@cosmicdrift/kumiko-bundled-features 0.118.0 → 0.120.0

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -0,0 +1,148 @@
+// crypto-shredding forget-subject — end-to-end over real HTTP dispatch:
+//
+//   - DPO erases a user subject → DEK gone (getKey throws KeyErased),
+//     subject-forgotten audit event appended
+//   - tenant subjects shred the same way
+//   - repeat forget is a no-op erase but still audited
+//   - no KMS configured → 500 with actionable message
+//   - Member role → 403 (DPO/SystemAdmin only)
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { setupTestStack, type TestStack, testTenantId } from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
+import { createCryptoShreddingFeature } from "../feature";
+
+const FORGET = "crypto-shredding:write:forget-subject";
+
+let stack: TestStack;
+let kms: InMemoryKmsAdapter;
+
+const TENANT: TenantId = testTenantId(1);
+const TARGET_USER_ID = "aaaaaaaa-aaaa-4aaa-8aaa-000000000001";
+const TARGET_TENANT_ID = "aaaaaaaa-aaaa-4aaa-8aaa-0000000000a1";
+const REASON = "authority request #42 (Art. 17)";
+
+const dpoUser = {
+  id: "aaaaaaaa-aaaa-4aaa-8aaa-0000000000d1",
+  tenantId: TENANT,
+  roles: ["DataProtectionOfficer"],
+};
+
+const memberUser = {
+  id: "aaaaaaaa-aaaa-4aaa-8aaa-0000000000e1",
+  tenantId: TENANT,
+  roles: ["Member"],
+};
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createCryptoShreddingFeature()] });
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [eventsTable]);
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+async function forgottenEvents(): Promise<Array<{ payload: Record<string, unknown> }>> {
+  return (await selectMany(stack.db, eventsTable, {
+    type: SUBJECT_FORGOTTEN_EVENT_NAME,
+  })) as Array<{ payload: Record<string, unknown> }>;
+}
+
+describe("crypto-shredding :: forget-subject", () => {
+  test("DPO forgets a user subject → key erased + audit event", async () => {
+    const subject = { kind: "user", userId: TARGET_USER_ID } as const;
+    await kms.createKey(subject);
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject, reason: REASON },
+      dpoUser,
+    );
+    expect(result.subjectKey).toBe(`user:${TARGET_USER_ID}`);
+
+    await expect(kms.getKey(subject)).rejects.toThrow("Subject key erased");
+
+    const events = await forgottenEvents();
+    expect(events).toHaveLength(1);
+    expect(events[0]?.payload).toMatchObject({
+      subjectKey: `user:${TARGET_USER_ID}`,
+      reason: REASON,
+      forgottenBy: dpoUser.id,
+    });
+  });
+
+  test("tenant subject shreds the same way", async () => {
+    const subject = { kind: "tenant", tenantId: TARGET_TENANT_ID } as const;
+    await kms.createKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId });
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject, reason: REASON },
+      dpoUser,
+    );
+    expect(result.subjectKey).toBe(`tenant:${TARGET_TENANT_ID}`);
+
+    await expect(
+      kms.getKey({ kind: "tenant", tenantId: TARGET_TENANT_ID as TenantId }),
+    ).rejects.toThrow("Subject key erased");
+  });
+
+  test("repeat forget: erase is a no-op but each attempt is audited", async () => {
+    const subject = { kind: "user", userId: TARGET_USER_ID } as const;
+    await kms.createKey(subject);
+
+    await stack.http.writeOk(FORGET, { subject, reason: REASON }, dpoUser);
+    await stack.http.writeOk(FORGET, { subject, reason: `${REASON} (repeat)` }, dpoUser);
+
+    expect(await forgottenEvents()).toHaveLength(2);
+  });
+
+  test("no KMS configured → 500 with boot hint", async () => {
+    resetPiiSubjectKmsForTests();
+
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: TARGET_USER_ID }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(500);
+  });
+
+  test("Member role → 403", async () => {
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: TARGET_USER_ID }, reason: REASON },
+      memberUser,
+    );
+    expect(err.httpStatus).toBe(403);
+  });
+
+  test("reason shorter than 10 chars → schema reject", async () => {
+    const err = await stack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: TARGET_USER_ID }, reason: "short" },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(400);
+  });
+});

