@cosmicdrift/kumiko-samples 0.387.0 → 0.389.0

package/packages/bundled-features/src/auth-mfa/web/mfa-setup-preauth-screen.tsx

@@ -79,6 +79,7 @@ export function MfaSetupPreauthScreen({
   const [setup, setSetup] = useState<SetupState | null>(null);
   const [acknowledged, setAcknowledged] = useState(false);
   const [code, setCode] = useState("");
+  const [attempt, setAttempt] = useState(0);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [retryAfterSeconds, setRetryAfterSeconds] = useState<number | null>(null);
@@ -109,13 +110,13 @@ export function MfaSetupPreauthScreen({
     }
   };
 
-  const confirmSetup = async (): Promise<void> => {
-    if (!setup) return;
+  const confirmSetup = async (submittedCode: string): Promise<void> => {
+    if (!setup || busy) return;
     setBusy(true);
     setError(null);
     setRetryAfterSeconds(null);
     try {
-      const res = await confirmMfaSetupPreauth(setup.setupToken, code);
+      const res = await confirmMfaSetupPreauth(setup.setupToken, submittedCode);
       if (res.kind !== "success") {
         setError(res.error.reason);
         setRetryAfterSeconds(res.error.retryAfterSeconds ?? null);
@@ -130,7 +131,11 @@ export function MfaSetupPreauthScreen({
           setSetup(null);
           setAcknowledged(false);
           setCode("");
+          return;
         }
+        // Remount: the field was disabled during confirm and lost focus.
+        setCode("");
+        setAttempt((n) => n + 1);
         return;
       }
       onSuccess?.(res.data.landingPath);
@@ -143,7 +148,7 @@ export function MfaSetupPreauthScreen({
 
   const onSubmit = (e?: FormEvent): void => {
     e?.preventDefault();
-    void confirmSetup();
+    void confirmSetup(code);
   };
 
   return (
@@ -226,13 +231,17 @@ export function MfaSetupPreauthScreen({
 
             <Field id="mfa-setup-preauth-code" label={t("auth.mfa.enable.code")} required>
               <Input
-                kind="text"
+                key={attempt}
+                kind="code"
+                length={6}
                 id="mfa-setup-preauth-code"
                 name="mfa-setup-preauth-code"
                 value={code}
                 onChange={setCode}
+                onComplete={(next) => void confirmSetup(next)}
                 disabled={busy || !acknowledged}
-                autoComplete="one-time-code"
+                hasError={error !== null}
+                autoFocus={attempt > 0}
               />
             </Field>
 

package/packages/bundled-features/src/auth-mfa/web/mfa-verify-screen.tsx

@@ -27,6 +27,10 @@ export type MfaVerifyScreenProps = {
   readonly onCancel?: () => void;
 };
 
+type CodeEntryMode = "authenticator" | "recovery";
+
+const MFA_CODE_LENGTH = 6;
+
 function reasonToKey(reason: string): string {
   switch (reason) {
     case "invalid_totp_code":
@@ -56,14 +60,17 @@ export function MfaVerifyScreen({
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner } = usePrimitives();
   const session = useSession();
+  const [mode, setMode] = useState<CodeEntryMode>("authenticator");
   const [code, setCode] = useState("");
+  const [attempt, setAttempt] = useState(0);
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
-  const doSubmit = async (): Promise<void> => {
+  const doSubmit = async (submittedCode: string): Promise<void> => {
+    if (submitting) return;
     setSubmitting(true);
     setError(null);
-    const res = await verifyMfaChallenge(challengeToken, code);
+    const res = await verifyMfaChallenge(challengeToken, submittedCode);
     if (res.kind === "success") {
       await session.refresh();
       setSubmitting(false);
@@ -72,30 +79,65 @@ export function MfaVerifyScreen({
     }
     setSubmitting(false);
     setError(res.error.reason);
+    // Remount: the input was disabled during submit and lost focus.
+    setAttempt((n) => n + 1);
+    if (mode === "authenticator") setCode("");
   };
 
   const onSubmit = (e?: FormEvent): void => {
     e?.preventDefault();
-    void doSubmit();
+    void doSubmit(code);
   };
 
