@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/user-data-rights/schema/export-job.ts

@@ -0,0 +1,174 @@
+import { buildEntityTable, sql } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createBigIntField,
+  createEntity,
+  createLongTextField,
+  createSelectField,
+  createTextField,
+  createTimestampField,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// Export-Job-Lifecycle (S2.U3+U4 Atom 1).
+//
+// Spec: docs/plans/architecture/user-data-rights.md "Async Export-Pipeline".
+// User triggert `request-export` → ExportJob (status="pending"). Worker
+// pickt auf → "running" → erfolgreich "done" + downloadStorageKey gesetzt
+// + expiresAt = completedAt + compliance-profile.userRights.exportDownloadTtl
+// (per-Tenant-konfigurierbar via Override, Default 7 Tage). Bei Throw
+// oder Stale-Timeout → "failed" mit errorMessage. Stale-Timeout +
+// Storage-Cleanup-Grace ebenfalls aus dem compliance-profile.
+//
+// Status-Werte als Constants — Single source of truth fuer Worker,
+// Application-Code (request-export-Handler), UI-Banner (Polling) und
+// Drift-Guard im Test.
+export const EXPORT_JOB_STATUS = {
+  Pending: "pending",
+  Running: "running",
+  Done: "done",
+  Failed: "failed",
+} as const;
+
+export type ExportJobStatus = (typeof EXPORT_JOB_STATUS)[keyof typeof EXPORT_JOB_STATUS];
+
+/**
+ * DB-Constraint-Name fuer den Partial-UNIQUE-Index (1 aktiver Job pro
+ * User). Single source of truth — request-export.write catched 23505
+ * mit diesem Namen als Race-Schutz, Tests pinnen ihn als
+ * `expectUniqueViolation`-Argument. Rename hier propagiert automatisch.
+ */
+export const ACTIVE_JOB_CONSTRAINT = "read_export_jobs_one_active_per_user";
+
+const EXPORT_JOB_STATUS_OPTIONS = [
+  EXPORT_JOB_STATUS.Pending,
+  EXPORT_JOB_STATUS.Running,
+  EXPORT_JOB_STATUS.Done,
+  EXPORT_JOB_STATUS.Failed,
+] as const;
+
+// **Tenant-agnostic** like userTable — one job per userId across all
+// memberships; the worker iterates cross-tenant via ctx.db.unsafeRaw (same pattern as runForgetCleanup).
+//
+// **Idempotency:** Partial-UNIQUE-Index auf `(userId)` WHERE
+// `status IN ('pending', 'running')`. User mit pending-Job kann keinen
+// zweiten parallelen Job starten — der Insert faellt mit Constraint-
+// Violation auf, der request-export-Handler (Atom 2) faengt das ab und
+// returnt den existing pending-Job (Insert-or-Return). Race-Window
+// null. Done/Failed-Jobs koennen beliebig viele pro User existieren
+// (Audit-Historie).
+//
+// **idType: "uuid"** — Job-IDs reisen ueber Process-Grenzen
+// (BullMQ-Payload, Job-Run-Logger, Audit-Events fuer DPO). Serial-IDs
+// sind nur prozess-lokal verlaesslich, UUIDs cross-process stabil.
+export const exportJobEntity = createEntity({
+  table: "read_export_jobs",
+  idType: "uuid",
+  description:
+    "One user's GDPR Art. 20 data-export request and its lifecycle: who asked, from which tenant, the pending/running/done/failed status, the timestamps, the download storage key and expiry, and any error the export worker hit.",
+
+  fields: {
+    // Tenant-agnostisch: Wert wird beim Schreiben gesetzt (Framework
+    // braucht eine tenant_id-Spalte), domain-mäßig ignoriert.
+    // Kein maxLength — folgt userTable.id + tenantMembershipsTable.userId
+    // (beide ohne maxLength). UserId-Form ist Plattform-Konzern, hier
+    // nur Storage.
+    userId: createTextField({
+      required: true,
+      searchable: true,
+      personal: false,
+      reason: "pseudonymous_fk",
+    }),
+
+    // **requestedFromTenantId** — der Tenant aus dem der User den Antrag
+    // gestellt hat. Persistierter Audit-Pfad fuer den Worker (welches
+    // Compliance-Profile gilt fuer Job-TTL/Stale/Cleanup) — DSGVO-
