@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/user-data-rights-defaults/feature.ts

@@ -3,8 +3,28 @@ import {
   EXT_USER_DATA,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook";
+import { configValueDeleteHook, configValueExportHook } from "./hooks/config-value.userdata-hook";
+import {
+  deliveryAttemptDeleteHook,
+  deliveryAttemptExportHook,
+} from "./hooks/delivery-attempt.userdata-hook";
 import { fileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook";
+import {
+  inAppMessageDeleteHook,
+  inAppMessageExportHook,
+} from "./hooks/in-app-message.userdata-hook";
+import { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook";
+import {
+  notificationPreferenceDeleteHook,
+  notificationPreferenceExportHook,
+} from "./hooks/notification-preference.userdata-hook";
+import {
+  tenantInvitationDeleteHook,
+  tenantInvitationExportHook,
+} from "./hooks/tenant-invitation.userdata-hook";
 import { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook";
+import { userSessionDeleteHook, userSessionExportHook } from "./hooks/user-session.userdata-hook";
 
 // user-data-rights-defaults — Default-Hooks für die Core-Entities
 // `user` (S2.H1) und `fileRef` (S2.H2).
@@ -31,7 +51,7 @@ import { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook";
 export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
   return defineFeature("user-data-rights-defaults", (r) => {
     r.describe(
-      "Registers ready-made `EXT_USER_DATA` export and delete hooks for the two core entities: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`) and `fileRef` (delete removes both the DB row and the storage binary). Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.",
+      "Registers ready-made `EXT_USER_DATA` export and delete hooks for the bundled entities that hold per-user data: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`), `fileRef` (delete removes both the DB row and the storage binary), plus — gated on the source feature being mounted — `user-session` (ip/userAgent, hard-delete), `api-token` (hard-delete = revoke), `in-app-message` (hard-delete), `tenant-invitation` (invitee email forgotten/pseudonymized, inviter link severed), `notification-preference` and user-scoped `config-value` (purged via the forget verb), plus export-only hooks for the events-only aggregates `delivery-attempt` (recipientAddress) and `job-run` (payload) whose erasure runs via crypto-shredding. Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.",
     );
     r.uiHints({
       displayLabel: "User Data Rights · Default Hooks",
@@ -39,6 +59,19 @@ export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
       recommended: false,
     });
     r.requires("user", "files", "user-data-rights");
+    // Optional sources: hooks are registered unconditionally but each one
+    // no-ops at runtime when its source feature isn't mounted (see
+    // hooks/feature-mounted.ts) — the export runner has no per-hook
+    // try/catch, so a query against a missing table would kill the job.
+    r.optionalRequires(
+      "sessions",
+      "personal-access-tokens",
+      "channel-in-app",
+      "tenant",
+      "delivery",
+      "config",
+      "jobs",
+    );
 
     r.useExtension(EXT_USER_DATA, "user", {
       export: userExportHook,
@@ -49,5 +82,49 @@ export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
       export: fileRefExportHook,
       delete: fileRefDeleteHook,
     });
+
+    r.useExtension(EXT_USER_DATA, "user-session", {
+      export: userSessionExportHook,
+      delete: userSessionDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "api-token", {
+      export: apiTokenExportHook,
+      delete: apiTokenDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "in-app-message", {
+      export: inAppMessageExportHook,
+      delete: inAppMessageDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "tenant-invitation", {
+      export: tenantInvitationExportHook,
+      delete: tenantInvitationDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "notification-preference", {
+      export: notificationPreferenceExportHook,
+      delete: notificationPreferenceDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "config-value", {
+      export: configValueExportHook,
+      delete: configValueDeleteHook,
+    });
+
+    // Events-only aggregates (#799): export reads the projected rows, the
+    // delete hooks are deliberate no-ops — erasure happens via crypto-
+    // shredding (forget erases the user's DEK; recipientAddress / job
+    // payload become unreadable in events AND rows).
+    r.useExtension(EXT_USER_DATA, "delivery-attempt", {
+      export: deliveryAttemptExportHook,
+      delete: deliveryAttemptDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "job-run", {
+      export: jobRunExportHook,
+      delete: jobRunDeleteHook,
+    });
   });
 }

