create(
-          {
-            email,
-            role: event.payload.role,
-            status: INVITATION_STATUS.pending,
-            invitedBy: event.user.id,
-            expiresAt,
-          },
-          event.user,
-          ctx.db,
-        );
-        if (!createResult.isSuccess) return createResult;
-        invitationId = (createResult.data as { id: string }).id; // @cast-boundary engine-payload
-        token = generateToken();
-      }
-
-      await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
-
-      const locale = resolveHandlerMailLocale(ctx, opts.locale);
-
-      await dispatchMagicLinkMail(
-        ctx.notify,
-        {
-          handlerName: "invite-create",
-          notificationType: INVITE_NOTIFICATION_TYPE,
-          renderContent: (renderArgs) =>
-            renderInviteEmail({ ...renderArgs, role: event.payload.role }),
-        },
-        {
-          email,
-          appUrl: opts.appUrl,
-          token,
-          expiresAt: expiresAt.toString(),
-          ...(opts.appName !== undefined && { appName: opts.appName }),
-          locale,
-        },
+      if (roleRejection) return roleRejection;
+      return issueInvitation(
+        opts,
+        ttlSeconds,
+        { email: event.payload.email, role: event.payload.role, globalRoles: [] },
+        event.user,
+        ctx,
       );
+    },
+  });
+}
 
-      return {
-        isSuccess: true,
-        data: {
-          kind: "invite-created",
-          invitationId,
-          tenantId,
-          email,
-          role: event.payload.role,
-          expiresAt: expiresAt.toString(),
-        },
-      };
+const SystemInviteCreateSchema = z.object({
+  email: z.email(),
+  role: z.string().min(1).max(50),
+  globalRoles: z.array(z.enum(GLOBAL_ROLE_OPTIONS)).max(GLOBAL_ROLE_OPTIONS.length).default([]),
+});
+
+// System-only sibling of invite-create: the only path that can put global
+// roles (SystemAdmin) on an invitation. No session mint path yields the
+// "system" role (users.roles only accepts GLOBAL_ROLE_OPTIONS), so only
+// in-process callers dispatching as createSystemUser (runBootstrap) get here.
+export function createSystemInviteCreateHandler(opts: InviteCreateOptions) {
+  assertAppDefinedAdditionalRoles(opts);
+  const ttlSeconds = (opts.tokenTtlMinutes ?? AUTH_INVITE_DEFAULT_TTL_MINUTES) * 60;
+
+  return defineWriteHandler<
+    "system-invite-create",
+    typeof SystemInviteCreateSchema,
+    InviteCreateData
+  >({
+    name: "system-invite-create",
+    schema: SystemInviteCreateSchema,
+    access: { roles: access.system },
+    agent: { expose: false },
+    description:
+      "System-only invite into the dispatching tenant that may additionally carry global roles, which the invitee receives only when accepting; used by provisioning such as runBootstrap.",
+    handler: async (event, ctx) => {
+      const roleRejection = checkAssignableInviteRole(
+        opts,
+        event.user.roles,
+        event.payload.role,
+        ctx,
+      );
+      if (roleRejection) return roleRejection;
+      return issueInvitation(opts, ttlSeconds, event.payload, event.user, ctx, true);
     },
   });
 }

package/packages/bundled-features/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -46,6 +46,8 @@ import {
 } from "../../tenant/membership-roles.js";
 // kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
 import { seedTenantMembership } from "../../tenant/seeding.js";
+// kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
+import { parseInvitedGlobalRoles } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import existence-check
 import { userTable } from "../../user/schema/user.js";
 import { invalidInviteToken } from "../errors.js";
@@ -113,6 +115,7 @@ export function createInviteSignupCompleteHandler() {
         readonly tenantId: TenantId;
         readonly email: string;
         readonly role: string;
+        readonly globalRoles: unknown;
         readonly version: number;
       };
 
@@ -133,6 +136,7 @@ export function createInviteSignupCompleteHandler() {
           "auth:invite-signup-complete",
         );
         const invitationRole = invitation.role;
+        const invitationGlobalRoles = parseInvitedGlobalRoles(invitation.globalRoles);
         const invitationVersion = invitation.version;
 
         // User-Not-Exists-Check: wenn die Email schon registriert ist,
@@ -157,6 +161,7 @@ export function createInviteSignupCompleteHandler() {
           password: event.payload.password,
           displayName: invitationEmail.split("@")[0] ?? invitationEmail,
           emailVerified: true,
+          ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
         });
 
         // Membership-Add via seed-helper (gleiches Pattern wie
@@ -192,7 +197,7 @@ export function createInviteSignupCompleteHandler() {
           tenantId: invitationTenantId,
           // buildSessionRoles calls stripForbiddenMembershipRoles internally —
           // a reserved role on the invitation itself must never reach the session.
-          roles: buildSessionRoles([], [invitationRole]),
+          roles: buildSessionRoles(invitationGlobalRoles, [invitationRole]),
         };
 
         committed = true;

package/packages/bundled-features/src/auth-email-password/handlers/signup-request.write.ts

