@cosmicdrift/kumiko-samples 0.386.0 → 0.388.0

package/packages/bundled-features/src/user-profile/index.ts

@@ -1,6 +1,6 @@
-// Bewusst OHNE i18n-Export: das Server-Barrel muss von Server-Samples
-// ohne jsx-tsconfig kompilierbar bleiben (i18n zieht kumiko-renderer →
-// .tsx). Translations kommen via ./web (userProfileClient).
+// Deliberately no i18n export: the server barrel must remain compilable by server samples
+// without a JSX tsconfig (i18n pulls in kumiko-renderer → .tsx). Translations are provided
+// through ./web (userProfileClient).
 
 export { createUserProfileFeature, type UserProfileFeatureOptions } from "./feature.ts";
 export {

package/packages/bundled-features/src/user-profile/web/client-plugin.ts

@@ -25,7 +25,7 @@ export type UserProfileClientFeature = {
 };
 
 // Supplies the ChangeEmail/ChangePassword extension components for the
-// declarative `profile` projectionDetail screen (fw#2312, ../feature.ts,
+// declarative `profile` projectionDetail screen (../feature.ts,
 // registered there server-side) plus the default translations. Apps add it
 // via createKumikoApp({ clientFeatures: [userProfileClient()] }) and place
 // the screen (id "profile") via r.nav — the screen itself has no r.nav of

package/packages/bundled-features/src/user-profile/web/constants.ts

@@ -5,7 +5,7 @@ export const USER_PROFILE_FEATURE = "user-profile" as const;
 
 export const PROFILE_SCREEN_ID = "profile" as const;
 
-// EditExtensionSection `__component` markers (fw#2312) — change-password and
+// EditExtensionSection `__component` markers — change-password and
 // change-email stay React components (re-auth flows a declarative action
 // can't express); deletion moved to declarative fields/actions on the screen
 // itself (feature.ts), same split as user-data-rights' privacy-center.

package/packages/bundled-features/src/user-profile/web/profile-screen.tsx

@@ -1,5 +1,5 @@
 // Change-password and change-email sections for the declarative `profile`
-// projectionDetail screen (fw#2312, ../feature.ts). Both keep re-auth flows
+// projectionDetail screen (../feature.ts). Both keep re-auth flows
 // a declarative action can't express, so they stay React `EditExtensionSection`
 // components; account deletion moved to declarative fields/actions on the
 // screen itself — same split as user-data-rights' privacy-center

package/packages/bundled-features/src/waitlist/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Link-on-signup failures, legacy re-run and purge audit order",
+    "detail": "link-on-signup throws when the entry update fails and the entry is still invited, so the consumer redelivers. The offlot legacy migration skips rows that are already imports. purge writes its audit event before shredding keys."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Admin notice language comes from adminLocale",
+    "detail": "The admin notice mail used the request locale, which is the entrant's browser language. The new adminLocale option (en, de or es, default en) sets the operator's language."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Legacy migration dry run counts the streams it would archive",
+    "detail": "The dry run now runs the read-only archive checks and reports archivedStreams without writing; the CLI prints \"would archive\" for it."
+  },
   {
     "version": "0.379.0",
     "type": "improvement",

package/packages/bundled-features/src/waitlist/handlers/export-purge.write.ts

@@ -74,8 +74,9 @@ export const purgeHandler = defineWriteHandler<"purge", typeof PurgeSchema, Wait
         }),
       );
     }
-    await purgeWaitlistRows(db, rows, event.user.id);
+    // Audit first: purgeWaitlistRows shreds KMS keys, which a later failure cannot roll back.
     await appendAudit(ctx, WAITLIST_PURGED_EVENT_QN, rows.length);
+    await purgeWaitlistRows(db, rows, event.user.id);
     return { isSuccess: true, data: { purged: rows.length } };
   },
 });

package/packages/bundled-features/src/waitlist/handlers/submit.write.ts

@@ -73,9 +73,10 @@ async function hasOpenEntryForEmail(email: string, ctx: HandlerContext): Promise
   return found.rows.length > 0;
 }
 
