@cosmicdrift/kumiko-samples 0.362.0 → 0.364.0

package/packages/bundled-features/src/tier-engine/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Tier cache: stale single reload cannot overwrite a newer full resync",
+    "detail": "A single-tenant reload that started before a full resync and resolved after it could restore an outdated tier. The resync now advances the per-tenant ticket for deleted and adopted tenants too, and assignment changes are published remote-only."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/packages/bundled-features/src/tier-engine/feature.ts

@@ -338,7 +338,8 @@ export function createTierEngineFeature<
     };
     const publishAssignmentChange = (tenantId: TenantId): void => {
       const message: TierAssignmentSyncMessage = { tenantId };
-      busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message);
+      // The writer already updated its own cache; only other pods need to re-read.
+      busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message, { remoteOnly: true });
     };
 
     // Trial: zeit-abgeleitet aus tenant.inserted_at (≈ Signup), live am
@@ -533,10 +534,17 @@ export function createTierEngineFeature<
           const isNewerThanSnapshot = (tenantId: TenantId): boolean =>
             (latestTicket.get(tenantId) ?? 0) > startedAtTicket;
           for (const tenantId of [...cache.keys()]) {
-            if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId)) cache.delete(tenantId);
+            if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId)) {
+              cache.delete(tenantId);
+              latestTicket.set(tenantId, startedAtTicket);
+            }
           }
           for (const [tenantId, features] of loaded) {
-            if (!isNewerThanSnapshot(tenantId)) cache.set(tenantId, features);
+            if (!isNewerThanSnapshot(tenantId)) {
+              cache.set(tenantId, features);
+              // Makes a single reload that started before this snapshot discard its older result.
+              latestTicket.set(tenantId, startedAtTicket);
+            }
           }
         };
 

package/packages/bundled-features/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "resolveUserDisplayNames no longer swallows decrypt errors",
+    "detail": "A misconfigured or unavailable KMS made the delivery log silently show addresses or ids instead of names. Decrypt errors now propagate like in the member directory; users that are missing or have no display name are still left out."
+  },
   {
     "version": "0.361.0",
     "type": "improvement",

package/packages/bundled-features/src/user/db/queries/stream-tenant-backfill.ts

@@ -37,12 +37,12 @@ export type UserStreamBackfillResult = {
 export async function backfillUserStreamTenants(
   db: DbConnection,
 ): Promise<UserStreamBackfillResult> {
-  const candidates = (await unsafeReadRetrying(
+  const candidates = await unsafeReadRetrying<{ aggregate_id: string }>(
     db,
     `SELECT DISTINCT "aggregate_id" FROM "kumiko_events"
       WHERE "aggregate_type" = 'user' AND "tenant_id" <> $1::uuid`,
     [SYSTEM_TENANT_ID],
-  )) as ReadonlyArray<{ aggregate_id: string }>;
+  );
 
   let aggregatesMigrated = 0;
   let eventsMigrated = 0;
@@ -67,13 +67,13 @@ async function migrateAggregate(db: DbConnection, aggregateId: string): Promise<
     const raw = asRawClient(tx);
     // Global id order = commit-adjacent replay order; merges a split stream
     // (legacy tenant + SYSTEM) into one consistent version sequence.
-    const events = (await raw.unsafe(
+    const events = await raw.unsafe<{ id: bigint | string }>(
       `SELECT "id" FROM "kumiko_events"
         WHERE "aggregate_type" = 'user' AND "aggregate_id" = $1::uuid
         ORDER BY "id" ASC
         FOR UPDATE`,
       [aggregateId],
-    )) as ReadonlyArray<{ id: bigint | string }>;
+    );
 
     // Phase 1: negative interim versions — real versions are always >= 1, so
     // nothing can collide with events_aggregate_version_uq mid-migration.

package/packages/bundled-features/src/user/handlers/detail.query.ts

@@ -3,6 +3,7 @@ import {
   defineEntityDetailHandler,
   type HandlerContext,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { userEntity } from "../schema/user.js";
 import { attachTenantLabels, dbForList } from "./list.query.js";
 