package/src/crypto-shredding/constants.ts

@@ -0,0 +1,5 @@
+export const CRYPTO_SHREDDING_FEATURE_NAME = "crypto-shredding";
+
+export const SUBJECT_FORGOTTEN_EVENT_NAME = "crypto-shredding:event:subject-forgotten";
+
+export const CRYPTO_SHREDDING_AGGREGATE_TYPE = "crypto-shredding-subject";

package/src/crypto-shredding/feature.ts

@@ -0,0 +1,18 @@
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { CRYPTO_SHREDDING_FEATURE_NAME } from "./constants";
+import { forgetSubjectWrite, subjectForgottenSchema } from "./handlers/forget-subject.write";
+
+export function createCryptoShreddingFeature(): FeatureDefinition {
+  return defineFeature(CRYPTO_SHREDDING_FEATURE_NAME, (r) => {
+    r.describe(
+      "Operator-level crypto-shredding trigger. `forget-subject` erases a user or tenant subject key in the configured KMS adapter, making every PII field encrypted under it permanently unreadable (reads render the `[[erased]]` sentinel), and appends a `subject-forgotten` audit event. Requires a KMS adapter (`runProdApp({ kms })`). The automated Art.-17 deletion pipeline in `user-data-rights` erases keys itself; this command covers manual forgets (authority requests, operator recovery, tenant destroy).",
+    );
+    r.uiHints({
+      displayLabel: "Crypto-Shredding",
+      category: "compliance",
+    });
+
+    r.defineEvent("subject-forgotten", subjectForgottenSchema);
+    r.writeHandler(forgetSubjectWrite);
+  });
+}

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -0,0 +1,91 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import {
+  configuredPiiSubjectKms,
+  type SubjectId,
+  subjectIdToKey,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { nullBlindIndexesForSubject } from "@cosmicdrift/kumiko-framework/db";
+import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { z } from "zod";
+import { CRYPTO_SHREDDING_AGGREGATE_TYPE, SUBJECT_FORGOTTEN_EVENT_NAME } from "../constants";
+
+export const subjectIdSchema = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("user"), userId: z.uuid() }),
+  z.object({ kind: z.literal("tenant"), tenantId: z.uuid() }),
+]);
+
+export const forgetSubjectSchema = z.object({
+  subject: subjectIdSchema,
+  reason: z.string().min(10),
+});
+
+export const subjectForgottenSchema = z.object({
+  subjectKey: z.string().min(1),
+  reason: z.string().min(10),
+  forgottenBy: z.string().min(1),
+});
+
+// Manual crypto-shred for a DPO / platform operator: erases the subject's
+// DEK immediately (all its PII ciphertext becomes unreadable, reads render
+// "[[erased]]") and appends the audit event. Forget is final — the adapter
+// keeps a tombstone, so the subject can never get a new key.
+//
+// The automated Art.-17 path (user-data-rights forget-cleanup) calls
+// kms.eraseKey directly inside its per-user sub-tx; this command is the
+// standalone trigger for cases outside that pipeline (authority requests,
+// tenant-destroy in Sprint 5, operator recovery).
+export const forgetSubjectWrite = defineWriteHandler({
+  name: "forget-subject",
+  schema: forgetSubjectSchema,
+  access: { roles: [ROLES.DataProtectionOfficer, ROLES.SystemAdmin] },
+  handler: async (event, ctx) => {
+    const kms = configuredPiiSubjectKms();
+    if (!kms) {
+      return writeFailure(
+        new InternalError({
+          message:
+            "[crypto-shredding] forget-subject called but no KMS adapter is configured — " +
+            "pass runProdApp({ kms }) / configurePiiSubjectKms(adapter) at boot.",
+        }),
+      );
+    }
+
+    const raw = event.payload.subject;
+    const subject: SubjectId =
+      raw.kind === "user"
+        ? { kind: "user", userId: raw.userId }
+        : { kind: "tenant", tenantId: raw.tenantId as TenantId }; // @cast-boundary uuid-validated command payload → branded id
+    const subjectKey = subjectIdToKey(subject);
+
+    // Erase BEFORE the audit append: if the append throws, the key is gone
+    // but no event exists — a retry is a no-op erase plus the event. The
+    // reverse order could leave an audit trail claiming a shred that never
+    // happened.
+    await kms.eraseKey(subject, {
+      requestId: requestContext.get()?.requestId ?? "crypto-shredding:forget-subject",
+      userId: event.user.id,
+      eraseReason: event.payload.reason,
+    });
+
+    // Blind-Index-Sweep (#818): bidx-Spalten des erased Subjects sofort
+    // nullen — sonst bliebe der deterministische HMAC bis zum nächsten
+    // Rebuild equality-matchbar. Bewusst ctx.db.raw: der Ciphertext-Prefix
+    // adressiert das Subject tenant-übergreifend.
+    await nullBlindIndexesForSubject(ctx.db.raw, ctx.registry.features, subjectKey);
+
+    await ctx.unsafeAppendEvent({
+      aggregateId: raw.kind === "user" ? raw.userId : raw.tenantId,
+      aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+      type: SUBJECT_FORGOTTEN_EVENT_NAME,
+      payload: {
+        subjectKey,
+        reason: event.payload.reason,
+        forgottenBy: event.user.id,
+      },
+    });
+
+    return { isSuccess: true as const, data: { subjectKey } };
+  },
+});

