@cosmicdrift/kumiko-bundled-features 0.146.4 → 0.147.0

package/src/jobs/web/job-runs-screen.tsx

@@ -3,6 +3,8 @@
 
 import {
   type DataTableSort,
+  formatWhen,
+  sortByAccessor,
   useDispatcher,
   useNav,
   usePrimitives,
@@ -99,7 +101,7 @@ export function JobRunsScreen(): ReactNode {
       ]}
       sort={sort}
       onSortChange={setSort}
-      rows={sortJobRuns(state.rows, sort).map((row) => ({
+      rows={sortByAccessor(state.rows, sort, SORT_ACCESSORS).map((row) => ({
         id: row.id,
         values: {
           job: row.jobName,
@@ -142,23 +144,3 @@ const SORT_ACCESSORS: Record<string, (r: JobRunRow) => string | number> = {
   status: (r) => r.status,
   started: (r) => r.startedAt,
 };
-
-function sortJobRuns(rows: readonly JobRunRow[], sort: DataTableSort | null): readonly JobRunRow[] {
-  if (sort === null) return rows;
-  const accessor = SORT_ACCESSORS[sort.field];
-  if (accessor === undefined) return rows;
-  const factor = sort.dir === "asc" ? 1 : -1;
-  return [...rows].sort((a, b) => {
-    const av = accessor(a);
-    const bv = accessor(b);
-    return av < bv ? -factor : av > bv ? factor : 0;
-  });
-}
-
-function formatWhen(value: string): string {
-  try {
-    return new Date(value).toLocaleString();
-  } catch {
-    return value;
-  }
-}

package/src/page-render/__tests__/layout.test.ts

@@ -40,6 +40,16 @@ describe("wrapInLayout :: seo (opt-in OG/JSON-LD extension)", () => {
     expect(html).not.toContain('<meta name="description" content="About us">');
   });
 
+  test('with `seo` — no description means no <meta name="description"> at all (not an empty one)', () => {
+    const html = wrapInLayout({
+      title: "About",
+      bodyHtml: "<p>x</p>",
+      lang: "en",
+      seo: {},
+    });
+    expect(html).not.toContain('<meta name="description"');
+  });
+
   test("with `seo` — escapes title/description same as the non-seo path", () => {
     const html = wrapInLayout({
       title: "<script>alert(1)</script>",

package/src/personal-access-tokens/web/pat-tokens-screen.tsx

@@ -258,7 +258,7 @@ export function PatTokensScreen({
     return <div className="flex flex-col gap-6">{content}</div>;
   }
   return (
-    <FormScreenShell testId="pat-tokens-screen" maxWidth="3xl">
+    <FormScreenShell testId="pat-tokens-screen" maxWidth="3xl" className="flex flex-col gap-6">
       {content}
     </FormScreenShell>
   );

package/src/renderer-simple/__tests__/resolve-variables.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { RendererContext } from "../../renderer-foundation";
+import { resolveNotificationVariables } from "../resolve-variables";
+
+describe("resolveNotificationVariables :: template-resolver not mounted", () => {
+  test("template slug set but template-resolver isn't mounted → falls back to variables, never touches ctx.db", async () => {
+    // Truthy-but-poisoned db: if the guard ever regresses to only checking
+    // `!ctx.db`, calling anything on this throws instead of silently
+    // succeeding — the test fails loud, not by accident.
+    const poisonedDb = new Proxy(
+      {},
+      {
+        get(): never {
+          throw new Error(
+            "resolveNotificationVariables must not touch ctx.db when template-resolver isn't mounted",
+          );
+        },
+      },
+    );
+    const ctx: RendererContext = {
+      db: poisonedDb as never,
+      registry: { features: new Map() } as never,
+      tenantId: "11111111-1111-4111-8111-111111111111" as TenantId,
+    };
+
+    const result = await resolveNotificationVariables(
+      {
+        kind: "notification",
+        payload: { template: "welcome-email", variables: { name: "Ada" } },
+      },
+      ctx,
+    );
+
+    expect(result).toEqual({ name: "Ada" });
+  });
+});

package/src/renderer-simple/resolve-variables.ts

@@ -14,7 +14,7 @@ export async function resolveNotificationVariables(
 ): Promise<Readonly<Record<string, unknown>>> {
   const variables = req.payload.variables ?? {};
   const slug = req.payload.template?.trim();
-  if (!slug || req.payload.content || !ctx.db) {
+  if (!slug || req.payload.content || !ctx.db || !ctx.registry.features.has("template-resolver")) {
     return variables;
   }
 
