@cosmicdrift/kumiko-bundled-features 0.401.0 → 0.403.0

package/dist/managed-pages/render-page-body.js

@@ -2,18 +2,55 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { renderSafeMarkdown } from "../page-render/index.js";
 import { sanitizeDocumentHtml } from "../template-resolver/index.js";
 const defaultLog = createFallbackLogger("managed-pages");
-// A document body is re-sanitized at render time even though writes validate it:
-// rows can predate the validation or arrive through other writers. A rejected
-// document renders as an empty body (never the raw HTML) and is logged.
-export function renderPageBody(page, log = defaultLog) {
-    if (page.bodyFormat === "markdown")
-        return renderSafeMarkdown(page.body);
-    const result = sanitizeDocumentHtml(page.body);
-    if (result.ok)
-        return result.html;
-    log.warn("managed page document body rejected at render, serving an empty body", {
-        slug: page.slug,
-        violations: result.violations.map((violation) => violation.code),
-    });
-    return "";
+const MAX_CACHED_BODIES = 500;
+// Bounds the cache memory: 500 entries of arbitrary size could otherwise pin
+// hundreds of MB. A bigger body is still served, just re-rendered per request.
+const MAX_CACHED_BODY_LENGTH = 256 * 1024;
+// Every write bumps the version, so a (page, version) key never serves stale
+// HTML. A Map keeps insertion order: delete+reinsert on a hit makes the first
+// key the least recently used one.
+function cacheKeyOf(page) {
+    return [page.tenantId, page.slug, page.lang, page.version, page.updatedAt, page.bodyFormat].join("\u0000");
 }
+// Writes store the rebuilt, sanitized HTML, but rows can predate that validation
+// or arrive through other writers, so a render still sanitizes — once per page
+// version instead of once per request. A rejected document renders as an empty
+// body (never the raw HTML), is logged on the miss, and the empty result is cached.
+export function createPageBodyRenderer(deps = {}) {
+    const sanitizeDocument = deps.sanitizeDocument ?? sanitizeDocumentHtml;
+    const renderMarkdown = deps.renderMarkdown ?? renderSafeMarkdown;
+    const maxEntries = deps.maxEntries ?? MAX_CACHED_BODIES;
+    const cache = new Map();
+    function renderUncached(page, log) {
+        if (page.bodyFormat === "markdown")
+            return renderMarkdown(page.body);
+        const result = sanitizeDocument(page.body);
+        if (result.ok)
+            return result.html;
+        log.warn("managed page document body rejected at render, serving an empty body", {
+            slug: page.slug,
+            violations: result.violations.map((violation) => violation.code),
+        });
+        return "";
+    }
+    return (page, log = defaultLog) => {
+        const key = cacheKeyOf(page);
+        const cached = cache.get(key);
+        if (cached !== undefined) {
+            cache.delete(key);
+            cache.set(key, cached);
+            return cached;
+        }
+        const html = renderUncached(page, log);
+        if (html.length > MAX_CACHED_BODY_LENGTH)
+            return html;
+        cache.set(key, html);
+        if (cache.size > maxEntries) {
+            const oldest = cache.keys().next();
+            if (!oldest.done)
+                cache.delete(oldest.value);
+        }
+        return html;
+    };
+}
+export const renderPageBody = createPageBodyRenderer();

package/dist/managed-pages/web/i18n.js

@@ -50,11 +50,10 @@ export const MANAGED_PAGES_I18N = {
     "managed-pages:body.lossy.warning": {
         en: "This page was written in Markdown. Converting it to the editor drops: {features}. Check the result before saving.",
     },
-    "managed-pages:body.lossy.image": { en: "images" },
+    "managed-pages:body.lossy.image": { en: "external images" },
     "managed-pages:body.lossy.blockquote": { en: "block quotes" },
     "managed-pages:body.lossy.code": { en: "code" },
     "managed-pages:body.lossy.deepHeading": { en: "headings below level 3" },
-    "managed-pages:body.lossy.relativeLink": { en: "relative links" },
     // Row-Actions + Confirm (pageListScreen)
     "managed-pages:actions.edit": { en: "Edit" },
     "managed-pages:actions.delete": { en: "Delete" },

