@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/user-data-rights-defaults/hooks/delivery-attempt.userdata-hook.ts

@@ -0,0 +1,36 @@
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { deliveryAttemptsTable } from "../../delivery/index.js";
+import { featureMounted } from "./feature-mounted.js";
+
+// userData-Hooks for delivery's attempt log (deferred from #797, closed by
+// #799). deliveryAttempt is an events-only aggregate — the export reads the
+// projected rows; recipientAddress may be ciphertext (kumiko-pii:), which
+// the export runner's central decrypt sweep resolves to plaintext (or
+// [[erased]] after a forget).
+
+export const deliveryAttemptExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "delivery")) return null;
+  const rows = await ctx.db.selectMany(deliveryAttemptsTable, {
+    tenantId: ctx.tenantId,
+    recipientId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "delivery-attempt",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"],
+      channel: r["channel"],
+      status: r["status"],
+      recipientAddress: r["recipientAddress"],
+      priority: r["priority"],
+      createdAt: r["createdAt"],
+    })),
+  };
+};
+
+export const deliveryAttemptDeleteHook: UserDataDeleteHook = async () => {
+  // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
+  // erases the recipient's DEK, which makes recipientAddress unreadable in
+  // BOTH the append-only events and the projected rows (#799). A read-side
+  // UPDATE here would be wiped on the next projection rebuild anyway.
+};

package/packages/bundled-features/src/user-data-rights-defaults/hooks/feature-mounted.ts

@@ -0,0 +1,10 @@
+import type { UserDataHookCtx } from "@cosmicdrift/kumiko-framework/engine";
+
+// The defaults feature registers hooks for OPTIONAL source features
+// (optionalRequires). When the source isn't mounted its tables don't exist,
+// and the export runner has no try/catch around hooks — a query against a
+// missing table would kill the whole export job. Every gated hook must
+// early-return on this check before touching the source's tables.
+export function featureMounted(ctx: UserDataHookCtx, featureName: string): boolean {
+  return ctx.registry.getFeature(featureName) !== undefined;
+}

package/packages/bundled-features/src/user-data-rights-defaults/hooks/file-ref.userdata-hook.ts