@@ -31,6 +31,8 @@ export async function resolveNotificationVariables(
       const base = parsePlainTemplateContent(resolved.content);
       return { ...base, ...variables };
     }
+    // body always wins from the resolved template for rendered formats — a runtime
+    // "variables.body" override would clobber the actual rendered content.
     return { ...variables, body: resolved.content };
   } catch (err) {
     if (err instanceof TemplateNotFoundError) {

package/src/seo/__tests__/seo.integration.test.ts

@@ -141,6 +141,16 @@ describe("seo :: GET /sitemap.xml", () => {
     expect(xml).not.toContain("http://a.example.com");
   });
 
+  test("x-forwarded-proto: garbage value → falls back to the raw URL scheme, not the header", async () => {
+    const res = await stack.app.request("http://a.example.com/sitemap.xml", {
+      headers: { "x-forwarded-proto": "javascript" },
+    });
+    expect(res.status).toBe(200);
+    const xml = await res.text();
+    expect(xml).toContain("<loc>http://a.example.com/legal/impressum</loc>");
+    expect(xml).not.toContain("javascript://a.example.com");
+  });
+
   test("host without a managed-pages tenant → callback + legal-pages entries only", async () => {
     const res = await stack.app.request("http://unknown.example.com/sitemap.xml");
     expect(res.status).toBe(200);
@@ -161,6 +171,8 @@ describe("seo :: GET /llms.txt", () => {
     expect(text).toContain("> Acme builds things.");
     expect(text).toContain("## Pages");
     expect(text).toContain("http://a.example.com/p/about");
+    // #979: the managed-page's real title, not its URL, is the link text.
+    expect(text).toContain("[About](http://a.example.com/p/about)");
   });
 });
 

package/src/seo/feature.ts

@@ -131,11 +131,15 @@ async function gatherEntries(
         );
         if (res.ok) {
           const body: {
-            data?: { pages?: readonly { slug: string; updatedAt: string }[] };
+            data?: { pages?: readonly { slug: string; title: string; updatedAt: string }[] };
           } = await res.json();
           const basePath = opts.managedPages.basePath ?? "/p";
           for (const page of body.data?.pages ?? []) {
-            entries.push({ loc: `${origin}${basePath}/${page.slug}`, lastmod: page.updatedAt });
+            entries.push({
+              loc: `${origin}${basePath}/${page.slug}`,
+              title: page.title,
+              lastmod: page.updatedAt,
+            });
           }
         }
       } catch {
@@ -160,7 +164,10 @@ function requestHost(c: { req: { header: (name: string) => string | undefined; u
   const url = new URL(c.req.url);
   const host = c.req.header("host") ?? url.host;
   const forwardedProto = c.req.header("x-forwarded-proto")?.split(",")[0]?.trim();
-  const protocol = forwardedProto || url.protocol.replace(":", "");
+  const protocol =
+    forwardedProto === "https" || forwardedProto === "http"
+      ? forwardedProto
+      : url.protocol.replace(":", "");
   return { origin: `${protocol}://${host}`, host };
 }
 
@@ -225,7 +232,12 @@ export function createSeoFeature(opts: SeoOptions): FeatureDefinition {
         ]);
         const sections =
           entries.length > 0
-            ? [{ heading: "Pages", links: entries.map((e) => ({ title: e.loc, url: e.loc })) }]
+            ? [
+                {
+                  heading: "Pages",
+                  links: entries.map((e) => ({ title: e.title ?? e.loc, url: e.loc })),
+                },
+              ]
             : [];
         const text = buildLlmsTxt({
           title: seoConfig.organizationName || host,

package/src/seo/sitemap.ts

@@ -7,6 +7,9 @@ export type SitemapEntry = {
   readonly changefreq?: "always" | "hourly" | "daily" | "weekly" | "monthly" | "yearly" | "never";
   /** hreflang alternates for the same logical page (multilingual sitemaps). */
   readonly alternates?: readonly { readonly hreflang: string; readonly href: string }[];
+  /** Human-/LLM-readable page title, used by llms.txt link lines. Falls back
+   *  to `loc` when absent (callback-only entries rarely set this). */
+  readonly title?: string;
 };
 