package/src/user-data-rights-defaults/hooks/api-token.userdata-hook.ts

@@ -0,0 +1,37 @@
+import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { apiTokenTable } from "../../personal-access-tokens";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for personal-access-tokens rows. Same shape as user-session:
+// unmanaged direct-write store (no event stream, rebuild-safe DELETE), and a
+// token without its user is worthless — both strategies hard-delete. Deleting
+// the row also revokes the token (the resolver point-reads this table), which
+// is the correct outcome for a forgotten user.
+
+export const apiTokenExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "personal-access-tokens")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, apiTokenTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "api-token",
+    // tokenHash stays out of the bundle — secret-derived, not personal data.
+    rows: rows.map((r) => ({
+      name: r["name"] ?? null,
+      prefix: r["prefix"] ?? null,
+      scopes: r["scopes"] ?? null,
+      createdAt: String(r["createdAt"] ?? ""),
+      expiresAt: r["expiresAt"] ? String(r["expiresAt"]) : null,
+      revokedAt: r["revokedAt"] ? String(r["revokedAt"]) : null,
+    })),
+  };
+};
+
+export const apiTokenDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: personal-access-tokens not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "personal-access-tokens")) return;
+  await deleteMany(ctx.db, apiTokenTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};

package/src/user-data-rights-defaults/hooks/config-value.userdata-hook.ts

@@ -0,0 +1,51 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { configValueEntity, configValuesTable } from "../../config";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for config's USER-scoped rows (userId set). Tenant-/system-
+// scope rows carry no per-user subject and stay untouched. Event-sourced
+// entity → forget goes through the executor (rebuild replays the erasure).
+// A user-scoped setting without its user is meaningless — both strategies
+// purge via the forget verb, which also erases encrypted value blobs.
+
+const crud = createEventStoreExecutor(configValuesTable, configValueEntity, {
+  entityName: "config-value",
+});
+
+export const configValueExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "config")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, configValuesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "config-value",
+    // value may be an encrypted blob — exported as stored; decryption is the
+    // config resolver's concern and secret-backed values don't belong in the
+    // bundle in plaintext.
+    rows: rows.map((r) => ({ key: r["key"], value: r["value"] })),
+  };
+};
+
+export const configValueDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: config not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "config")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, configValuesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.forget({ id }, systemUser, tdb);
+  }
+};

package/src/user-data-rights-defaults/hooks/delivery-attempt.userdata-hook.ts

@@ -0,0 +1,37 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { deliveryAttemptsTable } from "../../delivery";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for delivery's attempt log (deferred from #797, closed by
+// #799). deliveryAttempt is an events-only aggregate — the export reads the
+// projected rows; recipientAddress may be ciphertext (kumiko-pii:), which
+// the export runner's central decrypt sweep resolves to plaintext (or
+// [[erased]] after a forget).
+
+export const deliveryAttemptExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "delivery")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, deliveryAttemptsTable, {
+    tenantId: ctx.tenantId,
+    recipientId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "delivery-attempt",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"],
+      channel: r["channel"],
+      status: r["status"],
+      recipientAddress: r["recipientAddress"],
+      priority: r["priority"],
+      createdAt: r["createdAt"],
+    })),
+  };
+};
+
+export const deliveryAttemptDeleteHook: UserDataDeleteHook = async () => {
+  // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
+  // erases the recipient's DEK, which makes recipientAddress unreadable in
+  // BOTH the append-only events and the projected rows (#799). A read-side
+  // UPDATE here would be wiped on the next projection rebuild anyway.
+};

package/src/user-data-rights-defaults/hooks/feature-mounted.ts

@@ -0,0 +1,10 @@
+import type { UserDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
+
+// The defaults feature registers hooks for OPTIONAL source features
+// (optionalRequires). When the source isn't mounted its tables don't exist,
+// and the export runner has no try/catch around hooks — a query against a
+// missing table would kill the whole export job. Every gated hook must
+// early-return on this check before touching the source's tables.
+export function featureMounted(ctx: UserDataHookCtx, featureName: string): boolean {
+  return ctx.registry.getFeature(featureName) !== undefined;
+}

