@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -16,7 +16,9 @@
 // der end-to-end-Default-Pfad (delete).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
 import type { JobContext } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
@@ -30,7 +32,7 @@ import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature, tenantRetentionOverrideEntity } from "../../data-retention";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import {
   createUserFeature,
   USER_ANONYMIZED_DISPLAY_NAME,
@@ -66,6 +68,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),
@@ -74,6 +77,9 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);
+  // sessions ist gemountet → der user-session-Hook der defaults läuft im Forget
+  // und braucht die Tabelle (#797).
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
   // tenant-membership-Tabelle (von tenant-feature) manuell anlegen weil
   // wir ohne tenant-feature im stack arbeiten — minimaler Setup.
@@ -276,6 +282,22 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
   // getJob undefined und die Loeschung laeuft nach Grace-Ablauf NIE. Wir
   // treiben den ECHTEN registrierten Job durch den echten JobContext (db +
   // registry, kein config) — nicht den inneren runForgetCleanup-Helper.
+  function capturingJobLog() {
+    const warns: string[] = [];
+    const log: JobContext["log"] = {
+      info() {},
+      warn(message: string) {
+        warns.push(message);
+      },
+      error() {},
+      debug() {},
+      child(): JobContext["log"] {
+        return this;
+      },
+    };
+    return { log, warns };
+  }
+
   test("registered job exists + erases through the real JobContext", async () => {
     const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
     expect(job).toBeTruthy();
@@ -289,10 +311,8 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     });
     await seedMembership(CRON_USER, TENANT_A);
 
-    const jobCtx = { db: stack.db, registry: stack.registry };
-    // jobCtx is a deliberately minimal prod-context replica (missing
-    // systemUser/log/triggeredBy) — double-cast at this test boundary since
-    // the handler under test never touches those fields.
+    const { log } = capturingJobLog();
+    const jobCtx = { db: stack.db, registry: stack.registry, log };
     await job?.handler({}, jobCtx as unknown as JobContext);
 
     const row = await fetchUser(CRON_USER);
@@ -300,6 +320,52 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     expect(row?.email).not.toContain("cron-delete@example.com");
     expect(row?.email).toContain("anonymized.invalid");
   });
+
+  test("incomplete hooks are written to ctx.log (job-run audit trail, #1572)", async () => {
+    const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
+    expect(job).toBeTruthy();
+
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const usages = stack.registry.getExtensionUsages("userData");
+    const userUsage = usages.find((u) => u.entityName === "user");
+    if (!userUsage?.options) throw new Error("user usage not found");
+    type DeleteHook = (
+      ctx: { userId: string; tenantId: string; db: unknown },
+      strategy: string,
+    ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+    const originalUserDelete = (userUsage.options as { delete: DeleteHook }).delete;
+    (userUsage.options as { delete: DeleteHook }).delete = async (ctx, strategy) => {
+      if (ctx.userId === ALICE_ID) {
+        return { status: "incomplete", reason: "synthetic partial cleanup for alice" };
+      }
+      return originalUserDelete(ctx, strategy);
+    };
+
+    const { log, warns } = capturingJobLog();
+    try {
+      await job?.handler({}, {
+        db: stack.db,
+        registry: stack.registry,
+        log,
+      } as unknown as JobContext);
+    } finally {
+      (userUsage.options as { delete: DeleteHook }).delete = originalUserDelete;
+    }
+
+    const hit = warns.find((w) => w.includes("incomplete hook") && w.includes(ALICE_ID));
+    expect(hit).toBeDefined();
+    expect(hit).toContain("entityName=user");
+    expect(hit).toContain("rolledBack=false");
+    expect(hit).toContain("reason=synthetic partial cleanup for alice");
+
+    const aliceRow = await fetchUser(ALICE_ID);
+    expect(aliceRow?.status).toBe(USER_STATUS.Deleted);
+  });
 });
 
