@cosmicdrift/kumiko-bundled-features 0.328.0 → 0.329.0

package/src/custom-fields/handlers/set-custom-field.write.ts

@@ -1,123 +0,0 @@
-import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
-import * as z from "zod";
-import { DEFAULT_VALUE_WRITE_ROLES } from "../constants";
-import { customFieldsFeature } from "../feature";
-import { fieldWriteAccessDeniedRoles, loadFieldDefinition } from "../lib/field-access";
-import { buildCustomFieldValueSchema } from "../lib/value-schema";
-
-export const setCustomFieldPayloadSchema = z.object({
-  entityName: z.string().min(1).max(64),
-  entityId: z.string().min(1),
-  fieldKey: z
-    .string()
-    .min(1)
-    .max(64)
-    .regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/),
-  // z.unknown() is implicitly optional; reject a missing value here (clearing is
-  // clear-custom-field's job) so the projection never binds JSON.stringify(undefined).
-  value: z
-    .unknown()
-    .refine((v) => v !== undefined, "value is required (use clear-custom-field to remove a value)"),
-});
-export type SetCustomFieldPayload = z.infer<typeof setCustomFieldPayloadSchema>;
-
-const SET_CUSTOM_FIELD_REASON =
-  "reads custom field definitions with an explicit tenant_id = caller tenant via raw SQL with read retry";
-
-// set-custom-field — schreibt einen Custom-Field-Wert auf eine host-entity.
-//
-// **ES-Option-B**: emittiert customField.set-Event auf dem host-aggregate
-// stream (aggregateType = host-entity-name, aggregateId = host-entity-id).
-// Last-Wins-Semantik: customField.set wird OHNE expectedVersion appended,
-// concurrent writes auf gleiches Field gehen beide durch (Plan-Doc v2
-// Concurrency-Tabelle).
-//
-// **Write-Pfad (Single-Fetch)** — eine fieldDefinition-Ladung, drei Gates:
-//   1. Definition fehlt → 404.
-//   2. field-access (T1.5b): fieldAccess.write-Rollen müssen intersecten, sonst
-//      403/422. Handler-level RBAC (TenantAdmin/Member) bleibt zusätzlich.
-//   3. Value-Validation (Builder-Reuse): der Wert wird gegen das aus
-//      serializedField rehydrierte fieldToZod-Schema geparst. Type-Mismatch →
-//      422, KEIN Event entsteht (Projection bleibt typed — Plan-Doc
-//      Stammfeld-Identität). `value: null` ODER `value: undefined` auf einem
-//      typisierten Feld sind Type-Mismatches → 422; zum Entfernen eines Werts
-//      dient clear-custom-field.
-//
-// Scope: ECHTE type-only Validation. value-schema.ts strippt `required`,
-// `maxLength`, `format` und `default` aus dem serializedField bevor fieldToZod
-// daraus ein Schema baut — wir prüfen nur die Type-Shape. Required-on-set,
-// Default-Application und Length-/Format-Enforcement bleiben out-of-scope
-// (Plan-Doc "Stammfeld-Identität" listet sie als eigene Zeilen).
-export const setCustomFieldHandler: WriteHandlerDef = {