+  const toggleMode = (): void => {
+    setMode(mode === "authenticator" ? "recovery" : "authenticator");
+    setCode("");
+    setError(null);
+  };
+
+  const isRecovery = mode === "recovery";
+  const fieldId = isRecovery ? "mfa-verify-recovery-code" : "mfa-verify-code";
+  const defaultSubtitle = isRecovery
+    ? t("auth.mfa.verify.recoverySubtitle")
+    : t("auth.mfa.verify.subtitle");
+
   return (
-    <AuthCard
-      title={title ?? t("auth.mfa.verify.title")}
-      subtitle={subtitle ?? t("auth.mfa.verify.subtitle")}
-    >
+    <AuthCard title={title ?? t("auth.mfa.verify.title")} subtitle={subtitle ?? defaultSubtitle}>
       <Form onSubmit={onSubmit}>
-        <Field id="mfa-verify-code" label={t("auth.mfa.verify.code")} required>
-          <Input
-            kind="text"
-            id="mfa-verify-code"
-            name="mfa-verify-code"
-            value={code}
-            onChange={setCode}
-            disabled={submitting}
-            required
-            autoComplete="one-time-code"
-          />
+        <Field
+          id={fieldId}
+          label={isRecovery ? t("auth.mfa.verify.recoveryCode") : t("auth.mfa.verify.code")}
+          required
+        >
+          {isRecovery ? (
+            <Input
+              key={`${mode}-${attempt}`}
+              kind="text"
+              id={fieldId}
+              name={fieldId}
+              value={code}
+              onChange={setCode}
+              disabled={submitting}
+              required
+              autoFocus
+              autoComplete="off"
+            />
+          ) : (
+            <Input
+              key={`${mode}-${attempt}`}
+              kind="code"
+              length={MFA_CODE_LENGTH}
+              id={fieldId}
+              name={fieldId}
+              value={code}
+              onChange={setCode}
+              onComplete={(next) => void doSubmit(next)}
+              disabled={submitting}
+              hasError={error !== null}
+              required
+              autoFocus
+            />
+          )}
         </Field>
         {error !== null ? <Banner variant="error">{t(reasonToKey(error))}</Banner> : null}
         <Button type="submit" loading={submitting} disabled={submitting}>
@@ -103,6 +145,11 @@ export function MfaVerifyScreen({
             ? t("auth.mfa.verify.submitting")
             : (submitLabel ?? t("auth.mfa.verify.submit"))}
         </Button>
+        <Button type="button" variant="link" onClick={toggleMode} disabled={submitting}>
+          {isRecovery
+            ? t("auth.mfa.verify.useAuthenticatorCode")
+            : t("auth.mfa.verify.useRecoveryCode")}
+        </Button>
         {onCancel ? (
           <Button type="button" variant="secondary" onClick={onCancel} disabled={submitting}>
             {t("auth.mfa.verify.backToLogin")}

