@cosmicdrift/kumiko-samples 0.401.0 → 0.402.0

package/packages/bundled-features/src/inbound-mail-foundation/watch-supervisor.ts

@@ -17,11 +17,9 @@
 //     db,
 //     dispatchWrite: ({ handlerQn, payload, tenantId }) =>
 //       deps.dispatchSystemWrite({ handlerQn, payload, tenantId: tenantId as TenantId }),
-//     // Multi-worker deployments: share one DistributedLock (same Redis,
-//     // same key prefix) across every worker process so only one of them
-//     // holds the IMAP IDLE connection per account. Omit `lock`
-//     // for a single-process deployment — every active account gets
-//     // watched locally, as before.
+//     // One DistributedLock (same Redis, same key prefix) shared across
+//     // every worker process, so only one of them holds the IMAP IDLE
+//     // connection per account.
 //     lock: createDistributedLock(redis, `${RedisKeys.lock}inbound-mail:watch:`),
 //   });
 //   await supervisor.start();
@@ -34,7 +32,7 @@
 // **Multi-worker coordination:** the reconciliation poll remains deliberately
 // N-fold: every worker polls every active account, which is idempotent and
 // cheap. Only `plugin.watch()` holds a long-lived connection, and only one
-// worker may hold it per account. With `deps.lock`, `ensureWatcher` claims a
+// worker may hold it per account. `ensureWatcher` claims a
 // TTL lease (`lock.acquire`) before connecting; a worker that fails to claim
 // it leaves the account to its current holder, while the poll still covers
 // it. The holder renews the lease via heartbeat (`lock.renew`, every ttl/3)
@@ -435,7 +433,7 @@ export function createInboundMailSupervisor(
         log(`inbound-mail: stop watcher ${accountId} failed: ${describeError(err)}`);
       }
     }
-    if (deps.lock && lockToken) {
+    if (lockToken) {
       try {
         await deps.lock.release(accountId, lockToken);
       } catch (err) {

package/packages/bundled-features/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "The public render caches a sanitized document body per page version",
+    "detail": "The render cache holds up to 500 entries keyed on tenant, slug, language, version and format. Bodies larger than 256 KB are sanitized on every render and not cached."
+  },
   {
     "version": "0.395.0",
     "type": "breaking",

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -263,7 +263,15 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
 
         const html = wrapLayout({
           title: data.title,
-          bodyHtml: renderPageBody({ slug, body: data.body, bodyFormat: data.bodyFormat }),
+          bodyHtml: renderPageBody({
+            tenantId,
+            slug,
+            lang,
+            version: data.version,
+            updatedAt: data.updatedAt,
+            body: data.body,
+            bodyFormat: data.bodyFormat,
+          }),
           lang: data.lang,
           slug,
           description: data.description,

package/packages/bundled-features/src/managed-pages/render-page-body.ts

@@ -7,22 +7,76 @@ type WarnLogger = Pick<Logger, "warn">;
 
 const defaultLog = createFallbackLogger("managed-pages");
 
+const MAX_CACHED_BODIES = 500;
+// Bounds the cache memory: 500 entries of arbitrary size could otherwise pin
+// hundreds of MB. A bigger body is still served, just re-rendered per request.
+const MAX_CACHED_BODY_LENGTH = 256 * 1024;
+
 export type RenderablePageBody = {
+  readonly tenantId: string;
   readonly slug: string;
+  readonly lang: string;
+  readonly version: number;
+  readonly updatedAt: string;
   readonly body: string;
   readonly bodyFormat: BodyFormat;
 };
 
