@cosmicdrift/kumiko-framework 0.362.0 → 0.364.0

package/agents/examples/user-data-rights.md

@@ -0,0 +1,410 @@
+<!-- Generated by `bun run gen:agent-docs` from samples/recipes/user-data-rights. Do not edit. -->
+
+# user-data-rights
+
+DSGVO-compliant in 5 LOC: r.useExtension(EXT_USER_DATA, ...) haengt eine Domain an Forget+Export-Pipeline. Forget-Cron, Export-ZIP, Magic-Link kommen alle aus user-data-rights.
+
+## README
+
+# user-data-rights
+
+GDPR-compliant domain wiring in ~5 lines: `r.useExtension(EXT_USER_DATA, …)`
+hooks any entity into the forget cron, export ZIP, and magic-link pipeline.
+You write two hooks per entity — the framework runs the rest.
+
+## What it shows
+
+A minimal notes domain with GDPR Art. 15+17+20 integrated without hand-written
+forget logic:
+
+```ts illustration
+defineFeature("notes", (r) => {
+  r.requires("user-data-rights");
+  r.entity("note", noteEntity);
+
+  r.useExtension(EXT_USER_DATA, "note", {
+    export: async (ctx) => ({
+      entity: "note",
+      rows: await ctx.db.select().from(notesTable)
+        .where(and(eq(notesTable.tenantId, ctx.tenantId),
+                   eq(notesTable.authorId, ctx.userId))),
+    }),
+    delete: async (ctx, strategy) => {
+      const where = and(eq(notesTable.tenantId, ctx.tenantId),
+                        eq(notesTable.authorId, ctx.userId));
+      if (strategy === "anonymize") {
+        await ctx.db.update(notesTable).set({ authorId: null }).where(where);
+      } else {
+        await ctx.db.delete(notesTable).where(where);
+      }
+    },
+  });
+});
+```
+
+## What runs automatically
+
+| Article | What happens | Trigger |
+|---|---|---|
+| Art. 15 + 20 | Notes snippet in export ZIP + magic-link email | `runUserExport` (via `request-export`) |
+| Art. 17 | Notes deleted or anonymized after grace | `runForgetCleanup` cron |
+| Art. 18 | Restriction blocks login while active | Auth middleware |
+| Operator | Brute-force detection on magic-link endpoint | Edge rate-limit + audit log |
+
+## Strategy-aware delete
+
+`retention.policyFor("note")` resolves per entity:
+
+| Profile | Strategy | Effect |
+|---|---|---|
+| `eu-dsgvo` (default) | `delete` | Notes hard-deleted |
+| `de-hr-dsgvo-hgb` | `anonymize` for HR entities | `authorId=null`, row kept for multi-user refs |
+
+The integration test pins both paths.
+
+## Flow
+
+1. User creates notes → rows stored with `authorId`.
+2. `request-export` queues job → `runUserExport` bundles user + note rows.
+3. `request-deletion` → grace period from compliance profile.
+4. `runForgetCleanup` calls your `delete` hook with resolved strategy.
+
+## Tests
+
+Needs a running Postgres and `TEST_DATABASE_URL` set (e.g. `postgres://postgres:postgres@127.0.0.1:5432/postgres`, see `demo/.env.example`).
+
+```bash
+bun test src/__tests__/feature.integration.test.ts
+```
+
+Step-by-step proof:
+
+1. Alice creates 2 notes → export bundle includes note snippet
+2. Deletion + expired grace → `runForgetCleanup` removes all notes
+3. Strategy `anonymize` → `authorId=null`, title/body remain
+
+## Full app vs this recipe
+
+| | This recipe | [user-data-rights-demo](/en/samples/apps-user-data-rights-demo/) |
+|---|---|---|
+| Scope | One hook pattern | Runnable app + todos + files |
+| Boot | Integration test only | `bun dev` on port 4291 |
+
+## Dependencies
+
+```ts illustration
+import { createUserDataRightsFeature } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
+import { createUserDataRightsDefaultsFeature } from "@cosmicdrift/kumiko-bundled-features/user-data-rights-defaults";
+import { createDataRetentionFeature } from "@cosmicdrift/kumiko-bundled-features/data-retention";
+import { createComplianceProfilesFeature } from "@cosmicdrift/kumiko-bundled-features/compliance-profiles";
+
+export const features = [
+  createDataRetentionFeature(),
+  createComplianceProfilesFeature(),
+  createUserDataRightsFeature(),
+  createUserDataRightsDefaultsFeature(),
+  notesFeature,
+];
+```
+
+## Source files
+
+### src/__tests__/feature.integration.test.ts
+
+```ts
+// User-Data-Rights Recipe — Integration-Test.