+    // konsistent: 1 User = 1 effektives Profile pro Antrag, nicht "wechselt
+    // mit jedem Cross-Tenant-Klick". Plan-Doc-Decision: Tenant aus 1. Klick
+    // (Option a). Spalte heisst nicht einfach "tenantId" damit kein
+    // Verwechseln mit der Framework-Auto-Spalte tenant_id.
+    //
+    // **Atom 3b Worker-Hinweis:** Profile-Resolution muss ueber
+    // `requestedFromTenantId` laufen (`queryAs(systemUserOf(requestedFromTenantId),
+    // "compliance-profiles:query:for-tenant", {})`), NICHT ueber
+    // `executor.tenantId` — sonst kriegt ein Job-Pickup aus einem anderen
+    // Tenant-Context ein falsches Profile.
+    requestedFromTenantId: createTextField({
+      required: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
+
+    status: createSelectField({
+      required: true,
+      default: EXPORT_JOB_STATUS.Pending,
+      options: EXPORT_JOB_STATUS_OPTIONS,
+    }),
+
+    // Wann hat der User den Job angefordert. Required — kein Job-Row
+    // entsteht ohne Klick.
+    requestedAt: createTimestampField({
+      required: true,
+      sortable: true,
+    }),
+
+    // Wann hat der Worker mit dem Pickup angefangen. NULL solange
+    // `pending`. Stale-Detection nutzt das +
+    // compliance-profile.userRights.exportStaleTimeoutMinutes.
+    startedAt: createTimestampField({}),
+
+    // Wann hat der Worker abgeschlossen (success oder fail). NULL
+    // solange running.
+    completedAt: createTimestampField({}),
+
+    // Storage-Key des fertigen ZIP-Files. NULL solange nicht `done`.
+    // Worker setzt das + die ZIP-Bytes via storage-provider.write(key).
+    // Dies ist KEIN signed-URL — der Download-Endpoint generiert den
+    // signed-URL on demand vom Storage-Provider (Atom 4).
+    downloadStorageKey: createTextField({
+      maxLength: 500,
+      personal: false,
+      reason: "technical_reference",
+    }),
+
+    // Ab wann ist der Download nicht mehr abrufbar. Worker setzt
+    // `completedAt + compliance-profile.userRights.exportDownloadTtl`
+    // beim Flip auf `done`. NULL fuer pending/running/failed.
+    //
+    // Storage-Cleanup-Pflicht: Worker laesst nach
+    // `expiresAt + compliance-profile.userRights.exportStorageCleanupGraceHours`
+    // einen separaten Pass loeschen damit abgelaufene ZIPs nicht auf S3
+    // verbleiben.
+    expiresAt: createTimestampField({}),
+
+    // Failed-state diagnostics. longText because hook errors with stack
+    // traces can run several KB. `reason: "is_business_data"` because
+    // job status is publicly visible in UI polling (no PII).
+    errorMessage: createLongTextField({
+      personal: false,
+      reason: "is_business_data",
+    }),
+
+    // Audit-Info fuer Operator: wie gross war der Export. Hilft beim
+    // Capacity-Planning + erkennt pathologische Cases (Streaming-ZIP
+    // mit 5 GB Files schreibt mehrere Mrd Bytes, integer-Overflow waere
+    // silent + Audit-Drift).
+    //
+    // bigInt liefert JS-`number` Round-trip via mode:"number" — sicher
+    // bis 2^53 ≈ 9 PB, JSON-tauglich fuer das Status-Polling.
+    bytesWritten: createBigIntField({}),
+  },
+
+  // Partial-UNIQUE-Index: nur 1 aktiver Job pro User, Done/Failed-
+  // Historie ist unbeschraenkt. request-export.write nutzt App-side-
+  // Pre-Check als primaeren Pfad + 23505-Catch dieser Constraint als
+  // Race-Schutz fuer das <1ms-Window zwischen fetchOne + crud.create.
+  indexes: [
+    {
+      unique: true,
+      columns: ["userId"],
+      name: ACTIVE_JOB_CONSTRAINT,
+      where: sql`status IN ('pending', 'running')`,
+    },
+  ],
+});
+
+export const exportJobsTable = buildEntityTable("exportJob", exportJobEntity);