 // Pure XML builder — sitemaps.org urlset + xhtml:link alternates. No

package/src/{auth-email-password/__tests__ → shared}/identity-v3-hash.test.ts

@@ -15,8 +15,8 @@
 
 import { describe, expect, test } from "bun:test";
 import { pbkdf2Sync } from "node:crypto";
-import { isIdentityV3Hash, verifyIdentityV3Hash } from "../identity-v3-hash";
-import { verifyPassword } from "../password-hashing";
+import { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
+import { verifyPassword } from "./password-hashing";
 
 // --- Test helpers ---
 

package/src/shared/index.ts

@@ -7,3 +7,5 @@ export {
 } from "./chunked-entity-migration";
 export { decryptStoredPii } from "./decrypt-stored-pii";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write";
+export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
+export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing";

package/src/shared/password-hashing.ts

@@ -0,0 +1,55 @@
+import { hash as argonHash, verify as argonVerify } from "@node-rs/argon2";
+import { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash";
+
+// OWASP-recommended argon2id parameters (2024 guidance):
+//   memoryCost: 19 MiB, timeCost: 2, parallelism: 1
+// These strike a balance between login latency (~20ms on typical hardware)
+// and brute-force resistance. If hashing becomes a bottleneck, tune memoryCost
+// before parallelism — memory hardness is what defeats GPU attacks.
+//
+// algorithm: 2 = Argon2id (best of argon2i + argon2d).
+// We inline the numeric value instead of importing Algorithm because the
+// @node-rs/argon2 enum is const and breaks verbatimModuleSyntax imports.
+const HASH_OPTIONS = {
+  algorithm: 2,
+  memoryCost: 19456,
+  timeCost: 2,
+  parallelism: 1,
+} as const;
+
+// @wrapper-known semantic-alias
+export async function hashPassword(password: string): Promise<string> {
+  return argonHash(password, HASH_OPTIONS);
+}
+
+// Returns true if the password matches. Never throws on wrong passwords —
+// only on malformed hash strings (which would be a bug, not a login attempt).
+//
+// Two verifier paths:
+//   - argon2id (default, what `hashPassword` produces)
+//   - ASP.NET Core Identity V3 (verify-only, for legacy migrations from .NET
+//     stacks). Sniffed via the format marker; on a successful match the
+//     application can rehash to argon2 at the next password-change event.
+export async function verifyPassword(hashString: string, password: string): Promise<boolean> {
+  if (isIdentityV3Hash(hashString)) {
+    return verifyIdentityV3Hash(password, hashString);
+  }
+  try {
+    return await argonVerify(hashString, password);
+  } catch {
+    // argon2 throws on unparseable hash — treat as mismatch rather than 500
+    // to avoid revealing which accounts have corrupted stored hashes.
+    return false;
+  }
+}
+
+// Anti-enumeration timing equaliser (#774). The login handler runs this on
+// the no-user / no-hash path so a missing account costs the same argon2
+// latency as a real verify — otherwise response timing leaks whether an
+// email is registered. Derived from hashPassword once and cached, so it
+// always tracks HASH_OPTIONS; the password never matches, result discarded.
+let dummyHash: Promise<string> | undefined;
+export async function verifyDummyPassword(password: string): Promise<void> {
+  dummyHash ??= hashPassword("anti-enumeration-dummy");
+  await verifyPassword(await dummyHash, password);
+}

package/src/tags/web/__tests__/tag-section.test.tsx

@@ -22,6 +22,8 @@ let assignmentRows: readonly AssignmentRow[] = [];
 beforeEach(() => {
   catalogRows = [];
   assignmentRows = [];
+  catalogRefetch.mockClear();
+  assignmentsRefetch.mockClear();
 });
 
 const dispatchSpy = mock(async (type: string) =>
@@ -30,11 +32,13 @@ const dispatchSpy = mock(async (type: string) =>
     : { isSuccess: true, data: undefined },
 );
 
