@cosmicdrift/kumiko-samples 0.378.0 → 0.380.0

package/packages/bundled-features/src/auth-mfa/errors.ts

@@ -3,9 +3,9 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { AuthMfaErrorCodes } from "./constants.ts";
+import { AuthMfaErrorCodes } from "./web/constants.ts";
 
-export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants.ts";
+export { AuthMfaErrorCodes as AuthMfaErrors } from "./web/constants.ts";
 
 export function mfaAlreadyEnabled(): WriteFailure {
   return writeFailure(

package/packages/bundled-features/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -12,7 +12,6 @@ import * as z from "zod";
 import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared/index.ts";
 import { USER_STATUS, UserQueries } from "../../user/index.ts";
 import { base32Decode } from "../base32.ts";
-import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants.ts";
 import { findUserMfaRow } from "../db/queries.ts";
 import {
   invalidSetupToken,
@@ -28,6 +27,7 @@ import {
 } from "../mfa-verify-attempts.ts";
 import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
 import { verifyTotp } from "../totp.ts";
+import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../web/constants.ts";
 
 export type EnableConfirmPreauthOptions = {
   // Must match the secret enable-start-preauth.write.ts signs setupTokens

package/packages/bundled-features/src/auth-mfa/handlers/enable-start-preauth.write.ts

@@ -2,7 +2,6 @@ import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { base32Encode } from "../base32.ts";
-import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.ts";
 import { findUserMfaRow } from "../db/queries.ts";
 import { invalidChallengeToken, mfaAlreadyEnabled } from "../errors.ts";
 import { verifyMfaPreauthSetupToken } from "../mfa-preauth-setup-token.ts";
@@ -10,6 +9,7 @@ import { signMfaSetupToken } from "../mfa-setup-token.ts";
 import { buildOtpauthUri } from "../otpauth-uri.ts";
 import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.ts";
 import { generateTotpSecret } from "../totp.ts";
+import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../web/constants.ts";
 
 const ENABLE_START_PREAUTH_TENANT_REASON =
   "reads the MFA enrollment of the tenant named in the signed login/setup token, not the guest dispatch tenant";

package/packages/bundled-features/src/auth-mfa/handlers/enable-start.write.ts

@@ -2,13 +2,13 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { UserQueries } from "../../user/index.ts";
 import { base32Encode } from "../base32.ts";
-import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants.ts";
 import { findUserMfaRow } from "../db/queries.ts";
 import { mfaAlreadyEnabled } from "../errors.ts";
 import { signMfaSetupToken } from "../mfa-setup-token.ts";
 import { buildOtpauthUri } from "../otpauth-uri.ts";
 import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes.ts";
 import { generateTotpSecret } from "../totp.ts";
+import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../web/constants.ts";
 
 export type EnableStartOptions = {
   readonly setupTokenSecret: string;

package/packages/bundled-features/src/auth-mfa/handlers/verify.write.ts

@@ -10,7 +10,6 @@ import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared/index.ts";
 import { USER_STATUS, UserQueries } from "../../user/index.ts";
-import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants.ts";
 import { findUserMfaRow } from "../db/queries.ts";
 import { invalidChallengeToken, invalidTotpCode, tooManyAttempts } from "../errors.ts";
 import { verifyMfaChallengeToken } from "../mfa-challenge-token.ts";
@@ -21,6 +20,7 @@ import {
 } from "../mfa-verify-attempts.ts";
 import { encodeRecoveryCodes, userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
 import { verifyMfaFactor } from "../verify-factor.ts";
+import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../web/constants.ts";
 
 export type MfaVerifyOptions = {
   // Must match the secret the login handler signs mfa-challenge tokens

package/packages/bundled-features/src/auth-mfa/index.ts

@@ -1,13 +1,5 @@
 export { base32Decode } from "./base32.ts";
 export { type MfaRequiredPolicy, mfaRequiredConfigHandle } from "./config.ts";
-export {
-  AUTH_MFA_FEATURE,
-  AuthMfaHandlers,
-  AuthMfaQueries,
-  MFA_DISABLE_SCREEN_ID,
-  MFA_ENABLE_SCREEN_ID,
-  MFA_REGENERATE_RECOVERY_SCREEN_ID,
-} from "./constants.ts";
 export { authMfaEnvSchema, mfaTokenSecretsEnvSchema } from "./env.ts";
 export type { AuthMfaFeatureOptions } from "./feature.ts";
 export { createAuthMfaFeature } from "./feature.ts";
@@ -33,3 +25,11 @@ export {
   resolveMfaTokenSecrets,
   resolveMfaTokenSecretsFromEnv,
 } from "./token-secrets.ts";
+export {
+  AUTH_MFA_FEATURE,
+  AuthMfaHandlers,
+  AuthMfaQueries,
+  MFA_DISABLE_SCREEN_ID,
+  MFA_ENABLE_SCREEN_ID,
+  MFA_REGENERATE_RECOVERY_SCREEN_ID,
+} from "./web/constants.ts";

