@cosmicdrift/kumiko-bundled-features 0.158.2 → 0.159.1

package/src/user-data-rights/__tests__/read-users-rebuild-survives-lifecycle.integration.test.ts

@@ -13,6 +13,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createRegistry,
@@ -58,7 +59,7 @@ import { createDataRetentionFeature } from "../../data-retention";
 import { createSessionsFeature } from "../../sessions";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
-import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
 import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -91,6 +92,7 @@ function buildFeatures() {
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),
     createAuthEmailPasswordFeature(),
+    authFoundationFeature,
     createSessionsFeature(),
     createUserDataRightsFeature(),
   ];
@@ -137,6 +139,12 @@ beforeEach(async () => {
   ]);
 });
 
+// Any actor hitting a write handler needs a live sid once sessionChecker
+// is wired.
+function mintActor(user: { id: string; tenantId: TenantId; roles: readonly string[] }) {
+  return withMintedSession((u, meta) => callbacks.get().sessionCreator(u, meta), user);
+}
+
 describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
   test("Restricted-Status ueberlebt einen Projection-Rebuild (T_create != T_active)", async () => {
     // Diskriminierende Praemisse: user.created landet auf systemAdmin.tenantId
@@ -149,7 +157,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: ALICE_EMAIL, passwordHash: hash, displayName: "Alice" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     // Mitgliedschaft + Lifecycle auf einem ANDEREN, aktiven Tenant.
     await seedTenantMembership(stack.db, {
@@ -158,7 +166,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
       roles: ["Member"],
     });
 
-    const aliceActive = { id: created.id, tenantId: T_ACTIVE, roles: ["Member"] };
+    const aliceActive = await mintActor({ id: created.id, tenantId: T_ACTIVE, roles: ["Member"] });
     const restricted = await stack.http.writeOk<{ status: string }>(RESTRICT, {}, aliceActive);
     expect(restricted.status).toBe(USER_STATUS.Restricted);
 
@@ -187,7 +195,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "grace.rebuild@example.com", passwordHash: hash, displayName: "Grace" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
 
     const T = getTemporal();
@@ -218,7 +226,7 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const created = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "legacy.rebuild@example.com", passwordHash: hash, displayName: "Legacy" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
 
     // Prae-Fix-Zustand simulieren: roher Write OHNE Event.
@@ -256,14 +264,14 @@ describe("#494 :: read_users-Rebuild bewahrt Lifecycle-State", () => {
     const goodRow = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "healthy.rebuild@example.com", passwordHash: hash, displayName: "Healthy" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: goodRow.id });
 
     const badRow = await stack.http.writeOk<{ id: string }>(
       UserHandlers.create,
       { email: "corrupt.rebuild@example.com", passwordHash: hash, displayName: "Corrupt" },
-      TestUsers.systemAdmin,
+      await mintActor(TestUsers.systemAdmin),
     );
     await updateRows(stack.db, userTable, { status: USER_STATUS.Restricted }, { id: badRow.id });
     // userEntity is systemStream:true (schema/user.ts) — its event stream

package/src/user-data-rights/__tests__/request-cancel-deletion.integration.test.ts

@@ -10,6 +10,7 @@
 // hier; der Frist-Ablauf-Cleanup folgt mit S2.U5b.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -57,6 +58,7 @@ const features = [
   createUserFeature(),
   createDataRetentionFeature(),
   createComplianceProfilesFeature(),
+  authFoundationFeature,
   createSessionsFeature(),
 
   createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/request-deletion-callback.integration.test.ts

