@cosmicdrift/kumiko-samples 0.368.0 → 0.370.0

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -16,38 +16,38 @@ import {
   createNoopMetricsHandle,
 } from "@cosmicdrift/kumiko-framework/observability";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
-import { createConfigAccessor } from "../config/index.js";
-import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks.js";
+import { createConfigAccessor } from "../config/index.ts";
+import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks.ts";
 import {
   EXPORT_SECTION_EXTENSION_NAME,
   PRIVACY_CENTER_SCREEN_ID,
   STATUS_OPTION_KEY_PREFIX,
   USER_ME_QUERY,
   UserDataRightsHandlers,
-} from "./constants.js";
-import { cancelDeletionWrite } from "./handlers/cancel-deletion.write.js";
-import { createConfirmDeletionByTokenHandler } from "./handlers/confirm-deletion-by-token.write.js";
-import { downloadAttemptListQuery } from "./handlers/download-attempt-list.query.js";
-import { downloadByJobQuery } from "./handlers/download-by-job.query.js";
-import { downloadByTokenQuery } from "./handlers/download-by-token.query.js";
-import { exportJobDetailQuery } from "./handlers/export-job-detail.query.js";
-import { exportJobListQuery } from "./handlers/export-job-list.query.js";
-import { exportStatusQuery } from "./handlers/export-status.query.js";
-import { liftRestrictionWrite } from "./handlers/lift-restriction.write.js";
-import { listDownloadAttemptsQuery } from "./handlers/list-download-attempts.query.js";
-import { myAuditLogQuery } from "./handlers/my-audit-log.query.js";
+} from "./constants.ts";
+import { cancelDeletionWrite } from "./handlers/cancel-deletion.write.ts";
+import { createConfirmDeletionByTokenHandler } from "./handlers/confirm-deletion-by-token.write.ts";
+import { downloadAttemptListQuery } from "./handlers/download-attempt-list.query.ts";
+import { downloadByJobQuery } from "./handlers/download-by-job.query.ts";
+import { downloadByTokenQuery } from "./handlers/download-by-token.query.ts";
+import { exportJobDetailQuery } from "./handlers/export-job-detail.query.ts";
+import { exportJobListQuery } from "./handlers/export-job-list.query.ts";
+import { exportStatusQuery } from "./handlers/export-status.query.ts";
+import { liftRestrictionWrite } from "./handlers/lift-restriction.write.ts";
+import { listDownloadAttemptsQuery } from "./handlers/list-download-attempts.query.ts";
+import { myAuditLogQuery } from "./handlers/my-audit-log.query.ts";
 import {
   createRequestDeletionHandler,
   type SendDeletionRequestedEmailFn,
-} from "./handlers/request-deletion.write.js";
+} from "./handlers/request-deletion.write.ts";
 import {
   createRequestDeletionByEmailHandler,
   type SendDeletionVerificationEmailFn,
-} from "./handlers/request-deletion-by-email.write.js";
-import { requestExportWrite } from "./handlers/request-export.write.js";
-import { restrictAccountWrite } from "./handlers/restrict-account.write.js";
-import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.write.js";
-import { USER_DATA_RIGHTS_I18N } from "./i18n.js";
+} from "./handlers/request-deletion-by-email.write.ts";
+import { requestExportWrite } from "./handlers/request-export.write.ts";
+import { restrictAccountWrite } from "./handlers/restrict-account.write.ts";
+import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.write.ts";
+import { USER_DATA_RIGHTS_I18N } from "./i18n.ts";
 import {
   type GdprMailDefaults,
   isGdprMailDeliveryAvailable,
@@ -56,31 +56,31 @@ import {
   makeDefaultDeletionExecutedEmail,
   makeDefaultExportFailedEmail,
   makeDefaultExportReadyEmail,
-} from "./lib/default-mailers.js";
-import { makeTenantMailTransportResolver } from "./lib/mail-transport-resolver.js";
-import { resolveAppTenantModel } from "./lib/resolve-tenant-model.js";
-import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver.js";
-import { registerGdprMails } from "./mail-notifications.js";
+} from "./lib/default-mailers.ts";
+import { makeTenantMailTransportResolver } from "./lib/mail-transport-resolver.ts";
+import { resolveAppTenantModel } from "./lib/resolve-tenant-model.ts";
+import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver.ts";
+import { registerGdprMails } from "./mail-notifications.ts";
 import {
   EXPORT_CLEANUP_BACKLOG_AGE_METRIC,
   EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC,
   runExportJobs,
   type SendExportFailedEmailFn,
   type SendExportReadyEmailFn,
-} from "./run-export-jobs.js";
+} from "./run-export-jobs.ts";
 import {
   runForgetCleanup,
   type SendDeletionExecutedEmailFn,
   sanitizeReasonForLog,
-} from "./run-forget-cleanup.js";
-import { downloadAttemptEntity } from "./schema/download-attempt.js";
-import { exportDownloadTokenEntity } from "./schema/download-token.js";
-import { exportJobEntity } from "./schema/export-job.js";
+} from "./run-forget-cleanup.ts";
+import { downloadAttemptEntity } from "./schema/download-attempt.ts";
+import { exportDownloadTokenEntity } from "./schema/download-token.ts";
+import { exportJobEntity } from "./schema/export-job.ts";
 import {
   downloadAttemptListScreen,
   exportJobDetailScreen,
   exportJobListScreen,
-} from "./screens.js";
+} from "./screens.ts";
 
