@cosmicdrift/kumiko-samples 0.362.0 → 0.363.0

package/packages/bundled-features/src/user/handlers/detail.query.ts

@@ -3,6 +3,7 @@ import {
   defineEntityDetailHandler,
   type HandlerContext,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { userEntity } from "../schema/user.js";
 import { attachTenantLabels, dbForList } from "./list.query.js";
 
@@ -24,12 +25,9 @@ export const detailQuery = {
     ctx: HandlerContext,
   ) => {
     const result = await baseDetail.handler?.(query, ctx);
-    if (result === null || typeof result !== "object") return result;
+    if (!isPlainObject(result)) return result;
     if (!ctx.registry.features.has("tenant")) return result;
-    const [enriched] = await attachTenantLabels(
-      [result as Record<string, unknown>],
-      dbForList(ctx),
-    );
+    const [enriched] = await attachTenantLabels([result], dbForList(ctx));
     return enriched ?? result;
   },
 };

package/packages/bundled-features/src/user/roles-input-schema.ts

@@ -8,8 +8,8 @@ export const rolesInputSchema = z.union([
   z.string().transform((raw, ctx) => {
     try {
       const parsed: unknown = JSON.parse(raw);
-      if (Array.isArray(parsed) && parsed.every((v) => typeof v === "string")) {
-        return parsed as string[];
+      if (Array.isArray(parsed) && parsed.every((v): v is string => typeof v === "string")) {
+        return parsed;
       }
     } catch {
       /* fall through */

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "GDPR default mails are r.notification declarations, render*Email is gone",
+    "detail": "export-ready, export-failed, deletion-requested and deletion-executed are declared as trigger-less notifications (user-data-rights:notify:<name>) with variables and localized templates built from the GDPR translations, so a tenant can override the text. The default export-ready, export-failed and deletion-requested mails send through ctx.notify to the user (export mails with immediate so the plain magic-link token never lands in a job payload). deletion-executed renders the seeded template through the mail renderer and sends over the tenant mail transport without a delivery log, because the user is already gone. App-provided send*Email callbacks still win. The defaults now need delivery with channel-email; a boot warning is logged once when mail-foundation and a mail transport are mounted without them. New exports are GdprMailNotificationTypes, gdprMailLocalizedTemplate, gdprMailTemplateLocale, registerGdprMails and formatGdprMailTimestamp.",
+    "migration": "renderExportReadyEmail, renderExportFailedEmail, renderDeletionRequestedEmail, renderDeletionExecutedEmail and RenderedEmail are removed from user-data-rights/email-templates; the translations stay. An app that mounts it without includeBundled needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html at boot (composeRendererStack() from dev-server mounts all of them), plus a delivery with the channel-email feature; apps without the template tables need a schema migration (`kumiko schema generate`). Delivery preferences that referenced the mails use the new user-data-rights:notify:<name> types."
+  },
   {
     "version": "0.362.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,10 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 
 export async function selectUsersDueForForgetCleanup(
-  db: DbConnection,
+  db: DbRunner,
   status: string,
   gracePeriodEndCutoff: Temporal.Instant | string,
 ): Promise<readonly { id: string }[]> {

package/packages/bundled-features/src/user-data-rights/email-templates.ts

@@ -1,10 +1,10 @@
-// Default HTML renderers for GDPR notification mails. English ships here;
-// other languages register via @cosmicdrift/kumiko-locale-* (localeDe() /
+// Translations for the GDPR notification mails (the templates in
+// mail-notifications.ts are built from them). English ships here; other
+// languages register via @cosmicdrift/kumiko-locale-* (localeDe() /
 // localeEs() call registerMailTranslations). Apps that want their own
 // branding pass send*Email callbacks and these defaults do not run.
 
-import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 
 export type GdprMailLocale = string;
@@ -41,151 +41,7 @@ export const GDPR_MAIL_EN: Readonly<Record<string, string>> = {
 
 registerMailTranslations("en", GDPR_MAIL_EN);
 