@@ -8,6 +8,7 @@
 // Properties — dieser Test verifiziert sie end-to-end.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -64,6 +65,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature({ sendDeletionRequestedEmail }),

package/src/user-data-rights/__tests__/request-export.integration.test.ts

@@ -18,6 +18,7 @@
 //     hasJob=false wenn nichts da
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -53,6 +54,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -12,6 +12,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -44,7 +45,7 @@ import { createSessionsFeature } from "../../sessions";
 import { SessionHandlers } from "../../sessions/constants";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
-import { sessionCallbacksFromLateBound } from "../../sessions/testing";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
 import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -77,6 +78,7 @@ beforeAll(async () => {
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
       createAuthEmailPasswordFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature(),
     ],
@@ -115,10 +117,14 @@ async function seedAliceWithMembership(
   status: string = USER_STATUS.Active,
 ): Promise<{ userId: string }> {
   const hash = await hashPassword(ALICE_PW);
+  const actor = await withMintedSession(
+    (user, meta) => callbacks.get().sessionCreator(user, meta),
+    TestUsers.systemAdmin,
+  );
   const created = await stack.http.writeOk<{ id: string }>(
     UserHandlers.create,
     { email: ALICE_EMAIL, passwordHash: hash, displayName: "Alice" },
-    TestUsers.systemAdmin,
+    actor,
   );
   if (status !== USER_STATUS.Active) {
     await updateRows(stack.db, userTable, { status }, { id: created.id });
@@ -136,6 +142,12 @@ async function login(email: string, password: string): Promise<{ status: number;
   return { status: res.status, body: await res.json() };
 }
 
+// Any actor hitting a write handler needs a live sid once sessionChecker
+// is wired (same gate as seedAliceWithMembership's bootstrap actor above).
+function mintActor(user: { id: string; tenantId: TenantId; roles: readonly string[] }) {
+  return withMintedSession((u, meta) => callbacks.get().sessionCreator(u, meta), user);
+}
+
 function reasonOf(err: { details?: unknown }): string | undefined {
   return (err.details as { reason?: string } | undefined)?.reason;
 }
@@ -156,11 +168,11 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     expect(sessionsBefore.every((s) => s.revokedAt === null)).toBe(true);
 
     // Restrict-Account.
-    const aliceUser = {
+    const aliceUser = await mintActor({
       id: userId,
       tenantId: TENANT,
       roles: ["Member"],
-    };
+    });
     const result = await stack.http.writeOk<{ userId: string; status: string }>(
       RESTRICT,
       {},
@@ -182,17 +194,36 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     expect(sessionsAfter.every((s) => s.revokedAt !== null)).toBe(true);
   });
 
+  test("non-admin targets another user's account: 403 admin_required_for_other_user", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const attacker = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+    const err = await stack.http.writeErr(RESTRICT, { userId: targetId }, attacker);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("admin_required_for_other_user");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: targetId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
   test("Restricted → Restricted (Idempotenz-Guard): 422 already_restricted", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(RESTRICT, {}, aliceUser);
+    // Alice's own session is blocked while Restricted — an admin targets
+    // her account instead, same as production would have to.
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(RESTRICT, { userId }, admin);
     expect(err.httpStatus).toBe(422);
     expect(reasonOf(err)).toBe("already_restricted");
   });
 
   test("DeletionRequested → restrict-account: 422 user_not_in_active_state", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.DeletionRequested);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
+    const aliceUser = await mintActor({ id: userId, tenantId: TENANT, roles: ["Member"] });
     const err = await stack.http.writeErr(RESTRICT, {}, aliceUser);
     expect(reasonOf(err)).toBe("user_not_in_active_state");
   });
@@ -201,9 +232,11 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
 describe("S2.U6 :: lift-restriction state-transitions", () => {
   test("Restricted → Active: status flippt zurueck", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
+    // lift-restriction is operator-only (access.admin) — Alice's own
+    // session is blocked while Restricted anyway.
+    const admin = await mintActor(TestUsers.admin);
 
