@cosmicdrift/kumiko-bundled-features 0.205.0 → 0.207.0

package/src/tenant/i18n.ts

@@ -1,28 +1,39 @@
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const TENANT_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:tenant-list.title": { de: "Mandanten", en: "Tenants" },
-  "screen:tenant-edit.title": { de: "Mandant bearbeiten", en: "Edit tenant" },
-  "screen:members.title": { de: "Team", en: "Team" },
-  "tenant.nav.members": { de: "Team", en: "Team" },
-  "tenant:entity:tenant:field:key": { de: "Schlüssel", en: "Key" },
-  "tenant:entity:tenant:field:name": { de: "Name", en: "Name" },
-  "tenant:entity:tenant:field:isEnabled": { de: "Aktiv", en: "Enabled" },
-  "tenant:entity:tenant:field:status": { de: "Status", en: "Status" },
-  "tenant:entity:tenant:field:status:option:active": { de: "Aktiv", en: "Active" },
+  "screen:tenant-list.title": { de: "Mandanten", en: "Tenants", es: "Organizaciones" },
+  "screen:tenant-edit.title": {
+    de: "Mandant bearbeiten",
+    en: "Edit tenant",
+    es: "Editar organización",
+  },
+  "screen:members.title": { de: "Team", en: "Team", es: "Equipo" },
+  "tenant.nav.members": { de: "Team", en: "Team", es: "Equipo" },
+  "tenant:entity:tenant:field:key": { de: "Schlüssel", en: "Key", es: "Clave" },
+  "tenant:entity:tenant:field:name": { de: "Name", en: "Name", es: "Nombre" },
+  "tenant:entity:tenant:field:isEnabled": { de: "Aktiv", en: "Enabled", es: "Activado" },
+  "tenant:entity:tenant:field:status": { de: "Status", en: "Status", es: "Estado" },
+  "tenant:entity:tenant:field:status:option:active": { de: "Aktiv", en: "Active", es: "Activo" },
   "tenant:entity:tenant:field:status:option:destroyRequested": {
     de: "Löschung angefordert",
     en: "Destroy requested",
+    es: "Eliminación solicitada",
   },
   "tenant:entity:tenant:field:status:option:destroying": {
     de: "Wird gelöscht",
     en: "Destroying",
+    es: "Eliminándose",
   },
   "tenant:entity:tenant:field:status:option:destroyFailed": {
     de: "Löschung fehlgeschlagen",
     en: "Destroy failed",
+    es: "Eliminación fallida",
+  },
+  "tenant:entity:tenant:field:status:option:destroyed": {
+    de: "Gelöscht",
+    en: "Destroyed",
+    es: "Eliminado",
   },
-  "tenant:entity:tenant:field:status:option:destroyed": { de: "Gelöscht", en: "Destroyed" },
-  "tenant:entity:tenant:field:isEnabled:option:true": { de: "Ja", en: "Yes" },
-  "tenant:entity:tenant:field:isEnabled:option:false": { de: "Nein", en: "No" },
+  "tenant:entity:tenant:field:isEnabled:option:true": { de: "Ja", en: "Yes", es: "Sí" },
+  "tenant:entity:tenant:field:isEnabled:option:false": { de: "Nein", en: "No", es: "No" },
 };

package/src/tenant/web/i18n.ts

@@ -40,4 +40,23 @@ export const defaultTranslations: TranslationsByLocale = {
     "tenant.members.col.expires": "Valid until",
     "tenant.nav.members": "Team",
   },
+  es: {
+    "tenant.members.title": "Miembros",
+    "tenant.members.loading": "Cargando miembros…",
+    "tenant.members.active": "Miembros activos",
+    "tenant.members.invite.title": "Nueva invitación",
+    "tenant.members.invite.email": "Correo electrónico",
+    "tenant.members.invite.role": "Rol",
+    "tenant.members.invite.submit": "Enviar invitación",
+    "tenant.members.invite.submitting": "Enviando invitación…",
+    "tenant.members.invite.success": "Invitación enviada a {email}",
+    "tenant.members.pending": "Invitaciones pendientes",
+    "tenant.members.pending.empty": "No hay invitaciones pendientes.",
+    "tenant.members.cancel": "Cancelar",
+    "tenant.members.col.userId": "ID de usuario",
+    "tenant.members.col.roles": "Roles",
+    "tenant.members.col.email": "Correo electrónico",
+    "tenant.members.col.expires": "Válido hasta",
+    "tenant.nav.members": "Equipo",
+  },
 };