-// A document body is re-sanitized at render time even though writes validate it:
-// rows can predate the validation or arrive through other writers. A rejected
-// document renders as an empty body (never the raw HTML) and is logged.
-export function renderPageBody(page: RenderablePageBody, log: WarnLogger = defaultLog): string {
-  if (page.bodyFormat === "markdown") return renderSafeMarkdown(page.body);
-  const result = sanitizeDocumentHtml(page.body);
-  if (result.ok) return result.html;
-  log.warn("managed page document body rejected at render, serving an empty body", {
-    slug: page.slug,
-    violations: result.violations.map((violation) => violation.code),
-  });
-  return "";
+export type PageBodyRendererDeps = {
+  readonly sanitizeDocument?: typeof sanitizeDocumentHtml;
+  readonly renderMarkdown?: (markdown: string) => string;
+  readonly maxEntries?: number;
+};
+
+// Every write bumps the version, so a (page, version) key never serves stale
+// HTML. A Map keeps insertion order: delete+reinsert on a hit makes the first
+// key the least recently used one.
+function cacheKeyOf(page: RenderablePageBody): string {
+  return [page.tenantId, page.slug, page.lang, page.version, page.updatedAt, page.bodyFormat].join(
+    "\u0000",
+  );
+}
+
+// Writes store the rebuilt, sanitized HTML, but rows can predate that validation
+// or arrive through other writers, so a render still sanitizes — once per page
+// version instead of once per request. A rejected document renders as an empty
+// body (never the raw HTML), is logged on the miss, and the empty result is cached.
+export function createPageBodyRenderer(
+  deps: PageBodyRendererDeps = {},
+): (page: RenderablePageBody, log?: WarnLogger) => string {
+  const sanitizeDocument = deps.sanitizeDocument ?? sanitizeDocumentHtml;
+  const renderMarkdown = deps.renderMarkdown ?? renderSafeMarkdown;
+  const maxEntries = deps.maxEntries ?? MAX_CACHED_BODIES;
+  const cache = new Map<string, string>();
+
+  function renderUncached(page: RenderablePageBody, log: WarnLogger): string {
+    if (page.bodyFormat === "markdown") return renderMarkdown(page.body);
+    const result = sanitizeDocument(page.body);
+    if (result.ok) return result.html;
+    log.warn("managed page document body rejected at render, serving an empty body", {
+      slug: page.slug,
+      violations: result.violations.map((violation) => violation.code),
+    });
+    return "";
+  }
+
+  return (page, log = defaultLog) => {
+    const key = cacheKeyOf(page);
+    const cached = cache.get(key);
+    if (cached !== undefined) {
+      cache.delete(key);
+      cache.set(key, cached);
+      return cached;
+    }
+    const html = renderUncached(page, log);
+    if (html.length > MAX_CACHED_BODY_LENGTH) return html;
+    cache.set(key, html);
+    if (cache.size > maxEntries) {
+      const oldest = cache.keys().next();
+      if (!oldest.done) cache.delete(oldest.value);
+    }
+    return html;
+  };
 }
+
+export const renderPageBody = createPageBodyRenderer();

package/packages/bundled-features/src/managed-pages/web/i18n.ts

@@ -57,11 +57,10 @@ export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
   "managed-pages:body.lossy.warning": {
     en: "This page was written in Markdown. Converting it to the editor drops: {features}. Check the result before saving.",
   },
-  "managed-pages:body.lossy.image": { en: "images" },
+  "managed-pages:body.lossy.image": { en: "external images" },
   "managed-pages:body.lossy.blockquote": { en: "block quotes" },
   "managed-pages:body.lossy.code": { en: "code" },
   "managed-pages:body.lossy.deepHeading": { en: "headings below level 3" },
-  "managed-pages:body.lossy.relativeLink": { en: "relative links" },
 
   // Row-Actions + Confirm (pageListScreen)
   "managed-pages:actions.edit": { en: "Edit" },

package/packages/bundled-features/src/managed-pages/web/lossy-markdown.ts

@@ -1,18 +1,9 @@
-import { isAllowedDocumentLinkHref } from "@cosmicdrift/kumiko-bundled-features/template-resolver/document-schema";
 import { Lexer, type Token } from "marked";
 
-export const LOSSY_MARKDOWN_FEATURES = [
-  "image",
-  "blockquote",
-  "code",
-  "deepHeading",
-  "relativeLink",
-] as const;
+export const LOSSY_MARKDOWN_FEATURES = ["image", "blockquote", "code", "deepHeading"] as const;
 export type LossyMarkdownFeature = (typeof LOSSY_MARKDOWN_FEATURES)[number];
 