@@ -24,12 +25,9 @@ export const detailQuery = {
     ctx: HandlerContext,
   ) => {
     const result = await baseDetail.handler?.(query, ctx);
-    if (result === null || typeof result !== "object") return result;
+    if (!isPlainObject(result)) return result;
     if (!ctx.registry.features.has("tenant")) return result;
-    const [enriched] = await attachTenantLabels(
-      [result as Record<string, unknown>],
-      dbForList(ctx),
-    );
+    const [enriched] = await attachTenantLabels([result], dbForList(ctx));
     return enriched ?? result;
   },
 };

package/packages/bundled-features/src/user/resolve-display-names.ts

@@ -6,9 +6,10 @@ import { userTable } from "./schema/user.js";
 // Shares the KMS adapter's small dedicated pool, same as member-directory.
 const KMS_POOL_CONCURRENCY = 4;
 
-// One batched lookup for a page of user ids. Users that are missing, have no
-// display name, or whose name cannot be decrypted (e.g. crypto-shredded) are
-// left out, so callers fall back to the raw id instead of failing the page.
+// One batched lookup for a page of user ids. Users that are missing or have no
+// display name are left out, so callers fall back to the raw id. Decrypt errors
+// propagate (a misconfigured or unavailable KMS fails loudly, like member-directory);
+// crypto-shredding is handled by the KMS layer.
 export async function resolveUserDisplayNames(
   db: TenantDb,
   userIds: readonly string[],
@@ -18,18 +19,10 @@ export async function resolveUserDisplayNames(
   const users = await selectMany(db, userTable, { id: [...userIds] });
   const named = users.filter((user) => typeof user.displayName === "string");
   await mapWithConcurrency(named, KMS_POOL_CONCURRENCY, async (user) => {
-    try {
-      names.set(
-        String(user.id),
-        await decryptStoredPii(
-          String(user.displayName),
-          "displayName",
-          "user:resolve-display-names",
-        ),
-      );
-    } catch {
-      // Unreadable name: the caller's fallback applies.
-    }
+    names.set(
+      String(user.id),
+      await decryptStoredPii(String(user.displayName), "displayName", "user:resolve-display-names"),
+    );
   });
   return names;
 }

package/packages/bundled-features/src/user/roles-input-schema.ts

@@ -8,8 +8,8 @@ export const rolesInputSchema = z.union([
   z.string().transform((raw, ctx) => {
     try {
       const parsed: unknown = JSON.parse(raw);
-      if (Array.isArray(parsed) && parsed.every((v) => typeof v === "string")) {
-        return parsed as string[];
+      if (Array.isArray(parsed) && parsed.every((v): v is string => typeof v === "string")) {
+        return parsed;
       }
     } catch {
       /* fall through */

package/packages/bundled-features/src/user/seeding.ts

@@ -11,6 +11,7 @@
 // das Event UND schreibt die Projection-Zeile in einer TX.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEventStoreExecutor,
   createTenantDb,
@@ -139,12 +140,25 @@ export async function rewriteSeededUserEmail(
   if (typeof id !== "string") {
     throw new Error("rewriteSeededUserEmail: existing user row has no string id");
   }
+  const version = existingRow["version"];
+  if (typeof version !== "number") {
+    throw new Error("rewriteSeededUserEmail: existing user row has no numeric version");
+  }
+  // Every executor.update appends a user:updated event; skip when the stored
+  // blind index already matches so repeated boots do not grow the stream.
+  // Queried by the bidx column itself: fetchOne does not return it, and an
+  // `email` condition would also match a plaintext row with a blank index.
+  const blindIndexKey = configuredBlindIndexKey();
+  if (blindIndexKey !== undefined) {
+    const indexed = await fetchOne(db, userTable, {
+      id,
+      emailBidx: computeBlindIndex(blindIndexKey, email),
+    });
+    // skip: the stored blind index already matches, a rewrite would only append a no-op event.
+    if (indexed) return;
+  }
   const tdb = createTenantDb(db, by.tenantId, "system");
-  const result = await userExecutor.update(
-    { id, version: existingRow["version"] as number, changes: { email } },
-    by,
-    tdb,
-  );
+  const result = await userExecutor.update({ id, version, changes: { email } }, by, tdb);
   // version_conflict: a concurrent write already changed the row — fine for a seed helper.
   // unique_violation: a duplicate row already holds the blind index; the repair
   // has to wait for a manual duplicate cleanup.