package/src/tier-engine/i18n.ts

@@ -5,10 +5,14 @@
 
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const TIER_ENGINE_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:tier-admin.title": { de: "Tier manuell zuweisen", en: "Assign tier manually" },
+  "screen:tier-admin.title": {
+    de: "Tier manuell zuweisen",
+    en: "Assign tier manually",
+    es: "Asignar tier manualmente",
+  },
 };
 
 export const defaultTranslations: TranslationsByLocale = {
@@ -44,4 +48,20 @@ export const defaultTranslations: TranslationsByLocale = {
     "tier-admin.error.noTiers":
       "This app has no TierMap configured — there are no assignable tiers.",
   },
+  es: {
+    "screen:tier-admin.title": "Asignar tier manualmente",
+    "tier-admin.title": "Asignar tier manualmente",
+    "tier-admin.explainer":
+      "Asigna un tier a un tenant sin necesidad de compra. La asignación se marca como «manual» y no será sobrescrita por una sincronización de facturación posterior.",
+    "tier-admin.tenant.label": "Tenant",
+    "tier-admin.current.label": "Tier actual",
+    "tier-admin.current.none": "— aún ninguno —",
+    "tier-admin.tier.label": "Nuevo tier",
+    "tier-admin.submit": "Asignar tier",
+    "tier-admin.success": "Tier «{tier}» asignado.",
+    "tier-admin.error.generic": "No se pudo asignar el tier.",
+    "tier-admin.error.load": "No se pudieron cargar los tenants.",
+    "tier-admin.error.noTiers":
+      "Esta aplicación no tiene una TierMap configurada — no hay tiers asignables.",
+  },
 };