-// The document editor has no image, quote or code nodes, only three heading
-// levels, and links must pass the document link policy (absolute http(s),
-// mailto, tel, placeholders).
+// The document editor has no image, quote or code nodes and only three heading levels.
 const MAX_DOCUMENT_HEADING_DEPTH = 3;
 
 function tokenList(value: unknown): readonly Token[] {
@@ -31,12 +22,6 @@ function isDeepHeading(token: Token): boolean {
   );
 }
 
-function isRelativeLink(token: Token): boolean {
-  return (
-    "href" in token && typeof token.href === "string" && !isAllowedDocumentLinkHref(token.href)
-  );
-}
-
 function featuresOf(token: Token): readonly LossyMarkdownFeature[] {
   switch (token.type) {
     case "image":
@@ -48,8 +33,6 @@ function featuresOf(token: Token): readonly LossyMarkdownFeature[] {
       return ["code"];
     case "heading":
       return isDeepHeading(token) ? ["deepHeading"] : [];
-    case "link":
-      return isRelativeLink(token) ? ["relativeLink"] : [];
     default:
       return [];
   }

package/packages/bundled-features/src/managed-pages/web/markdown-to-document.ts

@@ -3,8 +3,8 @@ import { escapeHtml } from "@cosmicdrift/kumiko-renderer/headless";
 import { Marked } from "marked";
 
 // The server sanitizer rejects what it cannot keep, so the conversion drops it up front and the
-// lossy banner stays true: a link outside the document link policy keeps its text, an image
-// (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
+// lossy banner stays true: a link outside the document link policy keeps its text, an external
+// image (no uploaded resource to point at) is dropped, and raw HTML is shown as text.
 const converter = new Marked({ gfm: false, breaks: false });
 converter.use({
   renderer: {

package/packages/bundled-features/src/managed-pages/web/page-body-section.tsx

@@ -14,7 +14,6 @@ const LOSSY_LABEL_KEYS: Readonly<Record<LossyMarkdownFeature, string>> = {
   blockquote: "managed-pages:body.lossy.blockquote",
   code: "managed-pages:body.lossy.code",
   deepHeading: "managed-pages:body.lossy.deepHeading",
-  relativeLink: "managed-pages:body.lossy.relativeLink",
 };
 
 const BODY_EDITOR_ID = "managed-pages-page-body";

package/packages/bundled-features/src/readiness/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "fix",
+    "title": "System-check history keeps runs of the same second in order",
+    "detail": "`probe-run:list` returned `requestedAt` as `Instant.toString()`, which drops trailing zeros in the fraction, and `pageRows` sorts that field as a string. Two runs in the same second could then come out reversed (`…:20Z` sorted after `…:20.001Z`), so the history showed the older run on top and a click opened it. `requestedAt` now always carries six fractional digits, so string order matches time order."
+  },
   {
     "version": "0.392.0",
     "type": "improvement",

package/packages/bundled-features/src/readiness/handlers/run-list.query.ts

@@ -29,7 +29,8 @@ export const runListQuery = defineQueryHandler({
       const { counts, outcome } = viewRun(run, query.user);
       return {
         id: run.id,
-        requestedAt: run.requestedAt.toString(),
+        // Fixed width: pageRows sorts this as a string, and a trimmed fraction ("…20Z" vs "…20.001Z") sorts wrong.
+        requestedAt: run.requestedAt.toString({ fractionalSecondDigits: 6 }),
         triggeredByUserId: run.triggeredByUserId,
         triggeredByName: starterNames.get(run.triggeredByUserId) ?? run.triggeredByUserId,
         status: run.status,

package/packages/bundled-features/src/readiness/run-view.ts

@@ -1,5 +1,6 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { PROBE_RUN_STATUS, probeRunsTable } from "./schema/probe-run.ts";
 import {
   countResults,
@@ -10,14 +11,12 @@ import {
   visibleResults,
 } from "./visible-results.ts";
 
