@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/engine/boot-validator/action-wiring.ts

@@ -0,0 +1,149 @@
+import { isExtensionEditSection, normalizeEditField, normalizeListColumn } from "../screen-helpers";
+import type {
+  EditFieldSpec,
+  EditLayout,
+  FeatureDefinition,
+  ListColumnSpec,
+  RowAction,
+  ToolbarAction,
+} from "../types";
+
+const FUNCTION_DROPPED_HINT =
+  "functions are dropped by JSON.stringify when the screen config reaches the client " +
+  "bundle — the action/field silently no-ops at runtime instead of failing loudly.";
+
+function throwIfFunction(value: unknown, message: string): void {
+  if (typeof value === "function") {
+    throw new Error(message);
+  }
+}
+
+// rowActions/toolbarActions carry row-context extractors (payload/params),
+// static visibility conditions and navigate entityId — all declarative-DSL-
+// only fields (RowFieldExtractor's `{ pick }`/`{ map }`, FieldCondition's
+// `{ field, eq }`/`{ field, ne }`, plain strings). A function literal here
+// does not type-check against these structural DSL types — it only reaches
+// here via a leaked `any`/`as any`, which this runtime check backstops.
+const ACTION_FUNCTION_FIELDS = ["payload", "params", "entityId", "visible"] as const;
+
+function validateActionNoFunctions(
+  featureName: string,
+  screenId: string,
+  actionKind: "rowAction" | "toolbarAction",
+  action: RowAction | ToolbarAction,
+): void {
+  const record = action as unknown as Record<string, unknown>;
+  for (const field of ACTION_FUNCTION_FIELDS) {
+    throwIfFunction(
+      record[field],
+      `[Feature ${featureName}] Screen "${screenId}" ${actionKind} "${action.id}" ${field} ` +
+        `is a function — ${FUNCTION_DROPPED_HINT} Use the declarative DSL ({ pick }, { map }, ` +
+        `"fieldName", { field, eq }) instead.`,
+    );
+  }
+}
+
+export function validateActionWiring(feature: FeatureDefinition): void {
+  for (const screen of Object.values(feature.screens)) {
+    if (screen.type !== "entityList" && screen.type !== "projectionList") continue;
+    for (const action of screen.rowActions ?? []) {
+      validateActionNoFunctions(feature.name, screen.id, "rowAction", action);
+    }
+    for (const action of screen.toolbarActions ?? []) {
+      validateActionNoFunctions(feature.name, screen.id, "toolbarAction", action);
+    }
+  }
+}
+
+// EditFieldSpec's visible/readOnly/required are the same FieldCondition DSL
+// as rowActions — same footgun, different screen type (entityEdit layouts).
+const EDIT_FIELD_FUNCTION_FIELDS = ["visible", "readOnly", "required"] as const;
+
+function validateEditFieldNoFunctions(
+  featureName: string,
+  screenId: string,
+  screenType: string,
+  fieldSpec: EditFieldSpec,
+): void {
+  const normalized = normalizeEditField(fieldSpec);
+  const record = normalized as unknown as Record<string, unknown>;
+  for (const key of EDIT_FIELD_FUNCTION_FIELDS) {
+    throwIfFunction(
+      record[key],
+      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) field "${normalized.field}" ` +
+        `${key} is a function — ${FUNCTION_DROPPED_HINT} Use a FieldCondition ` +
+        `(boolean or { field, eq }/{ field, ne }) instead.`,
+    );
+  }
+  throwIfFunction(
+    normalized.renderer,
+    `[Feature ${featureName}] Screen "${screenId}" (${screenType}) field "${normalized.field}" ` +
+      `renderer is a function — ${FUNCTION_DROPPED_HINT} Use a FormatSpec ({ format: "..." }) instead.`,
+  );
+}
+
+function validateColumnsNoFunctions(
+  featureName: string,
+  screenId: string,
+  screenType: string,
+  columns: readonly ListColumnSpec[],
+): void {
+  for (const col of columns) {
+    const normalized = normalizeListColumn(col);
+    throwIfFunction(
+      normalized.renderer,
+      `[Feature ${featureName}] Screen "${screenId}" (${screenType}) column ` +
+        `"${normalized.field}" renderer is a function — ${FUNCTION_DROPPED_HINT} ` +
+        `Use a FormatSpec ({ format: "..." }) instead.`,
+    );
+  }
+}
+
+function validateEditLayoutNoFunctions(
+  featureName: string,
+  screenId: string,
+  screenType: string,
+  layout: EditLayout,
+): void {
+  for (const section of layout.sections) {
+    if (isExtensionEditSection(section)) continue;
+    for (const fieldSpec of section.fields) {
+      validateEditFieldNoFunctions(featureName, screenId, screenType, fieldSpec);
+    }
+  }
+}
+
+// Screen types that carry an EditLayout (entityEdit's layout shape, reused
+// verbatim by actionForm/configEdit/projectionDetail) vs. ones that carry
+// ListColumnSpec[] (entityList/projectionList, plus dashboard "list" panels)
+// both funnel through the same two checks below — a function literal in
+// either shape is dropped by JSON.stringify regardless of which screen type
+// hosts it.
+export function validateFieldWiring(feature: FeatureDefinition): void {
+  for (const screen of Object.values(feature.screens)) {
+    if (screen.type === "entityList" || screen.type === "projectionList") {
+      validateColumnsNoFunctions(feature.name, screen.id, screen.type, screen.columns);
+      continue;
+    }
+    if (
+      screen.type === "entityEdit" ||
+      screen.type === "actionForm" ||
+      screen.type === "configEdit" ||
+      screen.type === "projectionDetail"
+    ) {
+      validateEditLayoutNoFunctions(feature.name, screen.id, screen.type, screen.layout);
+      continue;
+    }
+    if (screen.type === "dashboard") {
+      for (const panel of screen.panels) {
+        if (panel.kind !== "list") continue;
+        validateColumnsNoFunctions(
+          feature.name,
+          `${screen.id}:${panel.id}`,
+          "dashboard-list",
+          panel.columns,
+        );
+      }
+    }
+  }
+}