package/packages/bundled-features/src/user-data-rights/screens.ts

@@ -0,0 +1,77 @@
+import {
+  access,
+  type EntityEditScreenDefinition,
+  type EntityListScreenDefinition,
+  i18nKey,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// Read-only operator inspector for the GDPR data-rights read-models. All
+// screens are SystemAdmin-gated and inert until an app navs them — the feature
+// only registers them, the app opts in per screen via r.nav (see the
+// mount-inspector-screens guide). The entities are event-sourced r.entity rows,
+// so binding entityList/entityEdit to them is safe (no direct-write rebuild
+// hazard like jobs/sessions).
+
+// Read-only field shorthand for the detail screens — every field is display-only.
+const ro = (field: string) => ({ field, readOnly: true });
+
+export const exportJobListScreen: EntityListScreenDefinition = {
+  id: "export-job-list",
+  type: "entityList",
+  entity: "export-job",
+  columns: ["userId", "status", "requestedAt", "completedAt", "expiresAt"],
+  rowActions: [
+    {
+      kind: "navigate",
+      id: "view",
+      label: i18nKey("kumiko.actions.view"),
+      screen: "export-job-detail",
+      entityId: "id",
+    },
+  ],
+  defaultSort: { field: "requestedAt", dir: "desc" },
+  searchable: true,
+  access: { roles: access.systemAdmin },
+};
+
+export const exportJobDetailScreen: EntityEditScreenDefinition = {
+  id: "export-job-detail",
+  type: "entityEdit",
+  entity: "export-job",
+  layout: {
+    sections: [
+      {
+        columns: 2,
+        fields: [
+          ro("userId"),
+          ro("requestedFromTenantId"),
+          ro("status"),
+          ro("requestedAt"),
+          ro("startedAt"),
+          ro("completedAt"),
+          ro("expiresAt"),
+          ro("downloadStorageKey"),
+          ro("bytesWritten"),
+          ro("errorMessage"),
+        ],
+      },
+    ],
+  },
+  // Inspector is strictly read-only: no export-job:create/update/delete handler
+  // exists, and the export lifecycle is driven by the worker, not an operator.
+  allowCreate: false,
+  allowDelete: false,
+  access: { roles: access.systemAdmin },
+};
+
+export const downloadAttemptListScreen: EntityListScreenDefinition = {
+  id: "download-attempt-list",
+  type: "entityList",
+  entity: "download-attempt",
+  columns: ["attemptedAt", "result", "via", "ip", "attemptedByUserId", "jobId"],
+  searchable: false,
+  access: { roles: access.systemAdmin },
+  // Inert until an app navs it (see file header) — no nav area to resolve
+  // in isolation.
+  dormant: true,
+};