package/src/crypto-shredding/index.ts

@@ -0,0 +1,11 @@
+export {
+  CRYPTO_SHREDDING_AGGREGATE_TYPE,
+  CRYPTO_SHREDDING_FEATURE_NAME,
+  SUBJECT_FORGOTTEN_EVENT_NAME,
+} from "./constants";
+export { createCryptoShreddingFeature } from "./feature";
+export {
+  forgetSubjectSchema,
+  subjectForgottenSchema,
+  subjectIdSchema,
+} from "./handlers/forget-subject.write";

package/src/delivery/__tests__/delivery-pii-kms.integration.test.ts

@@ -0,0 +1,171 @@
+// Delivery-attempt log under KMS (#799): recipientAddress is written via
+// LOW-LEVEL append() in attempt-log.ts — the event-PII catalog must cover
+// it. Stored event + projected row carry ciphertext under the recipient's
+// DEK, the outgoing mail still reaches the PLAINTEXT address, the admin
+// log.query decrypts for display, and erasing the recipient's key flips
+// the log entry to [[erased]] without touching the append-only stream.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  PII_ERASED_SENTINEL,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  defineFeature,
+  defineWriteHandler,
+  type NotifyFn,
+  qn,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
+import { createChannelEmailFeature } from "../../channel-email/feature";
+import { createInMemoryTransport } from "../../channel-email/types";
+import { createConfigFeature } from "../../config/feature";
+import { configValuesTable } from "../../config/table";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature } from "../../renderer-simple/feature";
+import { simpleRenderer } from "../../renderer-simple/simple-renderer";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { DELIVERY_ATTEMPT_EVENT } from "../constants";
+import { createDeliveryFeature } from "../feature";
+import { deliveryAttemptsTable, notificationPreferencesTable } from "../tables";
+import { createDeliveryTestContext } from "../testing";
+
+const emailTransport = createInMemoryTransport();
+const testEmail = (userId: string | number) => `user-${userId}@test.com`;
+
+const admin = TestUsers.admin;
+const recipient = createTestUser({ id: 7, roles: ["User"] });
+
+const appFeature = defineFeature("app", (r) => {
+  r.requires("delivery");
+
+  r.writeHandler(
+    defineWriteHandler({
+      name: "ping",
+      schema: z.object({ toUserId: z.string() }),
+      handler: async (event, ctx) => {
+        const notify = ctx.notify as NotifyFn;
+        await notify(qn("app", "notify", "pinged"), {
+          to: event.payload.toUserId,
+          data: { title: "Ping", body: "Du wurdest angepingt" },
+        });
+        return { isSuccess: true, data: { sent: true } };
+      },
+      access: { openToAll: true },
+    }),
+  );
+});
+
+let stack: TestStack;
+let kms: InMemoryKmsAdapter;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async (userId) => testEmail(userId),
+      }),
+      appFeature,
+    ],
+    extraContext: (deps) => createDeliveryTestContext(deps),
+  });
+
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+// ONE kms for the whole file: rows persist across tests, so a fresh adapter
+// per test would orphan earlier ciphertext (decrypt fails loud on KeyNotFound).
+beforeEach(() => {
+  kms ??= new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+  emailTransport.sent.length = 0;
+});
+
+afterAll(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+async function pingRecipient(): Promise<void> {
+  await stack.http.writeOk(qn("app", "write", "ping"), { toUserId: recipient.id }, admin);
+}
+
+describe("delivery attempt log under KMS", () => {
+  test("mail goes to the plaintext address; event + row store ciphertext", async () => {
+    await pingRecipient();
+
+    expect(emailTransport.sent.length).toBe(1);
+    expect(emailTransport.sent[0]?.to).toBe(testEmail(recipient.id));
+
+    const events = await selectMany(stack.db, eventsTable, { type: DELIVERY_ATTEMPT_EVENT });
+    const sent = events
+      .map((e) => e.payload as Record<string, unknown>)
+      .find((p) => p["channel"] === "email" && p["status"] === "sent");
+    expect(sent).toBeDefined();
+    expect(isPiiCiphertext(sent?.["recipientAddress"])).toBe(true);
+    expect(String(sent?.["recipientAddress"])).toContain(`user:${recipient.id}`);
+    expect(sent?.["recipientId"]).toBe(recipient.id);
+
+    const rows = await selectMany(stack.db, deliveryAttemptsTable, {
+      recipientId: recipient.id,
+      channel: "email",
+    });
+    expect(rows.length).toBeGreaterThan(0);
+    expect(isPiiCiphertext(rows[0]?.["recipientAddress"])).toBe(true);
+  });
+
+  test("admin log.query decrypts for display; after key-erase it shows [[erased]]", async () => {
+    await pingRecipient();
+
+    const before = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      "delivery:query:log",
+      { limit: 100 },
+      admin,
+    );
+    const entry = before.rows.find(
+      (r) => r["recipientId"] === recipient.id && r["channel"] === "email",
+    );
+    expect(entry?.["recipientAddress"]).toBe(testEmail(recipient.id));
+
+    await kms.eraseKey({ kind: "user", userId: recipient.id });
+
+    const after = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      "delivery:query:log",
+      { limit: 100 },
+      admin,
+    );
+    const erased = after.rows.find(
+      (r) => r["recipientId"] === recipient.id && r["channel"] === "email",
+    );
+    expect(erased?.["recipientAddress"]).toBe(PII_ERASED_SENTINEL);
+  });
+});