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,59 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Concurrent termination runs, revocation resume and sync ordering",
+    "detail": "record-contract-termination re-checks the requestId after the provider call so a concurrent run appends nothing. Revocation resumes a period-end cancel that was recorded between its two stream reads. sync-subscription stamps the snapshot time as providerEventAtIso so a late older webhook cannot reactivate a synced cancellation."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Ordered terms lists keep their numbers in the confirmation mail",
+    "detail": "The contract confirmation mail prefixes each item of an ordered Markdown list with its number, so references such as \"see no. 3\" in terms and cancellation policies stay intact."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Operator notice tells an unavailable receipt limiter from a reached limit",
+    "detail": "When the termination receipt mail is withheld because the rate limiter failed or has no digest key, the operator notice reports \"receipt_not_sent\" instead of the per-recipient limit reason."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "An abandoned plan-change checkout no longer restarts the withdrawal period",
+    "detail": "The withdrawal period now runs from the latest subscription start only; a checkout consent without a following subscription start does not reopen it, so a later withdrawal of an old contract is cancelled at period end."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Same-second provider update cannot revive a canceled subscription",
+    "detail": "When a non-terminal state event carries the same provider timestamp as a stored cancellation, it is treated as late and discarded."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Several subscription providers in one catalog",
+    "detail": "The billing-plans query returns providers (name, displayName, plans, note) when more than one provider is offered, and start-plan-checkout takes providerName. consumerProtection.providerTexts overrides checkoutNote and vatNote per provider, and the consent record carries providerName. switch-plan always uses the provider of the existing subscription."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "In-app plan switch with a preview and consent",
+    "detail": "A provider plugin that implements previewPlanSwitch and applyPlanSwitch switches plans without a hosted portal. The new plan-switch-preview query returns the proration, the billing-plans result carries inAppPlanSwitch, and the panel shows PlanSwitchConfirmDialog with the withdrawal consent checkboxes. The confirmation mail is sent when the plan_changed webhook arrives with the consent id."
+  },
+  {
+    "version": "0.388.0",
+    "type": "breaking",
+    "title": "A catalog with several providers no longer throws an ambiguous-provider error",
+    "detail": "With more than one subscription provider mounted, billing-plans and start-plan-checkout used to throw. They now list the providers; start-plan-checkout answers with errors.providerRequired when several are offered and no providerName is given, and errors.providerNotOffered for an unknown one. Plugins have to set displayName.",
+    "migration": "Set displayName on custom subscriptionProvider plugins. Callers that send start-plan-checkout with several providers mounted must pass providerName."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Provider choice moved into the checkout dialog",
+    "detail": "The plan panel no longer shows a provider switch. Cards show the first provider's price, or the cheapest one with a \"from\" prefix when providers disagree. With several providers, or with consumerProtection, choosing a plan opens CheckoutConsentDialog, which now has an optional providerChoice (ChoiceCards with the checkout note and, when prices differ, the price), an optional note, and an optional consumerProtection (without it there are no checkboxes and the order carries no consent). The plan switch dialog shows the recurring price with its interval."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/packages/bundled-features/src/billing-foundation/checkout-core.ts

@@ -36,17 +36,22 @@ export type ResolvedProvider = {
   readonly plugin: SubscriptionProviderPlugin;
 };
 
+/** Every registered provider plugin, in registration order. */
+function listProviderPlugins(ctx: HandlerContext): readonly ResolvedProvider[] {
+  return ctx.registry.getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION).map((usage) => ({
+    name: usage.entityName,
+    // @cast-boundary engine-payload — extension-usage carries unknown options
+    plugin: usage.options as SubscriptionProviderPlugin,
+  }));
+}
+
 /** Non-throwing provider lookup by name — null when no plugin with that
  *  entityName is registered. */
 export function findProviderPlugin(
   ctx: HandlerContext,
   providerName: string,
 ): ResolvedProvider | null {
-  const usage = ctx.registry
-    .getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION)
-    .find((u) => u.entityName === providerName);
-  // @cast-boundary engine-payload — extension-usage carries unknown options
-  return usage ? { name: providerName, plugin: usage.options as SubscriptionProviderPlugin } : null;
+  return listProviderPlugins(ctx).find((provider) => provider.name === providerName) ?? null;
 }
 
 export function resolveProviderPlugin(ctx: HandlerContext, providerName: string): ResolvedProvider {
@@ -64,17 +69,15 @@ export function resolveProviderPlugin(ctx: HandlerContext, providerName: string)
   return found;
 }
 