package/packages/bundled-features/src/user-data-rights/token-helpers.ts

@@ -0,0 +1,67 @@
+// Download-Token-Helper (S2.U3 Atom 4a).
+//
+// Generiert ein kryptographisch-sicheres Token zur Authorisierung des
+// Export-ZIP-Downloads. Pattern matched Magic-Link/Bearer-Token mit DB-
+// gespeichertem Hash:
+//
+//   1. Worker generiert plain-Token (32 byte random base64url) + Hash
+//      (SHA256 hex).
+//   2. DB speichert NUR den Hash. Plain bleibt im Worker-Memory.
+//   3. Atom 5 (Notification) versendet plain via Email an User.
+//   4. Atom 4b (Download-Endpoint) hashet incoming-Token + vergleicht
+//      mit DB-Hash → konstantes-Zeit-Vergleich gegen timing-attacks.
+//
+// **Multi-use within TTL** (User-Choice 4a-Plan): Token wird NICHT
+// "consumed" beim Download — User kann mehrfach downloaden bis expiresAt.
+// Pattern matched Google-Takeout (7d) + Facebook-Data-Download (4d).
+//
+// **Universal Web-Crypto API:** crypto.getRandomValues + crypto.subtle.digest
+// laeuft in Bun + Node 19+ + Browser identisch — keine plattform-
+// spezifischen Imports (Memory `feedback_universal_deps`).
+
+/**
+ * Generiert ein neues Download-Token. plain wird dem User via Email
+ * zugestellt (Atom 5); hash landet in der Token-DB-Row.
+ *
+ * Token-Format: 32 byte random → base64url-encoded (~43 chars). URL-safe
+ * fuer Magic-Link-Verwendung (kein +/= das URL-encoded werden muesste).
+ */
+export async function generateDownloadToken(): Promise<{
+  readonly plain: string;
+  readonly hash: string;
+}> {
+  const randomBytes = crypto.getRandomValues(new Uint8Array(32));
+  const plain = uint8ArrayToBase64Url(randomBytes);
+  const hash = await hashDownloadToken(plain);
+  return { plain, hash };
+}
+
+/**
+ * Hashed einen plain-Token zu seiner DB-Repraesentation. Verify-Pfad
+ * (Atom 4b's Download-Endpoint): hashed incoming-Token + sucht den Hash
+ * in DB. Konstante-Zeit-String-Vergleich verhindert timing-attacks
+ * (das macht der Caller via `crypto.subtle`-vergleich oder secure-
+ * compare-helper).
+ */
+export async function hashDownloadToken(plain: string): Promise<string> {
+  const encoded = new TextEncoder().encode(plain);
+  const digest = await crypto.subtle.digest("SHA-256", encoded);
+  return uint8ArrayToHex(new Uint8Array(digest));
+}
+
+function uint8ArrayToBase64Url(bytes: Uint8Array): string {
+  // btoa erwartet binary-string. atob/btoa sind universal in Bun + Node + Browser.
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i] as number); // @cast-boundary dynamic-key
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function uint8ArrayToHex(bytes: Uint8Array): string {
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) {
+    out += (bytes[i] as number).toString(16).padStart(2, "0"); // @cast-boundary dynamic-key
+  }
+  return out;
+}

