@cosmicdrift/kumiko-bundled-features 0.187.0 → 0.188.0

package/src/form-draft/handlers/list.query.ts

@@ -0,0 +1,40 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { FORM_DRAFT_ACCESS } from "../constants";
+import { listDraftsByScreen } from "../lookup";
+import { listDraftsPayloadSchema } from "../schemas";
+
+export type ListDraftsResult = {
+  readonly drafts: readonly {
+    readonly id: string;
+    readonly draftKey: string;
+    readonly stepIndex: number;
+    readonly savedAt: string;
+  }[];
+};
+
+// list — the fallback path for resuming a draft whose draftId the client
+// lost (new tab, cleared storage, another device): returns just enough to
+// pick one (id, draftKey, stepIndex, savedAt), never the blob's `values`.
+// Newest first, so the most likely-relevant draft leads.
+export const listDraftsQuery = defineQueryHandler({
+  name: "list",
+  schema: listDraftsPayloadSchema,
+  access: FORM_DRAFT_ACCESS,
+  handler: async (query, ctx): Promise<ListDraftsResult> => {
+    const rows = await listDraftsByScreen(
+      ctx.db,
+      query.user.tenantId,
+      query.user.id,
+      query.payload.screenId,
+    );
+    const drafts = rows
+      .map((row) => ({
+        id: row.id,
+        draftKey: row.draftKey,
+        stepIndex: row.draft.stepIndex,
+        savedAt: row.draft.savedAt,
+      }))
+      .sort((a, b) => b.savedAt.localeCompare(a.savedAt));
+    return { drafts };
+  },
+});

package/src/form-draft/handlers/save.write.ts

@@ -0,0 +1,60 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import { FORM_DRAFT_ACCESS, FORM_DRAFT_UNIQUE_KEY_CONSTRAINT } from "../constants";
+import { formDraftExecutor } from "../executor";
+import { lookupDraft } from "../lookup";
+import { saveDraftPayloadSchema } from "../schemas";
+
+/**
+ * save is an upsert keyed on (tenantId, ownerId, draftKey) — same
+ * lookup-then-create|update-with-race-retry idiom as
+ * delivery/upsert-preference.ts, because createEventStoreExecutor has no
+ * built-in upsert. Two racing saves for the same draftKey: the loser hits
+ * the unique index (FORM_DRAFT_UNIQUE_KEY_CONSTRAINT), re-looks-up the
+ * winner's row, and updates it (with the winner's version) instead of
+ * erroring.
+ */
+function isDraftKeyConflict(failure: WriteFailure): boolean {
+  const error = failure.error as {
+    code?: string;
+    details?: { constraintName?: string };
+  }; // @cast-boundary error-details
+  return (
+    error.code === "unique_violation" &&
+    error.details?.constraintName === FORM_DRAFT_UNIQUE_KEY_CONSTRAINT
+  );
+}
+
+export const saveDraftWrite = defineWriteHandler({
+  name: "save",
+  schema: saveDraftPayloadSchema,
+  access: FORM_DRAFT_ACCESS,
+  handler: async (event, ctx) => {
+    const ownerId = event.user.id;
+    const { draftKey, values, stepIndex } = event.payload;
+    const T = getTemporal();
+    const draft = { values, stepIndex, savedAt: T.Now.instant().toString() };
+
+    const existing = await lookupDraft(ctx.db, event.user.tenantId, ownerId, draftKey);
+    if (existing) {
+      return formDraftExecutor.update(
+        { id: existing.id, version: existing.version, changes: { draft } },
+        event.user,
+        ctx.db,
+      );
+    }
+
+    const result = await formDraftExecutor.create({ ownerId, draftKey, draft }, event.user, ctx.db);
+    if (result.isSuccess) return result;
+    if (!isDraftKeyConflict(result)) return result;
+
+    const winner = await lookupDraft(ctx.db, event.user.tenantId, ownerId, draftKey);
+    if (!winner) return result;
+    return formDraftExecutor.update(
+      { id: winner.id, version: winner.version, changes: { draft } },
+      event.user,
+      ctx.db,
+    );
+  },
+});

package/src/form-draft/i18n.ts

@@ -0,0 +1,3 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const FORM_DRAFT_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {};