+//
+// Pinst dass die zwei Hooks aus feature.ts genau das tun was die Recipe-
+// README verspricht:
+//   1. Notes des Users landen via export-Hook im Bundle-Snippet.
+//   2. Forget-Cleanup-Cron entfernt die Notes via delete-Hook (strategy
+//      "delete", default).
+//   3. Strategy "anonymize" (HR-Override) setzt authorId=null statt zu
+//      löschen — Row bleibt für Multi-User-Refs intakt.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "@cosmicdrift/kumiko-bundled-features/compliance-profiles";
+import {
+  createDataRetentionFeature,
+  tenantRetentionOverrideEntity,
+} from "@cosmicdrift/kumiko-bundled-features/data-retention";
+import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
+import {
+  createUserFeature,
+  USER_STATUS,
+  userEntity,
+  userTable,
+} from "@cosmicdrift/kumiko-bundled-features/user";
+import {
+  createUserDataRightsFeature,
+  runForgetCleanup,
+  runUserExport,
+} from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
+import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { noteEntity, notesFeature, notesTable } from "../feature";
+
+let stack: TestStack;
+
+const TENANT_A = "00000000-0000-4000-8000-00000000000a";
+const TENANT_SYSTEM = "00000000-0000-4000-8000-000000000001";
+const ALICE_ID = "11111111-1111-4111-8111-000000000001";
+
+type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
+const NOW = (): Instant => getTemporal().Now.instant();
+const PAST = (): Instant => getTemporal().Instant.fromEpochMilliseconds(Date.now() - 60_000);
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createUserFeature(),
+      authFoundationFeature,
+      createSessionsFeature(),
+      createDataRetentionFeature(),
+      createComplianceProfilesFeature(),
+      createUserDataRightsFeature(),
+      notesFeature,
+    ],
+  });
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, noteEntity);
+  await unsafeCreateEntityTable(stack.db, tenantRetentionOverrideEntity);
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
+  await asRawClient(stack.db).unsafe(`
+    CREATE TABLE IF NOT EXISTS read_tenant_memberships (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      tenant_id UUID NOT NULL,
+      user_id TEXT NOT NULL,
+      version INTEGER NOT NULL DEFAULT 0,
+      inserted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      modified_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      inserted_by_id TEXT,
+      modified_by_id TEXT,
+      is_deleted BOOLEAN NOT NULL DEFAULT false,
+      deleted_at TIMESTAMPTZ,
+      deleted_by_id TEXT,
+      roles TEXT NOT NULL DEFAULT '[]',
+      UNIQUE(user_id, tenant_id)
+    )
+  `);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe(`DELETE FROM store_notes`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM "${userTable.tableName}"`);
+  await asRawClient(stack.db).unsafe(`DELETE FROM read_tenant_memberships`);
+});
+
+async function seedAlice(opts: { gracePeriodEnd?: Instant; status?: string } = {}): Promise<void> {
+  await seedRow(stack.db, userTable, {
+    id: ALICE_ID,
+    tenantId: TENANT_SYSTEM,
+    email: "alice@recipe.test",
+    passwordHash: "h",
+    displayName: "Alice",
+    locale: "de",
+    emailVerified: true,
+    roles: '["Member"]',
+    status: opts.status ?? USER_STATUS.Active,
+    gracePeriodEnd: opts.gracePeriodEnd ?? null,
+  });