+const catalogRefetch = mock(async () => {});
+const assignmentsRefetch = mock(async () => {});
 const useQuerySpy = mock((type: string) => ({
   data: type === TagsQueries.tagList ? { rows: catalogRows } : { rows: assignmentRows },
   loading: false,
   error: null,
-  refetch: mock(async () => {}),
+  refetch: type === TagsQueries.tagList ? catalogRefetch : assignmentsRefetch,
 }));
 
 const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
@@ -63,6 +67,13 @@ const StubPicker = ({
     <button type="button" data-testid="picker-add-t2" onClick={() => onChange([...value, "t2"])}>
       add t2
     </button>
+    <button
+      type="button"
+      data-testid="picker-add-t2-t3"
+      onClick={() => onChange([...value, "t2", "t3"])}
+    >
+      add t2+t3
+    </button>
     <button
       type="button"
       data-testid="picker-remove-t1"
@@ -169,6 +180,41 @@ describe("TagSection", () => {
     );
   });
 
+  test("partial write failure still refetches — no stale UI for the writes that succeeded", async () => {
+    catalogRows = [
+      { id: "t1", name: "important" },
+      { id: "t2", name: "project-x" },
+      { id: "t3", name: "urgent" },
+    ];
+    assignmentRows = [{ tagId: "t1", entityType: "note", entityId: "note-1" }];
+    dispatchSpy.mockClear();
+    dispatchSpy.mockImplementation(async (_type: string, payload?: Record<string, unknown>) =>
+      payload?.["tagId"] === "t3"
+        ? { isSuccess: false, error: { i18nKey: "tags.error.assignFailed" } }
+        : { isSuccess: true, data: undefined },
+    );
+
+    render(
+      <Wrapper>
+        <TagSection entityName="note" entityId="note-1" />
+      </Wrapper>,
+    );
+
+    // t2 assigns OK, t3 fails — the loop stops, but refetch must still run so
+    // the UI reflects the t2 write that already succeeded server-side.
+    fireEvent.click(screen.getByTestId("picker-add-t2-t3"));
+    await waitFor(() => expect(screen.getByTestId("tags-section-action-error")).toBeTruthy());
+
+    expect(catalogRefetch).toHaveBeenCalled();
+    expect(assignmentsRefetch).toHaveBeenCalled();
+
+    dispatchSpy.mockImplementation(async (type: string) =>
+      type === TagsHandlers.createTag
+        ? { isSuccess: true, data: { id: "tag-new" } }
+        : { isSuccess: true, data: undefined },
+    );
+  });
+
   test("create-mode (no entityId yet) shows the save-first hint instead of the section", () => {
     render(
       <Wrapper>

package/src/tags/web/tag-section.tsx

@@ -119,14 +119,17 @@ export function TagSection({
       try {
         for (const tagId of added) {
           if (!(await writeOk(TagsHandlers.assignTag, { tagId, entityType: entityName, entityId })))
-            return;
+            break;
         }
         for (const tagId of removed) {
           if (!(await writeOk(TagsHandlers.removeTag, { tagId, entityType: entityName, entityId })))
-            return;
+            break;
         }
-        await refetch();
       } finally {
+        // Unconditional: even a partial failure may have persisted some
+        // writes server-side — skipping refetch here would leave the UI
+        // stale relative to those, undetected until the next interaction.
+        await refetch();
         setBusy(false);
       }
     })();

package/src/tenant-lifecycle/lifecycle-gate.ts

@@ -9,17 +9,23 @@ export type TenantLifecycleGate = {
 };
 
