@cosmicdrift/kumiko-bundled-features 0.115.0 → 0.116.0

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -30,7 +30,7 @@ import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import {
   createUserFeature,
   USER_ANONYMIZED_DISPLAY_NAME,
@@ -74,6 +74,9 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);
+  // sessions ist gemountet → der user-session-Hook der defaults läuft im Forget
+  // und braucht die Tabelle (#797).
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
   // tenant-membership-Tabelle (von tenant-feature) manuell anlegen weil
   // wir ohne tenant-feature im stack arbeiten — minimaler Setup.

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -28,7 +28,7 @@ import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -63,6 +63,7 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS read_tenant_memberships (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),

package/src/user-data-rights-defaults/__tests__/bundled-entities.userdata-hooks.integration.test.ts

@@ -0,0 +1,392 @@
+// userData-Hook Integration-Tests für die Bundled-Entity-Hooks (GDPR-Audit
+// 2026-07): user-session, api-token, in-app-message, tenant-invitation,
+// notification-preference, config-value.
+//
+// Zwei Stacks:
+//   FULL    — alle Source-Features gemountet; testet Export-Inhalt, Forget-
+//             Semantik (hard-delete vs. executor-forget vs. anonymize) und
+//             Tenant-Isolation.
+//   MINIMAL — nur user/files/udr/defaults; testet das Presence-Gating: jeder
+//             Hook muss null/no-op liefern statt gegen fehlende Tabellen zu
+//             crashen (der Export-Runner hat kein per-Hook try/catch).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { createChannelInAppFeature, inAppMessagesTable } from "../../channel-in-app";
+import { createComplianceProfilesFeature } from "../../compliance-profiles";
+import { configValueEntity, createConfigFeature } from "../../config";
+import { createDataRetentionFeature } from "../../data-retention";
+import { createDeliveryFeature, notificationPreferenceEntity } from "../../delivery";
+import { createFilesFeature } from "../../files";
+import {
+  apiTokenEntity,
+  createPersonalAccessTokensFeature,
+  PatQueries,
+  type PatScopeConfig,
+} from "../../personal-access-tokens";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
+import { createTenantFeature, tenantInvitationEntity } from "../../tenant";
+import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
+import { createUserDataRightsFeature } from "../../user-data-rights";
+import { createUserDataRightsDefaultsFeature } from "../feature";
+import {
+  apiTokenDeleteHook,
+  apiTokenExportHook,
+  configValueDeleteHook,
+  configValueExportHook,
+  inAppMessageDeleteHook,
+  inAppMessageExportHook,
+  notificationPreferenceDeleteHook,
+  notificationPreferenceExportHook,
+  tenantInvitationDeleteHook,
+  tenantInvitationExportHook,
+  userSessionDeleteHook,
+  userSessionExportHook,
+} from "../index";
+
+const PAT_SCOPES: PatScopeConfig = {
+  tokens: { label: "Tokens", read: [PatQueries.mine] },
+};
+
+let full: TestStack;
+let minimal: TestStack;
+
+beforeAll(async () => {
+  full = await setupTestStack({
+    features: [
+      createUserFeature(),
+      createFilesFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createSessionsFeature(),
+      createConfigFeature(),
+      createTenantFeature(),
+      createPersonalAccessTokensFeature({ scopes: PAT_SCOPES }),
+      createDeliveryFeature(),
+      createChannelInAppFeature(),
+      createUserDataRightsFeature(),
+      createUserDataRightsDefaultsFeature(),
+    ],
+  });
+  await unsafeCreateEntityTable(full.db, userEntity);
+  await unsafeCreateEntityTable(full.db, userSessionEntity);
+  await unsafeCreateEntityTable(full.db, apiTokenEntity);
+  await unsafeCreateEntityTable(full.db, tenantInvitationEntity);
+  await unsafeCreateEntityTable(full.db, notificationPreferenceEntity);
