@cosmicdrift/kumiko-bundled-features 0.119.0 → 0.121.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.119.0",
+  "version": "0.121.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -96,11 +96,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.119.0",
-    "@cosmicdrift/kumiko-framework": "0.119.0",
-    "@cosmicdrift/kumiko-headless": "0.119.0",
-    "@cosmicdrift/kumiko-renderer": "0.119.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.119.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.121.0",
+    "@cosmicdrift/kumiko-framework": "0.121.0",
+    "@cosmicdrift/kumiko-headless": "0.121.0",
+    "@cosmicdrift/kumiko-renderer": "0.121.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.121.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/delivery/__tests__/delivery-pii-kms.integration.test.ts

@@ -0,0 +1,171 @@
+// Delivery-attempt log under KMS (#799): recipientAddress is written via
+// LOW-LEVEL append() in attempt-log.ts — the event-PII catalog must cover
+// it. Stored event + projected row carry ciphertext under the recipient's
+// DEK, the outgoing mail still reaches the PLAINTEXT address, the admin
+// log.query decrypts for display, and erasing the recipient's key flips
+// the log entry to [[erased]] without touching the append-only stream.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  PII_ERASED_SENTINEL,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import {
+  defineFeature,
+  defineWriteHandler,
+  type NotifyFn,
+  qn,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { z } from "zod";
+import { createChannelEmailFeature } from "../../channel-email/feature";
+import { createInMemoryTransport } from "../../channel-email/types";
+import { createConfigFeature } from "../../config/feature";
+import { configValuesTable } from "../../config/table";
+import { createRendererFoundationFeature } from "../../renderer-foundation/feature";
+import { createRendererSimpleFeature } from "../../renderer-simple/feature";
+import { simpleRenderer } from "../../renderer-simple/simple-renderer";
+import { createTemplateResolverFeature } from "../../template-resolver/feature";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { DELIVERY_ATTEMPT_EVENT } from "../constants";
+import { createDeliveryFeature } from "../feature";
+import { deliveryAttemptsTable, notificationPreferencesTable } from "../tables";
+import { createDeliveryTestContext } from "../testing";
+
+const emailTransport = createInMemoryTransport();
+const testEmail = (userId: string | number) => `user-${userId}@test.com`;
+
+const admin = TestUsers.admin;
+const recipient = createTestUser({ id: 7, roles: ["User"] });
+
+const appFeature = defineFeature("app", (r) => {
+  r.requires("delivery");
+
+  r.writeHandler(
+    defineWriteHandler({
+      name: "ping",
+      schema: z.object({ toUserId: z.string() }),
+      handler: async (event, ctx) => {
+        const notify = ctx.notify as NotifyFn;
+        await notify(qn("app", "notify", "pinged"), {
+          to: event.payload.toUserId,
+          data: { title: "Ping", body: "Du wurdest angepingt" },
+        });
+        return { isSuccess: true, data: { sent: true } };
+      },
+      access: { openToAll: true },
+    }),
+  );
+});
+
+let stack: TestStack;
+let kms: InMemoryKmsAdapter;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createTemplateResolverFeature(),
+      createRendererFoundationFeature(),
+      createDeliveryFeature(),
+      createRendererSimpleFeature(),
+      createChannelEmailFeature({
+        transport: emailTransport,
+        renderer: simpleRenderer,
+        resolveEmail: async (userId) => testEmail(userId),
+      }),
+      appFeature,
+    ],
+    extraContext: (deps) => createDeliveryTestContext(deps),
+  });
+
+  await unsafePushTables(stack.db, {
+    configValuesTable,
+    tenantMembershipsTable,
+    notificationPreferencesTable,
+  });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+// ONE kms for the whole file: rows persist across tests, so a fresh adapter
+// per test would orphan earlier ciphertext (decrypt fails loud on KeyNotFound).
+beforeEach(() => {
+  kms ??= new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+  emailTransport.sent.length = 0;
+});
+
+afterAll(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+async function pingRecipient(): Promise<void> {
+  await stack.http.writeOk(qn("app", "write", "ping"), { toUserId: recipient.id }, admin);
+}
+
+describe("delivery attempt log under KMS", () => {
+  test("mail goes to the plaintext address; event + row store ciphertext", async () => {
+    await pingRecipient();
+
+    expect(emailTransport.sent.length).toBe(1);
+    expect(emailTransport.sent[0]?.to).toBe(testEmail(recipient.id));
+
+    const events = await selectMany(stack.db, eventsTable, { type: DELIVERY_ATTEMPT_EVENT });
+    const sent = events
+      .map((e) => e.payload as Record<string, unknown>)
+      .find((p) => p["channel"] === "email" && p["status"] === "sent");
+    expect(sent).toBeDefined();
+    expect(isPiiCiphertext(sent?.["recipientAddress"])).toBe(true);
+    expect(String(sent?.["recipientAddress"])).toContain(`user:${recipient.id}`);
+    expect(sent?.["recipientId"]).toBe(recipient.id);
+
+    const rows = await selectMany(stack.db, deliveryAttemptsTable, {
+      recipientId: recipient.id,
+      channel: "email",
+    });
+    expect(rows.length).toBeGreaterThan(0);
+    expect(isPiiCiphertext(rows[0]?.["recipientAddress"])).toBe(true);
+  });
+
+  test("admin log.query decrypts for display; after key-erase it shows [[erased]]", async () => {
+    await pingRecipient();
+
+    const before = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      "delivery:query:log",
+      { limit: 100 },
+      admin,
+    );
+    const entry = before.rows.find(
+      (r) => r["recipientId"] === recipient.id && r["channel"] === "email",
+    );
+    expect(entry?.["recipientAddress"]).toBe(testEmail(recipient.id));
+
+    await kms.eraseKey({ kind: "user", userId: recipient.id });
+
+    const after = await stack.http.queryOk<{ rows: Record<string, unknown>[] }>(
+      "delivery:query:log",
+      { limit: 100 },
+      admin,
+    );
+    const erased = after.rows.find(
+      (r) => r["recipientId"] === recipient.id && r["channel"] === "email",
+    );
+    expect(erased?.["recipientAddress"]).toBe(PII_ERASED_SENTINEL);
+  });
+});