-/** Picks the catalog's provider — an explicit `catalog.providerName`, or the
- *  single registered provider exposing `priceToTier` when there is exactly
- *  one. Returns null when `providerName` is unset and no registered plugin
- *  exposes `priceToTier` — a state `billing-plans` renders as
- *  `enabled: false` instead of erroring. An explicit `providerName` that is
- *  not registered, or more than one candidate, is a config bug and throws
- *  `UnconfiguredError`. */
-export function findCatalogProvider(
+/** The providers a catalog sells through, in registration order: an explicit
+ *  `catalog.providerName` (only that one), otherwise every registered provider
+ *  exposing `priceToTier`. Empty when none qualifies, a state `billing-plans`
+ *  renders as `enabled: false` instead of erroring. An explicit `providerName`
+ *  that is not registered is a config bug and throws `UnconfiguredError`. */
+export function listCatalogProviders(
   ctx: HandlerContext,
   catalog: BillingPlanCatalog,
-): ResolvedProvider | null {
+): readonly ResolvedProvider[] {
   if (catalog.providerName) {
     const found = findProviderPlugin(ctx, catalog.providerName);
     if (!found) {
@@ -84,40 +87,27 @@ export function findCatalogProvider(
         hint: `provider "${catalog.providerName}" not registered`,
       });
     }
-    return found;
+    return [found];
   }
-  const usages = ctx.registry.getExtensionUsages(SUBSCRIPTION_PROVIDER_EXTENSION);
-  const withPriceCatalog = usages.filter(
-    (u) => (u.options as SubscriptionProviderPlugin).priceToTier !== undefined,
+  return listProviderPlugins(ctx).filter(({ plugin }) => plugin.priceToTier !== undefined);
+}
+
+export async function filterOfferedProviders(
+  ctx: HandlerContext,
+  providers: readonly ResolvedProvider[],
+): Promise<readonly ResolvedProvider[]> {
+  const enabledFlags = await Promise.all(
+    providers.map(({ plugin }) => isPluginBillingEnabled(ctx, plugin)),
   );
-  if (withPriceCatalog.length > 1) {
-    throw new UnconfiguredError({
-      feature: "billing-foundation",
-      key: "catalog.providerName",
-      hint: `ambiguous — ${withPriceCatalog.length} registered plugins expose priceToTier, set catalog.providerName explicitly`,
-    });
-  }
-  const usage = withPriceCatalog[0];
-  if (!usage) return null;
-  // @cast-boundary engine-payload — extension-usage carries unknown options
-  return { name: usage.entityName, plugin: usage.options as SubscriptionProviderPlugin };
+  return providers.filter((_, index) => enabledFlags[index]);
 }
 
-/** `findCatalogProvider` for callers that require a provider to proceed —
- *  start-plan-checkout and switch-plan. `FeatureDisabledError` (not
- *  `UnconfiguredError`) when none is found: an unconfigured provider is
- *  the same "billing isn't live yet" state as `isPluginBillingEnabled`
- *  returning false, and the panel already renders both the same way. */
-export function resolveCatalogProvider(
+/** The catalog providers that are live right now: what a buyer can choose from. */
+export async function listOfferedCatalogProviders(
   ctx: HandlerContext,
   catalog: BillingPlanCatalog,
-  handlerName: string,
-): ResolvedProvider {
-  const found = findCatalogProvider(ctx, catalog);
-  if (!found) {
-    throw new FeatureDisabledError(BILLING_FOUNDATION_FEATURE, handlerName);
-  }
-  return found;
+): Promise<readonly ResolvedProvider[]> {
+  return filterOfferedProviders(ctx, listCatalogProviders(ctx, catalog));
 }
 
 /** `plugin.isBillingEnabled?.(ctx) ?? true` — the one place this fallback is

package/packages/bundled-features/src/billing-foundation/consumer-protection/confirmation-mail.ts

@@ -166,8 +166,14 @@ inlineHtmlMarkdown.use({
     blockquote({ tokens }) {
       return this.parser.parse(tokens);
     },
-    list({ items }) {
-      return items.map((item) => this.parser.parse(item.tokens)).join("");
+    list({ items, ordered, start }) {
+      const firstNumber = typeof start === "number" ? start : 1;
+      return items
+        .map((item, index) => {
+          const marker = ordered ? `${firstNumber + index}. ` : "";
+          return `${marker}${this.parser.parse(item.tokens)}`;
+        })
+        .join("");
     },
     hr: () => "",
     space: () => "",

package/packages/bundled-features/src/billing-foundation/consumer-protection/consent-gate.ts

