@cosmicdrift/kumiko-bundled-features 0.239.0 → 0.241.0

package/src/tier-engine/__tests__/tier-engine-screens.boot.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, test } from "bun:test";
+import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import type { TierMap } from "../compose-app";
+import { TIER_ADMIN_SCREEN_ID } from "../constants";
+import { createTierEngineFeature } from "../feature";
+
+const SYSTEM_ADMIN_ROLES = ["SystemAdmin"] as const;
+
+type TestCaps = { readonly maxItems: number };
+const TEST_TIER_MAP: TierMap<TestCaps> = {
+  free: { features: [], caps: { maxItems: 1 } },
+  pro: { features: ["feat-pro"], caps: { maxItems: 5 } },
+};
+
+describe("tier-engine tier-admin screen + handler access alignment", () => {
+  test("boot-validates with the tier-admin actionForm registered (tierMap configured)", () => {
+    const features = [
+      createConfigFeature(),
+      createTenantFeature(),
+      createTierEngineFeature({ tierMap: TEST_TIER_MAP }),
+    ];
+    expect(() => validateBoot(features)).not.toThrow();
+  });
+
+  test("boot-validates in storage-only mode with tier-admin screen showing the no-tiers message (no tierMap)", () => {
+    const features = [createConfigFeature(), createTenantFeature(), createTierEngineFeature()];
+    expect(() => validateBoot(features)).not.toThrow();
+    const tierEngine = createTierEngineFeature();
+    const screen = tierEngine.screens[TIER_ADMIN_SCREEN_ID];
+    expect(screen).toBeDefined();
+    if (screen && "layout" in screen) {
+      expect(screen.layout.sections[0]).toMatchObject({ description: "tier-admin.error.noTiers" });
+    }
+    if (screen && "fields" in screen) {
+      expect(screen.fields["tier"]).toEqual({ type: "select", options: [], required: true });
+    }
+  });
+
+  test("tier-admin is a SystemAdmin-gated actionForm dispatching set-tenant-tier", () => {
+    const tierEngine = createTierEngineFeature({ tierMap: TEST_TIER_MAP });
+    const screen = tierEngine.screens[TIER_ADMIN_SCREEN_ID];
+    expect(screen?.type).toBe("actionForm");
+    if (screen && "handler" in screen) {
+      expect(screen.handler).toBe("tier-engine:write:set-tenant-tier");
+    }
+    if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+      expect(screen.access.roles).toEqual(SYSTEM_ADMIN_ROLES);
+    }
+    if (screen && "layout" in screen) {
+      expect(screen.layout.sections[0]).toMatchObject({ description: "tier-admin.explainer" });
+    }
+  });
+
+  test("tier-admin's tier field options come from the tierMap", () => {
+    const tierEngine = createTierEngineFeature({ tierMap: TEST_TIER_MAP });
+    const screen = tierEngine.screens[TIER_ADMIN_SCREEN_ID];
+    if (screen && "fields" in screen) {
+      expect(screen.fields["tier"]).toEqual({
+        type: "select",
+        options: ["free", "pro"],
+        required: true,
+      });
+      expect(screen.fields["tenantId"]).toEqual({
+        type: "reference",
+        entity: "tenant:tenant",
+        labelField: "name",
+        required: true,
+      });
+    }
+  });
+
+  test("set-tenant-tier write + get-tenant-tier/tier-options reads stay SystemAdmin-only", () => {
+    const tierEngine = createTierEngineFeature({ tierMap: TEST_TIER_MAP });
+    const roles = [...SYSTEM_ADMIN_ROLES];
+    expect(rolesOf(tierEngine.writeHandlers["set-tenant-tier"]?.access)).toEqual(roles);
+    expect(rolesOf(tierEngine.queryHandlers["get-tenant-tier"]?.access)).toEqual(roles);
+    expect(rolesOf(tierEngine.queryHandlers["tier-options"]?.access)).toEqual(roles);
+  });
+});