-// The resolver usually reads config; run it outside the handler transaction's
-// critical section so a failing statement cannot abort the transaction that holds
-// the entry, and a slow resolver does not extend the per-email advisory lock.
+// The resolver usually reads config. It runs before the per-email advisory lock so a
+// slow resolver does not extend the lock. It still shares the handler transaction: a
+// thrown JS error is swallowed here, but a failed SQL statement inside it would abort
+// the transaction, so resolvers must not issue statements that can fail.
 async function resolveAdminRecipient(
   opts: WaitlistOptions,
   ctx: HandlerContext,
@@ -175,8 +176,7 @@ export function createSubmitHandler(opts: WaitlistOptions) {
             message: payload.message,
           }),
           priority: "normal",
-          // Operator-facing: the request locale, not the one the entrant picked in the form.
-          locale: resolveWaitlistMailLocale(ctx.locale),
+          locale: resolveWaitlistMailLocale(opts.adminLocale),
         });
       });
 

package/packages/bundled-features/src/waitlist/import.ts

@@ -38,6 +38,11 @@ export function waitlistImportId(sourceKey: string): string {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 
+// The version nibble marks ids minted by waitlistImportId; legacy row ids are random UUIDs.
+export function isWaitlistImportId(id: string): boolean {
+  return id[14] === "5";
+}
+
 function presentOnly(fields: Record<string, unknown>): Record<string, unknown> {
   return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
 }

package/packages/bundled-features/src/waitlist/legacy-migrate.ts

@@ -9,6 +9,7 @@ import {
   createTenantDb,
   selectMany,
   table,
+  tableExists,
   text as textColumn,
   timestamp,
   transaction,
@@ -23,9 +24,16 @@ import {
 } from "@cosmicdrift/kumiko-framework/event-store";
 import type { DbConnection } from "@cosmicdrift/kumiko-types/db-connection";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { importWaitlistEntry, type WaitlistImportEntry, waitlistImportId } from "./import.ts";
+import {
+  importWaitlistEntry,
+  isWaitlistImportId,
+  type WaitlistImportEntry,
+  waitlistImportId,
+} from "./import.ts";
 import { WAITLIST_STATUS, type WaitlistStatus } from "./web/constants.ts";
 
+const ARCHIVED_STREAMS_TABLE = "public.kumiko_archived_streams";
+
 export const LEGACY_WAITLIST_SOURCES = ["offlot", "publicstatus"] as const;
 export type LegacyWaitlistSource = (typeof LEGACY_WAITLIST_SOURCES)[number];
 
@@ -210,15 +218,19 @@ async function archiveLegacyStream(
   db: DbConnection,
   legacyId: string,
   importedId: string,
+  dryRun: boolean,
 ): Promise<number> {
   if (legacyId === importedId) return 0;
-  if (await isStreamArchived(db, SYSTEM_TENANT_ID, legacyId)) return 0;
+  // A dry run never creates the archive table, so a missing one means nothing is archived yet.
+  const archiveTableReady = !dryRun || (await tableExists(db, ARCHIVED_STREAMS_TABLE));
+  if (archiveTableReady && (await isStreamArchived(db, SYSTEM_TENANT_ID, legacyId))) return 0;
   const legacyEvents = await countWhere(db, eventsTable, {
     tenantId: SYSTEM_TENANT_ID,
     aggregateId: legacyId,
     aggregateType: LEGACY_AGGREGATE_TYPE,
   });
   if (legacyEvents === 0) return 0;
+  if (dryRun) return 1;
   await archiveStream(db, {
     tenantId: SYSTEM_TENANT_ID,
     aggregateId: legacyId,
@@ -243,6 +255,12 @@ export async function migrateLegacyWaitlist(
   let archivedStreams = 0;
   if (!options.dryRun && options.from === "offlot") await createArchivedStreamsTable(db);
   for (const row of rows) {
+    // The offlot default source is the entity table: rows a previous run imported
+    // are already migrated entries and must neither be re-imported nor archived.
+    if (options.from === "offlot" && isWaitlistImportId(String(row["id"]))) {
+      skipped += 1;
+      continue;
+    }
     const entry =
       options.from === "offlot"
         ? await mapOfflotRow(row)
@@ -257,11 +275,12 @@ export async function migrateLegacyWaitlist(
       if (outcome === "created") created += 1;
       else skipped += 1;
     });
-    if (!options.dryRun && options.from === "offlot") {
+    if (options.from === "offlot") {
       archivedStreams += await archiveLegacyStream(
         db,
         String(row["id"]),
         waitlistImportId(entry.sourceKey),
+        options.dryRun,
       );
     }
   }