package/src/engine/boot-validator/boot-check.ts

@@ -0,0 +1,21 @@
+import type { BootCheckContext, FeatureDefinition } from "../types";
+
+// r.bootCheck(fn) lets a feature declare its own mount-invariant instead of
+// relying on framework-internal knowledge (the gdpr-storage.ts guards are
+// the framework-owned version of this same idea). Each registered fn gets
+// the full mounted-feature set and throws to fail the boot; we wrap the
+// message with the owning feature's name so the error text points back at
+// the feature that declared the check.
+export function validateFeatureBootChecks(features: readonly FeatureDefinition[]): void {
+  const ctx: BootCheckContext = { features };
+  for (const feature of features) {
+    for (const check of feature.bootChecks) {
+      try {
+        check(ctx);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Feature ${feature.name}] r.bootCheck failed: ${message}`);
+      }
+    }
+  }
+}

package/src/engine/boot-validator/config-deps.ts

@@ -1,3 +1,4 @@
+import { isEncryptedAtRest } from "../config-helpers";
 import type { FeatureDefinition } from "../types";
 
 // --- Toggleable-dependency warnings ---
@@ -79,9 +80,9 @@ export function validateConfigKeyComputed(feature: FeatureDefinition): void {
     // returns a plain value, encrypted expects cipher-text in the row. The
     // cascade doesn't know which one to prefer on write. Rejecting at boot
     // is cheaper than surprising behaviour at runtime.
-    if (keyDef.encrypted) {
+    if (isEncryptedAtRest(keyDef)) {
       throw new Error(
-        `[Feature ${feature.name}] Config key "${keyName}" has both encrypted=true and a computed resolver — these are mutually exclusive paradigms`,
+        `[Feature ${feature.name}] Config key "${keyName}" has both encrypted/backing="secrets" and a computed resolver — these are mutually exclusive paradigms`,
       );
     }
   }
@@ -128,9 +129,9 @@ export function validateConfigKeyAllowPerRequest(feature: FeatureDefinition): vo
     // encrypted + per-request would expose a cipher-text interpretation
     // to query-strings. The secret-value shouldn't be transported this
     // way — reject as a paradigm-mismatch.
-    if (keyDef.encrypted) {
+    if (isEncryptedAtRest(keyDef)) {
       throw new Error(
-        `[Feature ${feature.name}] Config key "${keyName}" has allowPerRequest=true but encrypted=true — secret values may not be set via query-params`,
+        `[Feature ${feature.name}] Config key "${keyName}" has allowPerRequest=true but encrypted/backing="secrets" — secret values may not be set via query-params`,
       );
     }
   }
@@ -160,6 +161,41 @@ export function validateConfigKeyBacking(feature: FeatureDefinition): void {
   }
 }
 
+// --- Config key piiEncrypted compatibility (kumiko-platform#231/#459) ---
+
+export function validateConfigKeyPiiEncrypted(feature: FeatureDefinition): void {
+  for (const [keyName, keyDef] of Object.entries(feature.configKeys)) {
+    if (!keyDef.piiEncrypted) continue;
+
+    if (keyDef.type !== "text") {
+      throw new Error(
+        `[Feature ${feature.name}] Config key "${keyName}" has piiEncrypted=true but type="${keyDef.type}" — piiEncrypted only applies to text keys`,
+      );
+    }
+
