feat(compliance-check): MC-Classification + Embedding + Vendor-Redundanz + Action-Recipes + Borlabs-Features

Massiv-Update auf Basis BMW-Test-Iterationen (v1→v9):

Core Compliance-Check
- Sonnet check_type Klassifikation: text/process/review fuer alle 1874 MCs
  in compliance.doc_check_controls (script + Sidecar /data/mc_classification.db).
  rag_document_checker filtert auf check_type='text' fuer doc_check.
  Plus fits_doc_type-Audit (v2) + ui_only-Audit fuer DSA/E-Commerce-MCs in
  falscher doc_type-Schublade.
- scope_requires-Filter: biometric/ai_decision/child_targeting MCs werden
  per business_profile gefiltert (FRT skipped fuer BMW etc.).
- Embedding-Match (BGE-M3) als Phase-3 nach Regex-Match:
  Per-doc_type-Threshold-Override (impressum 0.50, dse/cookie 0.60),
  Short-Field-Rescue (15-Wort-Chunks) fuer Pflichtfelder im Impressum.
  Title+check_question als Embedding-Input fuer mehr Kontext.
- Cookie-Text-Routing: consent-tester gibt cmp_cookie_text aus dem
  CMP-Reconstruct zurueck, Backend bevorzugt das gegen DOM-Extraction
  wenn richer (BMW 1824 vs 600 Worte).

Vendor-Redundanz + EU-Alternativen + Cost-Saving
- vendor_redundancy.analyze() — funktionale Kategorisierung der CMP-Vendors,
  Detektion von Mehrfach-Anbietern pro Kategorie, EU-Alternative-Lookup
  (Matomo, IONOS, HERE, Friendly Captcha, Smart AdServer, ...).
- vendor_cost_estimator: Tier-Inferenz aus Cookie-Footprint (Cookie-Anzahl
  + Premium-Feature-Cookies + Third-Party-Quote → starter/professional/
  enterprise/premier).
- Self-Service-Werbung (Google/Meta/Pinterest/...) = 0 Lizenz-Kosten
  (nur Media-Spend, separat). DSP-Plattformen behalten enge Range.
- Tier-aware Saving-Range: bei Enterprise/Premier nutzen wir den
  oberen 40-100%-Band der Listpreise, nicht starter→premier.
- Multi-Function-Tools (Matomo Pro, SAP CX, IONOS Cloud, Userlike, Smart
  AdServer, HERE Maps, Vimeo Pro, LamaPoll) — ein Tool ersetzt mehrere
  Kategorien gleichzeitig.

Cookie-Wissens-DB + Funktionale Klassifikation
- cookie_knowledge_db: 50 kuratierte Top-Cookies (Google/Meta/Adobe/MS/...)
  mit vendor, exact_purpose, data_collected, IAB-TCF-IDs, reid_risk,
  schrems_ii_status, EuGH-Urteile, EU-Alternative.
- cookie_function_classifier: pro Cookie funktionale Rolle (tracking_id,
  ad_pixel, session_id, ab_test, csrf, ...) + blocking_impact.

Country-Inferenz aus Rechtsform
- cookie_link_validator: Country-Field wird aus Vendor-Name abgeleitet
  (A/S=DK, GmbH=DE, Inc=US, B.V.=NL, ...) plus Vendor-Lookup-Table.
  Reduziert false-positive no_country-Flags bei eindeutig-EU-Vendors
  (Adform DK, Pinterest IE).

Action-Recipes + Doc-Anchor-Locator
- finding_action_recipes: pro Finding-Typ (no_cookies_listed, no_country,
  broken_opt_out, "Auftragsverarbeiter erwaehnen", "Art. 22 Profiling",
  ...) eine strukturierte Anweisung mit what/why/fix_text/where/example.
  Zum 1:1-Einfuegen in Kunden-Dokumente.
- doc_anchor_locator: Embedding-basiert (BGE-M3 cosine) — sucht den
  passenden Absatz im existierenden Kundendokument fuer jeden Finding.
  Per-Run Thread-Local-Cache. Fallback: keyword-Match.
- Email-Rendering integriert Recipe + Anchor pro Doc-Pruefungs-Fail
  + Vendor-Flag-Liste mit aufklappbarer Action-Liste.
- Score-Erklaerung pro Vendor-Zeile (3/5-Untertitel + Tooltip).

Migration-Pipeline (Compliance-Check -> Customer Banner/Documents)
- migration_to_banner.py: Vendor-Liste -> CookieBannerConfig mit
  4 Kategorien + Review-Flags.
- migration_to_document.py: Vendor-Liste -> Cookie-Policy + VVT-Register
  + Privacy-Policy-Pre-Fills.
- agent_migration_routes: 3 Preview-Endpoints (banner-preview,
  document-preview, summary). Persistierung der cmp_vendors in
  /data/compliance_audits.db check_payloads-Tabelle.

Borlabs-Parity Cookie-Banner-Features
- Consent-Historie im Banner: window.bpShowConsentHistory() + localStorage.
- Content-Blocker: cookie-banner-content-blocker.ts — YouTube/Maps/Video
  Placeholder bis Einwilligung.
- Google Consent Mode v2 erweitert: wait_for_update + region=EEA/CH/GB.
- Consent-Log Export (CSV/JSON) per einwilligungen_export_routes.