package/dist/managed-pages/web/lossy-markdown.d.ts

@@ -1,3 +1,3 @@
-export declare const LOSSY_MARKDOWN_FEATURES: readonly ["image", "blockquote", "code", "deepHeading", "relativeLink"];
+export declare const LOSSY_MARKDOWN_FEATURES: readonly ["image", "blockquote", "code", "deepHeading"];
 export type LossyMarkdownFeature = (typeof LOSSY_MARKDOWN_FEATURES)[number];
 export declare function detectLossyMarkdown(markdown: string): readonly LossyMarkdownFeature[];

package/dist/managed-pages/web/lossy-markdown.js

@@ -1,15 +1,6 @@
-import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/template-resolver/document-schema";
 import { Lexer } from "marked";
-export const LOSSY_MARKDOWN_FEATURES = [
-    "image",
-    "blockquote",
-    "code",
-    "deepHeading",
-    "relativeLink",
-];
-// The document editor has no image, quote or code nodes, only three heading
-// levels, and links must pass the document link policy (absolute http(s),
-// mailto, tel, placeholders).
+export const LOSSY_MARKDOWN_FEATURES = ["image", "blockquote", "code", "deepHeading"];
+// The document editor has no image, quote or code nodes and only three heading levels.
 const MAX_DOCUMENT_HEADING_DEPTH = 3;
 function tokenList(value) {
     return Array.isArray(value) ? value : [];
@@ -23,9 +14,6 @@ function childTokens(token) {
 function isDeepHeading(token) {
     return ("depth" in token && typeof token.depth === "number" && token.depth > MAX_DOCUMENT_HEADING_DEPTH);
 }
-function isRelativeLink(token) {
-    return ("href" in token && typeof token.href === "string" && !isAllowedDocumentLinkHref(token.href));
-}
 function featuresOf(token) {
     switch (token.type) {
         case "image":
@@ -37,8 +25,6 @@ function featuresOf(token) {
             return ["code"];
         case "heading":
             return isDeepHeading(token) ? ["deepHeading"] : [];
-        case "link":
-            return isRelativeLink(token) ? ["relativeLink"] : [];
         default:
             return [];
     }

package/dist/managed-pages/web/markdown-to-document.js

@@ -2,8 +2,8 @@ import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/
 import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import { Marked } from "marked";
 // The server sanitizer rejects what it cannot keep, so the conversion drops it up front and the
-// lossy banner stays true: a link outside the document link policy keeps its text, an image
-// (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
+// lossy banner stays true: a link outside the document link policy keeps its text, an external
+// image (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
 const converter = new Marked({ gfm: false, breaks: false });
 converter.use({
     renderer: {

package/dist/managed-pages/web/page-body-section.js

@@ -10,7 +10,6 @@ const LOSSY_LABEL_KEYS = {
     blockquote: "managed-pages:body.lossy.blockquote",
     code: "managed-pages:body.lossy.code",
     deepHeading: "managed-pages:body.lossy.deepHeading",
-    relativeLink: "managed-pages:body.lossy.relativeLink",
 };
 const BODY_EDITOR_ID = "managed-pages-page-body";
 function stringValue(value) {

package/dist/readiness/handlers/run-list.query.js

@@ -18,7 +18,8 @@ export const runListQuery = defineQueryHandler({
             const { counts, outcome } = viewRun(run, query.user);
             return {
                 id: run.id,
-                requestedAt: run.requestedAt.toString(),
+                // Fixed width: pageRows sorts this as a string, and a trimmed fraction ("…20Z" vs "…20.001Z") sorts wrong.
+                requestedAt: run.requestedAt.toString({ fractionalSecondDigits: 6 }),
                 triggeredByUserId: run.triggeredByUserId,
                 triggeredByName: starterNames.get(run.triggeredByUserId) ?? run.triggeredByUserId,
                 status: run.status,