@@ -0,0 +1,280 @@
+import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
+import {
+  createSystemUser,
+  type FieldDefinition,
+  type Registry,
+  type SessionUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+  type UserDataHookCtx,
+  type UserDataStorageProvider,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
+
+const ERROR_CONTEXT = "user-data-rights-defaults:fileRef";
+
+// Forget writes go through the executor (events), not deleteMany/updateMany:
+// a projection rebuild replays the events, so the erasure survives. Eventless
+// writes are wiped/resurrected on rebuild — the Art.17 hole this fixes. Bounded:
+// per-user forget flows are rare, so per-row events are acceptable.
+const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
+
+// userData-Hook fuer fileRef-entity (S2.H2).
+//
+// Export-Hook liefert Metadata aller FileRefs des Users mit Subject-
+// Resolver via insertedById. Storage-Provider-binary-Streams kommen
+// NICHT direkt — sie werden via signed-Download-URLs separat ins ZIP
+// gepackt (S2.U3 Export-Job-Pipeline orchestriert das).
+//
+// Delete-hook removes the fileRef row + binary:
+//   "delete":    storageProvider.delete() per file + row hard-delete — but
+//                ONLY for rows whose field is marked as PII of the person
+//                (isPersonalFileRow, #3005). All other rows (business/
+//                tenant data, no resolvable field, no annotation) go
+//                through severPersonLink instead, even when the entity
+//                strategy is "delete" — the uploader axis (insertedById) is
+//                not the subject axis.
+//   "anonymize": insertedById=null, row + binary survive (FK refs can still
+//                point at it; person-link removed) — applies to ALL rows
+//                when a retention override on fileRef (anonymize or
+//                blockDelete, e.g. a statutory retention duty) sets the
+//                strategy, regardless of the field.
+//
+// **Provider-Resolution:** der Provider kommt zur Lauf-Zeit aus
+// `ctx.buildStorageProvider(ctx.tenantId)` — der Forget-Orchestrator
+// (run-forget-cleanup) baut ihn aus dem gemounteten file-foundation, also aus
+// DEMSELBEN Store den Upload + Export nutzen (delete-target == upload-target by
+// construction). Kein bei-Mount captured Provider mehr.
+//
+// **Zwei Fehlerklassen, bewusst verschieden behandelt:**
+//   1. Resolution schlaegt fehl (kein Provider konfiguriert / configResolver
+//      fehlt) → NICHT fail-closed: Warn pro Aufruf + row-only-delete. Ein
+//      fehlkonfigurierter Store darf die Art.-17-Loeschung nicht DAUERHAFT
+//      blockieren (sonst haengt jeder User fuer immer in DeletionRequested);
+//      der Boot-Guard macht die Fehlkonfiguration sichtbar, Binaries werden
+//      nachgeholt sobald ein Provider existiert.
+//   2. Binary-DELETE schlaegt fehl, OBWOHL ein Provider da ist → FAIL-CLOSED:
+//      der Hook wirft NACH dem Loop, die per-User-Sub-Tx von runForgetCleanup
+//      rollt zurueck, der User bleibt DeletionRequested, der naechste Run
+//      retried (delete ist idempotent → konvergiert). Den Fehler zu schlucken +
+//      die Row trotzdem zu loeschen wuerde Erasure als "done" markieren waehrend
+//      die Bytes liegen bleiben — falsche Compliance-Aussage. Das "KEIN globaler
+//      Rollback" der Sprint-2-Atomicity bleibt gewahrt: nur DIESE Sub-Tx rollt
+//      zurueck. Der anonymize-Pfad behaelt Row+binary, hat nichts zu schlucken.
+//
+// Caveat: hard-delete via deleteMany emittiert KEIN fileRef.deleted —
+// die storage-tracking-MSP dekrementiert nicht. Wenn die zu loeschenden
+// Files vorher nicht soft-deleted waren, bleibt `tenant_storage_usage`
+// inflated. Forget-Flows sind selten (per-User-Art.-17) und damit
+// bounded; ein executor.purge-API folgt mit dem trashed-files-GC.
+
+export const fileRefExportHook: UserDataExportHook = async (ctx) => {
+  // isDeleted:false — soft-deleted (trashed) Files gehören nicht ins
+  // Auskunfts-Bundle. Forget (delete-Hook unten) erfasst sie trotzdem.
+  const rawRows = await ctx.db.selectMany(fileRefsTable, {
+    tenantId: ctx.tenantId,
+    insertedById: ctx.userId,
+    isDeleted: false,
+  });
+
+  // @cast-boundary db-row: drizzle liefert insertedAt als Instant
+  // (framework-customType). Fuer JSON-Export brauchen wir String —
+  // .toString() funktioniert sowohl auf Temporal.Instant als auch
+  // Date.
+  const rows = rawRows.map((r) => {
+    const row = r as Record<string, unknown>; // @cast-boundary recursive-walk
+    return {
+      id: String(row["id"]),
+      storageKey: String(row["storageKey"]),
+      fileName: String(row["fileName"]),
+      mimeType: String(row["mimeType"]),
+      size: typeof row["size"] === "number" ? row["size"] : 0,
+      insertedAt: String(row["insertedAt"] ?? ""),
+    };
+  });
+
+  if (rows.length === 0) return null;
+
+  return {
+    entity: "fileRef",
+    rows: rows.map((r) => ({
+      id: r.id,
+      fileName: r.fileName,
+      mimeType: r.mimeType,
+      size: r.size,
+      insertedAt: r.insertedAt,
+    })),
+    // Plus die fileRefs-Liste die Sprint-2-U3 dann zum Storage-Provider
+    // bringt + signed-URLs erzeugt + ins ZIP packt (siehe S1.9-Z1
+    // UserDataExportSnippet.fileRefs).
+    fileRefs: rows.map((r) => ({
+      fileRefId: r.id,
+      storageKey: r.storageKey,
+      fileName: r.fileName,
+    })),
+  };
+};
+
+// Resolve the per-tenant provider the forget orchestrator injected. A
+// resolution failure (no provider configured / configResolver absent) collapses
+// to `undefined` so the hook degrades to a row-only delete instead of throwing —
+// see error-class 1 in the header. A working-provider binary-delete failure is
+// handled separately (fail-closed) below.
+async function resolveProvider(ctx: UserDataHookCtx): Promise<UserDataStorageProvider | undefined> {
+  if (!ctx.buildStorageProvider) return undefined;
+  try {
+    return await ctx.buildStorageProvider(ctx.tenantId);
+  } catch {
+    // skip: provider unresolvable (not configured) → fall through to row-only
+    // delete; the warn below gives operator visibility, boot guard catches it.
+    return undefined;
+  }
+}
+
+// Per-row Art.17 decision (kumiko-framework#3005): whether THIS file's field
+// carries personal data of the forgotten person, or is business/tenant data
+// that merely loses its uploader-attribution. insertedById names who
+// UPLOADED the file, not whose data it is — a dealer's vehicle photo
+// uploaded by an employee is the dealer's business data, not the employee's
