@cosmicdrift/kumiko-framework 0.158.2 → 0.159.1

package/src/db/queries/event-consumer.ts

@@ -47,6 +47,7 @@ export type ConsumerDeliveryOutcome = {
   readonly attempts: number;
   readonly lastError: string | null;
   readonly deadLettered: boolean;
+  readonly processed: number;
 };
 
 export async function updateConsumerDeliveryOutcome(
@@ -55,19 +56,26 @@ export async function updateConsumerDeliveryOutcome(
   instanceId: string,
   outcome: ConsumerDeliveryOutcome,
 ): Promise<void> {
+  // Advancing the cursor proves this pass wasn't poison — reset the re-arm
+  // budget so an unrelated failure down the line gets its own fresh 3
+  // chances instead of inheriting a partially-spent counter from a past,
+  // already-resolved outage.
+  const resetRearmCount = outcome.processed > 0;
   await asRawClient(db).unsafe(
     `UPDATE "kumiko_event_consumers" SET
        "last_processed_event_id" = $1,
        "attempts" = $2,
        "status" = $3,
        "last_error" = $4,
+       "rearm_count" = CASE WHEN $5 THEN 0 ELSE "rearm_count" END,
        "updated_at" = now()
-     WHERE "name" = $5 AND "instance_id" = $6`,
+     WHERE "name" = $6 AND "instance_id" = $7`,
     [
       outcome.cursor,
       outcome.attempts,
       outcome.deadLettered ? "dead" : "idle",
       outcome.lastError,
+      resetRearmCount,
       name,
       instanceId,
     ],
@@ -81,7 +89,7 @@ export async function updateConsumerStatusReturning(
   status: "idle" | "disabled",
 ): Promise<Record<string, unknown> | undefined> {
   const rows = (await asRawClient(db).unsafe(
-    `UPDATE "kumiko_event_consumers" SET "status" = $1, "attempts" = 0, "last_error" = NULL, "updated_at" = now()
+    `UPDATE "kumiko_event_consumers" SET "status" = $1, "attempts" = 0, "last_error" = NULL, "rearm_count" = 0, "updated_at" = now()
      WHERE "name" = $2 AND "instance_id" = $3
      RETURNING *`,
     [status, name, instanceId],
@@ -101,6 +109,7 @@ export async function advanceConsumerPastEventReturning(
        "status" = 'idle',
        "attempts" = 0,
        "last_error" = NULL,
+       "rearm_count" = 0,
        "updated_at" = now()
      WHERE "name" = $2 AND "instance_id" = $3
      RETURNING *`,
@@ -168,3 +177,27 @@ export async function markConsumerRebuildFailed(
     [errorMessage, name, instanceId],
   );
 }
+
+// Auto-revive a dead consumer once its cooldown has elapsed (called from
+// acquireConsumerState — not an ops action, so no "requireConsumerRow"
+// precondition like restartConsumer/enableConsumer). Increments rearm_count
+// so the caller can enforce a lifetime cap on automatic revivals; manual
+// restartConsumer()/enableConsumer() reset it back to 0.
+export async function rearmDeadConsumer(
+  db: AnyDb,
+  name: string,
+  instanceId: string,
+): Promise<Record<string, unknown> | undefined> {
+  const rows = (await asRawClient(db).unsafe(
+    `UPDATE "kumiko_event_consumers" SET
+       "status" = 'idle',
+       "attempts" = 0,
+       "last_error" = NULL,
+       "rearm_count" = "rearm_count" + 1,
+       "updated_at" = now()
+     WHERE "name" = $1 AND "instance_id" = $2
+     RETURNING *`,
+    [name, instanceId],
+  )) as ReadonlyArray<Record<string, unknown>>;
+  return rows[0];
+}

