@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/user-data-rights/web/privacy-center-screen.tsx

@@ -0,0 +1,185 @@
+// @runtime client
+// Export section (Art. 20) — the one part of user-data-rights' privacy-center
+// screen that stays custom (fw#2312). Registered as an EditExtensionSection
+// component (see web/client-plugin.tsx); the projectionDetail screen
+// (feature.ts) supplies the surrounding Section chrome (title, testId), so
+// this component renders only its own body content.
+//
+// Export needs async-job polling (worker-Lane-Cron, ~1 Min) plus a
+// signed-URL download — logic a declarative field/action can't express.
+// Restriction (Art. 18) and Deletion (Art. 17) moved onto the screen's
+// declarative fields/actions instead (feature.ts).
+
+import {
+  useDispatcher,
+  usePrimitives,
+  useQuery,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
+import { postWithDownload } from "@cosmicdrift/kumiko-renderer-web";
+import { type ReactNode, useEffect, useState } from "react";
+import {
+  EXPORT_JOB_STATUS,
+  type ExportJobStatus,
+  UserDataRightsHandlers,
+  UserDataRightsQueries,
+} from "../constants.js";
+
+// Export-Job läuft async (worker-Lane-Cron, ~1 Min). Solange er pending/running
+// ist, pollt der Screen den Status, damit der Download ohne manuellen Reload
+// erscheint.
+const EXPORT_POLL_MS = 4000;
+
+type ExportJob = {
+  readonly id: string;
+  readonly status: ExportJobStatus;
+  readonly expiresAt?: string | null;
+  readonly errorMessage?: string | null;
+};
+type ExportStatusResult =
+  | { readonly hasJob: false }
+  | { readonly hasJob: true; readonly job: ExportJob };
+
+type SectionStatus =
+  | { kind: "idle" }
+  | { kind: "submitting" }
+  | { kind: "success"; messageKey: string }
+  | { kind: "error"; messageKey: string };
+
+// Dispatcher-Failures tragen i18nKey nur wenn der Handler einen setzt —
+// Boundary-Read mit generischem Fallback.
+function failureKey(error: unknown): string {
+  const key = (error as { i18nKey?: unknown } | null)?.i18nKey; // @cast-boundary dispatcher-error
+  return typeof key === "string" ? key : "userDataRights.privacyCenter.errors.generic";
+}
+
+// Roher ISO-Instant → nur der Datums-Teil ist relevant; reiner String-Slice,
+// kein Date-API (no-date-api-Guard) und universell. Leer/null → "—".
+export function formatDate(iso: string | null | undefined): string {
+  if (!iso) return "—";
+  const tIndex = iso.indexOf("T");
+  return tIndex > 0 ? iso.slice(0, tIndex) : iso;
+}
+
+function StatusBanner({ status }: { readonly status: SectionStatus }): ReactNode {
+  const t = useTranslation();
+  const { Banner } = usePrimitives();
+  if (status.kind === "success") {
+    return <Banner variant="info">{t(status.messageKey)}</Banner>;
+  }
+  if (status.kind === "error") {
+    return <Banner variant="error">{t(status.messageKey)}</Banner>;
+  }
+  return null;
+}
+
+// Mounted by the renderer's ExtensionSectionMount (already wrapped in
+// <Section title={...} testId="section-extension-...">) — takes no props of
+// its own, ExtensionSectionProps (entityName/entityId/...) are unused since
+// export status/actions are scoped to the current user session, not to a
+// host entity row.
+export function ExportSection(): ReactNode {
+  const t = useTranslation();
+  const { Button, Banner } = usePrimitives();
+  const dispatcher = useDispatcher();
+  const statusQuery = useQuery<ExportStatusResult | null>(UserDataRightsQueries.exportStatus, {});
+  const [status, setStatus] = useState<SectionStatus>({ kind: "idle" });
+
+  const request = async (): Promise<void> => {