@@ -79,6 +79,7 @@ export type ConsentPriceDetails = {
     "unitAmount" | "currency" | "interval" | "intervalCount"
   > | null;
   readonly orderItem?: OrderItem;
+  readonly providerName?: string;
 };
 
 export async function prepareConsent(
@@ -163,6 +164,7 @@ export async function recordConsent(
     termsTemplateVersion: prepared.termsTemplateVersion,
     locale: prepared.locale,
     actorUserId: String(ctx.user.id),
+    ...(details.providerName !== undefined && { providerName: details.providerName }),
     ...(details.orderItem && {
       itemLabelKey: details.orderItem.labelKey,
       ...(details.orderItem.params && { itemLabelParams: details.orderItem.params }),

package/packages/bundled-features/src/billing-foundation/consumer-protection/issue-confirmation.ts

@@ -12,6 +12,7 @@ import { InternalError, UnprocessableError } from "@cosmicdrift/kumiko-framework
 import { createI18n } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
+import { decryptStoredUserEmail } from "../../shared/index.ts";
 import { requireTemplateResolver, TEXT_BLOCK_KIND } from "../../template-resolver/index.ts";
 import { UserQueries } from "../../user/index.ts";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.ts";
@@ -29,7 +30,6 @@ import type { ConsumerProtectionOptions, ResolvedBillingFoundationOptions } from
 import { CONTRACT_CONFIRMATION_NOTIFICATION_TYPE } from "../web/constants.ts";
 import { contractConfirmationVariables } from "./confirmation-mail.ts";
 import { resolveConsentLocale } from "./consent-text.ts";
-import { openStoredUserEmail } from "./stored-user-email.ts";
 
 export const issueContractConfirmationSchema = z
   .object({
@@ -58,6 +58,17 @@ function translatedOrUndefined(translation: string, key: string): string | undef
   return translation === key ? undefined : translation;
 }
 
+function vatNoteFor(
+  consumerProtection: ConsumerProtectionOptions,
+  providerName: string | undefined,
+): Readonly<Record<string, string>> {
+  const providerNote =
+    providerName === undefined
+      ? undefined
+      : consumerProtection.providerTexts?.[providerName]?.vatNote;
+  return providerNote ?? consumerProtection.vatNote;
+}
+
 function pickTimeZone(userZone: string | null | undefined, tenantZone: string): string {
   if (userZone && isValidIanaTimeZone(userZone)) return userZone;
   return isValidIanaTimeZone(tenantZone) ? tenantZone : "UTC";
@@ -145,7 +156,7 @@ export function createIssueContractConfirmationHandler(
       );
       const recipientEmail =
         recipient.success && recipient.data.isDeleted !== true
-          ? await openStoredUserEmail(
+          ? await decryptStoredUserEmail(
               recipient.data.email,
               "billing-foundation:issue-contract-confirmation",
             )
@@ -203,7 +214,7 @@ export function createIssueContractConfirmationHandler(
         ...(payload.currentPeriodEndIso !== undefined && {
           currentPeriodEndIso: payload.currentPeriodEndIso,
         }),
-        vatNote: consumerProtection.vatNote,
+        vatNote: vatNoteFor(consumerProtection, consent.providerName),
         operatorEmail: consumerProtection.operatorEmail,
         termsContent: terms.content,
       });

package/packages/bundled-features/src/billing-foundation/consumer-protection/mail-notifications.ts

@@ -69,10 +69,9 @@ export function terminationReceiptTemplate(): NotificationLocalizedTemplate {
         mailRepeatedRows("details", "text"),
         mailParagraph(texts.receiptNextSteps),
         mailParagraph(texts.receiptRevoke(OPERATOR_EMAIL_SLOT)),
-        mailParagraphWithLink(texts.receiptNotMe, texts.receiptNotMeLink, "revokeUrl").replace(
-          "<p>",
-          '<p data-if="revokeUrl">',
-        ),
+        mailParagraphWithLink(texts.receiptNotMe, texts.receiptNotMeLink, "revokeUrl", {
+          showIf: "revokeUrl",
+        }),
         mailParagraph(`${texts.contact} {operatorEmail}`),
       ].join(""),
     };