package/src/engine/__tests__/boot-validator-boot-check.test.ts

@@ -0,0 +1,99 @@
+// r.bootCheck(fn) — feature-declared mount invariants, checked at boot.
+// Mirrors the prompt-store trap (kumiko-enterprise#229): a feature with
+// PII-annotated fields was mounted without its required companion feature,
+// and nothing caught it at boot. The conditional-invariant tests below
+// reproduce that shape: the check only fails when the feature actually has
+// PII fields AND the companion is missing — a bare "is X mounted" check
+// would already be covered by r.requires and wouldn't justify this API.
+
+import { describe, expect, test } from "bun:test";
+import { validateFeatureBootChecks } from "../boot-validator/boot-check";
+import { defineFeature } from "../define-feature";
+import { createEntity, createTextField } from "../factories";
+
+function catchMessage(fn: () => void): string {
+  try {
+    fn();
+  } catch (e) {
+    return e instanceof Error ? e.message : String(e);
+  }
+  throw new Error("expected function to throw, but it did not");
+}
+
+const requiresUserDataHook = (features: readonly { readonly name: string }[]) =>
+  features.some((f) => f.name === "user-data-hook");
+
+const promptStore = () =>
+  defineFeature("prompt-store", (r) => {
+    const promptFields = { text: createTextField({ pii: true }) };
+    r.entity("prompt", createEntity({ fields: promptFields }));
+    r.bootCheck(({ features }) => {
+      // Conditional on this feature's own shape (has a pii field), closed
+      // over from setup — r.requires("user-data-hook") can't express that.
+      const hasPiiField = Object.values(promptFields).some((field) => field.pii);
+      if (hasPiiField && !requiresUserDataHook(features)) {
+        throw new Error("prompt-store has PII fields but no user-data-hook feature is mounted");
+      }
+    });
+  });
+
+describe("r.bootCheck / validateFeatureBootChecks", () => {
+  test("no bootChecks registered → no-op", () => {
+    const noop = defineFeature("noop", () => {});
+    expect(() => validateFeatureBootChecks([noop])).not.toThrow();
+  });
+
+  test("conditional invariant satisfied (companion mounted) → boot succeeds", () => {
+    const userDataHook = defineFeature("user-data-hook", () => {});
+    expect(() => validateFeatureBootChecks([userDataHook, promptStore()])).not.toThrow();
+  });
+
+  test("conditional invariant violated (PII field, no companion) → boot fails with feature-prefixed message", () => {
+    const message = catchMessage(() => validateFeatureBootChecks([promptStore()]));
+    expect(message).toContain("[Feature prompt-store]");
+    expect(message).toContain(
+      "prompt-store has PII fields but no user-data-hook feature is mounted",
+    );
+  });
+
+  test("no PII field → boot succeeds even without the companion", () => {
+    const noPiiFields = { text: createTextField() };
+    const noPii = defineFeature("prompt-store-no-pii", (r) => {
+      r.entity("note", createEntity({ fields: noPiiFields }));
+      r.bootCheck(({ features }) => {
+        const hasPiiField = Object.values(noPiiFields).some((field) => field.pii);
+        if (hasPiiField && !requiresUserDataHook(features)) {
+          throw new Error("unreachable in this test");
+        }
+      });
+    });
+    expect(() => validateFeatureBootChecks([noPii])).not.toThrow();
+  });
+
+  test("multiple bootChecks on one feature all run in order until one throws", () => {
+    const calls: string[] = [];
+    const feature = defineFeature("multi-check", (r) => {
+      r.bootCheck(() => {
+        calls.push("first");
+      });
+      r.bootCheck(() => {
+        calls.push("second");
+        throw new Error("second check failed");
+      });
+    });
+    expect(() => validateFeatureBootChecks([feature])).toThrow("second check failed");
+    expect(calls).toEqual(["first", "second"]);
+  });
+
+  test("ctx.features exposes every mounted feature, not just the declaring one", () => {
+    const a = defineFeature("feature-a", () => {});
+    let seenNames: string[] = [];
+    const b = defineFeature("feature-b", (r) => {
+      r.bootCheck(({ features }) => {
+        seenNames = features.map((f) => f.name);
+      });
+    });
+    validateFeatureBootChecks([a, b]);
+    expect(seenNames).toEqual(["feature-a", "feature-b"]);
+  });
+});

