@cosmicdrift/kumiko-renderer-web 1.0.0 → 2.0.0

package/src/__tests__/workspace-shell.test.tsx

@@ -1,7 +1,10 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
+import type { EntityListScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
 import type { WorkspaceSchema } from "@cosmicdrift/kumiko-renderer";
 import {
   createStaticLocaleResolver,
+  DispatcherProvider,
+  KumikoScreen,
   LocaleProvider,
   NavProvider,
   PrimitivesProvider,
@@ -17,7 +20,7 @@ import {
 } from "../layout/workspace-shell";
 import { WorkspaceSwitcher } from "../layout/workspace-switcher";
 import { defaultPrimitives } from "../primitives";
-import { fireEvent, render, screen } from "./test-utils";
+import { createMockDispatcher, fireEvent, render, screen } from "./test-utils";
 
 // jsdom shares window.history across tests in the same file. Reset to /
 // before each render so URL-driven workspace state from one test doesn't
@@ -57,7 +60,6 @@ function ws(
     openToAll?: boolean;
     isDefault?: boolean;
     navMembers?: readonly string[];
-    navigation?: "nav" | "tree";
   } = {},
 ): WorkspaceSchema {
   const access = options.openToAll
@@ -72,7 +74,6 @@ function ws(
       ...(options.order !== undefined && { order: options.order }),
       ...(access !== undefined && { access }),
       ...(options.isDefault === true && { default: true }),
-      ...(options.navigation !== undefined && { navigation: options.navigation }),
     },
     navMembers: options.navMembers ?? [],
   };
@@ -329,10 +330,11 @@ describe("WorkspaceShell", () => {
         <div>content</div>
       </WorkspaceShell>,
     );
-    // admin → system + orders, NOT tours
-    expect(screen.getByText("System")).toBeTruthy();
-    expect(screen.getByText("Orders")).toBeTruthy();
-    expect(screen.queryByText("Tours")).toBeNull();
+    // admin → system + orders, NOT tours. getAllByText: die shadcn-Sidebar
+    // rendert Desktop + Mobile-Sheet, jeder Nav-Eintrag kommt also 2× vor.
+    expect(screen.getAllByText("System").length).toBeGreaterThan(0);
+    expect(screen.getAllByText("Orders").length).toBeGreaterThan(0);
+    expect(screen.queryAllByText("Tours").length).toBe(0);
   });
 
   test("clicking the dispatch tab swaps the visible nav set", () => {
@@ -346,10 +348,10 @@ describe("WorkspaceShell", () => {
       </WorkspaceShell>,
     );
     fireEvent.click(screen.getByTestId("workspace-tab-dispatch"));
-    // dispatch → orders + tours, NOT system
-    expect(screen.getByText("Orders")).toBeTruthy();
-    expect(screen.getByText("Tours")).toBeTruthy();
-    expect(screen.queryByText("System")).toBeNull();
+    // dispatch → orders + tours, NOT system (getAllByText: Desktop + Mobile-Sheet)
+    expect(screen.getAllByText("Orders").length).toBeGreaterThan(0);
+    expect(screen.getAllByText("Tours").length).toBeGreaterThan(0);
+    expect(screen.queryAllByText("System").length).toBe(0);
   });
 
   test("a driver lands on the driver workspace (their only one)", () => {
@@ -365,9 +367,9 @@ describe("WorkspaceShell", () => {
     // Only one workspace → switcher renders nothing, but the nav still
     // shows that workspace's members.
     expect(screen.queryByTestId("workspace-tab-driver")).toBeNull();
-    expect(screen.getByText("Tours")).toBeTruthy();
-    expect(screen.queryByText("System")).toBeNull();
-    expect(screen.queryByText("Orders")).toBeNull();
+    expect(screen.getAllByText("Tours").length).toBeGreaterThan(0);
+    expect(screen.queryAllByText("System").length).toBe(0);
+    expect(screen.queryAllByText("Orders").length).toBe(0);
   });
 
