@cosmicdrift/kumiko-samples 0.361.0 → 0.363.0

package/packages/bundled-features/src/user/handlers/detail.query.ts

@@ -3,6 +3,7 @@ import {
   defineEntityDetailHandler,
   type HandlerContext,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { userEntity } from "../schema/user.js";
 import { attachTenantLabels, dbForList } from "./list.query.js";
 
@@ -24,12 +25,9 @@ export const detailQuery = {
     ctx: HandlerContext,
   ) => {
     const result = await baseDetail.handler?.(query, ctx);
-    if (result === null || typeof result !== "object") return result;
+    if (!isPlainObject(result)) return result;
     if (!ctx.registry.features.has("tenant")) return result;
-    const [enriched] = await attachTenantLabels(
-      [result as Record<string, unknown>],
-      dbForList(ctx),
-    );
+    const [enriched] = await attachTenantLabels([result], dbForList(ctx));
     return enriched ?? result;
   },
 };

package/packages/bundled-features/src/user/roles-input-schema.ts

@@ -8,8 +8,8 @@ export const rolesInputSchema = z.union([
   z.string().transform((raw, ctx) => {
     try {
       const parsed: unknown = JSON.parse(raw);
-      if (Array.isArray(parsed) && parsed.every((v) => typeof v === "string")) {
-        return parsed as string[];
+      if (Array.isArray(parsed) && parsed.every((v): v is string => typeof v === "string")) {
+        return parsed;
       }
     } catch {
       /* fall through */

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "GDPR default mails are r.notification declarations, render*Email is gone",
+    "detail": "export-ready, export-failed, deletion-requested and deletion-executed are declared as trigger-less notifications (user-data-rights:notify:<name>) with variables and localized templates built from the GDPR translations, so a tenant can override the text. The default export-ready, export-failed and deletion-requested mails send through ctx.notify to the user (export mails with immediate so the plain magic-link token never lands in a job payload). deletion-executed renders the seeded template through the mail renderer and sends over the tenant mail transport without a delivery log, because the user is already gone. App-provided send*Email callbacks still win. The defaults now need delivery with channel-email; a boot warning is logged once when mail-foundation and a mail transport are mounted without them. New exports are GdprMailNotificationTypes, gdprMailLocalizedTemplate, gdprMailTemplateLocale, registerGdprMails and formatGdprMailTimestamp.",
+    "migration": "renderExportReadyEmail, renderExportFailedEmail, renderDeletionRequestedEmail, renderDeletionExecutedEmail and RenderedEmail are removed from user-data-rights/email-templates; the translations stay. An app that mounts it without includeBundled needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html at boot (composeRendererStack() from dev-server mounts all of them), plus a delivery with the channel-email feature; apps without the template tables need a schema migration (`kumiko schema generate`). Delivery preferences that referenced the mails use the new user-data-rights:notify:<name> types."
+  },
+  {
+    "version": "0.362.0",
+    "type": "fix",
+    "title": "download-attempt.ip and userAgent are encrypted personal data instead of plaintext",
+    "detail": "download-attempt.ip and userAgent are declared personal: { of: \"attemptedByUserId\", whenAbsent: \"tenant\" }, ip with find \"exact\" and userAgent with find \"none\". With a KMS configured, rows written by the logged-in job path are encrypted under the requesting user's key (a user forget makes IP and user agent unreadable), rows from the anonymous token path under the tenant key. The new ip_bidx column keeps the equality filter of list-download-attempts working across both kinds of rows, and the query now returns the decrypted values (an erased user's values come back as the erased sentinel). user-data-rights-defaults registers an EXT_USER_DATA hook for download-attempt: export lists the user's own attempts, delete purges the user's own attempts via the forget verb (projection row and blind index included, replayed on rebuild); owner-less token-path rows expire with the 90d hardDelete retention.",
+    "migration": "Apps that mount user-data-rights run kumiko-schema generate and apply: the migration adds the ip_bidx column and its index to read_download_attempts. Apps that mount user-data-rights without user-data-rights-defaults must register their own EXT_USER_DATA hook for the download-attempt entity, otherwise boot fails the PII hook coverage check. The annotation fingerprint of the boot PII backfill changes, so the first boot after the bump does one full pass: it encrypts existing download-attempt events (tenant key or user key) and rebuilds the projection including ip_bidx (KUMIKO_SKIP_PII_BACKFILL=1 turns it off)."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/user-data-rights/db/queries/forget-cleanup.ts