package/src/form-draft/index.ts

@@ -0,0 +1,28 @@
+export {
+  FORM_DRAFT_ACCESS,
+  FORM_DRAFT_FEATURE_NAME,
+  FORM_DRAFT_KEY_MAX_LENGTH,
+  FORM_DRAFT_UNIQUE_KEY_CONSTRAINT,
+  FormDraftHandlers,
+  FormDraftQueries,
+} from "./constants";
+export { formDraftEntity } from "./entity";
+export { formDraftExecutor, formDraftTable } from "./executor";
+export { formDraftFeature } from "./feature";
+export { discardDraftWrite } from "./handlers/discard.write";
+export { type GetDraftResult, getDraftQuery } from "./handlers/get.query";
+export { type ListDraftsResult, listDraftsQuery } from "./handlers/list.query";
+export { saveDraftWrite } from "./handlers/save.write";
+export { type FormDraftRow, lookupDraft } from "./lookup";
+export {
+  type DiscardDraftPayload,
+  discardDraftPayloadSchema,
+  type FormDraftBlob,
+  formDraftBlobSchema,
+  type GetDraftPayload,
+  getDraftPayloadSchema,
+  type ListDraftsPayload,
+  listDraftsPayloadSchema,
+  type SaveDraftPayload,
+  saveDraftPayloadSchema,
+} from "./schemas";

package/src/form-draft/lookup.ts

@@ -0,0 +1,53 @@
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { formDraftTable } from "./executor";
+import type { FormDraftBlob } from "./schemas";
+
+export type FormDraftRow = {
+  readonly id: string;
+  readonly version: number;
+  readonly draft: FormDraftBlob;
+};
+
+// Shared by save (upsert lookup + race re-lookup), discard, and get — always
+// scoped by tenantId + ownerId + draftKey, tenantId included explicitly
+// (not relying on TenantDb auto-scoping) to mirror delivery/upsert-preference.ts.
+export async function lookupDraft(
+  db: TenantDb,
+  tenantId: TenantId,
+  ownerId: string,
+  draftKey: string,
+): Promise<FormDraftRow | undefined> {
+  return fetchOne<FormDraftRow>(db, formDraftTable, { tenantId, ownerId, draftKey });
+}
+
+export type FormDraftSummaryRow = {
+  readonly id: string;
+  readonly draftKey: string;
+  readonly draft: FormDraftBlob;
+};
+
+// LIKE metacharacters in a caller-controlled screenId must not widen the
+// prefix scan (e.g. a literal "%" matching every draft).
+function escapeLikePattern(value: string): string {
+  return value.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
+
+// draftKey is `${screenId}:${entityId}` or `${screenId}:new:${draftId}`
+// (framework-wizard-mode.md) — "drafts for a screenId" is a LIKE prefix
+// match on that leading segment. tenantId + ownerId equality narrows to the
+// caller's own rows via the (tenantId, ownerId, draftKey) unique index
+// before the pattern filter applies.
+export async function listDraftsByScreen(
+  db: TenantDb,
+  tenantId: TenantId,
+  ownerId: string,
+  screenId: string,
+): Promise<readonly FormDraftSummaryRow[]> {
+  return selectMany<FormDraftSummaryRow>(db, formDraftTable, {
+    tenantId,
+    ownerId,
+    draftKey: { like: `${escapeLikePattern(screenId)}:%` },
+  });
+}