package/dist/readiness/run-view.d.ts

@@ -1,15 +1,13 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { type ResultCounts, type RunOutcome, type VisibleProbeResult } from "./visible-results.ts";
-type InstantLike = {
-    readonly toString: () => string;
-};
 export type RunRow = {
     readonly id: string;
     readonly status: string;
-    readonly requestedAt: InstantLike;
-    readonly startedAt: InstantLike | null;
-    readonly finishedAt: InstantLike | null;
+    readonly requestedAt: Temporal.Instant;
+    readonly startedAt: Temporal.Instant | null;
+    readonly finishedAt: Temporal.Instant | null;
     readonly triggeredByUserId: string;
     readonly durationMs: number | null;
     readonly results: unknown;
@@ -22,4 +20,3 @@ export type RunView = {
 export declare const HISTORY_LIMIT = 100;
 export declare function fetchLatestRun(db: TenantDb): Promise<RunRow | undefined>;
 export declare function viewRun(run: RunRow, user: SessionUser): RunView;
-export {};

package/dist/template-resolver/compile-document-body.js

@@ -2,7 +2,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { isResourceImageContentType } from "../shared/index.js";
 import { rewriteStepsBlock } from "./compile-steps-block.js";
 import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_TEXT_ALIGNMENTS, isAllowedDocumentUrlHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
 // Private-use characters mark where a Handlebars expression goes. Author text
 // is scrubbed of them first and every `{`/`}` is entity-encoded before the
 // markers are swapped for real expressions, so the only Handlebars syntax in
@@ -120,7 +120,7 @@ function rewriteLink(element, state) {
             element.setAttribute("href", "#");
         }
     }
-    else if (!isAllowedDocumentLinkHref(href)) {
+    else if (!isAllowedDocumentUrlHref(href)) {
         element.setAttribute("href", "#");
     }
 }

package/dist/template-resolver/document-sanitizer.js

@@ -2,7 +2,7 @@ import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { generateHTML, generateJSON } from "@tiptap/html/server";
 import { Window } from "happy-dom";
 import { DOCUMENT_HTML_KINDS } from "./web/constants.js";
-import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+import { DOCUMENT_CONDITION_ATTRIBUTE, documentExtensions, isAllowedDocumentLinkHref, isAllowedDocumentUrlHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
 import { isDocumentStepKey } from "./web/document-steps.js";
 export function violation(code, detail, message) {
     return { code, detail, message };
@@ -38,7 +38,7 @@ function scanScriptAndHandlers(tag, element, out) {
 function scanAnchor(element, out) {
     const href = element.getAttribute("href");
     if (href !== null && !isAllowedDocumentLinkHref(href)) {
-        out.push(violation("disallowed_link_href", href, `Link target "${href}" is not allowed; use https, http, mailto, tel or a {{placeholder}}`));
+        out.push(violation("disallowed_link_href", href, `Link target "${href}" is not allowed; use https, http, mailto, tel, a relative path or a {{placeholder}}`));
     }
     if (element.hasAttribute("data-button") && !isDocumentPlaceholderHref(href ?? "")) {
         out.push(violation("button_href_not_placeholder", href ?? "", `Button target "${href ?? ""}" must be a {{placeholder}}`));
@@ -96,7 +96,7 @@ function scanUrlAttributes(tag, element, out) {
         if (SVG_IMAGE_TAGS.has(tag) && name.endsWith("href")) {
             out.push(violation("external_image_source", value, `Images must reference an uploaded resource via data-resource; image source "${value}" is not allowed`));
         }
-        else if (tag === "base" || !isAllowedDocumentLinkHref(value)) {
+        else if (tag === "base" || !isAllowedDocumentUrlHref(value)) {
             out.push(violation("disallowed_link_href", value, `Link target "${value}" is not allowed; use https, http, mailto, tel or a {{placeholder}}`));
         }
     }

package/dist/template-resolver/index.d.ts

@@ -24,5 +24,5 @@ export { collectTemplateUsage, type TemplateUsageEntry } from "./template-usage.
 export { hasPlaceholderProblems, resolveTemplateVariables, SYSTEM_PLACEHOLDERS, systemPlaceholdersFor, type TemplateValidation, validateTemplatePlaceholders, } from "./template-validation.ts";
 export { type UserContentEntryRow, userContentEntriesTable, userContentEntryEntity, } from "./user-content-table.ts";
 export { CONTENT_FORMATS, type ContentFormat, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, type DocumentHtmlKind, FALLBACK_LOCALE, NON_RENDER_KINDS, type NonRenderKind, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, type PdfOrientation, type PdfPageFormat, RENDER_KINDS, type RenderKind, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, type TemplateKind, type TemplateScope, type TemplateStatus, UPSERT_KINDS, type UpsertKind, } from "./web/constants.ts";
-export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.ts";
+export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, type DocumentTextAlignment, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isAllowedDocumentUrlHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.ts";
 export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./web/qualified-names.ts";