package/packages/bundled-features/src/auth-mfa/mfa-status-checker.ts

@@ -7,13 +7,13 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { type MfaRequiredPolicy, mfaRequiredConfigHandle, mfaRequiredConfigKey } from "./config.ts";
-import {
-  MFA_CHALLENGE_TOKEN_TTL_MINUTES,
-  MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES,
-} from "./constants.ts";
 import { findUserMfaRow } from "./db/queries.ts";
 import { signMfaChallengeToken } from "./mfa-challenge-token.ts";
 import { signMfaPreauthSetupToken } from "./mfa-preauth-setup-token.ts";
+import {
+  MFA_CHALLENGE_TOKEN_TTL_MINUTES,
+  MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES,
+} from "./web/constants.ts";
 
 export type MfaStatusCheckResult =
   | { readonly required: false }

package/packages/bundled-features/src/auth-mfa/screens.ts

@@ -8,7 +8,7 @@ import {
   MFA_DISABLE_SCREEN_ID,
   MFA_ENABLE_SCREEN_ID,
   MFA_REGENERATE_RECOVERY_SCREEN_ID,
-} from "./constants.ts";
+} from "./web/constants.ts";
 
 // Declarative TOTP-enrollment screen: mint (no input) -> reveal QR/secret/
 // recovery-codes -> confirm with a 6-digit code. `setupToken` is carried

package/packages/bundled-features/src/auth-mfa/web/client-plugin.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Client-Feature-Factory für auth-mfa — mirrors emailPasswordClient()'s
 // shape so apps register both the same way:
 // createKumikoApp({ clientFeatures: [emailPasswordClient(), authMfaClient()] }).

package/packages/bundled-features/src/auth-mfa/{constants.ts → web/constants.ts}

@@ -1,4 +1,3 @@
-// @runtime client
 // Pure constants — client-marked so auth-mfa/web/ may import handler QNs
 // and the screen id without pulling the feature's server runtime barrel.
 // Qualified write-handler names — feature is registered as "auth-mfa", each

package/packages/bundled-features/src/auth-mfa/web/i18n.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Default-Bundles für die auth-mfa Feature-UI. Merged in mit
 // authMfaClient() analog zu emailPasswordClient() aus auth-email-password.
 // Keys folgen `auth.mfa.<area>.<slug>`.

package/packages/bundled-features/src/auth-mfa/web/index.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Public exports für die Browser-Seite des auth-mfa Features. Sub-Path-
 // Export `@cosmicdrift/kumiko-bundled-features/auth-mfa/web` — Server-Seite
 // (defineFeature) bleibt frei von React-/DOM-Deps, siehe auth-email-

package/packages/bundled-features/src/auth-mfa/web/mfa-client.ts

@@ -1,4 +1,3 @@
-// @runtime client
 // Browser-Seite von POST /api/auth/mfa/verify — completes the two-step
 // login LoginScreen started when the server responded mfaRequired. Same
 // fetch/CSRF pattern as auth-email-password's login() (pre-session, no

package/packages/bundled-features/src/auth-mfa/web/mfa-disable-dialog.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // MfaDisableDialog — confirm-with-code before turning MFA off. Uses the
 // generic Dialog primitive (unlike MfaRegenerateRecoveryDialog): disable is
 // single-step, no state to preserve after confirm, so
@@ -12,7 +11,7 @@
 
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
-import { AuthMfaHandlers } from "../constants.ts";
+import { AuthMfaHandlers } from "./constants.ts";
 
 export type MfaDisableDialogProps = {
   readonly open: boolean;

package/packages/bundled-features/src/auth-mfa/web/mfa-recovery-codes-reveal.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // MfaRecoveryCodesReveal — one-time display of a fresh recovery-code set,
 // with an acknowledge-then-dismiss gate. Standalone so MfaRegenerateRecovery-
 // Dialog's caller can render it after the dialog closes — the codes only

package/packages/bundled-features/src/auth-mfa/web/mfa-regenerate-recovery-dialog.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // MfaRegenerateRecoveryDialog — confirm-with-code, then the caller reveals
 // the new codes. The reveal itself can't live inside this Dialog: Dialog
 // closes in a `finally` right after onConfirm resolves (see profile-screen.
@@ -9,7 +8,7 @@
 