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Regression tests prove that forget also shreds the previous email in user.updated events",
+    "detail": "No runtime change. Integration tests with a configured subject KMS show that after an email change followed by forget, the old and new email in user.updated changes and previous decrypt only to the erased sentinel and the subject key is gone. Without a configured KMS, event payloads stay plaintext by design."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "GDPR default mails are r.notification declarations, render*Email is gone",
+    "detail": "export-ready, export-failed, deletion-requested and deletion-executed are declared as trigger-less notifications (user-data-rights:notify:<name>) with variables and localized templates built from the GDPR translations, so a tenant can override the text. The default export-ready, export-failed and deletion-requested mails send through ctx.notify to the user (export mails with immediate so the plain magic-link token never lands in a job payload). deletion-executed renders the seeded template through the mail renderer and sends over the tenant mail transport without a delivery log, because the user is already gone. App-provided send*Email callbacks still win. The defaults now need delivery with channel-email; a boot warning is logged once when mail-foundation and a mail transport are mounted without them. New exports are GdprMailNotificationTypes, gdprMailLocalizedTemplate, gdprMailTemplateLocale, registerGdprMails and formatGdprMailTimestamp.",
+    "migration": "renderExportReadyEmail, renderExportFailedEmail, renderDeletionRequestedEmail, renderDeletionExecutedEmail and RenderedEmail are removed from user-data-rights/email-templates; the translations stay. An app that mounts it without includeBundled needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html at boot (composeRendererStack() from dev-server mounts all of them), plus a delivery with the channel-email feature; apps without the template tables need a schema migration (`kumiko schema generate`). Delivery preferences that referenced the mails use the new user-data-rights:notify:<name> types."
+  },
   {
     "version": "0.362.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,10 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 
 export async function selectUsersDueForForgetCleanup(
-  db: DbConnection,
+  db: DbRunner,
   status: string,
   gracePeriodEndCutoff: Temporal.Instant | string,
 ): Promise<readonly { id: string }[]> {

package/packages/bundled-features/src/user-data-rights/email-templates.ts

@@ -1,10 +1,10 @@
-// Default HTML renderers for GDPR notification mails. English ships here;
-// other languages register via @cosmicdrift/kumiko-locale-* (localeDe() /
+// Translations for the GDPR notification mails (the templates in
+// mail-notifications.ts are built from them). English ships here; other
+// languages register via @cosmicdrift/kumiko-locale-* (localeDe() /
 // localeEs() call registerMailTranslations). Apps that want their own
 // branding pass send*Email callbacks and these defaults do not run.
 
-import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 
 export type GdprMailLocale = string;
@@ -41,151 +41,7 @@ export const GDPR_MAIL_EN: Readonly<Record<string, string>> = {
 
 registerMailTranslations("en", GDPR_MAIL_EN);
 