-  name: "set-custom-field",
-  schema: setCustomFieldPayloadSchema,
-  access: { roles: DEFAULT_VALUE_WRITE_ROLES },
-  description:
-    "Stores one custom-field value on a single host entity row after validating it against the field definition's declared type and per-field write roles; use it to save what a user entered into a custom field.",
-  escapeHatch: {
-    reason: SET_CUSTOM_FIELD_REASON,
-  },
-  handler: async (event, ctx) => {
-    const payload = event.payload as SetCustomFieldPayload; // @cast-boundary engine-payload
-
-    const loaded = await loadFieldDefinition(
-      ctx.db.unsafeRaw(SET_CUSTOM_FIELD_REASON),
-      event.user.tenantId,
-      payload.entityName,
-      payload.fieldKey,
-    );
-    if (!loaded.found) {
-      return failNotFound("fieldDefinition", payload.fieldKey);
-    }
-    if (loaded.field === null) {
-      return failUnprocessable("field_definition_corrupt", { fieldKey: payload.fieldKey });
-    }
-
-    const deniedRoles = fieldWriteAccessDeniedRoles(loaded.field, event.user.roles);
-    if (deniedRoles) {
-      return failUnprocessable("field_access_denied", {
-        fieldKey: payload.fieldKey,
-        requiredRoles: deniedRoles,
-      });
-    }
-
-    const valueSchema = buildCustomFieldValueSchema(loaded.field);
-    if (valueSchema) {
-      const parsed = valueSchema.safeParse(payload.value);
-      if (!parsed.success) {
-        return failUnprocessable("custom_field_value_invalid", {
-          fieldKey: payload.fieldKey,
-          fieldType: loaded.field?.type,
-          issues: parsed.error.issues.map((i) => i.message),
-        });
-      }
-    }
-
-    // Emit customField.set on host-aggregate stream. unsafeAppendEvent
-    // (statt strict appendEvent) weil event-type-map keine cross-feature-
-    // augmentation für diesen event-typ hat — wir nutzen den qualified
-    // string-namen direkt. Der Wert steht IMMER im Event (custom fields
-    // tragen keine PII, #972) — Replay reproduziert die Projection voll.
-    await ctx.unsafeAppendEvent({
-      aggregateId: payload.entityId,
-      aggregateType: payload.entityName,
-      type: customFieldsFeature.exports.setEvent.name,
-      payload: { fieldKey: payload.fieldKey, value: payload.value },
-    });
-
-    return {
-      isSuccess: true as const,
-      data: { entityName: payload.entityName, entityId: payload.entityId },
-    };
-  },
-};
-
-/** Value-Write mit App-Rollen statt der Bundle-Defaults — Apps mit eigenem
- *  Rollen-Vokabular (z.B. "Admin"/"Editor") reichen ihre Rollen über
- *  createCustomFieldsFeature({ valueWriteRoles }) hierher durch. */
-export function createSetCustomFieldHandler(
-  roles: readonly string[] = DEFAULT_VALUE_WRITE_ROLES,
-): WriteHandlerDef {
-  return { ...setCustomFieldHandler, access: { roles } };
-}