+    setStatus({ kind: "submitting" });
+    const res = await dispatcher.write(UserDataRightsHandlers.requestExport, {});
+    if (!res.isSuccess) {
+      setStatus({ kind: "error", messageKey: failureKey(res.error) });
+      return;
+    }
+    setStatus({ kind: "idle" });
+    void statusQuery.refetch?.();
+  };
+
+  // Download laeuft ueber den Dispatcher (traegt X-CSRF-Token) statt ueber
+  // eine <a>-Navigation: download-by-job liefert eine signed URL zurueck, auf
+  // die postWithDownload den Browser navigiert (content-disposition:
+  // attachment → laedt herunter).
+  const downloadExport = async (jobId: string): Promise<void> => {
+    const err = await postWithDownload(dispatcher, UserDataRightsQueries.downloadByJob, { jobId });
+    if (err) setStatus({ kind: "error", messageKey: failureKey(err) });
+  };
+
+  const result = statusQuery.data;
+  const job = result?.hasJob ? result.job : null;
+  const submitting = status.kind === "submitting";
+  const inProgress =
+    job?.status === EXPORT_JOB_STATUS.Pending || job?.status === EXPORT_JOB_STATUS.Running;
+  const done = job?.status === EXPORT_JOB_STATUS.Done;
+  const failed = job?.status === EXPORT_JOB_STATUS.Failed;
+
+  // While the job is running: poll until Done/Failed, then auto-stop.
+  const refetch = statusQuery.refetch;
+  // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
+  useEffect(() => {
+    if (!inProgress || !refetch) return;
+    const id = setInterval(() => void refetch(), EXPORT_POLL_MS);
+    return () => clearInterval(id);
+  }, [inProgress, refetch]);
+
+  return (
+    <>
+      <p className="text-sm text-muted-foreground">
+        {t("userDataRights.privacyCenter.export.intro")}
+      </p>
+      {statusQuery.error && (
+        <Banner variant="error">{t("userDataRights.privacyCenter.errors.generic")}</Banner>
+      )}
+      {inProgress && (
+        <Banner variant="info" testId="privacy-export-pending">
+          {t("userDataRights.privacyCenter.export.pending")}
+        </Banner>
+      )}
+      {failed && (
+        <Banner variant="error" testId="privacy-export-failed">
+          {t("userDataRights.privacyCenter.export.failed")}
+        </Banner>
+      )}
+      {done && job && (
+        <Banner variant="info" testId="privacy-export-ready">
+          <p className="font-medium text-foreground">
+            {t("userDataRights.privacyCenter.export.ready")}
+          </p>
+          {job.expiresAt && (
+            <p className="mt-1">
+              {t("userDataRights.privacyCenter.export.availableUntil", {
+                date: formatDate(job.expiresAt),
+              })}
+            </p>
+          )}
+          <div className="mt-2">
+            <Button
+              variant="secondary"
+              onClick={() => void downloadExport(job.id)}
+              testId="privacy-export-download"
+            >
+              {t("userDataRights.privacyCenter.export.download")}
+            </Button>
+          </div>
+        </Banner>
+      )}
+      {!inProgress && (
+        <div className="mt-2">
+          <Button
+            onClick={() => void request()}
+            disabled={submitting}
+            loading={submitting}
+            testId="privacy-export-request"
+          >
+            {done
+              ? t("userDataRights.privacyCenter.export.requestNew")
+              : submitting
+                ? t("userDataRights.privacyCenter.export.requesting")
+                : t("userDataRights.privacyCenter.export.request")}
+          </Button>
+        </div>
+      )}
+      <StatusBanner status={status} />
+    </>
+  );
+}

