@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.159.1

package/src/tier-engine/feature.ts

@@ -62,7 +62,7 @@ import {
   type TierResolverPlugin,
   type TrialGate,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { getAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { tenantTable } from "../tenant";
@@ -365,7 +365,7 @@ export function createTierEngineFeature<
 
           // Idempotency: stream-existence-check vor create. Pattern aus
           // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
-          const streamVersion = await getAggregateStreamMaxVersion(rawDb, aggregateId);
+          const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
           // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
           if (streamVersion > 0) return;
 

package/src/user-data-rights/COMPLIANCE.md

@@ -45,6 +45,26 @@ Dieses Dokument bündelt die **technischen Fakten** zur DSGVO-Pipeline
 | `read_tenant_retention_overrides` | Per-Tenant Retention-Override pro Entity | nein | unbounded (Konfiguration) | Aufbewahrungspflicht-Edge-Cases |
 | Storage-Provider (Local / S3) | Export-ZIPs + File-Binaries | indirekt (Inhalt) | Local: per `exportDownloadTtl` Cleanup. S3: lifecycle-Policy (App-Author-Verantwortung) | Daten-Export-Auslieferung |
 
+### Bekanntes Residuum: `createdBy` / `metadata.userId` in `kumiko_events`
+
+Nach der Forget-Pipeline (Art. 17, Abschnitt 1) bleiben `kumiko_events.created_by`
+und `metadata.userId` (Event-Store-Schema `events-schema.ts`, EventMetadata-Feld)
+als Klartext-UUID stehen. Die Forget-Hooks aus `user-data-rights-defaults` fassen
+`kumiko_events` nicht an — `createdBy`/`metadata.userId` sind keine über
+`defineEvent(..., { piiFields })` deklarierten Payload-PII-Felder (siehe
+`packages/framework/src/crypto/event-pii.ts`) und laufen deshalb nicht durch die
+Payload-Verschlüsselung. Löschung dieser Rows erfolgt ausschließlich über die
+zeitbasierte `data-retention`-Policy (`keepFor`, s. `kumiko_events`-Zeile in Abschnitt
+2 oben), unabhängig vom User-Forget-Antrag.
+
+Technische Basis: Der `read_users`-Row zur betroffenen UUID wird beim Forget-Run
+in-place anonymisiert, nicht hard-gelöscht (Sentinel-Pattern, siehe Abschnitt 4
+„Integrität"). Email, Displayname und Passwort-Hash werden dabei entfernt/ersetzt —
+das ist der Schlüssel, der die Verknüpfung kappt: Sobald diese Felder weg sind, gibt
+es keinen Rückweg von der UUID in `created_by` zu einer realen Identität mehr. Die
+UUID bleibt als stabiler, aber orphaned Pseudonym-Wert bestehen, bis die
+Retention-Policy irgendwann das Event selbst löscht.
+
 ---
 
 ## 3. Compliance-Profile

package/src/user-data-rights/__tests__/anonymous-deletion-kms.integration.test.ts

@@ -4,6 +4,7 @@
 // KLARTEXT schicken (vorher: Ciphertext-Adresse → Mail unzustellbar).
 
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configureBlindIndexKey,
@@ -58,6 +59,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature({
         deletionTokenSecret: DELETION_SECRET,

package/src/user-data-rights/__tests__/anonymous-deletion.integration.test.ts

@@ -6,6 +6,7 @@
 // Beweist end-to-end via echte /api/write-Calls OHNE Auth (anonymousAccess).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -53,6 +54,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature({
         deletionTokenSecret: DELETION_SECRET,
@@ -331,6 +333,7 @@ describe("anonymous deletion flow — not configured (kein Secret)", () => {
         createUserFeature(),
         createDataRetentionFeature(),
         createComplianceProfilesFeature(),
+        authFoundationFeature,
         createSessionsFeature(),
         createUserDataRightsFeature({
           sendDeletionVerificationEmail: async (args) => {