package/src/user/__tests__/email-unique-blind-index.integration.test.ts

@@ -0,0 +1,140 @@
+// fw#2134 — user:create's email-uniqueness check used to be a pure
+// pre-flight fetchOne (TOCTOU: two concurrent creates can both pass the
+// pre-flight and both insert, see handlers/create.write.ts). This proves
+// the DB-level fix directly against the executor (bypassing the handler's
+// pre-flight entirely) — a unique index over email's blind-index column
+// rejects the loser of a genuine race, and the framework's F8 pg-23505
+// mapping turns that into a clean 409 unique_violation, not a 500.
+//
+// createTestDb wires no blind-index key by default (see
+// blind-index.integration.test.ts) — without configureBlindIndexKey the
+// email_bidx column stays NULL for every row, the partial bidx unique
+// index never applies, and a race "passing" here would prove nothing. So
+// this test configures one explicitly and then proves the loser was
+// actually rejected on the bidx constraint (not the plaintext-fallback
+// index) by asserting the constraint name and reading email_bidx back off
+// the surviving row.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  computeBlindIndex,
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  decodeBlindIndexKey,
+  InMemoryKmsAdapter,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestDb,
+  type TestDb,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { userEntity, userTable } from "../schema/user";
+
+const TEST_KEY_B64 = Buffer.alloc(32, 9).toString("base64");
+const TEST_KEY = decodeBlindIndexKey(TEST_KEY_B64);
+
+let testDb: TestDb;
+const executor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  await unsafeCreateEntityTable(testDb.db, userEntity, "user");
+  await createEventsTable(testDb.db);
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(testDb.db).unsafe(
+    `TRUNCATE kumiko_events, read_users RESTART IDENTITY CASCADE`,
+  );
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+  configureBlindIndexKey(TEST_KEY_B64);
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+describe("fw#2134 — email unique constraint on the blind-index column", () => {
+  test("two concurrent creates with the same email: exactly one wins, loser fails on the bidx constraint", async () => {
+    const email = "race@example.com";
+    const tdb = createTenantDb(testDb.db, SYSTEM_TENANT_ID, "system");
+    const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+
+    const [first, second] = await Promise.all([
+      executor.create({ email, displayName: "Racer One" }, systemUser, tdb),
+      executor.create({ email, displayName: "Racer Two" }, systemUser, tdb),
+    ]);
+
+    const winner = first.isSuccess ? first : second;
+    const loser = first.isSuccess ? second : first;
+    if (loser.isSuccess || !winner.isSuccess) {
+      throw new Error("expected exactly one winner and one loser out of the two racing creates");
+    }
+
+    expect(loser.error.code).toBe("unique_violation");
+    expect(loser.error.httpStatus).toBe(409);
+    const details = loser.error.details as { constraintName?: string };
+    expect(details.constraintName).toBe("read_users_email_unique_bidx");
+
+    // Proves the race was actually decided by the blind-index constraint,
+    // not the plaintext-fallback index: the surviving row's bidx column
+    // carries the deterministic HMAC of the email.
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT "email_bidx" FROM "read_users" WHERE "id" = $1::uuid`,
+      [winner.data.id],
+    )) as ReadonlyArray<{ email_bidx: string | null }>;
+    expect(rows[0]?.email_bidx).toBe(computeBlindIndex(TEST_KEY, email));
+
+    // DB-proof: only one row actually survives under that blind index.
+    const survivors = (await asRawClient(testDb.db).unsafe(
+      `SELECT count(*)::int AS n FROM "read_users" WHERE "email_bidx" = $1`,
+      [computeBlindIndex(TEST_KEY, email)],
+    )) as ReadonlyArray<{ n: number }>;
+    expect(survivors[0]?.n).toBe(1);
+  });
+
+  test("a soft-deleted user still holds its email: constraint agrees with the pre-existing pre-flight behavior", async () => {
+    // Soft-delete only flips isDeleted/deletedAt (apply-entity-event.ts) —
+    // it never touches email/email_bidx, so the row still occupies the
+    // unique slot. This isn't new behavior from fw#2134: the handler's
+    // pre-flight fetchOne is a raw, unfiltered query (see create.write.ts)
+    // and already saw soft-deleted rows before this fix. This test pins
+    // that the new DB constraint doesn't diverge from that — only the
+    // GDPR "forgotten" hard-delete (see forget-cleanup) actually frees the
+    // email slot.
+    const email = "soft-deleted@example.com";
+    const tdb = createTenantDb(testDb.db, SYSTEM_TENANT_ID, "system");
+    const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+
+    const created = await executor.create(
+      { email, displayName: "Departing User" },
+      systemUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("expected create to succeed");
+
+    const deleted = await executor.delete({ id: created.data.id }, systemUser, tdb);
+    if (!deleted.isSuccess) throw new Error("expected soft-delete to succeed");
+
+    const reCreated = await executor.create({ email, displayName: "Squatter" }, systemUser, tdb);
+    if (reCreated.isSuccess) {
+      throw new Error("expected re-create with the same email to be rejected while soft-deleted");
+    }
+    expect(reCreated.error.code).toBe("unique_violation");
+    const details = reCreated.error.details as { constraintName?: string };
+    expect(details.constraintName).toBe("read_users_email_unique_bidx");
+  });
+});