-export type RenderedEmail = {
-  readonly subject: string;
-  readonly html: string;
-  readonly text: string;
-};
-
-export type RenderExportReadyEmailArgs = {
-  readonly downloadUrl: string;
-  readonly expiresAt: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderExportFailedEmailArgs = {
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderDeletionRequestedEmailArgs = {
-  readonly gracePeriodEnd: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderDeletionExecutedEmailArgs = {
-  readonly executedAt: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-function t(locale: string, key: string, params?: Readonly<Record<string, string>>): string {
-  return mailT(locale, key, params);
-}
-
-function appNameFor(args: { locale?: GdprMailLocale; appName?: string }): string {
-  const locale = args.locale ?? "en";
-  return args.appName ?? t(locale, "gdpr.mail.appNameDefault");
-}
-
-export function renderExportReadyEmail(args: RenderExportReadyEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const subject = t(locale, "gdpr.mail.exportReady.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0 0 24px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportReady.intro", { app }))}</p>
-    <p style="margin: 0 0 24px;">${renderButton({ url: args.downloadUrl, label: t(locale, "gdpr.mail.exportReady.button") })}</p>
-    <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }))}</p>
-    ${renderFallbackUrl({ url: args.downloadUrl, label: t(locale, "gdpr.mail.fallbackUrl") })}`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.exportReady.intro", { app }),
-    `${t(locale, "gdpr.mail.exportReady.button")}: ${args.downloadUrl}`,
-    t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const subject = t(locale, "gdpr.mail.exportFailed.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportFailed.intro", { app }))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.exportFailed.intro", { app }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderDeletionRequestedEmail(
-  args: RenderDeletionRequestedEmailArgs,
-): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const when = formatTimestamp(args.gracePeriodEnd);
-  const subject = t(locale, "gdpr.mail.deletionRequested.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0 0 16px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.intro", { app, when }))}</p>
-    <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.cancel"))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.deletionRequested.intro", { app, when }),
-    t(locale, "gdpr.mail.deletionRequested.cancel"),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const when = formatTimestamp(args.executedAt);
-  const subject = t(locale, "gdpr.mail.deletionExecuted.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-function plainTextBody(paragraphs: readonly string[]): string {
-  return paragraphs.join("\n\n");
-}
-
-function wrapCell(bodyHtml: string): string {
-  return `<tr><td>${bodyHtml}</td></tr>`;
-}
-
-function renderShell(args: { title: string; bodyHtml: string; locale: GdprMailLocale }): string {
-  return `<!DOCTYPE html>
-<html lang="${escapeHtmlAttr(args.locale)}">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(args.title)}</title>
-  </head>
-  <body style="margin: 0; padding: 0; background: #f7f7f7; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; color: #1a1a1a;">
-    <table width="100%" cellpadding="0" cellspacing="0" style="padding: 24px 0;">
-      <tr>
-        <td align="center">
-          <table width="560" cellpadding="0" cellspacing="0" style="max-width: 560px; background: #ffffff; border-radius: 8px; padding: 32px;">
-            ${args.bodyHtml}
-          </table>
-        </td>
-      </tr>
-    </table>
-  </body>
-</html>`;
-}
-
-function renderButton(args: { url: string; label: string }): string {
-  return `<a href="${escapeHtmlAttr(args.url)}" style="display: inline-block; background: #1a1a1a; color: #ffffff; padding: 12px 24px; border-radius: 6px; text-decoration: none; font-weight: 500;">${escapeHtml(args.label)}</a>`;
-}
-
-function renderFallbackUrl(args: { url: string; label: string }): string {
-  return `<p style="margin: 24px 0 0; font-size: 12px; color: #666;">${escapeHtml(args.label)}<br /><a href="${escapeHtmlAttr(args.url)}" style="color: #1a1a1a; word-break: break-all;">${escapeHtml(args.url)}</a></p>`;
-}
-
-function formatTimestamp(iso: string): string {
+export function formatGdprMailTimestamp(iso: string): string {
   try {
     const z = Temporal.Instant.from(iso).toZonedDateTimeISO("UTC");
     return `${z.year}-${pad2(z.month)}-${pad2(z.day)} ${pad2(z.hour)}:${pad2(z.minute)} UTC`;

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -2,16 +2,21 @@
 import { UNKNOWN_CLIENT_IP } from "@cosmicdrift/kumiko-framework/api";
 import {
   createSystemConfig,
+  createSystemUser,
   defineFeature,
   EXT_USER_DATA,
   type FeatureDefinition,
   i18nKey,
   SYSTEM_USER_ID,
+  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import {
   createMetricsHandle,
   createNoopMetricsHandle,
 } from "@cosmicdrift/kumiko-framework/observability";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { createConfigAccessor } from "../config/index.js";
 import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks.js";
 import {
   EXPORT_SECTION_EXTENSION_NAME,
@@ -45,6 +50,8 @@ import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.wri
 import { USER_DATA_RIGHTS_I18N } from "./i18n.js";
 import {
   type GdprMailDefaults,
+  isGdprMailDeliveryAvailable,
+  isMailRendererAvailable,
   isMailTransportAvailable,
   makeDefaultDeletionExecutedEmail,
   makeDefaultExportFailedEmail,
@@ -53,6 +60,7 @@ import {
 import { makeTenantMailTransportResolver } from "./lib/mail-transport-resolver.js";
 import { resolveAppTenantModel } from "./lib/resolve-tenant-model.js";
 import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver.js";
+import { registerGdprMails } from "./mail-notifications.js";
 import {
   EXPORT_CLEANUP_BACKLOG_AGE_METRIC,
   EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC,
@@ -163,11 +171,22 @@ export type UserDataRightsOptions = {
   readonly privacyCenterShowDeletion?: boolean;
 };
 