+// PII. The field's own personal-annotation decides:
+//   - pii / userOwned / recordOwned → the field's content IS personal data
+//     of a person (self, owner-referenced, or the record's own subject) →
+//     hard-delete path.
+//   - anything else (explicit `personal: false`, `tenantOwned`,
+//     `subjectRef`, or no annotation at all) → not personal-to-a-person
+//     content → sever the uploader link only, keep row + binary.
+function isPersonalPiiField(field: FieldDefinition | undefined): boolean {
+  if (!field) return false;
+  return (
+    ("pii" in field && field.pii === true) ||
+    ("userOwned" in field && field.userOwned !== undefined) ||
+    ("recordOwned" in field && field.recordOwned === true)
+  );
+}
+
+// Three cases the field-lookup itself can't resolve (issue #3005's rule for
+// the non-resolvable cases):
+//   1. Unattached upload (entityType/fieldName both null) → hard-delete: a
+//      file with no entity binding belongs to nobody but its uploader.
+//   2. Field exists but carries no PII annotation → anonymize (the
+//      conservative path); the boot-validator warns on a PII-typical field
+//      name so this stays visible and quiet-fixable via `personal`.
+//   3. Entity or field not resolvable (upload hardening in file-routes.ts
+//      should prevent this from ever being written; theoretical remainder
+//      only) → anonymize, never a silent hard-delete.
+function isPersonalFileRow(registry: Registry, row: Record<string, unknown>): boolean {
+  const entityType = row["entityType"]; // @cast-boundary db-row
+  const fieldName = row["fieldName"]; // @cast-boundary db-row
+  if (entityType === null && fieldName === null) return true;
+  if (typeof entityType !== "string" || typeof fieldName !== "string") return false;
+  const fieldDef = registry.getEntity(entityType)?.fields[fieldName];
+  return isPersonalPiiField(fieldDef);
+}
+
+// Delete every row's binary (original + any derivatives) via the provider.
+// Returns the keys whose delete threw — the caller fails closed on a
+// non-empty list so the sub-tx rolls back and the next forget run retries
+// (delete is idempotent → converges). Derivative-listing + per-key delete
+// lives in the shared derivatives helper (also used by data-retention's
+// hardDelete cleanup) so this hook no longer carries its own copy.
+async function deleteBinaries(
+  rows: readonly Record<string, unknown>[],
+  provider: UserDataStorageProvider,
+): Promise<readonly string[]> {
+  const failedKeys: string[] = [];
+  for (const row of rows) {
+    const key = row["storageKey"]; // @cast-boundary db-row
+    if (typeof key !== "string" || key.length === 0) continue;
+    failedKeys.push(...(await deleteStoredFileAndDerivatives(key, provider, ERROR_CONTEXT)));
+  }
+  return failedKeys;
+}
+
+// Null the person-link on every row via the executor (event → rebuild-safe).
+// tdb: the executor needs a TenantDb (loadById → db.fetchOne), not the raw
+// ctx.db runner.
+async function severPersonLink(
+  tdb: TenantDb,
+  systemUser: SessionUser,
+  rows: readonly Record<string, unknown>[],
+): Promise<void> {
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.update({ id, changes: { insertedById: null } }, systemUser, tdb, {
+      skipOptimisticLock: true,
+    });
+  }
+}
+
+export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
+  const systemUser = createSystemUser(ctx.tenantId);
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(fileRefsTable, {
+    tenantId: ctx.tenantId,
+    insertedById: ctx.userId,
+  });
+
+  if (strategy !== "delete") {
+    // Only reachable via an explicit retention override on fileRef:
+    // policyToStrategy maps anonymize and blockDelete to "anonymize", typically
+    // for a statutory retention duty (Art. 17(3)(b) GDPR, HGB/AO). Row and
+    // binary must survive, so only the uploader link is severed. Applies to
+    // ALL rows because the override replaces the per-field decision below,
+    // which only runs for strategy="delete".
+    await severPersonLink(ctx.db, systemUser, rows);
+    // skip: anonymize is complete — the hard-delete path below runs only for strategy "delete".
+    return;
+  }
+
+  // strategy="delete" decides PER ROW based on the field, not uniformly
+  // (#3005): only rows whose field is marked as PII of the person (or
+  // unattached, see isPersonalFileRow) take the hard path. Everything else
+  // only loses the uploader link.
+  const personalRows: Record<string, unknown>[] = [];
+  const businessRows: Record<string, unknown>[] = [];
+  for (const row of rows) {
+    (isPersonalFileRow(ctx.registry, row) ? personalRows : businessRows).push(row);
+  }
+
+  if (businessRows.length > 0) {
+    await severPersonLink(ctx.db, systemUser, businessRows);
+  }
+
+  // skip: nothing left to hard-delete — businessRows above already had their person link severed via severPersonLink.
+  if (personalRows.length === 0) return;
+
+  const storageProvider = await resolveProvider(ctx);
+  if (storageProvider) {
+    const failedKeys = await deleteBinaries(personalRows, storageProvider);
+    if (failedKeys.length > 0) {
+      throw new InternalError({
+        message: `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
+      });
+    }
+  } else {
+    // No warn-once guard: a forget-cleanup cron runs rarely enough (not a hot
+    // path) that logging every occurrence is fine, and an operator who fixes the
+    // provider config mid-process sees the warning stop on the very next run —
+    // a module-level "warned once" flag would silence it for the rest of the
+    // process even after the misconfiguration is corrected.
+    // biome-ignore lint/suspicious/noConsole: misconfiguration visibility — disk-leak in forget-flow
+    console.warn(
+      "[user-data-rights-defaults:fileRef] no file provider resolvable from ctx.buildStorageProvider — file binaries are NOT deleted on forget (row-only delete). Mount file-foundation + a file-provider-* feature and set the provider config so erasure can reach the binaries.",
+    );
+  }
+  // Hard-purge each row via the executor forget-verb: emits fileRef.forgotten,
+  // which hard-deletes the row even though fileRef is softDelete — and, being an
+  // auto-verb, the erasure replays on rebuild (created → forgotten → row gone).
+  // The old hard deleteMany was resurrected on rebuild; this closes that Art.17
+  // hole without a direct write.
+  const failures: string[] = [];
+  for (const row of personalRows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "fileRef", id, failures);
+  }
+  throwIfErasureFailed(failures);
+};