package/src/tier-engine/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.241.0",
+    "type": "breaking",
+    "title": "TierAdminScreen removed; tier-admin is now a declarative actionForm (fw#2312).",
+    "detail": "`tier-engine:screen:tier-admin` is now a declarative `actionForm` (a `reference` field for the tenant, a `select` field for the tier) instead of a custom React component: it dispatches `set-tenant-tier` directly, so the renderer's generic form handles tenant lookup, validation and submit. Two behaviors are intentionally not carried over: the current tier of the selected tenant is no longer shown before submit (declarative forms have no dependent-query support), and the success state no longer names the newly assigned tier (a generic actionForm success doesn't surface write-response data). Both are visible again after a page reload / re-navigation — the assignment itself is unchanged.",
+    "migration": "Breaking only if you imported `TierAdminScreen` directly (no shipped consumer app did — all reference the screen by its qualified id `tier-engine:screen:tier-admin`). Remove `import { TierAdminScreen } from \"@cosmicdrift/kumiko-bundled-features/tier-engine/web\"` and any `components: { TierAdminScreen: ... }` entry in your renderer setup — the bundled feature registers the `tier-admin` screen itself now, nothing left for an app to wire."
+  }
+]

package/src/tier-engine/constants.ts

@@ -1,9 +1,9 @@
 // @runtime client
-// Pure string-literal QNs/ids — von Server (feature.ts) UND Client
-// (web/tier-admin-screen, client-plugin) importiert. Als `client` markiert,
-// die im kumiko-Isolation-Modell permissivste Kategorie (runtime darf
-// client importieren, client nur client) — sonst wirft der Runtime-
-// Isolation-Guard auf den Client-Imports. Muster wie text-content/constants.
+// Pure string-literal QNs/ids — imported by both server (feature.ts) and
+// client (web/client-plugin.tsx). Marked `client`, the most permissive
+// category in the kumiko isolation model (runtime may import client, client
+// may only import client) — otherwise the runtime isolation guard throws on
+// the client imports. Same pattern as text-content/constants.
 // Feature name
 export const TIER_ENGINE_FEATURE = "tier-engine" as const;
 

package/src/tier-engine/feature.ts

@@ -69,7 +69,7 @@ import { z } from "zod";
 import { tenantTable } from "../tenant";
 import { tierAssignmentAggregateId } from "./aggregate-id";
 import type { TierMap } from "./compose-app";
-import { TIER_ADMIN_SCREEN_ID, TIER_ENGINE_FEATURE } from "./constants";
+import { TIER_ADMIN_SCREEN_ID, TIER_ENGINE_FEATURE, TierEngineHandlers } from "./constants";
 import { tierAssignmentEntity } from "./entity";
 import { getActiveTierQuery } from "./handlers/active-tier.query";
 import { getTenantTierQuery } from "./handlers/get-tenant-tier.query";
@@ -187,7 +187,7 @@ export function createTierEngineFeature<
 >(opts: CreateTierEngineOptions<TCaps> = {}): FeatureDefinition {
   return defineFeature(TIER_ENGINE_FEATURE, (r) => {
     r.describe(
-      'Stores a `tier-assignment` entity per tenant (which pricing tier is active) and, when configured with a `TierMap`, registers itself as the `tenantTierResolver` extension so the dispatcher automatically gates `r.toggleable()` features per tenant based on their assigned tier. Call `createTierEngineFeature({ defaultTier, tierMap })` to get full tier composition \u2014 including an `inTransaction` entity hook that atomically writes the default tier when a new tenant is created \u2014 or use `createTierEngineFeature()` without options for storage-only mode when you manage tier assignment yourself via `composeApp`. A SystemAdmin-only `set-tenant-tier` write plus `get-tenant-tier`/`tier-options` reads let an operator assign a tier to ANY tenant manually \u2014 without a billing purchase \u2014 stamping `source: "manual"` so a future Stripe\u2192tier sync won\'t overwrite the grant. Apps surface this via the `tier-admin` screen.',
+      'Stores a `tier-assignment` entity per tenant (which pricing tier is active) and, when configured with a `TierMap`, registers itself as the `tenantTierResolver` extension so the dispatcher automatically gates `r.toggleable()` features per tenant based on their assigned tier. Call `createTierEngineFeature({ defaultTier, tierMap })` to get full tier composition \u2014 including an `inTransaction` entity hook that atomically writes the default tier when a new tenant is created \u2014 or use `createTierEngineFeature()` without options for storage-only mode when you manage tier assignment yourself via `composeApp`. A SystemAdmin-only `set-tenant-tier` write plus `get-tenant-tier`/`tier-options` reads let an operator assign a tier to ANY tenant manually \u2014 without a billing purchase \u2014 stamping `source: "manual"` so a future Stripe\u2192tier sync won\'t overwrite the grant. Apps surface this via the `tier-admin` screen, which is always registered — in storage-only mode (no `tierMap`) it shows an honest "no tiers configured" message instead of a tier dropdown.',
     );
     r.uiHints({
       displayLabel: "Tier Engine \u00b7 Plan Composition",
@@ -252,18 +252,44 @@ export function createTierEngineFeature<
       }),
     );
 