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
-import { AuthMfaHandlers } from "../constants.ts";
+import { AuthMfaHandlers } from "./constants.ts";
 
 export type MfaRegenerateRecoveryDialogProps = {
   readonly open: boolean;

package/packages/bundled-features/src/auth-mfa/web/mfa-setup-preauth-screen.tsx

@@ -1,6 +1,3 @@
-// @runtime client
-// Consumers that type-check this source never include the ambient declaration on their own.
-/// <reference path="./qrcode-browser.d.ts" />
 // Pre-auth twin of the declarative auth-mfa-enable secretMint screen: a user
 // blocked at login by MFA enforcement and not yet enrolled lands here
 // straight out of the login flow — there is no session yet. Identity comes
@@ -17,9 +14,6 @@
 // stays "unauthenticated" until the next reload.
 
 import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
-// qrcode's package.json#browser remap avoids Node-only deps (yargs/pngjs)
-// for bundlers that honor it — Metro doesn't, hence the explicit subpath.
-import QRCode from "qrcode/lib/browser.js";
 import { type FormEvent, type ReactNode, useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only component, the feature's server barrel has no web/ re-export
 import { AuthCard } from "../../auth-email-password/web/index.ts";
@@ -29,7 +23,7 @@ type SetupState = {
   readonly setupToken: string;
   readonly secretParam: string;
   readonly recoveryCodes: readonly string[];
-  readonly qrSvg: string;
+  readonly otpauthUri: string;
 };
 
 // otpauth:// URIs put the secret in the query string — extract it for the
@@ -80,7 +74,7 @@ export function MfaSetupPreauthScreen({
   onCancel,
 }: MfaSetupPreauthScreenProps): ReactNode {
   const t = useTranslation();
-  const { Button, Banner, Field, Form, Input, Section } = usePrimitives();
+  const { Button, Banner, Field, Form, Input, Section, SecretReveal } = usePrimitives();
 
   const [setup, setSetup] = useState<SetupState | null>(null);
   const [acknowledged, setAcknowledged] = useState(false);
@@ -100,18 +94,11 @@ export function MfaSetupPreauthScreen({
         setRetryAfterSeconds(res.error.retryAfterSeconds ?? null);
         return;
       }
-      // errorCorrectionLevel "H" (~30% redundancy) — more resilient to
-      // camera/lighting issues than the default, no downside for a code
-      // this short-lived.
-      const qrSvg = await QRCode.toString(res.data.otpauthUri, {
-        type: "svg",
-        errorCorrectionLevel: "H",
-      });
       setSetup({
         setupToken: res.data.setupToken,
         secretParam: extractSecret(res.data.otpauthUri),
         recoveryCodes: res.data.recoveryCodes,
-        qrSvg,
+        otpauthUri: res.data.otpauthUri,
       });
       setAcknowledged(false);
       setCode("");
@@ -192,13 +179,24 @@ export function MfaSetupPreauthScreen({
         <Form onSubmit={onSubmit}>
           <Section testId="mfa-setup-preauth-setup">
             <div className="flex flex-col items-center gap-2 text-center">
-              <span className="text-sm font-semibold">{t("auth.mfa.enable.scanTitle")}</span>
-              {/* qrcode's own SVG string output, not user input — safe to inline */}
-              <div
-                className="h-40 w-40"
-                // biome-ignore lint/security/noDangerouslySetInnerHtml: qrcode-generated SVG, no user input
-                dangerouslySetInnerHTML={{ __html: setup.qrSvg }}
-              />
+              {SecretReveal !== undefined ? (
+                <SecretReveal
+                  values={[
+                    {
+                      label: t("auth.mfa.enable.scanTitle"),
+                      value: setup.otpauthUri,
+                      qr: true,
+                      copyable: false,
+                      multiline: false,
+                    },
+                  ]}
+                  copyLabel={t("kumiko.secretMint.copy")}
+                  copiedLabel={t("kumiko.secretMint.copied")}
+                  testId="mfa-setup-preauth-qr"
+                />
+              ) : (
+                <span className="text-sm font-semibold">{t("auth.mfa.enable.scanTitle")}</span>
+              )}
               <span className="text-xs text-muted-foreground">
                 {t("auth.mfa.enable.manualEntry")}
               </span>

package/packages/bundled-features/src/auth-mfa/web/mfa-verify-screen.tsx

@@ -1,4 +1,3 @@
-// @runtime client
 // Login-Challenge-Step, gerendert wenn LoginScreen's onMfaChallenge feuert
 // (/auth/login antwortete mfaRequired). Stilistisch wie login-screen.tsx:
 // useState + direkter fetch-Call, kein Dispatcher — es existiert noch kein