 // user-data-rights — DSGVO Art. 15 (Auskunft) + Art. 17 (Löschung) +
 // Art. 18 (Restriction) + Art. 20 (Portabilität) als Core-Feature.
@@ -719,17 +719,20 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           userId: forgetUserId,
         });
 
-        // Without an app callback the default mail goes out when a mail transport and a
-        // mail renderer are mounted. The user is already erased here, so it bypasses the
-        // delivery log: an attempt row would be new personal data.
+        // Without an app callback the default mail goes out when an email channel or a
+        // mail transport, plus a mail renderer, are mounted. The user is already erased
+        // here, so it bypasses the delivery log: an attempt row would be new personal data.
         const forgetConfigResolver = ctx.configResolver;
         const sendDeletionExecutedEmail =
           opts.sendDeletionExecutedEmail ??
-          (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+          ((isGdprMailDeliveryAvailable(forgetRegistry) ||
+            isMailTransportAvailable(forgetRegistry)) &&
+          isMailRendererAvailable(forgetRegistry)
             ? makeDefaultDeletionExecutedEmail(
                 {
                   registry: forgetRegistry,
                   db: forgetDb,
+                  ...(ctx.secrets !== undefined && { secrets: ctx.secrets }),
                   resolveTransport: makeTenantMailTransportResolver({
                     registry: forgetRegistry,
                     configResolver: forgetConfigResolver,

package/packages/bundled-features/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -1,9 +1,9 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { isWithinGracePeriod } from "../../shared/index.js";
-import { USER_STATUS, userTable } from "../../user/index.js";
-import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+import { isWithinGracePeriod } from "../../shared/index.ts";
+import { USER_STATUS, userTable } from "../../user/index.ts";
+import { updateUserLifecycle } from "../lib/update-user-lifecycle.ts";
 
 const APPEND_LIFECYCLE_EVENT_REASON =
   "appends the user lifecycle event on the SYSTEM_TENANT_ID user stream";

package/packages/bundled-features/src/user-data-rights/handlers/confirm-deletion-by-token.write.ts

@@ -1,9 +1,9 @@
 import { defineWriteHandler, type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { USER_STATUS, userTable } from "../../user/index.js";
-import { redeemDeletionToken } from "../deletion-token.js";
-import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
+import { USER_STATUS, userTable } from "../../user/index.ts";
+import { redeemDeletionToken } from "../deletion-token.ts";
+import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.ts";
 
 export type ConfirmDeletionByTokenOptions = {
   readonly deletionTokenSecret?: string;

package/packages/bundled-features/src/user-data-rights/handlers/deletion-grace-period.ts