+function isMailTransportMountedWithoutDelivery(features: readonly FeatureDefinition[]): boolean {
+  const names = new Set(features.map((feature) => feature.name));
+  const hasTransport = [...names].some((name) => name.startsWith("mail-transport-"));
+  return (
+    names.has("mail-foundation") &&
+    hasTransport &&
+    !(names.has("delivery") && names.has("channel-email"))
+  );
+}
+
 export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): FeatureDefinition {
   // One-shot operator warning (the export cron fires daily — warn once per
   // process, not every run). Lives in the factory scope so the cron closure
   // shares it across runs.
   let warnedMissingExportUrl = false;
+  let warnedMissingMailDelivery = false;
   const showDeletion = opts.privacyCenterShowDeletion ?? true;
   return defineFeature("user-data-rights", (r) => {
     r.describe(
@@ -197,7 +216,15 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // EXT_USER_DATA channel owner: any r.useExtension(EXT_USER_DATA, ...)
     // usage already requires user-data-rights to be mounted.
     r.bootCheck(({ features }) => validateGdprHookCompleteness(features));
-    r.bootCheck(({ features }) => validateGdprPiiHookCoverage(features));
+    r.bootCheck(({ features }) => {
+      validateGdprPiiHookCoverage(features);
+      if (!warnedMissingMailDelivery && isMailTransportMountedWithoutDelivery(features)) {
+        warnedMissingMailDelivery = true;
+        createFallbackLogger("user-data-rights").warn(
+          "mail-foundation and a mail transport are mounted but delivery/channel-email are not — the default export and deletion-request mails need them and will not be sent",
+        );
+      }
+    });
 
     // App-level tenant-occupancy model. Default "multi-user" → tenant-scoped
     // contributors (e.g. credit) NEVER erase tenant data on a per-user forget
@@ -312,6 +339,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     });
 
     r.translations({ keys: USER_DATA_RIGHTS_I18N });
+    registerGdprMails(r);
     // Privacy-center dot-form labels (i18nKey()-marked below), duplicated in
     // web/i18n.ts's client bundle since privacy-center-screen.tsx renders
     // them client-side.
@@ -520,10 +548,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       handler: async (c, { app, clientIp }) => {
         const url = new URL(c.req.url);
         const parsedBody = await c.req.json().catch(() => null);
-        const token =
-          parsedBody && typeof parsedBody === "object" && "token" in parsedBody
-            ? (parsedBody as { token?: unknown }).token
-            : undefined;
+        const token = isPlainObject(parsedBody) ? parsedBody["token"] : undefined;
         if (typeof token !== "string" || token.length === 0) {
           return c.json({ error: "missing_token" }, 400);
         }
@@ -605,28 +630,25 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
         // versendet der Cron die Export-Notifications selbst (Default-Templates).
         // Der Resolver baut den per-Tenant-Transport aus configResolver — gleiche
         // Bruecke wie buildStorageProvider.
-        const exportMailResolver = isMailTransportAvailable(exportRegistry)
-          ? makeTenantMailTransportResolver({
-              registry: exportRegistry,
-              configResolver: ctx.configResolver,
-              secrets: ctx.secrets,
-              db: exportDb,
-              userId: exportUserId,
-              handlerName: "user-data-rights:run-export-jobs",
-            })
-          : undefined;
+        // The cron runs across tenants: each mail needs a notify bound to the
+        // recipient's tenant (template override, channel config).
+        const notifyFactory = ctx._notifyFactory;
+        const exportNotifyFor =
+          notifyFactory !== undefined && isGdprMailDeliveryAvailable(exportRegistry)
+            ? (tenantId: TenantId) => notifyFactory(createSystemUser(tenantId), tenantId)
+            : undefined;
         const sendExportReadyEmail =
           opts.sendExportReadyEmail ??
-          (exportMailResolver && opts.appExportDownloadUrl !== undefined
-            ? makeDefaultExportReadyEmail(exportMailResolver, opts.mailDefaults)
+          (exportNotifyFor && opts.appExportDownloadUrl !== undefined
+            ? makeDefaultExportReadyEmail(exportNotifyFor, opts.mailDefaults)
             : undefined);
         const sendExportFailedEmail =
           opts.sendExportFailedEmail ??
-          (exportMailResolver
-            ? makeDefaultExportFailedEmail(exportMailResolver, opts.mailDefaults)
+          (exportNotifyFor
+            ? makeDefaultExportFailedEmail(exportNotifyFor, opts.mailDefaults)
             : undefined);
         if (
-          exportMailResolver &&
+          exportNotifyFor &&
           !opts.sendExportReadyEmail &&
           opts.appExportDownloadUrl === undefined &&
           !warnedMissingExportUrl
@@ -634,7 +656,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           warnedMissingExportUrl = true;
           // biome-ignore lint/suspicious/noConsole: one-shot operator visibility for misconfig
           console.warn(
-            "[user-data-rights:run-export-jobs] mail transport mounted but appExportDownloadUrl unset — default export-ready emails disabled (export-failed + deletion mails still send)",
+            "[user-data-rights:run-export-jobs] mail delivery mounted but appExportDownloadUrl unset — default export-ready emails disabled (export-failed + deletion mails still send)",
           );
         }
 