-export type RenderedEmail = {
-  readonly subject: string;
-  readonly html: string;
-  readonly text: string;
-};
-
-export type RenderExportReadyEmailArgs = {
-  readonly downloadUrl: string;
-  readonly expiresAt: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderExportFailedEmailArgs = {
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderDeletionRequestedEmailArgs = {
-  readonly gracePeriodEnd: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderDeletionExecutedEmailArgs = {
-  readonly executedAt: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-function t(locale: string, key: string, params?: Readonly<Record<string, string>>): string {
-  return mailT(locale, key, params);
-}
-
-function appNameFor(args: { locale?: GdprMailLocale; appName?: string }): string {
-  const locale = args.locale ?? "en";
-  return args.appName ?? t(locale, "gdpr.mail.appNameDefault");
-}
-
-export function renderExportReadyEmail(args: RenderExportReadyEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const subject = t(locale, "gdpr.mail.exportReady.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0 0 24px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportReady.intro", { app }))}</p>
-    <p style="margin: 0 0 24px;">${renderButton({ url: args.downloadUrl, label: t(locale, "gdpr.mail.exportReady.button") })}</p>
-    <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }))}</p>
-    ${renderFallbackUrl({ url: args.downloadUrl, label: t(locale, "gdpr.mail.fallbackUrl") })}`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.exportReady.intro", { app }),
-    `${t(locale, "gdpr.mail.exportReady.button")}: ${args.downloadUrl}`,
-    t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const subject = t(locale, "gdpr.mail.exportFailed.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportFailed.intro", { app }))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.exportFailed.intro", { app }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderDeletionRequestedEmail(
-  args: RenderDeletionRequestedEmailArgs,
-): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const when = formatTimestamp(args.gracePeriodEnd);
-  const subject = t(locale, "gdpr.mail.deletionRequested.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0 0 16px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.intro", { app, when }))}</p>
-    <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.cancel"))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.deletionRequested.intro", { app, when }),
-    t(locale, "gdpr.mail.deletionRequested.cancel"),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const when = formatTimestamp(args.executedAt);
-  const subject = t(locale, "gdpr.mail.deletionExecuted.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-function plainTextBody(paragraphs: readonly string[]): string {
-  return paragraphs.join("\n\n");
-}
-
-function wrapCell(bodyHtml: string): string {
-  return `<tr><td>${bodyHtml}</td></tr>`;
-}
-
-function renderShell(args: { title: string; bodyHtml: string; locale: GdprMailLocale }): string {
-  return `<!DOCTYPE html>
-<html lang="${escapeHtmlAttr(args.locale)}">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(args.title)}</title>
-  </head>
-  <body style="margin: 0; padding: 0; background: #f7f7f7; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; color: #1a1a1a;">
-    <table width="100%" cellpadding="0" cellspacing="0" style="padding: 24px 0;">
-      <tr>
-        <td align="center">
-          <table width="560" cellpadding="0" cellspacing="0" style="max-width: 560px; background: #ffffff; border-radius: 8px; padding: 32px;">
-            ${args.bodyHtml}
-          </table>
-        </td>
-      </tr>
-    </table>
-  </body>
-</html>`;
-}
-
-function renderButton(args: { url: string; label: string }): string {
-  return `<a href="${escapeHtmlAttr(args.url)}" style="display: inline-block; background: #1a1a1a; color: #ffffff; padding: 12px 24px; border-radius: 6px; text-decoration: none; font-weight: 500;">${escapeHtml(args.label)}</a>`;
-}
-
-function renderFallbackUrl(args: { url: string; label: string }): string {
-  return `<p style="margin: 24px 0 0; font-size: 12px; color: #666;">${escapeHtml(args.label)}<br /><a href="${escapeHtmlAttr(args.url)}" style="color: #1a1a1a; word-break: break-all;">${escapeHtml(args.url)}</a></p>`;
-}
-
-function formatTimestamp(iso: string): string {
+export function formatGdprMailTimestamp(iso: string): string {
   try {
     const z = Temporal.Instant.from(iso).toZonedDateTimeISO("UTC");
     return `${z.year}-${pad2(z.month)}-${pad2(z.day)} ${pad2(z.hour)}:${pad2(z.minute)} UTC`;

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -2,16 +2,21 @@
 import { UNKNOWN_CLIENT_IP } from "@cosmicdrift/kumiko-framework/api";
 import {
   createSystemConfig,
+  createSystemUser,
   defineFeature,
   EXT_USER_DATA,
   type FeatureDefinition,
   i18nKey,
   SYSTEM_USER_ID,
+  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import {
   createMetricsHandle,
   createNoopMetricsHandle,
 } from "@cosmicdrift/kumiko-framework/observability";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { createConfigAccessor } from "../config/index.js";
 import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks.js";
 import {
   EXPORT_SECTION_EXTENSION_NAME,
@@ -45,6 +50,8 @@ import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.wri
 import { USER_DATA_RIGHTS_I18N } from "./i18n.js";
 import {
   type GdprMailDefaults,
+  isGdprMailDeliveryAvailable,
+  isMailRendererAvailable,
   isMailTransportAvailable,
   makeDefaultDeletionExecutedEmail,
   makeDefaultExportFailedEmail,
@@ -53,6 +60,7 @@ import {
 import { makeTenantMailTransportResolver } from "./lib/mail-transport-resolver.js";
 import { resolveAppTenantModel } from "./lib/resolve-tenant-model.js";
 import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver.js";
+import { registerGdprMails } from "./mail-notifications.js";
 import {
   EXPORT_CLEANUP_BACKLOG_AGE_METRIC,
   EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC,
@@ -163,11 +171,22 @@ export type UserDataRightsOptions = {
   readonly privacyCenterShowDeletion?: boolean;
 };
 