package/src/delivery/feature.ts

@@ -40,7 +40,11 @@ export function createDeliveryFeature(): FeatureDefinition {
     // attempt is a fresh stream, no CRUD lifecycle. Framework's
     // boot-validator accepts the projection below because at least one
     // apply-key is a registered domain-event (DELIVERY_ATTEMPT_EVENT).
-    r.defineEvent("attempt", deliveryAttemptSchema);
+    // recipientAddress is the real PII (email address); recipientId stays
+    // plaintext — pseudonymous fk, same line as config.userId (#821).
+    r.defineEvent("attempt", deliveryAttemptSchema, {
+      piiFields: { recipientAddress: { subjectField: "recipientId" } },
+    });
 
     // Inline projection that materialises every delivery attempt into
     // deliveryAttemptsTable. Runs in the SAME transaction as the low-level

package/src/delivery/handlers/log.query.ts

@@ -1,6 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { deliveryAttemptsTable } from "../tables";
 
 export const logQuery = defineQueryHandler({
@@ -14,6 +15,18 @@ export const logQuery = defineQueryHandler({
       orderBy: { col: "createdAt", direction: "desc" },
       limit: query.payload.limit,
     });
-    return { rows };
+    // recipientAddress is stored encrypted under the recipient's DEK (#799)
+    // — decrypt for the admin log view; forgotten subjects show [[erased]].
+    return {
+      rows: await Promise.all(
+        rows.map(async (row) => ({
+          ...row,
+          recipientAddress:
+            typeof row["recipientAddress"] === "string"
+              ? await decryptStoredPii(row["recipientAddress"], "delivery-log")
+              : row["recipientAddress"],
+        })),
+      ),
+    };
   },
 });