package/src/custom-fields/handlers/update-tenant-field.write.ts

@@ -1,98 +0,0 @@
-import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
-import { fieldDefinitionAggregateId } from "../aggregate-id";
-import { DEFAULT_FIELD_DEFINITION_WRITE_ROLES } from "../constants";
-import { fieldDefinitionExecutor } from "../executor";
-import { buildFieldDefinitionColumns } from "../lib/field-definition-row";
-import { type UpdateFieldPayload, updateFieldPayloadSchema } from "../schemas";
-
-// update-tenant-field — TenantAdmin ersetzt den Stand einer bestehenden
-// Field-Definition (Vollersatz: Payload-Shape = define, der Edit-Screen
-// schickt den kompletten neuen Stand). Identität ist (entityName, fieldKey)
-// → deterministische aggregate-id wie bei define/delete; tenantId kommt
-// aus event.user (Cross-Tenant-Mutation unmöglich, fremde Definitionen
-// derivieren auf eine andere aggregate-id → 404).
-//
-// **type ist immutable.** Ein Type-Wechsel würde bestehende Values in den
-// host-entity customFields-jsonbs verwaisen (text-Wert unter number-Feld);
-// dafür ist delete + re-define der ehrliche Weg (Bug-Bash D2: bewusst KEIN
-// delete+redefine im update — das würde Event-Historie + Field-Ids
-// zerstören, aber ein Type-Wechsel will genau diese Zäsur).
-//
-// **Bekannte MVP-Grenze (bewusst):** der Edit reconciled bestehende
-// Host-Werte NICHT gegen die neue Definition — Constraint-Narrowing
-// (enum-Wert weg, min/max enger) lässt alte Werte still non-conformant,
-// required false→true macht Bestands-Rows unvollständig, searchable-Toggle
-// re-indexed nicht. Werte werden beim NÄCHSTEN Write der Host-Row gegen
-// die aktuelle Def validiert; eine Reject-mit-Konflikt-Liste-Variante
-// wäre der Ausbau, wenn der Bedarf real wird.
-//
-// **skipOptimisticLock:** Definition-Edits sind admin-only + low-frequency
-// (gleiche Abwägung wie der Quota-soft-cap in define). Last-write-wins
-// statt version-Roundtrip durch den Edit-Screen.
-export interface UpdateTenantFieldOptions {
-  /** Access roles for this handler. Default ["TenantAdmin"] (#2296) — see
-   *  DefineTenantFieldOptions.roles, the definition-CRUD triad shares one gate. */
-  readonly roles?: readonly string[];
-}
-
-export function createUpdateTenantFieldHandler(
-  opts: UpdateTenantFieldOptions = {},
-): WriteHandlerDef {
-  return {
-    name: "update-tenant-field",
-    schema: updateFieldPayloadSchema,
-    access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
-    description:
-      "Replaces a tenant-owned custom-field definition with a complete new spec while refusing any change to the field's type; use it to relabel or re-constrain an existing field rather than to create or remove one.",
-    handler: async (event, ctx) => {
-      const payload = event.payload as UpdateFieldPayload; // @cast-boundary engine-payload
-      const tenantId = event.user.tenantId;
-
-      if (isSystemTenant(tenantId)) {
-        throw new Error(
-          "update-tenant-field: tenantId is SYSTEM_TENANT_ID — system-scope definitions have no update handler (delete + re-define via the system-field handlers)",
-        );
-      }
-
-      const aggregateId = fieldDefinitionAggregateId(
-        tenantId,
-        payload.entityName,
-        payload.fieldKey,
-      );
-
-      const existing = await fieldDefinitionExecutor.detail(
-        { id: aggregateId },
-        event.user,
-        ctx.db,
-      );
-      if (!existing) {
-        return failNotFound("field-definition", aggregateId);
-      }
-
-      if (existing["type"] !== payload.serializedField.type) {
-        return failUnprocessable("field_type_immutable", {
-          entityName: payload.entityName,
-          fieldKey: payload.fieldKey,
-          currentType: existing["type"],
-          requestedType: payload.serializedField.type,
-        });
-      }
-
-      // entityName/fieldKey sind die Identität — nicht Teil der changes.
-      const {
-        entityName: _entityName,
-        fieldKey: _fieldKey,
-        ...changes
-      } = buildFieldDefinitionColumns(payload);
-
-      return fieldDefinitionExecutor.update({ id: aggregateId, changes }, event.user, ctx.db, {
-        skipOptimisticLock: true,
-      });
-    },
-  };
-}
-
-// Backwards-compat: existing imports of `updateTenantFieldHandler` keep
-// working — identical to createUpdateTenantFieldHandler() with default roles.
-export const updateTenantFieldHandler: WriteHandlerDef = createUpdateTenantFieldHandler();