 // Every authenticated + anonymous request consults this (via auth-middleware's
-// resolveTenantLifecycleStatus) — a per-request DB round-trip otherwise. No
-// TTL: status must be observable the instant it changes (a stale "active"
-// read after tombstoning would let a request slip through the 410 gate), so
-// this is invalidated explicitly by every status-changing write —
-// request/cancel-destruction, the sweep, and tombstoneTenantRow all call
-// invalidateTenantLifecycleGate(tenantId) right after their update succeeds.
+// resolveTenantLifecycleStatus) — a per-request DB round-trip otherwise.
+// invalidateTenantLifecycleGate(tenantId) clears the SAME-process entry
+// right after every status-changing write (request/cancel-destruction, the
+// sweep, tombstoneTenantRow) — the instant-visibility path for a single
+// replica. In a multi-replica deployment a write on pod A never reaches pod
+// B's Map, so a short TTL bounds the cross-pod staleness window instead of
+// leaving it unbounded (self-heals within GATE_TTL_MS even if invalidation
+// never arrives).
 // Split into its own module (not run-tenant-destroy.ts) so stages.ts can
 // invalidate too without a stages.ts <-> run-tenant-destroy.ts import cycle.
 // ponytail: unbounded Map — fine while tenant counts stay in the thousands (a
 // few bytes/entry); swap for a bounded LRU if that ever changes.
-const gateCache = new Map<TenantId, TenantLifecycleGate | null>();
+const GATE_TTL_MS = 3000;
+const gateCache = new Map<
+  TenantId,
+  { readonly value: TenantLifecycleGate | null; readonly expiresAt: number }
+>();
 
 export function invalidateTenantLifecycleGate(tenantId: TenantId): void {
   gateCache.delete(tenantId);
@@ -38,7 +44,8 @@ export async function resolveTenantLifecycleGate(
   db: DbRunner,
   tenantId: TenantId,
 ): Promise<TenantLifecycleGate | null> {
-  if (gateCache.has(tenantId)) return gateCache.get(tenantId) ?? null;
+  const cached = gateCache.get(tenantId);
+  if (cached && cached.expiresAt > Date.now()) return cached.value;
   const rows = await selectMany<{ status: string; gracePeriodEnd: Temporal.Instant | null }>(
     db,
     tenantTable,
@@ -46,13 +53,13 @@ export async function resolveTenantLifecycleGate(
   );
   const row = rows[0];
   if (!row) {
-    gateCache.set(tenantId, null);
+    gateCache.set(tenantId, { value: null, expiresAt: Date.now() + GATE_TTL_MS });
     return null;
   }
   const gate: TenantLifecycleGate = {
     status: row.status,
     gracePeriodEnd: row.gracePeriodEnd?.toString() ?? null,
   };
-  gateCache.set(tenantId, gate);
+  gateCache.set(tenantId, { value: gate, expiresAt: Date.now() + GATE_TTL_MS });
   return gate;
 }

package/src/text-content/web/client-plugin.tsx

@@ -318,7 +318,7 @@ function TextContentEditor({
       onSubmit={onSubmit}
       testId="text-content-editor"
       title={title || slug || "—"}
-      subtitle={lang !== "" ? `(${lang})` : undefined}
+      subtitle={lang !== "" ? `${slug} · (${lang})` : slug}
       actions={
         canWrite ? (
           <Button type="submit" loading={submitting} disabled={disabled}>

package/src/tier-engine/__tests__/trial-config-validation.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import type { TierMap } from "../compose-app";
+import { createTierEngineFeature } from "../feature";
+
+type Caps = { readonly apps: number };
+
+const tierMap: TierMap<Caps> = {
+  free: { features: [], caps: { apps: 1 } },
+  pro: { features: ["designer"], caps: { apps: 5 } },
+};
+
+describe("createTierEngineFeature trial config validation", () => {
+  test("throws at construction when trial.tier is not a key in tierMap", () => {
+    expect(() =>
+      createTierEngineFeature({
+        tierMap,
+        trial: { tier: "enterprise", durationHours: 72 },
+      }),
+    ).toThrow(/trial\.tier "enterprise" is not a key in tierMap/);
+  });
+
+  test("does not throw when trial.tier is a valid tierMap key", () => {
+    expect(() =>
+      createTierEngineFeature({
+        tierMap,
+        trial: { tier: "pro", durationHours: 72 },
+      }),
+    ).not.toThrow();
+  });
+});