package/packages/bundled-features/src/user-data-rights-defaults/hooks/in-app-message.userdata-hook.ts

@@ -0,0 +1,37 @@
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { inAppMessagesTable } from "../../channel-in-app/index.js";
+import { featureMounted } from "./feature-mounted.js";
+
+// userData-Hooks for channel-in-app's in_app_messages. Plain SQL table (no
+// r.entity, no event stream — see channel-in-app/tables.ts), written by
+// direct INSERT in the channel adapter, so a direct DELETE is rebuild-safe.
+// Messages are addressed TO the user (title/body can quote personal content);
+// both strategies hard-delete.
+//
+// This table has no entity fields, so the V3 pii-annotation boot guard cannot
+// see it — coverage lives solely in these hooks.
+
+export const inAppMessageExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "channel-in-app")) return null;
+  const rows = await ctx.db.selectMany(inAppMessagesTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "in-app-message",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"] ?? null,
+      title: r["title"] ?? null,
+      body: r["body"] ?? null,
+      isRead: r["isRead"] ?? false,
+      createdAt: String(r["createdAt"] ?? ""),
+    })),
+  };
+};
+
+export const inAppMessageDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: channel-in-app not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "channel-in-app")) return;
+  await ctx.db.deleteMany(inAppMessagesTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};