package/src/form-draft/release-file-refs.ts

@@ -0,0 +1,69 @@
+import type { FormDraftBlob } from "./schemas";
+
+// The draft blob's `values` is free-form by design (issue #1889: form-draft
+// never knows the consuming form's field schema, only { values, stepIndex,
+// savedAt }). A FileRef pointer is therefore recognised purely by shape —
+// any object anywhere in `values` carrying a non-empty string `storageKey`
+// matches what POST /files returns (file-routes.ts) and what a photo-upload
+// step writes into the draft, whether under a single "file" field or nested
+// in a "files"/"images" array.
+function isFileRefPointer(value: unknown): value is { readonly storageKey: string } {
+  if (typeof value !== "object" || value === null) return false;
+  const storageKey = (value as { storageKey?: unknown }).storageKey;
+  return typeof storageKey === "string" && storageKey.length > 0;
+}
+
+function collectStorageKeys(value: unknown, keys: Set<string>): void {
+  if (isFileRefPointer(value)) {
+    keys.add(value.storageKey);
+    // skip: FileRef pointer is a leaf — nothing further to recurse into.
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectStorageKeys(item, keys);
+    // skip: array items are already visited recursively above.
+    return;
+  }
+  if (typeof value === "object" && value !== null) {
+    for (const item of Object.values(value)) collectStorageKeys(item, keys);
+  }
+}
+
+export function collectDraftFileRefKeys(
+  draft: FormDraftBlob | null | undefined,
+): readonly string[] {
+  if (!draft) return [];
+  const keys = new Set<string>();
+  collectStorageKeys(draft.values, keys);
+  return [...keys];
+}
+
+// Best-effort by design: a storage hiccup must not block a draft discard or
+// the nightly cleanup sweep — this is storage-cost hygiene, not GDPR Art. 17
+// erasure, so there is no fail-closed requirement (contrast
+// user-data-rights-defaults/hooks/file-ref.userdata-hook.ts, which rolls
+// back the whole forget on a binary-delete failure). Each failing key is
+// logged and skipped; the caller's row-level operation proceeds regardless.
+//
+// Takes an already-decided key list, not the draft blob — callers must run
+// collectDraftFileRefKeys() output through db/queries' owned-storage-key
+// filter first. `values` is free-form, client-supplied JSON (issue #1889);
+// releasing a key straight out of it without verifying a real, owned
+// file_refs row exists would let a crafted `{ storageKey: "<victim's key>" }`
+// delete someone else's file — the same ownership check file-routes.ts runs
+// before every read/delete (loadFileForTenant + FileAccessGuard).
+export async function releaseDraftFileRefs(
+  keys: readonly string[],
+  deleteBinary: (storageKey: string) => Promise<void>,
+  log?: { warn(msg: string, data?: Record<string, unknown>): void },
+): Promise<void> {
+  for (const key of keys) {
+    try {
+      await deleteBinary(key);
+    } catch (err) {
+      log?.warn(`[form-draft] failed to release FileRef storageKey=${key}`, {
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+}

package/src/form-draft/schemas.ts

@@ -0,0 +1,47 @@
+import { z } from "zod";
+import { FORM_DRAFT_KEY_MAX_LENGTH } from "./constants";
+
+const draftKeySchema = z.string().trim().min(1).max(FORM_DRAFT_KEY_MAX_LENGTH);
+
+// The draft blob shape — fixed by issue #1889 here, not left for consumers
+// to invent per-app. `stepIndex` is in from the start so wizard-mode resume
+// (kumiko-framework#1884) doesn't need a later migration.
+export const formDraftBlobSchema = z.object({
+  values: z.record(z.string(), z.unknown()),
+  stepIndex: z.number().int().min(0),
+  savedAt: z.string(),
+});
+export type FormDraftBlob = z.infer<typeof formDraftBlobSchema>;
+
+// savedAt is stamped server-side (see handlers/save.write.ts) — never
+// accepted from the caller.
+export const saveDraftPayloadSchema = z.object({
+  draftKey: draftKeySchema,
+  values: z.record(z.string(), z.unknown()),
+  stepIndex: z.number().int().min(0),
+});
+export type SaveDraftPayload = z.infer<typeof saveDraftPayloadSchema>;
+
+// releaseFiles defaults to false/absent: the caller's only two current call
+// sites (render-edit.tsx, both on a *successful submit*) delete the draft
+// row right after the domain entity write already carries the same
+// storageKeys forward — releasing them here would destroy files the entity
+// now depends on. Only an actual abandon/abort flow should pass
+// releaseFiles: true (issue #1915's "explicit abort" case).
+export const discardDraftPayloadSchema = z.object({
+  draftKey: draftKeySchema,
+  releaseFiles: z.boolean().optional(),
+});
+export type DiscardDraftPayload = z.infer<typeof discardDraftPayloadSchema>;
+
+export const getDraftPayloadSchema = z.object({
+  draftKey: draftKeySchema,
+});
+export type GetDraftPayload = z.infer<typeof getDraftPayloadSchema>;
+
+// screenId is the draftKey's leading segment by convention (see lookup.ts),
+// so it shares the same charset/length constraints as a full draftKey.
+export const listDraftsPayloadSchema = z.object({
+  screenId: draftKeySchema,
+});
+export type ListDraftsPayload = z.infer<typeof listDraftsPayloadSchema>;