package/dist/template-resolver/index.js

@@ -21,5 +21,5 @@ export { collectTemplateUsage } from "./template-usage.js";
 export { hasPlaceholderProblems, resolveTemplateVariables, SYSTEM_PLACEHOLDERS, systemPlaceholdersFor, validateTemplatePlaceholders, } from "./template-validation.js";
 export { userContentEntriesTable, userContentEntryEntity, } from "./user-content-table.js";
 export { CONTENT_FORMATS, DEFAULT_MAIL_LAYOUT_SLUG, DEFAULT_PDF_LAYOUT_SLUG, DOCUMENT_HTML_KINDS, FALLBACK_LOCALE, NON_RENDER_KINDS, PDF_DEFAULT_MARGIN_MM, PDF_FOOTER_MARGIN_MM, PDF_HEADER_MARGIN_MM, PDF_ORIENTATIONS, PDF_PAGE_FORMATS, RENDER_KINDS, SYSTEM_TENANT_ID, TEMPLATE_KINDS, TEMPLATE_SCOPES, TEMPLATE_STATUSES, TEXT_BLOCK_KIND, UPSERT_KINDS, } from "./web/constants.js";
-export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
+export { DOCUMENT_CONDITION_ATTRIBUTE, DOCUMENT_NODE_NAMES, DOCUMENT_TEXT_ALIGNMENTS, DocumentButton, DocumentCondition, DocumentDivider, DocumentLink, DocumentPageBreak, DocumentResource, DocumentTable, DocumentTableCell, DocumentTableHeader, DocumentTableRow, DocumentTextAlign, DocumentVariable, documentExtensions, isAllowedDocumentLinkHref, isAllowedDocumentUrlHref, isDocumentPlaceholderHref, isDocumentReferenceName, isDocumentResourceKey, } from "./web/document-schema.js";
 export { TEMPLATE_RESOLVER_FEATURE, TemplateResolverErrors, TemplateResolverHandlers, TemplateResolverQueries, } from "./web/qualified-names.js";

package/dist/template-resolver/web/document-schema.d.ts

@@ -2,6 +2,7 @@ import { Extension, type Extensions, Node } from "@tiptap/core";
 import { isDocumentReferenceName } from "./document-reference-name.ts";
 export { isDocumentReferenceName };
 export declare function isDocumentPlaceholderHref(href: string): boolean;
+export declare function isAllowedDocumentUrlHref(href: string): boolean;
 export declare function isAllowedDocumentLinkHref(href: string): boolean;
 export declare function isDocumentResourceKey(value: string): boolean;
 export declare const DOCUMENT_NODE_NAMES: readonly ["variable", "resource", "button", "divider", "pageBreak", "steps", "images"];

package/dist/template-resolver/web/document-schema.js

@@ -40,15 +40,30 @@ function hasAllowedLinkScheme(href) {
         return isParsableWebUrl(href, "http:");
     return ALLOWED_LINK_SCHEMES.some((scheme) => href.startsWith(scheme));
 }
+// Relative references are matched by their literal leading character so a
+// scheme can never hide in them: a value starting with a letter ("x:y",
+// "javascript:") is not relative. Protocol-relative "//host" and any backslash
+// (browsers read "/\\host" as "//host") would leave the site.
+const RELATIVE_HREF_PREFIXES = ["/", "./", "../", "#", "?"];
+function isRelativeHref(href) {
+    if (href.includes("\\") || href.startsWith("//"))
+        return false;
+    return RELATIVE_HREF_PREFIXES.some((prefix) => href.startsWith(prefix));
+}
 // Exact lowercase prefix on the unchanged value: no trim, no case folding, so
 // "JaVaScRiPt:", "HTTPS://" or a leading tab can never slip through as a
 // scheme variant. Markup and control characters are refused outright because
 // downstream parsers (MJML, PDF renderer) re-read the serialized attribute.
-export function isAllowedDocumentLinkHref(href) {
+export function isAllowedDocumentUrlHref(href) {
     if (hasUnsafeUrlCharacter(href))
         return false;
     return hasAllowedLinkScheme(href) || isDocumentPlaceholderHref(href);
 }
+// Anchors only: other URL attributes (form action, svg href) resolve against the
+// page and must stay on explicit schemes or placeholders.
+export function isAllowedDocumentLinkHref(href) {
+    return isAllowedDocumentUrlHref(href) || (!hasUnsafeUrlCharacter(href) && isRelativeHref(href));
+}
 export function isDocumentResourceKey(value) {
     return RESOURCE_KEY.test(value);
 }