-type InstantLike = { readonly toString: () => string };
-
 export type RunRow = {
   readonly id: string;
   readonly status: string;
-  readonly requestedAt: InstantLike;
-  readonly startedAt: InstantLike | null;
-  readonly finishedAt: InstantLike | null;
+  readonly requestedAt: Temporal.Instant;
+  readonly startedAt: Temporal.Instant | null;
+  readonly finishedAt: Temporal.Instant | null;
   readonly triggeredByUserId: string;
   readonly durationMs: number | null;
   readonly results: unknown;

package/packages/bundled-features/src/template-resolver/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Document anchors accept relative links",
+    "detail": "An anchor href in a document body may be relative (/path, ./, ../, #, ?); never // or a backslash. Other URL attributes (image src and similar) and mail links still accept only explicit schemes or placeholders. The sanitizer, the editor schema, compileDocumentBody and the confirmation mail use the same split."
+  },
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "Collection nav takes entryLabel for the create title",
+    "detail": "A collection's nav takes an optional entryLabel (singular i18n key, new in the nav type and in the required surface keys of all locale packages). The create screen title reads \"New {label}\", or \"New entry\" without it."
+  },
   {
     "version": "0.395.0",
     "type": "breaking",

package/packages/bundled-features/src/template-resolver/compile-document-body.ts

@@ -7,7 +7,7 @@ import { conditionScopeElement, withParsedDocument } from "./document-sanitizer.
 import {
   DOCUMENT_CONDITION_ATTRIBUTE,
   DOCUMENT_TEXT_ALIGNMENTS,
-  isAllowedDocumentLinkHref,
+  isAllowedDocumentUrlHref,
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,
@@ -170,7 +170,7 @@ function rewriteLink(element: ScanElement, state: CompileState): void {
     } else {
       element.setAttribute("href", "#");
     }
-  } else if (!isAllowedDocumentLinkHref(href)) {
+  } else if (!isAllowedDocumentUrlHref(href)) {
     element.setAttribute("href", "#");
   }
 }

package/packages/bundled-features/src/template-resolver/document-sanitizer.ts

@@ -11,6 +11,7 @@ import {
   DOCUMENT_CONDITION_ATTRIBUTE,
   documentExtensions,
   isAllowedDocumentLinkHref,
+  isAllowedDocumentUrlHref,
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,
@@ -101,7 +102,7 @@ function scanAnchor(element: ScanElement, out: DocumentViolation[]): void {
       violation(
         "disallowed_link_href",
         href,
-        `Link target "${href}" is not allowed; use https, http, mailto, tel or a {{placeholder}}`,
+        `Link target "${href}" is not allowed; use https, http, mailto, tel, a relative path or a {{placeholder}}`,
       ),
     );
   }
@@ -197,7 +198,7 @@ function scanUrlAttributes(tag: string, element: ScanElement, out: DocumentViola
           `Images must reference an uploaded resource via data-resource; image source "${value}" is not allowed`,
         ),
       );
-    } else if (tag === "base" || !isAllowedDocumentLinkHref(value)) {
+    } else if (tag === "base" || !isAllowedDocumentUrlHref(value)) {
       out.push(
         violation(
           "disallowed_link_href",

package/packages/bundled-features/src/template-resolver/index.ts

@@ -160,6 +160,7 @@ export {
   DocumentVariable,
   documentExtensions,
   isAllowedDocumentLinkHref,
+  isAllowedDocumentUrlHref,
   isDocumentPlaceholderHref,
   isDocumentReferenceName,
   isDocumentResourceKey,

package/packages/bundled-features/src/template-resolver/web/document-schema.ts

@@ -45,15 +45,32 @@ function hasAllowedLinkScheme(href: string): boolean {
   return ALLOWED_LINK_SCHEMES.some((scheme) => href.startsWith(scheme));
 }
 
+// Relative references are matched by their literal leading character so a
+// scheme can never hide in them: a value starting with a letter ("x:y",
+// "javascript:") is not relative. Protocol-relative "//host" and any backslash
+// (browsers read "/\\host" as "//host") would leave the site.
+const RELATIVE_HREF_PREFIXES = ["/", "./", "../", "#", "?"] as const;
+
+function isRelativeHref(href: string): boolean {
+  if (href.includes("\\") || href.startsWith("//")) return false;
+  return RELATIVE_HREF_PREFIXES.some((prefix) => href.startsWith(prefix));
+}
+
 // Exact lowercase prefix on the unchanged value: no trim, no case folding, so
 // "JaVaScRiPt:", "HTTPS://" or a leading tab can never slip through as a
 // scheme variant. Markup and control characters are refused outright because
 // downstream parsers (MJML, PDF renderer) re-read the serialized attribute.
-export function isAllowedDocumentLinkHref(href: string): boolean {
+export function isAllowedDocumentUrlHref(href: string): boolean {
   if (hasUnsafeUrlCharacter(href)) return false;
   return hasAllowedLinkScheme(href) || isDocumentPlaceholderHref(href);
 }
 