+    // system scope has no subject (no tenant, no user) for the subject-KMS
+    // to encrypt under.
+    if (keyDef.scope === "system") {
+      throw new Error(
+        `[Feature ${feature.name}] Config key "${keyName}" has piiEncrypted=true but scope="system" — system-scope has no subject (tenant/user) for the subject-KMS to encrypt under`,
+      );
+    }
+
+    // Mutually exclusive with the shared-cipher path: a config value is
+    // either subject-keyed (piiEncrypted) or master-key-keyed (encrypted/
+    // backing="secrets"), never both — unlike entity fields, which allow
+    // both markers together (double-wrap, e.g. auth-mfa.totpSecret) because
+    // entity rows decrypt through a fixed executor pipeline that peels both
+    // layers. Config values have no such pipeline; picking one keeps the
+    // resolver simple.
+    if (isEncryptedAtRest(keyDef)) {
+      throw new Error(
+        `[Feature ${feature.name}] Config key "${keyName}" has both piiEncrypted=true and encrypted/backing="secrets" — pick one: piiEncrypted (subject-KMS, user-visible) or encrypted (shared cipher, server-only values)`,
+      );
+    }
+  }
+}
+
 // --- Config key cross-feature reference validation ---
 
 export function validateConfigReads(

package/src/engine/boot-validator/entity-handler.ts

@@ -101,29 +101,27 @@ const USER_BUCKETED_RATE_LIMIT_PER: ReadonlySet<string> = new Set(["user", "user
 // at runtime, but we fail at boot to turn an easy-to-miss security regression
 // into a loud configuration error.
 export function validateHandlerAccess(feature: FeatureDefinition): void {
-  for (const [name, handler] of Object.entries(feature.writeHandlers)) {
-    if (!handler.access) {
-      throw new Error(
-        `Write handler "${feature.name}:write:${name}" is missing an access rule. ` +
-          `Set { roles: [...] } for role-based access, or { openToAll: true } for any authenticated user.`,
-      );
-    }
-    validateAnonymousRateLimit(feature.name, "write", name, handler.access, handler.rateLimit);
-  }
-  for (const [name, handler] of Object.entries(feature.queryHandlers)) {
-    if (!handler.access) {
-      throw new Error(
-        `Query handler "${feature.name}:query:${name}" is missing an access rule. ` +
-          `Set { roles: [...] } for role-based access, or { openToAll: true } for any authenticated user.`,
-      );
+  const kinds = [
+    { kind: "write" as const, label: "Write", handlers: feature.writeHandlers },
+    { kind: "query" as const, label: "Query", handlers: feature.queryHandlers },
+    { kind: "stream" as const, label: "Stream", handlers: feature.streamHandlers },
+  ];
+  for (const { kind, label, handlers } of kinds) {
+    for (const [name, handler] of Object.entries(handlers)) {
+      if (!handler.access) {
+        throw new Error(
+          `${label} handler "${feature.name}:${kind}:${name}" is missing an access rule. ` +
+            `Set { roles: [...] } for role-based access, or { openToAll: true } for any authenticated user.`,
+        );
+      }
+      validateAnonymousRateLimit(feature.name, kind, name, handler.access, handler.rateLimit);
     }
-    validateAnonymousRateLimit(feature.name, "query", name, handler.access, handler.rateLimit);
   }
 }
 