   test("schema without workspaces falls back to plain rendering (all navs visible)", () => {
@@ -710,8 +712,9 @@ describe("WorkspaceShell — AppSchema (multi-feature)", () => {
         <div>content</div>
       </WorkspaceShell>,
     );
-    expect(screen.getByTestId("sidebar-footer")).toBeTruthy();
-    expect(screen.getByTestId("sidebar-footer").textContent).toBe("v1.2.3");
+    const footers = screen.getAllByTestId("sidebar-footer");
+    expect(footers.length).toBeGreaterThan(0);
+    expect(footers[0]?.textContent).toBe("v1.2.3");
   });
 
   test("ohne sidebarFooter-Prop rendert die Sidebar ohne Footer-Slot (default)", () => {
@@ -772,26 +775,23 @@ describe("WorkspaceShell — AppSchema (multi-feature)", () => {
 });
 
 // ---------------------------------------------------------------------------
-// EINE Nav (Visual-Tree-Merge). Der frühere navigation:"tree"/VisualTree-
-// Zweig ist gefaltet: WorkspaceShell rendert IMMER NavTree. Die
-// navigation-Property ist seitdem ein No-op (deferred removal aus
-// WorkspaceDefinition). Im Content-Bereich ersetzt ein aktives target
-// (aus den nav.searchParams) den RoutedScreen durch den EditorPanel.
+// EINE Nav. WorkspaceShell rendert IMMER NavTree. Im Content-Bereich
+// ersetzt ein aktives target (aus den nav.searchParams) den RoutedScreen
+// durch den EditorPanel.
 // ---------------------------------------------------------------------------
 
-describe("WorkspaceShell — EINE Nav (Visual-Tree gefaltet)", () => {
-  test('navigation: "tree" rendert NavTree (Tree-Stub ist gefaltet, kein Switch mehr)', () => {
+describe("WorkspaceShell — EINE Nav", () => {
+  test("workspace rendert NavTree", () => {
     const schema = {
       featureName: "demo",
       entities: {},
       screens: [],
       navs: [{ id: "list", label: "List" }],
       workspaces: [
-        ws("visual", {
-          label: "Visual",
+        ws("admin", {
+          label: "Admin",
           openToAll: true,
           isDefault: true,
-          navigation: "tree",
           navMembers: ["demo:nav:list"],
         }),
       ],
@@ -802,13 +802,16 @@ describe("WorkspaceShell — EINE Nav (Visual-Tree gefaltet)", () => {
         <div>content</div>
       </WorkspaceShell>,
     );
-    // NavTree rendert das nav-Item — auch bei navigation:"tree" (No-op).
     expect(screen.getByText("List")).toBeTruthy();
-    // Der alte VisualTree-Stub existiert nicht mehr.
-    expect(screen.queryByLabelText("Visual Tree (no providers)")).toBeNull();
   });
 
-  test("workspace ohne navigation-Property rendert NavTree (Backwards-Compat)", () => {
+  test("aktives target in der URL rendert EditorPanel statt der screen-children", () => {
+    // Klick auf einen target-Knoten persistiert das target in den
+    // searchParams (?t=feat:action&a_*=...). WorkspaceShell rendert dann
+    // den EditorPanel statt des RoutedScreen. Voller workspace+screen-Pfad,
+    // damit der default-fill-Effect nicht replaced (sonst Verlust der
+    // searchParams). Kein Resolver registriert → EditorPanel-Fallback.
+    window.history.replaceState(null, "", "/admin/x?t=demo:edit&a_id=1");
     const schema = {
       featureName: "demo",
       entities: {},
@@ -829,39 +832,91 @@ describe("WorkspaceShell — EINE Nav (Visual-Tree gefaltet)", () => {
         <div>content</div>
       </WorkspaceShell>,
     );
-    expect(screen.getByText("List")).toBeTruthy();
+    // EditorPanel-Fallback (kein Resolver für demo:edit) — beweist target→Editor.
+    expect(screen.getByRole("heading", { name: "Editor" })).toBeTruthy();
+    // Die screen-children sind ersetzt, nicht zusätzlich gerendert.
+    expect(screen.queryByText("content")).toBeNull();
   });
 