+// Anchors only: other URL attributes (form action, svg href) resolve against the
+// page and must stay on explicit schemes or placeholders.
+export function isAllowedDocumentLinkHref(href: string): boolean {
+  return isAllowedDocumentUrlHref(href) || (!hasUnsafeUrlCharacter(href) && isRelativeHref(href));
+}
+
 export function isDocumentResourceKey(value: string): boolean {
   return RESOURCE_KEY.test(value);
 }

package/packages/bundled-features/src/template-resolver/web/i18n.ts

@@ -22,7 +22,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "template-resolver.documentEditor.insertPlaceholder": "Placeholder",
     "template-resolver.documentEditor.invalidImageAlt": "The alt text must not contain < or >.",
     "template-resolver.documentEditor.invalidLink":
-      "This link target is not allowed. Use https, http, mailto, tel or a placeholder.",
+      "This link target is not allowed. Use https, http, mailto, tel, a relative path or a placeholder.",
     "template-resolver.documentEditor.invalidResourceKey": "This resource key is not valid.",
     "template-resolver.documentEditor.link": "Link",
     "template-resolver.documentEditor.linkHref": "Link target",
@@ -64,7 +64,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "templateResolver.errors.document.buttonHrefNotPlaceholder":
       "The button target “{detail}” must be a placeholder.",
     "templateResolver.errors.document.disallowedLinkHref":
-      "Link target “{detail}” is not allowed; use https, http, mailto, tel or a placeholder.",
+      "Link target “{detail}” is not allowed; use https, http, mailto, tel, a relative path or a placeholder.",
     "templateResolver.errors.document.documentRequiresHtmlFormat":
       "This template kind requires the html format, got “{detail}”.",
     "templateResolver.errors.document.layoutRequiresMjmlFormat":

package/packages/bundled-features/src/template-resolver/web/use-collection-entry-create.ts

@@ -36,9 +36,11 @@ export function useCollectionEntryCreate(target: TargetRef, tenantId: string | u
 
   const slugValid = slug.length <= SLUG_MAX_LENGTH && SLUG_PATTERN.test(slug);
   const disabled = submitting || !canWrite || collectionId === undefined;
-  const headerTitle = t("template-resolver.editor.newEntryTitle", {
-    label: collection !== undefined ? t(collection.nav.label) : "",
-  });
+  const entryLabel = collection?.nav.entryLabel;
+  const headerTitle =
+    entryLabel !== undefined
+      ? t("template-resolver.editor.newEntryTitle", { label: t(entryLabel) })
+      : t("template-resolver.editor.newEntry");
 
   const create = async (): Promise<void> => {
     // skip: nothing to write to, or the slug is invalid (the field already shows the issue)

package/packages/bundled-features/src/user-data-rights/boot-checks.ts

@@ -1,9 +1,12 @@
 import {
+  bootRuleError,
+  collectBootRuleViolations,
   EXT_USER_DATA,
   type FeatureDefinition,
   type ResolvedPiiFlags,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { entitiesOf } from "../shared/index.ts";
+import { USER_DATA_RIGHTS_BOOT_RULES } from "./boot-rules.ts";
 