@@ -697,22 +719,37 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           userId: forgetUserId,
         });
 
-        // C6 — Default-Mail beim delete-flip wenn kein Callback gesetzt + ein
-        // mail-transport gemountet ist (gleiche per-Tenant-Bruecke wie Export).
-        const forgetMailResolver = isMailTransportAvailable(forgetRegistry)
-          ? makeTenantMailTransportResolver({
-              registry: forgetRegistry,
-              configResolver: ctx.configResolver,
-              secrets: ctx.secrets,
-              db: forgetDb,
-              userId: forgetUserId,
-              handlerName: "user-data-rights:run-forget-cleanup",
-            })
-          : undefined;
+        // Without an app callback the default mail goes out when a mail transport and a
+        // mail renderer are mounted. The user is already erased here, so it bypasses the
+        // delivery log: an attempt row would be new personal data.
+        const forgetConfigResolver = ctx.configResolver;
         const sendDeletionExecutedEmail =
           opts.sendDeletionExecutedEmail ??
-          (forgetMailResolver
-            ? makeDefaultDeletionExecutedEmail(forgetMailResolver, opts.mailDefaults)
+          (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+            ? makeDefaultDeletionExecutedEmail(
+                {
+                  registry: forgetRegistry,
+                  db: forgetDb,
+                  resolveTransport: makeTenantMailTransportResolver({
+                    registry: forgetRegistry,
+                    configResolver: forgetConfigResolver,
+                    secrets: ctx.secrets,
+                    db: forgetDb,
+                    userId: forgetUserId,
+                    handlerName: "user-data-rights:run-forget-cleanup",
+                  }),
+                  configFor: (tenantId) =>
+                    forgetConfigResolver &&
+                    createConfigAccessor(
+                      forgetRegistry,
+                      forgetConfigResolver,
+                      tenantId,
+                      forgetUserId,
+                      forgetDb,
+                    ),
+                },
+                opts.mailDefaults,
+              )
             : undefined);
 
         const forgetResult = await runForgetCleanup({

package/packages/bundled-features/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -71,12 +71,13 @@ export const cancelDeletionWrite = defineWriteHandler({
 
     // gracePeriodEnd=null im Response symmetrisch zu request-deletion's
     // ISO-Timestamp — Frontend kann beide Endpoints uniform behandeln.
+    const gracePeriodEnd: string | null = null;
     return {
       isSuccess: true as const,
       data: {
         userId: event.user.id,
         status: USER_STATUS.Active,
-        gracePeriodEnd: null as string | null,
+        gracePeriodEnd,
       },
     };
   },

package/packages/bundled-features/src/user-data-rights/handlers/request-deletion.write.ts

@@ -1,11 +1,10 @@
-import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { USER_STATUS } from "../../user/index.js";
 import {
   type GdprMailDefaults,
-  isMailTransportAvailable,
+  isGdprMailDeliveryAvailable,
   makeDefaultDeletionRequestedEmail,
 } from "../lib/default-mailers.js";
 import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
@@ -71,17 +70,12 @@ export function createRequestDeletionHandler(opts: RequestDeletionOptions = {})
       if (!res.ok) return writeFailure(res.error);
       const { gracePeriodEnd, userEmail, userLocale } = res;
 
-      // App-Callback hat Vorrang; sonst greift die mail-foundation-Default-Mail
-      // (Request-Lane → ctx.config vorhanden, createTransportForTenant direkt).
-      // Ohne gemounteten mail-transport bleibt send undefined → keine Mail.
+      // The app callback wins; otherwise the default mail goes through ctx.notify after
+      // the commit. Without delivery and an email channel there is no sender and no mail.
       const send =
         opts.sendDeletionRequestedEmail ??
-        (isMailTransportAvailable(ctx.registry)
-          ? makeDefaultDeletionRequestedEmail(
-              (tenantId) =>
-                createTransportForTenant(ctx, tenantId, "user-data-rights:request-deletion"),
-              opts.mailDefaults,
-            )
+        (ctx.notify !== undefined && isGdprMailDeliveryAvailable(ctx.registry)
+          ? makeDefaultDeletionRequestedEmail(ctx.notify, opts.mailDefaults)
           : undefined);
 
       // Best-effort Email-Notification. Send-Failure darf das Write nicht