-  test("aktives target in der URL rendert EditorPanel statt der screen-children", () => {
-    // Klick auf einen target-Knoten persistiert das target in den
-    // searchParams (?t=feat:action&a_*=...). WorkspaceShell rendert dann
-    // den EditorPanel statt des RoutedScreen. Voller workspace+screen-Pfad,
-    // damit der default-fill-Effect nicht replaced (sonst Verlust der
-    // searchParams). Kein Resolver registriert → EditorPanel-Fallback.
-    window.history.replaceState(null, "", "/admin/x?t=demo:edit&a_id=1");
+  test("navBadges pass through to NavTree leaf items", () => {
     const schema = {
-      featureName: "demo",
+      featureName: "bmc",
       entities: {},
       screens: [],
-      navs: [{ id: "list", label: "List" }],
+      navs: [
+        { id: "system", label: "System", screen: "bmc:screen:system" },
+        { id: "orders", label: "Orders", screen: "bmc:screen:orders" },
+      ],
       workspaces: [
         ws("admin", {
           label: "Admin",
-          openToAll: true,
+          roles: ["admin"],
+          order: 1,
           isDefault: true,
-          navMembers: ["demo:nav:list"],
+          navMembers: ["bmc:nav:system", "bmc:nav:orders"],
         }),
       ],
     } as const;
 
     renderShell(
-      <WorkspaceShell brand={<div>Brand</div>} schema={schema} user={{ id: "u1", roles: [] }}>
+      <WorkspaceShell
+        brand={<div>Brand</div>}
+        schema={schema}
+        user={{ id: "u1", roles: ["admin"] }}
+        navBadges={new Map([["orders", <span>3</span>]])}
+      >
         <div>content</div>
       </WorkspaceShell>,
     );
-    // EditorPanel-Fallback (kein Resolver für demo:edit) — beweist target→Editor.
-    expect(screen.getByRole("heading", { name: "Editor" })).toBeTruthy();
-    // Die screen-children sind ersetzt, nicht zusätzlich gerendert.
-    expect(screen.queryByText("content")).toBeNull();
+    const ordersItems = screen.getAllByText("Orders");
+    const systemItems = screen.getAllByText("System");
+    expect(ordersItems.some((el) => el.closest("li")?.textContent?.includes("3"))).toBe(true);
+    expect(systemItems.every((el) => !el.closest("li")?.textContent?.includes("3"))).toBe(true);
+  });
+});
+
+// WorkspaceShell threads `user.roles` into a UserRolesProvider around
+// children (#1203) — KumikoScreen reads that to gate role-restricted
+// screens at render time, not just via nav/workspace-switcher filtering.
+describe("WorkspaceShell wires user.roles into children for screen-level access (#1203)", () => {
+  const restrictedScreen: EntityListScreenDefinition = {
+    id: "restricted",
+    type: "entityList",
+    entity: "x",
+    columns: [],
+    access: { roles: ["admin"] },
+  };
+  const schema = {
+    featureName: "bmc",
+    entities: {},
+    screens: [restrictedScreen],
+    navs: [],
+    workspaces: [],
+  } as const;
+
+  test("no user prop → role-gated screen child shows access-denied", () => {
+    renderShell(
+      <DispatcherProvider dispatcher={createMockDispatcher()}>
+        <WorkspaceShell brand={<div>Brand</div>} schema={schema}>
+          <KumikoScreen schema={schema} qn="bmc:screen:restricted" />
+        </WorkspaceShell>
+      </DispatcherProvider>,
+    );
+    expect(screen.getByTestId("kumiko-screen-access-denied")).toBeTruthy();
+  });
+
+  test("user prop with matching role → role-gated screen child renders", () => {
+    renderShell(
+      <DispatcherProvider dispatcher={createMockDispatcher()}>
+        <WorkspaceShell
+          brand={<div>Brand</div>}
+          schema={schema}
+          user={{ id: "u1", roles: ["admin"] }}
+        >
+          <KumikoScreen schema={schema} qn="bmc:screen:restricted" />
+        </WorkspaceShell>
+      </DispatcherProvider>,
+    );
+    expect(screen.queryByTestId("kumiko-screen-access-denied")).toBeNull();
   });
 });