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -1,6 +1,7 @@
 // S2.U7 — my-audit-log + invalid-attempt-audit + list-download-attempts.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -39,6 +40,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -0,0 +1,172 @@
+import { describe, expect, test } from "bun:test";
+import { integer, type SchemaTable, table, uuid } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  EXT_TENANT_DATA,
+  EXT_USER_DATA,
+  validateBoot,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
+import { z } from "zod";
+import { EXT_SESSION_STORE } from "../../auth-foundation";
+import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
+import { createConfigFeature } from "../../config/feature";
+import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createSessionsFeature } from "../../sessions/feature";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle/feature";
+import { createUserFeature } from "../../user/feature";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
+import { createUserDataRightsFeature } from "../feature";
+
+// GDPR-storage guards V2 (export-without-erase) and V3 (pii-entity-without-
+// hook) moved off the framework-internal boot-validator onto user-data-
+// rights' own `r.bootCheck()` (#1314); V4 (tenantOwned-entity-without-hook)
+// onto tenant-lifecycle's own `r.bootCheck()` — tenant-lifecycle owns
+// EXT_TENANT_DATA, so its own mount preserves the original guard's trigger
+// exactly (gating on a sibling feature would silently narrow coverage).
+// Unlike the old direct-function tests, these only run inside a real
+// validateBoot() pass — exercising the actual `r.bootCheck()` plumbing, not
+// just the guard logic.
+// Stub instead of the real auth-foundation — these boot-checks are about
+// GDPR-storage guards, not auth; only sessions' sessionStore registration
+// needs an owner present.
+const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
+  r.extendsRegistrar(EXT_SESSION_STORE, {});
+});
+
+function baseFeatures() {
+  return [
+    createConfigFeature(),
+    createUserFeature(),
+    sessionStoreOwnerStub,
+    createSessionsFeature(),
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createFilesFeature(),
+    createUserDataRightsFeature(),
+    createUserDataRightsDefaultsFeature(),
+  ];
+}
+
+// Minimal tenant-lifecycle assembly with NO user-data-rights* mounted at all
+// — proves V4 fires from tenant-lifecycle's own mount, not from a sibling
+// feature accidentally re-gating it.
+function minimalTenantLifecycleFeatures() {
+  return [
+    createConfigFeature(),
+    createTenantFeature(),
+    createComplianceProfilesFeature(),
+    createTenantLifecycleFeature(),
+  ];
+}
+
+describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
+  test("known-good assembly boot-validates (baseline)", () => {
+    expect(() => validateBoot(baseFeatures())).not.toThrow();
+  });
+
+  test("V2: export hook without delete hook → Art.17 throw", () => {
+    const bad = defineFeature("bad-export", (r) => {
+      r.requires("user-data-rights");
+      r.useExtension(EXT_USER_DATA, "badEntity", { export: async () => null });
+    });
+    expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/Art\.17/);
+  });
+
+  test("V3: pii entity without any EXT_USER_DATA hook → throws the guard's own message", () => {
+    const bad = defineFeature("crm", (r) => {
+      r.entity("contact", createEntity({ fields: { email: createTextField({ pii: true }) } }));
+    });
+    expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/EXT_USER_DATA hook.*Art\.17 gap/);
+  });
+
+  test("V3: pii field on a projection-only entity (no r.entity) is still caught", () => {
+    const projectionTable = table("crm_contact_summary", {
+      id: uuid("id").primaryKey(),
+      count: integer("count").notNull().default(0),
+    }) as unknown as SchemaTable;
+    const bad = defineFeature("crm", (r) => {
+      const contactCreated = r.defineEvent("contact-created", z.unknown());
+      r.projection({
+        name: "contact-summary",
+        source: "contact",
+        table: projectionTable,
+        apply: { [contactCreated.name]: async () => {} },
+        entity: createEntity({ fields: { email: createTextField({ pii: true }) } }),
+      });
+    });
+    expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/EXT_USER_DATA hook.*Art\.17 gap/);
+  });
+
+  test("V3: projection-only pii entity WITH EXT_USER_DATA hook registered for its entity name → no throw", () => {
+    const projectionTable = table("crm_contact_summary_hooked", {
+      id: uuid("id").primaryKey(),
+      count: integer("count").notNull().default(0),
+    }) as unknown as SchemaTable;
+    const hooked = defineFeature("crm-hooked", (r) => {
+      r.requires("user-data-rights");
+      const contactCreated = r.defineEvent("contact-hooked-created", z.unknown());
+      r.projection({
+        name: "contact-summary",
+        source: "contact",
+        table: projectionTable,
+        apply: { [contactCreated.name]: async () => {} },
+        entity: createEntity({ fields: { email: createTextField({ pii: true }) } }),
+      });
+      r.useExtension(EXT_USER_DATA, "contact-summary", {
+        export: async () => null,
+        delete: async () => {},
+      });
+    });
+    expect(() => validateBoot([...baseFeatures(), hooked])).not.toThrow();
+  });
+
+  test("V4: tenantOwned entity without EXT_TENANT_DATA hook, tenant-lifecycle mounted → throws the guard's own message", () => {
+    const bad = defineFeature("billing", (r) => {
+      r.entity(
+        "subscription",
+        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+      );
+    });
+    expect(() => validateBoot([...minimalTenantLifecycleFeatures(), bad])).toThrow(
+      /EXT_TENANT_DATA destroy hook/,
+    );
+  });
+
+  test("V4: fires with no user-data-rights* mounted at all — trigger is tenant-lifecycle's own mount", () => {
+    const bad = defineFeature("billing", (r) => {
+      r.entity(
+        "subscription",
+        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+      );
+    });
+    const features = minimalTenantLifecycleFeatures().concat(bad);
+    expect(features.some((f) => f.name.startsWith("user-data-rights"))).toBe(false);
+    expect(() => validateBoot(features)).toThrow(/EXT_TENANT_DATA destroy hook/);
+  });
+
+  test("V4: tenant-lifecycle not mounted → tenantOwned entity does not throw", () => {
+    const notMounted = defineFeature("billing-standalone", (r) => {
+      r.entity(
+        "subscription",
+        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+      );
+    });
+    expect(() => validateBoot([...baseFeatures(), notMounted])).not.toThrow();
+  });
+
+  test("V4: tenantOwned entity WITH EXT_TENANT_DATA hook registered → no throw", () => {
+    const hooked = defineFeature("billing-hooked", (r) => {
+      r.requires("tenant-lifecycle");
+      r.entity(
+        "subscription",
+        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+      );
+      r.useExtension(EXT_TENANT_DATA, "subscription", { destroy: async () => {} });
+    });
+    expect(() => validateBoot([...minimalTenantLifecycleFeatures(), hooked])).not.toThrow();
+  });
+});