@@ -11,9 +11,9 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { decryptStoredPii } from "../../shared/index.js";
-import { USER_STATUS, userTable } from "../../user/index.js";
-import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+import { decryptStoredPii } from "../../shared/index.ts";
+import { USER_STATUS, userTable } from "../../user/index.ts";
+import { updateUserLifecycle } from "../lib/update-user-lifecycle.ts";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 

package/packages/bundled-features/src/user-data-rights/handlers/download-attempt-list.query.ts

@@ -1,5 +1,5 @@
 import { access, defineEntityListHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { downloadAttemptEntity } from "../schema/download-attempt.js";
+import { downloadAttemptEntity } from "../schema/download-attempt.ts";
 
 // SystemAdmin operator view of invalid download attempts (DPO brute-force
 // triage). A bespoke list-download-attempts query already exists but sits on a

package/packages/bundled-features/src/user-data-rights/handlers/download-by-job.query.ts

@@ -33,10 +33,10 @@ import {
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
-import { recordDownloadUse, recordInvalidAttempt } from "../audit-download.js";
-import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver.js";
-import { exportDownloadTokensTable } from "../schema/download-token.js";
-import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job.js";
+import { recordDownloadUse, recordInvalidAttempt } from "../audit-download.ts";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver.ts";
+import { exportDownloadTokensTable } from "../schema/download-token.ts";
+import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job.ts";
 
 const SIGNED_URL_TTL_SECONDS = 300; // 5 min — matched download-by-token
 

package/packages/bundled-features/src/user-data-rights/handlers/download-by-token.query.ts

@@ -35,11 +35,11 @@ import {
 import { NotFoundError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
-import { recordDownloadUse, recordInvalidAttempt } from "../audit-download.js";
-import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver.js";
-import { exportDownloadTokensTable } from "../schema/download-token.js";
-import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job.js";
-import { hashDownloadToken } from "../token-helpers.js";
+import { recordDownloadUse, recordInvalidAttempt } from "../audit-download.ts";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver.ts";
+import { exportDownloadTokensTable } from "../schema/download-token.ts";
+import { EXPORT_JOB_STATUS, exportJobsTable } from "../schema/export-job.ts";
+import { hashDownloadToken } from "../token-helpers.ts";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 

package/packages/bundled-features/src/user-data-rights/handlers/export-job-detail.query.ts

@@ -1,5 +1,5 @@
 import { access, defineEntityDetailHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { exportJobEntity } from "../schema/export-job.js";
+import { exportJobEntity } from "../schema/export-job.ts";
 
 // Detail fetch backing the read-only export-job inspector screen.
 export const exportJobDetailQuery = defineEntityDetailHandler("export-job", exportJobEntity, {

package/packages/bundled-features/src/user-data-rights/handlers/export-job-list.query.ts

@@ -1,5 +1,5 @@
 import { access, defineEntityListHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { exportJobEntity } from "../schema/export-job.js";
+import { exportJobEntity } from "../schema/export-job.ts";
 
 // SystemAdmin operator view of GDPR Art. 20 export jobs. Read-only inspector —
 // rows are created by the user's request-export flow, never through this handler.

package/packages/bundled-features/src/user-data-rights/handlers/export-status.query.ts

@@ -15,7 +15,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
-import { exportJobsTable } from "../schema/export-job.js";
+import { exportJobsTable } from "../schema/export-job.ts";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 

package/packages/bundled-features/src/user-data-rights/handlers/lift-restriction.write.ts

@@ -1,9 +1,9 @@
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { USER_STATUS, userTable } from "../../user/index.js";
-import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.js";
-import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+import { USER_STATUS, userTable } from "../../user/index.ts";
+import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.ts";
+import { updateUserLifecycle } from "../lib/update-user-lifecycle.ts";
 
 const LIFT_RESTRICTION_ESCAPE_HATCH_REASON =
   "checks the target user's membership in the admin's tenant and appends the user lifecycle status change on the SYSTEM_TENANT_ID user stream, both via DbRunner helpers outside the admin's own tenant scope.";

package/packages/bundled-features/src/user-data-rights/handlers/list-download-attempts.query.ts