package/packages/bundled-features/src/waitlist/link-on-signup.ts

@@ -75,22 +75,25 @@ export const linkWaitlistOnSignup: MultiStreamApplyFn = async (event, tx) => {
   if (typeof user?.email !== "string") return;
   const email = normalizeEmail(await decryptStoredPii(user.email, "email", PII_DECRYPT_REASON));
 
-  const found = await waitlistExecutor.list(
-    {
-      filter: { field: "email", op: "eq", value: email },
-      filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
-    },
-    platformActor(),
-    db,
-  );
-  const invited = [...found.rows].sort(newestSubmittedFirst)[0];
+  const findInvited = async () => {
+    const found = await waitlistExecutor.list(
+      {
+        filter: { field: "email", op: "eq", value: email },
+        filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
+      },
+      platformActor(),
+      db,
+    );
+    return [...found.rows].sort(newestSubmittedFirst)[0];
+  };
+  const invited = await findInvited();
   // skip: the signup email has no invited waitlist entry (open signup or stale invite).
   if (!invited) return;
   const { id, version } = invited;
   // skip: defensive guard on the row shape.
   if (typeof id !== "string" || typeof version !== "number") return;
 
-  await waitlistExecutor.update(
+  const updated = await waitlistExecutor.update(
     {
       id,
       version,
@@ -103,4 +106,11 @@ export const linkWaitlistOnSignup: MultiStreamApplyFn = async (event, tx) => {
     platformActor(),
     db,
   );
+  // skip: linked.
+  if (updated.isSuccess) return;
+  // A concurrent admin change that already moved the entry out of `invited` makes the link
+  // moot; otherwise throw so the at-least-once consumer redelivers.
+  // skip: the entry left `invited` concurrently.
+  if ((await findInvited())?.id !== id) return;
+  throw new Error(`waitlist:link-on-signup: could not link waitlist entry ${id}`);
 };

package/packages/bundled-features/src/waitlist/options.ts

@@ -24,6 +24,9 @@ export type WaitlistOptions = {
    *  string or an absent option sends none. Best effort, never fails the submit,
    *  also when the resolver throws or rejects. */
   readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
+  /** Language of the admin notice mail (en, de or es; anything else falls back to en).
+   *  Not taken from the request: a submit comes from the entrant, not the operator. */
+  readonly adminLocale?: string;
   /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
   readonly invite?: WaitlistInviteOptions;
   /** Default: 5 submits per IP per 10 minutes. Pass `{ disabled: true, reason }`

package/packages/bundled-features/src/workflow-runner/aggregate-id.ts

@@ -12,7 +12,7 @@ const WORKFLOW_RUN_NAMESPACE = "1f8a6c3e-7d2b-4a91-9e3f-5c8b2a41d6f0";
  * race on `expectedVersion` and have the loser fail the unique constraint
  * instead of silently double-running. It does NOT dedup sequential
  * re-triggers of the same key — those land as version 2, 3, ... on the same
- * stream and each starts its own run; that's out of scope for #2478.
+ * stream and each starts its own run; that's out of scope.
  */
 // @wrapper-known uuid-domain
 export function workflowRunAggregateId(workflowName: string, key: string): string {

