@cosmicdrift/kumiko-bundled-features 0.87.3 → 0.89.0

package/src/user-data-rights/__tests__/email-templates.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "bun:test";
+import {
+  renderDeletionExecutedEmail,
+  renderDeletionRequestedEmail,
+  renderExportFailedEmail,
+  renderExportReadyEmail,
+} from "../email-templates";
+
+describe("gdpr email-templates", () => {
+  test("export-ready: subject + download-button + formatted expiry, de/en differ", () => {
+    const en = renderExportReadyEmail({
+      downloadUrl: "https://app.test/export/by-token?token=abc123",
+      expiresAt: "2026-07-01T13:45:00Z",
+      locale: "en",
+      appName: "Acme",
+    });
+    expect(en.subject).toBe("Acme — Your data export is ready");
+    expect(en.html).toContain("https://app.test/export/by-token?token=abc123");
+    // Button label present.
+    expect(en.html).toContain("Download data export");
+    // Instant formatted to UTC, not the raw ISO.
+    expect(en.html).toContain("2026-07-01 13:45 UTC");
+
+    const de = renderExportReadyEmail({
+      downloadUrl: "https://app.test/x?token=abc",
+      expiresAt: "2026-07-01T13:45:00Z",
+      locale: "de",
+      appName: "Acme",
+    });
+    expect(de.subject).toBe("Acme — Dein Datenexport ist bereit");
+    expect(de.subject).not.toBe(en.subject);
+  });
+
+  test("export-ready: ampersand in download url is escaped in the href attr", () => {
+    const r = renderExportReadyEmail({
+      downloadUrl: "https://app.test/x?token=a&next=b",
+      expiresAt: "2026-07-01T13:45:00Z",
+    });
+    // escapeHtmlAttr turns & into & — no raw unescaped attribute break.
+    expect(r.html).toContain("token=a&next=b");
+    expect(r.html).not.toContain('token=a&next="');
+  });
+
+  test("export-ready: default appName when omitted (Account/Konto)", () => {
+    expect(
+      renderExportReadyEmail({ downloadUrl: "u", expiresAt: "x", locale: "en" }).subject,
+    ).toContain("Account");
+    expect(
+      renderExportReadyEmail({ downloadUrl: "u", expiresAt: "x", locale: "de" }).subject,
+    ).toContain("Konto");
+  });
+
+  test("export-failed: informational, no download button", () => {
+    const r = renderExportFailedEmail({ locale: "en", appName: "Acme" });
+    expect(r.subject).toBe("Acme — Your data export failed");
+    expect(r.html).not.toContain("<a ");
+    expect(r.html).toContain("request the export again");
+  });
+
+  test("deletion-requested: grace deadline formatted + cancel hint", () => {
+    const r = renderDeletionRequestedEmail({
+      gracePeriodEnd: "2026-07-30T09:00:00Z",
+      locale: "en",
+      appName: "Acme",
+    });
+    expect(r.subject).toBe("Acme — Account deletion requested");
+    expect(r.html).toContain("2026-07-30 09:00 UTC");
+    expect(r.html).toContain("cancel the deletion");
+  });
+
+  test("deletion-executed: execution timestamp formatted", () => {
+    const r = renderDeletionExecutedEmail({
+      executedAt: "2026-07-30T09:05:00Z",
+      locale: "de",
+      appName: "Acme",
+    });
+    expect(r.subject).toBe("Acme — Dein Konto wurde geloescht");
+    expect(r.html).toContain("2026-07-30 09:05 UTC");
+  });
+
+  test("un-parsable timestamp falls back to the raw string", () => {
+    const r = renderDeletionExecutedEmail({ executedAt: "not-a-date" });
+    expect(r.html).toContain("not-a-date");
+  });
+});

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
+import { createConfigFeature } from "../../config/feature";
+import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createSessionsFeature } from "../../sessions/feature";
+import { createUserFeature } from "../../user/feature";
+import { createUserDataRightsFeature } from "../feature";
+
+// Read-only GDPR inspector screens live IN user-data-rights (the boot-validator
+// forbids cross-feature screen ownership). The validator checks screen structure
+// — entity-local binding, columns/fields exist on the entity, rowAction targets
+// resolve — so a clean boot proves the entityList/entityEdit defs bind to the
+// real event-sourced entities and the convention list/detail QNs exist. The
+// entities (export-job, download-attempt) are r.entity, not direct-write stores,
+// so an entityList binding is rebuild-safe (unlike jobs/sessions read-models).