Bug-Fixes
- canonical_control_routes: _jsonish-Helper fuer string-typed jsonb,
  similar-controls-Endpoint mit _has_embedding_col()-Cache (kein 500 mehr).
- Control-Library Frontend: defensive .map-Coercer in 2 Detail-Views.
- Embedding-Service-Batching (32er Batches statt 165 in einem Call).
- KeyError 'control_id' in MC-Result-Aggregation (defensive .get).
- Master-Controls-Klick-Through von /sdk/master-controls auf
  /sdk/control-library?control=<id> mit URL-Param-Auto-Open.
- Dockerfile: /data pre-chowned auf appuser (Audit-DB-Schreibrecht).
- Cookie-Text-Routing-Bug (cmp_reconstructed > DOM-extraction).
- doc_type-aware MC-Filter (statt all-text-MCs).
- Master-Contract-Dedup (60 BMW-Internal-Eintraege = 1 Adobe-Vertrag).
- A3-v2-Audit hat 24 UI-Sprache-MCs als 'process' reklassifiziert.

Tests
- test_migration_mappers.py (9 Tests)
- test_migration_endpoints.py (4 Tests)

Skripte (one-shot)
- classify_mc_check_type.py (v1) + _v2 (PK=control_id,doc_type)
- audit_mc_doctype_fit.py (v1 fits) + _v2 (ui_only + scope_requires)

BMW-Run-Bilanz v1 (broken) -> v9 (alle Fixes):
  DSE     7,5% -> 81-83%
  Impressum 4%   -> 100% (6 echte MCs alle erfuellt)
  Cookie  0%    -> 79-83% (CMP-Text-Routing + Embedding)
  Plus: 10 Konsolidierungs-Kategorien, geschaetzte Saving 200k-3M / Jahr
  Plus: Action-Recipes + Doc-Anchors fuer jeden Fail

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-compliance/app/api/sdk/v1/einwilligungen/export/route.ts

@@ -0,0 +1,55 @@
+/**
+ * Proxy: GET /api/sdk/v1/einwilligungen/export?format=csv|json&kind=consents|history
+ *   -> backend /api/compliance/einwilligungen/export/<file>
+ *
+ * Streams the backend response straight through (CSV or JSON download).
+ */
+import { NextRequest, NextResponse } from 'next/server'
+
+const BACKEND_URL = process.env.BACKEND_URL || 'http://backend-compliance:8002'
+
+function getTenantHeader(request: NextRequest): HeadersInit {
+  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+  const clientTenantId = request.headers.get('x-tenant-id') || request.headers.get('X-Tenant-ID')
+  const tenantId = (clientTenantId && uuidRegex.test(clientTenantId))
+    ? clientTenantId
+    : (process.env.DEFAULT_TENANT_ID || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e')
+  return { 'X-Tenant-ID': tenantId }
+}
+
+export async function GET(request: NextRequest) {
+  const { searchParams } = new URL(request.url)
+  const fmt = (searchParams.get('format') || 'csv').toLowerCase()
+  const kind = (searchParams.get('kind') || 'consents').toLowerCase()
+
+  const filename = `${kind}.${fmt === 'json' ? 'json' : 'csv'}`
+  const upstreamPath = `/api/compliance/einwilligungen/export/${filename}`
+
+  const passthroughParams = new URLSearchParams()
+  for (const k of ['user_id', 'granted', 'since', 'consent_id']) {
+    const v = searchParams.get(k)
+    if (v) passthroughParams.set(k, v)
+  }
+  const qs = passthroughParams.toString()
+  const url = `${BACKEND_URL}${upstreamPath}${qs ? `?${qs}` : ''}`
+
+  try {
+    const r = await fetch(url, { headers: getTenantHeader(request) })
+    if (!r.ok) {
+      const text = await r.text()
+      return NextResponse.json({ error: text || `HTTP ${r.status}` }, { status: r.status })
+    }
+    return new NextResponse(r.body, {
+      status: 200,
+      headers: {
+        'Content-Type': r.headers.get('content-type') || 'application/octet-stream',
+        'Content-Disposition': r.headers.get('content-disposition') || `attachment; filename=${filename}`,
+      },
+    })
+  } catch (e) {
+    return NextResponse.json(
+      { error: 'Export-Proxy fehlgeschlagen', detail: String(e) },
+      { status: 503 },
+    )
+  }
+}

admin-compliance/app/sdk/control-library/_components/ControlDetailView.tsx

@@ -8,6 +8,23 @@ import type { CanonicalControl } from '../_types'
 import { EFFORT_LABELS } from '../_types'
 import { SeverityBadge, StateBadge, LicenseRuleBadge } from './Badges'
 