package/dist/template-resolver/web/i18n.js

@@ -18,7 +18,7 @@ export const defaultTranslations = {
         "template-resolver.documentEditor.insert": "Insert",
         "template-resolver.documentEditor.insertPlaceholder": "Placeholder",
         "template-resolver.documentEditor.invalidImageAlt": "The alt text must not contain < or >.",
-        "template-resolver.documentEditor.invalidLink": "This link target is not allowed. Use https, http, mailto, tel or a placeholder.",
+        "template-resolver.documentEditor.invalidLink": "This link target is not allowed. Use https, http, mailto, tel, a relative path or a placeholder.",
         "template-resolver.documentEditor.invalidResourceKey": "This resource key is not valid.",
         "template-resolver.documentEditor.link": "Link",
         "template-resolver.documentEditor.linkHref": "Link target",
@@ -55,7 +55,7 @@ export const defaultTranslations = {
         "template-resolver.editor.saved": "Saved.",
         "templateResolver.errors.document.imagesBlockPdfOnly": "Photo blocks are only allowed in PDF documents.",
         "templateResolver.errors.document.buttonHrefNotPlaceholder": "The button target “{detail}” must be a placeholder.",
-        "templateResolver.errors.document.disallowedLinkHref": "Link target “{detail}” is not allowed; use https, http, mailto, tel or a placeholder.",
+        "templateResolver.errors.document.disallowedLinkHref": "Link target “{detail}” is not allowed; use https, http, mailto, tel, a relative path or a placeholder.",
         "templateResolver.errors.document.documentRequiresHtmlFormat": "This template kind requires the html format, got “{detail}”.",
         "templateResolver.errors.document.layoutRequiresMjmlFormat": "Mail layouts require the mjml format, got “{detail}”.",
         "templateResolver.errors.document.layoutInvalidStructure": "The layout may only contain the header, content, signature and footer regions: {detail}.",

package/dist/template-resolver/web/use-collection-entry-create.js

@@ -26,9 +26,10 @@ export function useCollectionEntryCreate(target, tenantId) {
     const [content, setContent] = useState("");
     const slugValid = slug.length <= SLUG_MAX_LENGTH && SLUG_PATTERN.test(slug);
     const disabled = submitting || !canWrite || collectionId === undefined;
-    const headerTitle = t("template-resolver.editor.newEntryTitle", {
-        label: collection !== undefined ? t(collection.nav.label) : "",
-    });
+    const entryLabel = collection?.nav.entryLabel;
+    const headerTitle = entryLabel !== undefined
+        ? t("template-resolver.editor.newEntryTitle", { label: t(entryLabel) })
+        : t("template-resolver.editor.newEntry");
     const create = async () => {
         // skip: nothing to write to, or the slug is invalid (the field already shows the issue)
         if (collectionId === undefined || !slugValid)