package/packages/bundled-features/src/user-data-rights/web/client-plugin.tsx

@@ -0,0 +1,52 @@
+// @runtime client
+// Client-feature factory for user-data-rights. Provides the ExportSection
+// extension component for the privacy-center screen (registered server-side
+// declaratively as `type: "projectionDetail"`, see feature.ts — restriction
+// and deletion are fields/actions on the screen itself and need no client
+// component) + default translations. Apps wire it in via
+// createKumikoApp({ clientFeatures: [userDataRightsClient()] }); the screen
+// has no own r.nav, the app places it via r.nav.
+//
+// fw#2312: the former `privacyCenter: { showDeletion }` option is gone — a
+// declarative screen is now registered server-side once for all apps, so a
+// client prop can no longer toggle its sections/actions per app. Its
+// replacement is the server-side
+// `UserDataRightsOptions.privacyCenterShowDeletion` (createUserDataRightsFeature,
+// ../feature.ts) — BREAKING, consumers with `showDeletion: false` (e.g.
+// money-horse) must carry the option over at feature setup.
+
+import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import { EXPORT_SECTION_EXTENSION_NAME, USER_DATA_RIGHTS_FEATURE } from "../constants.js";
+import { defaultTranslations } from "./i18n.js";
+import { ExportSection } from "./privacy-center-screen.js";
+import { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.js";
+
+export type UserDataRightsClientOptions = {
+  /** Key-weise Overrides über die Default-Bundles (de/en). */
+  readonly translations?: TranslationsByLocale;
+  /** Wenn gesetzt: registriert die anonymen (login-freien) Lösch-Screens als
+   *  Gate auf den angegebenen Pfaden. Weglassen → nur der eingeloggte
+   *  privacy-center-Screen. Den Client VOR dem Auth-Client listen, sonst
+   *  landet der anonyme Besucher auf der Login-Maske. */
+  readonly publicDeletion?: PublicDeletionRoutes;
+};
+
+export function userDataRightsClient(
+  options?: UserDataRightsClientOptions,
+): ClientFeatureDefinition {
+  const base: ClientFeatureDefinition = {
+    name: USER_DATA_RIGHTS_FEATURE,
+    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+    extensionSectionComponents: {
+      [EXPORT_SECTION_EXTENSION_NAME]: ExportSection,
+    },
+  };
+  if (options?.publicDeletion === undefined) return base;
+  // Extend, not overwrite (570/2) — base.gates is empty today, but a spread
+  // that clobbers it instead of appending would silently drop future gates.
+  return {
+    ...base,
+    gates: [...(base.gates ?? []), makePublicDeletionGate(options.publicDeletion)],
+  };
+}

package/packages/bundled-features/src/user-data-rights/web/confirm-deletion-screen.tsx

@@ -0,0 +1,97 @@
+// @runtime client
+// ConfirmAccountDeletionScreen — anonymer Apex-Screen Schritt 2. Liest das
+// Token aus dem URL-Fragment (`#token=…`, nie an den Server gesendet — landet
+// so nicht in Proxy-/Access-Logs, fw#1554) und dispatcht beim Bestätigen
+// user-data-rights:write:confirm-deletion-by-token → startet die Grace-Period.
+//
+// App mountet den Screen unter der deletionVerifyUrl-Route (z.B.
+// /delete-account/confirm) via createPublicSurface.
+
+import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { type ReactNode, useState } from "react";
+
+const CONFIRM_BY_TOKEN = "user-data-rights:write:confirm-deletion-by-token";
+
+type Phase = "idle" | "submitting" | "success" | "missing" | "invalid" | "error";
+
+function readToken(): string {
+  if (typeof window === "undefined") return "";
+  return new URLSearchParams(window.location.hash.slice(1)).get("token") ?? "";
+}
+
+export type ConfirmAccountDeletionScreenProps = {
+  readonly title?: string;
+};
+
+export function ConfirmAccountDeletionScreen({
+  title,
+}: ConfirmAccountDeletionScreenProps): ReactNode {
+  const t = useTranslation();
+  const dispatcher = useDispatcher();
+  const { Button, Banner, Card } = usePrimitives();
+  const [token] = useState(readToken);
+  const [phase, setPhase] = useState<Phase>(token.length > 0 ? "idle" : "missing");
+
+  const doConfirm = async (): Promise<void> => {
+    setPhase("submitting");
+    try {
+      const res = await dispatcher.write(CONFIRM_BY_TOKEN, { token });
+      setPhase(res.isSuccess ? "success" : "invalid");
+    } catch {
+      setPhase("error");
+    }
+  };
+
+  return (
+    <Card
+      // kumiko-lint-ignore primitives-discipline narrow centered confirmation card, not a screen container
+      className="w-full max-w-sm mx-auto"
+      options={{ padded: false }}
+      slots={{
+        header: (
+          <div className="flex flex-col space-y-1.5 p-6 pb-4">
+            <h1 className="text-xl font-semibold tracking-tight">
+              {title ?? t("userDataRights.deletion.confirm.title")}
+            </h1>
+          </div>
+        ),
+      }}
+    >
+      <div className="p-6 pt-0 flex flex-col gap-4">
+        {phase === "success" ? (
+          <Banner variant="info">
+            <p className="font-medium text-foreground">
+              {t("userDataRights.deletion.confirm.successTitle")}
+            </p>
+            <p className="mt-1">{t("userDataRights.deletion.confirm.successBody")}</p>
+          </Banner>
+        ) : phase === "missing" ? (
+          <Banner variant="error">{t("userDataRights.deletion.confirm.missingToken")}</Banner>
+        ) : (
+          <>
+            <p className="text-sm text-muted-foreground">
+              {t("userDataRights.deletion.confirm.intro")}
+            </p>
+            {phase === "invalid" && (
+              <Banner variant="error">{t("userDataRights.deletion.confirm.invalidToken")}</Banner>
+            )}
+            {phase === "error" && (
+              <Banner variant="error">{t("userDataRights.deletion.confirm.error")}</Banner>
+            )}
+            <Button
+              type="button"
+              variant="danger"
+              loading={phase === "submitting"}
+              disabled={phase === "submitting"}
+              onClick={() => void doConfirm()}
+            >
+              {phase === "submitting"
+                ? t("userDataRights.deletion.confirm.submitting")
+                : t("userDataRights.deletion.confirm.submit")}
+            </Button>
+          </>
+        )}
+      </div>
+    </Card>
+  );
+}