package/packages/bundled-features/src/user-data-rights/web/public-deletion-gate.tsx

@@ -0,0 +1,42 @@
+// @runtime client
+// Public-Gate für die anonyme Account-Löschung. Matcht window.location.pathname:
+// requestPath → RequestAccountDeletionScreen, confirmPath →
+// ConfirmAccountDeletionScreen, sonst durch zur App. Spiegelt makeAuthGate
+// (auth-email-password) — userDataRightsClient hängt es als Gate ein, die App
+// listet den Client VOR dem Auth-Client, damit ein anonymer Besucher die Lösch-
+// Maske statt der Login-Maske sieht. Path-Match beim Render: Apex-Übergänge
+// (der Verify-Link) sind Full-Page-Loads, kein Client-Router.
+//
+// confirmPath MUSS dem Pfad der server-seitigen deletionVerifyUrl entsprechen —
+// der ConfirmScreen liest das ?token aus eben dieser URL.
+
+import type { ComponentType, ReactNode } from "react";
+import { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.js";
+import { RequestAccountDeletionScreen } from "./request-deletion-screen.js";
+
+export type PublicDeletionRoutes = {
+  /** Login-freie Route für die Email-Antrags-Maske (z.B. "/account/delete"). */
+  readonly requestPath: string;
+  /** Login-freie Route für die Token-Bestätigung; = Pfad der deletionVerifyUrl. */
+  readonly confirmPath: string;
+  /** Chrome um die Screen-Card. Default: vollflächig zentriert (wie der Auth-
+   *  defaultShell). Apps reichen ihre eigene Shell (z.B. Marketing-Header). */
+  readonly shell?: (screen: ReactNode) => ReactNode;
+};
+
+const centeredShell = (screen: ReactNode): ReactNode => (
+  <div className="min-h-screen flex items-center justify-center bg-background px-4">{screen}</div>
+);
+
+export function makePublicDeletionGate(
+  routes: PublicDeletionRoutes,
+): ComponentType<{ children: ReactNode }> {
+  const shell = routes.shell ?? centeredShell;
+  function PublicDeletionGate({ children }: { readonly children: ReactNode }): ReactNode {
+    const path = window.location.pathname;
+    if (path === routes.requestPath) return shell(<RequestAccountDeletionScreen />);
+    if (path === routes.confirmPath) return shell(<ConfirmAccountDeletionScreen />);
+    return <>{children}</>;
+  }
+  return PublicDeletionGate;
+}

package/packages/bundled-features/src/user-data-rights/web/request-deletion-screen.tsx

@@ -0,0 +1,104 @@
+// @runtime client
+// RequestAccountDeletionScreen — anonymer Apex-Screen Schritt 1. Email-Form
+// → user-data-rights:write:request-deletion-by-email. Enumeration-safe: zeigt
+// unconditional ein "Falls Account existiert, Mail unterwegs"-Confirm, auch
+// wenn der Server intern erkannt hat dass die Email nicht existiert.
+//
+// App mountet den Screen unter einer Apex-Route (z.B. /delete-account) via
+// createPublicSurface; die Page-Shell liefert die Chrome.
+
+import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { type FormEvent, type ReactNode, useState } from "react";
+
+const REQUEST_BY_EMAIL = "user-data-rights:write:request-deletion-by-email";
+
+export type RequestAccountDeletionScreenProps = {
+  readonly title?: string;
+};
+
+export function RequestAccountDeletionScreen({
+  title,
+}: RequestAccountDeletionScreenProps): ReactNode {
+  const t = useTranslation();
+  const dispatcher = useDispatcher();
+  const { Form, Field, Input, Button, Banner, Card } = usePrimitives();
+  const [email, setEmail] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  const [done, setDone] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const doSubmit = async (): Promise<void> => {
+    setSubmitting(true);
+    setError(null);
+    try {
+      const res = await dispatcher.write(REQUEST_BY_EMAIL, { email });
+      if (res.isSuccess) {
+        setDone(true);
+      } else {
+        setError(t("userDataRights.deletion.request.error"));
+      }
+    } catch {
+      setError(t("userDataRights.deletion.request.error"));
+    } finally {
+      setSubmitting(false);
+    }
+  };
+
+  const onSubmit = (e?: FormEvent): void => {
+    e?.preventDefault();
+    void doSubmit();
+  };
+
+  return (
+    <Card
+      // kumiko-lint-ignore primitives-discipline narrow centered confirmation card, not a screen container
+      className="w-full max-w-sm mx-auto"
+      options={{ padded: false }}
+      slots={{
+        header: (
+          <div className="flex flex-col space-y-1.5 p-6 pb-4">
+            <h1 className="text-xl font-semibold tracking-tight">
+              {title ?? t("userDataRights.deletion.request.title")}
+            </h1>
+          </div>
+        ),
+      }}
+    >
+      {done ? (
+        <div className="p-6 pt-0">
+          <Banner variant="info">
+            <p className="font-medium text-foreground">
+              {t("userDataRights.deletion.request.successTitle")}
+            </p>
+            <p className="mt-1">{t("userDataRights.deletion.request.successBody")}</p>
+          </Banner>
+        </div>
+      ) : (
+        <div className="p-6 pt-0 flex flex-col gap-4">
+          <p className="text-sm text-muted-foreground">
+            {t("userDataRights.deletion.request.intro")}
+          </p>
+          <Form onSubmit={onSubmit}>
+            <Field id="delete-email" label={t("userDataRights.deletion.request.email")} required>
+              <Input
+                kind="text"
+                id="delete-email"
+                name="delete-email"
+                value={email}
+                onChange={setEmail}
+                disabled={submitting}
+                required
+              />
+            </Field>
+            {error !== null && <Banner variant="error">{error}</Banner>}
+            <Button type="submit" loading={submitting} disabled={submitting}>
+              {submitting
+                ? t("userDataRights.deletion.request.submitting")
+                : t("userDataRights.deletion.request.submit")}
+            </Button>
+          </Form>
+        </div>
+      )}
+    </Card>
+  );
+}