package/packages/bundled-features/src/user-data-rights-defaults/hooks/job-run.userdata-hook.ts

@@ -0,0 +1,34 @@
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { jobRunsTable } from "../../jobs/index.js";
+import { featureMounted } from "./feature-mounted.js";
+
+// userData-Hooks for the jobs run log (deferred from #797, closed by #799).
+// Job runs live on the SYSTEM tenant regardless of who triggered them, so
+// the export filters by triggeredById only — Art. 15 covers everything the
+// user caused, across tenants. payload may be ciphertext (kumiko-pii:); the
+// export runner's central decrypt sweep resolves it.
+
+export const jobRunExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "jobs")) return null;
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(jobRunsTable, {
+    triggeredById: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "job-run",
+    rows: rows.map((r) => ({
+      jobName: r["jobName"],
+      status: r["status"],
+      payload: r["payload"],
+      startedAt: r["startedAt"],
+      finishedAt: r["finishedAt"],
+    })),
+  };
+};
+
+export const jobRunDeleteHook: UserDataDeleteHook = async () => {
+  // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
+  // erases the triggering user's DEK, which makes the payload unreadable in
+  // BOTH the append-only events and the projected rows (#799). triggeredById
+  // itself is a pseudonymous fk (plaintext by design, like config.userId).
+};

package/packages/bundled-features/src/user-data-rights-defaults/hooks/notification-preference.userdata-hook.ts

@@ -0,0 +1,63 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  notificationPreferenceEntity,
+  notificationPreferencesTable,
+} from "../../delivery/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
+import { featureMounted } from "./feature-mounted.js";
+
+// userData-Hooks for delivery's notification-preference rows. Event-sourced
+// entity → forget goes through the executor so a rebuild replays the erasure.
+// A preference without its user is meaningless, so both strategies purge via
+// the forget verb.
+//
+// The delivery ATTEMPTS log is covered separately: export via
+// delivery-attempt.userdata-hook.ts, erasure via crypto-shredding (#799).
+
+const crud = createEventStoreExecutor(notificationPreferencesTable, notificationPreferenceEntity, {
+  entityName: "notification-preference",
+});
+
+export const notificationPreferenceExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "delivery")) return null;
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(notificationPreferencesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "notification-preference",
+    rows: rows.map((r) => ({
+      notificationType: r["notificationType"],
+      channel: r["channel"],
+      enabled: r["enabled"],
+    })),
+  };
+};
+
+export const notificationPreferenceDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: delivery not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "delivery")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(notificationPreferencesTable, {
+    tenantId: ctx.tenantId,
+    userId: ctx.userId,
+  });
+  const failures: string[] = [];
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    collectErasureFailure(
+      await crud.forget({ id }, systemUser, ctx.db),
+      "notification-preference",
+      id,
+      failures,
+    );
+  }
+  throwIfErasureFailed(failures);
+};