 export function validateAnonymousRateLimit(
   featureName: string,
-  kind: "write" | "query",
+  kind: "write" | "query" | "stream",
   handlerName: string,
   access: NonNullable<FeatureDefinition["writeHandlers"][string]["access"]>,
   rateLimit: FeatureDefinition["writeHandlers"][string]["rateLimit"],
@@ -178,8 +176,9 @@ export function validateMultiStreamProjections(feature: FeatureDefinition): void
 //
 // Die häufigste Quelle von Konflikten ist Hand-Konstruktion:
 //   { foo: { type: "timestamp", locatedBy: "fooTz" } }
-// ohne das `fooTz`-Feld zu deklarieren. Der `locatedTimestamp(name)` Helper
-// macht das Pair atomar — wer ihn nutzt, fliegt nicht durch diesen Validator.
+// ohne das `fooTz`-Feld zu deklarieren. `createLocatedTimestampField()`
+// erzeugt stattdessen EIN Feld vom Typ "locatedTimestamp" — wer den nutzt,
+// fliegt nicht durch diesen Validator.
 export function validateLocatedTimestamps(feature: FeatureDefinition): void {
   for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
     const fields = entity.fields;
@@ -190,8 +189,8 @@ export function validateLocatedTimestamps(feature: FeatureDefinition): void {
         throw new Error(
           `Feature "${feature.name}", entity "${entityName}": field "${fieldName}" has ` +
             `locatedBy: "${field.locatedBy}" but no field with that name exists in the entity. ` +
-            `Either declare the tz-field, or use the locatedTimestamp("${fieldName.replace(/At$/, "")}") helper ` +
-            `to create the pair atomically.`,
+            `Either declare the tz-field, or use createLocatedTimestampField() ` +
+            `to create a single located-timestamp field instead.`,
         );
       }
       if (referenced.type !== "tz") {