package/packages/bundled-features/src/user-data-rights/web/i18n.ts

@@ -0,0 +1,93 @@
+// @runtime client
+// Default-Bundle für die Apex-Deletion-Screens. Apps hängen es als
+// Fallback-Bundle in den LocaleProvider (createPublicSurface clientFeatures
+// oder direkt) und können einzelne Keys überschreiben. Keys: `userDataRights.
+// deletion.<step>.<slug>`.
+
+import {
+  mergeTranslations,
+  type TranslationsByLocale,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
+import { USER_DATA_RIGHTS_I18N } from "../i18n.js";
+
+const apexTranslations: TranslationsByLocale = {
+  en: {
+    "userDataRights.deletion.request.title": "Request account deletion",
+    "userDataRights.deletion.request.intro":
+      "Enter the email address of your account. If an account exists, we'll send you a confirmation link to delete it.",
+    "userDataRights.deletion.request.email": "Email",
+    "userDataRights.deletion.request.submit": "Request confirmation link",
+    "userDataRights.deletion.request.submitting": "…",
+    "userDataRights.deletion.request.successTitle": "Email sent",
+    "userDataRights.deletion.request.successBody":
+      "If the email exists in our system, a message with a confirmation link is on its way. Please check your inbox.",
+    "userDataRights.deletion.request.error": "Something went wrong. Please try again.",
+    "userDataRights.deletion.confirm.title": "Confirm account deletion",
+    "userDataRights.deletion.confirm.intro":
+      "Confirming starts the deletion grace period. Until it ends you can cancel the deletion from your logged-in account.",
+    "userDataRights.deletion.confirm.submit": "Confirm deletion",
+    "userDataRights.deletion.confirm.submitting": "…",
+    "userDataRights.deletion.confirm.successTitle": "Deletion scheduled",
+    "userDataRights.deletion.confirm.successBody":
+      "Your account will be deleted after the grace period. You can cancel the deletion from your logged-in account until then.",
+    "userDataRights.deletion.confirm.invalidToken":
+      "The link is invalid or expired. Please request a new one.",
+    "userDataRights.deletion.confirm.missingToken":
+      "No token found in the link. Please open the link from the email again.",
+    "userDataRights.deletion.confirm.error": "Something went wrong. Please try again.",
+
+    "userDataRights.privacyCenter.errors.generic": "Something went wrong. Please try again.",
+    "userDataRights.privacyCenter.field.status": "Account status",
+    "userDataRights.privacyCenter.field.gracePeriodEnd": "Scheduled deletion date",
+    "userDataRights.privacyCenter.field.status.option.active": "Active",
+    "userDataRights.privacyCenter.field.status.option.restricted": "Restricted",
+    "userDataRights.privacyCenter.field.status.option.deletionRequested": "Deletion requested",
+    "userDataRights.privacyCenter.field.status.option.deleted": "Deleted",
+
+    "userDataRights.privacyCenter.export.title": "Export your data (Art. 20)",
+    "userDataRights.privacyCenter.export.intro":
+      "Request a copy of your data. It is prepared in the background; once ready you can download it here.",
+    "userDataRights.privacyCenter.export.request": "Request data export",
+    "userDataRights.privacyCenter.export.requesting": "Requesting …",
+    "userDataRights.privacyCenter.export.pending":
+      "Your export is being prepared. Please check back later.",