+
+describe("user-data-rights read-only inspector screens", () => {
+  const features = [
+    createConfigFeature(),
+    createUserFeature(),
+    createSessionsFeature(),
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createUserDataRightsFeature(),
+  ];
+
+  test("the assembled feature set boot-validates", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("ships SystemAdmin-gated list + detail screens", () => {
+    const f = createUserDataRightsFeature();
+    expect(Object.keys(f.screens)).toEqual(
+      expect.arrayContaining(["export-job-list", "export-job-detail", "download-attempt-list"]),
+    );
+    const list = f.screens["export-job-list"];
+    expect(list?.type).toBe("entityList");
+    expect(list?.access).toEqual({ roles: ["SystemAdmin"] });
+  });
+
+  test("export-job detail is strictly read-only (no create/delete, every field readOnly)", () => {
+    const f = createUserDataRightsFeature();
+    const edit = f.screens["export-job-detail"];
+    expect(edit?.type).toBe("entityEdit");
+    if (edit?.type === "entityEdit") {
+      expect(edit.allowCreate).toBe(false);
+      expect(edit.allowDelete).toBe(false);
+      const fields = edit.layout.sections.flatMap((s) => ("fields" in s ? s.fields : []));
+      expect(fields.length).toBeGreaterThan(0);
+      expect(fields.every((field) => typeof field === "object" && field.readOnly === true)).toBe(
+        true,
+      );
+    }
+  });
+
+  test("convention list/detail handlers resolve the screen QNs", () => {
+    const f = createUserDataRightsFeature();
+    // entityList → user-data-rights:query:export-job:list; entityEdit detail →
+    // :export-job:detail; download-attempt list → :download-attempt:list.
+    expect(Object.keys(f.queryHandlers)).toEqual(
+      expect.arrayContaining(["export-job:list", "export-job:detail", "download-attempt:list"]),
+    );
+  });
+});

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -0,0 +1,154 @@
+// C6 Autonomie-Beweis: mountet user-data-rights OHNE send*Email-Opts +
+// mail-foundation + mail-transport-inmemory, und treibt den ECHTEN
+// registrierten Forget-Cron durch einen echten Job-Kontext — `configResolver`
+// gesetzt (App-Override provider=inmemory), KEIN per-request `config`.
+//
+// Das beweist die kritische Naht: der Cron baut den per-Tenant-Mail-Transport
+// aus `ctx.configResolver` (makeTenantMailTransportResolver). Ein hand-
+// gefuetterter Callback oder Fake-Resolver wuerde genau diese Bruecke
+// ueberspringen (vgl. project_export_cron_config_accessor_fix). Akzeptanz von
+// #624: "App mountet mail-foundation+transport → GDPR-Mails ohne Callback-Code".
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { configValuesTable, createConfigFeature, createConfigResolver } from "../../config";
+import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
+import { createFilesFeature } from "../../files";
+import { mailFoundationFeature } from "../../mail-foundation";
+import { clearInbox, getInbox, mailTransportInMemoryFeature } from "../../mail-transport-inmemory";
+import { createSessionsFeature } from "../../sessions";
+import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
+import { createUserDataRightsFeature } from "../feature";
+
+const TENANT_A = "00000000-0000-4000-8000-0000000006a1";
+const TENANT_SYSTEM = "00000000-0000-4000-8000-000000000001";
+const USER_ID = "00000000-0000-4000-8000-0000000006b1";
+const ORIGINAL_EMAIL = "bridge-delete@example.test";
+const FORGET_JOB = "user-data-rights:job:run-forget-cleanup";
+
+// App-weiter Override (wie money-horse's Config-Resolver): provider=inmemory
+// ohne per-Tenant-config-Row. Der Job-Kontext traegt DIESEN resolver, kein config.
+const configResolver = createConfigResolver({
+  appOverrides: new Map([["mail-foundation:config:provider", "inmemory"]]),
+});
+
+let stack: TestStack;
+
+type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
+const past = (): Instant => getTemporal().Instant.fromEpochMilliseconds(Date.now() - 60_000);
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createFilesFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createSessionsFeature(),
+      mailFoundationFeature,
+      mailTransportInMemoryFeature,
+      // KEINE send*Email-Opts — die mail-foundation-Defaults muessen greifen.