package/src/__tests__/xss-safety.test.tsx

@@ -0,0 +1,62 @@
+//
+// Pins the XSS-escaping behavior for tenant-/pattern-authored content
+// (kumiko-framework#1321). renderer-web has no dangerouslySetInnerHTML
+// and no field-renderer path that wires tenant data into href/src — this
+// test guards JSX auto-escaping against future regressions (e.g. if
+// someone adds rich-text/markdown support via dangerouslySetInnerHTML),
+// and pins the Link primitive's scheme guard (kumiko-framework#1365)
+// against javascript:/data: hrefs as defense-in-depth.
+
+import { describe, expect, test } from "bun:test";
+import { defaultPrimitives } from "../primitives";
+import { StatCard } from "../widgets/stat";
+import { render, screen } from "./test-utils";
+
+const PAYLOAD = '<script>window.__xss = true;</script><img src=x onerror="window.__xss = true">';
+const UNSAFE_HREFS = [
+  "javascript:window.__xss = true",
+  "data:text/html,<script>window.__xss=true</script>",
+  // Browsers strip embedded control/whitespace chars before scheme
+  // detection — a tab/newline mid-scheme must not bypass the check.
+  "java\tscript:window.__xss = true",
+  "java\nscript:window.__xss = true",
+];
+
+describe("XSS-safety (tenant-authored content)", () => {
+  test("Text-Primitive rendert Payload als Text, nicht als HTML", () => {
+    render(<defaultPrimitives.Text testId="txt">{PAYLOAD}</defaultPrimitives.Text>);
+    const node = screen.getByTestId("txt");
+    expect(node.textContent).toBe(PAYLOAD);
+    expect(node.querySelector("script")).toBeNull();
+    expect(node.querySelector("img")).toBeNull();
+  });
+
+  test("StatCard-Widget rendert label/value/sub als Text, nicht als HTML", () => {
+    render(<StatCard testId="stat" label={PAYLOAD} value={PAYLOAD} sub={PAYLOAD} />);
+    const node = screen.getByTestId("stat");
+    expect(node.querySelector("script")).toBeNull();
+    expect(node.querySelector("img")).toBeNull();
+    expect(node.textContent).toContain(PAYLOAD);
+  });
+
+  test.each(UNSAFE_HREFS)("Link-Primitive neutralisiert unsicheren href-Scheme: %s", (href) => {
+    render(
+      <defaultPrimitives.Link testId="link" href={href}>
+        text
+      </defaultPrimitives.Link>,
+    );
+    const node = screen.getByTestId("link");
+    expect(node.getAttribute("href")).toBe("#");
+  });
+
+  test("Link-Primitive lässt sichere hrefs (https/mailto/relativ) unverändert", () => {
+    for (const href of ["https://example.com", "mailto:a@example.com", "/relative/path"]) {
+      render(
+        <defaultPrimitives.Link testId={`link-${href}`} href={href}>
+          text
+        </defaultPrimitives.Link>,
+      );
+      expect(screen.getByTestId(`link-${href}`).getAttribute("href")).toBe(href);
+    }
+  });
+});