package/packages/bundled-features/src/workflow-runner/event-subscriber.ts

@@ -1,6 +1,5 @@
 // event-subscriber — wakes up pending waitForEvent suspensions when their
-// awaited domain event arrives (framework#2513 Phase 3b, D4 in
-// workflow-resume-loop.md).
+// awaited domain event arrives (in workflow-resume-loop.md).
 //
 // registerEventTrigger (event-trigger.ts) calls registerEventWakeup for
 // every workflow it registers, building ONE MultiStreamProjection PER
@@ -17,12 +16,12 @@
 // already in hand, has no such hazard — same reasoning event-trigger.ts
 // already applies to the run-start MSP.
 //
-// This subscriber never resumes a run itself (D3, workflow-resume-loop.md):
+// This subscriber never resumes a run itself (in workflow-resume-loop.md):
 // the MultiStreamApplyContext it runs in has no callFeature/runStepList
 // access, only unsafeAppendEvent/loadAggregate. It writes triggerEventType
 // + triggerEventRef + wakeAt=now() onto the matching pending row(s); the
-// existing resume-due-runs job (Phase 2) picks the row up on its next
-// cron tick — the one resume path stays exactly the one Phase 2 built.
+// existing resume-due-runs job picks the row up on its next
+// cron tick — the resume path remains unchanged.
 
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/db";
 import type {

package/packages/bundled-features/src/workflow-runner/event-trigger.ts

@@ -26,6 +26,7 @@ import {
   WORKFLOW_AGGREGATE_TYPE,
   WORKFLOW_RUN_FAILED_TYPE,
   WorkflowStepError,
+  walkStepInstances,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { workflowRunAggregateId } from "./aggregate-id.ts";
@@ -51,18 +52,6 @@ const STEP_KINDS_NEEDING_HANDLER_CONTEXT: ReadonlySet<string> = new Set([
   "unsafeProjectionDelete",
 ]);
 
-function* walkStepInstances(steps: readonly StepInstance[]): Generator<StepInstance, void, void> {
-  for (const step of steps) {
-    yield step;
-    const { args } = step;
-    if (typeof args !== "object" || args === null) continue;
-    for (const path of getStep(step.kind)?.subPaths ?? []) {
-      const nested: unknown = path in args ? Reflect.get(args, path) : undefined;
-      if (Array.isArray(nested)) yield* walkStepInstances(nested);
-    }
-  }
-}
-
 export function assertEventTriggerStepsSupported(workflow: WorkflowDefinition): void {
   let steps: readonly StepInstance[];
   try {
@@ -80,7 +69,7 @@ export function assertEventTriggerStepsSupported(workflow: WorkflowDefinition):
       { cause: error },
     );
   }
-  for (const step of walkStepInstances(steps)) {
+  for (const step of walkStepInstances(steps, `workflow "${workflow.name}" eventTrigger`)) {
     if (getStep(step.kind) === undefined) {
       throw new Error(`Workflow "${workflow.name}" uses unknown step kind "${step.kind}"`);
     }
@@ -95,13 +84,13 @@ export function assertEventTriggerStepsSupported(workflow: WorkflowDefinition):
 
 export function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefinition): void {
   // Populate the workflow-registry unconditionally, before the event-trigger
-  // guard below — resume-run (framework#2513 Phase 2) looks workflows up by
+  // guard below — resume-run looks workflows up by
   // name regardless of trigger kind, and a cron-triggered workflow that never
   // reaches the MSP branch still needs to be resumable.
   registerWorkflow(workflow);
 
   // Independent of trigger.kind — a cron-triggered workflow can still have
-  // waitForEvent steps in its pipeline (framework#2513 Phase 3b, D4).
+  // waitForEvent steps in its pipeline.
   registerEventWakeup(r, workflow);
 