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -0,0 +1,120 @@
+// Event-PII on the jobs run-logger (#799): runStarted.payload can carry
+// arbitrary user data and is written via LOW-LEVEL append() (not
+// ctx.appendEvent) — exactly the path the event-PII catalog must cover.
+// With a KMS active the stored event AND the projected read-row carry
+// ciphertext under the triggering user's DEK; erasing that key makes the
+// payload unreadable ([[erased]]) without touching the append-only stream.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  decryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  PII_ERASED_SENTINEL,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestDb,
+  createTestRedis,
+  type TestDb,
+  type TestRedis,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import { createJobsFeature } from "../feature";
+import { createJobRunLogger, JOB_RUN_STARTED_EVENT } from "../job-run-logger";
+import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
+
+let testDb: TestDb;
+let testRedis: TestRedis;
+let logger: ReturnType<typeof createJobRunLogger>;
+let kms: InMemoryKmsAdapter;
+
+const USER_ID = "u-pii-9";
+const SECRET_PAYLOAD = JSON.stringify({ iban: "DE89370400440532013000" });
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  testRedis = await createTestRedis();
+  // createRegistry publishes the event-PII catalog as a module singleton —
+  // the logger's low-level append() picks it up without further wiring.
+  const registry = createRegistry([createJobsFeature()]);
+  await unsafePushTables(testDb.db, { jobRunsTable, jobRunLogsTable });
+  await createEventsTable(testDb.db);
+  logger = createJobRunLogger({ db: testDb.db, registry });
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+  await testRedis.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(testDb.db, [eventsTable, jobRunsTable, jobRunLogsTable]);
+  kms = new InMemoryKmsAdapter();
+  configurePiiSubjectKms(kms);
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+});
+
+describe("jobs run-started payload under KMS", () => {
+  test("stored event carries ciphertext payload, plaintext triggeredById", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-1", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+      attempt: 1,
+    });
+
+    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
+    expect(events.length).toBe(1);
+    const payload = events[0]?.payload as Record<string, unknown>;
+    expect(isPiiCiphertext(payload["payload"])).toBe(true);
+    expect(String(payload["payload"])).toContain(`user:${USER_ID}`);
+    expect(payload["triggeredById"]).toBe(USER_ID);
+
+    const back = await decryptPiiFieldValues(payload, ["payload"], kms, { requestId: "t" });
+    expect(back["payload"]).toBe(SECRET_PAYLOAD);
+  });
+
+  test("projected read-row carries the same ciphertext; erase → [[erased]]", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-2", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-2" });
+    expect(isPiiCiphertext(row?.["payload"])).toBe(true);
+
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+    const after = await decryptPiiFieldValues({ payload: row?.["payload"] }, ["payload"], kms, {
+      requestId: "t",
+    });
+    expect(after["payload"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  test("system run (no triggeredById) stays plaintext — no subject to shred", async () => {
+    await logger.onJobStart?.("app:job:cron-sweep", "bull-3", {
+      payload: JSON.stringify({ scope: "all" }),
+    });
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-3" });
+    expect(row?.["payload"]).toBe(JSON.stringify({ scope: "all" }));
+  });
+
+  test("without a KMS the payload stays plaintext (rollout mode)", async () => {
+    resetPiiSubjectKmsForTests();
+    await logger.onJobStart?.("app:job:export", "bull-4", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-4" });
+    expect(row?.["payload"]).toBe(SECRET_PAYLOAD);
+  });
+});

package/src/jobs/feature.ts

@@ -44,7 +44,12 @@ export function createJobsFeature(): FeatureDefinition {
     // (no executor, no CRUD). The boot-validator accepts the two
     // projections below because every apply-key is a registered
     // domain-event.
-    r.defineEvent("run-started", runStartedSchema);
+    // payload can carry arbitrary user data; triggeredById stays plaintext
+    // (pseudonymous fk). System runs (triggeredById null) stay plaintext —
+    // no user subject to shred.
+    r.defineEvent("run-started", runStartedSchema, {
+      piiFields: { payload: { subjectField: "triggeredById" } },
+    });
     r.defineEvent("run-completed", runCompletedSchema);
     r.defineEvent("run-failed", runFailedSchema);
 

package/src/jobs/handlers/detail.query.ts

@@ -1,6 +1,7 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 export const detailQuery = defineQueryHandler({
@@ -18,6 +19,11 @@ export const detailQuery = defineQueryHandler({
 
     if (!row) return null;
 
+    // payload is stored encrypted under the triggering user's DEK (#799).
+    if (typeof row["payload"] === "string") {
+      row["payload"] = await decryptStoredPii(row["payload"], "job-run-detail");
+    }
+
     const logs = await selectMany(
       db,
       jobRunLogsTable,

package/src/jobs/handlers/list.query.ts

@@ -1,8 +1,14 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { jobRunsTable } from "../job-run-table";
 