-    // Custom React-Screen für den manuellen Grant. SystemAdmin-only fest
-    // verdrahtet (Platform-Admin-Hoheit, nicht App-konfigurierbar). App
-    // platziert ihn nur via r.nav("tier-engine:screen:tier-admin"); die
-    // Komponente liefert tierEngineClient() aus dem ./web-subpath.
+    // Declarative form for the manual grant. SystemAdmin-only, hard-wired
+    // (platform-admin authority, not app-configurable). Apps place it only
+    // via r.nav("tier-engine:screen:tier-admin"); tier options are built
+    // statically from the tierMap closure. Always registered — even in
+    // storage-only mode (no tierMap) — so the screen shows an honest
+    // "no tiers configured" message instead of vanishing (samples like
+    // use-all-bundled deliberately mount storage-only to screenshot that
+    // empty state).
     r.translations({ keys: TIER_ENGINE_I18N });
-    // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312
     r.screen({
       id: TIER_ADMIN_SCREEN_ID,
-      type: "custom",
-      renderer: { react: { __component: "TierAdminScreen" } },
+      type: "actionForm",
+      handler: TierEngineHandlers.setTenantTier,
+      fields: {
+        tenantId: {
+          type: "reference",
+          entity: "tenant:tenant",
+          labelField: "name",
+          required: true,
+        },
+        tier: {
+          type: "select",
+          options: opts.tierMap ? Object.keys(opts.tierMap) : [],
+          required: true,
+        },
+      },
+      layout: {
+        sections: [
+          {
+            fields: ["tenantId", "tier"],
+            description: opts.tierMap ? "tier-admin.explainer" : "tier-admin.error.noTiers",
+          },
+        ],
+      },
+      submitLabel: "tier-admin.submit",
+      cancelTarget: false,
       description:
-        "Operator form that picks a tenant, shows its current tier and assigns a new one as a manual grant without a billing purchase.",
+        "Operator form that assigns a tier to any tenant as a manual grant without a billing purchase.",
       access: { roles: ["SystemAdmin"] },
     });
 

package/src/tier-engine/i18n.ts

@@ -1,31 +1,28 @@
 // @runtime client
-// Default-Bundles für den TierAdminScreen. Werden vom tierEngineClient()
-// als Fallback-Bundle in den LocaleProvider gehängt — Apps überschreiben
-// einzelne Keys via `tierEngineClient({ translations })`.
+// Server + client i18n for the tier-admin actionForm. Single source of
+// truth: r.translations({ keys: TIER_ENGINE_I18N }) registers these
+// server-side, defaultTranslations derives the client-side locale bundle
+// from the same map so the two can't drift.
 
