@cosmicdrift/kumiko-bundled-features 0.400.0 → 0.402.0

package/dist/user-data-rights/boot-checks.js

@@ -1,5 +1,6 @@
-import { EXT_USER_DATA, } from "@cosmicdrift/kumiko-framework/engine";
+import { bootRuleError, collectBootRuleViolations, EXT_USER_DATA, } from "@cosmicdrift/kumiko-framework/engine";
 import { entitiesOf } from "../shared/index.js";
+import { USER_DATA_RIGHTS_BOOT_RULES } from "./boot-rules.js";
 // V2: export-without-erase gate. A feature that registers an EXT_USER_DATA
 // export hook without a matching delete hook exports data under Art.20 but
 // never erases it on forget — an Art.17 violation. Hard boot failure: no app
@@ -14,22 +15,25 @@ import { entitiesOf } from "../shared/index.js";
 // fails otherwise); running this from user-data-rights' own bootCheck is
 // equivalent to the framework-internal call it replaces.
 export function validateGdprHookCompleteness(features) {
-    for (const feature of features) {
-        for (const usage of feature.extensionUsages) {
-            if (usage.extensionName !== EXT_USER_DATA)
-                continue;
-            const hasExport = typeof usage.options?.["export"] === "function";
-            const hasDelete = typeof usage.options?.["delete"] === "function";
-            // The compile-time "at least one hook" type is bypassed by string-typed
-            // extension names and casts; without this an empty bag registers nothing.
-            if (!hasExport && !hasDelete) {
-                throw new Error(`[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`);
-            }
-            if (hasExport && !hasDelete) {
-                throw new Error(`[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`);
-            }
+    const usages = features.flatMap((feature) => feature.extensionUsages
+        .filter((usage) => usage.extensionName === EXT_USER_DATA)
+        .map((usage) => ({ feature, usage })));
+    collectBootRuleViolations(usages, ({ feature, usage }) => {
+        const hasExport = typeof usage.options?.["export"] === "function";
+        const hasDelete = typeof usage.options?.["delete"] === "function";
+        // The compile-time "at least one hook" type is bypassed by string-typed
+        // extension names and casts; without this an empty bag registers nothing.
+        if (!hasExport && !hasDelete) {
+            throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.emptyHook, {
+                message: `[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`,
+            });
         }
-    }
+        if (hasExport && !hasDelete) {
+            throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.exportWithoutDelete, {
+                message: `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
+            });
+        }
+    });
 }
 // V3: PII-entity-without-hook gate. V2 checks registered hooks for
 // completeness; V3 catches the entity nobody registered at all — fields
@@ -51,19 +55,22 @@ export function validateGdprPiiHookCoverage(features) {
                 hookedEntities.add(usage.entityName);
         }
     }
-    for (const feature of features) {
-        for (const [entityName, entity] of entitiesOf(feature)) {
-            if (hookedEntities.has(entityName))
-                continue;
-            const subjectFields = Object.entries(entity.fields)
-                .filter(([, field]) => {
-                const annot = field; // @cast-boundary schema-walk
-                return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
-            })
-                .map(([name]) => name);
-            if (subjectFields.length === 0)
-                continue;
-            throw new Error(`[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`);
-        }
-    }
+    const entities = features.flatMap((feature) => [...entitiesOf(feature)].map(([entityName, entity]) => ({ feature, entityName, entity })));
+    collectBootRuleViolations(entities, ({ feature, entityName, entity }) => {
+        // skip: an entity with a registered hook is covered
+        if (hookedEntities.has(entityName))
+            return;
+        const subjectFields = Object.entries(entity.fields)
+            .filter(([, field]) => {
+            const annot = field; // @cast-boundary schema-walk
+            return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
+        })
+            .map(([name]) => name);
+        // skip: an entity without user-subject fields stays out of the pipeline by design
+        if (subjectFields.length === 0)
+            return;
+        throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.missingHook, {
+            message: `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
+        });
+    });
 }

package/dist/user-data-rights/boot-rules.d.ts

@@ -0,0 +1,17 @@
+export declare const USER_DATA_RIGHTS_BOOT_RULES: {
+    readonly emptyHook: {
+        readonly id: "user-data-rights/empty-hook";
+        readonly summary: "An EXT_USER_DATA registration declares at least one of an export or a delete hook.";
+        readonly fix: "Register at least one hook.";
+    };
+    readonly exportWithoutDelete: {
+        readonly id: "user-data-rights/export-without-delete";
+        readonly summary: "An entity exported via EXT_USER_DATA also registers a delete hook.";
+        readonly fix: "Add a delete hook, or a documented no-op delete if erasure is handled elsewhere.";
+    };
+    readonly missingHook: {
+        readonly id: "user-data-rights/missing-hook";
+        readonly summary: "An entity with user-subject fields registers an EXT_USER_DATA hook.";
+        readonly fix: "Register r.useExtension(EXT_USER_DATA, ...) for the entity, or a documented no-op hook if it is covered elsewhere.";
+    };
+};