package/src/engine/boot-validator/entity-list-screens.ts

@@ -0,0 +1,88 @@
+import { normalizeListColumn } from "../screen-helpers";
+import type { EntityListScreenDefinition, FeatureDefinition } from "../types";
+
+/** Operator lists default searchable; low-cardinality audit trails stay opt-out. */
+export const SEARCHABLE_FALSE_WHITELIST = new Set(["download-attempt-list"]);
+
+function hasFilterableFields(feature: FeatureDefinition, entityName: string): boolean {
+  const entities = feature.entities;
+  if (!entities) return false;
+  const entity = entities[entityName];
+  if (!entity) return false;
+  return Object.values(entity.fields).some(
+    (raw) => (raw as { readonly filterable?: boolean }).filterable === true,
+  );
+}
+
+function hasEntityEditDetail(feature: FeatureDefinition, entityName: string): boolean {
+  return Object.values(feature.screens).some(
+    (s) => s.type === "entityEdit" && s.entity === entityName,
+  );
+}
+
+function validateOneEntityListScreen(
+  feature: FeatureDefinition,
+  screen: EntityListScreenDefinition,
+): void {
+  const prefix = `[entityList] Feature "${feature.name}" screen "${screen.id}"`;
+
+  if (screen.searchable === false && !SEARCHABLE_FALSE_WHITELIST.has(screen.id)) {
+    throw new Error(
+      `${prefix}: searchable defaults to true for operator lists — set searchable: true or add "${screen.id}" to the whitelist`,
+    );
+  }
+
+  const filtersActive = hasFilterableFields(feature, screen.entity);
+  const searchable = screen.searchable !== false;
+  if ((searchable || filtersActive) && screen.defaultSort === undefined) {
+    throw new Error(
+      `${prefix}: defaultSort required when searchable or filterable fields are active`,
+    );
+  }
+
+  if (screen.defaultSort !== undefined) {
+    const sortField = screen.defaultSort.field;
+    const col = screen.columns.find((c) => normalizeListColumn(c).field === sortField);
+    if (col === undefined) {
+      throw new Error(`${prefix}: defaultSort.field "${sortField}" is not a listed column`);
+    }
+    const entityDef = feature.entities?.[screen.entity];
+    const fieldDef = entityDef?.fields[sortField];
+    const isSortable =
+      fieldDef !== undefined && "sortable" in fieldDef && fieldDef.sortable === true;
+    if (!isSortable) {
+      throw new Error(`${prefix}: defaultSort column "${sortField}" must be sortable`);
+    }
+  }
+
+  if (hasEntityEditDetail(feature, screen.entity)) {
+    const hasNavigate = (screen.rowActions ?? []).some(
+      (a) => a.kind === "navigate" && (a.id === "view" || a.id === "edit"),
+    );
+    if (!hasNavigate) {
+      throw new Error(
+        `${prefix}: detail screen exists — add a navigate rowAction with id "view" or "edit"`,
+      );
+    }
+  }
+
+  for (const col of screen.columns) {
+    const normalized = normalizeListColumn(col);
+    if (normalized.label === undefined) {
+      const entity = feature.entities?.[screen.entity];
+      const isDerived = entity?.derivedFields?.[normalized.field] !== undefined;
+      if (!entity?.fields[normalized.field] && !isDerived) {
+        throw new Error(`${prefix}: unknown column field "${normalized.field}"`);
+      }
+    }
+  }
+}
+
+export function validateEntityListScreens(features: readonly FeatureDefinition[]): void {
+  for (const feature of features) {
+    for (const screen of Object.values(feature.screens)) {
+      if (screen.type !== "entityList") continue;
+      validateOneEntityListScreen(feature, screen);
+    }
+  }
+}

package/src/engine/boot-validator/gdpr-storage.ts

@@ -57,23 +57,3 @@ export function validateGdprStoragePersistence(features: readonly FeatureDefinit
     }
   }
 }
-
-// V2: export-without-erase guard. A feature that registers an EXT_USER_DATA
-// export hook without a matching delete hook exports data under Art.20 but
-// never erases it on forget — an Art.17 violation. Registry-level signal only;
-// runtime no-ops (a delete hook that silently skips) are not detectable here.
-export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
-  for (const feature of features) {
-    for (const usage of feature.extensionUsages) {
-      if (usage.extensionName !== "userData") continue;
-      const hasExport = typeof usage.options?.["export"] === "function";
-      const hasDelete = typeof usage.options?.["delete"] === "function";
-      if (hasExport && !hasDelete) {
-        // biome-ignore lint/suspicious/noConsole: boot-time dev hint, no logger available yet
-        console.warn(
-          `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 risk). Add a delete hook, or a no-op with a comment explaining why erasure is intentionally skipped.`,
-        );
-      }
-    }
-  }
-}