+function isMailTransportMountedWithoutDelivery(features: readonly FeatureDefinition[]): boolean {
+  const names = new Set(features.map((feature) => feature.name));
+  const hasTransport = [...names].some((name) => name.startsWith("mail-transport-"));
+  return (
+    names.has("mail-foundation") &&
+    hasTransport &&
+    !(names.has("delivery") && names.has("channel-email"))
+  );
+}
+
 export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): FeatureDefinition {
   // One-shot operator warning (the export cron fires daily — warn once per
   // process, not every run). Lives in the factory scope so the cron closure
   // shares it across runs.
   let warnedMissingExportUrl = false;
+  let warnedMissingMailDelivery = false;
   const showDeletion = opts.privacyCenterShowDeletion ?? true;
   return defineFeature("user-data-rights", (r) => {
     r.describe(
@@ -197,7 +216,15 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // EXT_USER_DATA channel owner: any r.useExtension(EXT_USER_DATA, ...)
     // usage already requires user-data-rights to be mounted.
     r.bootCheck(({ features }) => validateGdprHookCompleteness(features));
-    r.bootCheck(({ features }) => validateGdprPiiHookCoverage(features));
+    r.bootCheck(({ features }) => {
+      validateGdprPiiHookCoverage(features);
+      if (!warnedMissingMailDelivery && isMailTransportMountedWithoutDelivery(features)) {
+        warnedMissingMailDelivery = true;
+        createFallbackLogger("user-data-rights").warn(
+          "mail-foundation and a mail transport are mounted but delivery/channel-email are not — the default export and deletion-request mails need them and will not be sent",
+        );
+      }
+    });
 
     // App-level tenant-occupancy model. Default "multi-user" → tenant-scoped
     // contributors (e.g. credit) NEVER erase tenant data on a per-user forget
@@ -312,6 +339,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     });
 
     r.translations({ keys: USER_DATA_RIGHTS_I18N });
+    registerGdprMails(r);
     // Privacy-center dot-form labels (i18nKey()-marked below), duplicated in
     // web/i18n.ts's client bundle since privacy-center-screen.tsx renders
     // them client-side.
@@ -520,10 +548,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       handler: async (c, { app, clientIp }) => {
         const url = new URL(c.req.url);
         const parsedBody = await c.req.json().catch(() => null);
-        const token =
-          parsedBody && typeof parsedBody === "object" && "token" in parsedBody
-            ? (parsedBody as { token?: unknown }).token
-            : undefined;
+        const token = isPlainObject(parsedBody) ? parsedBody["token"] : undefined;
         if (typeof token !== "string" || token.length === 0) {
           return c.json({ error: "missing_token" }, 400);
         }
@@ -605,28 +630,25 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
         // versendet der Cron die Export-Notifications selbst (Default-Templates).
         // Der Resolver baut den per-Tenant-Transport aus configResolver — gleiche
         // Bruecke wie buildStorageProvider.
-        const exportMailResolver = isMailTransportAvailable(exportRegistry)
-          ? makeTenantMailTransportResolver({
-              registry: exportRegistry,
-              configResolver: ctx.configResolver,
-              secrets: ctx.secrets,
-              db: exportDb,
-              userId: exportUserId,
-              handlerName: "user-data-rights:run-export-jobs",
-            })
-          : undefined;
+        // The cron runs across tenants: each mail needs a notify bound to the
+        // recipient's tenant (template override, channel config).
+        const notifyFactory = ctx._notifyFactory;
+        const exportNotifyFor =
+          notifyFactory !== undefined && isGdprMailDeliveryAvailable(exportRegistry)
+            ? (tenantId: TenantId) => notifyFactory(createSystemUser(tenantId), tenantId)
+            : undefined;
         const sendExportReadyEmail =
           opts.sendExportReadyEmail ??
-          (exportMailResolver && opts.appExportDownloadUrl !== undefined
-            ? makeDefaultExportReadyEmail(exportMailResolver, opts.mailDefaults)
+          (exportNotifyFor && opts.appExportDownloadUrl !== undefined
+            ? makeDefaultExportReadyEmail(exportNotifyFor, opts.mailDefaults)
             : undefined);
         const sendExportFailedEmail =
           opts.sendExportFailedEmail ??
-          (exportMailResolver
-            ? makeDefaultExportFailedEmail(exportMailResolver, opts.mailDefaults)
+          (exportNotifyFor
+            ? makeDefaultExportFailedEmail(exportNotifyFor, opts.mailDefaults)
             : undefined);
         if (
-          exportMailResolver &&
+          exportNotifyFor &&
           !opts.sendExportReadyEmail &&
           opts.appExportDownloadUrl === undefined &&
           !warnedMissingExportUrl
@@ -634,7 +656,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           warnedMissingExportUrl = true;
           // biome-ignore lint/suspicious/noConsole: one-shot operator visibility for misconfig
           console.warn(
-            "[user-data-rights:run-export-jobs] mail transport mounted but appExportDownloadUrl unset — default export-ready emails disabled (export-failed + deletion mails still send)",
+            "[user-data-rights:run-export-jobs] mail delivery mounted but appExportDownloadUrl unset — default export-ready emails disabled (export-failed + deletion mails still send)",
           );
         }
 