+  await unsafeCreateEntityTable(full.db, configValueEntity);
+  await unsafePushTables(full.db, { inAppMessagesTable });
+
+  minimal = await setupTestStack({
+    features: [
+      createUserFeature(),
+      createFilesFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createSessionsFeature(),
+      createUserDataRightsFeature(),
+      createUserDataRightsDefaultsFeature(),
+    ],
+  });
+});
+
+afterAll(async () => {
+  await full.cleanup();
+  await minimal.cleanup();
+});
+
+const TENANT_A = "00000000-0000-4000-8000-00000000000a";
+const TENANT_B = "00000000-0000-4000-8000-00000000000b";
+
+function uuid(suffix: number): string {
+  return `bbbbbbbb-bbbb-4bbb-8bbb-${suffix.toString(16).padStart(12, "0")}`;
+}
+
+function ctx(userId: string, overrides: Record<string, unknown> = {}) {
+  return {
+    db: full.db,
+    registry: full.registry,
+    tenantId: TENANT_A,
+    userId,
+    ...overrides,
+  };
+}
+
+async function rawSelect(sql: string, params: unknown[]) {
+  const result = await asRawClient(full.db).unsafe(sql, params);
+  // biome-ignore lint/suspicious/noExplicitAny: drizzle execute typing
+  return ((result as any).rows ?? result) as Array<Record<string, unknown>>;
+}
+
+async function seedUser(id: string): Promise<void> {
+  const SYSTEM_TENANT = "00000000-0000-4000-8000-000000000001";
+  await seedRow(full.db, userTable, {
+    id,
+    tenantId: SYSTEM_TENANT,
+    email: `user-${id}@example.com`,
+    passwordHash: "hashed-password",
+    displayName: `User ${id}`,
+    locale: "de",
+    emailVerified: true,
+    roles: '["Member"]',
+    status: USER_STATUS.Active,
+  });
+}
+
+describe("user-session userData-hooks", () => {
+  async function seedSession(id: string, userId: string, tenantId: string): Promise<void> {
+    await asRawClient(full.db).unsafe(
+      `INSERT INTO read_user_sessions (id, user_id, tenant_id, created_at, expires_at, ip, user_agent)
+       VALUES ($1, $2, $3, now(), now() + interval '1 day', '203.0.113.7', 'TestAgent/1.0')`,
+      [id, userId, tenantId],
+    );
+  }
+
+  test("export liefert ip/userAgent, aber keine Session-Id (jti)", async () => {
+    await seedSession(uuid(1), "sess-user-1", TENANT_A);
+
+    const result = await userSessionExportHook(ctx("sess-user-1"));
+    expect(result?.entity).toBe("user-session");
+    expect(result?.rows).toHaveLength(1);
+    expect(result?.rows[0]?.["ip"]).toBe("203.0.113.7");
+    expect(result?.rows[0]?.["userAgent"]).toBe("TestAgent/1.0");
+    expect(result?.rows[0]?.["id"]).toBeUndefined();
+  });
+
+  test("delete entfernt Sessions des Users, Cross-Tenant bleibt", async () => {
+    await seedSession(uuid(2), "sess-user-2", TENANT_A);
+    await seedSession(uuid(3), "sess-user-2", TENANT_B);
+
+    await userSessionDeleteHook(ctx("sess-user-2"), "delete");
+
+    const a = await rawSelect(
+      "SELECT * FROM read_user_sessions WHERE user_id = $1 AND tenant_id = $2",
+      ["sess-user-2", TENANT_A],
+    );
+    const b = await rawSelect(
+      "SELECT * FROM read_user_sessions WHERE user_id = $1 AND tenant_id = $2",
+      ["sess-user-2", TENANT_B],
+    );
+    expect(a).toHaveLength(0);
+    expect(b).toHaveLength(1);
+  });
+});
+
+describe("api-token userData-hooks", () => {
+  async function seedToken(id: string, userId: string): Promise<void> {
+    await asRawClient(full.db).unsafe(
+      `INSERT INTO read_api_tokens (id, user_id, tenant_id, name, token_hash, prefix, scopes, created_at)
+       VALUES ($1, $2, $3, 'My MacBook', $4, 'kum_ab12', '["read"]', now())`,
+      [id, userId, TENANT_A, `hash-${id}`],
+    );
+  }
+
+  test("export liefert Token-Metadata ohne tokenHash", async () => {
+    await seedToken(uuid(10), "pat-user-1");
+
+    const result = await apiTokenExportHook(ctx("pat-user-1"));
+    expect(result?.entity).toBe("api-token");
+    expect(result?.rows).toHaveLength(1);
+    expect(result?.rows[0]?.["name"]).toBe("My MacBook");