@@ -1,10 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 
 export async function selectUsersDueForForgetCleanup(
-  db: DbConnection,
+  db: DbRunner,
   status: string,
   gracePeriodEndCutoff: Temporal.Instant | string,
 ): Promise<readonly { id: string }[]> {

package/packages/bundled-features/src/user-data-rights/email-templates.ts

@@ -1,10 +1,10 @@
-// Default HTML renderers for GDPR notification mails. English ships here;
-// other languages register via @cosmicdrift/kumiko-locale-* (localeDe() /
+// Translations for the GDPR notification mails (the templates in
+// mail-notifications.ts are built from them). English ships here; other
+// languages register via @cosmicdrift/kumiko-locale-* (localeDe() /
 // localeEs() call registerMailTranslations). Apps that want their own
 // branding pass send*Email callbacks and these defaults do not run.
 
-import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 
 export type GdprMailLocale = string;
@@ -41,151 +41,7 @@ export const GDPR_MAIL_EN: Readonly<Record<string, string>> = {
 
 registerMailTranslations("en", GDPR_MAIL_EN);
 
-export type RenderedEmail = {
-  readonly subject: string;
-  readonly html: string;
-  readonly text: string;
-};
-
-export type RenderExportReadyEmailArgs = {
-  readonly downloadUrl: string;
-  readonly expiresAt: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderExportFailedEmailArgs = {
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderDeletionRequestedEmailArgs = {
-  readonly gracePeriodEnd: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-export type RenderDeletionExecutedEmailArgs = {
-  readonly executedAt: string;
-  readonly locale?: GdprMailLocale;
-  readonly appName?: string;
-};
-
-function t(locale: string, key: string, params?: Readonly<Record<string, string>>): string {
-  return mailT(locale, key, params);
-}
-
-function appNameFor(args: { locale?: GdprMailLocale; appName?: string }): string {
-  const locale = args.locale ?? "en";
-  return args.appName ?? t(locale, "gdpr.mail.appNameDefault");
-}
-
-export function renderExportReadyEmail(args: RenderExportReadyEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const subject = t(locale, "gdpr.mail.exportReady.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0 0 24px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportReady.intro", { app }))}</p>
-    <p style="margin: 0 0 24px;">${renderButton({ url: args.downloadUrl, label: t(locale, "gdpr.mail.exportReady.button") })}</p>
-    <p style="margin: 0 0 8px; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }))}</p>
-    ${renderFallbackUrl({ url: args.downloadUrl, label: t(locale, "gdpr.mail.fallbackUrl") })}`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.exportReady.intro", { app }),
-    `${t(locale, "gdpr.mail.exportReady.button")}: ${args.downloadUrl}`,
-    t(locale, "gdpr.mail.exportReady.expiry", { when: formatTimestamp(args.expiresAt) }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderExportFailedEmail(args: RenderExportFailedEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const subject = t(locale, "gdpr.mail.exportFailed.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.exportFailed.intro", { app }))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.exportFailed.intro", { app }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderDeletionRequestedEmail(
-  args: RenderDeletionRequestedEmailArgs,
-): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const when = formatTimestamp(args.gracePeriodEnd);
-  const subject = t(locale, "gdpr.mail.deletionRequested.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0 0 16px; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.intro", { app, when }))}</p>
-    <p style="margin: 0; font-size: 13px; color: #555;">${escapeHtml(t(locale, "gdpr.mail.deletionRequested.cancel"))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.deletionRequested.intro", { app, when }),
-    t(locale, "gdpr.mail.deletionRequested.cancel"),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-export function renderDeletionExecutedEmail(args: RenderDeletionExecutedEmailArgs): RenderedEmail {