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-receipt-limit.ts

@@ -14,28 +14,34 @@ function receiptBucketKey(ctx: HandlerContext, email: string): string | undefine
   return digest === undefined ? undefined : `${RECEIPT_BUCKET_PREFIX}:${digest}`;
 }
 
+export type ReceiptMailVerdict = "allowed" | "limited" | "unavailable";
+
 /** Consumes one receipt token for the recipient. Fails closed when the limiter
- *  errors or no digest key is wired: the declaration is already recorded, a missing receipt is the lesser harm. */
-export async function mayMailReceipt(ctx: HandlerContext, email: string): Promise<boolean> {
+ *  errors or no digest key is wired ("unavailable"): the declaration is already
+ *  recorded, a missing receipt is the lesser harm. */
+export async function mayMailReceipt(
+  ctx: HandlerContext,
+  email: string,
+): Promise<ReceiptMailVerdict> {
   // skip: no rate limiter wired, nothing to count against
-  if (!ctx.rateLimit) return true;
+  if (!ctx.rateLimit) return "allowed";
   try {
     const bucketKey = receiptBucketKey(ctx, email);
     if (bucketKey === undefined) {
       ctx.log?.warn(
         "[billing-foundation:termination] no rate-limit digest available, receipt mail withheld",
       );
-      return false;
+      return "unavailable";
     }
     const decision = await ctx.rateLimit.check(bucketKey, {
       limit: RECEIPT_MAILS_PER_RECIPIENT,
       windowSeconds: RECEIPT_WINDOW_SECONDS,
     });
-    return decision.allowed;
+    return decision.allowed ? "allowed" : "limited";
   } catch (error) {
     ctx.log?.warn(
       `[billing-foundation:termination] receipt rate limiter failed: ${error instanceof Error ? error.message : String(error)}`,
     );
-    return false;
+    return "unavailable";
   }
 }

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-record.ts

@@ -249,25 +249,8 @@ export function createRecordContractTerminationHandler(
 
       // The public job runs at least once: a second run must not call the
       // provider or append again.
-      const alreadyRecorded = stream.events
-        .map((e) =>
-          e.type === CONTRACT_TERMINATION_REQUESTED_EVENT_QN
-            ? contractTerminationRequestedPayloadSchema.safeParse(e.payload).data
-            : undefined,
-        )
-        .find((recordedPayload) => recordedPayload?.requestId === payload.requestId);
-      if (alreadyRecorded) {
-        return {
-          isSuccess: true as const,
-          data: {
-            receivedAtIso: alreadyRecorded.receivedAtIso,
-            effectiveAtIso: alreadyRecorded.effectiveAtIso,
-            providerCancel: alreadyRecorded.providerCancel,
-            noticeReason: null,
-            withdrawalPeriodExpired: false,
-          } satisfies RecordContractTerminationResult,
-        };
-      }
+      const alreadyRecorded = findRecordedTermination(stream.events, payload.requestId);
+      if (alreadyRecorded) return recordedTerminationResult(alreadyRecorded);
 
       // A revoked public declaration never reaches the provider.
       if (hasRevocation(stream.events, payload.requestId)) {
@@ -301,6 +284,13 @@ export function createRecordContractTerminationHandler(
         aggregateId: subscriptionAggregateId(tenantId),
         aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
       });
+      // A concurrent run with the same requestId may have recorded while we were
+      // at the provider; a second append would duplicate the event and the notice.
+      const recordedMeanwhile = findRecordedTermination(
+        streamAfterProviderCall.events,
+        payload.requestId,
+      );
+      if (recordedMeanwhile) return recordedTerminationResult(recordedMeanwhile);
       // A revocation that landed during the provider call found no cancel to take back.
       if (hasRevocation(streamAfterProviderCall.events, payload.requestId)) {
         await takeBackLateRevokedCancel(ctx, consumerProtection, {
@@ -348,6 +338,32 @@ export function createRecordContractTerminationHandler(
   };
 }
 