package/src/user-data-rights-defaults/hooks/in-app-message.userdata-hook.ts

@@ -0,0 +1,38 @@
+import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { inAppMessagesTable } from "../../channel-in-app";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for channel-in-app's in_app_messages. Plain SQL table (no
+// r.entity, no event stream — see channel-in-app/tables.ts), written by
+// direct INSERT in the channel adapter, so a direct DELETE is rebuild-safe.
+// Messages are addressed TO the user (title/body can quote personal content);
+// both strategies hard-delete.
+//
+// This table has no entity fields, so the V3 pii-annotation boot guard cannot
+// see it — coverage lives solely in these hooks.
+
+export const inAppMessageExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "channel-in-app")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, inAppMessagesTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "in-app-message",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"] ?? null,
+      title: r["title"] ?? null,
+      body: r["body"] ?? null,
+      isRead: r["isRead"] ?? false,
+      createdAt: String(r["createdAt"] ?? ""),
+    })),
+  };
+};
+
+export const inAppMessageDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: channel-in-app not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "channel-in-app")) return;
+  await deleteMany(ctx.db, inAppMessagesTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};

package/src/user-data-rights-defaults/hooks/job-run.userdata-hook.ts

@@ -0,0 +1,35 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { jobRunsTable } from "../../jobs";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for the jobs run log (deferred from #797, closed by #799).
+// Job runs live on the SYSTEM tenant regardless of who triggered them, so
+// the export filters by triggeredById only — Art. 15 covers everything the
+// user caused, across tenants. payload may be ciphertext (kumiko-pii:); the
+// export runner's central decrypt sweep resolves it.
+
+export const jobRunExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "jobs")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, jobRunsTable, {
+    triggeredById: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "job-run",
+    rows: rows.map((r) => ({
+      jobName: r["jobName"],
+      status: r["status"],
+      payload: r["payload"],
+      startedAt: r["startedAt"],
+      finishedAt: r["finishedAt"],
+    })),
+  };
+};
+
+export const jobRunDeleteHook: UserDataDeleteHook = async () => {
+  // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
+  // erases the triggering user's DEK, which makes the payload unreadable in
+  // BOTH the append-only events and the projected rows (#799). triggeredById
+  // itself is a pseudonymous fk (plaintext by design, like config.userId).
+};

package/src/user-data-rights-defaults/hooks/notification-preference.userdata-hook.ts

@@ -0,0 +1,54 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { notificationPreferenceEntity, notificationPreferencesTable } from "../../delivery";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for delivery's notification-preference rows. Event-sourced
+// entity → forget goes through the executor so a rebuild replays the erasure.
+// A preference without its user is meaningless, so both strategies purge via
+// the forget verb.
+//
+// The delivery ATTEMPTS log is covered separately: export via
+// delivery-attempt.userdata-hook.ts, erasure via crypto-shredding (#799).
+
+const crud = createEventStoreExecutor(notificationPreferencesTable, notificationPreferenceEntity, {
+  entityName: "notification-preference",
+});
+
+export const notificationPreferenceExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "delivery")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, notificationPreferencesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "notification-preference",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"],
+      channel: r["channel"],
+      enabled: r["enabled"],
+    })),
+  };
+};
+
+export const notificationPreferenceDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: delivery not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "delivery")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, notificationPreferencesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.forget({ id }, systemUser, tdb);
+  }
+};