+      createUserDataRightsFeature(),
+      createUserDataRightsDefaultsFeature(),
+    ],
+  });
+
+  await unsafePushTables(stack.db, { configValuesTable });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_tenant_memberships (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      user_id TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      is_deleted BOOLEAN NOT NULL DEFAULT false,
+      deleted_at TIMESTAMPTZ,
+      deleted_by_id TEXT,
+      roles TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(user_id, tenant_id)
+    )
+  `);
+  await unsafePushTables(stack.db, { fileRefsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [userTable, "read_tenant_memberships", fileRefsTable]);
+  clearInbox(TENANT_A);
+});
+
+describe("C6 default mail bridge :: forget cron sends deletion-executed without app callback", () => {
+  test("registered cron + configResolver(provider=inmemory) → user deleted + mail in inbox", async () => {
+    await insertOne(stack.db, userTable, {
+      id: USER_ID,
+      tenantId: TENANT_SYSTEM,
+      email: ORIGINAL_EMAIL,
+      passwordHash: "hashed",
+      displayName: "Bridge Delete",
+      locale: "de",
+      emailVerified: true,
+      roles: '["Member"]',
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: past(),
+    });
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO read_tenant_memberships (tenant_id, user_id, roles) VALUES ($1, $2, '["Member"]')`,
+      [TENANT_A, USER_ID],
+    );
+
+    const job = stack.registry.getJob(FORGET_JOB);
+    expect(job).toBeDefined();
+
+    // EXAKT der prod-Job-Kontext: configResolver gesetzt, config undefined.
+    const jobCtx = { db: stack.db, registry: stack.registry, configResolver };
+    await job?.handler({}, jobCtx as never);
+
+    // Loeschung lief autonom durch.
+    const rows = (await asRawClient(stack.db).unsafe(
+      "SELECT status, email FROM read_users WHERE id = $1",
+      [USER_ID],
+    )) as unknown as { rows?: Array<{ status: string; email: string }> };
+    const userRow = (rows.rows ?? (rows as unknown as Array<{ status: string; email: string }>))[0];
+    expect(userRow?.status).toBe(USER_STATUS.Deleted);
+
+    // Die Default-Mail wurde ueber den aus configResolver gebauten inmemory-
+    // Transport versendet — keine App-seitige Callback-Verdrahtung.
+    const inbox = getInbox(TENANT_A);
+    expect(inbox).toHaveLength(1);
+    expect(inbox[0]?.to).toBe(ORIGINAL_EMAIL);
+    // Der User ist mit locale="de" geseedet → die Default-Mail rendert DEUTSCH
+    // (per-recipient locale, KEIN App-Callback). Vorher rendete sie still en —
+    // der Advisor-Befund, den dieser Assert jetzt einfaengt.
+    expect(inbox[0]?.subject).toContain("Dein Konto wurde geloescht");
+    expect(inbox[0]?.html).toContain("endgueltig");
+  });
+
+  test("no mail transport mounted is NOT this stack — sanity: provider really is inmemory", () => {
+    // Pinnt dass der Stack den inmemory-Transport registriert hat (sonst waere
+    // der obige Beweis vacuously true: ohne mailTransport-Usage greift die
+    // Default gar nicht).
+    expect(stack.registry.getExtensionUsages("mailTransport").map((u) => u.entityName)).toContain(
+      "inmemory",
+    );
+  });
+});

package/src/user-data-rights/__tests__/run-export-jobs-cron-context.integration.test.ts

@@ -28,6 +28,8 @@ import { configValuesTable, createConfigFeature, createConfigResolver } from "..
 import { createDataRetentionFeature } from "../../data-retention";
 import { fileFoundationFeature } from "../../file-foundation";
 import { fileProviderInMemoryFeature } from "../../file-provider-inmemory";
+import { mailFoundationFeature } from "../../mail-foundation";
+import { clearInbox, getInbox, mailTransportInMemoryFeature } from "../../mail-transport-inmemory";
 import { createSessionsFeature } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsFeature } from "../feature";
@@ -41,9 +43,14 @@ const JOB_QN = "user-data-rights:job:run-export-jobs";
 // App-weiter Override wie money-horse's cashColtConfigResolver — provider=inmemory
 // ohne per-Tenant-config-Row. Der Job-Kontext trägt DIESEN resolver, kein config.