+async function decryptRunPayload<T extends Record<string, unknown>>(row: T): Promise<T> {
+  if (typeof row["payload"] !== "string") return row;
+  return { ...row, payload: await decryptStoredPii(row["payload"], "job-runs") };
+}
+
 export const listQuery = defineQueryHandler({
   name: "list",
   schema: z.object({
@@ -19,6 +25,7 @@ export const listQuery = defineQueryHandler({
       orderBy: { col: "id", direction: "desc" },
       limit: query.payload.limit ?? 50,
     });
-    return { rows };
+    // payload is stored encrypted under the triggering user's DEK (#799).
+    return { rows: await Promise.all(rows.map(decryptRunPayload)) };
   },
 });

package/src/user-data-rights-defaults/__tests__/bundled-entities.userdata-hooks.integration.test.ts

@@ -25,6 +25,7 @@ import { configValueEntity, createConfigFeature } from "../../config";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createDeliveryFeature, notificationPreferenceEntity } from "../../delivery";
 import { createFilesFeature } from "../../files";
+import { createJobsFeature, jobRunLogsTable, jobRunsTable } from "../../jobs";
 import {
   apiTokenEntity,
   createPersonalAccessTokensFeature,
@@ -41,8 +42,10 @@ import {
   apiTokenExportHook,
   configValueDeleteHook,
   configValueExportHook,
+  deliveryAttemptExportHook,
   inAppMessageDeleteHook,
   inAppMessageExportHook,
+  jobRunExportHook,
   notificationPreferenceDeleteHook,
   notificationPreferenceExportHook,
   tenantInvitationDeleteHook,
@@ -71,6 +74,7 @@ beforeAll(async () => {
       createPersonalAccessTokensFeature({ scopes: PAT_SCOPES }),
       createDeliveryFeature(),
       createChannelInAppFeature(),
+      createJobsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),
     ],
@@ -81,7 +85,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(full.db, tenantInvitationEntity);
   await unsafeCreateEntityTable(full.db, notificationPreferenceEntity);
   await unsafeCreateEntityTable(full.db, configValueEntity);
-  await unsafePushTables(full.db, { inAppMessagesTable });
+  await unsafePushTables(full.db, { inAppMessagesTable, jobRunsTable, jobRunLogsTable });
 
   minimal = await setupTestStack({
     features: [
@@ -364,6 +368,60 @@ describe("config-value userData-hooks", () => {
   });
 });
 
+describe("delivery-attempt userData-hooks (#799)", () => {
+  async function seedAttempt(id: string, recipientId: string, tenantId: string): Promise<void> {
+    await asRawClient(full.db).unsafe(
+      `INSERT INTO read_delivery_attempts
+         (id, tenant_id, notification_type, channel, recipient_id, recipient_address, status, priority)
+       VALUES ($1, $2, 'app:notify:ping', 'email', $3, $4, 'sent', 'normal')`,
+      [id, tenantId, recipientId, `user-${recipientId}@example.com`],
+    );
+  }
+
+  test("export returns only the user's attempts in the export tenant", async () => {
+    await seedAttempt(uuid(60), "da-user-1", TENANT_A);
+    await seedAttempt(uuid(61), "da-user-1", TENANT_B);
+    await seedAttempt(uuid(62), "da-user-2", TENANT_A);
+
+    const result = await deliveryAttemptExportHook(ctx("da-user-1"));
+    expect(result?.entity).toBe("delivery-attempt");
+    expect(result?.rows).toHaveLength(1);
+    expect(result?.rows[0]?.["recipientAddress"]).toBe("user-da-user-1@example.com");
+    expect(result?.rows[0]?.["channel"]).toBe("email");
+  });
+
+  test("export returns null for a user without attempts", async () => {
+    expect(await deliveryAttemptExportHook(ctx("da-nobody"))).toBeNull();
+  });
+});
+
+describe("job-run userData-hooks (#799)", () => {
+  async function seedRun(id: string, triggeredById: string | null): Promise<void> {
+    await asRawClient(full.db).unsafe(
+      `INSERT INTO read_job_runs
+         (id, tenant_id, job_name, bull_job_id, status, payload, attempt, started_at, triggered_by_id)
+       VALUES ($1::uuid, $2, 'app:job:export', $3, 'completed', '{"scope":"mine"}', 1, now(), $4)`,
+      [id, TENANT_A, `bull-${id}`, triggeredById],
+    );
+  }
+
+  test("export filters by triggeredById only (system-tenant rows)", async () => {
+    await seedRun(uuid(70), "jr-user-1");
+    await seedRun(uuid(71), "jr-user-2");
+    await seedRun(uuid(72), null);
+
+    const result = await jobRunExportHook(ctx("jr-user-1"));
+    expect(result?.entity).toBe("job-run");
+    expect(result?.rows).toHaveLength(1);
+    expect(result?.rows[0]?.["jobName"]).toBe("app:job:export");
+    expect(result?.rows[0]?.["payload"]).toBe('{"scope":"mine"}');
+  });
+
+  test("export returns null for a user without runs", async () => {
+    expect(await jobRunExportHook(ctx("jr-nobody"))).toBeNull();
+  });
+});
+
 describe("Presence-Gating: Source-Feature nicht gemountet → null/no-op statt Crash", () => {
   test("alle gegateten Hooks no-open auf dem Minimal-Stack", async () => {
     const minCtx = {
@@ -382,6 +440,8 @@ describe("Presence-Gating: Source-Feature nicht gemountet → null/no-op statt C
     expect(await tenantInvitationExportHook(minCtx)).toBeNull();
     expect(await notificationPreferenceExportHook(minCtx)).toBeNull();
     expect(await configValueExportHook(minCtx)).toBeNull();
+    expect(await deliveryAttemptExportHook(minCtx)).toBeNull();
+    expect(await jobRunExportHook(minCtx)).toBeNull();
 