   // skip: cron-triggered workflows have no domain event to project off — they

package/packages/bundled-features/src/workflow-runner/feature.ts

@@ -9,8 +9,8 @@
 // `workflowRunnerFeature` documents that dependency and reserves the
 // picker/manifest slot.
 //
-// It also registers the resume loop (framework#2513 Phase 2 + 3b):
-//   - the workflow_run_pending MSP (Phase 1) materialises suspended
+// It also registers the resume loop:
+//   - the workflow_run_pending MSP materialises suspended
 //     wait/waitForEvent/retry steps into a pending-set table
 //   - the `resume-due-runs` cron job (perTenant) scans that table for
 //     `wakeAt < now()` rows and dispatches `resume-run` per row — the job

package/packages/bundled-features/src/workflow-runner/handlers/resume-run.write.ts

@@ -1,10 +1,10 @@
 // resume-run — wakes one suspended workflow step. Dispatched by the
-// resume-due-runs job (framework#2513 Phase 2), never called directly by a
+// resume-due-runs job, never called directly by a
 // user — r.systemScope() + access: { roles: [SYSTEM_ROLE] } enforce that.
 //
 // The job does nothing but SELECT + dispatch; all resume logic lives here,
 // adapted from samples/recipes/workflow-engine/src/resume-loop.ts:
-//   1. Q7 fingerprint check FIRST — before claiming, before any pipeline
+//   1. Fingerprint check FIRST — before claiming, before any pipeline
 //      work. A changed workflow definition fails loud (WORKFLOW_RUN_FAILED,
 //      reason "workflow_definition_changed"), never a silent skip.
 //   2. Claim via a savepoint-scoped WORKFLOW_RESUMED append (ctx.tryAppendEvent,
@@ -23,8 +23,8 @@
 // shows up here in its shredded form, and an unloadable one (archived
 // stream) fails the run. The pending row's own
 // triggerEventType/triggerEventRef columns are a DIFFERENT thing: for a
-// waitForEvent suspension they point at the AWAITED event the Phase 3b
-// event-subscriber matched (NULL until then, and NULL forever on a
+// waitForEvent suspension they point at the AWAITED event the event-subscriber
+// matched (NULL until then, and NULL forever on a
 // timeout-without-a-match). That event's payload becomes the resumed
 // pipeline's result for the skipped waitForEvent step itself (see
 // resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so

package/packages/bundled-features/src/workflow-runner/pending-projection.ts

@@ -4,13 +4,12 @@
 // Insert (upsert, for idempotent at-least-once redelivery) on every
 // suspension: wait, waitForEvent, retry. Delete on WORKFLOW_RESUMED or a
 // terminal run outcome (completed/failed) — a run only ever has one row
-// pending at a time (D1: a later suspension always targets a fresh
-// stepIndex, since the prior one was resumed away first), so deleting by
+// pending at a time (a later suspension always targets a fresh stepIndex,
+// since the prior one was resumed away first), so deleting by
 // (tenantId, runId) alone is exact.
 //
-// No resume logic here — framework#2513 Phase 2 owns the job that reads
-// this table and dispatches the actual resume. This projection only writes
-// the rows.
+// No resume logic here — the job that reads this table and dispatches the
+// actual resume is separate. This projection only writes the rows.
 
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/db";
@@ -81,8 +80,8 @@ async function upsertPending(tx: DbRunner, row: PendingRow): Promise<void> {
     workflowRunPendingTable,
     {
       ...row,
-      // Phase 3's event-subscriber writes these when the awaited event
-      // arrives — Phase 1 never touches them, insert or update.
+      // The event-subscriber writes these when the awaited event
+      // arrives — they are never touched here, on insert or update.
       triggerEventType: null,
       triggerEventRef: null,
       triggerPayload: null,