 describe("runForgetCleanup :: time-window guards", () => {
@@ -743,4 +809,272 @@ describe("runForgetCleanup :: per-User-Sub-Tx-Isolation (advisor-pinned Architek
       ).delete = originalUserDelete;
     }
   });
+
+  test("Hook meldet {status:'incomplete'} → kein Rollback, User trotzdem Deleted, im result.incomplete gesammelt", async () => {
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const usages = stack.registry.getExtensionUsages("userData");
+    const userUsage = usages.find((u) => u.entityName === "user");
+    if (!userUsage?.options) throw new Error("user usage not found");
+    const originalUserDelete = (
+      userUsage.options as {
+        delete: (
+          ctx: { userId: string; tenantId: string; db: unknown },
+          strategy: string,
+        ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+      }
+    ).delete;
+    (
+      userUsage.options as {
+        delete: (
+          ctx: { userId: string; tenantId: string; db: unknown },
+          strategy: string,
+        ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+      }
+    ).delete = async (ctx: { userId: string; tenantId: string; db: unknown }, strategy: string) => {
+      if (ctx.userId === ALICE_ID) {
+        return { status: "incomplete", reason: "synthetic partial cleanup for alice" };
+      }
+      return originalUserDelete(ctx, strategy);
+    };
+
+    try {
+      const result = await runForgetCleanup({
+        db: stack.db,
+        registry: stack.registry,
+        now: NOW(),
+      });
+
+      // No hard failure: user flipped, no errors entry.
+      expect(result.processedUserIds).toContain(ALICE_ID);
+      expect(result.errors.some((e) => e.userId === ALICE_ID)).toBe(false);
+
+      // But collected in the incomplete set with reason + tenant + entity.
+      const aliceIncomplete = result.incomplete.find((i) => i.userId === ALICE_ID);
+      expect(aliceIncomplete?.reason).toBe("synthetic partial cleanup for alice");
+      expect(aliceIncomplete?.tenantId).toBe(TENANT_A);
+      expect(aliceIncomplete?.entityName).toBe("user");
+      expect(aliceIncomplete?.rolledBack).toBe(false);
+
+      // Status flip proceeded despite the incomplete report.
+      const aliceRow = await fetchUser(ALICE_ID);
+      expect(aliceRow?.status).toBe(USER_STATUS.Deleted);
+    } finally {
+      (
+        userUsage.options as {
+          delete: (
+            ctx: { userId: string; tenantId: string; db: unknown },
+            strategy: string,
+          ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+        }
+      ).delete = originalUserDelete;
+    }
+  });
+
+  test("hook incomplete on one tenant, then throws on a later tenant → the incomplete report survives, flagged rolledBack (#1489)", async () => {
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+    await seedMembership(ALICE_ID, TENANT_B);
+
+    const usages = stack.registry.getExtensionUsages("userData");
+    const userUsage = usages.find((u) => u.entityName === "user");
+    if (!userUsage?.options) throw new Error("user usage not found");
+    const originalUserDelete = (
+      userUsage.options as {
+        delete: (
+          ctx: { userId: string; tenantId: string; db: unknown },
+          strategy: string,
+        ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+      }
+    ).delete;
+    (
+      userUsage.options as {
+        delete: (
+          ctx: { userId: string; tenantId: string; db: unknown },
+          strategy: string,
+        ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+      }
+    ).delete = async (ctx: { userId: string; tenantId: string; db: unknown }, strategy: string) => {
+      if (ctx.userId === ALICE_ID && ctx.tenantId === TENANT_A) {
+        return { status: "incomplete", reason: "synthetic partial cleanup for alice (tenant A)" };
+      }
+      if (ctx.userId === ALICE_ID && ctx.tenantId === TENANT_B) {
+        throw new Error("synthetic hook failure for alice (tenant B)");
+      }
+      return originalUserDelete(ctx, strategy);
+    };
+
+    try {
+      const result = await runForgetCleanup({
+        db: stack.db,
+        registry: stack.registry,
+        now: NOW(),
+      });
+
+      // The whole per-user sub-tx rolled back — the DB rows (including the
+      // status flip) are undone, and the failure surfaces as a hard error
+      // too. But tenant A's "incomplete" report describes an external,
+      // non-transactional side effect (already ran, not rolled back by a
+      // DB rollback) — it must still reach the operator, just marked
+      // rolledBack so they know the user itself is still DeletionRequested.