-  const locale = args.locale ?? "en";
-  const app = appNameFor(args);
-  const when = formatTimestamp(args.executedAt);
-  const subject = t(locale, "gdpr.mail.deletionExecuted.subject", { app });
-  const body = `
-    <p style="margin: 0 0 16px; font-size: 16px;">${escapeHtml(t(locale, "gdpr.mail.greeting"))}</p>
-    <p style="margin: 0; font-size: 14px; line-height: 1.5;">${escapeHtml(t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }))}</p>`;
-  const text = plainTextBody([
-    t(locale, "gdpr.mail.greeting"),
-    t(locale, "gdpr.mail.deletionExecuted.intro", { app, when }),
-  ]);
-  return { subject, html: renderShell({ title: subject, bodyHtml: wrapCell(body), locale }), text };
-}
-
-function plainTextBody(paragraphs: readonly string[]): string {
-  return paragraphs.join("\n\n");
-}
-
-function wrapCell(bodyHtml: string): string {
-  return `<tr><td>${bodyHtml}</td></tr>`;
-}
-
-function renderShell(args: { title: string; bodyHtml: string; locale: GdprMailLocale }): string {
-  return `<!DOCTYPE html>
-<html lang="${escapeHtmlAttr(args.locale)}">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>${escapeHtml(args.title)}</title>
-  </head>
-  <body style="margin: 0; padding: 0; background: #f7f7f7; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; color: #1a1a1a;">
-    <table width="100%" cellpadding="0" cellspacing="0" style="padding: 24px 0;">
-      <tr>
-        <td align="center">
-          <table width="560" cellpadding="0" cellspacing="0" style="max-width: 560px; background: #ffffff; border-radius: 8px; padding: 32px;">
-            ${args.bodyHtml}
-          </table>
-        </td>
-      </tr>
-    </table>
-  </body>
-</html>`;
-}
-
-function renderButton(args: { url: string; label: string }): string {
-  return `<a href="${escapeHtmlAttr(args.url)}" style="display: inline-block; background: #1a1a1a; color: #ffffff; padding: 12px 24px; border-radius: 6px; text-decoration: none; font-weight: 500;">${escapeHtml(args.label)}</a>`;
-}
-
-function renderFallbackUrl(args: { url: string; label: string }): string {
-  return `<p style="margin: 24px 0 0; font-size: 12px; color: #666;">${escapeHtml(args.label)}<br /><a href="${escapeHtmlAttr(args.url)}" style="color: #1a1a1a; word-break: break-all;">${escapeHtml(args.url)}</a></p>`;
-}
-
-function formatTimestamp(iso: string): string {
+export function formatGdprMailTimestamp(iso: string): string {
   try {
     const z = Temporal.Instant.from(iso).toZonedDateTimeISO("UTC");
     return `${z.year}-${pad2(z.month)}-${pad2(z.day)} ${pad2(z.hour)}:${pad2(z.minute)} UTC`;

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -2,16 +2,21 @@
 import { UNKNOWN_CLIENT_IP } from "@cosmicdrift/kumiko-framework/api";
 import {
   createSystemConfig,
+  createSystemUser,
   defineFeature,
   EXT_USER_DATA,
   type FeatureDefinition,
   i18nKey,
   SYSTEM_USER_ID,
+  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import {
   createMetricsHandle,
   createNoopMetricsHandle,
 } from "@cosmicdrift/kumiko-framework/observability";
+import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { createConfigAccessor } from "../config/index.js";
 import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks.js";
 import {
   EXPORT_SECTION_EXTENSION_NAME,
@@ -45,6 +50,8 @@ import { createRunForgetCleanupHandler } from "./handlers/run-forget-cleanup.wri
 import { USER_DATA_RIGHTS_I18N } from "./i18n.js";
 import {
   type GdprMailDefaults,
+  isGdprMailDeliveryAvailable,
+  isMailRendererAvailable,
   isMailTransportAvailable,
   makeDefaultDeletionExecutedEmail,
   makeDefaultExportFailedEmail,
@@ -53,6 +60,7 @@ import {
 import { makeTenantMailTransportResolver } from "./lib/mail-transport-resolver.js";
 import { resolveAppTenantModel } from "./lib/resolve-tenant-model.js";
 import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver.js";
+import { registerGdprMails } from "./mail-notifications.js";
 import {
   EXPORT_CLEANUP_BACKLOG_AGE_METRIC,
   EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC,
@@ -163,11 +171,22 @@ export type UserDataRightsOptions = {
   readonly privacyCenterShowDeletion?: boolean;
 };
 