package/src/app/__tests__/first-open-screen-qn.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, test } from "bun:test";
+import type { CustomScreenDefinition } from "@cosmicdrift/kumiko-framework/ui-types";
+import type { FeatureSchema } from "@cosmicdrift/kumiko-renderer";
+import { firstOpenScreenQn } from "../create-app";
+
+function feature(
+  overrides: Partial<FeatureSchema> & { readonly featureName: string },
+): FeatureSchema {
+  return { entities: {}, screens: [], ...overrides };
+}
+
+function customScreen(
+  overrides: Partial<CustomScreenDefinition> & { readonly id: string },
+): CustomScreenDefinition {
+  return { type: "custom", renderer: {}, ...overrides };
+}
+
+describe("firstOpenScreenQn", () => {
+  test("picks an open screen that is placed in nav", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "shop",
+        screens: [customScreen({ id: "catalog" })],
+        navs: [{ id: "catalog", label: "shop:nav.catalog", screen: "shop:screen:catalog" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBe("shop:screen:catalog");
+  });
+
+  test("skips a dormant open screen that has no nav entry (#1258)", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "auth-mfa",
+        screens: [customScreen({ id: "auth-mfa-enable", access: { openToAll: true } })],
+        // No nav entry — this is auth-mfa's dormant custom-screen convention.
+      }),
+      feature({
+        featureName: "shop",
+        screens: [customScreen({ id: "catalog" })],
+        navs: [{ id: "catalog", label: "shop:nav.catalog", screen: "shop:screen:catalog" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBe("shop:screen:catalog");
+  });
+
+  test("skips role-restricted screens even when placed in nav", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "admin",
+        screens: [customScreen({ id: "dashboard", access: { roles: ["Admin"] } })],
+        navs: [{ id: "dashboard", label: "admin:nav.dashboard", screen: "admin:screen:dashboard" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBeUndefined();
+  });
+
+  test("returns undefined when no screen is both open and nav-placed", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "auth-mfa",
+        screens: [customScreen({ id: "auth-mfa-enable", access: { openToAll: true } })],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBeUndefined();
+  });
+
+  test("resolves a bare screen id in nav to the qualified screen name", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "shop",
+        screens: [customScreen({ id: "catalog" })],
+        navs: [{ id: "catalog", label: "shop:nav.catalog", screen: "catalog" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBe("shop:screen:catalog");
+  });
+});

package/src/app/browser-locale.ts

@@ -67,7 +67,7 @@ export function createBrowserLocaleResolver(
     timeZone: () => timeZone,
     subscribe: store.subscribe,
     setLocale: (next) => {
-      // Early-Return so we don't write localStorage on a no-op. Store's
+      // skip: locale unchanged, avoid redundant localStorage write
       // own Object.is-Gate would already block listener notification,
       // but the persistence side-effect lives outside the store.
       if (next === store.getSnapshot()) return;

package/src/app/create-app.tsx

@@ -11,6 +11,7 @@ import {
   type ColumnRendererComponent,
   ColumnRenderersProvider,
   CustomScreensProvider,
+  DashboardBodyProvider,
   DispatcherProvider,
   type ExtensionSectionComponent,
   ExtensionSectionsProvider,
@@ -19,13 +20,16 @@ import {
   kumikoDefaultTranslations,
   LiveEventsProvider,
   LocaleProvider,
+  mergeTranslations,
   type NavApi,
   NavProvider,
   PrimitivesProvider,
   type PrimitivesRegistry,
   qualifyScreenId,
   TokensProvider,
+  type TranslationsByLocale,
   toAppSchema,
+  translationsByLocaleFromKeys,
   useNav,
 } from "@cosmicdrift/kumiko-renderer";
 import { type ComponentType, type ReactNode, useMemo } from "react";
@@ -38,6 +42,7 @@ import { useBrowserTokensApi } from "../tokens";
 import { UpdateChecker } from "../version/update-checker";
 import { createBrowserLocaleResolver } from "./browser-locale";
 import { type ClientFeatureDefinition, stackWrappers } from "./client-plugin";
+import { WebDashboardBody } from "./dashboard-body";
 import { useBrowserNavApi } from "./nav";
 import { NavProvidersProvider } from "./nav-providers-context";
 import { type ResolverComponent, ResolversProvider } from "./resolvers-context";
@@ -124,6 +129,42 @@ function readInjectedSchema(): AppSchema | FeatureSchema | undefined {
   return w.__KUMIKO_SCHEMA__;
 }
 