-    const result = await stack.http.writeOk<{ status: string }>(LIFT, {}, aliceUser);
+    const result = await stack.http.writeOk<{ status: string }>(LIFT, { userId }, admin);
     expect(result.status).toBe(USER_STATUS.Active);
 
     const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
@@ -214,15 +247,15 @@ describe("S2.U6 :: lift-restriction state-transitions", () => {
 
   test("Active → lift-restriction: 422 not_restricted (Idempotenz-Guard)", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Active);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(LIFT, {}, aliceUser);
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(LIFT, { userId }, admin);
     expect(reasonOf(err)).toBe("not_restricted");
   });
 
   test("DeletionRequested → lift-restriction: 422 not_restricted", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.DeletionRequested);
-    const aliceUser = { id: userId, tenantId: TENANT, roles: ["Member"] };
-    const err = await stack.http.writeErr(LIFT, {}, aliceUser);
+    const admin = await mintActor(TestUsers.admin);
+    const err = await stack.http.writeErr(LIFT, { userId }, admin);
     expect(reasonOf(err)).toBe("not_restricted");
   });
 });
@@ -286,11 +319,11 @@ describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
     expect(liveBefore.length).toBe(2);
 
     // System-Caller.
-    const systemUser = {
+    const systemUser = await mintActor({
       id: "00000000-0000-4000-8000-000000000000",
       tenantId: TENANT,
       roles: ["SystemAdmin"],
-    };
+    });
     const result = await stack.http.writeOk<{ count: number; userId: string }>(
       SessionHandlers.revokeAllForUser,
       { userId },

package/src/user-data-rights/__tests__/run-export-jobs-cron-context.integration.test.ts

@@ -10,6 +10,7 @@
 // jeden Export auf "failed" setzte).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { type JobContext, SYSTEM_USER_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -65,6 +66,7 @@ beforeAll(async () => {
       fileProviderInMemoryFeature,
       mailFoundationFeature,
       mailTransportInMemoryFeature,
+      authFoundationFeature,
       createSessionsFeature(),
       // appExportDownloadUrl set → the default export-ready mail is enabled, so
       // this also proves the export cron's mail bridge end-to-end (C6).

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -17,6 +17,7 @@ import { spawn } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -59,6 +60,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),
@@ -803,6 +805,7 @@ describe("runExportJobs :: Atom 3c file-binaries", () => {
         createUserFeature(),
         createDataRetentionFeature(),
         createComplianceProfilesFeature(),
+        authFoundationFeature,
         createSessionsFeature(),
 
         createUserDataRightsFeature(),
@@ -1063,7 +1066,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
     expect(sent.userEmail).toBe("alice@example.com");
     expect(sent.jobId).toBe(jobId);
     expect(sent.downloadUrl).toMatch(
-      /^https:\/\/app\.example\.com\/user-export\/by-token\?token=[A-Za-z0-9_%-]+$/,
+      /^https:\/\/app\.example\.com\/user-export\/by-token#token=[A-Za-z0-9_%-]+$/,
     );
     // plain-token aus dem callback-arg entspricht dem result.tokenByJobId
     const plainFromResult = result.tokenByJobId.get(jobId);

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -16,6 +16,7 @@
 // der end-to-end-Default-Pfad (delete).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
@@ -67,6 +68,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -15,6 +15,7 @@
 //     ueber Pseudo-Tenant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configurePiiSubjectKms,
@@ -61,6 +62,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -13,6 +13,7 @@
 // value (the failure mode that shipped the ctx.config export bug).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEntity,
@@ -82,6 +83,7 @@ beforeAll(async () => {
   stack = await setupTestStack({
     features: [
       createUserFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),

package/src/user-data-rights/__tests__/user-data-rights.integration.test.ts

@@ -7,6 +7,7 @@
 // Sprint-2-H1/H2-Hooks) kommt in S2.T1 (Cross-Data-Matrix).
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
@@ -24,7 +25,14 @@ const userDataRights = createUserDataRightsFeature();
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [userFeature, sessionsFeature, dataRetention, complianceProfiles, userDataRights],
+    features: [
+      authFoundationFeature,
+      userFeature,
+      sessionsFeature,
+      dataRetention,
+      complianceProfiles,
+      userDataRights,
+    ],
   });
 });
 