package/src/engine/boot-validator/i18n-keys.ts

@@ -1,20 +1,68 @@
 import {
   buildEffectiveTranslationKeys,
+  featureHasI18nSurface,
   findTranslationLocaleGaps,
   requiredKeysFromFeature,
+  requiredKeysFromNav,
+  requiredKeysFromScreen,
+  requiredKeysFromWorkspace,
 } from "../../i18n/required-surface-keys";
+import { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE } from "../build-config-feature-schema";
+import { createRegistry } from "../registry";
 import type { FeatureDefinition } from "../types";
+import type { Registry } from "../types/feature";
+
+function requiredKeysFromGeneratedConfigHub(registry: Registry): readonly string[] {
+  const schema = buildConfigFeatureSchema(registry);
+  if (schema.navs.length === 0) return [];
+  const out = new Set<string>();
+
+  for (const screen of schema.screens) {
+    for (const key of requiredKeysFromScreen(SETTINGS_HUB_FEATURE, screen)) out.add(key);
+  }
+  for (const nav of schema.navs) {
+    for (const key of requiredKeysFromNav(nav)) out.add(key);
+  }
+  if (schema.workspace) {
+    for (const key of requiredKeysFromWorkspace(schema.workspace.definition)) out.add(key);
+  }
+  out.add("config.settings.title");
+  for (const scope of ["system", "tenant", "user"] as const) {
+    out.add(`config.settings.${scope}`);
+  }
+
+  return [...out];
+}
+
+function isFrameworkOwnedI18nKey(key: string): boolean {
+  return key.startsWith("kumiko.");
+}
+
+function hasDefinedTranslation(defined: Set<string>, key: string): boolean {
+  if (defined.has(key)) return true;
+  const colon = key.indexOf(":");
+  if (colon > 0) {
+    const feature = key.slice(0, colon);
+    const local = key.slice(colon + 1);
+    if (defined.has(`${feature}:${local}`)) return true;
+  }
+  if (key.includes(".")) {
+    const feature = key.split(".")[0];
+    if (feature && defined.has(`${feature}:${key}`)) return true;
+  }
+  return false;
+}
 
 export function validateI18nSurfaceKeys(features: readonly FeatureDefinition[]): void {
   const defined = buildEffectiveTranslationKeys(features);
+  const registry = createRegistry(features);
 
   for (const feature of features) {
-    // ponytail: features without r.translations are legacy — once they register
-    // keys, surface + locale checks apply (apps, new bundled work).
-    if (Object.keys(feature.translations ?? {}).length === 0) continue;
+    if (!featureHasI18nSurface(feature)) continue;
 
     for (const key of requiredKeysFromFeature(feature)) {
-      if (!defined.has(key)) {
+      if (isFrameworkOwnedI18nKey(key)) continue;
+      if (!hasDefinedTranslation(defined, key)) {
         throw new Error(
           `[i18n] Feature "${feature.name}": required translation key missing: "${key}"`,
         );
@@ -22,6 +70,12 @@ export function validateI18nSurfaceKeys(features: readonly FeatureDefinition[]):
     }
   }
 
+  for (const key of requiredKeysFromGeneratedConfigHub(registry)) {
+    if (!hasDefinedTranslation(defined, key)) {
+      throw new Error(`[i18n] Settings-Hub: required translation key missing: "${key}"`);
+    }
+  }
+
   for (const gap of findTranslationLocaleGaps(features)) {
     throw new Error(
       `[i18n] Feature "${gap.featureName}": key "${gap.key}" missing locale(s): ${gap.missingLocales.join(", ")}`,