package/packages/bundled-features/src/user-data-rights/zip-path.ts

@@ -0,0 +1,94 @@
+// Shared helper fuer ZIP-Path-Berechnung von fileRefs (S2.U3 Atom 3c).
+//
+// Das Bundle hat zwei Sichten auf die selben fileRefs:
+//   1. bundle.json: Eine flat-Liste mit `zipPath` pro fileRef. Reader-
+//      Tools koennen so JSON ↔ files/-Pfade verlinken.
+//   2. ZIP-Entries: Bytes liegen unter genau diesen `zipPath`-Schluesseln.
+//
+// Damit beide Sichten NICHT auseinander driften, lebt die Pfad-Berechnung
+// EXAKT EINMAL hier. run-user-export befuellt zipPath im fileRef-Item,
+// run-export-jobs's bundleToZipEntries nutzt dieselben Pfade als Entry-
+// Keys.
+
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+
+/**
+ * Maximale Laenge des sanitized fileName (ohne Extension). Realistic
+ * Filenames sind <50, 100 ist eine sichere Grenze fuer ZIP-Kompatibilitaet
+ * (PKWARE-spec keine harte limit, aber viele Reader haengen bei extrem
+ * langen Namen).
+ */
+const MAX_SANITIZED_BASENAME_LENGTH = 100;
+
+/**
+ * Erlaubte Filename-Chars: alphanumerisch, dot, dash, underscore. Alles
+ * andere wird zu underscore replaced. Path-Separator (`/`, `\`),
+ * relative-traversal (`..`), und null-bytes sind insbesondere ausgeschlossen.
+ */
+const FILENAME_SAFE_CHARS = /[^a-zA-Z0-9._-]/g;
+
+/**
+ * Sanitize einen vom User-Input stammenden fileName fuer Verwendung als
+ * ZIP-internal-path-Suffix. Defense gegen:
+ *   - Path-Traversal:  "../../etc/passwd" → "file.etc_passwd"
+ *   - Null-Bytes:      "report\x00.pdf"   → "report_.pdf"
+ *   - Path-Separator:  "sub/dir/file.txt" → "sub_dir_file.txt"
+ *   - Reserved-Names:  "." / ".." / "..."  → "file"
+ *   - Empty input:     "" / null / undef   → "unnamed"
+ *   - Ueberlange:      lange Strings auf MAX_SANITIZED_BASENAME_LENGTH gekappt
+ *                      (Extension bleibt erhalten falls vorhanden)
+ *   - Unicode:         non-ASCII → underscore. Leading-strip kann auch dazu
+ *                      fuehren dass alle-Unicode-Names zu "file" werden.
+ *
+ * Output ist garantiert: nicht leer, kein Path-Separator, max-len enforced,
+ * keine `..`-Sequenz im finalen String.
+ */
+export function sanitizeZipFilename(raw: string): string {
+  if (raw === undefined || raw === null || raw === "") return "unnamed";
+
+  // Extension extrahieren (letzte ".X" wo X kein "." enthaelt).
+  const lastDot = raw.lastIndexOf(".");
+  const hasExt = lastDot > 0 && lastDot < raw.length - 1;
+  const baseName = hasExt ? raw.slice(0, lastDot) : raw;
+  const extension = hasExt ? raw.slice(lastDot + 1) : "";
+
+  const safeBase = collapseUnsafe(baseName).slice(0, MAX_SANITIZED_BASENAME_LENGTH);
+  const safeExt = collapseUnsafe(extension).slice(0, 20);
+
+  // Empty oder all-underscores → "file" als reproduzierbarer Fallback.
+  const finalBase = safeBase.length === 0 ? "file" : safeBase;
+
+  return safeExt.length > 0 ? `${finalBase}.${safeExt}` : finalBase;
+}
+
+/**
+ * 3-step Sanitize:
+ *   1. Replace alles ausser [a-zA-Z0-9._-] mit "_"
+ *   2. Collapse `..` (oder mehr) → "_" — verhindert dass `..` nach
+ *      Sanitize uebrig bleibt (z.B. wenn input nur dots+slashes ist).
+ *   3. Strip leading [._-]+ — verhindert hidden-file-Patterns + leere
+ *      Basenames + leading-segments die nach den ersten zwei Steps
+ *      lauter underscores haetten.
+ */
+function collapseUnsafe(s: string): string {
+  let out = s.replace(FILENAME_SAFE_CHARS, "_");
+  out = out.replace(/\.{2,}/g, "_");
+  out = out.replace(/^[._-]+/, "");
+  return out;
+}
+
+/**
+ * Berechnet den ZIP-internal-Pfad fuer einen fileRef. Layout:
+ *   files/<tenantId>/<fileRefId>-<sanitized-fileName>
+ *
+ * tenantId + fileRefId sind UUID-shape (sicher); fileName geht durch
+ * sanitizeZipFilename. Garantiert kein path-traversal.
+ */
+export function buildFileRefZipPath(args: {
+  readonly tenantId: TenantId;
+  readonly fileRefId: string;
+  readonly fileName: string;
+}): string {
+  const safeName = sanitizeZipFilename(args.fileName);
+  return `files/${args.tenantId}/${args.fileRefId}-${safeName}`;
+}