package/src/user-data-rights/boot-checks.ts

@@ -0,0 +1,86 @@
+import {
+  type EntityDefinition,
+  EXT_USER_DATA,
+  type FeatureDefinition,
+  type PiiAnnotations,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// r.entity(...) is not the only way a feature exposes an entity shape:
+// r.projection(...) can carry an optional `entity` too (raw read-models with
+// no executor, e.g. billing-foundation's subscription table). V3 below needs
+// every entity a feature declares, not just the r.entity ones, or a pii/
+// userOwned field on a projection-only entity is invisible to the guard it
+// was annotated for.
+function entitiesOf(
+  feature: FeatureDefinition,
+): ReadonlyArray<readonly [string, EntityDefinition]> {
+  const fromEntities = Object.entries(feature.entities ?? {});
+  const fromProjections = Object.values(feature.projections ?? {})
+    .filter((p): p is typeof p & { entity: EntityDefinition } => p.entity !== undefined)
+    .map((p) => [p.name, p.entity] as const);
+  return [...fromEntities, ...fromProjections];
+}
+
+// V2: export-without-erase gate. A feature that registers an EXT_USER_DATA
+// export hook without a matching delete hook exports data under Art.20 but
+// never erases it on forget — an Art.17 violation. Hard boot failure: no app
+// should ship a GDPR export path with no erase path. Registry-level signal
+// only; runtime no-ops (a delete hook that silently skips) are not detectable
+// here — those are covered by the export/forget integration tests.
+//
+// Registered as an `r.bootCheck()` by this feature (#1314) — EXT_USER_DATA is
+// owned by user-data-rights (r.extendsRegistrar(EXT_USER_DATA, {})), so any
+// r.useExtension(EXT_USER_DATA, ...) usage across the app already requires
+// user-data-rights to be mounted (boot-validator's extension-provider check
+// fails otherwise); running this from user-data-rights' own bootCheck is
+// equivalent to the framework-internal call it replaces.
+export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
+  for (const feature of features) {
+    for (const usage of feature.extensionUsages) {
+      if (usage.extensionName !== EXT_USER_DATA) continue;
+      const hasExport = typeof usage.options?.["export"] === "function";
+      const hasDelete = typeof usage.options?.["delete"] === "function";
+      if (hasExport && !hasDelete) {
+        throw new Error(
+          `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
+        );
+      }
+    }
+  }
+}
+
+// V3: PII-entity-without-hook gate. V2 checks registered hooks for
+// completeness; V3 catches the entity nobody registered at all — fields
+// annotated as user-subject data (pii / userOwned) yet invisible to the
+// Art.15/20 export and Art.17 forget pipeline. Hard boot failure: a
+// subject-data entity that skips the pipeline is exactly the "feature built
+// past GDPR" leak this gate exists to stop. No "is user-data-rights mounted"
+// guard needed here (unlike the framework-internal predecessor) — this runs
+// as user-data-rights' own bootCheck, so it's only reachable when mounted.
+// Matching is by entity name across all features (usage.entityName is
+// unqualified); a same-named entity in another feature can mask a gap —
+// accepted, as the common case is a distinct entity name.
+export function validateGdprPiiHookCoverage(features: readonly FeatureDefinition[]): void {
+  const hookedEntities = new Set<string>();
+  for (const f of features) {
+    for (const usage of f.extensionUsages) {
+      if (usage.extensionName === EXT_USER_DATA) hookedEntities.add(usage.entityName);
+    }
+  }
+
+  for (const feature of features) {
+    for (const [entityName, entity] of entitiesOf(feature)) {
+      if (hookedEntities.has(entityName)) continue;
+      const subjectFields = Object.entries(entity.fields)
+        .filter(([, field]) => {
+          const annot = field as PiiAnnotations; // @cast-boundary schema-walk
+          return Boolean(annot.pii) || Boolean(annot.userOwned);
+        })
+        .map(([name]) => name);
+      if (subjectFields.length === 0) continue;
+      throw new Error(
+        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
+      );
+    }
+  }
+}