 const configResolver = createConfigResolver({
-  appOverrides: new Map([["file-foundation:config:provider", "inmemory"]]),
+  appOverrides: new Map([
+    ["file-foundation:config:provider", "inmemory"],
+    ["mail-foundation:config:provider", "inmemory"],
+  ]),
 });
 
+const EXPORT_DOWNLOAD_URL = "https://app.test/user-export/by-token";
+
 let stack: TestStack;
 
 beforeAll(async () => {
@@ -55,8 +62,12 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       fileFoundationFeature,
       fileProviderInMemoryFeature,
+      mailFoundationFeature,
+      mailTransportInMemoryFeature,
       createSessionsFeature(),
-      createUserDataRightsFeature(),
+      // appExportDownloadUrl set → the default export-ready mail is enabled, so
+      // this also proves the export cron's mail bridge end-to-end (C6).
+      createUserDataRightsFeature({ appExportDownloadUrl: EXPORT_DOWNLOAD_URL }),
     ],
   });
   await createEventsTable(stack.db);
@@ -107,6 +118,7 @@ beforeEach(async () => {
   await raw.unsafe(
     `INSERT INTO read_tenant_memberships (tenant_id, user_id, roles) VALUES ('${TENANT}', '${USER_ID}', '["Member"]')`,
   );
+  clearInbox(TENANT);
 });
 
 // Seedet einen pending Export-Job über den echten request-export-Handler.
@@ -144,5 +156,14 @@ describe("run-export-jobs cron-context", () => {
     expect(row?.errorMessage).toBeNull();
     expect(row?.status).toBe(EXPORT_JOB_STATUS.Done);
     expect(row?.bytesWritten ?? 0).toBeGreaterThan(0);
+
+    // C6 — der echte Export-Cron versendet die Default-Export-ready-Mail ueber
+    // den aus configResolver gebauten inmemory-Transport (kein App-Callback).
+    // user.locale="de" → deutsches Subject; downloadUrl traegt den Magic-Link.
+    const inbox = getInbox(TENANT);
+    expect(inbox).toHaveLength(1);
+    expect(inbox[0]?.to).toBe("export-cron@example.test");
+    expect(inbox[0]?.subject).toContain("Dein Datenexport ist bereit");
+    expect(inbox[0]?.html).toContain(EXPORT_DOWNLOAD_URL);
   });
 });

package/src/user-data-rights/email-templates.ts

@@ -0,0 +1,211 @@
+// Default-HTML-Renderer fuer die GDPR-Notification-Mails (Export-bereit,
+// Export-fehlgeschlagen, Loeschung-angefordert, Loeschung-ausgefuehrt).
+// Damit eine App keine eigenen send*Email-Callbacks schreiben muss: sie
+// mountet mail-foundation + einen mail-transport-* und user-data-rights
+// rendert + versendet ueber diese Templates (siehe lib/default-mailers.ts).
+//
+// Apps die ihr eigenes Branding wollen, uebergeben eigene send*Email-Opts —
+// dann greifen diese Defaults nicht. Pattern + plain-inline-HTML gespiegelt
+// von auth-email-password/email-templates.ts (kein CSS-Framework, kein
+// Bild-Asset; Mail-Clients rendern table-layout + inline-CSS verlaesslich).
+//
+// Locale: de + en. Apps mit anderen Sprachen uebergeben eigene Callbacks.
+
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { Temporal } from "temporal-polyfill";
+
+export type GdprMailLocale = "de" | "en";
+
+// user.locale ist Freitext ("de", "en", "de-DE", "fr", null). Die Templates
+// koennen nur de/en — alles andere (inkl. unbekannte Sprachen) faellt auf
+// undefined zurueck, sodass der Caller auf mailDefaults.locale bzw. "en" geht.
