@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/user/schema/user.ts

@@ -67,6 +67,7 @@ export const userEntity = createEntity({
       format: "email",
       maxLength: 320,
       pii: true,
+      lookupable: true,
       access: { write: access.privileged },
     }),
 
@@ -79,8 +80,10 @@ export const userEntity = createEntity({
     }),
 
     // Profile — user-editable. Display-name is real-name in most apps,
-    // so treat as PII for DSGVO export/forget pipelines.
-    displayName: createTextField({ required: true, maxLength: 100, searchable: true, pii: true }),
+    // so treat as PII for DSGVO export/forget pipelines. NOT searchable:
+    // substring search on an encrypted field would require plaintext copies
+    // in the search index (boot-validator rejects the combination, #818).
+    displayName: createTextField({ required: true, maxLength: 100, pii: true }),
     locale: createTextField({ maxLength: 10, default: "de" }),
 
     // Which tenant should this user land in on next login. Set by the login
@@ -133,6 +136,7 @@ export const userEntity = createEntity({
       required: true,
       default: USER_STATUS.Active,
       options: USER_STATUS_OPTIONS,
+      sortable: true,
       access: { write: access.privileged },
     }),
 

package/src/user/screens.ts

@@ -7,10 +7,6 @@ import type {
 // feature runs with `r.systemScope()`, the entityList query returns every
 // user across all tenants — the SystemAdmin platform roster. Both screens are
 // SystemAdmin-gated and stay inert until an app navs them (no auto-nav).
-//
-// Field labels come from the renderer's humanizeSlug fallback (no i18n keys
-// registered) — "Display Name", "Email Verified" etc. Apps can override via
-// their own translations under the `user:entity:user:field:*` convention.
 
 export const userListScreen: EntityListScreenDefinition = {
   id: "user-list",
@@ -26,9 +22,9 @@ export const userListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  // No SearchAdapter assumption: search is opt-in per app infra, not a
-  // universal default for a bundled screen.
-  searchable: false,
+  defaultSort: { field: "status", dir: "asc" },
+  // ponytail: screen searchable but email is encrypted PII — list search uses non-encrypted columns only.
+  searchable: true,
   access: { roles: ["SystemAdmin"] },
 };
 
@@ -44,14 +40,6 @@ export const userEditScreen: EntityEditScreenDefinition = {
       },
     ],
   },
-  // `roles` is deliberately NOT editable here: it is a raw JSON text column
-  // (`["SystemAdmin"]`) — a free-text input would let a typo corrupt the
-  // privilege column on a live platform. Role management needs a dedicated
-  // surface; the list still shows status for triage.
-  //
-  // Create dispatches user:write:user:create (email + displayName required —
-  // both in the form). Delete is suppressed: there is no user:write:user:delete
-  // — user removal is the GDPR status/forget flow, not a hard delete.
   allowDelete: false,
   access: { roles: ["SystemAdmin"] },
 };

package/src/user/seeding.ts

@@ -18,6 +18,8 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+// kumiko-lint-ignore cross-feature-import shares the postSave-hooks fixture contract with tenant/seeding (#1478)
+import { fireEntityPostSave, type SeedTenantHooks } from "../tenant/seeding";
 import { userEntity, userTable } from "./schema/user";
 
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
@@ -52,6 +54,11 @@ export type SeedUserOptions = {
 export async function seedUser(
   db: DbConnection,
   options: SeedUserOptions,
+  // Optional, append-only — same rationale as tenant/seeding's seedTenant
+  // hooks param (#1478): fires user's postSave hooks (e.g. a Welcome-
+  // notification hook keyed off `allOf: "user"`) for fixtures/self-signup
+  // that opt in. Omit to keep today's hook-less behavior.
+  hooks?: SeedTenantHooks,
 ): Promise<{ id: string }> {
   const by = options.by ?? TestUsers.systemAdmin;
   // executor.create erwartet eine TenantDb (mit .insert()-API). User
@@ -81,6 +88,7 @@ export async function seedUser(
       `seedUser failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
+  await fireEntityPostSave(hooks, "user:seed", result.data);
   return { id: extractId(result.data, "seedUser") };
 }
 