     await expect(apiTokenDeleteHook(minCtx, "delete")).resolves.toBeUndefined();
     await expect(inAppMessageDeleteHook(minCtx, "delete")).resolves.toBeUndefined();

package/src/user-data-rights-defaults/feature.ts

@@ -5,11 +5,16 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook";
 import { configValueDeleteHook, configValueExportHook } from "./hooks/config-value.userdata-hook";
+import {
+  deliveryAttemptDeleteHook,
+  deliveryAttemptExportHook,
+} from "./hooks/delivery-attempt.userdata-hook";
 import { fileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook";
 import {
   inAppMessageDeleteHook,
   inAppMessageExportHook,
 } from "./hooks/in-app-message.userdata-hook";
+import { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook";
 import {
   notificationPreferenceDeleteHook,
   notificationPreferenceExportHook,
@@ -46,7 +51,7 @@ import { userSessionDeleteHook, userSessionExportHook } from "./hooks/user-sessi
 export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
   return defineFeature("user-data-rights-defaults", (r) => {
     r.describe(
-      "Registers ready-made `EXT_USER_DATA` export and delete hooks for the bundled entities that hold per-user data: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`), `fileRef` (delete removes both the DB row and the storage binary), plus — gated on the source feature being mounted — `user-session` (ip/userAgent, hard-delete), `api-token` (hard-delete = revoke), `in-app-message` (hard-delete), `tenant-invitation` (invitee email forgotten/pseudonymized, inviter link severed), `notification-preference` and user-scoped `config-value` (purged via the forget verb). Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.",
+      "Registers ready-made `EXT_USER_DATA` export and delete hooks for the bundled entities that hold per-user data: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`), `fileRef` (delete removes both the DB row and the storage binary), plus — gated on the source feature being mounted — `user-session` (ip/userAgent, hard-delete), `api-token` (hard-delete = revoke), `in-app-message` (hard-delete), `tenant-invitation` (invitee email forgotten/pseudonymized, inviter link severed), `notification-preference` and user-scoped `config-value` (purged via the forget verb), plus export-only hooks for the events-only aggregates `delivery-attempt` (recipientAddress) and `job-run` (payload) whose erasure runs via crypto-shredding. Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.",
     );
     r.uiHints({
       displayLabel: "User Data Rights · Default Hooks",
@@ -65,6 +70,7 @@ export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
       "tenant",
       "delivery",
       "config",
+      "jobs",
     );
 