package/packages/bundled-features/src/user-data-rights-defaults/changes.json

@@ -0,0 +1,13 @@
+[
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Delete hooks erase every row and report all failures together"
+  },
+  {
+    "version": "0.116.0",
+    "type": "fix",
+    "title": "user-data-rights-defaults now registers EXT_USER_DATA export/delete hooks for six more bu…",
+    "detail": "user-data-rights-defaults now registers EXT_USER_DATA export/delete hooks for six more bundled entities: user-session (ip/userAgent), api-token, in-app-message, tenant-invitation, notification-preference and user-scoped config-value. Hooks no-op when the source feature isn't mounted. pii annotations added on the affected schema fields. - @cosmicdrift/kumiko-renderer-web@0.116.0 - @cosmicdrift/kumiko-framework@0.116.0 - @cosmicdrift/kumiko-dispatcher-live@0.116.0 - @cosmicdrift/kumiko-headless@0.116.0 - @cosmicdrift/kumiko-renderer@0.116.0"
+  }
+]

package/packages/bundled-features/src/user-data-rights-defaults/feature.ts

@@ -0,0 +1,136 @@
+import {
+  defineFeature,
+  EXT_USER_DATA,
+  type FeatureDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook.js";
+import {
+  configValueDeleteHook,
+  configValueExportHook,
+} from "./hooks/config-value.userdata-hook.js";
+import {
+  deliveryAttemptDeleteHook,
+  deliveryAttemptExportHook,
+} from "./hooks/delivery-attempt.userdata-hook.js";
+import { fileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook.js";
+import {
+  inAppMessageDeleteHook,
+  inAppMessageExportHook,
+} from "./hooks/in-app-message.userdata-hook.js";
+import { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook.js";
+import {
+  notificationPreferenceDeleteHook,
+  notificationPreferenceExportHook,
+} from "./hooks/notification-preference.userdata-hook.js";
+import {
+  tenantInvitationDeleteHook,
+  tenantInvitationExportHook,
+} from "./hooks/tenant-invitation.userdata-hook.js";
+import { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook.js";
+import {
+  userSessionDeleteHook,
+  userSessionExportHook,
+} from "./hooks/user-session.userdata-hook.js";
+
+// user-data-rights-defaults — Default-Hooks für die Core-Entities
+// `user` (S2.H1) und `fileRef` (S2.H2).
+//
+// Architektur-Entscheidung (S2.H1+H2): user-data-rights selbst kann
+// nicht r.requires("user", "files") + r.useExtension(EXT_USER_DATA, ...)
+// machen weil es selbst Provider von EXT_USER_DATA ist (Boot-Validator
+// lehnt self-extension ab). Lösung: drittes optional-mountbares Feature
+// das requires beide Sources + die useExtension-Calls macht.
+//
+// App-Author kann dieses Feature weglassen wenn er Custom-Hooks
+// stattdessen registrieren will (z.B. "anonymize sollte den User-Row
+// hard-delete" — App-spezifische Compliance-Entscheidung). Default-
+// Implementierung deckt 95% der Apps ab.
+//
+// Pattern matched file-foundation + file-provider-s3 (separate Plugin-
+// Feature), nicht user/files schreiben ihre eigenen Hooks selbst weil
+// das circular-requires waere.
+// Binary storage for the fileRef delete-hook is resolved at run time from the
+// mounted file-foundation via ctx.buildStorageProvider (injected by the forget
+// orchestrator) — no provider is captured here, so a single app-wide store and
+// per-tenant stores both work, and forget deletes from the same store upload +
+// export use. See hooks/file-ref.userdata-hook.ts.
+export function createUserDataRightsDefaultsFeature(): FeatureDefinition {