package/dist/user-data-rights/boot-rules.js

@@ -0,0 +1,17 @@
+export const USER_DATA_RIGHTS_BOOT_RULES = {
+    emptyHook: {
+        id: "user-data-rights/empty-hook",
+        summary: "An EXT_USER_DATA registration declares at least one of an export or a delete hook.",
+        fix: "Register at least one hook.",
+    },
+    exportWithoutDelete: {
+        id: "user-data-rights/export-without-delete",
+        summary: "An entity exported via EXT_USER_DATA also registers a delete hook.",
+        fix: "Add a delete hook, or a documented no-op delete if erasure is handled elsewhere.",
+    },
+    missingHook: {
+        id: "user-data-rights/missing-hook",
+        summary: "An entity with user-subject fields registers an EXT_USER_DATA hook.",
+        fix: "Register r.useExtension(EXT_USER_DATA, ...) for the entity, or a documented no-op hook if it is covered elsewhere.",
+    },
+};

package/dist/user-data-rights/web/i18n.js

@@ -17,6 +17,10 @@ export const USER_DATA_RIGHTS_I18N = {
     },
     "user-data-rights:entity:export-job:field:userId": { en: "User" },
     "user-data-rights:entity:export-job:field:status": { en: "Status" },
+    "user-data-rights:entity:export-job:field:status:option:pending": { en: "Pending" },
+    "user-data-rights:entity:export-job:field:status:option:running": { en: "Running" },
+    "user-data-rights:entity:export-job:field:status:option:done": { en: "Done" },
+    "user-data-rights:entity:export-job:field:status:option:failed": { en: "Failed" },
     "user-data-rights:entity:export-job:field:requestedAt": { en: "Requested" },
     "user-data-rights:entity:export-job:field:completedAt": { en: "Completed" },
     "user-data-rights:entity:export-job:field:expiresAt": { en: "Expires" },

package/dist/user-data-rights/web/request-deletion-screen.js

@@ -46,7 +46,7 @@ export function RequestAccountDeletionScreen({ title, }) {
         // kumiko-lint-ignore primitives-discipline narrow centered confirmation card, not a screen container
         className: "w-full max-w-sm mx-auto", options: { padded: false }, slots: {
             header: (_jsx("div", { className: "flex flex-col space-y-1.5 p-6 pb-4", children: _jsx("h1", { className: "text-xl font-semibold tracking-tight", children: title ?? t("userDataRights.deletion.request.title") }) })),
-        }, children: done ? (_jsx("div", { className: "p-6 pt-0", children: _jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("userDataRights.deletion.request.successTitle") }), _jsx("p", { className: "mt-1", children: t("userDataRights.deletion.request.successBody") })] }) })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("userDataRights.deletion.request.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "delete-email", label: t("userDataRights.deletion.request.email"), required: true, children: _jsx(Input, { kind: "text", id: "delete-email", name: "delete-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
-                                ? t("userDataRights.deletion.request.submitting")
-                                : t("userDataRights.deletion.request.submit") })] })] })) }));
+        }, children: done ? (_jsx("div", { className: "p-6 pt-0", children: _jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("userDataRights.deletion.request.successTitle") }), _jsx("p", { className: "mt-1", children: t("userDataRights.deletion.request.successBody") })] }) })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("userDataRights.deletion.request.intro") }), _jsx(Form, { chromeless: true, onSubmit: onSubmit, children: _jsxs("div", { className: "flex flex-col gap-4", children: [_jsx(Field, { id: "delete-email", label: t("userDataRights.deletion.request.email"), required: true, children: _jsx(Input, { kind: "text", id: "delete-email", name: "delete-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
+                                    ? t("userDataRights.deletion.request.submitting")
+                                    : t("userDataRights.deletion.request.submit") })] }) })] })) }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.400.0",
+  "version": "0.402.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -570,9 +570,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.400.0",
-    "@cosmicdrift/kumiko-renderer": "0.400.0",
-    "@cosmicdrift/kumiko-types": "0.400.0",
+    "@cosmicdrift/kumiko-framework": "0.402.0",
+    "@cosmicdrift/kumiko-renderer": "0.402.0",
+    "@cosmicdrift/kumiko-types": "0.402.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "^3.31.3",
@@ -1166,17 +1166,17 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.8",
-    "@cosmicdrift/kumiko-locale-de": "0.400.0",
-    "@cosmicdrift/kumiko-locale-es": "0.400.0",
-    "@cosmicdrift/kumiko-locale-fr": "0.400.0",
-    "@cosmicdrift/kumiko-locale-it": "0.400.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.400.0",
+    "@cosmicdrift/kumiko-locale-de": "0.402.0",
+    "@cosmicdrift/kumiko-locale-es": "0.402.0",
+    "@cosmicdrift/kumiko-locale-fr": "0.402.0",
+    "@cosmicdrift/kumiko-locale-it": "0.402.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.402.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.400.0"
+    "@cosmicdrift/kumiko-testing": "0.402.0"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.400.0"
+    "@cosmicdrift/kumiko-testing": "0.402.0"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/src/agent-tools/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "breaking",
+    "title": "Agent manifest labels are one string in the requested locale",
+    "detail": "`buildAgentManifest` used to emit every label in every locale (`labels: { de, en, es }`, often `{}`), although the caller names one `locale`. Entities, fields, navs and workspaces now carry `label?: string`, screens `title?: string`, picked in the requested locale, then English, then the first other locale, and left out when untranslated. Empty `params` and `workspaces` on screens, empty `workspaces` on navs and an empty handler `description` are left out as well (`description`, `params` and `workspaces` are optional in the types). `buildToolCatalog` reads the new fields.",
+    "migration": "Read `entity.label`, `field.label`, `nav.label`, `workspace.label` and `screen.title` instead of the `labels`/`titles` maps. Code that only passes the manifest to `buildToolCatalog` or serialises it needs no change."
+  },
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Agent manifest shows only the first sentence of a feature description",
+    "detail": "`buildAgentManifest` emits the first sentence of `FeatureDefinition.description` (a `. ` before a capital letter ends it, so \"e.g.\" and \"Art. 15\" stay whole), at most 300 characters. The full text stays on the definition for the docs generators. In an app with 77 features the descriptions drop from about 46.6k to 12.2k characters."
+  },
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Agent manifest features and entities follow the role",
+    "detail": "`buildAgentManifest` now leaves out a feature when none of its handlers, screens or navs remain in the manifest for the role, and an entity when no remaining handler or screen refers to it, no `get_`/`list_` tool of the role reads it and no reachable entity points at it through a reference field (one hop). Before, `features` and `entities` were identical for every role, so a restricted role paid for schemas it could not use in every system prompt. A translation-only feature such as `locale-de` no longer appears in `features`."
+  },
   {
     "version": "0.389.0",
     "type": "improvement",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "breaking",
+    "title": "The inbound mail supervisor requires a lock and the dedup anchor is unique",
+    "detail": "`createInboundMailSupervisor` takes a required `lock` (a DistributedLock) instead of an optional one, so only one worker holds the IMAP watch per account; the single-process path without a lock is gone. The unmanaged table store_mail_seen_messages gets a unique index on (account_id, provider_message_id), which the ingest comment always promised; ingest-message already serialized concurrent ingests of one mail with a per-message advisory lock, so the second one reports duplicate.",
+    "migration": "Pass `lock: createDistributedLock(redis, \"kumiko:lock:inbound-mail:watch:\")` to createInboundMailSupervisor. Run `kumiko-schema generate <name>` in each app that mounts inbound-mail-foundation to get the migration for the unique index on store_mail_seen_messages; existing rows must hold no duplicate (account_id, provider_message_id)."
+  },
   {
     "version": "0.394.0",
     "type": "improvement",