package/src/engine/__tests__/boot-validator-gdpr-storage.test.ts

@@ -1,23 +1,16 @@
 // V1 — GDPR storage-persistence boot guard. Catches the prod failure class:
 // user-data-rights mounted but exports land in an ephemeral / missing store,
 // and s3-env selected as the GDPR store without its env vars set.
-// V2 — export-without-erase guard. Catches features that register an export
-// hook but no delete hook (Art.17 violation).
-// V3 — PII-entity-without-hook guard. Catches entities with pii/userOwned
-// fields that no feature registers an EXT_USER_DATA hook for.
-// V4 — tenantOwned-entity-without-hook guard. Mirrors V3 for EXT_TENANT_DATA.
+//
+// V2-V4 (export-without-erase / PII-entity-without-hook / tenantOwned-entity-
+// without-hook) moved off this framework-internal validator onto
+// `r.bootCheck()` calls declared by user-data-rights / user-data-rights-
+// defaults (#1314) — see boot-checks.test.ts in the bundled-features package
+// for their coverage.
 
 import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
-import { integer, type SchemaTable, table, uuid } from "../../db/dialect";
-import {
-  validateGdprHookCompleteness,
-  validateGdprPiiHookCoverage,
-  validateGdprStoragePersistence,
-  validateTenantDataHookCoverage,
-} from "../boot-validator/gdpr-storage";
+import { validateGdprStoragePersistence } from "../boot-validator/gdpr-storage";
 import { defineFeature } from "../define-feature";
-import { EXT_TENANT_DATA, EXT_USER_DATA } from "../extension-names";
-import { createEntity, createLongTextField, createTextField } from "../factories";
 
 const udr = () => defineFeature("user-data-rights", () => {});
 const fileProvider = (name: string) =>
@@ -25,26 +18,8 @@ const fileProvider = (name: string) =>
     r.useExtension("fileProvider", name);
   });
 
-// Throwaway Drizzle table for r.projection() registrations — the projection
-// runtime behaviour isn't under test here, only the guard's field scan.
-const testProjectionTable = table("test_projection", {
-  id: uuid("id").primaryKey(),
-  count: integer("count").notNull().default(0),
-}) as unknown as SchemaTable;
-
 const S3_ENV = ["S3_BUCKET", "S3_REGION", "S3_ACCESS_KEY", "S3_SECRET_KEY"] as const;
 