+// Erstes Screen über alle Features in deklarierter Reihenfolge, dessen
+// `access` niemanden ausschließt (undefined oder openToAll). Die Landing-
+// Route wird VOR Auth-Resolution gewählt, kennt also keine User-Rollen —
+// ein role-restricted Screen (z.B. bundled user/tenant, SystemAdmin-only)
+// darf hier nie gewinnen, sonst landet jeder Nicht-Admin auf einem
+// Access-Denied-Screen (#1176).
+// Also requires the screen be reachable via r.nav, otherwise a dormant
+// `type: "custom"` screen a feature only registers for manual app-side
+// placement (e.g. auth-mfa's enable screen) can win by declaration order
+// alone, landing every app without an explicit `screenQn` on a screen
+// nobody wired a component for (#1258).
+export function firstOpenScreenQn(features: readonly FeatureSchema[]): string | undefined {
+  // NavDefinition.screen carries two shapes in practice: most bundled
+  // features author it pre-qualified ("tenant:screen:members"), but the
+  // config settings-hub generator emits the bare short id. Index both
+  // forms so nav-reachability doesn't depend on which convention a given
+  // feature happens to use.
+  const navScreenQns = new Set<string>();
+  for (const f of features) {
+    for (const n of f.navs ?? []) {
+      if (n.screen === undefined) continue;
+      navScreenQns.add(n.screen);
+      navScreenQns.add(qualifyScreenId(f.featureName, n.screen));
+    }
+  }
+  for (const feature of features) {
+    const openScreen = feature.screens.find(
+      (s) =>
+        (s.access === undefined || "openToAll" in s.access) &&
+        navScreenQns.has(qualifyScreenId(feature.featureName, s.id)),
+    );
+    if (openScreen !== undefined) return qualifyScreenId(feature.featureName, openScreen.id);
+  }
+  return undefined;
+}
+
 export function createKumikoApp(options: CreateKumikoAppOptions = {}): { readonly root: Root } {
   const rootId = options.rootId ?? "root";
   const container = document.getElementById(rootId);
@@ -149,19 +190,11 @@ export function createKumikoApp(options: CreateKumikoAppOptions = {}): { readonl
   }
   const app = toAppSchema(rawSchema);
 
-  // Fallback-Screen: erstes Screen über alle Features in deklarierter
-  // Reihenfolge. War vorher schema.screens[0], jetzt search the first
-  // feature with screens.
-  const firstFeatureWithScreens = app.features.find((f) => f.screens.length > 0);
-  const firstScreen = firstFeatureWithScreens?.screens[0];
-  const fallbackQn =
-    options.screenQn ??
-    (firstScreen !== undefined && firstFeatureWithScreens !== undefined
-      ? qualifyScreenId(firstFeatureWithScreens.featureName, firstScreen.id)
-      : undefined);
+  // Fallback-Screen falls kein explizites screenQn übergeben wurde.
+  const fallbackQn = options.screenQn ?? firstOpenScreenQn(app.features);
   if (!fallbackQn) {
     throw new Error(
-      "createKumikoApp: schema contains no screens. Add at least one entry to `schema.screens` or pass `screenQn` explicitly.",
+      "createKumikoApp: schema contains no screens accessible without a role restriction. Add at least one entry to `schema.screens` without `access.roles`, or pass `screenQn` explicitly.",
     );
   }
 