+      const aliceIncomplete = result.incomplete.find((i) => i.userId === ALICE_ID);
+      expect(aliceIncomplete?.rolledBack).toBe(true);
+      expect(result.errors.some((e) => e.userId === ALICE_ID)).toBe(true);
+      expect(result.processedUserIds).not.toContain(ALICE_ID);
+
+      const aliceRow = await fetchUser(ALICE_ID);
+      expect(aliceRow?.status).toBe(USER_STATUS.DeletionRequested);
+    } finally {
+      (
+        userUsage.options as {
+          delete: (
+            ctx: { userId: string; tenantId: string; db: unknown },
+            strategy: string,
+          ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+        }
+      ).delete = originalUserDelete;
+    }
+  });
+
+  test("hook returns {status:'ok'} → treated as a clean completion, not incomplete", async () => {
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const usages = stack.registry.getExtensionUsages("userData");
+    const userUsage = usages.find((u) => u.entityName === "user");
+    if (!userUsage?.options) throw new Error("user usage not found");
+    const originalUserDelete = (
+      userUsage.options as {
+        delete: (
+          ctx: { userId: string; tenantId: string; db: unknown },
+          strategy: string,
+        ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+      }
+    ).delete;
+    (
+      userUsage.options as {
+        delete: (
+          ctx: { userId: string; tenantId: string; db: unknown },
+          strategy: string,
+        ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+      }
+    ).delete = async (ctx: { userId: string; tenantId: string; db: unknown }, strategy: string) => {
+      if (ctx.userId === ALICE_ID) {
+        return { status: "ok" };
+      }
+      return originalUserDelete(ctx, strategy);
+    };
+
+    try {
+      const result = await runForgetCleanup({
+        db: stack.db,
+        registry: stack.registry,
+        now: NOW(),
+      });
+
+      expect(result.processedUserIds).toContain(ALICE_ID);
+      expect(result.errors.some((e) => e.userId === ALICE_ID)).toBe(false);
+      expect(result.incomplete.some((i) => i.userId === ALICE_ID)).toBe(false);
+
+      const aliceRow = await fetchUser(ALICE_ID);
+      expect(aliceRow?.status).toBe(USER_STATUS.Deleted);
+    } finally {
+      (
+        userUsage.options as {
+          delete: (
+            ctx: { userId: string; tenantId: string; db: unknown },
+            strategy: string,
+          ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+        }
+      ).delete = originalUserDelete;
+    }
+  });
+});
+
+// eraseKey never fails in the in-memory adapter, so the rollback test
+// overrides it to simulate a KMS outage.
+class FailingEraseKms extends InMemoryKmsAdapter {
+  override async eraseKey(): Promise<void> {
+    throw new Error("kms unavailable");
+  }
+}
+
+describe("runForgetCleanup :: crypto-shredding (subject key erase)", () => {
+  test("successful forget erases the user's subject key", async () => {
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const kms = new InMemoryKmsAdapter();
+    await kms.createKey({ kind: "user", userId: ALICE_ID });
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: NOW(),
+      kms,
+    });
+
+    expect(result.processedUserIds).toEqual([ALICE_ID]);
+    expect(result.errors).toHaveLength(0);
+    await expect(kms.getKey({ kind: "user", userId: ALICE_ID })).rejects.toThrow(
+      "Subject key erased",
+    );
+  });
+
+  test("user without a subject key: erase is a no-op, forget still completes", async () => {
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: NOW(),
+      kms: new InMemoryKmsAdapter(),
+    });
+
+    expect(result.processedUserIds).toEqual([ALICE_ID]);
+    expect(result.errors).toHaveLength(0);
+  });
+
+  test("eraseKey failure rolls back the user's sub-tx (stays DeletionRequested, PII intact)", async () => {
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+      email: "alice.erase-fail@example.com",
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: NOW(),
+      kms: new FailingEraseKms(),
+    });
+
+    expect(result.processedUserIds).toHaveLength(0);
+    expect(result.errors.length).toBeGreaterThanOrEqual(1);
+    expect(result.errors[0]?.message).toContain("kms unavailable");
+
+    // Sub-tx rollback: the anonymize hooks ran but must be undone — a user
+    // whose key survives must keep retrying, not sit half-forgotten.
+    const alice = await fetchUser(ALICE_ID);
+    expect(alice?.status).toBe(USER_STATUS.DeletionRequested);
+    expect(alice?.email).toBe("alice.erase-fail@example.com");
+  });
 });