-// V2/V3 are hard boot gates now — capture the thrown message so a single case
-// can assert several substrings (feature, entity, article).
-function catchMessage(fn: () => void): string {
-  try {
-    fn();
-  } catch (e) {
-    return e instanceof Error ? e.message : String(e);
-  }
-  throw new Error("expected function to throw, but it did not");
-}
-
 describe("validateGdprStoragePersistence (V1)", () => {
   let warnSpy: ReturnType<typeof spyOn>;
   let savedEnv: Array<readonly [string, string | undefined]>;
@@ -103,204 +78,3 @@ describe("validateGdprStoragePersistence (V1)", () => {
     expect(warnSpy).not.toHaveBeenCalled();
   });
 });
-
-describe("validateGdprHookCompleteness (V2)", () => {
-  const exportFn = async () => null;
-  const deleteFn = async () => {};
-
-  test("export + delete hooks → no throw", () => {
-    const f = defineFeature("my-feature", (r) => {
-      r.useExtension(EXT_USER_DATA, "myEntity", { export: exportFn, delete: deleteFn });
-    });
-    expect(() => validateGdprHookCompleteness([f])).not.toThrow();
-  });
-
-  test("export hook without delete hook → Art.17 throw", () => {
-    const f = defineFeature("my-feature", (r) => {
-      r.useExtension(EXT_USER_DATA, "myEntity", { export: exportFn });
-    });
-    const msg = catchMessage(() => validateGdprHookCompleteness([f]));
-    expect(msg).toContain("my-feature");
-    expect(msg).toContain("myEntity");
-    expect(msg).toContain("Art.17");
-  });
-
-  test("delete hook only (no export) → no throw", () => {
-    const f = defineFeature("my-feature", (r) => {
-      r.useExtension(EXT_USER_DATA, "myEntity", { delete: deleteFn });
-    });
-    expect(() => validateGdprHookCompleteness([f])).not.toThrow();
-  });
-
-  test("no EXT_USER_DATA hooks at all → no throw", () => {
-    const f = defineFeature("my-feature", (r) => {
-      r.useExtension("fileProvider", "s3");
-    });
-    expect(() => validateGdprHookCompleteness([f])).not.toThrow();
-  });
-
-  test("multiple features, one missing delete → throws naming the offender", () => {
-    const good = defineFeature("good", (r) => {
-      r.useExtension(EXT_USER_DATA, "entityA", { export: exportFn, delete: deleteFn });
-    });
-    const bad = defineFeature("bad", (r) => {
-      r.useExtension(EXT_USER_DATA, "entityB", { export: exportFn });
-    });
-    const msg = catchMessage(() => validateGdprHookCompleteness([good, bad]));
-    expect(msg).toContain("entityB");
-  });
-});
-
-describe("validateGdprPiiHookCoverage (V3)", () => {
-  const exportFn = async () => null;
-  const deleteFn = async () => {};
-
-  const piiFeature = () =>
-    defineFeature("crm", (r) => {
-      r.entity(
-        "contact",
-        createEntity({
-          fields: {
-            email: createTextField({ pii: true }),
-            note: createLongTextField({ userOwned: { ownerField: "authorId" } }),
-            authorId: { type: "reference", entity: "user" },
-          },
-        }),
-      );
-    });
-
-  test("user-data-rights not mounted → no throw", () => {
-    expect(() => validateGdprPiiHookCoverage([piiFeature()])).not.toThrow();
-  });
-
-  test("pii entity without any EXT_USER_DATA hook → throws naming entity and fields", () => {
-    const msg = catchMessage(() => validateGdprPiiHookCoverage([udr(), piiFeature()]));
-    expect(msg).toContain('"contact"');
-    expect(msg).toContain("email");
-    expect(msg).toContain("note");
-    expect(msg).toContain("Art.17");
-  });
-
-  test("pii entity with hook registered by another feature → no throw", () => {
-    const hooks = defineFeature("crm-user-data", (r) => {
-      r.useExtension(EXT_USER_DATA, "contact", { export: exportFn, delete: deleteFn });
-    });
-    expect(() => validateGdprPiiHookCoverage([udr(), piiFeature(), hooks])).not.toThrow();
-  });
-
-  test("no-op hook is the intentional escape hatch → no throw", () => {
-    const hooks = defineFeature("crm-user-data", (r) => {
-      // Escape hatch: erasure handled elsewhere (crypto-shredding key-erase),
-      // so the pipeline hook is a deliberate no-op.
-      r.useExtension(EXT_USER_DATA, "contact", {
-        export: async () => null,
-        delete: async () => {},
-      });
-    });
-    expect(() => validateGdprPiiHookCoverage([udr(), piiFeature(), hooks])).not.toThrow();
-  });
-
-  test("entity without subject annotations → no throw", () => {
-    const plain = defineFeature("catalog", (r) => {
-      r.entity(
-        "product",
-        createEntity({
-          fields: { sku: createTextField({ allowPlaintext: "is-business-data" }) },
-        }),
-      );
-    });
-    expect(() => validateGdprPiiHookCoverage([udr(), plain])).not.toThrow();
-  });
-
-  test("userOwned field alone counts as user-subject data → throws", () => {
-    const f = defineFeature("notes", (r) => {
-      r.entity(
-        "note",
-        createEntity({
-          fields: {
-            body: createLongTextField({ userOwned: { ownerField: "authorId" } }),
-            authorId: { type: "reference", entity: "user" },
-          },
-        }),
-      );
-    });
-    const msg = catchMessage(() => validateGdprPiiHookCoverage([udr(), f]));
-    expect(msg).toContain('"note"');
-  });
-});
-
-describe("validateTenantDataHookCoverage (V4)", () => {
-  const destroyFn = async () => {};
-  const tenantLifecycle = () => defineFeature("tenant-lifecycle", () => {});
-
-  const tenantEntityFeature = () =>
-    defineFeature("billing", (r) => {
-      r.entity(
-        "subscription",
-        createEntity({
-          fields: { providerCustomerId: createTextField({ tenantOwned: true }) },
-        }),
-      );
-    });
-
-  test("tenant-lifecycle not mounted → no throw", () => {
-    expect(() => validateTenantDataHookCoverage([tenantEntityFeature()])).not.toThrow();
-  });
-
-  test("tenantOwned entity without any EXT_TENANT_DATA hook → throws naming entity and field", () => {
-    const msg = catchMessage(() =>
-      validateTenantDataHookCoverage([tenantLifecycle(), tenantEntityFeature()]),
-    );
-    expect(msg).toContain('"subscription"');
-    expect(msg).toContain("providerCustomerId");
-  });
-
-  test("tenantOwned entity with hook registered → no throw", () => {
-    const hooks = defineFeature("billing-hooks", (r) => {
-      r.useExtension(EXT_TENANT_DATA, "subscription", { destroy: destroyFn });
-    });
-    expect(() =>
-      validateTenantDataHookCoverage([tenantLifecycle(), tenantEntityFeature(), hooks]),
-    ).not.toThrow();
-  });
-
-  // Regression: billing-foundation's real `subscription` shape — r.projection()
-  // (no executor, no r.entity) carrying an `entity` reference for its
-  // tenantOwned fields. Before this fix, feature.entities-only scanning made
-  // this shape invisible to the guard.
-  test("tenantOwned field on a projection-only entity (no r.entity) is still caught", () => {
-    const projectionFeature = defineFeature("billing", (r) => {
-      r.projection({
-        name: "subscription",
-        source: "subscription",
-        table: testProjectionTable,
-        entity: createEntity({
-          fields: { providerCustomerId: createTextField({ tenantOwned: true }) },
-        }),
-        apply: {},
-      });
-    });
-    const msg = catchMessage(() =>
-      validateTenantDataHookCoverage([tenantLifecycle(), projectionFeature]),
-    );
-    expect(msg).toContain("providerCustomerId");
-  });
-
-  test("tenantOwned field on a projection-only entity WITH a hook → no throw", () => {
-    const projectionFeature = defineFeature("billing", (r) => {
-      r.projection({
-        name: "subscription",
-        source: "subscription",
-        table: testProjectionTable,
-        entity: createEntity({
-          fields: { providerCustomerId: createTextField({ tenantOwned: true }) },
-        }),
-        apply: {},
-      });
-      r.useExtension(EXT_TENANT_DATA, "subscription", { destroy: destroyFn });
-    });
-    expect(() =>
-      validateTenantDataHookCoverage([tenantLifecycle(), projectionFeature]),
-    ).not.toThrow();
-  });
-});