package/dist/user-data-rights/boot-checks.js

@@ -1,5 +1,6 @@
-import { EXT_USER_DATA, } from "@cosmicdrift/kumiko-framework/engine";
+import { bootRuleError, collectBootRuleViolations, EXT_USER_DATA, } from "@cosmicdrift/kumiko-framework/engine";
 import { entitiesOf } from "../shared/index.js";
+import { USER_DATA_RIGHTS_BOOT_RULES } from "./boot-rules.js";
 // V2: export-without-erase gate. A feature that registers an EXT_USER_DATA
 // export hook without a matching delete hook exports data under Art.20 but
 // never erases it on forget — an Art.17 violation. Hard boot failure: no app
@@ -14,22 +15,25 @@ import { entitiesOf } from "../shared/index.js";
 // fails otherwise); running this from user-data-rights' own bootCheck is
 // equivalent to the framework-internal call it replaces.
 export function validateGdprHookCompleteness(features) {
-    for (const feature of features) {
-        for (const usage of feature.extensionUsages) {
-            if (usage.extensionName !== EXT_USER_DATA)
-                continue;
-            const hasExport = typeof usage.options?.["export"] === "function";
-            const hasDelete = typeof usage.options?.["delete"] === "function";
-            // The compile-time "at least one hook" type is bypassed by string-typed
-            // extension names and casts; without this an empty bag registers nothing.
-            if (!hasExport && !hasDelete) {
-                throw new Error(`[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`);
-            }
-            if (hasExport && !hasDelete) {
-                throw new Error(`[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`);
-            }
+    const usages = features.flatMap((feature) => feature.extensionUsages
+        .filter((usage) => usage.extensionName === EXT_USER_DATA)
+        .map((usage) => ({ feature, usage })));
+    collectBootRuleViolations(usages, ({ feature, usage }) => {
+        const hasExport = typeof usage.options?.["export"] === "function";
+        const hasDelete = typeof usage.options?.["delete"] === "function";
+        // The compile-time "at least one hook" type is bypassed by string-typed
+        // extension names and casts; without this an empty bag registers nothing.
+        if (!hasExport && !hasDelete) {
+            throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.emptyHook, {
+                message: `[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`,
+            });
         }
-    }
+        if (hasExport && !hasDelete) {
+            throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.exportWithoutDelete, {
+                message: `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
+            });
+        }
+    });
 }
 // V3: PII-entity-without-hook gate. V2 checks registered hooks for
 // completeness; V3 catches the entity nobody registered at all — fields
@@ -51,19 +55,22 @@ export function validateGdprPiiHookCoverage(features) {
                 hookedEntities.add(usage.entityName);
         }
     }
-    for (const feature of features) {
-        for (const [entityName, entity] of entitiesOf(feature)) {
-            if (hookedEntities.has(entityName))
-                continue;
-            const subjectFields = Object.entries(entity.fields)
-                .filter(([, field]) => {
-                const annot = field; // @cast-boundary schema-walk
-                return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
-            })
-                .map(([name]) => name);
-            if (subjectFields.length === 0)
-                continue;
-            throw new Error(`[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`);
-        }
-    }
+    const entities = features.flatMap((feature) => [...entitiesOf(feature)].map(([entityName, entity]) => ({ feature, entityName, entity })));
+    collectBootRuleViolations(entities, ({ feature, entityName, entity }) => {
+        // skip: an entity with a registered hook is covered
+        if (hookedEntities.has(entityName))
+            return;
+        const subjectFields = Object.entries(entity.fields)
+            .filter(([, field]) => {
+            const annot = field; // @cast-boundary schema-walk
+            return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
+        })
+            .map(([name]) => name);
+        // skip: an entity without user-subject fields stays out of the pipeline by design
+        if (subjectFields.length === 0)
+            return;
+        throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.missingHook, {
+            message: `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
+        });
+    });
 }

package/dist/user-data-rights/boot-rules.d.ts

@@ -0,0 +1,17 @@
+export declare const USER_DATA_RIGHTS_BOOT_RULES: {
+    readonly emptyHook: {
+        readonly id: "user-data-rights/empty-hook";
+        readonly summary: "An EXT_USER_DATA registration declares at least one of an export or a delete hook.";
+        readonly fix: "Register at least one hook.";
+    };
+    readonly exportWithoutDelete: {
+        readonly id: "user-data-rights/export-without-delete";
+        readonly summary: "An entity exported via EXT_USER_DATA also registers a delete hook.";
+        readonly fix: "Add a delete hook, or a documented no-op delete if erasure is handled elsewhere.";
+    };
+    readonly missingHook: {
+        readonly id: "user-data-rights/missing-hook";
+        readonly summary: "An entity with user-subject fields registers an EXT_USER_DATA hook.";
+        readonly fix: "Register r.useExtension(EXT_USER_DATA, ...) for the entity, or a documented no-op hook if it is covered elsewhere.";
+    };
+};