package/src/form-draft-user-data/__tests__/hooks.integration.test.ts

@@ -0,0 +1,146 @@
+// formDraftExportHook — GDPR export must scope to the requesting user's own
+// drafts only, not every draft in the tenant. formDraftDeleteHook physically
+// deletes the requesting user's own draft rows and must leave other users'
+// (and other tenants') rows untouched.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createConfigFeature } from "../../config";
+import { FormDraftHandlers, formDraftEntity, formDraftFeature } from "../../form-draft";
+import { formDraftDeleteHook, formDraftExportHook } from "../hooks";
+
+async function countDraftRows(stack: TestStack, ownerId: string): Promise<number> {
+  const rows = await asRawClient(stack.db).unsafe(
+    "SELECT count(*)::int AS n FROM read_form_drafts WHERE owner_id = $1",
+    [ownerId],
+  );
+  return (rows as Array<{ n: number }>)[0]?.n ?? 0;
+}
+
+let stack: TestStack;
+const owner = createTestUser({ id: 1, roles: ["TenantMember"] });
+const other = createTestUser({ id: 2, roles: ["TenantMember"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [formDraftFeature, createConfigFeature()] });
+  await unsafeCreateEntityTable(stack.db, formDraftEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("formDraftExportHook", () => {
+  test("includes only the requesting user's own drafts", async () => {
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:owner", values: { name: "owner's" }, stepIndex: 0 },
+      owner,
+    );
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:other", values: { name: "other's" }, stepIndex: 0 },
+      other,
+    );
+
+    const snippet = await formDraftExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: owner.tenantId,
+      userId: owner.id,
+    });
+
+    expect(snippet).not.toBeNull();
+    const draftKeys = (snippet?.rows ?? []).map((r) => r["draftKey"]);
+    expect(draftKeys).toEqual(["wizard:owner"]);
+  });
+
+  test("same user id in a different tenant does not leak into this tenant's export", async () => {
+    const tenantATestTenantId = "00000000-0000-4000-8000-000000000021";
+    const tenantBTestTenantId = "00000000-0000-4000-8000-000000000022";
+    const sameIdTenantA = createTestUser({
+      id: 21,
+      roles: ["TenantMember"],
+      tenantId: tenantATestTenantId,
+    });
+    const sameIdTenantB = createTestUser({
+      id: 21,
+      roles: ["TenantMember"],
+      tenantId: tenantBTestTenantId,
+    });
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:tenant-a", values: { secret: "tenant-a-only" }, stepIndex: 0 },
+      sameIdTenantA,
+    );
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:tenant-b", values: { secret: "tenant-b-only" }, stepIndex: 0 },
+      sameIdTenantB,
+    );
+
+    const snippet = await formDraftExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: tenantATestTenantId,
+      userId: sameIdTenantA.id,
+    });
+
+    const draftKeys = (snippet?.rows ?? []).map((r) => r["draftKey"]);
+    expect(draftKeys).toEqual(["wizard:tenant-a"]);
+  });
+
+  test("returns null when the user saved no drafts", async () => {
+    const lurker = createTestUser({ id: 3, roles: ["TenantMember"] });
+    const snippet = await formDraftExportHook({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: lurker.tenantId,
+      userId: lurker.id,
+    });
+    expect(snippet).toBeNull();
+  });
+});
+
+describe("formDraftDeleteHook", () => {
+  test("deletes the requesting user's own draft rows, leaves other users' rows alone", async () => {
+    const alice = createTestUser({ id: 11, roles: ["TenantMember"] });
+    const bob = createTestUser({ id: 12, roles: ["TenantMember"], tenantId: alice.tenantId });
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:a", values: {}, stepIndex: 0 },
+      alice,
+    );
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:b", values: {}, stepIndex: 0 },
+      bob,
+    );
+
+    await formDraftDeleteHook(
+      { db: stack.db, registry: stack.registry, tenantId: alice.tenantId, userId: alice.id },
+      "delete",
+    );
+
+    expect(await countDraftRows(stack, String(alice.id))).toBe(0);
+    expect(await countDraftRows(stack, String(bob.id))).toBe(1);
+  });
+
+  test("is idempotent — running it again with nothing left to delete does not throw", async () => {
+    const lurker = createTestUser({ id: 13, roles: ["TenantMember"] });
+    await expect(
+      formDraftDeleteHook(
+        { db: stack.db, registry: stack.registry, tenantId: lurker.tenantId, userId: lurker.id },
+        "delete",
+      ),
+    ).resolves.toBeUndefined();
+  });
+});

package/src/form-draft-user-data/changes.json

@@ -0,0 +1 @@
+[]