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Late Stripe events are dropped",
+    "detail": "The Stripe plugin passes event.created as providerEventAt, process-event stores it as providerEventAtIso in the subscription event and drops a created, updated or canceled event that is older than one already stored (result stale: true). A canceled subscription is no longer reactivated by a late delivery. Providers without a timestamp are unaffected; no migration."
+  },
+  {
+    "version": "0.379.0",
+    "type": "fix",
+    "title": "Contract mails reach users with encrypted email addresses",
+    "detail": "With a KMS configured, the contract confirmation and the receipt for a termination from the user account used the stored, encrypted email address as recipient. The mail channel refuses such addresses, so neither mail was sent and the send job failed after its retries. Both now decrypt the address first; an erased user gets no mail, as before for deleted users."
+  },
+  {
+    "version": "0.379.0",
+    "type": "improvement",
+    "title": "\"This cancellation was not me\" link in the public cancellation receipt",
+    "detail": "When a public § 312k declaration matches an account, the receipt mail carries a one-time link (random token, only its sha256 is stored as revocationTokenHash in the declared event). The link opens a confirmation page; confirming with POST takes the cancellation back until it takes effect, resumes the provider subscription through the new optional SubscriptionProviderPlugin.resumeSubscription (Stripe sets cancel_at_period_end to false) or asks the operator to do it by hand, appends contract-termination.revoked and notifies the operator. Unknown requests and wrong tokens get the same answer; after the effective date the page says it is too late. Declarations stored before this release have no token and cannot be revoked by link."
+  },
   {
     "version": "0.377.0",
     "type": "improvement",

package/packages/bundled-features/src/billing-foundation/checkout-core.ts

@@ -11,13 +11,13 @@ import {
   UnconfiguredError,
   UnprocessableError,
 } from "@cosmicdrift/kumiko-framework/errors";
+import { getSubscriptionForTenant } from "./get-subscription-for-tenant.ts";
+import type { BillingPlanCatalog, SubscriptionProviderPlugin } from "./types.ts";
 import {
   BILLING_FOUNDATION_FEATURE,
   isSubscriptionBlockingCheckout,
   SUBSCRIPTION_PROVIDER_EXTENSION,
-} from "./constants.ts";
-import { getSubscriptionForTenant } from "./get-subscription-for-tenant.ts";
-import type { BillingPlanCatalog, SubscriptionProviderPlugin } from "./types.ts";
+} from "./web/constants.ts";
 
 /** Narrows a `readonly string[]` to the non-empty tuple shape `z.enum`
  *  needs. Callers only reach this with a catalog's `plans` — the feature

package/packages/bundled-features/src/billing-foundation/consumer-protection/consent-text.ts

@@ -1,12 +1,12 @@
 import { createHash } from "node:crypto";
-import type { ConsentLocale } from "./consent-locale.ts";
+import type { ConsentLocale } from "../web/consumer-protection/consent-locale.ts";
 
 export {
   CONSENT_LOCALES,
   type ConsentLocale,
   FALLBACK_CONSENT_LOCALE,
   resolveConsentLocale,
-} from "./consent-locale.ts";
+} from "../web/consumer-protection/consent-locale.ts";
 
 // Legal texts, deliberately inline de/en: the wording is part of the recorded
 // consent, so it cannot follow the en-only i18n convention.

package/packages/bundled-features/src/billing-foundation/consumer-protection/issue-confirmation.ts