@@ -175,12 +208,24 @@ export function createKumikoApp(options: CreateKumikoAppOptions = {}): { readonl
   const clientFeatures = options.clientFeatures ?? [];
   const providers = clientFeatures.flatMap((f) => f.providers ?? []);
   const gates = clientFeatures.flatMap((f) => f.gates ?? []);
-  // Framework-Default-Bundle als ALLERLETZTER Fallback — App-Resolver +
-  // clientFeatures.translations haben Vorrang. Apps können einzelne
-  // kumiko.*-Keys via clientFeatures.translations überschreiben (z.B.
-  // "kumiko.actions.save" → "Sichern" für ein bestimmtes Feature).
+  // Precedence in fallbackBundles (Array-Order = Priorität, höchste zuerst):
+  //   1. clientFeatures.translations — App-Overrides gewinnen immer, auch
+  //      gegen framework-eigene Labels.
+  //   2. schemaTranslations — server-authored r.translations, von
+  //      buildAppSchema verbatim projiziert (#1059). Ohne dieses Bundle
+  //      resolven Nav-/Screen-Labels nur, wenn eine App sie ZUSÄTZLICH in
+  //      web/i18n.ts dupliziert — die meisten bundled-features taten das
+  //      nie, Labels rendern dann als rohe i18n-Keys.
+  //   3. kumikoDefaultTranslations — Framework-Defaults, ALLERLETZTER
+  //      Fallback.
+  const schemaTranslations = app.features.reduce<TranslationsByLocale>(
+    (acc, f) =>
+      f.translations ? mergeTranslations(acc, translationsByLocaleFromKeys(f.translations)) : acc,
+    {},
+  );
   const fallbackBundles = [
     ...clientFeatures.flatMap((f) => (f.translations !== undefined ? [f.translations] : [])),
+    schemaTranslations,
     kumikoDefaultTranslations,
   ];
   // Custom-Screen-Components-Map mergen: spätere Features überschreiben
@@ -285,20 +330,22 @@ export function createKumikoApp(options: CreateKumikoAppOptions = {}): { readonl
         <PrimitivesProvider value={primitives}>
           <DispatcherProvider dispatcher={dispatcher}>
             <LiveEventsProvider value={liveEvents}>
-              <CustomScreensProvider value={customScreens}>
-                <ColumnRenderersProvider value={columnRenderers}>
-                  <ExtensionSectionsProvider value={extensionSectionComponents}>
-                    <NavProvidersProvider value={navProviders} entities={navEntities}>
-                      <ResolversProvider resolvers={resolvers}>
-                        <ToastProvider>
-                          <UpdateChecker />
-                          {stackWrappers(providers, stackWrappers(gates, screenNode))}
-                        </ToastProvider>
-                      </ResolversProvider>
-                    </NavProvidersProvider>
-                  </ExtensionSectionsProvider>
-                </ColumnRenderersProvider>
-              </CustomScreensProvider>
+              <DashboardBodyProvider value={WebDashboardBody}>
+                <CustomScreensProvider value={customScreens}>
+                  <ColumnRenderersProvider value={columnRenderers}>
+                    <ExtensionSectionsProvider value={extensionSectionComponents}>
+                      <NavProvidersProvider value={navProviders} entities={navEntities}>
+                        <ResolversProvider resolvers={resolvers}>
+                          <ToastProvider>
+                            <UpdateChecker />
+                            {stackWrappers(providers, stackWrappers(gates, screenNode))}
+                          </ToastProvider>
+                        </ResolversProvider>
+                      </NavProvidersProvider>
+                    </ExtensionSectionsProvider>
+                  </ColumnRenderersProvider>
+                </CustomScreensProvider>
+              </DashboardBodyProvider>
             </LiveEventsProvider>
           </DispatcherProvider>
         </PrimitivesProvider>
@@ -436,6 +483,25 @@ function RoutedScreen({
     };
   }, [onRowClick, app.features, nav]);
 
+  // Copy-Link-Action (Issue #912) für entityEdit-Update-Screens. Baut die
+  // absolute Permalink-URL aus der aktuellen Route + kopiert sie —
+  // `navigator`/`window` sind hier erlaubt (renderer-web, kein
+  // platform-neutrales Package). Kein Button ohne entityId (create-mode).
+  // Silent-catch bei Clipboard-Fehler (non-secure context) mirrort das
+  // bestehende Muster in pat-tokens-screen.tsx.
+  const effectiveOnCopyLink = useMemo<(() => Promise<void> | void) | undefined>(() => {
+    const route = nav.route;
+    if (route?.entityId === undefined) return undefined;
+    return async () => {
+      const url = `${window.location.origin}${nav.hrefFor(route)}`;
+      try {
+        await navigator.clipboard.writeText(url);
+      } catch {
+        // clipboard blocked (non-secure context) — no fallback UI needed here
+      }
+    };
+  }, [nav]);
+
   // KumikoScreen will nach wie vor ein single-feature schema. Wir
   // füttern es mit dem owning Feature — es enthält Entity-Defs +
   // Screen-Defs für den aktiven Render-Pfad. Kein Owner gefunden → wir
@@ -455,6 +521,7 @@ function RoutedScreen({
       {...(translate !== undefined && { translate })}
       {...(entityId !== undefined && { entityId })}
       onRowClick={effectiveOnRowClick}
+      {...(effectiveOnCopyLink !== undefined && { onCopyLink: effectiveOnCopyLink })}
     />
   );
 }