+// Defensive coercers: backend has rows where evidence/requirements/test_procedure/open_anchors
+// are JSON-encoded strings instead of arrays. .map() on a string throws — coerce here.
+function asArray<T = unknown>(v: unknown): T[] {
+  if (Array.isArray(v)) return v as T[]
+  if (typeof v === 'string' && v.trim().startsWith('[')) {
+    try { const p = JSON.parse(v); return Array.isArray(p) ? p : [] } catch { return [] }
+  }
+  return []
+}
+function asStringArray(v: unknown): string[] {
+  return asArray(v).map(x => typeof x === 'string' ? x : JSON.stringify(x))
+}
+type EvidenceItem = string | { type?: string; description?: string }
+function asEvidenceArray(v: unknown): EvidenceItem[] {
+  return asArray<EvidenceItem>(v)
+}
+
 export function ControlDetailView({
   ctrl,
   onBack,
@@ -72,31 +89,31 @@ export function ControlDetailView({
         <section>
           <h3 className="text-sm font-semibold text-gray-900 mb-2">Geltungsbereich</h3>
           <div className="grid grid-cols-3 gap-4">
-            {ctrl.scope.platforms && ctrl.scope.platforms.length > 0 && (
+            {asStringArray(ctrl.scope?.platforms).length > 0 && (
               <div>
                 <p className="text-xs font-medium text-gray-500 mb-1">Plattformen</p>
                 <div className="flex flex-wrap gap-1">
-                  {ctrl.scope.platforms.map(p => (
+                  {asStringArray(ctrl.scope?.platforms).map(p => (
                     <span key={p} className="px-2 py-0.5 bg-blue-50 text-blue-700 rounded text-xs">{p}</span>
                   ))}
                 </div>
               </div>
             )}
-            {ctrl.scope.components && ctrl.scope.components.length > 0 && (
+            {asStringArray(ctrl.scope?.components).length > 0 && (
               <div>
                 <p className="text-xs font-medium text-gray-500 mb-1">Komponenten</p>
                 <div className="flex flex-wrap gap-1">
-                  {ctrl.scope.components.map(c => (
+                  {asStringArray(ctrl.scope?.components).map(c => (
                     <span key={c} className="px-2 py-0.5 bg-purple-50 text-purple-700 rounded text-xs">{c}</span>
                   ))}
                 </div>
               </div>
             )}
-            {ctrl.scope.data_classes && ctrl.scope.data_classes.length > 0 && (
+            {asStringArray(ctrl.scope?.data_classes).length > 0 && (
               <div>
                 <p className="text-xs font-medium text-gray-500 mb-1">Datenklassen</p>
                 <div className="flex flex-wrap gap-1">
-                  {ctrl.scope.data_classes.map(d => (
+                  {asStringArray(ctrl.scope?.data_classes).map(d => (
                     <span key={d} className="px-2 py-0.5 bg-amber-50 text-amber-700 rounded text-xs">{d}</span>
                   ))}
                 </div>
@@ -109,7 +126,7 @@ export function ControlDetailView({
         <section>
           <h3 className="text-sm font-semibold text-gray-900 mb-2">Anforderungen</h3>
           <ol className="space-y-2">
-            {ctrl.requirements.map((req, i) => (
+            {asStringArray(ctrl.requirements).map((req, i) => (
               <li key={i} className="flex items-start gap-2 text-sm text-gray-700">
                 <span className="flex-shrink-0 w-5 h-5 bg-purple-100 text-purple-700 rounded-full flex items-center justify-center text-xs font-medium mt-0.5">{i + 1}</span>
                 {req}
@@ -122,7 +139,7 @@ export function ControlDetailView({
         <section>
           <h3 className="text-sm font-semibold text-gray-900 mb-2">Pruefverfahren</h3>
           <ol className="space-y-2">
-            {ctrl.test_procedure.map((step, i) => (
+            {asStringArray(ctrl.test_procedure).map((step, i) => (
               <li key={i} className="flex items-start gap-2 text-sm text-gray-700">
                 <CheckCircle2 className="w-4 h-4 text-green-500 flex-shrink-0 mt-0.5" />
                 {step}
@@ -135,12 +152,18 @@ export function ControlDetailView({
         <section>
           <h3 className="text-sm font-semibold text-gray-900 mb-2">Nachweisanforderungen</h3>
           <div className="space-y-2">
-            {ctrl.evidence.map((ev, i) => (
+            {asEvidenceArray(ctrl.evidence).map((ev, i) => (
               <div key={i} className="flex items-start gap-2 p-3 bg-gray-50 rounded-lg">
                 <FileText className="w-4 h-4 text-gray-400 flex-shrink-0 mt-0.5" />
                 <div>
-                  <span className="text-xs font-medium text-gray-500 uppercase">{ev.type}</span>
-                  <p className="text-sm text-gray-700">{ev.description}</p>
+                  {typeof ev === 'string' ? (
+                    <p className="text-sm text-gray-700">{ev}</p>
+                  ) : (
+                    <>
+                      {ev.type && <span className="text-xs font-medium text-gray-500 uppercase">{ev.type}</span>}
+                      <p className="text-sm text-gray-700">{ev.description ?? JSON.stringify(ev)}</p>
+                    </>
+                  )}
                 </div>
               </div>
             ))}
@@ -152,13 +175,13 @@ export function ControlDetailView({
           <div className="flex items-center gap-2 mb-3">
             <BookOpen className="w-4 h-4 text-green-700" />
             <h3 className="text-sm font-semibold text-green-900">Open-Source-Referenzen</h3>
-            <span className="text-xs text-green-600">({ctrl.open_anchors.length} Quellen)</span>
+            <span className="text-xs text-green-600">({asArray(ctrl.open_anchors).length} Quellen)</span>
           </div>
           <p className="text-xs text-green-700 mb-3">
             Dieses Control basiert auf frei verfuegbarem Wissen. Alle Referenzen sind offen und oeffentlich zugaenglich.
           </p>
           <div className="space-y-2">
-            {ctrl.open_anchors.map((anchor, i) => (
+            {asArray<{ framework?: string; ref?: string; url?: string }>(ctrl.open_anchors).map((anchor, i) => (
               <div key={i} className="flex items-start gap-3 p-2 bg-white rounded border border-green-100">
                 <Scale className="w-4 h-4 text-green-600 flex-shrink-0 mt-0.5" />
                 <div className="flex-1 min-w-0">
@@ -180,11 +203,11 @@ export function ControlDetailView({
         </section>
 