package/src/user-data-rights/__tests__/run-user-export.integration.test.ts

@@ -15,7 +15,14 @@
 //     ueber Pseudo-Tenant.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configurePiiSubjectKms,
+  encryptPiiFieldValues,
+  InMemoryKmsAdapter,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -28,7 +35,7 @@ import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createFilesFeature } from "../../files";
-import { createSessionsFeature } from "../../sessions";
+import { createSessionsFeature, userSessionEntity } from "../../sessions";
 import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../user";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import { createUserDataRightsFeature } from "../feature";
@@ -55,6 +62,7 @@ beforeAll(async () => {
       createFilesFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
 
       createUserDataRightsFeature(),
@@ -63,6 +71,7 @@ beforeAll(async () => {
   });
 
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
   await asRawClient(stack.db).unsafe(`
     CREATE TABLE IF NOT EXISTS read_tenant_memberships (
       id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
@@ -287,3 +296,70 @@ describe("runUserExport :: Empty-State", () => {
     expect(allUserSnippets).toEqual([]);
   });
 });
+
+describe("runUserExport :: PII-Subject-Ciphertexte (#820)", () => {
+  test("Art. 20: bundle carries plaintext, never kumiko-pii: blobs", async () => {
+    const kms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(kms);
+    try {
+      await seedUser(ALICE_ID, { email: "alice.kms@example.com", displayName: "Alice KMS" });
+      await seedMembership(ALICE_ID, TENANT_A);
+      // Read-Pfad-Test: die Spalten tragen echten Subject-Ciphertext, wie
+      // sie ein Executor-Write hinterlassen haette (Write-Pfad: PR 1/2).
+      const encrypted = await encryptPiiFieldValues(
+        { id: ALICE_ID, email: "alice.kms@example.com", displayName: "Alice KMS" },
+        userEntity,
+        ["email", "displayName"],
+        kms,
+        { requestId: "test" },
+      );
+      await asRawClient(stack.db).unsafe(
+        `UPDATE read_users SET email = $1, display_name = $2 WHERE id = $3`,
+        [String(encrypted["email"]), String(encrypted["displayName"]), ALICE_ID],
+      );
+
+      const bundle = await runUserExport({
+        db: stack.db,
+        registry: stack.registry,
+        userId: ALICE_ID,
+        now: NOW(),
+      });
+
+      const json = JSON.stringify(bundle);
+      expect(json).not.toContain("kumiko-pii:");
+      expect(json).toContain("alice.kms@example.com");
+      expect(json).toContain("Alice KMS");
+    } finally {
+      resetPiiSubjectKmsForTests();
+    }
+  });
+
+  test("ciphertext without a configured KMS exports an explicit marker, not the blob", async () => {
+    const kms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(kms);
+    await seedUser(ALICE_ID, { email: "alice.nokms@example.com" });
+    await seedMembership(ALICE_ID, TENANT_A);
+    const encrypted = await encryptPiiFieldValues(
+      { id: ALICE_ID, email: "alice.nokms@example.com" },
+      userEntity,
+      ["email"],
+      kms,
+      { requestId: "test" },
+    );
+    await asRawClient(stack.db).unsafe(`UPDATE read_users SET email = $1 WHERE id = $2`, [
+      String(encrypted["email"]),
+      ALICE_ID,
+    ]);
+    resetPiiSubjectKmsForTests();
+
+    const bundle = await runUserExport({
+      db: stack.db,
+      registry: stack.registry,
+      userId: ALICE_ID,
+      now: NOW(),
+    });
+    const json = JSON.stringify(bundle);
+    expect(json).not.toContain("kumiko-pii:");
+    expect(json).toContain("[encrypted:unavailable]");
+  });
+});

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -13,6 +13,7 @@
 // value (the failure mode that shipped the ctx.config export bug).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createEntity,
@@ -82,6 +83,7 @@ beforeAll(async () => {
   stack = await setupTestStack({
     features: [
       createUserFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),

package/src/user-data-rights/__tests__/user-data-rights.integration.test.ts

@@ -7,6 +7,7 @@
 // Sprint-2-H1/H2-Hooks) kommt in S2.T1 (Cross-Data-Matrix).
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
@@ -24,7 +25,14 @@ const userDataRights = createUserDataRightsFeature();
 
 beforeAll(async () => {
   stack = await setupTestStack({
-    features: [userFeature, sessionsFeature, dataRetention, complianceProfiles, userDataRights],
+    features: [
+      authFoundationFeature,
+      userFeature,
+      sessionsFeature,
+      dataRetention,
+      complianceProfiles,
+      userDataRights,
+    ],
   });
 });
 