+    expect(result?.rows[0]?.["prefix"]).toBe("kum_ab12");
+    expect(result?.rows[0]?.["tokenHash"]).toBeUndefined();
+  });
+
+  test("delete entfernt Tokens (= Revoke)", async () => {
+    await seedToken(uuid(11), "pat-user-2");
+
+    await apiTokenDeleteHook(ctx("pat-user-2"), "delete");
+
+    const rows = await rawSelect("SELECT * FROM read_api_tokens WHERE user_id = $1", [
+      "pat-user-2",
+    ]);
+    expect(rows).toHaveLength(0);
+  });
+});
+
+describe("in-app-message userData-hooks", () => {
+  async function seedMessage(userId: string, title: string): Promise<void> {
+    await asRawClient(full.db).unsafe(
+      `INSERT INTO in_app_messages (tenant_id, user_id, notification_type, title, body)
+       VALUES ($1, $2, 'test:notify', $3, 'Hallo Marc, dein Export ist da')`,
+      [TENANT_A, userId, title],
+    );
+  }
+
+  test("export liefert Messages, delete entfernt sie", async () => {
+    await seedMessage("inapp-user-1", "Export fertig");
+
+    const result = await inAppMessageExportHook(ctx("inapp-user-1"));
+    expect(result?.entity).toBe("in-app-message");
+    expect(result?.rows[0]?.["title"]).toBe("Export fertig");
+
+    await inAppMessageDeleteHook(ctx("inapp-user-1"), "delete");
+    const rows = await rawSelect("SELECT * FROM in_app_messages WHERE user_id = $1", [
+      "inapp-user-1",
+    ]);
+    expect(rows).toHaveLength(0);
+  });
+});
+
+describe("tenant-invitation userData-hooks", () => {
+  async function seedInvitation(
+    id: string,
+    email: string,
+    invitedBy: string,
+    tenantId = TENANT_A,
+  ): Promise<void> {
+    await asRawClient(full.db).unsafe(
+      `INSERT INTO read_tenant_invitations (id, tenant_id, email, role, status, invited_by, expires_at)
+       VALUES ($1, $2, $3, 'Member', 'pending', $4, now() + interval '7 days')`,
+      [id, tenantId, email, invitedBy],
+    );
+  }
+
+  test("export matcht Invitations über die User-Email", async () => {
+    await seedUser(uuid(20));
+    await seedInvitation(uuid(21), `user-${uuid(20)}@example.com`, "admin-1");
+
+    const result = await tenantInvitationExportHook(ctx(uuid(20)));
+    expect(result?.entity).toBe("tenant-invitation");
+    expect(result?.rows).toHaveLength(1);
+    expect(result?.rows[0]?.["role"]).toBe("Member");
+  });
+
+  test("forget delete purged die Invitee-Row (rebuild-sicher via Executor)", async () => {
+    await seedUser(uuid(22));
+    await seedInvitation(uuid(23), `user-${uuid(22)}@example.com`, "admin-1");
+
+    await tenantInvitationDeleteHook(ctx(uuid(22)), "delete");
+
+    const rows = await rawSelect("SELECT * FROM read_tenant_invitations WHERE id = $1", [uuid(23)]);
+    expect(rows).toHaveLength(0);
+  });
+
+  test("anonymize pseudonymisiert die Invitee-Email (unique-index-sicher)", async () => {
+    await seedUser(uuid(24));
+    await seedInvitation(uuid(25), `user-${uuid(24)}@example.com`, "admin-1");
+
+    await tenantInvitationDeleteHook(ctx(uuid(24)), "anonymize");
+
+    const rows = await rawSelect("SELECT email FROM read_tenant_invitations WHERE id = $1", [
+      uuid(25),
+    ]);
+    expect(rows).toHaveLength(1);
+    expect(String(rows[0]?.["email"])).toBe(`forgotten-${uuid(25)}@anonymized.invalid`);
+  });
+
+  test("userEmailBeforeDelete hat Vorrang (User-Row schon anonymisiert)", async () => {
+    await seedInvitation(uuid(26), "vanished@example.com", "admin-1");
+
+    await tenantInvitationDeleteHook(
+      ctx("ghost-user-forgotten", { userEmailBeforeDelete: "Vanished@Example.com" }),
+      "delete",
+    );
+
+    const rows = await rawSelect("SELECT * FROM read_tenant_invitations WHERE id = $1", [uuid(26)]);
+    expect(rows).toHaveLength(0);
+  });
+
+  test("Inviter-Forget severs invitedBy, Row bleibt (gehört dem Invitee)", async () => {
+    // userId als echte UUID — der Email-Lookup geht gegen read_users.id (uuid).
+    const inviter = uuid(28);