         {/* Tags */}
-        {ctrl.tags.length > 0 && (
+        {asStringArray(ctrl.tags).length > 0 && (
           <section>
             <h3 className="text-sm font-semibold text-gray-900 mb-2">Tags</h3>
             <div className="flex flex-wrap gap-1.5">
-              {ctrl.tags.map(tag => (
+              {asStringArray(ctrl.tags).map(tag => (
                 <span key={tag} className="px-2 py-1 bg-gray-100 text-gray-600 rounded text-xs">{tag}</span>
               ))}
             </div>

admin-compliance/app/sdk/control-library/components/ControlDetail.tsx

@@ -18,6 +18,16 @@ import { ControlRegulatorySection } from './ControlRegulatorySection'
 import { ControlSimilarControls } from './ControlSimilarControls'
 import { ControlReviewActions } from './ControlReviewActions'
 
+// Defensive coercer: some canonical_controls rows have evidence/tags/etc.
+// as JSON-encoded strings instead of arrays. .map() on a string throws.
+function toArray<T = unknown>(v: unknown): T[] {
+  if (Array.isArray(v)) return v as T[]
+  if (typeof v === 'string' && v.trim().startsWith('[')) {
+    try { const p = JSON.parse(v); return Array.isArray(p) ? p : [] } catch { return [] }
+  }
+  return []
+}
+
 interface SimilarControl {
   control_id: string; title: string; severity: string; release_state: string;
   tags: string[]; license_rule: number | null; verification_method: string | null;
@@ -186,7 +196,7 @@ export function ControlDetail({
         <ControlTraceability ctrl={ctrl} traceability={traceability} loadingTrace={loadingTrace}
           onNavigateToControl={onNavigateToControl} />
 
-        {!ctrl.source_citation && ctrl.open_anchors.length > 0 && (
+        {!ctrl.source_citation && toArray(ctrl.open_anchors).length > 0 && (
           <section className="bg-amber-50 border border-amber-200 rounded-lg p-3">
             <div className="flex items-center gap-2">
               <Scale className="w-4 h-4 text-amber-600" />
@@ -201,36 +211,36 @@ export function ControlDetail({
           </section>
         )}
 
-        {(ctrl.scope.platforms?.length || ctrl.scope.components?.length || ctrl.scope.data_classes?.length) ? (
+        {(toArray(ctrl.scope?.platforms).length || toArray(ctrl.scope?.components).length || toArray(ctrl.scope?.data_classes).length) ? (
           <section>
             <h3 className="text-sm font-semibold text-gray-900 mb-2">Geltungsbereich</h3>
             <div className="grid grid-cols-3 gap-4 text-xs">
-              {ctrl.scope.platforms?.length ? <div><span className="text-gray-500">Plattformen:</span> <span className="text-gray-700">{ctrl.scope.platforms.join(', ')}</span></div> : null}
-              {ctrl.scope.components?.length ? <div><span className="text-gray-500">Komponenten:</span> <span className="text-gray-700">{ctrl.scope.components.join(', ')}</span></div> : null}
-              {ctrl.scope.data_classes?.length ? <div><span className="text-gray-500">Datenklassen:</span> <span className="text-gray-700">{ctrl.scope.data_classes.join(', ')}</span></div> : null}
+              {toArray<string>(ctrl.scope?.platforms).length ? <div><span className="text-gray-500">Plattformen:</span> <span className="text-gray-700">{toArray<string>(ctrl.scope?.platforms).join(', ')}</span></div> : null}
+              {toArray<string>(ctrl.scope?.components).length ? <div><span className="text-gray-500">Komponenten:</span> <span className="text-gray-700">{toArray<string>(ctrl.scope?.components).join(', ')}</span></div> : null}
+              {toArray<string>(ctrl.scope?.data_classes).length ? <div><span className="text-gray-500">Datenklassen:</span> <span className="text-gray-700">{toArray<string>(ctrl.scope?.data_classes).join(', ')}</span></div> : null}
             </div>
           </section>
         ) : null}
 
-        {Array.isArray(ctrl.requirements) && ctrl.requirements.length > 0 && (
+        {toArray<string>(ctrl.requirements).length > 0 && (
           <section>
             <h3 className="text-sm font-semibold text-gray-900 mb-2">Anforderungen</h3>
-            <ol className="list-decimal list-inside space-y-1">{ctrl.requirements.map((r, i) => <li key={i} className="text-sm text-gray-700">{r}</li>)}</ol>
+            <ol className="list-decimal list-inside space-y-1">{toArray<string>(ctrl.requirements).map((r, i) => <li key={i} className="text-sm text-gray-700">{r}</li>)}</ol>
           </section>
         )}
 
-        {Array.isArray(ctrl.test_procedure) && ctrl.test_procedure.length > 0 && (
+        {toArray<string>(ctrl.test_procedure).length > 0 && (
           <section>
             <h3 className="text-sm font-semibold text-gray-900 mb-2">Pruefverfahren</h3>
-            <ol className="list-decimal list-inside space-y-1">{ctrl.test_procedure.map((s, i) => <li key={i} className="text-sm text-gray-700">{s}</li>)}</ol>
+            <ol className="list-decimal list-inside space-y-1">{toArray<string>(ctrl.test_procedure).map((s, i) => <li key={i} className="text-sm text-gray-700">{s}</li>)}</ol>
           </section>
         )}
 