package/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -0,0 +1,112 @@
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+  type UserDataHookCtx,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { decryptStoredPii } from "../../shared";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant";
+import { userTable } from "../../user";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for tenant-invitation rows. Event-sourced entity → all
+// forget writes go through the executor so a projection rebuild replays the
+// erasure (a direct write would be wiped — the Art.17 hole the user/fileRef
+// hooks already close).
+//
+// Two subject paths in one hook:
+//   invitee — rows whose `email` is the user's email. delete → executor
+//             forget (row purged); anonymize → email pseudonymized.
+//   inviter — rows whose `invitedBy` is the user. The row belongs to the
+//             invitee, so both strategies only sever the person-link
+//             (invitedBy → pseudonym; the field is required, null not
+//             allowed).
+//
+// Email source: on forget the user hook may already have anonymized the
+// user row, so ctx.userEmailBeforeDelete (captured by runForgetCleanup
+// before the transaction) takes precedence over a live lookup.
+
+const crud = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, {
+  entityName: "tenant-invitation",
+});
+
+const INVITED_BY_ANONYMIZED = "anonymized";
+
+async function resolveUserEmail(ctx: UserDataHookCtx): Promise<string | null> {
+  if (ctx.userEmailBeforeDelete) return ctx.userEmailBeforeDelete.toLowerCase();
+  const row = (await fetchOne(ctx.db, userTable, { id: ctx.userId })) as {
+    email: string;
+  } | null; // @cast-boundary db-runner
+  if (!row) return null;
+  // Stored value is ciphertext with an active KMS; lowercasing a base64
+  // blob would break both lookup arms — decrypt first.
+  const email = await decryptStoredPii(row.email, "email", "user-data-rights:invitation-hook");
+  return email.toLowerCase();
+}
+
+export const tenantInvitationExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "tenant")) return null;
+  const email = await resolveUserEmail(ctx);
+  if (!email) return null;
+  // Invitation emails are lowercase-normalized on insert, so an exact match
+  // is a case-insensitive match.
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
+    tenantId: ctx.tenantId,
+    email,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "tenant-invitation",
+    rows: rows.map((r) => ({
+      email: r["email"],
+      role: r["role"],
+      status: r["status"],
+      expiresAt: String(r["expiresAt"] ?? ""),
+    })),
+  };
+};
+
+export const tenantInvitationDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
+  // skip: tenant not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "tenant")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+
+  const email = await resolveUserEmail(ctx);
+  if (email) {
+    const inviteeRows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
+      tenantId: ctx.tenantId,
+      email,
+    });
+    for (const row of inviteeRows) {
+      const id = row["id"]; // @cast-boundary db-row
+      if (typeof id !== "string") continue;
+      if (strategy === "delete") {
+        await crud.forget({ id }, systemUser, tdb);
+      } else {
+        // Row-id in the pseudonym keeps the (tenantId, email) unique index
+        // collision-free when a user has invitations in several states.
+        await crud.update(
+          { id, changes: { email: `forgotten-${id}@anonymized.invalid` } },
+          systemUser,
+          tdb,
+          { skipOptimisticLock: true },
+        );
+      }
+    }
+  }
+
+  const inviterRows = await selectMany<Record<string, unknown>>(ctx.db, tenantInvitationsTable, {
+    tenantId: ctx.tenantId,
+    invitedBy: ctx.userId,
+  });
+  for (const row of inviterRows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.update({ id, changes: { invitedBy: INVITED_BY_ANONYMIZED } }, systemUser, tdb, {
+      skipOptimisticLock: true,
+    });
+  }
+};

package/src/user-data-rights-defaults/hooks/user-session.userdata-hook.ts

@@ -0,0 +1,42 @@
+import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { userSessionTable } from "../../sessions";
+import { featureMounted } from "./feature-mounted";
+
+// userData-Hooks for the sessions feature's user-session rows (ip, userAgent).
+//
+// user-session is an unmanaged direct-write store (no event stream, excluded
+// from projection rebuilds — see sessions/feature.ts #494/#498), so a direct
+// DELETE is legal here and survives rebuilds; the executor path the ES
+// entities use does not apply.
+//
+// Both forget strategies hard-delete: a session row without its user is
+// worthless (revocation audit trail loses its subject), and ip/userAgent are
+// pure PII with no shared-data value to preserve via anonymization.
+
+export const userSessionExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "sessions")) return null;
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, userSessionTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "user-session",
+    // sid (row id) stays out of the bundle — it is the JWT jti and
+    // token-shaped, not portable personal data.
+    rows: rows.map((r) => ({
+      createdAt: String(r["createdAt"] ?? ""),
+      expiresAt: String(r["expiresAt"] ?? ""),
+      revokedAt: r["revokedAt"] ? String(r["revokedAt"]) : null,
+      ip: r["ip"] ?? null,
+      userAgent: r["userAgent"] ?? null,
+    })),
+  };
+};
+
+export const userSessionDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: sessions not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "sessions")) return;
+  await deleteMany(ctx.db, userSessionTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};

package/src/user-data-rights-defaults/index.ts

@@ -1,6 +1,32 @@
 export { createUserDataRightsDefaultsFeature } from "./feature";
+export { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook";
+export {
+  configValueDeleteHook,
+  configValueExportHook,
+} from "./hooks/config-value.userdata-hook";
+export {
+  deliveryAttemptDeleteHook,
+  deliveryAttemptExportHook,
+} from "./hooks/delivery-attempt.userdata-hook";
 export {
   fileRefDeleteHook,
   fileRefExportHook,
 } from "./hooks/file-ref.userdata-hook";
+export {
+  inAppMessageDeleteHook,
+  inAppMessageExportHook,
+} from "./hooks/in-app-message.userdata-hook";
+export { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook";
+export {
+  notificationPreferenceDeleteHook,
+  notificationPreferenceExportHook,
+} from "./hooks/notification-preference.userdata-hook";
+export {
+  tenantInvitationDeleteHook,
+  tenantInvitationExportHook,
+} from "./hooks/tenant-invitation.userdata-hook";
 export { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook";
+export {
+  userSessionDeleteHook,
+  userSessionExportHook,
+} from "./hooks/user-session.userdata-hook";