package/src/user/__tests__/user.integration.test.ts

@@ -107,6 +107,37 @@ describe("scenario 1: create + me", () => {
     );
     expectErrorIncludes(error, UserErrors.emailAlreadyExists);
   });
+
+  // fw#2134 — the pre-flight fetchOne alone can't decide a genuine race
+  // (both requests can see "no duplicate" before either commits); this
+  // fires two real concurrent HTTP creates and checks the loser still
+  // gets a clean 4xx, never an unhandled 500. The DB-constraint-level
+  // proof (which layer actually catches the race, and that it's the
+  // blind-index column doing it) lives in
+  // email-unique-blind-index.integration.test.ts — this test's job is
+  // narrower: no request may 500 no matter who wins.
+  test("two concurrent creates with the same email: loser gets a clean 4xx, not a 500", async () => {
+    const email = "concurrent@example.com";
+    const [resA, resB] = await Promise.all([
+      stack.http.write(UserHandlers.create, { email, displayName: "Racer A" }, systemAdmin),
+      stack.http.write(UserHandlers.create, { email, displayName: "Racer B" }, systemAdmin),
+    ]);
+
+    const bodyA = (await resA.json()) as { isSuccess: boolean };
+    const bodyB = (await resB.json()) as { isSuccess: boolean };
+    const successes = [bodyA, bodyB].filter((b) => b.isSuccess === true);
+    const failures = [
+      { status: resA.status, body: bodyA },
+      { status: resB.status, body: bodyB },
+    ].filter((r) => r.body.isSuccess === false);
+
+    expect(successes).toHaveLength(1);
+    expect(failures).toHaveLength(1);
+    const loser = failures[0];
+    if (!loser) throw new Error("expected exactly one failing response");
+    expect(loser.status).toBeGreaterThanOrEqual(400);
+    expect(loser.status).toBeLessThan(500);
+  });
 });
 
 // --- Scenario 2: field-level read access hides passwordHash ---

package/src/user/handlers/create.write.ts

@@ -1,7 +1,12 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  ConflictError,
+  InternalError,
+  type WriteErrorInfo,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { UserErrors } from "../constants";
@@ -11,12 +16,16 @@ const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user
 
 // Only the Auth features (running as SYSTEM) or a SystemAdmin may create users.
 //
-// Email uniqueness is checked via a pre-flight query — the framework has no
-// `unique:` field flag yet. This check is race-prone: two concurrent requests
-// can both see "no duplicate" and both insert. Acceptable MVP behavior since
-// user creation is low-frequency and gated by privileged roles; the DB will
-// still surface a pg unique violation once we add the constraint.
-// TODO: replace with a real `unique:` field flag + DB constraint.
+// Email uniqueness has two layers (fw#2134):
+//  1. A pre-flight fetchOne — fast-fails with a friendly error on the
+//     common case, but is race-prone on its own: two concurrent requests
+//     can both see "no duplicate" and both proceed to crud.create.
+//  2. The real guard is the unique index over email's blind-index column
+//     (schema/user.ts). A losing concurrent create hits that constraint
+//     and crud.create returns a UniqueViolationError (framework's F8
+//     pg-23505 mapping) instead of throwing — remapped below to the same
+//     emailAlreadyExists shape the pre-flight path returns, so callers see
+//     one consistent error regardless of which layer caught the race.
 export const createWrite = defineWriteHandler({
   name: "user:create",
   schema: z.object({
@@ -56,6 +65,43 @@ export const createWrite = defineWriteHandler({
       );
     }
 
-    return crud.create(event.payload, event.user, db);
+    const result = await crud.create(event.payload, event.user, db);
+    if (!result.isSuccess && isEmailUniqueViolation(result.error)) {
+      return writeFailure(
+        new ConflictError({
+          message: "email already exists",
+          i18nKey: "user.errors.emailAlreadyExists",
+          details: {
+            reason: UserErrors.emailAlreadyExists,
+            field: "email",
+            constraintName: constraintNameOf(result.error),
+          },
+        }),
+      );
+    }
+    return result;
   },
 });
+
+// schema/user.ts's `read_users_email_unique` (+ its generated `_bidx`
+// pendant) is the actual race-safety net behind the pre-flight check
+// above — a losing concurrent create surfaces here as a generic
+// UniqueViolationError (framework F8 pg-23505 mapping). Only the email
+// constraint gets remapped; any other unique_violation on this entity
+// passes through unchanged.
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function constraintNameOf(error: WriteErrorInfo): string | undefined {
+  if (!isRecord(error.details)) return undefined;
+  const constraintName = error.details["constraintName"];
+  return typeof constraintName === "string" ? constraintName : undefined;
+}
+
+function isEmailUniqueViolation(error: WriteErrorInfo): boolean {
+  return (
+    error.code === "unique_violation" &&
+    (constraintNameOf(error)?.startsWith("read_users_email_unique") ?? false)
+  );
+}