package/packages/bundled-features/src/workflow-runner/runner.ts

@@ -2,12 +2,12 @@
 // pipeline until first suspension or completion, and writing run-completed.
 //
 // wait / retry / waitForEvent suspensions are all resumable — the
-// resume-due-runs job + resume-run handler (framework#2513 Phase 2) wake
-// wait/retry via a plain wakeAt timeout; waitForEvent additionally gets
-// woken early by the event-subscriber (Phase 3b, event-subscriber.ts) when
-// its awaited event arrives, and by the same wakeAt timeout otherwise
-// (D1's `wakeAt ?? timeoutAt`). startAndRunWorkflow returns a silent
-// "suspended" outcome for all three instead of throwing.
+// resume-due-runs job + resume-run handler wake wait/retry via a plain
+// wakeAt timeout; waitForEvent additionally gets woken early by the
+// event-subscriber (event-subscriber.ts) when its awaited event arrives,
+// and by the same wakeAt timeout otherwise (D1's `wakeAt ?? timeoutAt`).
+// startAndRunWorkflow returns a silent "suspended" outcome for all three
+// instead of throwing.
 
 import type {
   HandlerContext,

package/packages/bundled-features/src/workflow-runner/tables.ts

@@ -12,12 +12,12 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 
 // workflow_run_pending — one row per currently-suspended workflow step.
-// Read-side of the resume loop (framework#2513 Phase 1): the wait /
+// Read-side of the resume loop: the wait /
 // waitForEvent / retry steps already write their suspension onto the
 // workflow-run event stream, but scanning kumiko_events for due runs
 // doesn't scale (see samples/recipes/workflow-engine/postgres-resume-loop.ts,
 // which does exactly that). This table is kept in sync by
-// pending-projection.ts's MultiStreamProjection so Phase 2's resume job can
+// pending-projection.ts's MultiStreamProjection so the resume job can
 // do an indexed `wakeAt < now()` scan instead.
 //
 // **Unmanaged table** — same reasoning as delivery/tables.ts'
@@ -31,7 +31,7 @@ import {
 // key only, see aggregate-id.ts), so two tenants triggering the same
 // workflow with the same idempotencyKey get the SAME run_id. Without
 // tenant_id in the key, a same-stepIndex suspension from tenant B would
-// upsert onto tenant A's row and silently steal it (framework#2513).
+// upsert onto tenant A's row and silently steal it.
 export const workflowRunPendingTable = pgTable(
   "workflow_run_pending",
   {
@@ -45,14 +45,14 @@ export const workflowRunPendingTable = pgTable(
     // which step suspended.
     wakeAt: instant("wake_at").notNull(),
     retryAttempt: integer("retry_attempt"),
-    // Q7 snapshot fingerprint — Phase 2 compares this against the current
+    // Snapshot fingerprint — compares this against the current
     // workflow definition's fingerprint before resuming.
     definitionFingerprint: text("definition_fingerprint"),
     // Set only for waitForEvent suspensions; NULL for wait/retry.
     waitEventType: text("wait_event_type"),
     matchExpr: jsonb("match_expr"),
-    // Written by the Phase 3 event-subscriber when the awaited event
-    // arrives — always NULL in Phase 1/2. The row points at the awaited event
+    // Written by the event subscriber when the awaited event
+    // arrives — always NULL initially. The row points at the awaited event
     // ({ eventId, aggregateId, version }); resume-run re-reads it from the
     // event store, so erasing the event also covers the workflow.
     triggerEventType: text("trigger_event_type"),

package/packages/bundled-features/src/workflow-runner/workflow-registry.ts

@@ -1,6 +1,6 @@
 // workflow-registry — process-local lookup from workflow name to its
 // WorkflowDefinition. registerEventTrigger populates it at feature-
-// registration time; resume-run (Phase 2) is the only reader — it has
+// registration time; resume-run is the only reader — it has
 // nothing but a workflow name on the pending row and needs the live
 // definition to rebuild the pipeline + recompute the Q7 fingerprint.
 //