package/packages/bundled-features/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -0,0 +1,144 @@
+import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+  type UserDataHookCtx,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  collectErasureFailure,
+  decryptStoredPii,
+  mapWithConcurrency,
+  throwIfErasureFailed,
+} from "../../shared/index.js";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/index.js";
+import { userTable } from "../../user/index.js";
+import { featureMounted } from "./feature-mounted.js";
+
+// userData-Hooks for tenant-invitation rows. Event-sourced entity → all
+// forget writes go through the executor so a projection rebuild replays the
+// erasure (a direct write would be wiped — the Art.17 hole the user/fileRef
+// hooks already close).
+//
+// Two subject paths in one hook:
+//   invitee — rows whose `email` is the user's email. delete → executor
+//             forget (row purged); anonymize → email pseudonymized.
+//   inviter — rows whose `invitedBy` is the user. The row belongs to the
+//             invitee, so both strategies only sever the person-link
+//             (invitedBy → pseudonym; the field is required, null not
+//             allowed).
+//
+// Email source: on forget the user hook may already have anonymized the
+// user row, so ctx.userEmailBeforeDelete (captured by runForgetCleanup
+// before the transaction) takes precedence over a live lookup.
+
+const crud = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, {
+  entityName: "tenant-invitation",
+});
+
+const INVITED_BY_ANONYMIZED = "anonymized";
+
+// Bounded, not Promise.all — each decrypt hits the KMS adapter's own small
+// dedicated pool (PgKmsAdapter default max: 4). Same reasoning as
+// tenant/handlers/invitations.query.ts's KMS_POOL_CONCURRENCY.
+const KMS_POOL_CONCURRENCY = 4;
+
+async function resolveUserEmail(ctx: UserDataHookCtx): Promise<string | null> {
+  if (ctx.userEmailBeforeDelete) return ctx.userEmailBeforeDelete.toLowerCase();
+  const row = (await ctx.db.fetchOne(userTable, { id: ctx.userId })) as {
+    email: string;
+  } | null; // @cast-boundary db-runner
+  if (!row) return null;
+  // Stored value is ciphertext with an active KMS; lowercasing a base64
+  // blob would break both lookup arms — decrypt first.
+  const email = await decryptStoredPii(row.email, "email", "user-data-rights:invitation-hook");
+  return email.toLowerCase();
+}
+
+export const tenantInvitationExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "tenant")) return null;
+  const email = await resolveUserEmail(ctx);
+  if (!email) return null;
+  // Invitation emails are lowercase-normalized on insert, so an exact match
+  // is a case-insensitive match.
+  const rows = await ctx.db.selectMany<Record<string, unknown>>(tenantInvitationsTable, {
+    tenantId: ctx.tenantId,
+    email,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "tenant-invitation",
+    // Stored `email` is subject-KMS ciphertext (pii:true, not field-encrypted).
+    // decryptSnippetFields only sweeps collectEncryptedFieldNames — it would
+    // leave this as a base64 blob in the GDPR export. Decrypt here, same as
+    // invitations.query.ts and resolveUserEmail above.
+    rows: await mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, async (r) => {
+      const rawEmail = r["email"];
+      const decryptedEmail =
+        typeof rawEmail === "string"
+          ? await decryptStoredPii(rawEmail, "email", "user-data-rights:invitation-hook")
+          : rawEmail;
+      return {
+        email: decryptedEmail,
+        role: r["role"],
+        status: r["status"],
+        expiresAt: String(r["expiresAt"] ?? ""),
+      };
+    }),
+  };
+};
+
+export const tenantInvitationDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
+  // skip: tenant not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "tenant")) return;
+  const systemUser = createSystemUser(ctx.tenantId);
+  const failures: string[] = [];
+
+  const email = await resolveUserEmail(ctx);
+  if (email) {
+    const inviteeRows = await ctx.db.selectMany<Record<string, unknown>>(tenantInvitationsTable, {
+      tenantId: ctx.tenantId,
+      email,
+    });
+    for (const row of inviteeRows) {
+      const id = row["id"]; // @cast-boundary db-row
+      if (typeof id !== "string") continue;
+      if (strategy === "delete") {
+        collectErasureFailure(
+          await crud.forget({ id }, systemUser, ctx.db),
+          "tenant-invitation",
+          id,
+          failures,
+        );
+      } else {
+        // Row-id in the pseudonym keeps the (tenantId, email) unique index
+        // collision-free when a user has invitations in several states.
+        await crud.update(
+          { id, changes: { email: `forgotten-${id}@anonymized.invalid` } },
+          systemUser,
+          ctx.db,
+          { skipOptimisticLock: true },
+        );
+      }
+    }
+  }
+
+  // `invitedBy` is `lookupable` — the query compiler matches the plaintext
+  // filter value against the generated blind-index column
+  // (`invitedByBidx`), so this selects only this user's own invites-sent
+  // without loading + decrypting every invitation in the tenant. See
+  // tenant/handlers/invitations.query.ts for the same lookupable-filter
+  // pattern on `email`.
+  const inviterRows = await ctx.db.selectMany<Record<string, unknown>>(tenantInvitationsTable, {
+    tenantId: ctx.tenantId,
+    invitedBy: ctx.userId,
+  });
+  for (const row of inviterRows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.update({ id, changes: { invitedBy: INVITED_BY_ANONYMIZED } }, systemUser, ctx.db, {
+      skipOptimisticLock: true,
+    });
+  }
+  throwIfErasureFailed(failures);
+};