+function isMailTransportMountedWithoutDelivery(features: readonly FeatureDefinition[]): boolean {
+  const names = new Set(features.map((feature) => feature.name));
+  const hasTransport = [...names].some((name) => name.startsWith("mail-transport-"));
+  return (
+    names.has("mail-foundation") &&
+    hasTransport &&
+    !(names.has("delivery") && names.has("channel-email"))
+  );
+}
+
 export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): FeatureDefinition {
   // One-shot operator warning (the export cron fires daily — warn once per
   // process, not every run). Lives in the factory scope so the cron closure
   // shares it across runs.
   let warnedMissingExportUrl = false;
+  let warnedMissingMailDelivery = false;
   const showDeletion = opts.privacyCenterShowDeletion ?? true;
   return defineFeature("user-data-rights", (r) => {
     r.describe(
@@ -197,7 +216,15 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // EXT_USER_DATA channel owner: any r.useExtension(EXT_USER_DATA, ...)
     // usage already requires user-data-rights to be mounted.
     r.bootCheck(({ features }) => validateGdprHookCompleteness(features));
-    r.bootCheck(({ features }) => validateGdprPiiHookCoverage(features));
+    r.bootCheck(({ features }) => {
+      validateGdprPiiHookCoverage(features);
+      if (!warnedMissingMailDelivery && isMailTransportMountedWithoutDelivery(features)) {
+        warnedMissingMailDelivery = true;
+        createFallbackLogger("user-data-rights").warn(
+          "mail-foundation and a mail transport are mounted but delivery/channel-email are not — the default export and deletion-request mails need them and will not be sent",
+        );
+      }
+    });
 
     // App-level tenant-occupancy model. Default "multi-user" → tenant-scoped
     // contributors (e.g. credit) NEVER erase tenant data on a per-user forget
@@ -312,6 +339,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     });
 
     r.translations({ keys: USER_DATA_RIGHTS_I18N });
+    registerGdprMails(r);
     // Privacy-center dot-form labels (i18nKey()-marked below), duplicated in
     // web/i18n.ts's client bundle since privacy-center-screen.tsx renders
     // them client-side.
@@ -520,10 +548,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       handler: async (c, { app, clientIp }) => {
         const url = new URL(c.req.url);
         const parsedBody = await c.req.json().catch(() => null);
-        const token =
-          parsedBody && typeof parsedBody === "object" && "token" in parsedBody
-            ? (parsedBody as { token?: unknown }).token
-            : undefined;
+        const token = isPlainObject(parsedBody) ? parsedBody["token"] : undefined;
         if (typeof token !== "string" || token.length === 0) {
           return c.json({ error: "missing_token" }, 400);
         }
@@ -605,28 +630,25 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
         // versendet der Cron die Export-Notifications selbst (Default-Templates).
         // Der Resolver baut den per-Tenant-Transport aus configResolver — gleiche
         // Bruecke wie buildStorageProvider.
-        const exportMailResolver = isMailTransportAvailable(exportRegistry)
-          ? makeTenantMailTransportResolver({
-              registry: exportRegistry,
-              configResolver: ctx.configResolver,
-              secrets: ctx.secrets,
-              db: exportDb,
-              userId: exportUserId,
-              handlerName: "user-data-rights:run-export-jobs",
-            })
-          : undefined;
+        // The cron runs across tenants: each mail needs a notify bound to the
+        // recipient's tenant (template override, channel config).
+        const notifyFactory = ctx._notifyFactory;
+        const exportNotifyFor =
+          notifyFactory !== undefined && isGdprMailDeliveryAvailable(exportRegistry)
+            ? (tenantId: TenantId) => notifyFactory(createSystemUser(tenantId), tenantId)
+            : undefined;
         const sendExportReadyEmail =
           opts.sendExportReadyEmail ??
-          (exportMailResolver && opts.appExportDownloadUrl !== undefined
-            ? makeDefaultExportReadyEmail(exportMailResolver, opts.mailDefaults)
+          (exportNotifyFor && opts.appExportDownloadUrl !== undefined
+            ? makeDefaultExportReadyEmail(exportNotifyFor, opts.mailDefaults)
             : undefined);
         const sendExportFailedEmail =
           opts.sendExportFailedEmail ??
-          (exportMailResolver
-            ? makeDefaultExportFailedEmail(exportMailResolver, opts.mailDefaults)
+          (exportNotifyFor
+            ? makeDefaultExportFailedEmail(exportNotifyFor, opts.mailDefaults)
             : undefined);
         if (
-          exportMailResolver &&
+          exportNotifyFor &&
           !opts.sendExportReadyEmail &&
           opts.appExportDownloadUrl === undefined &&
           !warnedMissingExportUrl
@@ -634,7 +656,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           warnedMissingExportUrl = true;
           // biome-ignore lint/suspicious/noConsole: one-shot operator visibility for misconfig
           console.warn(
-            "[user-data-rights:run-export-jobs] mail transport mounted but appExportDownloadUrl unset — default export-ready emails disabled (export-failed + deletion mails still send)",
+            "[user-data-rights:run-export-jobs] mail delivery mounted but appExportDownloadUrl unset — default export-ready emails disabled (export-failed + deletion mails still send)",
           );
         }
 