package/src/user/i18n.ts

@@ -1,21 +1,38 @@
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const USER_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:user-list.title": { de: "Benutzer", en: "Users" },
-  "screen:user-edit.title": { de: "Benutzer bearbeiten", en: "Edit user" },
-  "user:entity:user:field:email": { de: "E-Mail", en: "Email" },
-  "user:entity:user:field:displayName": { de: "Anzeigename", en: "Display name" },
-  "user:entity:user:field:status": { de: "Status", en: "Status" },
-  "user:entity:user:field:emailVerified": { de: "E-Mail bestätigt", en: "Email verified" },
-  "user:entity:user:field:locale": { de: "Sprache", en: "Locale" },
-  "user:entity:user:field:timezone": { de: "Zeitzone", en: "Timezone" },
-  "user:entity:user:field:status:option:active": { de: "Aktiv", en: "Active" },
-  "user:entity:user:field:status:option:restricted": { de: "Eingeschränkt", en: "Restricted" },
+  "screen:user-list.title": { de: "Benutzer", en: "Users", es: "Usuarios" },
+  "screen:user-edit.title": { de: "Benutzer bearbeiten", en: "Edit user", es: "Editar usuario" },
+  "user:entity:user:field:email": { de: "E-Mail", en: "Email", es: "Correo electrónico" },
+  "user:entity:user:field:displayName": {
+    de: "Anzeigename",
+    en: "Display name",
+    es: "Nombre para mostrar",
+  },
+  "user:entity:user:field:status": { de: "Status", en: "Status", es: "Estado" },
+  "user:entity:user:field:emailVerified": {
+    de: "E-Mail bestätigt",
+    en: "Email verified",
+    es: "Correo verificado",
+  },
+  "user:entity:user:field:locale": { de: "Sprache", en: "Locale", es: "Idioma" },
+  "user:entity:user:field:timezone": { de: "Zeitzone", en: "Timezone", es: "Zona horaria" },
+  "user:entity:user:field:status:option:active": { de: "Aktiv", en: "Active", es: "Activo" },
+  "user:entity:user:field:status:option:restricted": {
+    de: "Eingeschränkt",
+    en: "Restricted",
+    es: "Restringido",
+  },
   "user:entity:user:field:status:option:deletionRequested": {
     de: "Löschung angefordert",
     en: "Deletion requested",
+    es: "Eliminación solicitada",
+  },
+  "user:entity:user:field:status:option:deleted": {
+    de: "Gelöscht",
+    en: "Deleted",
+    es: "Eliminado",
   },
-  "user:entity:user:field:status:option:deleted": { de: "Gelöscht", en: "Deleted" },
-  "user:entity:user:field:emailVerified:option:true": { de: "Ja", en: "Yes" },
-  "user:entity:user:field:emailVerified:option:false": { de: "Nein", en: "No" },
+  "user:entity:user:field:emailVerified:option:true": { de: "Ja", en: "Yes", es: "Sí" },
+  "user:entity:user:field:emailVerified:option:false": { de: "Nein", en: "No", es: "No" },
 };

package/src/user/schema/user.ts

@@ -169,6 +169,17 @@ export const userEntity = createEntity({
       access: { write: access.privileged },
     }),
   },
+  // fw#2134 — email is `pii: true, lookupable: true`, so the column holds
+  // per-row ciphertext: a plain unique index on it can't catch duplicates.
+  // `unique: true` over a lookupable column makes buildEntityTable /
+  // deriveEntityTableMeta emit a second, partial unique index over the
+  // deterministic `emailBidx` companion column (WHERE email_bidx IS NOT
+  // NULL — erased/key-less rows stay excluded), which is what actually
+  // closes the TOCTOU race between two concurrent user:create calls.
+  // Global (not tenant-scoped): user is a tenant-agnostic identity
+  // aggregate (systemStream: true) — a composite (tenantId, email) would
+  // leave the same email resolvable twice.
+  indexes: [{ columns: ["email"], unique: true, name: "read_users_email_unique" }],
 });
 