package/src/custom-fields/index.ts

@@ -1,40 +0,0 @@
-export { fieldDefinitionAggregateId } from "./aggregate-id";
-export {
-  CUSTOM_FIELDS_EXTENSION,
-  CUSTOM_FIELDS_FEATURE_NAME,
-  FIELD_DEFINITION_CREATED_EVENT,
-  FIELD_DEFINITION_UPDATED_EVENT,
-  SUPPORTED_FIELD_TYPES,
-  type SupportedFieldType,
-} from "./constants";
-export { fieldDefinitionEntity } from "./entity";
-export {
-  type CustomFieldClearedPayload,
-  type CustomFieldSetPayload,
-  customFieldClearedSchema,
-  customFieldSetSchema,
-} from "./events";
-export {
-  type CustomFieldsFeatureOptions,
-  createCustomFieldsFeature,
-  customFieldsFeature,
-} from "./feature";
-export {
-  type ClearCustomFieldPayload,
-  clearCustomFieldPayloadSchema,
-} from "./handlers/clear-custom-field.write";
-export {
-  type SetCustomFieldPayload,
-  setCustomFieldPayloadSchema,
-} from "./handlers/set-custom-field.write";
-export {
-  isFieldDefinitionRow,
-  parseSerializedField,
-} from "./lib/parse-serialized-field";
-export {
-  type DefineFieldPayload,
-  type DeleteFieldPayload,
-  defineFieldPayloadSchema,
-  deleteFieldPayloadSchema,
-} from "./schemas";
-export { customFieldsField, wireCustomFieldsFor } from "./wire-for-entity";

package/src/custom-fields/lib/define-or-resurrect.ts

@@ -1,52 +0,0 @@
-import { fieldDefinitionExecutor } from "../executor";
-import type { FieldDefinitionColumns } from "./field-definition-row";
-
-type DefineUser = Parameters<typeof fieldDefinitionExecutor.create>[1];
-type DefineDb = Parameters<typeof fieldDefinitionExecutor.create>[2];
-type WriteResult = Awaited<ReturnType<typeof fieldDefinitionExecutor.create>>;
-
-// Resurrection-aware define for the deterministic fieldDefinition aggregate-id.
-//
-// A definition's id is uuidv5(tenant|entity|fieldKey), so deleting it leaves a
-// (created+deleted) event stream under that id. A plain create() appends at
-// version 0 onto that stream → version_conflict — the deleted (entity, fieldKey)
-// could never be re-defined. The lifecycle states and their handling:
-//   - active definition exists → let create() raise the natural version_conflict
-//     (409) the dedup contract relies on.
-//   - soft-deleted definition  → restore() the stream, then update() it to the
-//     new payload (the caller is defining it afresh).
-//   - never defined            → create().
-//
-// restore-before-create matters: a create() version_conflict aborts the
-// surrounding tx, so a follow-up restore()/update() on the same connection would
-// fail with "current transaction is aborted". detail() (a read) + restore()
-// (which sees soft-deleted rows via a tenant-scoped fetch and only writes on
-// success) keep the tx clean until the single terminal write.
-export async function defineOrResurrectFieldDefinition(
-  aggregateId: string,
-  columns: FieldDefinitionColumns,
-  user: DefineUser,
-  db: DefineDb,
-): Promise<WriteResult> {
-  const active = await fieldDefinitionExecutor.detail({ id: aggregateId }, user, db);
-  if (active) {
-    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
-  }
-
-  const restored = await fieldDefinitionExecutor.restore({ id: aggregateId }, user, db);
-  if (restored.isSuccess) {
-    // restore() just un-deleted the row in this same tx; no concurrent writer
-    // exists, so skip the optimistic-lock version match (we'd otherwise have to
-    // thread the post-restore stream version through). Overwrite with the new
-    // definition payload — the caller is defining the field afresh.
-    // Spread to a mutable copy: `changes` is Record<string, unknown> and the
-    // readonly FieldDefinitionColumns isn't assignable to it.
-    return fieldDefinitionExecutor.update({ id: aggregateId, changes: { ...columns } }, user, db, {
-      skipOptimisticLock: true,
-    });
-  }
-  if (restored.error.code === "not_found") {
-    return fieldDefinitionExecutor.create({ id: aggregateId, ...columns }, user, db);
-  }
-  return restored;
-}