+    "userDataRights.privacyCenter.export.failed":
+      "The last export failed to build. You can try again.",
+    "userDataRights.privacyCenter.export.ready": "Your export is ready.",
+    "userDataRights.privacyCenter.export.download": "Download export",
+    "userDataRights.privacyCenter.export.availableUntil": "Available until {date}",
+    "userDataRights.privacyCenter.export.requestNew": "Request a new export",
+
+    "userDataRights.privacyCenter.restriction.title": "Restrict processing (Art. 18)",
+    "userDataRights.privacyCenter.restriction.explainer":
+      "Freeze your account: processing of your data is paused and you are signed out. Lifting the restriction afterwards is only possible via support.",
+    "userDataRights.privacyCenter.restriction.restrict": "Restrict account",
+    "userDataRights.privacyCenter.restriction.dialogTitle": "Restrict your account?",
+    "userDataRights.privacyCenter.restriction.dialogDescription":
+      "You will be signed out immediately and cannot sign in again until support lifts the restriction.",
+
+    "userDataRights.privacyCenter.deletion.title": "Delete account (Art. 17)",
+    "userDataRights.privacyCenter.deletion.explainer":
+      "Request deletion of your account. Until the grace period ends you can cancel the deletion.",
+    "userDataRights.privacyCenter.deletion.delete": "Delete account",
+    "userDataRights.privacyCenter.deletion.cancel": "Cancel deletion",
+    "userDataRights.privacyCenter.deletion.dialogTitle": "Delete your account?",
+    "userDataRights.privacyCenter.deletion.dialogDescription":
+      "Confirming starts the deletion grace period. You can cancel the deletion until it ends.",
+
+    "userDataRights.errors.download.notFound":
+      "The download link is invalid or belongs to a different account.",
+    "userDataRights.errors.download.expired":
+      "Your download has expired. Please request a new export.",
+    "userDataRights.errors.download.unavailable":
+      "The export is not yet ready or has failed. Please check the status endpoint.",
+    "userDataRights.errors.download.signedUrlNotSupported":
+      "The download is currently unavailable due to a server configuration issue. The operator has been notified.",
+  },
+};
+
+export const defaultTranslations: TranslationsByLocale = mergeTranslations(
+  translationsByLocaleFromKeys(USER_DATA_RIGHTS_I18N),
+  apexTranslations,
+);

package/packages/bundled-features/src/user-data-rights/web/index.ts

@@ -0,0 +1,15 @@
+// @runtime client
+// Public exports für die Browser-Seite des user-data-rights Features —
+// die anonymen Apex-Deletion-Screens. Konsumiert via Sub-Path-Export
+// `@cosmicdrift/kumiko-bundled-features/user-data-rights/web`. Die Server-
+// Seite (defineFeature, Handler) lebt unter `.../user-data-rights` und hat
+// keine React-/DOM-Deps.
+
+export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.js";
+export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.js";
+export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.js";
+export { defaultTranslations } from "./i18n.js";
+export { formatDate } from "./privacy-center-screen.js";
+export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.js";
+export type { RequestAccountDeletionScreenProps } from "./request-deletion-screen.js";
+export { RequestAccountDeletionScreen } from "./request-deletion-screen.js";