+  return defineFeature("user-data-rights-defaults", (r) => {
+    r.describe(
+      "Registers ready-made `EXT_USER_DATA` export and delete hooks for the bundled entities that hold per-user data: `user` (delete strategy sets email to `deleted-<id>@anonymized.invalid`, nulls `passwordHash`, sets status to `Deleted`; anonymize strategy sets email to `anonymized-<id>@anonymized.invalid` without touching `passwordHash`), `fileRef` (delete removes both the DB row and the storage binary), plus — gated on the source feature being mounted — `user-session` (ip/userAgent, hard-delete), `api-token` (hard-delete = revoke), `in-app-message` (hard-delete), `tenant-invitation` (invitee email forgotten/pseudonymized, inviter link severed), `notification-preference` and user-scoped `config-value` (purged via the forget verb), plus export-only hooks for the events-only aggregates `delivery-attempt` (recipientAddress) and `job-run` (payload) whose erasure runs via crypto-shredding. Mount this alongside `user-data-rights` for standard GDPR compliance; omit it only if your app needs custom anonymization logic for these entities.",
+    );
+    r.uiHints({
+      displayLabel: "User Data Rights · Default Hooks",
+      category: "compliance",
+      recommended: false,
+    });
+    r.requires("user", "files", "user-data-rights");
+    // Optional sources: hooks are registered unconditionally but each one
+    // no-ops at runtime when its source feature isn't mounted (see
+    // hooks/feature-mounted.ts) — the export runner has no per-hook
+    // try/catch, so a query against a missing table would kill the job.
+    r.optionalRequires(
+      "sessions",
+      "personal-access-tokens",
+      "channel-in-app",
+      "tenant",
+      "delivery",
+      "config",
+      "jobs",
+    );
+
+    r.useExtension(EXT_USER_DATA, "user", {
+      export: userExportHook,
+      delete: userDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "fileRef", {
+      export: fileRefExportHook,
+      delete: fileRefDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "user-session", {
+      export: userSessionExportHook,
+      delete: userSessionDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "api-token", {
+      export: apiTokenExportHook,
+      delete: apiTokenDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "in-app-message", {
+      export: inAppMessageExportHook,
+      delete: inAppMessageDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "tenant-invitation", {
+      export: tenantInvitationExportHook,
+      delete: tenantInvitationDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "notification-preference", {
+      export: notificationPreferenceExportHook,
+      delete: notificationPreferenceDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "config-value", {
+      export: configValueExportHook,
+      delete: configValueDeleteHook,
+    });
+
+    // Events-only aggregates (#799): export reads the projected rows, the
+    // delete hooks are deliberate no-ops — erasure happens via crypto-
+    // shredding (forget erases the user's DEK; recipientAddress / job
+    // payload become unreadable in events AND rows).
+    r.useExtension(EXT_USER_DATA, "delivery-attempt", {
+      export: deliveryAttemptExportHook,
+      delete: deliveryAttemptDeleteHook,
+    });
+
+    r.useExtension(EXT_USER_DATA, "job-run", {
+      export: jobRunExportHook,
+      delete: jobRunDeleteHook,
+    });
+  });
+}