 // V2: export-without-erase gate. A feature that registers an EXT_USER_DATA
 // export hook without a matching delete hook exports data under Art.20 but
@@ -19,25 +22,27 @@ import { entitiesOf } from "../shared/index.ts";
 // fails otherwise); running this from user-data-rights' own bootCheck is
 // equivalent to the framework-internal call it replaces.
 export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
-  for (const feature of features) {
-    for (const usage of feature.extensionUsages) {
-      if (usage.extensionName !== EXT_USER_DATA) continue;
-      const hasExport = typeof usage.options?.["export"] === "function";
-      const hasDelete = typeof usage.options?.["delete"] === "function";
-      // The compile-time "at least one hook" type is bypassed by string-typed
-      // extension names and casts; without this an empty bag registers nothing.
-      if (!hasExport && !hasDelete) {
-        throw new Error(
-          `[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`,
-        );
-      }
-      if (hasExport && !hasDelete) {
-        throw new Error(
-          `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
-        );
-      }
+  const usages = features.flatMap((feature) =>
+    feature.extensionUsages
+      .filter((usage) => usage.extensionName === EXT_USER_DATA)
+      .map((usage) => ({ feature, usage })),
+  );
+  collectBootRuleViolations(usages, ({ feature, usage }) => {
+    const hasExport = typeof usage.options?.["export"] === "function";
+    const hasDelete = typeof usage.options?.["delete"] === "function";
+    // The compile-time "at least one hook" type is bypassed by string-typed
+    // extension names and casts; without this an empty bag registers nothing.
+    if (!hasExport && !hasDelete) {
+      throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.emptyHook, {
+        message: `[kumiko:boot] Feature "${feature.name}" registers EXT_USER_DATA for entity "${usage.entityName}" with neither an export nor a delete hook — the entity silently stays out of the Art.15/17/20 pipeline. Register at least one hook.`,
+      });
     }
-  }
+    if (hasExport && !hasDelete) {
+      throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.exportWithoutDelete, {
+        message: `[kumiko:boot] Feature "${feature.name}" exports entity "${usage.entityName}" via EXT_USER_DATA but registers no delete hook — data is included in Art.20 exports but never erased on forget (Art.17 violation). Add a delete hook. If erasure is intentionally handled elsewhere (e.g. crypto-shredding key-erase, parent cascade), register a no-op delete: async () => {} with a comment explaining why.`,
+      });
+    }
+  });
 }
 
 // V3: PII-entity-without-hook gate. V2 checks registered hooks for
@@ -60,19 +65,22 @@ export function validateGdprPiiHookCoverage(features: readonly FeatureDefinition
     }
   }
 
-  for (const feature of features) {
-    for (const [entityName, entity] of entitiesOf(feature)) {
-      if (hookedEntities.has(entityName)) continue;
-      const subjectFields = Object.entries(entity.fields)
-        .filter(([, field]) => {
-          const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk
-          return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
-        })
-        .map(([name]) => name);
-      if (subjectFields.length === 0) continue;
-      throw new Error(
-        `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
-      );
-    }
-  }
+  const entities = features.flatMap((feature) =>
+    [...entitiesOf(feature)].map(([entityName, entity]) => ({ feature, entityName, entity })),
+  );
+  collectBootRuleViolations(entities, ({ feature, entityName, entity }) => {
+    // skip: an entity with a registered hook is covered
+    if (hookedEntities.has(entityName)) return;
+    const subjectFields = Object.entries(entity.fields)
+      .filter(([, field]) => {
+        const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk
+        return Boolean(annot.pii) || Boolean(annot.userOwned) || Boolean(annot.subjectRef);
+      })
+      .map(([name]) => name);
+    // skip: an entity without user-subject fields stays out of the pipeline by design
+    if (subjectFields.length === 0) return;
+    throw bootRuleError(USER_DATA_RIGHTS_BOOT_RULES.missingHook, {
+      message: `[kumiko:boot] Entity "${entityName}" (feature "${feature.name}") has user-subject fields (${subjectFields.join(", ")}) but no feature registers an EXT_USER_DATA hook for it — the data never appears in Art.15/20 exports and is never erased on forget (Art.17 gap). Register r.useExtension(EXT_USER_DATA, "${entityName}", { export, delete }) in the owning feature or a defaults feature. If this entity is intentionally out of the pipeline (e.g. crypto-shredding key-erase covers it), register a no-op hook { export: async () => null, delete: async () => {} } with a comment explaining why.`,
+    });
+  });
 }