+    await seedInvitation(uuid(27), "someone-else@example.com", inviter);
+
+    await tenantInvitationDeleteHook(ctx(inviter), "delete");
+
+    const rows = await rawSelect(
+      "SELECT email, invited_by FROM read_tenant_invitations WHERE id = $1",
+      [uuid(27)],
+    );
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["email"]).toBe("someone-else@example.com");
+    expect(rows[0]?.["invited_by"]).toBe("anonymized");
+  });
+});
+
+describe("notification-preference userData-hooks", () => {
+  async function seedPreference(id: string, userId: string): Promise<void> {
+    await asRawClient(full.db).unsafe(
+      `INSERT INTO read_notification_preferences (id, tenant_id, user_id, notification_type, channel, enabled)
+       VALUES ($1, $2, $3, 'test:notify', 'email', false)`,
+      [id, TENANT_A, userId],
+    );
+  }
+
+  test("export liefert Prefs, forget purged sie via Executor", async () => {
+    await seedPreference(uuid(30), "pref-user-1");
+
+    const result = await notificationPreferenceExportHook(ctx("pref-user-1"));
+    expect(result?.entity).toBe("notification-preference");
+    expect(result?.rows[0]?.["channel"]).toBe("email");
+    expect(result?.rows[0]?.["enabled"]).toBe(false);
+
+    await notificationPreferenceDeleteHook(ctx("pref-user-1"), "delete");
+    const rows = await rawSelect("SELECT * FROM read_notification_preferences WHERE user_id = $1", [
+      "pref-user-1",
+    ]);
+    expect(rows).toHaveLength(0);
+  });
+});
+
+describe("config-value userData-hooks", () => {
+  async function seedConfig(id: string, key: string, userId: string | null): Promise<void> {
+    await asRawClient(full.db).unsafe(
+      `INSERT INTO read_config_values (id, tenant_id, key, value, user_id)
+       VALUES ($1, $2, $3, '"dark"', $4)`,
+      [id, TENANT_A, key, userId],
+    );
+  }
+
+  test("export + forget treffen NUR user-scoped Rows, tenant-scope bleibt", async () => {
+    await seedConfig(uuid(40), "ui.theme", "cfg-user-1");
+    await seedConfig(uuid(41), "tenant.brand", null);
+
+    const result = await configValueExportHook(ctx("cfg-user-1"));
+    expect(result?.rows).toHaveLength(1);
+    expect(result?.rows[0]?.["key"]).toBe("ui.theme");
+
+    await configValueDeleteHook(ctx("cfg-user-1"), "delete");
+    const userRows = await rawSelect("SELECT * FROM read_config_values WHERE user_id = $1", [
+      "cfg-user-1",
+    ]);
+    const tenantRows = await rawSelect("SELECT * FROM read_config_values WHERE id = $1", [
+      uuid(41),
+    ]);
+    expect(userRows).toHaveLength(0);
+    expect(tenantRows).toHaveLength(1);
+  });
+});
+
+describe("Presence-Gating: Source-Feature nicht gemountet → null/no-op statt Crash", () => {
+  test("alle gegateten Hooks no-open auf dem Minimal-Stack", async () => {
+    const minCtx = {
+      db: minimal.db,
+      registry: minimal.registry,
+      tenantId: TENANT_A,
+      userId: "any-user",
+    };
+
+    // sessions ist im Minimal-Stack GEMOUNTET aber die Tabelle existiert
+    // nicht — der Gate-Check greift auf Feature-Ebene, deshalb hier nur die
+    // fünf wirklich ungemounteten Features. (user-session wird im FULL-Stack
+    // getestet.)
+    expect(await apiTokenExportHook(minCtx)).toBeNull();
+    expect(await inAppMessageExportHook(minCtx)).toBeNull();
+    expect(await tenantInvitationExportHook(minCtx)).toBeNull();
+    expect(await notificationPreferenceExportHook(minCtx)).toBeNull();
+    expect(await configValueExportHook(minCtx)).toBeNull();
+
+    await expect(apiTokenDeleteHook(minCtx, "delete")).resolves.toBeUndefined();
+    await expect(inAppMessageDeleteHook(minCtx, "delete")).resolves.toBeUndefined();
+    await expect(tenantInvitationDeleteHook(minCtx, "delete")).resolves.toBeUndefined();
+    await expect(notificationPreferenceDeleteHook(minCtx, "delete")).resolves.toBeUndefined();
+    await expect(configValueDeleteHook(minCtx, "delete")).resolves.toBeUndefined();
+  });
+});