package/src/tier-engine/feature.ts

@@ -270,6 +270,11 @@ export function createTierEngineFeature<
     // Sekunde 1 nach Signup. Darum lebt er als async trialGate (unten, am
     // build-Ende angehängt), den der dispatcher nur auf dem disabled-Pfad
     // konsultiert. trialFeatures = fixe Feature-Menge des Trial-Tiers.
+    if (opts.trial && !tierMap[opts.trial.tier]) {
+      throw new Error(
+        `tier-engine: trial.tier "${opts.trial.tier}" is not a key in tierMap — trial would unlock no features`,
+      );
+    }
     const trialFeatures: ReadonlySet<string> = opts.trial
       ? featuresForTier(tierMap, opts.trial.tier)
       : new Set();

package/src/user-data-rights/__tests__/email-templates.test.ts

@@ -31,6 +31,21 @@ describe("gdpr email-templates", () => {
     expect(de.subject).not.toBe(en.subject);
   });
 
+  test("export-ready: html lang attribute matches the requested locale (654/1)", () => {
+    const de = renderExportReadyEmail({
+      downloadUrl: "https://app.test/x?token=abc",
+      expiresAt: "2026-07-01T13:45:00Z",
+      locale: "de",
+    });
+    expect(de.html).toContain('<html lang="de">');
+    const en = renderExportReadyEmail({
+      downloadUrl: "https://app.test/x?token=abc",
+      expiresAt: "2026-07-01T13:45:00Z",
+      locale: "en",
+    });
+    expect(en.html).toContain('<html lang="en">');
+  });
+
   test("export-ready: ampersand in download url is escaped in the href attr", () => {
     const r = renderExportReadyEmail({
       downloadUrl: "https://app.test/x?token=a&next=b",

package/src/user-data-rights/email-templates.ts

@@ -117,7 +117,7 @@ export function renderExportReadyEmail(args: RenderExportReadyEmailArgs): Render
     <p style="margin: 0 0 24px;">${renderButton({ url: args.downloadUrl, label: t.exportReadyButton })}</p>
     <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(t.exportReadyExpiry(formatTimestamp(args.expiresAt)))}</p>
     ${renderFallbackUrl({ url: args.downloadUrl, label: t.fallbackUrl })}`;
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
 }
 
 export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): RenderedEmail {
@@ -128,7 +128,7 @@ export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): Rend
   const body = `
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
     <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t.exportFailedIntro(app))}</p>`;
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
 }
 
 export function renderDeletionRequestedEmail(
@@ -142,7 +142,7 @@ export function renderDeletionRequestedEmail(
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
     <p style="margin: 0 0 16px; font-size: 14px; line-height: 1.5;">${escapeHtml(t.deletionRequestedIntro(app, formatTimestamp(args.gracePeriodEnd)))}</p>
     <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(t.deletionRequestedCancel)}</p>`;
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
 }
 
 export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArgs): RenderedEmail {
@@ -153,7 +153,7 @@ export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArg
   const body = `
     <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
     <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t.deletionExecutedIntro(app, formatTimestamp(args.executedAt)))}</p>`;
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }) };
 }
 
 function wrapCell(bodyHtml: string): string {
@@ -162,9 +162,9 @@ function wrapCell(bodyHtml: string): string {
 
 // Plain inline-styled HTML — gespiegelt von auth-email-password.
 // guard:dup-ok — Email-HTML (table-layout, inline CSS) ≠ Web-HTML (legal-pages/markdown.ts)
-function renderShell(args: { title: string; bodyHtml: string }): string {
+function renderShell(args: { title: string; bodyHtml: string; locale: GdprMailLocale }): string {
   return `<!DOCTYPE html>
-<html lang="en">
+<html lang="${args.locale}">
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />

package/src/user-data-rights/web/privacy-center-screen.tsx

@@ -224,6 +224,7 @@ function RestrictionSection({
     <Section
       title={t("userDataRights.privacyCenter.restriction.title")}
       testId="privacy-restriction"
+      variant="destructive"
       actions={
         restricted ? undefined : (
           <Button
@@ -303,6 +304,7 @@ function DeletionSection({
     <Section
       title={t("userDataRights.privacyCenter.deletion.title")}
       testId="privacy-deletion"
+      variant="destructive"
       actions={
         deletionRequested ? (
           <Button