-import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import {
+  type TranslationsByLocale,
+  translationsByLocaleFromKeys,
+} from "@cosmicdrift/kumiko-renderer";
 
 type LocalizedString = { readonly en: string };
 
 export const TIER_ENGINE_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:tier-admin.title": { en: "Assign tier manually" },
-};
-
-export const defaultTranslations: TranslationsByLocale = {
-  en: {
-    "screen:tier-admin.title": "Assign tier manually",
-    "tier-admin.title": "Assign tier manually",
-    "tier-admin.explainer":
-      "Grant a tenant a tier without a purchase. The grant is marked as “manual” and a later billing sync won't overwrite it.",
-    "tier-admin.tenant.label": "Tenant",
-    "tier-admin.current.label": "Current tier",
-    "tier-admin.current.none": "— none yet —",
-    "tier-admin.tier.label": "New tier",
-    "tier-admin.submit": "Assign tier",
-    "tier-admin.success": "Assigned tier “{tier}”.",
-    "tier-admin.error.generic": "Could not assign the tier.",
-    "tier-admin.error.load": "Failed to load tenants.",
-    "tier-admin.error.noTiers":
-      "This app has no TierMap configured — there are no assignable tiers.",
+  "tier-admin.explainer": {
+    en: "Grant a tenant a tier without a purchase. The grant is marked as “manual” and a later billing sync won't overwrite it.",
   },
+  "tier-admin.error.noTiers": {
+    en: "This app has no TierMap configured — there are no assignable tiers.",
+  },
+  "tier-engine:entity:__action-form__:field:tenantId": { en: "Tenant" },
+  "tier-engine:entity:__action-form__:field:tier": { en: "New tier" },
+  "tier-admin.submit": { en: "Assign tier" },
 };
+
+export const defaultTranslations: TranslationsByLocale =
+  translationsByLocaleFromKeys(TIER_ENGINE_I18N);

package/src/tier-engine/web/client-plugin.tsx

@@ -1,18 +1,15 @@
 // @runtime client
-// Client-Feature-Factory für tier-engine. Liefert den TierAdminScreen
-// (gemappt auf die Screen-id "tier-admin") + Default-Translations. Apps
-// hängen es in createKumikoApp({ clientFeatures: [tierEngineClient()] }) ein;
-// der Screen selbst wird server-seitig vom Feature als custom-Screen
-// registriert (r.screen), die App platziert ihn nur via r.nav.
+// Client-feature factory for tier-engine. Supplies the default translations
+// for the declarative tier-admin actionForm (registered server-side via
+// r.screen in the feature); the app places the screen only via r.nav.
 
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { TIER_ADMIN_SCREEN_ID, TIER_ENGINE_FEATURE } from "../constants";
+import { TIER_ENGINE_FEATURE } from "../constants";
 import { defaultTranslations } from "../i18n";
-import { TierAdminScreen } from "./tier-admin-screen";
 
 export type TierEngineClientOptions = {
-  /** Key-weise Overrides über die Default-Bundles (de/en). */
+  /** Per-key overrides over the default bundles (de/en). */
   readonly translations?: TranslationsByLocale;
 };
 
@@ -20,8 +17,5 @@ export function tierEngineClient(options?: TierEngineClientOptions): ClientFeatu
   return {
     name: TIER_ENGINE_FEATURE,
     translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
-    components: {
-      [TIER_ADMIN_SCREEN_ID]: TierAdminScreen,
-    },
   };
 }

package/src/tier-engine/web/index.ts

@@ -5,4 +5,3 @@
 // `@cosmicdrift/kumiko-bundled-features/tier-engine` und hat keine React-Deps.
 
 export { type TierEngineClientOptions, tierEngineClient } from "./client-plugin";
-export { TierAdminScreen } from "./tier-admin-screen";