package/src/user-data-rights/COMPLIANCE.md

@@ -20,7 +20,7 @@ Dieses Dokument bündelt die **technischen Fakten** zur DSGVO-Pipeline
 |---------|-------------------|--------------|--------------|
 | **Art. 15 (Auskunft, light)** | `user-data-rights:query:my-audit-log` | User | Liest eigene Framework-Events aus `kumiko_events` (account-weit über alle Memberships). Filterbar nach `eventType`, `aggregateType`, `from`/`to`. Domain-Entities ohne `ctx.appendEvent` erscheinen NICHT — die kommen im Export-Bundle (Art. 20). |
 | **Art. 15 + 20 (Auskunft + Portabilität)** | `user-data-rights:write:request-export` | User | Async Job → ZIP mit user-Profil + fileRefs + alle EXT_USER_DATA-Provider-Daten (cross-tenant) + signed Magic-Link per Email. Idempotent: nur 1 active Job pro User (`ACTIVE_JOB_CONSTRAINT`). |
-| **Art. 15 + 20** | `GET /user-export/by-token?token=…` | Anonym (Magic-Link-Pfad) | Token-Hash-Lookup → 302-Redirect auf signed Storage-URL. Multi-use innerhalb TTL. Audit: `lastUsedAt`, `lastUsedFromIp`, `lastUsedUserAgent`. |
+| **Art. 15 + 20** | `GET /user-export/by-token` (interstitial) + `POST /user-export/by-token` (exchange) | Anonym (Magic-Link-Pfad) | Email-Link trägt den Token als URL-Fragment (`#token=`, nie an den Server gesendet, issue #1271); Interstitial-Script liest das Fragment client-seitig und tauscht es per POST-Body gegen die signed Storage-URL. Kein `?token=`-Query-Fallback (#1512) — Query-Param landet unveränderlich in Proxy-/Access-Logs. Multi-use innerhalb TTL. Audit: `lastUsedAt`, `lastUsedFromIp`, `lastUsedUserAgent`. |
 | **Art. 15 + 20** | `GET /user-export/by-job/:jobId` | User (Session-Auth) | UI-Klick-Pfad. Cross-tenant-same-user: User in Tenant B kann Job aus Tenant A laden wenn er der Owner ist. |
 | **Art. 17 (Löschung)** | `user-data-rights:write:request-deletion` | User | Soft-Delete: `status=DeletionRequested` + `gracePeriodEnd = now + profile.gracePeriod`. Cron `run-forget-cleanup` führt nach Grace die Anonymisierung durch. |
 | **Art. 17** | `user-data-rights:write:cancel-deletion` | User | Während Grace: status zurück auf `Active`. |
@@ -45,6 +45,26 @@ Dieses Dokument bündelt die **technischen Fakten** zur DSGVO-Pipeline
 | `read_tenant_retention_overrides` | Per-Tenant Retention-Override pro Entity | nein | unbounded (Konfiguration) | Aufbewahrungspflicht-Edge-Cases |
 | Storage-Provider (Local / S3) | Export-ZIPs + File-Binaries | indirekt (Inhalt) | Local: per `exportDownloadTtl` Cleanup. S3: lifecycle-Policy (App-Author-Verantwortung) | Daten-Export-Auslieferung |
 
+### Bekanntes Residuum: `createdBy` / `metadata.userId` in `kumiko_events`
+
+Nach der Forget-Pipeline (Art. 17, Abschnitt 1) bleiben `kumiko_events.created_by`
+und `metadata.userId` (Event-Store-Schema `events-schema.ts`, EventMetadata-Feld)
+als Klartext-UUID stehen. Die Forget-Hooks aus `user-data-rights-defaults` fassen
+`kumiko_events` nicht an — `createdBy`/`metadata.userId` sind keine über
+`defineEvent(..., { piiFields })` deklarierten Payload-PII-Felder (siehe
+`packages/framework/src/crypto/event-pii.ts`) und laufen deshalb nicht durch die
+Payload-Verschlüsselung. Löschung dieser Rows erfolgt ausschließlich über die
+zeitbasierte `data-retention`-Policy (`keepFor`, s. `kumiko_events`-Zeile in Abschnitt
+2 oben), unabhängig vom User-Forget-Antrag.
+
+Technische Basis: Der `read_users`-Row zur betroffenen UUID wird beim Forget-Run
+in-place anonymisiert, nicht hard-gelöscht (Sentinel-Pattern, siehe Abschnitt 4
+„Integrität"). Email, Displayname und Passwort-Hash werden dabei entfernt/ersetzt —
+das ist der Schlüssel, der die Verknüpfung kappt: Sobald diese Felder weg sind, gibt
+es keinen Rückweg von der UUID in `created_by` zu einer realen Identität mehr. Die
+UUID bleibt als stabiler, aber orphaned Pseudonym-Wert bestehen, bis die
+Retention-Policy irgendwann das Event selbst löscht.
+
 ---
 