package/samples/apps/styleguide/src/features/widgets/i18n.ts

@@ -119,6 +119,17 @@ export const WIDGETS_I18N = {
   "widgets:catalog:status-maintenance": { de: "maintenance", en: "maintenance" },
   "widgets:catalog:repayment-model": { de: "Tilgungsmodell", en: "Repayment model" },
   "widgets:catalog:mode-annuity": { de: "Annuität", en: "Annuity" },
+  "widgets:catalog:choice-cards": { de: "Zahlungsanbieter", en: "Payment provider" },
+  "widgets:catalog:choice-direct": { de: "Direkt", en: "Direct" },
+  "widgets:catalog:choice-direct-description": {
+    de: "Rechnung vom Anbieter der App",
+    en: "Invoiced by the app operator",
+  },
+  "widgets:catalog:choice-reseller": { de: "Reseller", en: "Reseller" },
+  "widgets:catalog:choice-reseller-description": {
+    de: "Verkäufer ist der Reseller, inklusive Umsatzsteuer",
+    en: "Sold by the reseller, VAT included",
+  },
   "widgets:catalog:mode-fixed": { de: "Feste Rate", en: "Fixed rate" },
   "widgets:catalog:model": { de: "Modell", en: "Model" },
   "widgets:catalog:nominal-rate": { de: "Sollzins", en: "Nominal rate" },

package/samples/apps/styleguide/src/features/widgets/web/Widgets.tsx

@@ -6,6 +6,7 @@ import {
   AiTextArea,
   AiTextField,
   BooleanField,
+  ChoiceCards,
   CollapsibleSection,
   ComparisonTable,
   DateField,
@@ -50,6 +51,7 @@ export function Widgets(): ReactNode {
   const t = useTranslation();
   const locale = useLocale().locale();
   const [mode, setMode] = useState<"annuity" | "fixed">("annuity");
+  const [provider, setProvider] = useState<"direct" | "reseller">("direct");
   const [drawerOpen, setDrawerOpen] = useState(false);
   const [belowHeaderDrawerOpen, setBelowHeaderDrawerOpen] = useState(false);
   const [floatingPanelOpen, setFloatingPanelOpen] = useState(false);
@@ -181,6 +183,28 @@ export function Widgets(): ReactNode {
         />
       </SectionCard>
 
+      <SectionCard title={t("widgets:catalog:choice-cards")}>
+        <ChoiceCards
+          value={provider}
+          onChange={setProvider}
+          ariaLabel={t("widgets:catalog:choice-cards")}
+          options={[
+            {
+              value: "direct",
+              title: t("widgets:catalog:choice-direct"),
+              description: t("widgets:catalog:choice-direct-description"),
+              aside: "9,00 €",
+            },
+            {
+              value: "reseller",
+              title: t("widgets:catalog:choice-reseller"),
+              description: t("widgets:catalog:choice-reseller-description"),
+              aside: "9,90 €",
+            },
+          ]}
+        />
+      </SectionCard>
+
       <CollapsibleSection title={t("widgets:catalog:advanced-settings")}>
         <EmptyState
           title={t("widgets:catalog:no-extra-repayments-title")}

package/samples/apps/use-all-bundled/e2e-billing-gallery/gallery-constants.ts

@@ -4,6 +4,7 @@
 // runs in a Playwright worker and must not pull the server import chain).
 
 export const GALLERY_PROVIDER = "gallery-mock-provider";
+export const GALLERY_MOR_PROVIDER = "gallery-mock-mor";
 export const GALLERY_TERMS_SLUG = "gallery-terms";
 export const GALLERY_OPERATOR_EMAIL = "billing@gallery.example";
 export const GALLERY_PLAN_PATH = "/tenant-admin/billing-plans";
@@ -14,3 +15,7 @@ export const GALLERY_TENANT_HOST = "localhost";
 export const GALLERY_APEX_HOST = "127.0.0.1";
 
 export const GALLERY_PRICE_IDS = { starter: "price_gallery_starter", pro: "price_gallery_pro" };
+export const GALLERY_MOR_PRICE_IDS = {
+  starter: "price_gallery_mor_starter",
+  pro: "price_gallery_mor_pro",
+};