@@ -93,6 +93,7 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
     schema: SignupRequestSchema,
     access: { roles: ["anonymous"] },
     rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+    additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
     description:
       "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
     escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },

package/packages/bundled-features/src/auth-email-password/handlers/token-request-handler.ts

@@ -100,6 +100,7 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
     schema: RequestTokenSchema,
     access: { roles: ["anonymous"] },
     rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
+    additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
     escapeHatch: {
       reason:
         "Anonymous requester has no session — looks up the target user by email via " +

package/packages/bundled-features/src/auth-email-password/index.ts

@@ -7,6 +7,19 @@
 // its own changeset + deliberate deprecation window, not a silent drop.
 export { hashPassword, verifyPassword } from "../shared/password-hashing.js";
 export { type AuthPath, type AuthPaths, DEFAULT_AUTH_PATHS, makeAuthPaths } from "./auth-paths.js";
+export type {
+  BootstrapConfigValue,
+  BootstrapDeps,
+  BootstrapInvite,
+  BootstrapInviteOutcome,
+  BootstrapPlan,
+  BootstrapReport,
+  BootstrapSeedDeps,
+  BootstrapSystemAdmin,
+  BootstrapTenant,
+  BootstrapTenantOutcome,
+} from "./bootstrap.js";
+export { BootstrapPlanError, BootstrapWriteError, bootstrapTenants } from "./bootstrap.js";
 export { AUTH_EMAIL_PASSWORD_FEATURE, AuthErrors, AuthHandlers, AuthQueries } from "./constants.js";
 // Renderers for the auth mails. All four magic-link flows (reset, verify,
 // signup-activation, invite) emit structured AuthMailContent through delivery

package/packages/bundled-features/src/auth-email-password/invite-token-store.ts

@@ -76,3 +76,9 @@ export async function deleteInviteToken(
 /** Burn release for failed-accept paths (DB error etc.) so a legitimate
  *  retry isn't blocked by a stale burn marker. */
 export const unburnInviteToken = store.unburn;
+
+/** Whether the invitation still has an unexpired, unconsumed token — Redis TTL
+ *  is the single truth for invite expiry (see the module comment). */
+export async function hasLiveInviteToken(redis: Redis, invitationId: string): Promise<boolean> {
+  return (await store.getTokenHashForSubject(redis, invitationId)) !== null;
+}

package/packages/bundled-features/src/auth-email-password/magic-link-mail.ts

@@ -82,6 +82,7 @@ export async function dispatchMagicLinkMail(
   await notify(spec.notificationType, {
     route: { email: params.email },
     data: content,
+    locale,
     priority: "critical",
   });
 }

package/packages/bundled-features/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "MFA required policy is writable by the system only",
+    "migration": "Tenant admins can no longer write auth-mfa:config:required (write access is now system-only). Set the app-wide default with createAuthMfaFeature({ requiredPolicy }) / the mfa options and per-tenant overrides with runBootstrap tenants[].config or a system write (createSystemUser). Code that wrote the key as TenantAdmin/Admin/SystemAdmin over HTTP must switch to one of these."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/packages/bundled-features/src/auth-mfa/config.ts

@@ -8,7 +8,11 @@
 // UI). Flipping this away from "optional" before PR3 locks out every
 // unenrolled matching user with no recovery path. Fine for a tenant that
 // enrolls its admins out-of-band first; a footgun otherwise.
-import { type ConfigKeyHandle, createTenantConfig } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  type ConfigKeyHandle,
+  createTenantConfig,
+} from "@cosmicdrift/kumiko-framework/engine";
 
 export const MFA_REQUIRED_POLICIES = ["optional", "admins", "all"] as const;
 export type MfaRequiredPolicy = (typeof MFA_REQUIRED_POLICIES)[number];
@@ -18,9 +22,14 @@ export const mfaRequiredConfigHandle: ConfigKeyHandle<"select"> = {
   type: "select",
 };
 
-export function mfaRequiredConfigKey() {
+// Write access is machine-only: a TenantAdmin must not be able to relax the
+// policy back to "optional". The app-wide default comes from
+// `createAuthMfaFeature({ requiredPolicy })`, per-tenant overrides are set by
+// system writes (runBootstrap `tenants[].config`, jobs, SystemAdmin tooling).
+export function mfaRequiredConfigKey(defaultPolicy: MfaRequiredPolicy = "optional") {
   return createTenantConfig("select", {
-    default: "optional" satisfies MfaRequiredPolicy,
+    default: defaultPolicy,
     options: [...MFA_REQUIRED_POLICIES],
+    write: access.system,
   });
 }