 ## 3. Compliance-Profile

package/src/user-data-rights/__tests__/anonymous-deletion-kms.integration.test.ts

@@ -0,0 +1,145 @@
+// Anonymer Deletion-Flow mit aktivem PII-KMS + Blind-Index (#818 PR 2):
+// die User-Row liegt verschlüsselt in der DB. request-deletion-by-email muss
+// den User über die email_bidx-Spalte finden und die Verify-Mail an den
+// KLARTEXT schicken (vorher: Ciphertext-Adresse → Mail unzustellbar).
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+  isPiiCiphertext,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
+import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "../../compliance-profiles";
+import { createDataRetentionFeature } from "../../data-retention";
+import { createSessionsFeature } from "../../sessions";
+import { USER_STATUS, userEntity, userTable } from "../../user";
+import { createUserFeature } from "../../user/feature";
+import { seedUser } from "../../user/seeding";
+import { createUserDataRightsFeature } from "../feature";
+import type { SendDeletionVerificationEmailFn } from "../handlers/request-deletion-by-email.write";
+
+const REQUEST_BY_EMAIL = "user-data-rights:write:request-deletion-by-email";
+const CONFIRM_BY_TOKEN = "user-data-rights:write:confirm-deletion-by-token";
+const DELETION_SECRET = "test-deletion-secret-0123456789abcdef";
+const VERIFY_URL = "https://app.example.test/delete-account/confirm";
+const ALICE_EMAIL = "alice.kms-deletion@example.com";
+const BIDX_KEY = Buffer.alloc(32, 7).toString("base64");
+
+const tenantA = testTenantId(1);
+
+type VerifyArgs = Parameters<SendDeletionVerificationEmailFn>[0];
+const verifyCalls: VerifyArgs[] = [];
+const sendDeletionVerificationEmail: SendDeletionVerificationEmailFn = async (args) => {
+  verifyCalls.push(args);
+};
+
+let stack: TestStack;
+let aliceId: string;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createUserFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+      createUserDataRightsFeature({
+        deletionTokenSecret: DELETION_SECRET,
+        deletionVerifyUrl: VERIFY_URL,
+        sendDeletionVerificationEmail,
+      }),
+    ],
+    anonymousAccess: { defaultTenantId: tenantA },
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  verifyCalls.length = 0;
+  await resetTestTables(stack.db, [userTable, tenantComplianceProfileTable, eventsTable]);
+
+  // KMS + bidx-Key VOR dem Seed — seedUser läuft über den Executor, die
+  // Row soll den verschlüsselten Prod-Zustand abbilden.
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+  configureBlindIndexKey(BIDX_KEY);
+  ({ id: aliceId } = await seedUser(stack.db, {
+    email: ALICE_EMAIL,
+    displayName: "Alice",
+    passwordHash: "hashed",
+    emailVerified: true,
+  }));
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+function tokenFromLastVerifyCall(): string {
+  const url = new URL(verifyCalls[0]?.verifyUrl ?? "");
+  return url.searchParams.get("token") ?? "";
+}
+
+describe("anonymous deletion flow with active KMS", () => {
+  test("request-by-email finds the encrypted row via bidx and mails the PLAINTEXT address", async () => {
+    const rows = await asRawClient(stack.db).unsafe<Record<string, unknown>>(
+      `SELECT email, email_bidx FROM "${userTable.tableName}" WHERE id = $1`,
+      [aliceId],
+    );
+    expect(isPiiCiphertext(rows[0]?.["email"])).toBe(true);
+    expect(String(rows[0]?.["email_bidx"])).toStartWith("kumiko-bidx:v1:");
+
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: REQUEST_BY_EMAIL,
+      payload: { email: ALICE_EMAIL },
+    });
+    expect(res.status).toBe(200);
+
+    expect(verifyCalls).toHaveLength(1);
+    expect(verifyCalls[0]?.email).toBe(ALICE_EMAIL);
+    expect(verifyCalls[0]?.verifyUrl).toContain("token=");
+  });
+
+  test("confirm-by-token flips to DeletionRequested; response carries no ciphertext", async () => {
+    await stack.http.raw("POST", "/api/write", {
+      type: REQUEST_BY_EMAIL,
+      payload: { email: ALICE_EMAIL },
+    });
+    const token = tokenFromLastVerifyCall();
+    expect(token).not.toBe("");
+
+    const res = await stack.http.raw("POST", "/api/write", {
+      type: CONFIRM_BY_TOKEN,
+      payload: { token },
+    });
+    expect(res.status).toBe(200);
+    const bodyText = await res.text();
+    expect(bodyText).not.toContain("kumiko-pii:");
+    const body = JSON.parse(bodyText) as { data?: { status?: string } };
+    expect(body.data?.status).toBe(USER_STATUS.DeletionRequested);
+  });
+});