@@ -2,8 +2,8 @@ import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { decryptStoredPii } from "../../shared/index.js";
-import { downloadAttemptsTable } from "../schema/download-attempt.js";
+import { decryptStoredPii } from "../../shared/index.ts";
+import { downloadAttemptsTable } from "../schema/download-attempt.ts";
 
 // Operator-Query: invalid Download-Attempts (S2.U7).
 // DPO-Sicht fuer Brute-Force-Detection. Tenant-isolated via WHERE.

package/packages/bundled-features/src/user-data-rights/handlers/my-audit-log.query.ts

@@ -3,7 +3,7 @@ import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
-import { redactPiiCiphertext } from "../../shared/index.js";
+import { redactPiiCiphertext } from "../../shared/index.ts";
 
 // DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.
 // WHERE createdBy = ctx.user.id ist hard-coded (kein userId-Param,

package/packages/bundled-features/src/user-data-rights/handlers/request-deletion-by-email.write.ts

@@ -1,8 +1,8 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
-import { USER_STATUS, userTable } from "../../user/index.js";
-import { signDeletionToken } from "../deletion-token.js";
-import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+import { USER_STATUS, userTable } from "../../user/index.ts";
+import { signDeletionToken } from "../deletion-token.ts";
+import { updateUserLifecycle } from "../lib/update-user-lifecycle.ts";
 
 // TTL des Verify-Links. 60 min — lang genug für einen Mail-Roundtrip,
 // kurz genug dass ein abgefangener Link nicht ewig gültig ist.

package/packages/bundled-features/src/user-data-rights/handlers/request-deletion.write.ts

@@ -1,13 +1,13 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { USER_STATUS } from "../../user/index.js";
+import { USER_STATUS } from "../../user/index.ts";
 import {
   type GdprMailDefaults,
   isGdprMailDeliveryAvailable,
   makeDefaultDeletionRequestedEmail,
-} from "../lib/default-mailers.js";
-import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
+} from "../lib/default-mailers.ts";
+import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.ts";
 
 // Atom 5b — Email-Notification beim deletion-requested-flip. Pattern:
 // password-reset-Callback aus auth-routes.ts. Best-effort — Throw beim

package/packages/bundled-features/src/user-data-rights/handlers/request-export.write.ts

@@ -30,7 +30,7 @@ import {
   EXPORT_JOB_STATUS,
   exportJobEntity,
   exportJobsTable,
-} from "../schema/export-job.js";
+} from "../schema/export-job.ts";
 
 const crud = createEventStoreExecutor(exportJobsTable, exportJobEntity, {
   entityName: "export-job",

package/packages/bundled-features/src/user-data-rights/handlers/restrict-account.write.ts

@@ -5,10 +5,10 @@ import {
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { USER_STATUS, userTable } from "../../user/index.js";
-import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.js";
-import { isAdminActor } from "../lib/is-admin-actor.js";
-import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+import { USER_STATUS, userTable } from "../../user/index.ts";
+import { denyIfTargetOutsideAdminTenant } from "../lib/deny-if-target-outside-admin-tenant.ts";
+import { isAdminActor } from "../lib/is-admin-actor.ts";
+import { updateUserLifecycle } from "../lib/update-user-lifecycle.ts";
 
 // POST /api/user/restrict (S2.U6) — DSGVO Art. 18 Account-Freeze.
 // Flippt status=Active → Restricted und revoked alle live sessions

package/packages/bundled-features/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -15,9 +15,9 @@ import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
-import { resolveAppTenantModel } from "../lib/resolve-tenant-model.js";
-import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver.js";
-import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "../run-forget-cleanup.js";
+import { resolveAppTenantModel } from "../lib/resolve-tenant-model.ts";
+import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver.ts";
+import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "../run-forget-cleanup.ts";
 
 export type RunForgetCleanupOptions = {
   readonly sendDeletionExecutedEmail?: SendDeletionExecutedEmailFn;