@@ -697,22 +719,37 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
           userId: forgetUserId,
         });
 
-        // C6 — Default-Mail beim delete-flip wenn kein Callback gesetzt + ein
-        // mail-transport gemountet ist (gleiche per-Tenant-Bruecke wie Export).
-        const forgetMailResolver = isMailTransportAvailable(forgetRegistry)
-          ? makeTenantMailTransportResolver({
-              registry: forgetRegistry,
-              configResolver: ctx.configResolver,
-              secrets: ctx.secrets,
-              db: forgetDb,
-              userId: forgetUserId,
-              handlerName: "user-data-rights:run-forget-cleanup",
-            })
-          : undefined;
+        // Without an app callback the default mail goes out when a mail transport and a
+        // mail renderer are mounted. The user is already erased here, so it bypasses the
+        // delivery log: an attempt row would be new personal data.
+        const forgetConfigResolver = ctx.configResolver;
         const sendDeletionExecutedEmail =
           opts.sendDeletionExecutedEmail ??
-          (forgetMailResolver
-            ? makeDefaultDeletionExecutedEmail(forgetMailResolver, opts.mailDefaults)
+          (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+            ? makeDefaultDeletionExecutedEmail(
+                {
+                  registry: forgetRegistry,
+                  db: forgetDb,
+                  resolveTransport: makeTenantMailTransportResolver({
+                    registry: forgetRegistry,
+                    configResolver: forgetConfigResolver,
+                    secrets: ctx.secrets,
+                    db: forgetDb,
+                    userId: forgetUserId,
+                    handlerName: "user-data-rights:run-forget-cleanup",
+                  }),
+                  configFor: (tenantId) =>
+                    forgetConfigResolver &&
+                    createConfigAccessor(
+                      forgetRegistry,
+                      forgetConfigResolver,
+                      tenantId,
+                      forgetUserId,
+                      forgetDb,
+                    ),
+                },
+                opts.mailDefaults,
+              )
             : undefined);
 
         const forgetResult = await runForgetCleanup({

package/packages/bundled-features/src/user-data-rights/handlers/cancel-deletion.write.ts

@@ -71,12 +71,13 @@ export const cancelDeletionWrite = defineWriteHandler({
 
     // gracePeriodEnd=null im Response symmetrisch zu request-deletion's
     // ISO-Timestamp — Frontend kann beide Endpoints uniform behandeln.
+    const gracePeriodEnd: string | null = null;
     return {
       isSuccess: true as const,
       data: {
         userId: event.user.id,
         status: USER_STATUS.Active,
-        gracePeriodEnd: null as string | null,
+        gracePeriodEnd,
       },
     };
   },

package/packages/bundled-features/src/user-data-rights/handlers/download-by-token.query.ts