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -77,3 +77,102 @@ describe("user-data-rights read-only inspector screens", () => {
     );
   });
 });
+
+// fw#2312 — privacy-center converted from a custom screen to a declarative
+// projectionDetail (Restriction/Deletion fields+actions, Export stays a
+// custom extension section). `validateBoot` above already proves the
+// screen clears every boot-validator rule for projectionDetail extension
+// sections (entityName set, contributesToFormSubmit not true) — these
+// tests pin the GDPR-relevant shape the type system can't check itself:
+// which handler each action dispatches, the confirm-dialog description,
+// and the visibility conditions carried over from the pre-#2312 custom
+// screen (restrict.tsx/deletion.tsx RestrictionSection/DeletionSection).
+describe("privacy-center screen (fw#2312 projectionDetail conversion)", () => {
+  test("is a projectionDetail bound to the user's own `me` query", () => {
+    const f = createUserDataRightsFeature();
+    const screen = f.screens["privacy-center"];
+    expect(screen?.type).toBe("projectionDetail");
+    if (screen?.type === "projectionDetail") {
+      expect(screen.query).toBe("user:query:user:me");
+      expect(screen.access).toEqual({ openToAll: true });
+    }
+  });
+
+  test("Export section is a self-persisting extension scoped to export-job", () => {
+    const f = createUserDataRightsFeature();
+    const screen = f.screens["privacy-center"];
+    if (screen?.type !== "projectionDetail") throw new Error("expected projectionDetail");
+    const exportSection = screen.layout.sections.find((s) => s.kind === "extension");
+    expect(exportSection?.entityName).toBe("export-job");
+    expect(exportSection?.contributesToFormSubmit).not.toBe(true);
+  });
+
+  test("`status` renders exactly once across the screen, with a translated enum label", () => {
+    const f = createUserDataRightsFeature();
+    const screen = f.screens["privacy-center"];
+    if (screen?.type !== "projectionDetail") throw new Error("expected projectionDetail");
+    const statusFields = screen.layout.sections
+      .flatMap((s) => ("fields" in s ? s.fields : []))
+      .filter((field) =>
+        typeof field === "string" ? field === "status" : field.field === "status",
+      );
+    expect(statusFields).toHaveLength(1);
+    const statusField = statusFields[0];
+    expect(typeof statusField === "object" ? statusField.renderer : undefined).toEqual({
+      format: "enumOption",
+      keyPrefix: "userDataRights.privacyCenter.field.status.option.",
+    });
+  });
+
+  test("gracePeriodEnd is hidden unless a deletion is actually pending", () => {
+    const f = createUserDataRightsFeature();
+    const screen = f.screens["privacy-center"];
+    if (screen?.type !== "projectionDetail") throw new Error("expected projectionDetail");
+    const graceField = screen.layout.sections
+      .flatMap((s) => ("fields" in s ? s.fields : []))
+      .find((field) => typeof field === "object" && field.field === "gracePeriodEnd");
+    expect(typeof graceField === "object" ? graceField.visible : undefined).toEqual({
+      field: "status",
+      eq: "deletionRequested",
+    });
+  });
+
+  test("Restriction/Deletion actions dispatch the right handlers with the original confirm+visibility rules", () => {
+    const f = createUserDataRightsFeature();
+    const screen = f.screens["privacy-center"];
+    if (screen?.type !== "projectionDetail") throw new Error("expected projectionDetail");
+    const byId = Object.fromEntries((screen.actions ?? []).map((a) => [a.id, a]));
+
+    expect(byId["restrict"]).toMatchObject({
+      handler: "user-data-rights:write:restrict-account",
+      visible: { field: "status", ne: "restricted" },
+    });
+    expect(byId["restrict"]?.kind === "navigate" ? undefined : byId["restrict"]?.confirm).toBe(
+      "userDataRights.privacyCenter.restriction.dialogDescription",
+    );
+
+    expect(byId["request-deletion"]).toMatchObject({
+      handler: "user-data-rights:write:request-deletion",
+      visible: { field: "status", ne: "deletionRequested" },
+    });
+    // Cancel has no confirm — the pre-#2312 custom screen executed it directly.
+    expect(byId["cancel-deletion"]).toMatchObject({
+      handler: "user-data-rights:write:cancel-deletion",
+      visible: { field: "status", eq: "deletionRequested" },
+    });
+    expect((byId["cancel-deletion"] as { readonly confirm?: string }).confirm).toBeUndefined();
+  });
+
+  test("privacyCenterShowDeletion: false drops the deletion section + its actions", () => {
+    const f = createUserDataRightsFeature({ privacyCenterShowDeletion: false });
+    const screen = f.screens["privacy-center"];
+    if (screen?.type !== "projectionDetail") throw new Error("expected projectionDetail");
+    expect(
+      screen.layout.sections.some((s) => s.title === "userDataRights.privacyCenter.deletion.title"),
+    ).toBe(false);
+    const actionIds = (screen.actions ?? []).map((a) => a.id);
+    expect(actionIds).not.toContain("request-deletion");
+    expect(actionIds).not.toContain("cancel-deletion");
+    expect(actionIds).toContain("restrict");
+  });
+});