package/packages/bundled-features/src/user-data-rights/index.ts

@@ -1,19 +1,19 @@
-export { TENANT_MODEL_CONFIG_KEY } from "./constants.js";
-export { createUserDataRightsFeature, type UserDataRightsOptions } from "./feature.js";
-export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write.js";
+export { TENANT_MODEL_CONFIG_KEY } from "./constants.ts";
+export { createUserDataRightsFeature, type UserDataRightsOptions } from "./feature.ts";
+export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write.ts";
 export {
   denyIfTargetOutsideAdminTenant,
   TARGET_USER_NOT_IN_ADMIN_TENANT,
-} from "./lib/deny-if-target-outside-admin-tenant.js";
-export { isSystemAdminActor } from "./lib/is-admin-actor.js";
+} from "./lib/deny-if-target-outside-admin-tenant.ts";
+export { isSystemAdminActor } from "./lib/is-admin-actor.ts";
 // #494 Bestandsdaten-Reconcile — Apps rufen das einmalig vor dem Re-Enable
 // von read_users-Rebuilds (siehe lib-Doc).
-export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle.js";
+export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle.ts";
 export type {
   SendExportFailedEmailFn,
   SendExportReadyEmailFn,
-} from "./run-export-jobs.js";
-export type { SendDeletionExecutedEmailFn } from "./run-forget-cleanup.js";
+} from "./run-export-jobs.ts";
+export type { SendDeletionExecutedEmailFn } from "./run-forget-cleanup.ts";
 // Runner-Exports — App-Tests dürfen export/forget deterministisch laufen
 // lassen, statt über den Job-Cron zu warten (siehe sample
 // user-data-rights-demo).
@@ -22,14 +22,14 @@ export type { SendDeletionExecutedEmailFn } from "./run-forget-cleanup.js";
 // consult a DIFFERENT entity's retention (e.g. notes-history-user-data's
 // host-entity check) reuse this instead of re-deriving the anonymize/delete
 // split.
-export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.js";
-export type { UserExportBundle } from "./run-user-export.js";
-export { runUserExport } from "./run-user-export.js";
-export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.js";
+export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.ts";
+export type { UserExportBundle } from "./run-user-export.ts";
+export { runUserExport } from "./run-user-export.ts";
+export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.ts";
 export {
   ACTIVE_JOB_CONSTRAINT,
   EXPORT_JOB_STATUS,
   type ExportJobStatus,
   exportJobEntity,
   exportJobsTable,
-} from "./schema/export-job.js";
+} from "./schema/export-job.ts";

package/packages/bundled-features/src/user-data-rights/lib/default-mailers.ts

@@ -7,8 +7,8 @@
 // to the user, so delivery resolves the address and the attempt row carries
 // the recipientId the forget path erases. Deletion-executed cannot: the user
 // is gone by then, and an attempt row written after the erasure would be new
-// personal data. It renders the seeded template and sends over the tenant's
-// mail transport, with no delivery log.
+// personal data. It renders the seeded template and sends it straight through the
+// email channel (or, without one, the tenant's mail transport), with no delivery log.
 
 import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
@@ -21,20 +21,27 @@ import type {
   TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { hasMailTranslations, mailT } from "@cosmicdrift/kumiko-framework/i18n";
-import { DELIVERY_CHANNEL_EXTENSION } from "../../delivery/index.js";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  buildChannelContext,
+  collectChannels,
+  DELIVERY_CHANNEL_EXTENSION,
+  type DeliveryChannel,
+  EMAIL_CHANNEL_NAME,
+} from "../../delivery/index.ts";
 import {
   collectRendererPlugins,
   createRendererFoundationApi,
-} from "../../renderer-foundation/index.js";
+} from "../../renderer-foundation/index.ts";
 import {
   formatGdprMailTimestamp,
   type GdprMailLocale,
   normalizeGdprMailLocale,
-} from "../email-templates.js";
-import type { SendDeletionRequestedEmailFn } from "../handlers/request-deletion.write.js";
-import { GdprMailNotificationTypes, gdprMailTemplateLocale } from "../mail-notifications.js";
-import type { SendExportFailedEmailFn, SendExportReadyEmailFn } from "../run-export-jobs.js";
-import type { SendDeletionExecutedEmailFn } from "../run-forget-cleanup.js";
+} from "../email-templates.ts";
+import type { SendDeletionRequestedEmailFn } from "../handlers/request-deletion.write.ts";
+import { GdprMailNotificationTypes, gdprMailTemplateLocale } from "../mail-notifications.ts";
+import type { SendExportFailedEmailFn, SendExportReadyEmailFn } from "../run-export-jobs.ts";
+import type { SendDeletionExecutedEmailFn } from "../run-forget-cleanup.ts";
 