@@ -76,7 +76,11 @@ export const downloadByTokenQuery = defineQueryHandler({
       })
       .optional(),
   }),
-  access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
+  // public-intake: rejected attempts store the anonymous caller's IP in the audit row.
+  access: {
+    roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"],
+    personalData: "public-intake",
+  },
   agent: { expose: false },
   // Brute-Force-Schutz fuer Token-Hash-Probing. Anonymous-Endpoint mit
   // 32-byte-Random-Token = 256 Bit Search-Space, aber rate-limit als

package/packages/bundled-features/src/user-data-rights/handlers/list-download-attempts.query.ts

@@ -2,12 +2,14 @@ import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
+import { decryptStoredPii } from "../../shared/index.js";
 import { downloadAttemptsTable } from "../schema/download-attempt.js";
 
 // Operator-Query: invalid Download-Attempts (S2.U7).
 // DPO-Sicht fuer Brute-Force-Detection. Tenant-isolated via WHERE.
 
 const MAX_LIMIT = 100;
+const REQUEST_ID = "user-data-rights:list-download-attempts";
 
 export const listDownloadAttemptsQuery = defineQueryHandler({
   name: "list-download-attempts",
@@ -44,6 +46,16 @@ export const listDownloadAttemptsQuery = defineQueryHandler({
       limit: p.limit,
     });
 
-    return { rows };
+    const decryptedRows = await Promise.all(
+      rows.map(async (row) => ({
+        ...row,
+        ip: row.ip === null ? null : await decryptStoredPii(row.ip, "ip", REQUEST_ID),
+        userAgent:
+          row.userAgent === null
+            ? null
+            : await decryptStoredPii(row.userAgent, "userAgent", REQUEST_ID),
+      })),
+    );
+    return { rows: decryptedRows };
   },
 });

package/packages/bundled-features/src/user-data-rights/handlers/request-deletion.write.ts

@@ -1,11 +1,10 @@
-import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { USER_STATUS } from "../../user/index.js";
 import {
   type GdprMailDefaults,
-  isMailTransportAvailable,
+  isGdprMailDeliveryAvailable,
   makeDefaultDeletionRequestedEmail,
 } from "../lib/default-mailers.js";
 import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
@@ -71,17 +70,12 @@ export function createRequestDeletionHandler(opts: RequestDeletionOptions = {})
       if (!res.ok) return writeFailure(res.error);
       const { gracePeriodEnd, userEmail, userLocale } = res;
 
-      // App-Callback hat Vorrang; sonst greift die mail-foundation-Default-Mail
-      // (Request-Lane → ctx.config vorhanden, createTransportForTenant direkt).
-      // Ohne gemounteten mail-transport bleibt send undefined → keine Mail.
+      // The app callback wins; otherwise the default mail goes through ctx.notify after
+      // the commit. Without delivery and an email channel there is no sender and no mail.
       const send =
         opts.sendDeletionRequestedEmail ??
-        (isMailTransportAvailable(ctx.registry)
-          ? makeDefaultDeletionRequestedEmail(
-              (tenantId) =>
-                createTransportForTenant(ctx, tenantId, "user-data-rights:request-deletion"),
-              opts.mailDefaults,
-            )
+        (ctx.notify !== undefined && isGdprMailDeliveryAvailable(ctx.registry)
+          ? makeDefaultDeletionRequestedEmail(ctx.notify, opts.mailDefaults)
           : undefined);
 
       // Best-effort Email-Notification. Send-Failure darf das Write nicht

package/packages/bundled-features/src/user-data-rights/index.ts

@@ -25,6 +25,7 @@ export type { SendDeletionExecutedEmailFn } from "./run-forget-cleanup.js";
 export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.js";
 export type { UserExportBundle } from "./run-user-export.js";
 export { runUserExport } from "./run-user-export.js";
+export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.js";
 export {
   ACTIVE_JOB_CONSTRAINT,
   EXPORT_JOB_STATUS,