@@ -15,7 +15,6 @@ import * as z from "zod";
 import { requireTemplateResolver, TEXT_BLOCK_KIND } from "../../template-resolver/index.ts";
 import { UserQueries } from "../../user/index.ts";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.ts";
-import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../constants.ts";
 import {
   CHECKOUT_CONSENT_RECORDED_EVENT_QN,
   type CheckoutConsentRecordedPayload,
@@ -27,8 +26,10 @@ import {
   SUBSCRIPTION_AGGREGATE_TYPE,
 } from "../events.ts";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.ts";
+import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../web/constants.ts";
 import { contractConfirmationVariables } from "./confirmation-mail.ts";
 import { resolveConsentLocale } from "./consent-text.ts";
+import { openStoredUserEmail } from "./stored-user-email.ts";
 
 export const issueContractConfirmationSchema = z
   .object({
@@ -142,7 +143,14 @@ export function createIssueContractConfirmationHandler(
           id: consent.actorUserId,
         }),
       );
-      if (!recipient.success || recipient.data.isDeleted === true) {
+      const recipientEmail =
+        recipient.success && recipient.data.isDeleted !== true
+          ? await openStoredUserEmail(
+              recipient.data.email,
+              "billing-foundation:issue-contract-confirmation",
+            )
+          : null;
+      if (!recipient.success || recipientEmail === null) {
         ctx.log?.warn(
           `[billing-foundation:issue-contract-confirmation] recipient of consent ${payload.consentId} not found; no mail sent`,
         );
@@ -219,7 +227,7 @@ export function createIssueContractConfirmationHandler(
       await stream.appendOne({ type: CONTRACT_CONFIRMATION_ISSUED_EVENT_QN, payload: issued });
 
       await ctx.notify(CONTRACT_CONFIRMATION_NOTIFICATION_TYPE, {
-        route: { email: recipient.data.email },
+        route: { email: recipientEmail },
         data: variables,
         locale,
         priority: "critical",

package/packages/bundled-features/src/billing-foundation/consumer-protection/mail-notifications.ts

@@ -4,7 +4,12 @@ import {
   type TemplateVariables,
   templateVariable,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { mailHeading, mailParagraph, mailRepeatedRows } from "../../shared/index.ts";
+import {
+  mailHeading,
+  mailParagraph,
+  mailParagraphWithLink,
+  mailRepeatedRows,
+} from "../../shared/index.ts";
 import { CONFIRMATION_LABELS } from "./confirmation-mail.ts";
 import { CONSENT_LOCALES, CONSENT_TEXTS, type ConsentLocale } from "./consent-text.ts";
 import { TERMINATION_TEXTS } from "./termination-texts.ts";
@@ -21,6 +26,7 @@ export const TERMINATION_RECEIPT_VARIABLES: TemplateVariables = {
   requestId: templateVariable.text({ required: true }),
   details: textRows(),
   operatorEmail: templateVariable.text({ required: true }),
+  revokeUrl: templateVariable.link(),
 };
 
 export const OPERATOR_NOTICE_VARIABLES: TemplateVariables = {
@@ -63,6 +69,10 @@ export function terminationReceiptTemplate(): NotificationLocalizedTemplate {
         mailRepeatedRows("details", "text"),
         mailParagraph(texts.receiptNextSteps),
         mailParagraph(texts.receiptRevoke(OPERATOR_EMAIL_SLOT)),
+        mailParagraphWithLink(texts.receiptNotMe, texts.receiptNotMeLink, "revokeUrl").replace(
+          "<p>",
+          '<p data-if="revokeUrl">',
+        ),
         mailParagraph(`${texts.contact} {operatorEmail}`),
       ].join(""),
     };

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-consent.ts

@@ -1,6 +1,5 @@
 import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.ts";
-import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants.ts";
 import {
   CHECKOUT_CONSENT_RECORDED_EVENT_SHORT,
   CONTRACT_CONFIRMATION_ISSUED_EVENT_SHORT,
@@ -12,6 +11,7 @@ import {
   SUBSCRIPTION_UPDATED_EVENT_QN,
 } from "../events.ts";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.ts";
+import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../web/constants.ts";
 import { createIssueContractConfirmationHandler } from "./issue-confirmation.ts";
 import { registerConsumerProtectionMails } from "./mail-notifications.ts";
 import { registerContractTermination } from "./register-termination.ts";

package/packages/bundled-features/src/billing-foundation/consumer-protection/register-termination.ts