-        {ctrl.evidence.length > 0 && (
+        {toArray(ctrl.evidence).length > 0 && (
           <section>
             <h3 className="text-sm font-semibold text-gray-900 mb-2">Nachweise</h3>
             <div className="space-y-2">
-              {ctrl.evidence.map((ev, i) => (
+              {toArray<string | { type?: string; description?: string }>(ctrl.evidence).map((ev, i) => (
                 <div key={i} className="flex items-start gap-2 text-sm text-gray-700">
                   <FileText className="w-4 h-4 text-gray-400 flex-shrink-0 mt-0.5" />
                   {typeof ev === 'string' ? <div>{ev}</div> : <div><span className="font-medium">{ev.type}:</span> {ev.description}</div>}
@@ -243,9 +253,9 @@ export function ControlDetail({
         <section className="grid grid-cols-3 gap-4 text-xs text-gray-500">
           {ctrl.risk_score !== null && <div>Risiko-Score: <span className="text-gray-700 font-medium">{ctrl.risk_score}</span></div>}
           {ctrl.implementation_effort && <div>Aufwand: <span className="text-gray-700 font-medium">{EFFORT_LABELS[ctrl.implementation_effort] || ctrl.implementation_effort}</span></div>}
-          {ctrl.tags.length > 0 && (
+          {toArray<string>(ctrl.tags).length > 0 && (
             <div className="col-span-3 flex items-center gap-1 flex-wrap">
-              {ctrl.tags.map(t => <span key={t} className="px-2 py-0.5 bg-gray-100 text-gray-600 rounded text-xs">{t}</span>)}
+              {toArray<string>(ctrl.tags).map(t => <span key={t} className="px-2 py-0.5 bg-gray-100 text-gray-600 rounded text-xs">{t}</span>)}
             </div>
           )}
         </section>
@@ -253,11 +263,11 @@ export function ControlDetail({
         <section className="bg-green-50 border border-green-200 rounded-lg p-4">
           <div className="flex items-center gap-2 mb-3">
             <BookOpen className="w-4 h-4 text-green-700" />
-            <h3 className="text-sm font-semibold text-green-900">Open-Source-Referenzen ({ctrl.open_anchors.length})</h3>
+            <h3 className="text-sm font-semibold text-green-900">Open-Source-Referenzen ({toArray(ctrl.open_anchors).length})</h3>
           </div>
-          {ctrl.open_anchors.length > 0 ? (
+          {toArray(ctrl.open_anchors).length > 0 ? (
             <div className="space-y-2">
-              {ctrl.open_anchors.map((anchor, i) => (
+              {toArray<{ framework?: string; ref?: string; url?: string }>(ctrl.open_anchors).map((anchor, i) => (
                 <div key={i} className="flex items-center gap-2 text-sm">
                   <ExternalLink className="w-3.5 h-3.5 text-green-600 flex-shrink-0" />
                   <span className="font-medium text-green-800">{anchor.framework}</span>

admin-compliance/app/sdk/control-library/page.tsx

@@ -1,5 +1,7 @@
 'use client'
 
+import { useEffect } from 'react'
+import { useSearchParams } from 'next/navigation'
 import { EMPTY_CONTROL } from './components/helpers'
 import { ControlForm } from './components/ControlForm'
 import { ControlDetail } from './components/ControlDetail'
@@ -12,6 +14,24 @@ import { BACKEND_URL } from './components/helpers'
 
 export default function ControlLibraryPage() {
   const state = useControlLibraryState()
+  const searchParams = useSearchParams()
+
+  // Deep-link via /sdk/control-library?control=<id>
+  // — e.g. from /sdk/master-controls member list.
+  useEffect(() => {
+    const cid = searchParams?.get('control')
+    if (!cid || state.selectedControl?.control_id === cid) return
+    fetch(`${BACKEND_URL}?endpoint=control&id=${encodeURIComponent(cid)}`)
+      .then(r => r.ok ? r.json() : null)
+      .then(ctrl => {
+        if (ctrl?.control_id) {
+          state.setSelectedControl(ctrl)
+          state.setMode('detail')
+        }
+      })
+      .catch(() => { /* user just sees the list */ })
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [searchParams])
 
   const {
     handleCreate, handleUpdate, handleDelete, handleReview, handleBulkReject,

admin-compliance/app/sdk/einwilligungen/page.tsx

@@ -57,12 +57,7 @@ export default function EinwilligungenPage() {
         explanation={stepInfo.explanation}
         tips={stepInfo.tips}
       >
-        <button className="flex items-center gap-2 px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors">
-          <svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-            <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4" />
-          </svg>
-          Export
-        </button>
+        <ConsentExportButton />
       </StepHeader>
 
       {/* Navigation Tabs */}
@@ -150,3 +145,32 @@ export default function EinwilligungenPage() {
     </div>
   )
 }
+
+// Export-Dropdown im Step-Header. Streamt CSV/JSON direkt aus dem
+// Backend via /api/sdk/v1/einwilligungen/export-Proxy.
+function ConsentExportButton() {
+  return (
+    <div className="relative group">
+      <button className="flex items-center gap-2 px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors">
+        <svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4" />
+        </svg>
+        Export
+      </button>
+      <div className="absolute right-0 top-full mt-1 w-60 bg-white border border-gray-200 rounded-lg shadow-lg invisible group-hover:visible opacity-0 group-hover:opacity-100 transition-all z-10">
+        <a href="/api/sdk/v1/einwilligungen/export?format=csv&kind=consents" download
+           className="block px-4 py-2 text-sm text-gray-700 hover:bg-purple-50 first:rounded-t-lg">
+          Einwilligungen als CSV
+        </a>
+        <a href="/api/sdk/v1/einwilligungen/export?format=json&kind=consents" download
+           className="block px-4 py-2 text-sm text-gray-700 hover:bg-purple-50">
+          Einwilligungen als JSON
+        </a>
+        <a href="/api/sdk/v1/einwilligungen/export?format=csv&kind=history" download
+           className="block px-4 py-2 text-sm text-gray-700 hover:bg-purple-50 last:rounded-b-lg border-t border-gray-100">
+          Aenderungs-Historie als CSV
+        </a>
+      </div>
+    </div>
+  )
+}