package/src/delivery/feature.ts

@@ -40,7 +40,11 @@ export function createDeliveryFeature(): FeatureDefinition {
     // attempt is a fresh stream, no CRUD lifecycle. Framework's
     // boot-validator accepts the projection below because at least one
     // apply-key is a registered domain-event (DELIVERY_ATTEMPT_EVENT).
-    r.defineEvent("attempt", deliveryAttemptSchema);
+    // recipientAddress is the real PII (email address); recipientId stays
+    // plaintext — pseudonymous fk, same line as config.userId (#821).
+    r.defineEvent("attempt", deliveryAttemptSchema, {
+      piiFields: { recipientAddress: { subjectField: "recipientId" } },
+    });
 
     // Inline projection that materialises every delivery attempt into
     // deliveryAttemptsTable. Runs in the SAME transaction as the low-level

package/src/delivery/handlers/log.query.ts

@@ -1,6 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { deliveryAttemptsTable } from "../tables";
 
 export const logQuery = defineQueryHandler({
@@ -14,6 +15,18 @@ export const logQuery = defineQueryHandler({
       orderBy: { col: "createdAt", direction: "desc" },
       limit: query.payload.limit,
     });
-    return { rows };
+    // recipientAddress is stored encrypted under the recipient's DEK (#799)
+    // — decrypt for the admin log view; forgotten subjects show [[erased]].
+    return {
+      rows: await Promise.all(
+        rows.map(async (row) => ({
+          ...row,
+          recipientAddress:
+            typeof row["recipientAddress"] === "string"
+              ? await decryptStoredPii(row["recipientAddress"], "delivery-log")
+              : row["recipientAddress"],
+        })),
+      ),
+    };
   },
 });

package/src/delivery/tables.ts

@@ -76,7 +76,7 @@ export const deliveryAttemptsTableMeta: EntityTableMeta = defineUnmanagedTable({
 export const notificationPreferenceEntity = createEntity({
   table: "read_notification_preferences",
   fields: {
-    userId: createTextField({ required: true, pii: true }),
+    userId: createTextField({ required: true, allowPlaintext: "pseudonymous-fk" }),
     notificationType: createTextField({ required: true }), // qualified name or "*"
     channel: createTextField({ required: true }), // "inApp", "email", "push", or "*"
     enabled: createBooleanField({ default: true }),