@@ -1,15 +1,17 @@
 import type { FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
-import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../constants.ts";
 import {
   CONTRACT_TERMINATION_DECLARED_EVENT_QN,
   CONTRACT_TERMINATION_DECLARED_EVENT_SHORT,
   CONTRACT_TERMINATION_REQUESTED_EVENT_SHORT,
+  CONTRACT_TERMINATION_REVOKED_EVENT_SHORT,
   CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT,
   contractTerminationDeclaredPayloadSchema,
   contractTerminationRequestedPayloadSchema,
+  contractTerminationRevokedPayloadSchema,
   contractTerminationUnmatchedPayloadSchema,
 } from "../events.ts";
 import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from "../types.ts";
+import { SubscriptionCancelTimings, SubscriptionFoundationHandlers } from "../web/constants.ts";
 import {
   createDeclareContractTerminationHandler,
   createRecordContractTerminationHandler,
@@ -20,6 +22,10 @@ import {
   createRequestContractTerminationHandler,
   createTerminateContractHandler,
 } from "./termination-request.ts";
+import {
+  createRecordContractTerminationRevocationHandler,
+  createRevokeContractTerminationHandler,
+} from "./termination-revoke.ts";
 
 export function registerContractTermination(
   r: FeatureRegistrar,
@@ -36,6 +42,9 @@ export function registerContractTermination(
     contractTerminationDeclaredPayloadSchema,
     { piiFields: "none" },
   );
+  r.defineEvent(CONTRACT_TERMINATION_REVOKED_EVENT_SHORT, contractTerminationRevokedPayloadSchema, {
+    piiFields: "none",
+  });
   r.defineEvent(
     CONTRACT_TERMINATION_UNMATCHED_EVENT_SHORT,
     contractTerminationUnmatchedPayloadSchema,
@@ -47,6 +56,8 @@ export function registerContractTermination(
   r.writeHandler(createRecordUnmatchedContractTerminationHandler());
   r.writeHandler(createRequestContractTerminationHandler(options, consumerProtection));
   r.writeHandler(createTerminateContractHandler(options, consumerProtection));
+  r.writeHandler(createRevokeContractTerminationHandler());
+  r.writeHandler(createRecordContractTerminationRevocationHandler(options, consumerProtection));
 
   // The provider cancel of a public declaration runs here, not in the
   // request: matched and unmatched requests then do the same work and the

package/packages/bundled-features/src/billing-foundation/consumer-protection/stored-user-email.ts

@@ -0,0 +1,12 @@
+import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import { decryptStoredPii } from "../../shared/index.ts";
+
+// findForAuth returns the stored column, which is ciphertext under an active KMS;
+// channel-email refuses to mail a ciphertext address. Null for an erased subject.
+export async function openStoredUserEmail(
+  stored: string,
+  fallbackRequestId: string,
+): Promise<string | null> {
+  const email = await decryptStoredPii(stored, "email", fallbackRequestId);
+  return email === PII_ERASED_SENTINEL ? null : email;
+}

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-mail.ts

@@ -16,6 +16,8 @@ export type TerminationReceiptVariables = {
   readonly requestId: string;
   readonly details: readonly TextRow[];
   readonly operatorEmail: string;
+  /** Only a matched declaration carries the "this was not me" link. */
+  readonly revokeUrl?: string;
 };
 
 /** Variables of the operator notice template. */
@@ -92,9 +94,11 @@ export type TerminationReceiptArgs = {
   readonly receivedAtIso: string;
   readonly declaration: ReceiptDeclaration;
   readonly operatorEmail: string;
+  readonly revokeUrl?: string;
 };
 
-/** The content must not depend on whether (or how) the declaration matched a contract. */
+/** Apart from the revoke link, the content must not depend on whether the declaration
+ *  matched a contract; the link only goes to the address the declarant entered. */
 export function terminationReceiptVariables(
   args: TerminationReceiptArgs,
 ): TerminationReceiptVariables {
@@ -105,6 +109,7 @@ export function terminationReceiptVariables(
     requestId: args.requestId,
     details: declarationLines(args.declaration, args.locale),
     operatorEmail: args.operatorEmail,
+    ...(args.revokeUrl !== undefined && { revokeUrl: args.revokeUrl }),
   };
 }
 

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-notify.ts

@@ -1,8 +1,8 @@
 import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE } from "../constants.ts";
 import type { ProviderCancelOutcome } from "../events.ts";
 import type { ConsumerProtectionOptions } from "../types.ts";
+import { CONTRACT_TERMINATION_OPERATOR_NOTIFICATION_TYPE } from "../web/constants.ts";
 import type { ConsentLocale } from "./consent-text.ts";
 import { type OperatorNoticeDeclaration, operatorNoticeVariables } from "./termination-mail.ts";
 import type { OperatorNoticeReason } from "./termination-texts.ts";