package/src/user-data-rights/__tests__/anonymous-deletion.integration.test.ts

@@ -6,6 +6,7 @@
 // Beweist end-to-end via echte /api/write-Calls OHNE Auth (anonymousAccess).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -53,6 +54,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createUserDataRightsFeature({
         deletionTokenSecret: DELETION_SECRET,
@@ -331,6 +333,7 @@ describe("anonymous deletion flow — not configured (kein Secret)", () => {
         createUserFeature(),
         createDataRetentionFeature(),
         createComplianceProfilesFeature(),
+        authFoundationFeature,
         createSessionsFeature(),
         createUserDataRightsFeature({
           sendDeletionVerificationEmail: async (args) => {

package/src/user-data-rights/__tests__/audit-log.integration.test.ts

@@ -1,6 +1,7 @@
 // S2.U7 — my-audit-log + invalid-attempt-audit + list-download-attempts.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
@@ -21,6 +22,8 @@ import { createSessionsFeature } from "../../sessions";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsFeature } from "../feature";
+import { listDownloadAttemptsQuery } from "../handlers/list-download-attempts.query";
+import { myAuditLogQuery } from "../handlers/my-audit-log.query";
 import { downloadAttemptEntity, downloadAttemptsTable } from "../schema/download-attempt";
 
 const MY_AUDIT = "user-data-rights:query:my-audit-log";
@@ -39,6 +42,7 @@ beforeAll(async () => {
       createUserFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),
@@ -156,6 +160,69 @@ describe("my-audit-log", () => {
   });
 });
 