     r.useExtension(EXT_USER_DATA, "user", {
@@ -106,5 +112,19 @@ export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
       export: configValueExportHook,
       delete: configValueDeleteHook,
     });
+
+    // Events-only aggregates (#799): export reads the projected rows, the
+    // delete hooks are deliberate no-ops — erasure happens via crypto-
+    // shredding (forget erases the user's DEK; recipientAddress / job
+    // payload become unreadable in events AND rows).
+    r.useExtension(EXT_USER_DATA, "delivery-attempt", {
+      export: deliveryAttemptExportHook,
+      delete: deliveryAttemptDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "job-run", {
+      export: jobRunExportHook,
+      delete: jobRunDeleteHook,
+    });
   });
 }

package/src/user-data-rights-defaults/hooks/delivery-attempt.userdata-hook.ts

@@ -0,0 +1,37 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { deliveryAttemptsTable } from "../../delivery";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for delivery's attempt log (deferred from #797, closed by
+// #799). deliveryAttempt is an events-only aggregate — the export reads the
+// projected rows; recipientAddress may be ciphertext (kumiko-pii:), which
+// the export runner's central decrypt sweep resolves to plaintext (or
+// [[erased]] after a forget).
+
+export const deliveryAttemptExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "delivery")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, deliveryAttemptsTable, {
+    tenantId: ctx.tenantId,
+    recipientId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "delivery-attempt",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"],
+      channel: r["channel"],
+      status: r["status"],
+      recipientAddress: r["recipientAddress"],
+      priority: r["priority"],
+      createdAt: r["createdAt"],
+    })),
+  };
+};
+
+export const deliveryAttemptDeleteHook: UserDataDeleteHook = async () => {
+  // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
+  // erases the recipient's DEK, which makes recipientAddress unreadable in
+  // BOTH the append-only events and the projected rows (#799). A read-side
+  // UPDATE here would be wiped on the next projection rebuild anyway.
+};

package/src/user-data-rights-defaults/hooks/job-run.userdata-hook.ts

@@ -0,0 +1,35 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { jobRunsTable } from "../../jobs";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for the jobs run log (deferred from #797, closed by #799).
+// Job runs live on the SYSTEM tenant regardless of who triggered them, so
+// the export filters by triggeredById only — Art. 15 covers everything the
+// user caused, across tenants. payload may be ciphertext (kumiko-pii:); the
+// export runner's central decrypt sweep resolves it.
+
+export const jobRunExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "jobs")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, jobRunsTable, {
+    triggeredById: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "job-run",
+    rows: rows.map((r) => ({
+      jobName: r["jobName"],
+      status: r["status"],
+      payload: r["payload"],
+      startedAt: r["startedAt"],
+      finishedAt: r["finishedAt"],
+    })),
+  };
+};
+
+export const jobRunDeleteHook: UserDataDeleteHook = async () => {
+  // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
+  // erases the triggering user's DEK, which makes the payload unreadable in
+  // BOTH the append-only events and the projected rows (#799). triggeredById
+  // itself is a pseudonymous fk (plaintext by design, like config.userId).
+};

package/src/user-data-rights-defaults/hooks/notification-preference.userdata-hook.ts

@@ -13,10 +13,8 @@ import { featureMounted } from "./feature-mounted";
 // A preference without its user is meaningless, so both strategies purge via
 // the forget verb.
 //
-// The delivery ATTEMPTS log (read_delivery_attempts, recipientAddress) is NOT
-// covered here: it is an events-only aggregate whose payload lives in the
-// append-only event store — per-user redaction there needs the event-store
-// redaction epic; a read-side UPDATE would be wiped on rebuild.
+// The delivery ATTEMPTS log is covered separately: export via
+// delivery-attempt.userdata-hook.ts, erasure via crypto-shredding (#799).
 
 const crud = createEventStoreExecutor(notificationPreferencesTable, notificationPreferenceEntity, {
   entityName: "notification-preference",

package/src/user-data-rights-defaults/index.ts

@@ -4,6 +4,10 @@ export {
   configValueDeleteHook,
   configValueExportHook,
 } from "./hooks/config-value.userdata-hook";
+export {
+  deliveryAttemptDeleteHook,
+  deliveryAttemptExportHook,
+} from "./hooks/delivery-attempt.userdata-hook";
 export {
   fileRefDeleteHook,
   fileRefExportHook,
@@ -12,6 +16,7 @@ export {
   inAppMessageDeleteHook,
   inAppMessageExportHook,
 } from "./hooks/in-app-message.userdata-hook";
+export { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook";
 export {
   notificationPreferenceDeleteHook,
   notificationPreferenceExportHook,