 export const userTable = buildEntityTable("user", userEntity);

package/src/user-data-rights/i18n.ts

@@ -1,40 +1,88 @@
 // @runtime client
 // Server + client i18n for user-data-rights (operator screens + nav). Pure
 // data, importable from the web bundle (web/i18n.ts derives the client keys).
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const USER_DATA_RIGHTS_I18N: Readonly<Record<string, LocalizedString>> = {
-  "user-data-rights:nav.exportJobs": { de: "DSGVO-Exporte", en: "GDPR exports" },
-  "screen:export-job-list.title": { de: "DSGVO-Exporte", en: "GDPR exports" },
-  "screen:export-job-detail.title": { de: "Export-Job", en: "Export job" },
-  "screen:download-attempt-list.title": { de: "Download-Versuche", en: "Download attempts" },
-  "screen:privacy-center.title": { de: "Datenschutz", en: "Privacy" },
-  "user-data-rights:entity:export-job:field:userId": { de: "Benutzer", en: "User" },
-  "user-data-rights:entity:export-job:field:status": { de: "Status", en: "Status" },
-  "user-data-rights:entity:export-job:field:requestedAt": { de: "Angefordert", en: "Requested" },
-  "user-data-rights:entity:export-job:field:completedAt": { de: "Abgeschlossen", en: "Completed" },
-  "user-data-rights:entity:export-job:field:expiresAt": { de: "Läuft ab", en: "Expires" },
+  "user-data-rights:nav.exportJobs": {
+    de: "DSGVO-Exporte",
+    en: "GDPR exports",
+    es: "Exportaciones RGPD",
+  },
+  "screen:export-job-list.title": {
+    de: "DSGVO-Exporte",
+    en: "GDPR exports",
+    es: "Exportaciones RGPD",
+  },
+  "screen:export-job-detail.title": {
+    de: "Export-Job",
+    en: "Export job",
+    es: "Trabajo de exportación",
+  },
+  "screen:download-attempt-list.title": {
+    de: "Download-Versuche",
+    en: "Download attempts",
+    es: "Intentos de descarga",
+  },
+  "screen:privacy-center.title": { de: "Datenschutz", en: "Privacy", es: "Privacidad" },
+  "user-data-rights:entity:export-job:field:userId": { de: "Benutzer", en: "User", es: "Usuario" },
+  "user-data-rights:entity:export-job:field:status": { de: "Status", en: "Status", es: "Estado" },
+  "user-data-rights:entity:export-job:field:requestedAt": {
+    de: "Angefordert",
+    en: "Requested",
+    es: "Solicitado",
+  },
+  "user-data-rights:entity:export-job:field:completedAt": {
+    de: "Abgeschlossen",
+    en: "Completed",
+    es: "Completado",
+  },
+  "user-data-rights:entity:export-job:field:expiresAt": {
+    de: "Läuft ab",
+    en: "Expires",
+    es: "Caduca",
+  },
   "user-data-rights:entity:export-job:field:requestedFromTenantId": {
     de: "Mandant",
     en: "Tenant",
+    es: "Organización",
+  },
+  "user-data-rights:entity:export-job:field:startedAt": {
+    de: "Gestartet",
+    en: "Started",
+    es: "Iniciado",
   },
-  "user-data-rights:entity:export-job:field:startedAt": { de: "Gestartet", en: "Started" },
   "user-data-rights:entity:export-job:field:downloadStorageKey": {
     de: "Speicher-Schlüssel",
     en: "Storage key",
+    es: "Clave de almacenamiento",
+  },
+  "user-data-rights:entity:export-job:field:bytesWritten": {
+    de: "Bytes",
+    en: "Bytes",
+    es: "Bytes",
+  },
+  "user-data-rights:entity:export-job:field:errorMessage": {
+    de: "Fehler",
+    en: "Error",
+    es: "Error",
   },
-  "user-data-rights:entity:export-job:field:bytesWritten": { de: "Bytes", en: "Bytes" },
-  "user-data-rights:entity:export-job:field:errorMessage": { de: "Fehler", en: "Error" },
   "user-data-rights:entity:download-attempt:field:attemptedAt": {
     de: "Zeitpunkt",
     en: "Attempted at",
+    es: "Fecha y hora",
+  },
+  "user-data-rights:entity:download-attempt:field:result": {
+    de: "Ergebnis",
+    en: "Result",
+    es: "Resultado",
   },
-  "user-data-rights:entity:download-attempt:field:result": { de: "Ergebnis", en: "Result" },
-  "user-data-rights:entity:download-attempt:field:via": { de: "Via", en: "Via" },
-  "user-data-rights:entity:download-attempt:field:ip": { de: "IP", en: "IP" },
+  "user-data-rights:entity:download-attempt:field:via": { de: "Via", en: "Via", es: "Vía" },
+  "user-data-rights:entity:download-attempt:field:ip": { de: "IP", en: "IP", es: "IP" },
   "user-data-rights:entity:download-attempt:field:attemptedByUserId": {
     de: "Benutzer",
     en: "User",
+    es: "Usuario",
   },
-  "user-data-rights:entity:download-attempt:field:jobId": { de: "Job", en: "Job" },
+  "user-data-rights:entity:download-attempt:field:jobId": { de: "Job", en: "Job", es: "Trabajo" },
 };