+describe("my-audit-log — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("from/to filter works without deleting globalThis.Temporal for handler-internal state", async () => {
+    // Seed with Temporal intact — only the handler call runs ambient-free,
+    // mirroring the audit feature's #1525 regression test (going through
+    // full HTTP dispatch would also break buildHandlerContext's unrelated
+    // ctx.tz setup, which isn't what this pins down).
+    await seedEvent(alice.id, tenantA, "user.x", { from: "range-test" });
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const res = await myAuditLogQuery.handler(
+        {
+          payload: { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
+          user: alice,
+        } as Parameters<typeof myAuditLogQuery.handler>[0],
+        { db: { raw: stack.db } } as unknown as Parameters<typeof myAuditLogQuery.handler>[1],
+      );
+      expect(res.rows.length).toBeGreaterThanOrEqual(1);
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
+describe("list-download-attempts — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("from/to filter works without relying on globalThis.Temporal", async () => {
+    const T = await import("@cosmicdrift/kumiko-framework/time");
+    const now = T.getTemporal().Now.instant();
+    await seedRows(stack.db, downloadAttemptsTable, [
+      {
+        id: "33333333-3333-4333-8333-333333333333",
+        tenantId: tenantA,
+        result: "notFound",
+        via: "token",
+        tokenHash: "abc",
+        jobId: null,
+        attemptedByUserId: null,
+        ip: "1.2.3.4",
+        userAgent: "test",
+        attemptedAt: now,
+      },
+    ]);
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const res = await listDownloadAttemptsQuery.handler(
+        {
+          payload: { limit: 50, from: "2020-01-01T00:00:00Z", to: "2030-01-01T00:00:00Z" },
+          user: admin,
+        } as Parameters<typeof listDownloadAttemptsQuery.handler>[0],
+        { db: stack.db } as unknown as Parameters<typeof listDownloadAttemptsQuery.handler>[1],
+      );
+      expect(res.rows.length).toBeGreaterThanOrEqual(1);
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 describe("download-attempt retention :: disk-bomb-Schutz bei Brute-Force", () => {
   test("Entity-Default ist 90d hardDelete (kein unbounded growth)", () => {
     expect(downloadAttemptEntity.retention).toBeDefined();