package/src/engine/boot-validator/index.ts

@@ -1,12 +1,16 @@
+import { validateEntityFieldEncryptionAvailable } from "../../db/entity-field-encryption";
 import { QnTypes, qualifyEntityName } from "../qualified-name";
 import type { ClaimKeyDefinition, FeatureDefinition } from "../types";
+import { validateActionWiring, validateFieldWiring } from "./action-wiring";
 import { validateApiExposureMatching, validateExtensionUsages } from "./api-ext";
+import { validateFeatureBootChecks } from "./boot-check";
 import {
   validateCircularDeps,
   validateConfigKeyAllowPerRequest,
   validateConfigKeyBacking,
   validateConfigKeyBounds,
   validateConfigKeyComputed,
+  validateConfigKeyPiiEncrypted,
   validateConfigKeyRequired,
   validateConfigReads,
   warnOnToggleableDependencies,
@@ -26,30 +30,35 @@ import {
   validateReferenceFields,
   validateTransitions,
 } from "./entity-handler";
-import { validateGdprHookCompleteness, validateGdprStoragePersistence } from "./gdpr-storage";
+import { validateEntityListScreens } from "./entity-list-screens";
+import { validateGdprStoragePersistence } from "./gdpr-storage";
 import { validateI18nSurfaceKeys } from "./i18n-keys";
-import { validateOwnershipRules } from "./ownership";
-import { validatePiiAndRetention } from "./pii-retention";
 import {
   collectKnownRoles,
   collectNavQns,
-  collectScreenQns,
-  collectScreensByShortId,
-  collectWorkspaceQns,
   collectWriteHandlerQns,
-  validateDefaultWorkspaceUniqueness,
   validateNavCycles,
   validateNavs,
+} from "./nav";
+import { validateOwnershipRules } from "./ownership";
+import { validatePiiAndRetention } from "./pii-retention";
+import {
+  collectScreenQns,
+  collectScreensByShortId,
   validateScreenShortIdCollisions,
   validateScreens,
+} from "./screens";
+import {
+  collectWorkspaceQns,
+  validateDefaultWorkspaceUniqueness,
   validateWorkspaces,
-} from "./screens-nav";
+} from "./workspaces";
 
 export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns";
 // Re-export: wird von run-dev-app.ts benötigt um Write-Handler-QNs
 // an den Codegen zu übergeben. Nicht Teil von validateBoot, aber
 // dieselbe Extraktionslogik.
-export { collectWriteHandlerQns } from "./screens-nav";
+export { collectWriteHandlerQns } from "./nav";
 
 /**
  * Validates all feature configurations at boot time.
@@ -158,8 +167,15 @@ export function validateBoot(features: readonly FeatureDefinition[]): void {
     validateConfigKeyComputed(feature);
     validateConfigKeyAllowPerRequest(feature);
     validateConfigKeyBacking(feature);
+    validateConfigKeyPiiEncrypted(feature);
     validateOwnershipRules(feature, allClaimKeys, knownRoles);
     validateMultiStreamProjections(feature);
+    // Vor validateScreens: dessen visible/entityId-Feldref-Checks werfen für
+    // einen Function-Wert bereits (mit verwirrender "unknown field undefined"-
+    // Message, weil `typeof fn !== "boolean"` true ist), bevor der klare
+    // Function-Check hier überhaupt liefe.
+    validateActionWiring(feature);
+    validateFieldWiring(feature);
     validateScreens(
       feature,
       featureMap,
@@ -175,12 +191,17 @@ export function validateBoot(features: readonly FeatureDefinition[]): void {
   validateNavCycles(allNavQns);
   validateDefaultWorkspaceUniqueness(allWorkspaceQns);
   validateI18nSurfaceKeys(features);
+  validateEntityListScreens(features);
   validateExtensionPreSaveWiring(features);
   validateGdprStoragePersistence(features);
-  validateGdprHookCompleteness(features);
+  validateFeatureBootChecks(features);
 
-  if (hasEncryptedFields && !process.env["ENCRYPTION_KEY"]) {
-    throw new Error("ENCRYPTION_KEY environment variable is required (encrypted fields in use)");
+  if (hasEncryptedFields) {
+    // Availability check, not env-presence: eagerly building the keyring
+    // catches malformed keys (wrong length, bad base64) at boot instead of
+    // on the first encrypted read in prod. An injected cipher (test seam,
+    // custom KMS provider) satisfies the requirement without env keys.
+    validateEntityFieldEncryptionAvailable();
   }
 
   if (hasFileFields && !process.env["FILE_STORAGE_PROVIDER"]) {