@@ -697,22 +719,37 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           userId: forgetUserId,
         });
 
-        // C6 — Default-Mail beim delete-flip wenn kein Callback gesetzt + ein
-        // mail-transport gemountet ist (gleiche per-Tenant-Bruecke wie Export).
-        const forgetMailResolver = isMailTransportAvailable(forgetRegistry)
-          ? makeTenantMailTransportResolver({
-              registry: forgetRegistry,
-              configResolver: ctx.configResolver,
-              secrets: ctx.secrets,
-              db: forgetDb,
-              userId: forgetUserId,
-              handlerName: "user-data-rights:run-forget-cleanup",
-            })
-          : undefined;
+        // Without an app callback the default mail goes out when a mail transport and a
+        // mail renderer are mounted. The user is already erased here, so it bypasses the
+        // delivery log: an attempt row would be new personal data.
+        const forgetConfigResolver = ctx.configResolver;
         const sendDeletionExecutedEmail =
           opts.sendDeletionExecutedEmail ??
-          (forgetMailResolver
-            ? makeDefaultDeletionExecutedEmail(forgetMailResolver, opts.mailDefaults)
+          (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+            ? makeDefaultDeletionExecutedEmail(
+                {
+                  registry: forgetRegistry,
+                  db: forgetDb,
+                  resolveTransport: makeTenantMailTransportResolver({
+                    registry: forgetRegistry,
+                    configResolver: forgetConfigResolver,
+                    secrets: ctx.secrets,
+                    db: forgetDb,
+                    userId: forgetUserId,
+                    handlerName: "user-data-rights:run-forget-cleanup",
+                  }),
+                  configFor: (tenantId) =>
+                    forgetConfigResolver &&
+                    createConfigAccessor(
+                      forgetRegistry,
+                      forgetConfigResolver,
+                      tenantId,
+                      forgetUserId,
+                      forgetDb,
+                    ),
+                },
+                opts.mailDefaults,
+              )
             : undefined);
 
         const forgetResult = await runForgetCleanup({

package/packages/bundled-features/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -71,12 +71,13 @@ export const cancelDeletionWrite = defineWriteHandler({
 
     // gracePeriodEnd=null im Response symmetrisch zu request-deletion's
     // ISO-Timestamp — Frontend kann beide Endpoints uniform behandeln.
+    const gracePeriodEnd: string | null = null;
     return {
       isSuccess: true as const,
       data: {
         userId: event.user.id,
         status: USER_STATUS.Active,
-        gracePeriodEnd: null as string | null,
+        gracePeriodEnd,
       },
     };
   },

package/packages/bundled-features/src/user-data-rights/handlers/request-deletion.write.ts

@@ -1,11 +1,10 @@
-import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { USER_STATUS } from "../../user/index.js";
 import {
   type GdprMailDefaults,
-  isMailTransportAvailable,
+  isGdprMailDeliveryAvailable,
   makeDefaultDeletionRequestedEmail,
 } from "../lib/default-mailers.js";
 import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
@@ -71,17 +70,12 @@ export function createRequestDeletionHandler(opts: RequestDeletionOptions = {})
       if (!res.ok) return writeFailure(res.error);
       const { gracePeriodEnd, userEmail, userLocale } = res;
 
-      // App-Callback hat Vorrang; sonst greift die mail-foundation-Default-Mail
-      // (Request-Lane → ctx.config vorhanden, createTransportForTenant direkt).
-      // Ohne gemounteten mail-transport bleibt send undefined → keine Mail.
+      // The app callback wins; otherwise the default mail goes through ctx.notify after
+      // the commit. Without delivery and an email channel there is no sender and no mail.
       const send =
         opts.sendDeletionRequestedEmail ??
-        (isMailTransportAvailable(ctx.registry)
-          ? makeDefaultDeletionRequestedEmail(
-              (tenantId) =>
-                createTransportForTenant(ctx, tenantId, "user-data-rights:request-deletion"),
-              opts.mailDefaults,
-            )
+        (ctx.notify !== undefined && isGdprMailDeliveryAvailable(ctx.registry)
+          ? makeDefaultDeletionRequestedEmail(ctx.notify, opts.mailDefaults)
           : undefined);
 
       // Best-effort Email-Notification. Send-Failure darf das Write nicht