+  await asRawClient(stack.db).unsafe(
+    `
+    INSERT INTO read_tenant_memberships (tenant_id, user_id, roles)
+    VALUES ($1, $2, '["Member"]')
+    ON CONFLICT DO NOTHING
+  `,
+    [TENANT_A, ALICE_ID],
+  );
+}
+
+async function seedNote(id: string, title: string): Promise<void> {
+  await insertOne(stack.db, notesTable, {
+    id,
+    tenantId: TENANT_A,
+    authorId: ALICE_ID,
+    title,
+    body: `body for ${title}`,
+  });
+}
+
+describe("user-data-rights recipe :: EXT_USER_DATA-Hooks integrieren Notes-Domain", () => {
+  test("Export-Bundle enthaelt Note-Snippet via Hook", async () => {
+    await seedAlice();
+    await seedNote("aaaaaaaa-aaaa-4aaa-8aaa-000000000001", "first");
+    await seedNote("aaaaaaaa-aaaa-4aaa-8aaa-000000000002", "second");
+
+    const bundle = await runUserExport({
+      db: stack.db,
+      registry: stack.registry,
+      userId: ALICE_ID,
+      now: NOW(),
+    });
+
+    const tenantA = bundle.tenants.find((t) => t.tenantId === TENANT_A);
+    const noteSnippet = tenantA?.entities.find((e) => e.entity === "note");
+    expect(noteSnippet?.rows).toHaveLength(2);
+    expect((noteSnippet?.rows ?? []).map((r) => String(r["title"])).sort()).toEqual([
+      "first",
+      "second",
+    ]);
+  });
+
+  test("Forget-Cron strategy=delete entfernt Notes (Default-Pfad)", async () => {
+    await seedAlice({ status: USER_STATUS.DeletionRequested, gracePeriodEnd: PAST() });
+    await seedNote("aaaaaaaa-aaaa-4aaa-8aaa-000000000003", "to-delete");
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: NOW(),
+    });
+    expect(result.processedUserIds).toContain(ALICE_ID);
+
+    const remaining = await asRawClient(stack.db).unsafe(`SELECT id FROM store_notes`);
+    expect(remaining.length).toBe(0);
+  });
+
+  test("Strategy=anonymize: authorId=null, Row bleibt (HR-Compliance-Pfad)", async () => {
+    await seedAlice();
+    await seedNote("aaaaaaaa-aaaa-4aaa-8aaa-000000000004", "stays-anonymous");
+
+    const usage = stack.registry
+      .getExtensionUsages(EXT_USER_DATA)
+      .find((u) => u.entityName === "note");
+    const hooks = usage?.options as
+      | {
+          delete?: (
+            ctx: { db: typeof stack.db; tenantId: string; userId: string },
+            strategy: "delete" | "anonymize",
+          ) => Promise<void>;
+        }
+      | undefined;
+    await hooks?.delete?.({ db: stack.db, tenantId: TENANT_A, userId: ALICE_ID }, "anonymize");
+
+    const after = (await asRawClient(stack.db).unsafe(
+      `SELECT title, author_id FROM store_notes`,
+    )) as Array<{ title: string; author_id: string | null }>;
+    expect(after).toHaveLength(1);
+    expect(after[0]?.author_id).toBeNull();
+    expect(after[0]?.title).toBe("stays-anonymous");
+  });
+});
+```
+
+### src/feature.ts
+
+```ts
+// User-Data-Rights — Recipe
+//
+// Wie eine App-Domain DSGVO-Pipeline integriert: pro Entity einen
+// (export, delete)-Hook ueber EXT_USER_DATA. Forget-Cron, Export-ZIP-Bau
+// und Magic-Link-Versand kommen vollstaendig aus user-data-rights —
+// App-Author schreibt nur die zwei Hooks pro Entity.
+//
+// Demo-Domain: minimaler Note-Service. Note hat (id, tenantId, authorId,
+// title, body). Pinst:
+//   1. Hook export liefert Note-Rows als JSON-Snippet ins Export-Bundle.
+//   2. Hook delete entfernt Note-Rows beim Forget-Cleanup-Cron.