 export type GdprMailDefaults = {
   readonly locale?: GdprMailLocale;
@@ -145,10 +152,16 @@ export function makeDefaultDeletionRequestedEmail(
 export type DeletionExecutedMailDeps = {
   readonly registry: Registry;
   readonly db: DbConnection;
+  /** Used only when no email delivery channel is mounted. */
   readonly resolveTransport: (tenantId: string) => Promise<EmailTransport>;
   readonly configFor: (tenantId: TenantId) => ConfigAccessor | undefined;
+  readonly secrets?: SecretsContext;
 };
 
+function emailChannelOf(registry: Registry): DeliveryChannel | undefined {
+  return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
+
 export function makeDefaultDeletionExecutedEmail(
   deps: DeletionExecutedMailDeps,
   defaults: GdprMailDefaults = {},
@@ -190,6 +203,30 @@ export function makeDefaultDeletionExecutedEmail(
     if (rendered.kind !== "mail") {
       throw new Error(`deletion-executed mail: renderer answered with kind "${rendered.kind}"`);
     }
+    // The channel picks the same transport as every other mail of this notification
+    // (the app transport unless it is declared tenantTransport), so a tenant without
+    // its own mail provider still gets the confirmation. channel.send writes no attempt row.
+    const channel = emailChannelOf(deps.registry);
+    if (channel !== undefined) {
+      const result = await channel.send(
+        args.userEmail,
+        {
+          notificationType: type,
+          title: rendered.subject,
+          body: undefined,
+          data: undefined,
+          locale,
+        },
+        buildChannelContext(deps.db, deps.registry, undefined, tenantId, deps.secrets, config),
+        { subject: rendered.subject, html: rendered.html, text: rendered.text },
+      );
+      if (result.status !== "sent") {
+        // No address in the message: the user is already erased.
+        throw new Error(`deletion-executed mail not sent: ${result.error ?? result.status}`);
+      }
+      // skip: the channel delivered it, the transport fallback below is for apps without one
+      return;
+    }
     const transport = await deps.resolveTransport(tenantId);
     await transport.send({
       to: args.userEmail,

package/packages/bundled-features/src/user-data-rights/lib/deny-if-target-outside-admin-tenant.ts

@@ -5,8 +5,8 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { tenantMembershipsTable } from "../../tenant/index.js";
-import { isSystemAdminActor } from "./is-admin-actor.js";
+import { tenantMembershipsTable } from "../../tenant/index.ts";
+import { isSystemAdminActor } from "./is-admin-actor.ts";
 
 export const TARGET_USER_NOT_IN_ADMIN_TENANT = "target_user_not_in_admin_tenant" as const;
 

package/packages/bundled-features/src/user-data-rights/lib/mail-transport-resolver.ts

@@ -11,7 +11,7 @@ import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/m
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigResolver, Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { createConfigAccessor } from "../../config/index.js";
+import { createConfigAccessor } from "../../config/index.ts";
 
 export interface TenantMailResolverCtx {
   readonly registry: Registry;

package/packages/bundled-features/src/user-data-rights/lib/resolve-tenant-model.ts

@@ -11,8 +11,8 @@ import {
   SYSTEM_TENANT_ID,
   type TenantUserModel,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { createConfigAccessor } from "../../config/index.js";
-import { TENANT_MODEL_CONFIG_KEY } from "../constants.js";
+import { createConfigAccessor } from "../../config/index.ts";
+import { TENANT_MODEL_CONFIG_KEY } from "../constants.ts";
 
 export async function resolveAppTenantModel(args: {
   readonly registry: Registry;

package/packages/bundled-features/src/user-data-rights/lib/storage-provider-resolver.ts