package/dist/user-data-rights/boot-rules.js

@@ -0,0 +1,17 @@
+export const USER_DATA_RIGHTS_BOOT_RULES = {
+    emptyHook: {
+        id: "user-data-rights/empty-hook",
+        summary: "An EXT_USER_DATA registration declares at least one of an export or a delete hook.",
+        fix: "Register at least one hook.",
+    },
+    exportWithoutDelete: {
+        id: "user-data-rights/export-without-delete",
+        summary: "An entity exported via EXT_USER_DATA also registers a delete hook.",
+        fix: "Add a delete hook, or a documented no-op delete if erasure is handled elsewhere.",
+    },
+    missingHook: {
+        id: "user-data-rights/missing-hook",
+        summary: "An entity with user-subject fields registers an EXT_USER_DATA hook.",
+        fix: "Register r.useExtension(EXT_USER_DATA, ...) for the entity, or a documented no-op hook if it is covered elsewhere.",
+    },
+};

package/dist/user-data-rights/web/request-deletion-screen.js

@@ -46,7 +46,7 @@ export function RequestAccountDeletionScreen({ title, }) {
         // kumiko-lint-ignore primitives-discipline narrow centered confirmation card, not a screen container
         className: "w-full max-w-sm mx-auto", options: { padded: false }, slots: {
             header: (_jsx("div", { className: "flex flex-col space-y-1.5 p-6 pb-4", children: _jsx("h1", { className: "text-xl font-semibold tracking-tight", children: title ?? t("userDataRights.deletion.request.title") }) })),
-        }, children: done ? (_jsx("div", { className: "p-6 pt-0", children: _jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("userDataRights.deletion.request.successTitle") }), _jsx("p", { className: "mt-1", children: t("userDataRights.deletion.request.successBody") })] }) })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("userDataRights.deletion.request.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "delete-email", label: t("userDataRights.deletion.request.email"), required: true, children: _jsx(Input, { kind: "text", id: "delete-email", name: "delete-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
-                                ? t("userDataRights.deletion.request.submitting")
-                                : t("userDataRights.deletion.request.submit") })] })] })) }));
+        }, children: done ? (_jsx("div", { className: "p-6 pt-0", children: _jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("userDataRights.deletion.request.successTitle") }), _jsx("p", { className: "mt-1", children: t("userDataRights.deletion.request.successBody") })] }) })) : (_jsxs("div", { className: "p-6 pt-0 flex flex-col gap-4", children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("userDataRights.deletion.request.intro") }), _jsx(Form, { chromeless: true, onSubmit: onSubmit, children: _jsxs("div", { className: "flex flex-col gap-4", children: [_jsx(Field, { id: "delete-email", label: t("userDataRights.deletion.request.email"), required: true, children: _jsx(Input, { kind: "text", id: "delete-email", name: "delete-email", value: email, onChange: setEmail, disabled: submitting, required: true }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting
+                                    ? t("userDataRights.deletion.request.submitting")
+                                    : t("userDataRights.deletion.request.submit") })] }) })] })) }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.401.0",
+  "version": "0.403.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -570,9 +570,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.401.0",
-    "@cosmicdrift/kumiko-renderer": "0.401.0",
-    "@cosmicdrift/kumiko-types": "0.401.0",
+    "@cosmicdrift/kumiko-framework": "0.403.0",
+    "@cosmicdrift/kumiko-renderer": "0.403.0",
+    "@cosmicdrift/kumiko-types": "0.403.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "^3.31.3",
@@ -1166,17 +1166,17 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.8",
-    "@cosmicdrift/kumiko-locale-de": "0.401.0",
-    "@cosmicdrift/kumiko-locale-es": "0.401.0",
-    "@cosmicdrift/kumiko-locale-fr": "0.401.0",
-    "@cosmicdrift/kumiko-locale-it": "0.401.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.401.0",
+    "@cosmicdrift/kumiko-locale-de": "0.403.0",
+    "@cosmicdrift/kumiko-locale-es": "0.403.0",
+    "@cosmicdrift/kumiko-locale-fr": "0.403.0",
+    "@cosmicdrift/kumiko-locale-it": "0.403.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.403.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.401.0"
+    "@cosmicdrift/kumiko-testing": "0.403.0"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.401.0"
+    "@cosmicdrift/kumiko-testing": "0.403.0"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/src/agent-tools/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "breaking",
+    "title": "Agent manifest labels are one string in the requested locale",
+    "detail": "`buildAgentManifest` used to emit every label in every locale (`labels: { de, en, es }`, often `{}`), although the caller names one `locale`. Entities, fields, navs and workspaces now carry `label?: string`, screens `title?: string`, picked in the requested locale, then English, then the first other locale, and left out when untranslated. Empty `params` and `workspaces` on screens, empty `workspaces` on navs and an empty handler `description` are left out as well (`description`, `params` and `workspaces` are optional in the types). `buildToolCatalog` reads the new fields.",
+    "migration": "Read `entity.label`, `field.label`, `nav.label`, `workspace.label` and `screen.title` instead of the `labels`/`titles` maps. Code that only passes the manifest to `buildToolCatalog` or serialises it needs no change."
+  },
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Agent manifest shows only the first sentence of a feature description",
+    "detail": "`buildAgentManifest` emits the first sentence of `FeatureDefinition.description` (a `. ` before a capital letter ends it, so \"e.g.\" and \"Art. 15\" stay whole), at most 300 characters. The full text stays on the definition for the docs generators. In an app with 77 features the descriptions drop from about 46.6k to 12.2k characters."
+  },
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Agent manifest features and entities follow the role",
+    "detail": "`buildAgentManifest` now leaves out a feature when none of its handlers, screens or navs remain in the manifest for the role, and an entity when no remaining handler or screen refers to it, no `get_`/`list_` tool of the role reads it and no reachable entity points at it through a reference field (one hop). Before, `features` and `entities` were identical for every role, so a restricted role paid for schemas it could not use in every system prompt. A translation-only feature such as `locale-de` no longer appears in `features`."
+  },
   {
     "version": "0.389.0",
     "type": "improvement",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "breaking",
+    "title": "The inbound mail supervisor requires a lock and the dedup anchor is unique",
+    "detail": "`createInboundMailSupervisor` takes a required `lock` (a DistributedLock) instead of an optional one, so only one worker holds the IMAP watch per account; the single-process path without a lock is gone. The unmanaged table store_mail_seen_messages gets a unique index on (account_id, provider_message_id), which the ingest comment always promised; ingest-message already serialized concurrent ingests of one mail with a per-message advisory lock, so the second one reports duplicate.",
+    "migration": "Pass `lock: createDistributedLock(redis, \"kumiko:lock:inbound-mail:watch:\")` to createInboundMailSupervisor. Run `kumiko-schema generate <name>` in each app that mounts inbound-mail-foundation to get the migration for the unique index on store_mail_seen_messages; existing rows must hold no duplicate (account_id, provider_message_id)."
+  },
   {
     "version": "0.394.0",
     "type": "improvement",