+//
+// Was nicht im Recipe ist (siehe samples/apps/user-data-rights-demo
+// fuer eine vollstaendige App):
+//   - Strategy-aware delete (anonymize vs hardDelete)
+//   - HTTP-Endpoints fuer create/list
+//   - Compliance-Profile-Wiring + Cron-Scheduling
+
+import { deleteMany, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  EXT_USER_DATA,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+export const noteEntity = createEntity({
+  table: "store_notes",
+  idType: "uuid",
+  fields: {
+    authorId: createTextField({ personal: "ref" }),
+    title: createTextField({
+      personal: false,
+      reason: "is_business_data",
+      required: true,
+      maxLength: 200,
+    }),
+    // Plaintext on purpose: store_notes is an unmanaged direct-write store, so the
+    // PII executor never encrypts it. Art. 17 runs through the EXT_USER_DATA
+    // hook below instead (deletes the author's rows, or unlinks them on anonymize).
+    body: createTextField({
+      personal: false,
+      reason: "covered_by_user_data_hook",
+      maxLength: 4000,
+    }),
+  },
+});
+
+// Plain EntityTableMeta, NOT a branded EntityTable: store_notes is a deliberate
+// unmanaged direct-write store (r.storeTable below), so the forget hook may
+// updateMany/deleteMany it directly — the meta carries no executor-only brand.
+export const notesTable = deriveEntityTableMeta("note", noteEntity, { source: "unmanaged" });
+
+export const notesFeature = defineFeature("notes", (r) => {
+  r.requires("user-data-rights");
+  // store_notes is a direct-write store: the forget hook below `updateMany`/
+  // `deleteMany`s rows WITHOUT emitting lifecycle events. r.entity would make
+  // it a rebuildable implicit projection whose replay finds zero note events
+  // and wipes the table (or un-forgets anonymized rows) on the next rebuild
+  // (#498). r.storeTable keeps the DDL, opts out of implicit rebuild.
+  r.storeTable(notesTable, {
+    reason: "read_side.notes_direct_write",
+  });
+
+  const exportNotes: UserDataExportHook = async (ctx) => {
+    const rows = await selectMany(ctx.db, notesTable, {
+      tenantId: ctx.tenantId,
+      authorId: ctx.userId,
+    });
+    if (rows.length === 0) return null;
+    return {
+      entity: "note",
+      rows: rows.map((row) => ({
+        id: String(row.id),
+        title: row.title ?? "",
+        body: row.body ?? "",
+      })),
+    };
+  };
+
+  const deleteNotes: UserDataDeleteHook = async (ctx, strategy) => {
+    const where = { tenantId: ctx.tenantId, authorId: ctx.userId };
+    if (strategy === "anonymize") {
+      await updateMany(ctx.db, notesTable, { authorId: null }, where);
+    } else {
+      await deleteMany(ctx.db, notesTable, where);
+    }
+  };
+
+  r.useExtension(EXT_USER_DATA, "note", {
+    export: exportNotes,
+    delete: deleteNotes,
+  });
+});
+```

package/agents/examples/user-profile.md

@@ -0,0 +1,226 @@
+<!-- Generated by `bun run gen:agent-docs` from samples/recipes/user-profile. Do not edit. -->
+
+# user-profile
+
+user-profile bundled feature — Self-Service-Kontoseite (Passwort/E-Mail ändern, Konto löschen) als App-Screen verdrahten.
+
+## README
+
+# user-profile
+
+Self-service account page as a bundled feature: change password, change email
+(with re-auth + verification reset), and request or cancel account deletion
+(with grace period from `user-data-rights`).
+
+The bundled feature ships the `profile` screen itself (a declarative
+`projectionDetail`, fw#2312) plus handlers and i18n. **Your app** only points
+a nav entry at it and registers the two extension-section components
+(change-password, change-email — re-auth flows a declarative action can't
+express) — this recipe shows the wiring.
+
+## What it shows
+
+- **`user-profile:write:change-email`** — re-authenticated email change;
+  resets `emailVerified` until the user confirms the new address.
+- **`auth-email-password:write:change-password`** — used from the same
+  screen; lives on `auth-email-password`, not duplicated in user-profile.