package/src/user-data-rights/boot-checks.ts

@@ -0,0 +1,70 @@
+import {
+  EXT_USER_DATA,
+  type FeatureDefinition,
+  type PiiAnnotations,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { entitiesOf } from "../shared";
+
+// V2: export-without-erase gate. A feature that registers an EXT_USER_DATA
+// export hook without a matching delete hook exports data under Art.20 but
+// never erases it on forget — an Art.17 violation. Hard boot failure: no app
+// should ship a GDPR export path with no erase path. Registry-level signal
+// only; runtime no-ops (a delete hook that silently skips) are not detectable
+// here — those are covered by the export/forget integration tests.
+//
+// Registered as an `r.bootCheck()` by this feature (#1314) — EXT_USER_DATA is
+// owned by user-data-rights (r.extendsRegistrar(EXT_USER_DATA, {})), so any
+// r.useExtension(EXT_USER_DATA, ...) usage across the app already requires
+// user-data-rights to be mounted (boot-validator's extension-provider check
+// fails otherwise); running this from user-data-rights' own bootCheck is
+// equivalent to the framework-internal call it replaces.
+export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
+  for (const feature of features) {
+    for (const usage of feature.extensionUsages) {
+      if (usage.extensionName !== EXT_USER_DATA) continue;
+      const hasExport = typeof usage.options?.["export"] === "function";
+      const hasDelete = typeof usage.options?.["delete"] === "function";
+      if (hasExport && !hasDelete) {
+        throw new Error(
+          `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
+        );
+      }
+    }
+  }
+}
+
+// V3: PII-entity-without-hook gate. V2 checks registered hooks for
+// completeness; V3 catches the entity nobody registered at all — fields
+// annotated as user-subject data (pii / userOwned) yet invisible to the
+// Art.15/20 export and Art.17 forget pipeline. Hard boot failure: a
+// subject-data entity that skips the pipeline is exactly the "feature built
+// past GDPR" leak this gate exists to stop. No "is user-data-rights mounted"
+// guard needed here (unlike the framework-internal predecessor) — this runs
+// as user-data-rights' own bootCheck, so it's only reachable when mounted.
+// Matching is by entity name across all features (usage.entityName is
+// unqualified); a same-named entity in another feature can mask a gap —
+// accepted, as the common case is a distinct entity name.
+export function validateGdprPiiHookCoverage(features: readonly FeatureDefinition[]): void {
+  const hookedEntities = new Set<string>();
+  for (const f of features) {
+    for (const usage of f.extensionUsages) {
+      if (usage.extensionName === EXT_USER_DATA) hookedEntities.add(usage.entityName);
+    }
+  }
+
+  for (const feature of features) {
+    for (const [entityName, entity] of entitiesOf(feature)) {
+      if (hookedEntities.has(entityName)) continue;
+      const subjectFields = Object.entries(entity.fields)
+        .filter(([, field]) => {
+          const annot = field as PiiAnnotations; // @cast-boundary schema-walk
+          return Boolean(annot.pii) || Boolean(annot.userOwned);
+        })
+        .map(([name]) => name);
+      if (subjectFields.length === 0) continue;
+      throw new Error(
+        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
+      );
+    }
+  }
+}

package/src/user-data-rights/db/queries/__tests__/forget-cleanup.integration.test.ts

@@ -0,0 +1,69 @@
+// kumiko-framework#1525: selectUsersDueForForgetCleanup must not rely on
+// globalThis.Temporal when the caller passes a string cutoff (the
+// run-forget-cleanup.integration.test.ts suite exercises the full
+// pipeline; this is the narrow seam for the ambient-global regression).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables, seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { createUserFeature, USER_STATUS, userEntity, userTable } from "../../../../user";
+import { selectUsersDueForForgetCleanup } from "../forget-cleanup";
+
+let stack: TestStack;
+
+const TENANT = "00000000-0000-4000-8000-00000000000a";
+const USER_ID = "aaaaaaaa-aaaa-4aaa-8aaa-000000000001";
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createUserFeature()] });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [userTable]);
+});
+
+describe("selectUsersDueForForgetCleanup — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("string cutoff resolves without relying on globalThis.Temporal", async () => {
+    const pastGracePeriodEnd = getTemporal().Now.instant().subtract({ hours: 1 });
+    await seedRow(stack.db, userTable, {
+      id: USER_ID,
+      tenantId: TENANT,
+      email: "due@example.com",
+      passwordHash: "hashed",
+      displayName: "Due User",
+      locale: "de",
+      emailVerified: true,
+      roles: '["Member"]',
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: pastGracePeriodEnd,
+    });
+
+    // Computed with Temporal intact — only the query call itself runs
+    // ambient-free below.
+    const cutoffIso = getTemporal().Now.instant().toString();
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const due = await selectUsersDueForForgetCleanup(
+        stack.db,
+        USER_STATUS.DeletionRequested,
+        cutoffIso,
+      );
+      expect(due.map((u) => u.id)).toContain(USER_ID);
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});