package/packages/bundled-features/src/user-data-rights-defaults/hooks/user-session.userdata-hook.ts

@@ -0,0 +1,41 @@
+import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { userSessionTable } from "../../sessions/index.js";
+import { featureMounted } from "./feature-mounted.js";
+
+// userData-Hooks for the sessions feature's user-session rows (ip, userAgent).
+//
+// user-session is an unmanaged direct-write store (no event stream, excluded
+// from projection rebuilds — see sessions/feature.ts #494/#498), so a direct
+// DELETE is legal here and survives rebuilds; the executor path the ES
+// entities use does not apply.
+//
+// Both forget strategies hard-delete: a session row without its user is
+// worthless (revocation audit trail loses its subject), and ip/userAgent are
+// pure PII with no shared-data value to preserve via anonymization.
+
+export const userSessionExportHook: UserDataExportHook = async (ctx) => {
+  if (!featureMounted(ctx, "sessions")) return null;
+  const rows = await ctx.db.selectMany(userSessionTable, {
+    userId: ctx.userId,
+    tenantId: ctx.tenantId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "user-session",
+    // sid (row id) stays out of the bundle — it is the JWT jti and
+    // token-shaped, not portable personal data.
+    rows: rows.map((r) => ({
+      createdAt: String(r["createdAt"] ?? ""),
+      expiresAt: String(r["expiresAt"] ?? ""),
+      revokedAt: r["revokedAt"] ? String(r["revokedAt"]) : null,
+      ip: r["ip"] ?? null,
+      userAgent: r["userAgent"] ?? null,
+    })),
+  };
+};
+
+export const userSessionDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: sessions not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "sessions")) return;
+  await ctx.db.deleteMany(userSessionTable, { userId: ctx.userId, tenantId: ctx.tenantId });
+};