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -0,0 +1,120 @@
+// Event-PII on the jobs run-logger (#799): runStarted.payload can carry
+// arbitrary user data and is written via LOW-LEVEL append() (not
+// ctx.appendEvent) — exactly the path the event-PII catalog must cover.
+// With a KMS active the stored event AND the projected read-row carry
+// ciphertext under the triggering user's DEK; erasing that key makes the
+// payload unreadable ([[erased]]) without touching the append-only stream.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  PII_ERASED_SENTINEL,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestDb,
+  createTestRedis,
+  type TestDb,
+  type TestRedis,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { createJobsFeature } from "../feature";
+import { createJobRunLogger, JOB_RUN_STARTED_EVENT } from "../job-run-logger";
+import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
+
+let testDb: TestDb;
+let testRedis: TestRedis;
+let logger: ReturnType<typeof createJobRunLogger>;
+let kms: InMemoryKmsAdapter;
+
+const USER_ID = "u-pii-9";
+const SECRET_PAYLOAD = JSON.stringify({ iban: "DE89370400440532013000" });
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  testRedis = await createTestRedis();
+  // createRegistry publishes the event-PII catalog as a module singleton —
+  // the logger's low-level append() picks it up without further wiring.
+  const registry = createRegistry([createJobsFeature()]);
+  await unsafePushTables(testDb.db, { jobRunsTable, jobRunLogsTable });
+  await createEventsTable(testDb.db);
+  logger = createJobRunLogger({ db: testDb.db, registry });
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+  await testRedis.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(testDb.db, [eventsTable, jobRunsTable, jobRunLogsTable]);
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+describe("jobs run-started payload under KMS", () => {
+  test("stored event carries ciphertext payload, plaintext triggeredById", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-1", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+      attempt: 1,
+    });
+
+    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
+    expect(events.length).toBe(1);
+    const payload = events[0]?.payload as Record<string, unknown>;
+    expect(isPiiCiphertext(payload["payload"])).toBe(true);
+    expect(String(payload["payload"])).toContain(`user:${USER_ID}`);
+    expect(payload["triggeredById"]).toBe(USER_ID);
+
+    const back = await decryptPiiFieldValues(payload, ["payload"], kms, { requestId: "t" });
+    expect(back["payload"]).toBe(SECRET_PAYLOAD);
+  });
+
+  test("projected read-row carries the same ciphertext; erase → [[erased]]", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-2", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-2" });
+    expect(isPiiCiphertext(row?.["payload"])).toBe(true);
+
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+    const after = await decryptPiiFieldValues({ payload: row?.["payload"] }, ["payload"], kms, {
+      requestId: "t",
+    });
+    expect(after["payload"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  test("system run (no triggeredById) stays plaintext — no subject to shred", async () => {
+    await logger.onJobStart?.("app:job:cron-sweep", "bull-3", {
+      payload: JSON.stringify({ scope: "all" }),
+    });
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-3" });
+    expect(row?.["payload"]).toBe(JSON.stringify({ scope: "all" }));
+  });
+
+  test("without a KMS the payload stays plaintext (rollout mode)", async () => {
+    resetPiiSubjectKmsForTests();
+    await logger.onJobStart?.("app:job:export", "bull-4", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-4" });
+    expect(row?.["payload"]).toBe(SECRET_PAYLOAD);
+  });
+});

package/src/jobs/feature.ts

@@ -44,7 +44,12 @@ export function createJobsFeature(): FeatureDefinition {
     // (no executor, no CRUD). The boot-validator accepts the two
     // projections below because every apply-key is a registered
     // domain-event.
-    r.defineEvent("run-started", runStartedSchema);
+    // payload can carry arbitrary user data; triggeredById stays plaintext
+    // (pseudonymous fk). System runs (triggeredById null) stay plaintext —
+    // no user subject to shred.
+    r.defineEvent("run-started", runStartedSchema, {
+      piiFields: { payload: { subjectField: "triggeredById" } },
+    });
     r.defineEvent("run-completed", runCompletedSchema);
     r.defineEvent("run-failed", runFailedSchema);
 

package/src/jobs/handlers/detail.query.ts

@@ -1,6 +1,7 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 export const detailQuery = defineQueryHandler({
@@ -18,6 +19,11 @@ export const detailQuery = defineQueryHandler({
 
     if (!row) return null;
 
+    // payload is stored encrypted under the triggering user's DEK (#799).
+    if (typeof row["payload"] === "string") {
+      row["payload"] = await decryptStoredPii(row["payload"], "job-run-detail");
+    }
+
     const logs = await selectMany(
       db,
       jobRunLogsTable,