+export function findRecordedTermination(
+  events: readonly { type: string; payload: unknown }[],
+  requestId: string,
+): ContractTerminationRequestedPayload | undefined {
+  return events
+    .map((e) =>
+      e.type === CONTRACT_TERMINATION_REQUESTED_EVENT_QN
+        ? contractTerminationRequestedPayloadSchema.safeParse(e.payload).data
+        : undefined,
+    )
+    .find((recordedPayload) => recordedPayload?.requestId === requestId);
+}
+
+function recordedTerminationResult(recorded: ContractTerminationRequestedPayload) {
+  return {
+    isSuccess: true as const,
+    data: {
+      receivedAtIso: recorded.receivedAtIso,
+      effectiveAtIso: recorded.effectiveAtIso,
+      providerCancel: recorded.providerCancel,
+      noticeReason: null,
+      withdrawalPeriodExpired: false,
+    } satisfies RecordContractTerminationResult,
+  };
+}
+
 export function hasRevocation(
   events: readonly { type: string; payload: unknown }[],
   requestId: string,

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-request.ts

@@ -13,6 +13,7 @@ import {
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
+import { decryptStoredUserEmail } from "../../shared/index.ts";
 import { TenantQueries } from "../../tenant/index.ts";
 import { UserQueries } from "../../user/index.ts";
 import {
@@ -31,10 +32,9 @@ import {
   SubscriptionFoundationQueries,
 } from "../web/constants.ts";
 import { resolveConsentLocale } from "./consent-text.ts";
-import { openStoredUserEmail } from "./stored-user-email.ts";
 import { type TerminationDeclaration, terminationReceiptVariables } from "./termination-mail.ts";
 import { notifyOperator, type OperatorNoticePlan, requireNotify } from "./termination-notify.ts";
-import { mayMailReceipt } from "./termination-receipt-limit.ts";
+import { mayMailReceipt, type ReceiptMailVerdict } from "./termination-receipt-limit.ts";
 import type { RecordContractTerminationResult } from "./termination-record.ts";
 import { createRevocationToken, revocationUrl } from "./termination-revoke.ts";
 import type { OperatorNoticeReason } from "./termination-texts.ts";
@@ -109,13 +109,19 @@ type TerminationMailPlan = OperatorNoticePlan & {
   readonly revokeUrl?: string;
 };
 
+function receiptWithheldReasons(verdict: ReceiptMailVerdict): readonly OperatorNoticeReason[] {
+  if (verdict === "limited") return ["receipt_rate_limited"];
+  if (verdict === "unavailable") return ["receipt_not_sent"];
+  return [];
+}
+
 async function sendTerminationMails(
   ctx: HandlerContext,
   consumerProtection: ConsumerProtectionOptions,
   plan: TerminationMailPlan,
 ): Promise<void> {
-  const receiptAllowed = await mayMailReceipt(ctx, plan.declaration.email);
-  if (receiptAllowed) {
+  const receiptVerdict = await mayMailReceipt(ctx, plan.declaration.email);
+  if (receiptVerdict === "allowed") {
     await requireNotify(ctx)(CONTRACT_TERMINATION_RECEIPT_NOTIFICATION_TYPE, {
       route: { email: plan.declaration.email },
       data: terminationReceiptVariables({
@@ -133,9 +139,7 @@ async function sendTerminationMails(
       priority: "critical",
     });
   }
-  const reasons = receiptAllowed
-    ? plan.reasons
-    : [...plan.reasons, "receipt_rate_limited" as const];
+  const reasons = [...plan.reasons, ...receiptWithheldReasons(receiptVerdict)];
   // skip: no operator notice needed for this declaration
   if (reasons.length === 0) return;
   const { revokeUrl: _revokeUrl, ...noticePlan } = plan;
@@ -320,7 +324,7 @@ export function createTerminateContractHandler(
       );
       const callerEmail =
         caller.success && caller.data.email && caller.data.isDeleted !== true
-          ? await openStoredUserEmail(caller.data.email, "billing-foundation:terminate-contract")
+          ? await decryptStoredUserEmail(caller.data.email, "billing-foundation:terminate-contract")
           : null;
       if (callerEmail === null) {
         throw new InternalError({