package/src/user-data-rights-defaults/feature.ts

@@ -3,8 +3,23 @@ import {
   EXT_USER_DATA,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook";
+import { configValueDeleteHook, configValueExportHook } from "./hooks/config-value.userdata-hook";
 import { fileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook";
+import {
+  inAppMessageDeleteHook,
+  inAppMessageExportHook,
+} from "./hooks/in-app-message.userdata-hook";
+import {
+  notificationPreferenceDeleteHook,
+  notificationPreferenceExportHook,
+} from "./hooks/notification-preference.userdata-hook";
+import {
+  tenantInvitationDeleteHook,
+  tenantInvitationExportHook,
+} from "./hooks/tenant-invitation.userdata-hook";
 import { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook";
+import { userSessionDeleteHook, userSessionExportHook } from "./hooks/user-session.userdata-hook";
 
 // user-data-rights-defaults — Default-Hooks für die Core-Entities
 // `user` (S2.H1) und `fileRef` (S2.H2).
@@ -31,7 +46,7 @@ import { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook";
 export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
   return defineFeature("user-data-rights-defaults", (r) => {
     r.describe(
-      "Registers ready-made `EXT_USER_DATA` export and delete hooks for the two core entities: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`) and `fileRef` (delete removes both the DB row and the storage binary). Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.",
+      "Registers ready-made `EXT_USER_DATA` export and delete hooks for the bundled entities that hold per-user data: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`), `fileRef` (delete removes both the DB row and the storage binary), plus — gated on the source feature being mounted — `user-session` (ip/userAgent, hard-delete), `api-token` (hard-delete = revoke), `in-app-message` (hard-delete), `tenant-invitation` (invitee email forgotten/pseudonymized, inviter link severed), `notification-preference` and user-scoped `config-value` (purged via the forget verb). Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.",
     );
     r.uiHints({
       displayLabel: "User Data Rights · Default Hooks",
@@ -39,6 +54,18 @@ export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
       recommended: false,
     });
     r.requires("user", "files", "user-data-rights");
+    // Optional sources: hooks are registered unconditionally but each one
+    // no-ops at runtime when its source feature isn't mounted (see
+    // hooks/feature-mounted.ts) — the export runner has no per-hook
+    // try/catch, so a query against a missing table would kill the job.
+    r.optionalRequires(
+      "sessions",
+      "personal-access-tokens",
+      "channel-in-app",
+      "tenant",
+      "delivery",
+      "config",
+    );
 
     r.useExtension(EXT_USER_DATA, "user", {
       export: userExportHook,
@@ -49,5 +76,35 @@ export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
       export: fileRefExportHook,
       delete: fileRefDeleteHook,
     });
+
+    r.useExtension(EXT_USER_DATA, "user-session", {
+      export: userSessionExportHook,
+      delete: userSessionDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "api-token", {
+      export: apiTokenExportHook,
+      delete: apiTokenDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "in-app-message", {
+      export: inAppMessageExportHook,
+      delete: inAppMessageDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "tenant-invitation", {
+      export: tenantInvitationExportHook,
+      delete: tenantInvitationDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "notification-preference", {
+      export: notificationPreferenceExportHook,
+      delete: notificationPreferenceDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "config-value", {
+      export: configValueExportHook,
+      delete: configValueDeleteHook,
+    });
   });
 }