@@ -9,8 +9,8 @@ import type { ConfigResolver, Registry, TenantId } from "@cosmicdrift/kumiko-fra
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { FileStorageProvider } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { createConfigAccessor } from "../../config/index.js";
-import { createFileProviderForTenant } from "../../file-foundation/index.js";
+import { createConfigAccessor } from "../../config/index.ts";
+import { createFileProviderForTenant } from "../../file-foundation/index.ts";
 
 export interface TenantStorageResolverCtx {
   readonly registry: Registry;

package/packages/bundled-features/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -7,7 +7,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
+import { USER_STATUS, userEntity, userTable } from "../../user/index.ts";
 
 // #494 — Lifecycle-Mutationen der user-Entity MUESSEN als `user.updated`-Event
 // laufen. Roh per updateMany geschrieben, wischt ein read_users-Rebuild sie

package/packages/bundled-features/src/user-data-rights/mail-notifications.ts

@@ -13,8 +13,8 @@ import {
   resolveMailLocale,
 } from "@cosmicdrift/kumiko-framework/i18n";
 import { escapeHtml } from "@cosmicdrift/kumiko-headless";
-import { mailParagraph } from "../shared/index.js";
-import { USER_DATA_RIGHTS_FEATURE } from "./constants.js";
+import { mailParagraph } from "../shared/index.ts";
+import { USER_DATA_RIGHTS_FEATURE } from "./constants.ts";
 
 const ALL_GDPR_MAIL_KINDS = [
   "exportReady",

package/packages/bundled-features/src/user-data-rights/run-export-jobs.ts

@@ -68,14 +68,14 @@ import {
 } from "@cosmicdrift/kumiko-framework/files";
 import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { resolveProfileForTenant } from "../compliance-profiles/index.js";
-import { decryptStoredPii } from "../shared/index.js";
-import { userTable } from "../user/index.js";
-import { selectExportJobsForStorageCleanup } from "./db/queries/export-jobs.js";
-import { runUserExport, type UserExportBundle } from "./run-user-export.js";
-import { exportDownloadTokenEntity, exportDownloadTokensTable } from "./schema/download-token.js";
-import { EXPORT_JOB_STATUS, exportJobEntity, exportJobsTable } from "./schema/export-job.js";
-import { generateDownloadToken } from "./token-helpers.js";
+import { resolveProfileForTenant } from "../compliance-profiles/index.ts";
+import { decryptStoredPii } from "../shared/index.ts";
+import { userTable } from "../user/index.ts";
+import { selectExportJobsForStorageCleanup } from "./db/queries/export-jobs.ts";
+import { runUserExport, type UserExportBundle } from "./run-user-export.ts";
+import { exportDownloadTokenEntity, exportDownloadTokensTable } from "./schema/download-token.ts";
+import { EXPORT_JOB_STATUS, exportJobEntity, exportJobsTable } from "./schema/export-job.ts";
+import { generateDownloadToken } from "./token-helpers.ts";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -74,12 +74,12 @@ import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   resolveRetentionPolicyForTenant,
   resolveTenantRetentionPreset,
-} from "../data-retention/index.js";
-import { decryptStoredPii, runInSubTransaction } from "../shared/index.js";
-import { tenantMembershipsTable } from "../tenant/index.js";
-import { USER_STATUS, userTable } from "../user/index.js";
-import { selectUsersDueForForgetCleanup } from "./db/queries/forget-cleanup.js";
-import { updateUserLifecycle } from "./lib/update-user-lifecycle.js";
+} from "../data-retention/index.ts";
+import { decryptStoredPii, runInSubTransaction } from "../shared/index.ts";
+import { tenantMembershipsTable } from "../tenant/index.ts";
+import { USER_STATUS, userTable } from "../user/index.ts";
+import { selectUsersDueForForgetCleanup } from "./db/queries/forget-cleanup.ts";
+import { updateUserLifecycle } from "./lib/update-user-lifecycle.ts";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;