+- **Account deletion** — `user-data-rights` handlers for request / cancel
+  deletion; grace period comes from the tenant's compliance profile.
+- **App-side nav wiring only** — `r.nav({ screen: "user-profile:screen:profile", ... })`;
+  no `r.screen()` registration needed, the bundled feature owns the screen.
+- **Full require chain** — `user` → `tenant` → `auth-email-password` →
+  `user-data-rights` (which pulls `data-retention`, `compliance-profiles`,
+  `sessions`). `composeAccountApp()` mounts everything boot needs.
+
+## Feature composition
+
+```
+user               → cross-tenant identity (email, roles, status)
+tenant             → memberships + tenant-scoped roles
+auth-email-password → login + change-password handlers
+data-retention     → retention policies (via user-data-rights)
+compliance-profiles → region profiles for grace periods
+sessions           → revocable JWTs (via user-data-rights chain)
+user-data-rights   → deletion request / export pipeline
+user-profile       → declarative `profile` screen + change-email handler
+account            → this recipe: nav wiring only
+```
+
+## Client wiring
+
+Register the two extension-section components once at app boot (the screen
+itself needs no client registration):
+
+```tsx illustration
+import { userProfileClient } from "@cosmicdrift/kumiko-bundled-features/user-profile/web";
+import { emailPasswordClient } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/web";
+import { createKumikoApp } from "@cosmicdrift/kumiko-renderer-web";
+
+createKumikoApp({
+  clientFeatures: [emailPasswordClient(), userProfileClient()],
+  // ... schema, nav from server features
+});
+```
+
+## Flow
+
+1. User opens the profile nav entry → renderer loads the declarative `profile`
+   screen.
+2. Password change dispatches `auth-email-password:write:change-password`.
+3. Email change dispatches `user-profile:write:change-email` (re-auth required).
+4. Delete account dispatches `user-data-rights:write:request-deletion`; cancel
+   uses the matching cancel handler during the grace window.
+
+## Tests
+
+Boot validation only — no DB/HTTP in this recipe (HTTP proof lives in the
+bundled-feature integration tests):
+
+```bash
+bun test src/__tests__/feature.test.ts
+```
+
+The test asserts `validateBoot(composeAccountApp())` passes, the profile
+screen/nav are registered, and the documented change-email qualified name
+matches `UserProfileHandlers.changeEmail`.
+
+## Related samples
+
+- [apex-surface-auth](/en/samples/recipes-apex-surface-auth/) — public login/
+  signup on the marketing apex (no admin nav).
+- [user-data-rights](/en/samples/recipes-user-data-rights/) — `EXT_USER_DATA`
+  hooks for export/forget on your domain entities.
+- [apps-user-data-rights-demo](/en/samples/apps-user-data-rights-demo/) —
+  full runnable app with todos + export ZIP.
+
+## Source files
+
+### src/__tests__/feature.test.ts
+
+```ts
+// Boot-Validation der vollen user-profile-Komposition: Require-Kette
+// erfüllt, Screen + Nav registriert, change-email-Handler unter der
+// dokumentierten QN. Kein DB/HTTP nötig — der HTTP-Beweis lebt im
+// bundled-feature-Test (change-email.integration.test.ts).