package/src/user-data-rights-defaults/hooks/api-token.userdata-hook.ts

@@ -0,0 +1,37 @@
+import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { apiTokenTable } from "../../personal-access-tokens";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for personal-access-tokens rows. Same shape as user-session:
+// unmanaged direct-write store (no event stream, rebuild-safe DELETE), and a
+// token without its user is worthless — both strategies hard-delete. Deleting
+// the row also revokes the token (the resolver point-reads this table), which
+// is the correct outcome for a forgotten user.
+
+export const apiTokenExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "personal-access-tokens")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, apiTokenTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "api-token",
+    // tokenHash stays out of the bundle — secret-derived, not personal data.
+    rows: rows.map((r) => ({
+      name: r["name"] ?? null,
+      prefix: r["prefix"] ?? null,
+      scopes: r["scopes"] ?? null,
+      createdAt: String(r["createdAt"] ?? ""),
+      expiresAt: r["expiresAt"] ? String(r["expiresAt"]) : null,
+      revokedAt: r["revokedAt"] ? String(r["revokedAt"]) : null,
+    })),
+  };
+};
+
+export const apiTokenDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: personal-access-tokens not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "personal-access-tokens")) return;
+  await deleteMany(ctx.db, apiTokenTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};

package/src/user-data-rights-defaults/hooks/config-value.userdata-hook.ts

@@ -0,0 +1,51 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { configValueEntity, configValuesTable } from "../../config";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for config's USER-scoped rows (userId set). Tenant-/system-
+// scope rows carry no per-user subject and stay untouched. Event-sourced
+// entity → forget goes through the executor (rebuild replays the erasure).
+// A user-scoped setting without its user is meaningless — both strategies
+// purge via the forget verb, which also erases encrypted value blobs.
+
+const crud = createEventStoreExecutor(configValuesTable, configValueEntity, {
+  entityName: "config-value",
+});
+
+export const configValueExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "config")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, configValuesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "config-value",
+    // value may be an encrypted blob — exported as stored; decryption is the
+    // config resolver's concern and secret-backed values don't belong in the
+    // bundle in plaintext.
+    rows: rows.map((r) => ({ key: r["key"], value: r["value"] })),
+  };
+};
+
+export const configValueDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: config not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "config")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, configValuesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.forget({ id }, systemUser, tdb);
+  }
+};

package/src/user-data-rights-defaults/hooks/feature-mounted.ts

@@ -0,0 +1,10 @@
+import type { UserDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
+
+// The defaults feature registers hooks for OPTIONAL source features
+// (optionalRequires). When the source isn't mounted its tables don't exist,
+// and the export runner has no try/catch around hooks — a query against a
+// missing table would kill the whole export job. Every gated hook must
+// early-return on this check before touching the source's tables.
+export function featureMounted(ctx: UserDataHookCtx, featureName: string): boolean {
+  return ctx.registry.getFeature(featureName) !== undefined;
+}

package/src/user-data-rights-defaults/hooks/in-app-message.userdata-hook.ts

@@ -0,0 +1,38 @@
+import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { inAppMessagesTable } from "../../channel-in-app";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for channel-in-app's in_app_messages. Plain SQL table (no
+// r.entity, no event stream — see channel-in-app/tables.ts), written by
+// direct INSERT in the channel adapter, so a direct DELETE is rebuild-safe.
+// Messages are addressed TO the user (title/body can quote personal content);
+// both strategies hard-delete.
+//
+// This table has no entity fields, so the V3 pii-annotation boot guard cannot
+// see it — coverage lives solely in these hooks.
+
+export const inAppMessageExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "channel-in-app")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, inAppMessagesTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "in-app-message",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"] ?? null,
+      title: r["title"] ?? null,
+      body: r["body"] ?? null,
+      isRead: r["isRead"] ?? false,
+      createdAt: String(r["createdAt"] ?? ""),
+    })),
+  };
+};
+
+export const inAppMessageDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: channel-in-app not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "channel-in-app")) return;
+  await deleteMany(ctx.db, inAppMessagesTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};