package/src/user-data-rights/__tests__/cross-data-matrix.integration.test.ts

@@ -13,6 +13,7 @@
 //     Alices Forget; Bobs Daten landen NICHT in Alices Export-Bundle.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineUnmanagedTable } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -118,6 +119,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/download-by-token-resolver-trust.integration.test.ts

@@ -12,6 +12,7 @@
 // for `jobRow.requestedFromTenantId` instead.
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -76,6 +77,7 @@ beforeAll(async () => {
       createComplianceProfilesFeature(),
       fileFoundationFeature,
       fileProviderInMemoryFeature,
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
     ],

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -9,6 +9,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -115,6 +116,7 @@ beforeAll(async () => {
       fileFoundationFeature,
       fileProviderInMemoryFeature,
       noSignedUrlProviderFeature,
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),
@@ -464,13 +466,25 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
     expect(body.error?.i18nKey).toBe("userDataRights.errors.download.notFound");
   });
 
-  test("missing token query-param → 400", async () => {
+  test("no query token (fragment-Pfad) → serviert Interstitial-HTML statt 400", async () => {
     const res = await stack.app.fetch(
       new Request("http://test/user-export/by-token", { method: "GET" }),
     );
-    expect(res.status).toBe(400);
-    const body = (await res.json()) as { error?: string };
-    expect(body.error).toBe("missing_token");
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("text/html");
+    const body = await res.text();
+    expect(body).toContain("/user-export/by-token.js");
+  });
+
+  test("by-token.js → same-origin exchange-script, application/javascript", async () => {
+    const res = await stack.app.fetch(
+      new Request("http://test/user-export/by-token.js", { method: "GET" }),
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("application/javascript");
+    const body = await res.text();
+    expect(body).toContain("location.hash");
+    expect(body).toContain("/user-export/by-token");
   });
 
   test("Audit-Update: useCount + IP/UA aus httpRoute-Headers (nicht aus payload)", async () => {
@@ -495,6 +509,47 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
     expect(row?.lastUsedFromIp).toBe("198.51.100.7");
     expect(row?.lastUsedUserAgent).toBe("e2e-test/2.0");
   });
+
+  test("POST-Exchange (Fragment-Pfad): happy-path + IP/UA-Audit aus httpRoute-Headers", async () => {
+    const { jobId, plainToken } = await seedDoneJobWithToken();
+
+    const res = await stack.app.fetch(
+      new Request("http://test/user-export/by-token", {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "user-agent": "e2e-test/3.0",
+          "x-forwarded-for": "203.0.113.9, 10.0.0.1",
+        },
+        body: JSON.stringify({ token: plainToken }),
+      }),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data?: { url?: string } };
+    expect(body.data?.url).toBeTruthy();
+
+    const [row] = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
+      useCount: number;
+      lastUsedFromIp: string | null;
+      lastUsedUserAgent: string | null;
+    }>;
+    expect(row?.useCount).toBe(1);
+    expect(row?.lastUsedFromIp).toBe("203.0.113.9");
+    expect(row?.lastUsedUserAgent).toBe("e2e-test/3.0");
+  });
+
+  test("POST-Exchange: missing token → 400", async () => {
+    const res = await stack.app.fetch(
+      new Request("http://test/user-export/by-token", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({}),
+      }),
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error?: string };
+    expect(body.error).toBe("missing_token");
+  });
 });
 
 describe("download-by-job :: cross-user + cross-tenant", () => {

package/src/user-data-rights/__tests__/export-encrypted-fields.integration.test.ts