admin-compliance/app/sdk/master-controls/page.tsx

@@ -199,32 +199,43 @@ function MCDetail({ mc, onBack }: { mc: Record<string, unknown>; onBack: () => v
           </div>
         ) : (
           <div className="divide-y divide-gray-50">
-            {filtered.map((m, i) => (
-              <div key={i} className="px-4 py-3 hover:bg-gray-50">
-                <div className="flex items-center gap-2 mb-1">
-                  <span className="text-xs font-mono text-gray-400">{m.control_id}</span>
-                  {m.severity && (
-                    <span className={`px-1.5 py-0.5 rounded text-[10px] font-bold ${SEV[m.severity] || 'bg-gray-100 text-gray-600'}`}>
-                      {m.severity}
-                    </span>
+            {filtered.map((m, i) => {
+              const inner = (
+                <>
+                  <div className="flex items-center gap-2 mb-1">
+                    <span className="text-xs font-mono text-gray-400">{m.control_id}</span>
+                    {m.severity && (
+                      <span className={`px-1.5 py-0.5 rounded text-[10px] font-bold ${SEV[m.severity] || 'bg-gray-100 text-gray-600'}`}>
+                        {m.severity}
+                      </span>
+                    )}
+                    {m.phase && (
+                      <span className="text-[10px] text-purple-600 bg-purple-50 px-1.5 py-0.5 rounded">
+                        {m.phase}
+                      </span>
+                    )}
+                    {m.action && (
+                      <span className="text-[10px] text-gray-400">{m.action}</span>
+                    )}
+                  </div>
+                  <p className="text-sm text-gray-900">{m.title}</p>
+                  {m.regulation_source && (
+                    <p className="text-xs text-blue-600 mt-1">
+                      {m.regulation_source} {m.regulation_article}
+                    </p>
                   )}
-                  {m.phase && (
-                    <span className="text-[10px] text-purple-600 bg-purple-50 px-1.5 py-0.5 rounded">
-                      {m.phase}
-                    </span>
-                  )}
-                  {m.action && (
-                    <span className="text-[10px] text-gray-400">{m.action}</span>
-                  )}
-                </div>
-                <p className="text-sm text-gray-900">{m.title}</p>
-                {m.regulation_source && (
-                  <p className="text-xs text-blue-600 mt-1">
-                    {m.regulation_source} {m.regulation_article}
-                  </p>
-                )}
-              </div>
-            ))}
+                </>
+              )
+              return m.control_id ? (
+                <a key={i}
+                  href={`/sdk/control-library?control=${encodeURIComponent(m.control_id)}`}
+                  className="block px-4 py-3 hover:bg-purple-50/40 transition-colors">
+                  {inner}
+                </a>
+              ) : (
+                <div key={i} className="px-4 py-3 hover:bg-gray-50">{inner}</div>
+              )
+            })}
             {filtered.length === 0 && !loading && (
               <div className="p-8 text-center text-gray-400">Keine Controls gefunden</div>
             )}

admin-compliance/lib/sdk/einwilligungen/generator/cookie-banner-content-blocker.ts