package/src/user-data-rights/web/i18n.ts

@@ -7,7 +7,7 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import { USER_DATA_RIGHTS_I18N } from "../i18n";
 
-const LOCALES = ["de", "en"] as const;
+const LOCALES = ["de", "en", "es"] as const;
 
 // Operator keys (export-job list/detail titles + entity field labels + nav)
 // live in the server i18n; the SystemAdmin entityList screens render them
@@ -167,9 +167,78 @@ const apexTranslations: TranslationsByLocale = {
     "userDataRights.errors.download.signedUrlNotSupported":
       "The download is currently unavailable due to a server configuration issue. The operator has been notified.",
   },
+  es: {
+    "userDataRights.deletion.request.title": "Solicitar la eliminación de la cuenta",
+    "userDataRights.deletion.request.intro":
+      "Introduce la dirección de correo de tu cuenta. Si existe una cuenta, te enviaremos un enlace de confirmación para eliminarla.",
+    "userDataRights.deletion.request.email": "Correo electrónico",
+    "userDataRights.deletion.request.submit": "Solicitar enlace de confirmación",
+    "userDataRights.deletion.request.submitting": "…",
+    "userDataRights.deletion.request.successTitle": "Correo enviado",
+    "userDataRights.deletion.request.successBody":
+      "Si el correo existe en nuestro sistema, te hemos enviado un mensaje con un enlace de confirmación. Revisa tu bandeja de entrada.",
+    "userDataRights.deletion.request.error": "Algo salió mal. Inténtalo de nuevo.",
+    "userDataRights.deletion.confirm.title": "Confirmar la eliminación de la cuenta",
+    "userDataRights.deletion.confirm.intro":
+      "Al confirmar se inicia el plazo de eliminación. Hasta que termine, puedes cancelarla iniciando sesión en tu cuenta.",
+    "userDataRights.deletion.confirm.submit": "Confirmar eliminación",
+    "userDataRights.deletion.confirm.submitting": "…",
+    "userDataRights.deletion.confirm.successTitle": "Eliminación programada",
+    "userDataRights.deletion.confirm.successBody":
+      "Tu cuenta se eliminará cuando finalice el plazo. Hasta entonces, puedes cancelar la eliminación iniciando sesión en tu cuenta.",
+    "userDataRights.deletion.confirm.invalidToken":
+      "El enlace no es válido o ha caducado. Solicita uno nuevo.",
+    "userDataRights.deletion.confirm.missingToken":
+      "No se encontró ningún token en el enlace. Abre de nuevo el enlace del correo.",
+    "userDataRights.deletion.confirm.error": "Algo salió mal. Inténtalo de nuevo.",
+
+    "userDataRights.privacyCenter.title": "Privacidad",
+    "userDataRights.privacyCenter.intro":
+      "Gestiona tus derechos según el RGPD: acceso a tus datos, exportación, limitación y eliminación de tu cuenta.",
+    "userDataRights.privacyCenter.loading": "Cargando…",
+    "userDataRights.privacyCenter.loadError": "No se pudieron cargar tus datos.",
+    "userDataRights.privacyCenter.errors.generic": "Algo salió mal. Inténtalo de nuevo.",