package/packages/bundled-features/src/auth-mfa/feature.ts

@@ -1,6 +1,6 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { mfaRequiredConfigKey } from "./config.js";
+import { type MfaRequiredPolicy, mfaRequiredConfigKey } from "./config.js";
 import { createDisableHandler } from "./handlers/disable.write.js";
 import { createEnableConfirmHandler } from "./handlers/enable-confirm.write.js";
 import { createEnableConfirmPreauthHandler } from "./handlers/enable-confirm-preauth.write.js";
@@ -33,6 +33,10 @@ export type AuthMfaFeatureOptions = {
   // secret from setupTokenSecret — a compromised setup-token secret must
   // not also forge login challenges.
   readonly challengeTokenSecret: string;
+  // App-wide MFA enforcement default when no tenant row overrides it.
+  // Tenant admins cannot change the policy (system-only write), so this plus
+  // system writes is the only way to set it. Defaults to "optional".
+  readonly requiredPolicy?: MfaRequiredPolicy;
 };
 
 export type BindMfaRevokeAllOtherSessions = (
@@ -127,7 +131,7 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
     // the app boots clean and the first MFA login dies at runtime on an
     // unknown handler instead of failing at mount time.
     r.requires("tenant");
-    r.config("required", mfaRequiredConfigKey());
+    r.config("required", mfaRequiredConfigKey(opts.requiredPolicy));
 
     // Declarative secretMint screen — mint (no input) -> reveal QR/secret/
     // recovery-codes -> confirm with a code. App places it via r.nav in its
@@ -225,6 +229,7 @@ export function createAuthMfaFeature(opts: AuthMfaFeatureOptions): FeatureDefini
     // at app-boot time.
     const checkMfaStatus = createMfaStatusChecker({
       challengeTokenSecret: opts.challengeTokenSecret,
+      ...(opts.requiredPolicy && { requiredPolicy: opts.requiredPolicy }),
     });
 
     // No late-bind needed — same reasoning as checkMfaStatus: only needs the

package/packages/bundled-features/src/auth-mfa/mfa-status-checker.ts

@@ -40,6 +40,7 @@ export type MfaStatusChecker = (
 
 export function createMfaStatusChecker(opts: {
   readonly challengeTokenSecret: string;
+  readonly requiredPolicy?: MfaRequiredPolicy;
 }): MfaStatusChecker {
   return async (ctx, userId, tenantId, roles) => {
     declareEscapeHatch({
@@ -70,7 +71,7 @@ export function createMfaStatusChecker(opts: {
     // against the declared `options` at write-time by the config feature.
     const policy = ((await ctx.configResolver?.get(
       mfaRequiredConfigHandle.name,
-      mfaRequiredConfigKey(),
+      mfaRequiredConfigKey(opts.requiredPolicy),
       tenantId,
       userId,
       scopedDb,

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "App layout around termination pages, trailing-slash redirects, receipt greeting",
+    "detail": "`createContractTerminationRoutes` accepts a `wrapLayout`, the same function `createLegalPagesFeature` takes. It wraps every termination page (form, review, result, 429, error); the security headers stay with the framework. The layout also receives `alternates`, a map from locale to the path of the same page, so it can render a language switch from plain links. `page-render` exports the shared type `PublicPageWrapLayout`; `LegalPagesWrapLayout` is now an alias of it. The page body sits in `<div data-kumiko-page=\"contract-termination\">` with `data-kumiko-*` hooks on the form, field groups, buttons and review table. The page CSP keeps `script-src 'none'`, so a layout must not rely on JavaScript.\nThe default `wrapInLayout` stylesheet gains base rules for input, select, textarea and button, so unstyled forms stay readable.\nThe termination pages and every legal page now answer the other trailing-slash form of their path (`/legal/kuendigen/`, `/legal/impressum/`) with a 301 to the configured path for GET and HEAD, query string kept. POST has no alias.\nThe termination receipt mail text changed: it now starts with a greeting line (\"Hallo,\" / \"Hello,\") and the English sentence starts capitalized (\"We confirm receipt ...\"). The receipt content still depends only on the declarant's input."
+  },
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "Payment and subscription projections use typed bun-db helpers",
+    "detail": "`payment-received` inserts through `insertOnConflictDoNothing`, subscription events upsert through `upsertOnConflict`. The raw `db/queries/payment-projection.ts` and `subscription-projection.ts` modules are gone.",
+    "migration": "keine"
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/packages/bundled-features/src/billing-foundation/consumer-protection/issue-confirmation.ts

@@ -188,6 +188,7 @@ export function createIssueContractConfirmationHandler(
       await ctx.notify(CONTRACT_CONFIRMATION_NOTIFICATION_TYPE, {
         route: { email: recipient.data.email },
         data: content,
+        locale,
         priority: "critical",
       });
 

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-mail.ts

@@ -87,6 +87,7 @@ export function renderTerminationReceipt(
     subject,
     header: subject,
     sections: [
+      { text: texts.receiptGreeting },
       { text: texts.receiptIntro },
       { text: `${texts.receivedAt}: ${formatReceivedAt(args.receivedAtIso, args.locale)}` },
       { text: `${texts.requestId}: ${args.requestId}` },

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-notify.ts

@@ -39,6 +39,7 @@ export async function notifyOperator(
       ...plan,
       operatorEmail: consumerProtection.operatorEmail,
     }),
+    locale: plan.locale,
     priority: "critical",
   });
 }