package/packages/bundled-features/src/user-data-rights-defaults/hooks/api-token.userdata-hook.ts

@@ -0,0 +1,36 @@
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { apiTokenTable } from "../../personal-access-tokens/index.js";
+import { featureMounted } from "./feature-mounted.js";
+
+// userData-Hooks for personal-access-tokens rows. Same shape as user-session:
+// unmanaged direct-write store (no event stream, rebuild-safe DELETE), and a
+// token without its user is worthless — both strategies hard-delete. Deleting
+// the row also revokes the token (the resolver point-reads this table), which
+// is the correct outcome for a forgotten user.
+
+export const apiTokenExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "personal-access-tokens")) return null;
+  const rows = await ctx.db.selectMany(apiTokenTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "api-token",
+    // tokenHash stays out of the bundle — secret-derived, not personal data.
+    rows: rows.map((r) => ({
+      name: r["name"] ?? null,
+      prefix: r["prefix"] ?? null,
+      scopes: r["scopes"] ?? null,
+      createdAt: String(r["createdAt"] ?? ""),
+      expiresAt: r["expiresAt"] ? String(r["expiresAt"]) : null,
+      revokedAt: r["revokedAt"] ? String(r["revokedAt"]) : null,
+    })),
+  };
+};
+
+export const apiTokenDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: personal-access-tokens not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "personal-access-tokens")) return;
+  await ctx.db.deleteMany(apiTokenTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};

package/packages/bundled-features/src/user-data-rights-defaults/hooks/config-value.userdata-hook.ts

@@ -0,0 +1,57 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { configValueEntity, configValuesTable } from "../../config/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
+import { featureMounted } from "./feature-mounted.js";
+
+// userData-Hooks for config's USER-scoped rows (userId set). Tenant-/system-
+// scope rows carry no per-user subject and stay untouched. Event-sourced
+// entity → forget goes through the executor (rebuild replays the erasure).
+// A user-scoped setting without its user is meaningless — both strategies
+// purge via the forget verb, which also erases encrypted value blobs.
+
+const crud = createEventStoreExecutor(configValuesTable, configValueEntity, {
+  entityName: "config-value",
+});
+
+export const configValueExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "config")) return null;
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(configValuesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "config-value",
+    // value may be an encrypted blob — exported as stored; decryption is the
+    // config resolver's concern and secret-backed values don't belong in the
+    // bundle in plaintext.
+    rows: rows.map((r) => ({ key: r["key"], value: r["value"] })),
+  };
+};
+
+export const configValueDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: config not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "config")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(configValuesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  const failures: string[] = [];
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    collectErasureFailure(
+      await crud.forget({ id }, systemUser, ctx.db),
+      "config-value",
+      id,
+      failures,
+    );
+  }
+  throwIfErasureFailed(failures);
+};