@@ -0,0 +1,156 @@
+/**
+ * Content-Blocker Generator (Borlabs-Parity).
+ *
+ * Returns a small JS snippet that scans the page for blockable third-party
+ * embeds (YouTube, Vimeo, Google Maps, Spotify, Twitter, Facebook) and
+ * replaces them with a click-to-consent placeholder until the user agrees
+ * to the relevant cookie category.
+ *
+ * The customer drops a SECOND script tag next to the banner:
+ *   <script src="/cookie-banner.js"></script>
+ *   <script src="/cookie-content-blocker.js"></script>
+ *
+ * Author writes content as either:
+ *   <bp-consent-block category="EXTERNAL_MEDIA"
+ *                     provider="YouTube"
+ *                     src="https://www.youtube.com/embed/...">
+ *     <!-- the original iframe / embed code -->
+ *   </bp-consent-block>
+ *
+ * OR auto-detect: any <iframe src="https://www.youtube.com/...">
+ * gets wrapped on page load.
+ */
+
+const KNOWN_EMBEDS: Array<{ host: string; provider: string; category: string }> = [
+  { host: 'youtube.com', provider: 'YouTube',     category: 'EXTERNAL_MEDIA' },
+  { host: 'youtu.be',    provider: 'YouTube',     category: 'EXTERNAL_MEDIA' },
+  { host: 'vimeo.com',   provider: 'Vimeo',       category: 'EXTERNAL_MEDIA' },
+  { host: 'google.com/maps',     provider: 'Google Maps', category: 'EXTERNAL_MEDIA' },
+  { host: 'maps.googleapis.com', provider: 'Google Maps', category: 'EXTERNAL_MEDIA' },
+  { host: 'spotify.com',  provider: 'Spotify',     category: 'EXTERNAL_MEDIA' },
+  { host: 'soundcloud.com', provider: 'SoundCloud', category: 'EXTERNAL_MEDIA' },
+  { host: 'twitter.com',  provider: 'Twitter / X', category: 'PERSONALIZATION' },
+  { host: 'facebook.com', provider: 'Facebook',    category: 'PERSONALIZATION' },
+  { host: 'instagram.com', provider: 'Instagram',  category: 'PERSONALIZATION' },
+]
+
+export function generateContentBlockerJS(cookieName: string = 'cookie_consent'): string {
+  return `(function () {
+  'use strict';
+  var COOKIE_NAME = ${JSON.stringify(cookieName)};
+  var KNOWN_EMBEDS = ${JSON.stringify(KNOWN_EMBEDS)};
+
+  function getConsent() {
+    var c = document.cookie.split('; ').find(function (r) {
+      return r.indexOf(COOKIE_NAME + '=') === 0;
+    });
+    if (!c) return null;
+    try { return JSON.parse(decodeURIComponent(c.split('=')[1])); } catch (e) { return null; }
+  }
+
+  function categoryGranted(cat) {
+    var c = getConsent();
+    if (!c) return false;
+    var k = String(cat).toLowerCase();
+    return c[cat] === true || c[k] === true;
+  }
+
+  function classifyByHost(src) {
+    if (!src) return null;
+    for (var i = 0; i < KNOWN_EMBEDS.length; i++) {
+      if (src.indexOf(KNOWN_EMBEDS[i].host) > -1) return KNOWN_EMBEDS[i];
+    }
+    return null;
+  }
+
+  function makePlaceholder(provider, category, originalHTML, parent) {
+    var ph = document.createElement('div');
+    ph.className = 'bp-consent-placeholder';
+    ph.style.cssText = 'border:2px dashed #cbd5e1;background:#f8fafc;padding:24px;' +
+      'border-radius:8px;text-align:center;font-family:-apple-system,sans-serif;color:#475569';
+    ph.innerHTML =
+      '<div style="font-size:14px;font-weight:600;color:#1e293b;margin-bottom:8px">' +
+      'Inhalt von ' + provider + ' blockiert</div>' +
+      '<div style="font-size:12px;margin-bottom:12px">' +
+      'Zum Anzeigen dieses Inhalts wird Ihre Einwilligung fuer die Kategorie ' +
+      '<strong>' + category + '</strong> benoetigt. ' +
+      'Beim Akzeptieren werden Cookies von ' + provider + ' gesetzt.</div>' +
+      '<button class="bp-consent-load-btn" ' +
+      'style="background:#7c3aed;color:white;border:none;padding:8px 16px;' +
+      'border-radius:6px;font-size:13px;cursor:pointer;margin-right:6px">' +
+      'Inhalt einmalig laden</button>' +
+      '<button class="bp-consent-accept-btn" ' +
+      'style="background:#16a34a;color:white;border:none;padding:8px 16px;' +
+      'border-radius:6px;font-size:13px;cursor:pointer">' +
+      category + ' akzeptieren</button>';
+    ph.querySelector('.bp-consent-load-btn').addEventListener('click', function () {
+      var div = document.createElement('div');
+      div.innerHTML = originalHTML;
+      while (div.firstChild) parent.insertBefore(div.firstChild, ph);
+      ph.remove();
+    });
+    ph.querySelector('.bp-consent-accept-btn').addEventListener('click', function () {
+      var c = getConsent() || {};
+      c[category] = true;
+      var date = new Date();
+      date.setTime(date.getTime() + 180 * 86400000);
+      document.cookie = COOKIE_NAME + '=' + encodeURIComponent(JSON.stringify(c)) +
+                        ';expires=' + date.toUTCString() + ';path=/;SameSite=Lax';
+      window.dispatchEvent(new CustomEvent('cookieConsentUpdated', { detail: c }));
+      // Re-scan: placeholders for THIS category get replaced now
+      processAll();
+    });
+    return ph;
+  }
+
+  function processWrapped() {
+    var wrapped = document.querySelectorAll('bp-consent-block, [data-bp-consent-block]');
+    wrapped.forEach(function (el) {
+      var cat = el.getAttribute('category') || el.getAttribute('data-category') || 'EXTERNAL_MEDIA';
+      var prov = el.getAttribute('provider') || el.getAttribute('data-provider') || 'Drittanbieter';
+      if (categoryGranted(cat)) {
+        // Already consented: unwrap the inner content
+        var html = el.innerHTML;
+        var tmp = document.createElement('div');
+        tmp.innerHTML = html;
+        var parent = el.parentNode;
+        while (tmp.firstChild) parent.insertBefore(tmp.firstChild, el);
+        el.remove();
+      } else {
+        var parent = el.parentNode;
+        var inner = el.innerHTML;
+        var ph = makePlaceholder(prov, cat, inner, parent);
+        parent.insertBefore(ph, el);
+        el.remove();
+      }
+    });
+  }
+
+  function processBareIframes() {
+    var iframes = document.querySelectorAll('iframe[src]:not([data-bp-processed])');
+    iframes.forEach(function (f) {
+      var match = classifyByHost(f.getAttribute('src') || '');
+      if (!match) return;
+      f.setAttribute('data-bp-processed', '1');
+      if (categoryGranted(match.category)) return;
+      var html = f.outerHTML;
+      var parent = f.parentNode;
+      var ph = makePlaceholder(match.provider, match.category, html, parent);
+      parent.replaceChild(ph, f);
+    });
+  }
+
+  function processAll() {
+    processWrapped();
+    processBareIframes();
+  }
+
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', processAll);
+  } else {
+    processAll();
+  }
+  // Re-process when consent updates
+  window.addEventListener('cookieConsentUpdated', processAll);
+})();`
+}

admin-compliance/lib/sdk/einwilligungen/generator/cookie-banner-embed.ts

@@ -325,18 +325,25 @@ function generateJS(config: CookieBannerConfig): string {
   const CATEGORIES = ${JSON.stringify(categoryIds)};
   const REQUIRED_CATEGORIES = ${JSON.stringify(requiredCategories)};
 