package/src/user-data-rights/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.241.0",
+    "type": "breaking",
+    "title": "privacy-center is now a declarative screen; userDataRightsClient's privacyCenter.showDeletion option is removed (fw#2312).",
+    "detail": "`privacy-center` is now a declarative `projectionDetail` screen instead of a custom React component: the Restriction and Deletion sections render through the generic renderer (`EditFieldsSection` + `actions: RowAction[]`), preserving the original confirmation dialogs (`RowActionWriteHandler.confirm`) and visibility rules (`visible: {field, eq/ne}`) 1:1. The Export section (Art. 20) stays a custom `EditExtensionSection` — it needs polling + a signed-URL download — registered via the new `ClientFeatureDefinition.extensionSectionComponents` under `EXPORT_SECTION_EXTENSION_NAME`. `PrivacyCenterScreen` is a dead export (the renderer selects the screen by `screen.type`, not the client component registry). The single `status` field now renders through the `enumOption` format instead of the raw enum string; `gracePeriodEnd` is hidden when no deletion is pending instead of showing an empty date. Known UI regression, accepted for this pass: the confirm-dialog title is now always the action's `label` (the renderer hardcodes this) — the original's distinct `dialogTitle` copy and its dynamic composed banner sentence (e.g. \"Your account will be deleted on {date}\") are gone, replaced by the translated `status` label plus a separately labeled `gracePeriodEnd` date.",
+    "migration": "A declarative screen is registered once and can no longer be toggled per-app on the client: `userDataRightsClient(options)`'s `privacyCenter: { showDeletion }` option is removed. Move the flag server-side instead — replace `createUserDataRightsFeature({})` with `createUserDataRightsFeature({ privacyCenterShowDeletion: false })` (default `true`) — it conditionally omits the Deletion section and its `request-deletion`/`cancel-deletion` actions from the screen definition. Then drop the now-unused `privacyCenter` option from the matching `userDataRightsClient({ privacyCenter: { showDeletion: false } })` call. Known affected consumer: `money-horse` (`src/app/client-features.tsx:74`)."
+  },
   {
     "version": "0.165.1",
     "type": "fix",

package/src/user-data-rights/constants.ts

@@ -1,15 +1,29 @@
 // @runtime client
-// Reine String-Konstanten — client-markiert, damit der PrivacyCenterScreen
-// (web/) sie importieren darf, ohne das runtime-Barrel des Features (und
-// damit dessen Server-/DOM-freien Code) zu ziehen. Runtime-Code
-// (feature.ts) darf client-Dateien ohnehin importieren.
+// Reine String-Konstanten — client-markiert, damit web/ (z.B. ExportSection)
+// sie importieren darf, ohne das runtime-Barrel des Features (und damit
+// dessen Server-/DOM-freien Code) zu ziehen. Runtime-Code (feature.ts) darf
+// client-Dateien ohnehin importieren.
 
 export const USER_DATA_RIGHTS_FEATURE = "user-data-rights" as const;
 
-// Dormant registriert (kein r.nav im Feature); Apps platzieren ihn via
-// r.nav. Qualifiziert: `user-data-rights:screen:privacy-center`.
+// Registered without r.nav — apps place it via their own r.nav. Qualified:
+// `user-data-rights:screen:privacy-center`.
 export const PRIVACY_CENTER_SCREEN_ID = "privacy-center" as const;
 