package/src/engine/__tests__/define-roles.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from "bun:test";
+import { defineRoles } from "../define-roles";
+
+describe("defineRoles", () => {
+  test("maps each role name to itself", () => {
+    const roles = defineRoles(["Admin", "SystemAdmin", "Driver"] as const);
+    expect(roles.Admin).toBe("Admin");
+    expect(roles.SystemAdmin).toBe("SystemAdmin");
+    expect(roles.Driver).toBe("Driver");
+  });
+
+  test("returns an object with exactly the given keys", () => {
+    const roles = defineRoles(["A", "B"] as const);
+    expect(Object.keys(roles).sort()).toEqual(["A", "B"]);
+  });
+
+  test("an empty role list returns an empty object", () => {
+    const roles = defineRoles([] as const);
+    expect(roles).toEqual({});
+  });
+});

package/src/engine/__tests__/event-type-map-augmentation.test.ts

@@ -0,0 +1,24 @@
+// Type-only fixture for the KumikoEventTypeMap declaration-merging channel
+// (#1394). event-type-map.ts moved the marker interfaces behind a re-export
+// chain (kumiko-types -> engine/types/event-type-map.ts shim -> engine
+// barrel), while the codegen augmentation channel
+// (dev-server/src/codegen/render.ts) still targets
+// `declare module "@cosmicdrift/kumiko-framework/engine"`. If a future
+// change breaks that re-export chain, augmentation silently stops merging
+// and every event payload falls back to `unknown` with no compile error —
+// this test only catches it because tsc checks the `declare module` below
+// against the SAME specifier the codegen emits.
+import { expectTypeOf, test } from "bun:test";
+import type { KumikoEventTypeMap } from "@cosmicdrift/kumiko-framework/engine";
+
+declare module "@cosmicdrift/kumiko-framework/engine" {
+  interface KumikoEventTypeMap {
+    "event-type-map-fixture:probe.created": { readonly probe: true };
+  }
+}
+
+test("augmenting KumikoEventTypeMap via the engine specifier merges into the relocated interface", () => {
+  expectTypeOf<KumikoEventTypeMap["event-type-map-fixture:probe.created"]>().toEqualTypeOf<{
+    readonly probe: true;
+  }>();
+});

package/src/engine/__tests__/store-table.test.ts

@@ -75,6 +75,18 @@ describe("r.storeTable — declaration", () => {
     ).toThrow(/requires source: "unmanaged"/);
   });
 