-  // Google Consent Mode v2 — PFLICHT seit Maerz 2024 fuer Google Services in EEA
-  // Sets default consent state to "denied" BEFORE any Google tags fire
-  if (typeof gtag === 'function') {
-    gtag('consent', 'default', {
-      analytics_storage: 'denied',
-      ad_storage: 'denied',
-      ad_user_data: 'denied',
-      ad_personalization: 'denied',
-      functionality_storage: 'granted',
-      security_storage: 'granted',
-    });
+  // Google Consent Mode v2 — PFLICHT seit Maerz 2024 fuer Google Services
+  // in EEA. Shim gtag/dataLayer falls Google Tag noch nicht initialisiert
+  // wurde, dann sofort den default consent state setzen (DENIED).
+  window.dataLayer = window.dataLayer || [];
+  if (typeof gtag !== 'function') {
+    window.gtag = function () { window.dataLayer.push(arguments); };
   }
+  // wait_for_update gibt dem Banner 500ms Zeit, damit der Nutzer
+  // entscheiden kann bevor Tags feuern. Empfehlung von Google fuer GCM v2.
+  gtag('consent', 'default', {
+    analytics_storage: 'denied',
+    ad_storage: 'denied',
+    ad_user_data: 'denied',
+    ad_personalization: 'denied',
+    functionality_storage: 'granted',
+    security_storage: 'granted',
+    wait_for_update: 500,
+    region: ['EEA', 'CH', 'GB'],
+  });
 
   function updateGoogleConsentMode(consent) {
     if (typeof gtag !== 'function') return;
@@ -364,10 +371,61 @@ function generateJS(config: CookieBannerConfig): string {
     document.cookie = COOKIE_NAME + '=' + encodeURIComponent(JSON.stringify(consent)) +
                       ';expires=' + date.toUTCString() +
                       ';path=/;SameSite=Lax';
+    // Append to local history (Art. 7(3) DSGVO Best-Practice + Borlabs-Parity).
+    // Server-seitiges Logging laeuft separat via consent-service.
+    try {
+      const HKEY = COOKIE_NAME + '_history';
+      const hist = JSON.parse(localStorage.getItem(HKEY) || '[]');
+      hist.push({
+        ts: new Date().toISOString(),
+        choices: consent,
+      });
+      if (hist.length > 50) hist.splice(0, hist.length - 50);
+      localStorage.setItem(HKEY, JSON.stringify(hist));
+    } catch (e) { /* localStorage blocked */ }
     window.dispatchEvent(new CustomEvent('cookieConsentUpdated', { detail: consent }));
     updateGoogleConsentMode(consent);
   }
 
+  // Borlabs-Parity: zeigt dem Nutzer alle seine bisherigen Einwilligungen.
+  // Aufruf via window.bpShowConsentHistory() oder Klick auf den Link im Banner-Footer.
+  window.bpShowConsentHistory = function () {
+    var existing = document.getElementById('bpConsentHistoryModal');
+    if (existing) { existing.remove(); return; }
+    var hist = [];
+    try { hist = JSON.parse(localStorage.getItem(COOKIE_NAME + '_history') || '[]'); } catch (e) {}
+    var rows = hist.length === 0
+      ? '<p style="color:#94a3b8;font-style:italic">Noch keine Einwilligungen gespeichert.</p>'
+      : hist.slice().reverse().map(function (h) {
+          var d = new Date(h.ts);
+          var parts = Object.keys(h.choices).map(function (k) {
+            return '<span style="margin-right:8px;font-size:11px;color:' +
+              (h.choices[k] ? '#16a34a' : '#dc2626') + '">' +
+              (h.choices[k] ? '✓ ' : '✗ ') + k + '</span>';
+          }).join('');
+          return '<div style="border-bottom:1px solid #e5e7eb;padding:8px 0">' +
+                 '<div style="font-size:12px;color:#64748b;margin-bottom:4px">' +
+                 d.toLocaleString('de-DE') + '</div>' +
+                 '<div>' + parts + '</div></div>';
+        }).join('');
+    var modal = document.createElement('div');
+    modal.id = 'bpConsentHistoryModal';
+    modal.style.cssText = 'position:fixed;inset:0;background:rgba(0,0,0,0.5);' +
+      'z-index:999999;display:flex;align-items:center;justify-content:center;padding:20px';
+    modal.innerHTML = '<div style="background:white;border-radius:8px;max-width:500px;' +
+      'width:100%;max-height:80vh;overflow:auto;padding:20px;font-family:-apple-system,sans-serif">' +
+      '<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:12px">' +
+      '<h3 style="margin:0;font-size:16px">Ihre Einwilligungs-Historie</h3>' +
+      '<button onclick="document.getElementById(\\'bpConsentHistoryModal\\').remove()" ' +
+      'style="background:none;border:none;font-size:24px;cursor:pointer;color:#94a3b8">×</button>' +
+      '</div>' +
+      '<p style="font-size:12px;color:#64748b;margin:0 0 12px">' +
+      'Lokal in Ihrem Browser gespeichert. Server-seitig laufen Audit-Logs gemaess Art. 7(1) DSGVO.</p>' +
+      rows + '</div>';
+    modal.addEventListener('click', function (e) { if (e.target === modal) modal.remove(); });
+    document.body.appendChild(modal);
+  };
+
   function hasConsent(category) {
     const consent = getConsent();
     if (!consent) return REQUIRED_CATEGORIES.includes(category);