+// Extension-section component name for the Export (Art. 20) section of the
+// privacy-center screen — shared between feature.ts (screen def's
+// `component: { react: { __component } }`) and web/client-plugin.tsx
+// (extensionSectionComponents registration), same pattern as
+// compliance-profiles' COMPLIANCE_PROFILE_CATALOG_EXTENSION_NAME.
+export const EXPORT_SECTION_EXTENSION_NAME = "UserDataRightsExportSection" as const;
+
+// enumOption keyPrefix for the privacy-center screen's `status` field
+// (fw#2315 pattern) — resolves the raw user-lifecycle enum value
+// (active/restricted/deletionRequested/deleted) to a translated label
+// instead of showing the raw string.
+export const STATUS_OPTION_KEY_PREFIX =
+  "userDataRights.privacyCenter.field.status.option." as const;
+
 export const UserDataRightsQueries = {
   exportStatus: "user-data-rights:query:export-status",
   myAuditLog: "user-data-rights:query:my-audit-log",

package/src/user-data-rights/feature.ts

@@ -7,7 +7,13 @@ import {
   SYSTEM_USER_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { validateGdprHookCompleteness, validateGdprPiiHookCoverage } from "./boot-checks";
-import { PRIVACY_CENTER_SCREEN_ID } from "./constants";
+import {
+  EXPORT_SECTION_EXTENSION_NAME,
+  PRIVACY_CENTER_SCREEN_ID,
+  STATUS_OPTION_KEY_PREFIX,
+  USER_ME_QUERY,
+  UserDataRightsHandlers,
+} from "./constants";
 import { cancelDeletionWrite } from "./handlers/cancel-deletion.write";
 import { createConfirmDeletionByTokenHandler } from "./handlers/confirm-deletion-by-token.write";
 import { downloadAttemptListQuery } from "./handlers/download-attempt-list.query";
@@ -132,6 +138,17 @@ export type UserDataRightsOptions = {
    *  wenn der jeweilige send*Email-Opt NICHT gesetzt ist; Export-ready braucht
    *  zusaetzlich appExportDownloadUrl. */
   readonly mailDefaults?: GdprMailDefaults;
+  /** Hides the Art. 17 deletion section + its request-deletion/cancel-deletion
+   *  actions on the privacy-center screen — for apps that already offer
+   *  account deletion elsewhere (e.g. a profile danger-zone), against
+   *  duplication. Default `true` (deletion section shown).
+   *  BREAKING (fw#2312): replaces the removed client-side
+   *  `userDataRightsClient({ privacyCenter: { showDeletion } })` option —
+   *  the screen is now declared once, server-side (`type: "projectionDetail"`),
+   *  so per-app visibility can only be a boot-time option, not a client-side
+   *  component swap. Consumers that passed `showDeletion: false` client-side
+   *  must move it here. */
+  readonly privacyCenterShowDeletion?: boolean;
 };
 
 export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): FeatureDefinition {
@@ -139,6 +156,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
   // process, not every run). Lives in the factory scope so the cron closure
   // shares it across runs.
   let warnedMissingExportUrl = false;
+  const showDeletion = opts.privacyCenterShowDeletion ?? true;
   return defineFeature("user-data-rights", (r) => {
     r.describe(
       'Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion`, plus the anonymous email-verified `request-deletion-by-email` + `confirm-deletion-by-token` flow for lockout-safe self-service, + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` \u2192 ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, "<entity>", { export, delete })` \u2014 the feature then orchestrates the export and forget pipelines across all registered hooks automatically. When `mail-foundation` and a `mail-transport-*` are mounted, it also sends the four GDPR notifications (export ready/failed, deletion requested/executed) itself with no app callback code, rendered in each recipient’s locale. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.',
@@ -283,24 +301,105 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
 
     r.translations({ keys: USER_DATA_RIGHTS_I18N });
 