+  test("rejects a table name with the reserved read_ prefix (#1220)", () => {
+    const readPrefixed = defineUnmanagedTable({
+      tableName: "read_rt_probe",
+      columns: [{ name: "id", pgType: "text", notNull: true, primaryKey: true }],
+    });
+    expect(() =>
+      defineFeature("probe", (r) => {
+        r.storeTable(readPrefixed, { reason: "test" });
+      }),
+    ).toThrow(/the "read_" prefix is reserved/);
+  });
+
   test("accepts valid registration and stores meta + reason", () => {
     const feature = defineFeature("probe", (r) => {
       r.storeTable(probeMeta, {

package/src/engine/boot-validator/action-wiring.ts

@@ -1,3 +1,4 @@
+import { isExtensionEditSection, normalizeEditField, normalizeListColumn } from "../screen-helpers";
 import type {
   EditFieldSpec,
   EditLayout,
@@ -6,7 +7,6 @@ import type {
   RowAction,
   ToolbarAction,
 } from "../types";
-import { isExtensionEditSection, normalizeEditField, normalizeListColumn } from "../types/screen";
 
 const FUNCTION_DROPPED_HINT =
   "functions are dropped by JSON.stringify when the screen config reaches the client " +

package/src/engine/boot-validator/boot-check.ts

@@ -0,0 +1,21 @@
+import type { BootCheckContext, FeatureDefinition } from "../types";
+
+// r.bootCheck(fn) lets a feature declare its own mount-invariant instead of
+// relying on framework-internal knowledge (the gdpr-storage.ts guards are
+// the framework-owned version of this same idea). Each registered fn gets
+// the full mounted-feature set and throws to fail the boot; we wrap the
+// message with the owning feature's name so the error text points back at
+// the feature that declared the check.
+export function validateFeatureBootChecks(features: readonly FeatureDefinition[]): void {
+  const ctx: BootCheckContext = { features };
+  for (const feature of features) {
+    for (const check of feature.bootChecks) {
+      try {
+        check(ctx);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Feature ${feature.name}] r.bootCheck failed: ${message}`);
+      }
+    }
+  }
+}

package/src/engine/boot-validator/entity-list-screens.ts

@@ -1,5 +1,5 @@
+import { normalizeListColumn } from "../screen-helpers";
 import type { EntityListScreenDefinition, FeatureDefinition } from "../types";
-import { normalizeListColumn } from "../types/screen";
 
 /** Operator lists default searchable; low-cardinality audit trails stay opt-out. */
 export const SEARCHABLE_FALSE_WHITELIST = new Set(["download-attempt-list"]);

package/src/engine/boot-validator/gdpr-storage.ts

@@ -1,22 +1,4 @@
-import { EXT_TENANT_DATA, EXT_USER_DATA } from "../extension-names";
 import type { FeatureDefinition } from "../types";
-import type { EntityDefinition, PiiAnnotations } from "../types/fields";
-
-// r.entity(...) is not the only way a feature exposes an entity shape:
-// r.projection(...) can carry an optional `entity` too (raw read-models with
-// no executor, e.g. billing-foundation's subscription table). Both V3 and V4
-// below need every entity a feature declares, not just the r.entity ones, or
-// a tenantOwned/pii field on a projection-only entity is invisible to the
-// guard it was annotated for.
-function entitiesOf(
-  feature: FeatureDefinition,
-): ReadonlyArray<readonly [string, EntityDefinition]> {
-  const fromEntities = Object.entries(feature.entities ?? {});
-  const fromProjections = Object.values(feature.projections ?? {})
-    .filter((p): p is typeof p & { entity: EntityDefinition } => p.entity !== undefined)
-    .map((p) => [p.name, p.entity] as const);
-  return [...fromEntities, ...fromProjections];
-}
 