package/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "The public render caches a sanitized document body per page version",
+    "detail": "The render cache holds up to 500 entries keyed on tenant, slug, language, version and format. Bodies larger than 256 KB are sanitized on every render and not cached."
+  },
   {
     "version": "0.395.0",
     "type": "breaking",

package/src/readiness/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "fix",
+    "title": "System-check history keeps runs of the same second in order",
+    "detail": "`probe-run:list` returned `requestedAt` as `Instant.toString()`, which drops trailing zeros in the fraction, and `pageRows` sorts that field as a string. Two runs in the same second could then come out reversed (`…:20Z` sorted after `…:20.001Z`), so the history showed the older run on top and a click opened it. `requestedAt` now always carries six fractional digits, so string order matches time order."
+  },
   {
     "version": "0.392.0",
     "type": "improvement",

package/src/template-resolver/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Document anchors accept relative links",
+    "detail": "An anchor href in a document body may be relative (/path, ./, ../, #, ?); never // or a backslash. Other URL attributes (image src and similar) and mail links still accept only explicit schemes or placeholders. The sanitizer, the editor schema, compileDocumentBody and the confirmation mail use the same split."
+  },
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Collection nav takes entryLabel for the create title",
+    "detail": "A collection's nav takes an optional entryLabel (singular i18n key, new in the nav type and in the required surface keys of all locale packages). The create screen title reads \"New {label}\", or \"New entry\" without it."
+  },
   {
     "version": "0.395.0",
     "type": "breaking",