+
+    "userDataRights.privacyCenter.export.title": "Exportar datos (art. 20)",
+    "userDataRights.privacyCenter.export.intro":
+      "Solicita una copia de tus datos. Se genera en segundo plano; en cuanto esté lista, podrás descargarla aquí.",
+    "userDataRights.privacyCenter.export.request": "Solicitar exportación de datos",
+    "userDataRights.privacyCenter.export.requesting": "Solicitando…",
+    "userDataRights.privacyCenter.export.pending":
+      "Tu exportación se está generando. Vuelve a comprobarlo más tarde.",
+    "userDataRights.privacyCenter.export.failed":
+      "La última exportación falló. Puedes intentarlo de nuevo.",
+    "userDataRights.privacyCenter.export.ready": "Tu exportación está lista.",
+    "userDataRights.privacyCenter.export.download": "Descargar exportación",
+    "userDataRights.privacyCenter.export.availableUntil": "Disponible hasta {date}",
+    "userDataRights.privacyCenter.export.requestNew": "Solicitar una nueva exportación",
+
+    "userDataRights.privacyCenter.restriction.title": "Limitar el tratamiento (art. 18)",
+    "userDataRights.privacyCenter.restriction.explainer":
+      "Congela tu cuenta: el tratamiento de tus datos se pausa y se cierra tu sesión. Después, solo el soporte puede levantar la limitación.",
+    "userDataRights.privacyCenter.restriction.restrict": "Limitar cuenta",
+    "userDataRights.privacyCenter.restriction.dialogTitle":
+      "¿Seguro que quieres limitar tu cuenta?",
+    "userDataRights.privacyCenter.restriction.dialogDescription":
+      "Se cerrará tu sesión de inmediato y no podrás volver a iniciarla hasta que el soporte levante la limitación.",
+    "userDataRights.privacyCenter.restriction.restricted":
+      "Tu cuenta está limitada. Ponte en contacto con el soporte para levantar la limitación.",
+
+    "userDataRights.privacyCenter.deletion.title": "Eliminar cuenta (art. 17)",
+    "userDataRights.privacyCenter.deletion.explainer":
+      "Solicita la eliminación de tu cuenta. Hasta que finalice el plazo, puedes cancelar la eliminación.",
+    "userDataRights.privacyCenter.deletion.delete": "Eliminar cuenta",
+    "userDataRights.privacyCenter.deletion.requested": "Tu cuenta se eliminará el {date}.",
+    "userDataRights.privacyCenter.deletion.cancel": "Cancelar eliminación",
+    "userDataRights.privacyCenter.deletion.cancelSuccess": "Se ha cancelado la eliminación.",
+    "userDataRights.privacyCenter.deletion.dialogTitle": "¿Seguro que quieres eliminar tu cuenta?",
+    "userDataRights.privacyCenter.deletion.dialogDescription":
+      "Al confirmar se inicia el plazo de eliminación. Puedes cancelarla hasta que finalice.",
+  },
 };
 
 export const defaultTranslations: TranslationsByLocale = {
   de: { ...apexTranslations["de"], ...operatorTranslations["de"] },
   en: { ...apexTranslations["en"], ...operatorTranslations["en"] },
+  es: { ...apexTranslations["es"], ...operatorTranslations["es"] },
 };