+export function normalizeGdprMailLocale(
+  raw: string | null | undefined,
+): GdprMailLocale | undefined {
+  if (!raw) return undefined;
+  const lower = raw.toLowerCase();
+  if (lower.startsWith("de")) return "de";
+  if (lower.startsWith("en")) return "en";
+  return undefined;
+}
+
+export type RenderedEmail = {
+  readonly subject: string;
+  readonly html: string;
+};
+
+export type RenderExportReadyEmailArgs = {
+  readonly downloadUrl: string;
+  readonly expiresAt: string;
+  readonly locale?: GdprMailLocale;
+  readonly appName?: string;
+};
+
+export type RenderExportFailedEmailArgs = {
+  readonly locale?: GdprMailLocale;
+  readonly appName?: string;
+};
+
+export type RenderDeletionRequestedEmailArgs = {
+  readonly gracePeriodEnd: string;
+  readonly locale?: GdprMailLocale;
+  readonly appName?: string;
+};
+
+export type RenderDeletionExecutedEmailArgs = {
+  readonly executedAt: string;
+  readonly locale?: GdprMailLocale;
+  readonly appName?: string;
+};
+
+const STRINGS = {
+  de: {
+    greeting: "Hallo,",
+    exportReadySubject: (app: string) => `${app} — Dein Datenexport ist bereit`,
+    exportReadyIntro: (app: string) =>
+      `dein angeforderter Datenexport fuer ${app} ist fertig. Lade ihn ueber den folgenden Link herunter:`,
+    exportReadyButton: "Datenexport herunterladen",
+    exportReadyExpiry: (when: string) => `Der Download-Link laeuft am ${when} ab.`,
+    exportFailedSubject: (app: string) => `${app} — Dein Datenexport ist fehlgeschlagen`,
+    exportFailedIntro: (app: string) =>
+      `dein angeforderter Datenexport fuer ${app} konnte leider nicht erstellt werden. Bitte fordere den Export erneut an.`,
+    deletionRequestedSubject: (app: string) => `${app} — Loeschung deines Kontos angefordert`,
+    deletionRequestedIntro: (app: string, when: string) =>
+      `wir haben deinen Antrag zur Loeschung deines ${app}-Kontos erhalten. Dein Konto und die zugehoerigen Daten werden am ${when} endgueltig geloescht.`,
+    deletionRequestedCancel:
+      "Falls du das nicht angefordert hast, melde dich an und brich die Loeschung in den Kontoeinstellungen ab, bevor die Frist ablaeuft.",
+    deletionExecutedSubject: (app: string) => `${app} — Dein Konto wurde geloescht`,
+    deletionExecutedIntro: (app: string, when: string) =>
+      `dein ${app}-Konto und die zugehoerigen personenbezogenen Daten wurden am ${when} geloescht. Diese Aktion ist endgueltig.`,
+    fallbackUrl: "Falls der Button nicht funktioniert, kopiere diesen Link in den Browser:",
+  },
+  en: {
+    greeting: "Hi,",
+    exportReadySubject: (app: string) => `${app} — Your data export is ready`,
+    exportReadyIntro: (app: string) =>
+      `your requested data export for ${app} is ready. Download it using the link below:`,
+    exportReadyButton: "Download data export",
+    exportReadyExpiry: (when: string) => `The download link expires on ${when}.`,
+    exportFailedSubject: (app: string) => `${app} — Your data export failed`,
+    exportFailedIntro: (app: string) =>
+      `your requested data export for ${app} could not be created. Please request the export again.`,
+    deletionRequestedSubject: (app: string) => `${app} — Account deletion requested`,
+    deletionRequestedIntro: (app: string, when: string) =>
+      `we received your request to delete your ${app} account. Your account and associated data will be permanently deleted on ${when}.`,
+    deletionRequestedCancel:
+      "If you didn't request this, sign in and cancel the deletion in your account settings before the deadline.",
+    deletionExecutedSubject: (app: string) => `${app} — Your account has been deleted`,
+    deletionExecutedIntro: (app: string, when: string) =>
+      `your ${app} account and the associated personal data were deleted on ${when}. This action is permanent.`,
+    fallbackUrl: "If the button doesn't work, copy this link into your browser:",
+  },
+} as const;
+
+function appNameFor(args: { locale?: GdprMailLocale; appName?: string }): string {
+  const locale = args.locale ?? "en";
+  return args.appName ?? (locale === "de" ? "Konto" : "Account");
+}
+
+export function renderExportReadyEmail(args: RenderExportReadyEmailArgs): RenderedEmail {
+  const locale = args.locale ?? "en";
+  const app = appNameFor(args);
+  const t = STRINGS[locale];
+  const subject = t.exportReadySubject(app);
+  const body = `
+    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