package/src/form-draft-user-data/hooks.ts

@@ -0,0 +1,49 @@
+// EXT_USER_DATA hooks for the form-draft feature's `form-draft` entity
+// (GDPR Art. 20 export / Art. 17 erasure). Lives apart from form-draft so
+// consumers without the user-data-rights pipeline don't pull a hard
+// dependency.
+
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { formDraftExecutor, formDraftTable } from "../form-draft";
+
+export const formDraftExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, formDraftTable, {
+    tenantId: ctx.tenantId,
+    ownerId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "form-draft",
+    rows: rows.map((r) => ({
+      draftKey: r["draftKey"],
+      draft: r["draft"],
+      insertedAt: r["insertedAt"],
+    })),
+  };
+};
+
+// Real physical delete, not crypto-shredding — `draft` is jsonb (entity.ts
+// explains why it can't use the string-only PII field-encryption engine).
+// A drafted form is pure pre-submit scratch state with no value once the
+// owner is gone, so both forget strategies (delete/anonymize) remove the
+// row outright rather than anonymizing in place. Per-row via the executor
+// (event -> rebuild-safe), scoped to this user only — never touches other
+// owners' drafts, tenant model doesn't matter here (unlike folders' single-
+// user gating: a form-draft row always has exactly one owner already).
+export const formDraftDeleteHook: UserDataDeleteHook = async (ctx) => {
+  const rows = await selectMany<{ id: string }>(ctx.db, formDraftTable, {
+    tenantId: ctx.tenantId,
+    ownerId: ctx.userId,
+  });
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  for (const row of rows) {
+    await formDraftExecutor.delete({ id: row.id }, systemUser, tdb);
+  }
+};

package/src/form-draft-user-data/index.ts

@@ -0,0 +1,21 @@
+// Provides the EXT_USER_DATA export/delete hooks for the form-draft
+// feature's `form-draft` entity as a standalone feature — mount it alongside
+// form-draft + user-data-rights when an app needs form drafts in its GDPR
+// export/forget pipeline. Kept separate from form-draft (which requires
+// nothing) so form-draft consumers without the user-data-rights stack don't
+// pull a hard dependency. Mirrors notes-history-user-data.
+
+import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import { formDraftDeleteHook, formDraftExportHook } from "./hooks";
+
+export const formDraftUserDataFeature = defineFeature("form-draft-user-data", (r) => {
+  r.describe(
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `form-draft` feature's `form-draft` entity. Mounts the EXT_USER_DATA export hook so a user's saved drafts are included in the user-data export bundle, and a delete hook that physically removes the user's own draft rows on forget. Kept separate from `form-draft` so form-draft consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `form-draft`.",
+  );
+  r.requires("user-data-rights");
+  r.optionalRequires("form-draft");
+  r.useExtension(EXT_USER_DATA, "form-draft", {
+    export: formDraftExportHook,
+    delete: formDraftDeleteHook,
+  });
+});

package/src/inbound-mail-foundation/__tests__/inbound-mail-foundation.integration.test.ts

@@ -624,7 +624,7 @@ describe("scenario 6: crypto-shredding (#800)", () => {
       inboundMessageAggregateId(accountId, "uid-shred"),
       admin.tenantId,
     );
-    const ciphertext = (events[0]?.payload as { from?: string }).from as string;
+    const ciphertext = (events[0]!.payload as { from?: string }).from as string;
     expect(isPiiCiphertext(ciphertext)).toBe(true);
 
     const kms = configuredPiiSubjectKms();

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -26,6 +26,8 @@ function projectionProbeTable(name: string): SchemaTable {
   }) as unknown as SchemaTable; // @cast-boundary test-fixture — minimal probe shape, real schema-table irrelevant here
 }
 
+import { formDraftFeature } from "../../form-draft";
+import { formDraftUserDataFeature } from "../../form-draft-user-data";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -72,6 +74,18 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     expect(() => validateBoot(baseFeatures())).not.toThrow();
   });
 
+  test("form-draft + form-draft-user-data mounted together satisfies V2 and V3 (real feature pair, not synthetic)", () => {
+    expect(() =>
+      validateBoot([...baseFeatures(), formDraftFeature, formDraftUserDataFeature]),
+    ).not.toThrow();
+  });
+
+  test("form-draft mounted WITHOUT form-draft-user-data → V3 throws (userOwned draft field has no hook)", () => {
+    expect(() => validateBoot([...baseFeatures(), formDraftFeature])).toThrow(
+      /EXT_USER_DATA hook.*Art\.17 gap/,
+    );
+  });
+
   test("V2: export hook without delete hook → Art.17 throw", () => {
     const bad = defineFeature("bad-export", (r) => {
       r.requires("user-data-rights");