+
+import { describe, expect, test } from "bun:test";
+import { UserProfileHandlers } from "@cosmicdrift/kumiko-bundled-features/user-profile";
+import {
+  createRegistry,
+  validateBoot as validateBootRaw,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { withBootValidatorFixture } from "@cosmicdrift/kumiko-framework/testing";
+import { composeAccountApp } from "../feature";
+
+function validateBoot(features: Parameters<typeof validateBootRaw>[0]): void {
+  validateBootRaw(withBootValidatorFixture(features));
+}
+
+const features = composeAccountApp();
+
+describe("user-profile recipe — boot validation", () => {
+  test("validateBoot accepts the full composition (require chain satisfied)", () => {
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("profile screen + nav registered with qualified ids", () => {
+    const registry = createRegistry(features);
+    expect(registry.getScreen("user-profile:screen:profile")?.id).toBe(
+      "user-profile:screen:profile",
+    );
+  });
+
+  test("user-profile deklariert seine Require-Kette (Manifest-Quelle)", () => {
+    const userProfile = features.find((f) => f.name === "user-profile");
+    if (!userProfile) throw new Error("user-profile feature missing in composition");
+    expect(userProfile.requires).toEqual([
+      "user",
+      "auth-email-password",
+      "user-data-rights",
+      "user-data-rights-defaults",
+    ]);
+  });
+
+  test("change-email QN entspricht der dokumentierten Konstante", () => {
+    expect(UserProfileHandlers.changeEmail).toBe("user-profile:write:change-email");
+  });
+});
+```
+
+### src/feature.ts
+
+```ts
+// user-profile Recipe — shows the app-side wiring for the self-service
+// account page: the bundled feature ships the screen itself (fw#2312:
+// declarative `projectionDetail`, id "profile") including handler + i18n;
+// the app only has to navigate to it, no own `r.screen()` registration
+// anymore (unlike before #2312 — see user-data-rights' recipe/demo pattern:
+// `r.nav({ screen: "<feature>:screen:<id>", ... })`).
+//
+// Client-side, the app only registers the two extension-section components
+// (change-password/change-email stay React, re-auth):
+//   import { userProfileClient } from
+//     "@cosmicdrift/kumiko-bundled-features/user-profile/web";
+//   createKumikoApp({
+//     clientFeatures: [emailPasswordClient(), userProfileClient()],
+//   })
+
+import { createAuthEmailPasswordFeature } from "@cosmicdrift/kumiko-bundled-features/auth-email-password";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createComplianceProfilesFeature } from "@cosmicdrift/kumiko-bundled-features/compliance-profiles";
+import { createConfigFeature } from "@cosmicdrift/kumiko-bundled-features/config";
+import { createDataRetentionFeature } from "@cosmicdrift/kumiko-bundled-features/data-retention";
+import { createFilesFeature } from "@cosmicdrift/kumiko-bundled-features/files";
+import { createPersonalAccessTokensFeature } from "@cosmicdrift/kumiko-bundled-features/personal-access-tokens";
+import { createSessionsFeature } from "@cosmicdrift/kumiko-bundled-features/sessions";
+import { createTenantFeature } from "@cosmicdrift/kumiko-bundled-features/tenant";
+import { createUserFeature } from "@cosmicdrift/kumiko-bundled-features/user";
+import { createUserDataRightsFeature } from "@cosmicdrift/kumiko-bundled-features/user-data-rights";
+import { createUserDataRightsDefaultsFeature } from "@cosmicdrift/kumiko-bundled-features/user-data-rights-defaults";
+import { createUserProfileFeature } from "@cosmicdrift/kumiko-bundled-features/user-profile";
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+
+export function createAccountFeature(): FeatureDefinition {
+  return defineFeature("account", (r) => {
+    r.describe(
+      "App-side wiring for the user-profile bundled feature: just the nav " +
+        "entry — user-profile registers the `profile` screen itself " +
+        "(fw#2312 declarative projectionDetail).",
+    );
+    r.requires("user-profile");
+
+    r.nav({
+      id: "profile",
+      label: "account:nav.profile",
+      icon: "user",
+      screen: "user-profile:screen:profile",
+      order: 90,
+    });
+
+    return {};
+  });
+}
+
+/** Volle Feature-Komposition inkl. der user-profile-Require-Kette
+ *  (user-data-rights → data-retention + compliance-profiles + sessions). */
+export function composeAccountApp(): FeatureDefinition[] {
+  return [
+    createConfigFeature(),
+    createUserFeature(),
+    createTenantFeature(),
+    createAuthEmailPasswordFeature(),
+    createDataRetentionFeature(),
+    createComplianceProfilesFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
+    createSessionsFeature(),
+    createFilesFeature(),
+    createUserDataRightsFeature(),
+    // registers the default export/erase hooks for core PII entities (user,
+    // fileRef, folder) so the GDPR boot gate (V3) is satisfied for the stack.
+    createUserDataRightsDefaultsFeature(),
+    createUserProfileFeature(),
+    createAccountFeature(),
+  ];
+}
+```