 // Providers whose bytes do not survive a process restart. Only "inmemory"
 // today; extend if another ephemeral bundled provider lands.
@@ -75,97 +57,3 @@ export function validateGdprStoragePersistence(features: readonly FeatureDefinit
     }
   }
 }
-
-// V2: export-without-erase gate. A feature that registers an EXT_USER_DATA
-// export hook without a matching delete hook exports data under Art.20 but
-// never erases it on forget — an Art.17 violation. Hard boot failure: no app
-// should ship a GDPR export path with no erase path. Registry-level signal
-// only; runtime no-ops (a delete hook that silently skips) are not detectable
-// here — those are covered by the export/forget integration tests.
-export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
-  for (const feature of features) {
-    for (const usage of feature.extensionUsages) {
-      if (usage.extensionName !== EXT_USER_DATA) continue;
-      const hasExport = typeof usage.options?.["export"] === "function";
-      const hasDelete = typeof usage.options?.["delete"] === "function";
-      if (hasExport && !hasDelete) {
-        throw new Error(
-          `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
-        );
-      }
-    }
-  }
-}
-
-// V3: PII-entity-without-hook gate. V2 checks registered hooks for
-// completeness; V3 catches the entity nobody registered at all — fields
-// annotated as user-subject data (pii / userOwned) yet invisible to the
-// Art.15/20 export and Art.17 forget pipeline. Hard boot failure once
-// user-data-rights is mounted: a subject-data entity that skips the pipeline
-// is exactly the "feature built past GDPR" leak this gate exists to stop.
-// Matching is by entity name across all features (usage.entityName is
-// unqualified); a same-named entity in another feature can mask a gap —
-// accepted, as the common case is a distinct entity name.
-export function validateGdprPiiHookCoverage(features: readonly FeatureDefinition[]): void {
-  const featureNames = new Set(features.map((f) => f.name));
-  if (!featureNames.has("user-data-rights")) {
-    // skip: this guard only applies to apps that mount user-data-rights
-    return;
-  }
-
-  const hookedEntities = new Set<string>();
-  for (const f of features) {
-    for (const usage of f.extensionUsages) {
-      if (usage.extensionName === EXT_USER_DATA) hookedEntities.add(usage.entityName);
-    }
-  }
-
-  for (const feature of features) {
-    for (const [entityName, entity] of entitiesOf(feature)) {
-      if (hookedEntities.has(entityName)) continue;
-      const subjectFields = Object.entries(entity.fields)
-        .filter(([, field]) => {
-          const annot = field as PiiAnnotations; // @cast-boundary schema-walk
-          return Boolean(annot.pii) || Boolean(annot.userOwned);
-        })
-        .map(([name]) => name);
-      if (subjectFields.length === 0) continue;
-      throw new Error(
-        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
-      );
-    }
-  }
-}
-
-// V4: tenantOwned-entity-without-hook gate. Mirrors validateGdprPiiHookCoverage
-// but for EXT_TENANT_DATA when tenant-lifecycle is mounted.
-export function validateTenantDataHookCoverage(features: readonly FeatureDefinition[]): void {
-  const featureNames = new Set(features.map((f) => f.name));
-  if (!featureNames.has("tenant-lifecycle")) {
-    // skip: this guard only applies to apps that mount tenant-lifecycle
-    return;
-  }
-
-  const hookedEntities = new Set<string>();
-  for (const f of features) {
-    for (const usage of f.extensionUsages) {
-      if (usage.extensionName === EXT_TENANT_DATA) hookedEntities.add(usage.entityName);
-    }
-  }
-
-  for (const feature of features) {
-    for (const [entityName, entity] of entitiesOf(feature)) {
-      if (hookedEntities.has(entityName)) continue;
-      const tenantSubjectFields = Object.entries(entity.fields)
-        .filter(([, field]) => {
-          const annot = field as PiiAnnotations;
-          return Boolean(annot.tenantOwned);
-        })
-        .map(([name]) => name);
-      if (tenantSubjectFields.length === 0) continue;
-      throw new Error(
-        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has tenant-subject fields (${tenantSubjectFields.join(", ")}) but no feature registers an EXT_TENANT_DATA destroy hook for it — tenant destroy never erases this data. Register r.useExtension(EXT_TENANT_DATA, "${entityName}", { destroy }) or a documented no-op if crypto-shredding covers it.`,
-      );
-    }
-  }
-}