package/src/user-profile/__tests__/change-email.integration.test.ts

@@ -4,6 +4,7 @@
 // dispatcht genau diese Strings).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -18,7 +19,6 @@ import {
 import { expectErrorIncludes, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/constants";
 import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
-import { hashPassword } from "../../auth-email-password/password-hashing";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -27,7 +27,9 @@ import {
 import { createConfigFeature } from "../../config";
 import { configValuesTable } from "../../config/table";
 import { createDataRetentionFeature } from "../../data-retention";
+import { createFilesFeature } from "../../files";
 import { createSessionsFeature } from "../../sessions";
+import { hashPassword } from "../../shared";
 import { createTenantFeature } from "../../tenant";
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 import { tenantEntity } from "../../tenant/schema/tenant";
@@ -36,6 +38,7 @@ import { UserErrors, UserHandlers, UserQueries } from "../../user";
 import { createUserFeature } from "../../user/feature";
 import { userEntity, userTable } from "../../user/schema/user";
 import { createUserDataRightsFeature } from "../../user-data-rights";
+import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults";
 import {
   UserDataRightsHandlers,
   UserProfileErrors,
@@ -58,8 +61,11 @@ beforeAll(async () => {
       createAuthEmailPasswordFeature(),
       createDataRetentionFeature(),
       createComplianceProfilesFeature(),
+      authFoundationFeature,
       createSessionsFeature(),
+      createFilesFeature(),
       createUserDataRightsFeature(),
+      createUserDataRightsDefaultsFeature(),
       createUserProfileFeature(),
     ],
     authConfig: {

package/src/user-profile/__tests__/profile-screen.test.tsx

@@ -37,6 +37,7 @@ function makeDispatcher(me: Record<string, unknown>): Dispatcher {
     query: (async () => ({ isSuccess: true, data: me })) as unknown as Dispatcher["query"],
     batch: (async () => ({ isSuccess: true, results: [] })) as unknown as Dispatcher["batch"],
     statusStore,
+    async *stream() {},
     pendingWrites: () => [],
     pendingFiles: () => [],
   } as unknown as Dispatcher; // @cast-boundary test-stub
@@ -76,6 +77,10 @@ describe("ProfileScreen", () => {
     expect(view.getByTestId("profile-email")).toBeTruthy();
     expect(view.getByTestId("profile-password")).toBeTruthy();
     expect(view.getByTestId("profile-danger")).toBeTruthy();
+    // 607/4: page heading is <h1> (Heading variant="page") — the danger-zone
+    // title must be <h2>, not Card's default <h3>, so the levels don't skip.
+    expect(view.getByTestId("profile-danger").querySelector("h2")).not.toBeNull();
+    expect(view.getByTestId("profile-danger").querySelector("h3")).toBeNull();
     expect(view.getByTestId("profile-email-current").textContent).toContain("marc@example.com");
     expect(view.getByTestId("profile-danger-delete")).toBeTruthy();
     // Echte i18n: kein einziger roher Key im sichtbaren Text.

package/src/user-profile/feature.ts

@@ -11,7 +11,9 @@ export function createUserProfileFeature(): FeatureDefinition {
         "change-email and account deletion (user-data-rights request/cancel with " +
         "grace period) into one screen. Apps register the screen as " +
         '`type: "custom"` with `__component: "UserProfileScreen"`. Requires `user`, ' +
-        "`auth-email-password`, and `user-data-rights`.",
+        "`auth-email-password`, `user-data-rights`, and `user-data-rights-defaults` " +
+        "(so the GDPR boot-validator finds export/delete hooks for `user`'s PII " +
+        "fields once user-data-rights is mounted).",
     );
     r.uiHints({
       displayLabel: "User Profile · Self-Service",
@@ -21,6 +23,7 @@ export function createUserProfileFeature(): FeatureDefinition {
     r.requires("user");
     r.requires("auth-email-password");
     r.requires("user-data-rights");
+    r.requires("user-data-rights-defaults");
 
     const handlers = {
       changeEmail: r.writeHandler(changeEmailWrite),