-    // Dormant self-service screen (Art. 15/17/18/20): export, activity log,
-    // restriction, deletion in one screen. No r.nav — the app places it in
-    // its logged-in area. The React component comes from userDataRightsClient()
-    // (web/) client-side. access is openToAll because no app role name is
-    // portable; the per-user handlers enforce auth server-side, and the
-    // screen is invisible without r.nav until the app actively links it in
-    // its authed area. dormant: true so createKumikoApp's boot diagnostic
-    // (#2025) doesn't flag apps that haven't (yet) navved the screen as
-    // having a missing client plugin (#2034).
-    // kumiko-lint-ignore app-feature-structure Phase-3 conversion tracked in #2312
+    // Self-service screen (Art. 15/17/18/20): export, restriction, deletion
+    // in one projectionDetail screen bound to the user's own `me` row. No
+    // r.nav — the app places it in its logged-in area (createKumikoApp's
+    // missing-client-plugin boot diagnostic (#2025/#2034) only scans
+    // type: "custom" screens, so a non-navved projectionDetail never
+    // triggers it — no `dormant` flag needed, that field doesn't exist on
+    // this screen type). access is openToAll because no app role name is
+    // portable; the per-user handlers enforce auth server-side.
+    //
+    // Restriction/Deletion are declarative fields + actions; Export stays a
+    // custom extension section (web/client-plugin.tsx registers the
+    // component under EXPORT_SECTION_EXTENSION_NAME) since it needs
+    // async-job polling + a signed-URL download that a declarative action
+    // can't express. entityName: "export-job" names the domain entity the
+    // extension persists against (projectionDetail has no real entity of
+    // its own for the extension to default to).
     r.screen({
       id: PRIVACY_CENTER_SCREEN_ID,
-      type: "custom",
-      renderer: { react: { __component: "PrivacyCenterScreen" } },
+      type: "projectionDetail",
+      query: USER_ME_QUERY,
+      singleton: true,
       access: { openToAll: true },
-      dormant: true,
       description:
         "Logged-in GDPR self-service page where a user requests and downloads a data export (Art. 20), restricts processing of their account (Art. 18) and requests its deletion (Art. 17).",
+      fieldLabels: {
+        status: "userDataRights.privacyCenter.field.status",
+        gracePeriodEnd: "userDataRights.privacyCenter.field.gracePeriodEnd",
+      },
+      layout: {
+        sections: [
+          {
+            kind: "extension",
+            title: "userDataRights.privacyCenter.export.title",
+            component: { react: { __component: EXPORT_SECTION_EXTENSION_NAME } },
+            entityName: "export-job",
+          },
+          {
+            // `status` lives here (not in Deletion) because this is the one
+            // section always on the screen — Deletion is dropped entirely
+            // when `showDeletion` is false, and status covers restriction
+            // AND deletion state, so it can't hang off the optional section.
+            title: "userDataRights.privacyCenter.restriction.title",
+            description: "userDataRights.privacyCenter.restriction.explainer",
+            fields: [
+              {
+                field: "status",
+                renderer: { format: "enumOption", keyPrefix: STATUS_OPTION_KEY_PREFIX },
+              },
+            ],
+          },
+          ...(showDeletion
+            ? [
+                {
+                  title: "userDataRights.privacyCenter.deletion.title",
+                  description: "userDataRights.privacyCenter.deletion.explainer",
+                  // gracePeriodEnd is only meaningful once a deletion is
+                  // actually pending — hide it instead of showing an empty
+                  // date when status isn't deletionRequested.
+                  fields: [
+                    {
+                      field: "gracePeriodEnd",
+                      renderer: { format: "date" as const },
+                      visible: { field: "status", eq: "deletionRequested" },
+                    },
+                  ],
+                },
+              ]
+            : []),
+        ],
+      },
+      actions: [
+        {
+          id: "restrict",
+          label: "userDataRights.privacyCenter.restriction.restrict",
+          handler: UserDataRightsHandlers.restrictAccount,
+          confirm: "userDataRights.privacyCenter.restriction.dialogDescription",
+          visible: { field: "status", ne: "restricted" },
+          style: "danger",
+        },
+        ...(showDeletion
+          ? [
+              {
+                id: "request-deletion",
+                label: "userDataRights.privacyCenter.deletion.delete",
+                handler: UserDataRightsHandlers.requestDeletion,
+                confirm: "userDataRights.privacyCenter.deletion.dialogDescription",
+                visible: { field: "status", ne: "deletionRequested" },
+                style: "danger" as const,
+              },
+              {
+                id: "cancel-deletion",
+                label: "userDataRights.privacyCenter.deletion.cancel",
+                handler: UserDataRightsHandlers.cancelDeletion,
+                visible: { field: "status", eq: "deletionRequested" },
+                style: "secondary" as const,
+              },
+            ]
+          : []),
+      ],
     });
 
     // Magic-link path (anonymous): the email link carries the token as a