@@ -4,6 +4,7 @@
 // (never the raw ciphertext) without one.
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   buildEntityTable,
@@ -74,6 +75,7 @@ beforeAll(async () => {
     createUserFeature(),
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),
+    authFoundationFeature,
     createSessionsFeature(),
     createUserDataRightsFeature(),
     vaultFeature,

package/src/user-data-rights/__tests__/export-job-idempotency.integration.test.ts

@@ -10,6 +10,7 @@
 // reale Postgres + Drizzle-customType-Codec-Path braucht.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { extractPgError } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -43,6 +44,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/export-job-list-cross-tenant.integration.test.ts

@@ -6,6 +6,7 @@
 // tenant A saw only tenant A's export jobs, never tenant B's.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -40,6 +41,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
     ],

package/src/user-data-rights/__tests__/file-binary-forget-cleanup.integration.test.ts

@@ -6,6 +6,7 @@
 // Datei ihre Bytes dauerhaft auf Disk (Issue gefunden im Review zu #177).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type JobContext, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
@@ -78,6 +79,7 @@ beforeAll(async () => {
       createTestFileProviderFeature(provider, "test"),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),

package/src/user-data-rights/__tests__/file-binary-forget-failure.integration.test.ts

@@ -10,6 +10,7 @@
 // still unvollständig).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
@@ -86,6 +87,7 @@ beforeAll(async () => {
       createTestFileProviderFeature(flakyProvider, "test"),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),

package/src/user-data-rights/__tests__/file-retention.integration.test.ts

@@ -16,6 +16,7 @@
 //      die Policy entscheidet pro Tenant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEventStoreExecutor,
@@ -68,6 +69,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),

package/src/user-data-rights/__tests__/file-storage-unification.integration.test.ts

@@ -11,6 +11,7 @@
 // assertion below go red.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type SessionUser, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
@@ -94,6 +95,7 @@ beforeAll(async () => {
       createTestFileProviderFeature(provider, "test"),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
       createUserDataRightsDefaultsFeature(),

package/src/user-data-rights/__tests__/forget-cleanup-hook-ordering.integration.test.ts

@@ -14,6 +14,7 @@
 // 0 rows after the owner column is nulled).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEntity,
@@ -148,6 +149,7 @@ beforeAll(async () => {
   stack = await setupTestStack({
     features: [
       createUserFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),

package/src/user-data-rights/__tests__/forget-hook-registry.integration.test.ts

@@ -8,6 +8,7 @@
 // functional registry instance; the end-to-end cascade is covered consumer-side.
 
 import { afterAll, beforeAll, beforeEach, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEntity,
@@ -66,6 +67,7 @@ beforeAll(async () => {
   stack = await setupTestStack({
     features: [
       createUserFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
-import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { access, defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
+import { EXT_SESSION_STORE } from "../../auth-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";
 import { createDataRetentionFeature } from "../../data-retention/feature";
@@ -17,6 +18,13 @@ import { createUserDataRightsFeature } from "../feature";
 // entities (export-job, download-attempt) are r.entity, not direct-write stores,
 // so an entityList binding is rebuild-safe (unlike jobs/sessions read-models).
 
+// Stub instead of the real auth-foundation — this test is about screen
+// wiring, not auth; only sessions' sessionStore registration needs an owner
+// present.
+const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
+  r.extendsRegistrar(EXT_SESSION_STORE, {});
+});
+
 describe("user-data-rights read-only inspector screens", () => {
   // A realistic assembly: mounting user-data-rights without its default hooks
   // now fails the V3 boot gate (the framework `user` entity holds PII with no
@@ -25,6 +33,7 @@ describe("user-data-rights read-only inspector screens", () => {
   const features = [
     createConfigFeature(),
     createUserFeature(),
+    sessionStoreOwnerStub,
     createSessionsFeature(),
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -10,6 +10,7 @@
 // #624: "App mountet mail-foundation+transport → GDPR-Mails ohne Callback-Code".
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
@@ -56,6 +57,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       mailFoundationFeature,
       mailTransportInMemoryFeature,