package/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "The public render caches a sanitized document body per page version",
+    "detail": "The render cache holds up to 500 entries keyed on tenant, slug, language, version and format. Bodies larger than 256 KB are sanitized on every render and not cached."
+  },
   {
     "version": "0.395.0",
     "type": "breaking",

package/src/readiness/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "fix",
+    "title": "System-check history keeps runs of the same second in order",
+    "detail": "`probe-run:list` returned `requestedAt` as `Instant.toString()`, which drops trailing zeros in the fraction, and `pageRows` sorts that field as a string. Two runs in the same second could then come out reversed (`…:20Z` sorted after `…:20.001Z`), so the history showed the older run on top and a click opened it. `requestedAt` now always carries six fractional digits, so string order matches time order."
+  },
   {
     "version": "0.392.0",
     "type": "improvement",

package/src/template-resolver/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Document anchors accept relative links",
+    "detail": "An anchor href in a document body may be relative (/path, ./, ../, #, ?); never // or a backslash. Other URL attributes (image src and similar) and mail links still accept only explicit schemes or placeholders. The sanitizer, the editor schema, compileDocumentBody and the confirmation mail use the same split."
+  },
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Collection nav takes entryLabel for the create title",
+    "detail": "A collection's nav takes an optional entryLabel (singular i18n key, new in the nav type and in the required surface keys of all locale packages). The create screen title reads \"New {label}\", or \"New entry\" without it."
+  },
   {
     "version": "0.395.0",
     "type": "breaking",

package/src/user-data-rights/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "user-data-rights boot checks report rule ids",
+    "detail": "The bootChecks of user-data-rights report `user-data-rights/empty-hook`, `user-data-rights/export-without-delete` and `user-data-rights/missing-hook` with a fix, and list every missing or empty hook of a run instead of stopping at the first. Message texts are unchanged."
+  },
+  {
+    "version": "0.402.0",
+    "type": "fix",
+    "title": "request-deletion-screen shows one deletion card",
+    "detail": "The request form no longer draws its own card inside the screen's card, so the screen shows one deletion card."
+  },
   {
     "version": "0.390.0",
     "type": "fix",