+    <p style="margin: 0 0 24px; font-size: 14px; line-height: 1.5;">${escapeHtml(t.exportReadyIntro(app))}</p>
+    <p style="margin: 0 0 24px;">${renderButton({ url: args.downloadUrl, label: t.exportReadyButton })}</p>
+    <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(t.exportReadyExpiry(formatTimestamp(args.expiresAt)))}</p>
+    ${renderFallbackUrl({ url: args.downloadUrl, label: t.fallbackUrl })}`;
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+}
+
+export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): RenderedEmail {
+  const locale = args.locale ?? "en";
+  const app = appNameFor(args);
+  const t = STRINGS[locale];
+  const subject = t.exportFailedSubject(app);
+  const body = `
+    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
+    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t.exportFailedIntro(app))}</p>`;
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+}
+
+export function renderDeletionRequestedEmail(
+  args: RenderDeletionRequestedEmailArgs,
+): RenderedEmail {
+  const locale = args.locale ?? "en";
+  const app = appNameFor(args);
+  const t = STRINGS[locale];
+  const subject = t.deletionRequestedSubject(app);
+  const body = `
+    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
+    <p style="margin: 0 0 16px; font-size: 14px; line-height: 1.5;">${escapeHtml(t.deletionRequestedIntro(app, formatTimestamp(args.gracePeriodEnd)))}</p>
+    <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(t.deletionRequestedCancel)}</p>`;
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+}
+
+export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArgs): RenderedEmail {
+  const locale = args.locale ?? "en";
+  const app = appNameFor(args);
+  const t = STRINGS[locale];
+  const subject = t.deletionExecutedSubject(app);
+  const body = `
+    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t.greeting)}</p>
+    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t.deletionExecutedIntro(app, formatTimestamp(args.executedAt)))}</p>`;
+  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body) }) };
+}
+
+function wrapCell(bodyHtml: string): string {
+  return `<tr><td>${bodyHtml}</td></tr>`;
+}
+
+// Plain inline-styled HTML — gespiegelt von auth-email-password.
+// guard:dup-ok — Email-HTML (table-layout, inline CSS) ≠ Web-HTML (legal-pages/markdown.ts)
+function renderShell(args: { title: string; bodyHtml: string }): string {
+  return `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${escapeHtml(args.title)}</title>
+  </head>
+  <body style="margin: 0; padding: 0; background: #f7f7f7; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; color: #1a1a1a;">
+    <table width="100%" cellpadding="0" cellspacing="0" style="padding: 24px 0;">
+      <tr>
+        <td align="center">
+          <table width="560" cellpadding="0" cellspacing="0" style="max-width: 560px; background: #ffffff; border-radius: 8px; padding: 32px;">
+            ${args.bodyHtml}
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`;
+}
+
+// guard:dup-ok — Email-HTML-Helper; selbe normalisierte AST-Form wie auth-email-password, verschiedene Semantik
+function renderButton(args: { url: string; label: string }): string {
+  return `<a href="${escapeHtmlAttr(args.url)}" style="display: inline-block; background: #1a1a1a; color: #ffffff; padding: 12px 24px; border-radius: 6px; text-decoration: none; font-weight: 500;">${escapeHtml(args.label)}</a>`;
+}
+
+// guard:dup-ok — Email-HTML-Helper; selbe normalisierte AST-Form wie auth-email-password, verschiedene Semantik
+function renderFallbackUrl(args: { url: string; label: string }): string {
+  return `<p style="margin: 24px 0 0; font-size: 12px; color: #666;">${escapeHtml(args.label)}<br /><a href="${escapeHtmlAttr(args.url)}" style="color: #1a1a1a; word-break: break-all;">${escapeHtml(args.url)}</a></p>`;
+}
+
+// ISO-Timestamp → "2026-05-04 13:45 UTC". Locale-unabhaengig + UTC-Suffix
+// damit der User unabhaengig von seiner Tz sieht wann etwas passiert; bei
+// un-parsbarem Input faellt's auf den raw-string zurueck.
+function formatTimestamp(iso: string): string {
+  try {
+    const z = Temporal.Instant.from(iso).toZonedDateTimeISO("UTC");
+    return `${z.year}-${pad2(z.month)}-${pad2(z.day)} ${pad2(z.hour)}:${pad2(z.minute)} UTC`;
+  } catch {
+    return iso;
+  }
+}
+
+function pad2(n: number): string {
+  return String(n).padStart(2, "0");
+}