package/packages/bundled-features/src/user-data-rights/boot-rules.ts

@@ -0,0 +1,19 @@
+import type { BootRuleTable } from "@cosmicdrift/kumiko-framework/engine";
+
+export const USER_DATA_RIGHTS_BOOT_RULES = {
+  emptyHook: {
+    id: "user-data-rights/empty-hook",
+    summary: "An EXT_USER_DATA registration declares at least one of an export or a delete hook.",
+    fix: "Register at least one hook.",
+  },
+  exportWithoutDelete: {
+    id: "user-data-rights/export-without-delete",
+    summary: "An entity exported via EXT_USER_DATA also registers a delete hook.",
+    fix: "Add a delete hook, or a documented no-op delete if erasure is handled elsewhere.",
+  },
+  missingHook: {
+    id: "user-data-rights/missing-hook",
+    summary: "An entity with user-subject fields registers an EXT_USER_DATA hook.",
+    fix: "Register r.useExtension(EXT_USER_DATA, ...) for the entity, or a documented no-op hook if it is covered elsewhere.",
+  },
+} as const satisfies BootRuleTable;

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.402.0",
+    "type": "improvement",
+    "title": "user-data-rights boot checks report rule ids",
+    "detail": "The bootChecks of user-data-rights report `user-data-rights/empty-hook`, `user-data-rights/export-without-delete` and `user-data-rights/missing-hook` with a fix, and list every missing or empty hook of a run instead of stopping at the first. Message texts are unchanged."
+  },
+  {
+    "version": "0.402.0",
+    "type": "fix",
+    "title": "request-deletion-screen shows one deletion card",
+    "detail": "The request form no longer draws its own card inside the screen's card, so the screen shows one deletion card."
+  },
   {
     "version": "0.390.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/web/request-deletion-screen.tsx

@@ -77,24 +77,26 @@ export function RequestAccountDeletionScreen({
           <p className="text-sm text-muted-foreground">
             {t("userDataRights.deletion.request.intro")}
           </p>
-          <Form onSubmit={onSubmit}>
-            <Field id="delete-email" label={t("userDataRights.deletion.request.email")} required>
-              <Input
-                kind="text"
-                id="delete-email"
-                name="delete-email"
-                value={email}
-                onChange={setEmail}
-                disabled={submitting}
-                required
-              />
-            </Field>
-            {error !== null && <Banner variant="error">{error}</Banner>}
-            <Button type="submit" loading={submitting} disabled={submitting}>
-              {submitting
-                ? t("userDataRights.deletion.request.submitting")
-                : t("userDataRights.deletion.request.submit")}
-            </Button>
+          <Form chromeless onSubmit={onSubmit}>
+            <div className="flex flex-col gap-4">
+              <Field id="delete-email" label={t("userDataRights.deletion.request.email")} required>
+                <Input
+                  kind="text"
+                  id="delete-email"
+                  name="delete-email"
+                  value={email}
+                  onChange={setEmail}
+                  disabled={submitting}
+                  required
+                />
+              </Field>
+              {error !== null && <Banner variant="error">{error}</Banner>}
+              <Button type="submit" loading={submitting} disabled={submitting}>
+                {submitting
+                  ? t("userDataRights.deletion.request.submitting")
+                  : t("userDataRights.deletion.request.submit")}
+              </Button>
+            </div>
           </Form>
         </div>
       )}

package/samples/apps/use-all-bundled/src/app/collection-labels-feature.ts

@@ -1,6 +1,6 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 
-// Nav labels for the two content collections this app mounts. Collection ids
+// Nav and entry labels for the two content collections this app mounts. Collection ids
 // are the app's choice, so their labels are too — a bundled feature cannot ship
 // a translation key for a collection it never named. Every app that declares a
 // collection carries its labels the same way.
@@ -9,7 +9,9 @@ export const collectionLabelsFeature = defineFeature("collection-labels", (r) =>
   r.translations({
     keys: {
       "templateResolver:nav.snippets": { de: "Bausteine", en: "Snippets" },
+      "templateResolver:nav.snippet": { de: "Baustein", en: "Snippet" },
       "templateResolver:nav.signatures": { de: "Signaturen", en: "Signatures" },
+      "templateResolver:nav.signature": { de: "Signatur", en: "Signature" },
     },
   });
   return {};