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -0,0 +1,170 @@
+import { describe, expect, test } from "bun:test";
+import { integer, type SchemaTable, table, uuid } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  EXT_TENANT_DATA,
+  EXT_USER_DATA,
+  validateBoot,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
+import { z } from "zod";
+import { authFoundationFeature } from "../../auth-foundation";
+import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
+import { createConfigFeature } from "../../config/feature";
+import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens";
+import { createSessionsFeature } from "../../sessions/feature";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle/feature";
+
+function projectionProbeTable(name: string): SchemaTable {
+  return table(name, {
+    id: uuid("id").primaryKey(),
+    count: integer("count").notNull().default(0),
+  }) as unknown as SchemaTable; // @cast-boundary test-fixture — minimal probe shape, real schema-table irrelevant here
+}
+
+import { createUserFeature } from "../../user/feature";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
+import { createUserDataRightsFeature } from "../feature";
+
+// GDPR-storage guards V2 (export-without-erase) and V3 (pii-entity-without-
+// hook) moved off the framework-internal boot-validator onto user-data-
+// rights' own `r.bootCheck()` (#1314); V4 (tenantOwned-entity-without-hook)
+// onto tenant-lifecycle's own `r.bootCheck()` — tenant-lifecycle owns
+// EXT_TENANT_DATA, so its own mount preserves the original guard's trigger
+// exactly (gating on a sibling feature would silently narrow coverage).
+// Unlike the old direct-function tests, these only run inside a real
+// validateBoot() pass — exercising the actual `r.bootCheck()` plumbing, not
+// just the guard logic.
+function baseFeatures() {
+  return [
+    createConfigFeature(),
+    createUserFeature(),
+    createTenantFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
+    createSessionsFeature(),
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    createFilesFeature(),
+    createUserDataRightsFeature(),
+    createUserDataRightsDefaultsFeature(),
+  ];
+}
+
+// Minimal tenant-lifecycle assembly with NO user-data-rights* mounted at all
+// — proves V4 fires from tenant-lifecycle's own mount, not from a sibling
+// feature accidentally re-gating it.
+function minimalTenantLifecycleFeatures() {
+  return [
+    createConfigFeature(),
+    createTenantFeature(),
+    createComplianceProfilesFeature(),
+    createTenantLifecycleFeature(),
+  ];
+}
+
+describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
+  test("known-good assembly boot-validates (baseline)", () => {
+    expect(() => validateBoot(baseFeatures())).not.toThrow();
+  });
+
+  test("V2: export hook without delete hook → Art.17 throw", () => {
+    const bad = defineFeature("bad-export", (r) => {
+      r.requires("user-data-rights");
+      r.useExtension(EXT_USER_DATA, "badEntity", { export: async () => null });
+    });
+    expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/Art\.17/);
+  });
+
+  test("V3: pii entity without any EXT_USER_DATA hook → throws the guard's own message", () => {
+    const bad = defineFeature("crm", (r) => {
+      r.entity("contact", createEntity({ fields: { email: createTextField({ pii: true }) } }));
+    });
+    expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/EXT_USER_DATA hook.*Art\.17 gap/);
+  });
+
+  test("V3: pii field on a projection-only entity (no r.entity) is still caught", () => {
+    const projectionTable = projectionProbeTable("crm_contact_summary");
+    const bad = defineFeature("crm", (r) => {
+      const contactCreated = r.defineEvent("contact-created", z.unknown());
+      r.projection({
+        name: "contact-summary",
+        source: "contact",
+        table: projectionTable,
+        apply: { [contactCreated.name]: async () => {} },
+        entity: createEntity({ fields: { email: createTextField({ pii: true }) } }),
+      });
+    });
+    expect(() => validateBoot([...baseFeatures(), bad])).toThrow(/EXT_USER_DATA hook.*Art\.17 gap/);
+  });
+
+  test("V3: projection-only pii entity WITH EXT_USER_DATA hook registered for its entity name → no throw", () => {
+    const projectionTable = projectionProbeTable("crm_contact_summary_hooked");
+    const hooked = defineFeature("crm-hooked", (r) => {
+      r.requires("user-data-rights");
+      const contactCreated = r.defineEvent("contact-hooked-created", z.unknown());
+      r.projection({
+        name: "contact-summary",
+        source: "contact",
+        table: projectionTable,
+        apply: { [contactCreated.name]: async () => {} },
+        entity: createEntity({ fields: { email: createTextField({ pii: true }) } }),
+      });
+      r.useExtension(EXT_USER_DATA, "contact-summary", {
+        export: async () => null,
+        delete: async () => {},
+      });
+    });
+    expect(() => validateBoot([...baseFeatures(), hooked])).not.toThrow();
+  });
+
+  test("V4: tenantOwned entity without EXT_TENANT_DATA hook, tenant-lifecycle mounted → throws the guard's own message", () => {
+    const bad = defineFeature("billing", (r) => {
+      r.entity(
+        "subscription",
+        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+      );
+    });
+    expect(() => validateBoot([...minimalTenantLifecycleFeatures(), bad])).toThrow(
+      /EXT_TENANT_DATA destroy hook/,
+    );
+  });
+
+  test("V4: fires with no user-data-rights* mounted at all — trigger is tenant-lifecycle's own mount", () => {
+    const bad = defineFeature("billing", (r) => {
+      r.entity(
+        "subscription",
+        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+      );
+    });
+    const features = minimalTenantLifecycleFeatures().concat(bad);
+    expect(features.some((f) => f.name.startsWith("user-data-rights"))).toBe(false);
+    expect(() => validateBoot(features)).toThrow(/EXT_TENANT_DATA destroy hook/);
+  });
+
+  test("V4: tenant-lifecycle not mounted → tenantOwned entity does not throw", () => {
+    const notMounted = defineFeature("billing-standalone", (r) => {
+      r.entity(
+        "subscription",
+        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+      );
+    });
+    expect(() => validateBoot([...baseFeatures(), notMounted])).not.toThrow();
+  });
+
+  test("V4: tenantOwned entity WITH EXT_TENANT_DATA hook registered → no throw", () => {
+    const hooked = defineFeature("billing-hooked", (r) => {
+      r.requires("tenant-lifecycle");
+      r.entity(
+        "subscription",
+        createEntity({ fields: { providerCustomerId: createTextField({ tenantOwned: true }) } }),
+      );
+      r.useExtension(EXT_TENANT_DATA, "subscription", { destroy: async () => {} });
+    });
+    expect(() => validateBoot([...minimalTenantLifecycleFeatures(), hooked])).not.toThrow();
+  });
+});

package/src/user-data-rights/__tests__/cross-data-matrix.integration.test.ts

@@ -13,6 +13,7 @@
 //     Alices Forget; Bobs Daten landen NICHT in Alices Export-Bundle.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineUnmanagedTable } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -36,7 +37,7 @@ import {
 } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { tenantMembershipsTable } from "../../tenant";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
@@ -118,6 +119,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),
@@ -127,6 +129,7 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await asRawClient(stack.db).unsafe(`