package/src/custom-fields/lib/field-access.ts

@@ -1,73 +0,0 @@
-// T1.5b — per-field write access-check for the set/clear handlers.
-// Plus single-fetch loader so set-custom-field can run access-check AND
-// value-validation off one DB read (no double fetch).
-
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import { selectSerializedFieldDefinition } from "../db/queries/field-access";
-import { parseSerializedField, type SerializedFieldShape } from "./parse-serialized-field";
-
-export type FieldAccessCheckResult =
-  | { ok: true }
-  | {
-      ok: false;
-      reason: "field_definition_not_found" | "field_definition_corrupt" | "field_access_denied";
-      requiredRoles?: ReadonlyArray<string>;
-    };
-
-export type LoadedFieldDefinition =
-  | { found: false }
-  // `field` is null when the row exists but its serialized_field is corrupt.
-  // A write access-gate treats this fail-closed (secure-by-default): a corrupt
-  // definition must not silently drop a per-field write restriction.
-  | { found: true; field: SerializedFieldShape | null };
-
-export async function loadFieldDefinition(
-  runner: DbRunner,
-  tenantId: string,
-  entityName: string,
-  fieldKey: string,
-): Promise<LoadedFieldDefinition> {
-  const serialized = await selectSerializedFieldDefinition(runner, tenantId, entityName, fieldKey);
-  if (serialized === null) return { found: false };
-  // parseSerializedField throws on a #972 legacy `sensitive` definition —
-  // that's a corrupt/unprocessable row from this write-gate's perspective,
-  // same fail-closed treatment as a shape that fails isShape().
-  try {
-    return { found: true, field: parseSerializedField(serialized) };
-  } catch {
-    return { found: true, field: null };
-  }
-}
-
-// Pure access-check on an already-loaded definition. Returns the required
-// roles when the caller is denied, or `null` when access is allowed.
-//
-// Contract: `fieldAccess.write` entries MUST be verbatim membership-system role
-// names (e.g. "TenantAdmin", not "Admin") — match is exact like framework-wide
-// `engine/access.ts`; no normalization, so a drifted name denies silently.
-export function fieldWriteAccessDeniedRoles(
-  field: SerializedFieldShape | null,
-  userRoles: ReadonlyArray<string>,
-): ReadonlyArray<string> | null {
-  const required = field?.fieldAccess?.write;
-  if (!required || required.length === 0) return null;
-  return userRoles.some((role) => required.includes(role)) ? null : required;
-}
-
-// Convenience wrapper retained for clear-custom-field (no value-validation
-// needed there) — does the load + access-check in one call.
-export async function checkFieldAccessForWrite(
-  runner: DbRunner,
-  tenantId: string,
-  entityName: string,
-  fieldKey: string,
-  userRoles: ReadonlyArray<string>,
-): Promise<FieldAccessCheckResult> {
-  const loaded = await loadFieldDefinition(runner, tenantId, entityName, fieldKey);
-  if (!loaded.found) return { ok: false, reason: "field_definition_not_found" };
-  if (loaded.field === null) return { ok: false, reason: "field_definition_corrupt" };
-
-  const deniedRoles = fieldWriteAccessDeniedRoles(loaded.field, userRoles);
-  if (!deniedRoles) return { ok: true };
-  return { ok: false, reason: "field_access_denied", requiredRoles: deniedRoles };
-}

package/src/custom-fields/lib/field-definition-row.ts

@@ -1,33 +0,0 @@
-import type { DefineFieldPayload } from "../schemas";
-
-export interface FieldDefinitionColumns {
-  readonly entityName: string;
-  readonly fieldKey: string;
-  readonly type: string;
-  readonly required: boolean;
-  readonly searchable: boolean;
-  readonly displayOrder: number;
-  readonly serializedField: string;
-}
-
-// The required/searchable/displayOrder columns are a denormalized projection of
-// serializedField — derive, don't default. Zod gives top-level `required` a
-// `.default(false)`, so "caller omitted it" is indistinguishable from `false`
-// post-parse; serializedField-present therefore wins to preserve caller intent.
-export function buildFieldDefinitionColumns(payload: DefineFieldPayload): FieldDefinitionColumns {
-  const sf = payload.serializedField;
-  const required = typeof sf["required"] === "boolean" ? sf["required"] : payload.required;
-  const searchable = typeof sf["searchable"] === "boolean" ? sf["searchable"] : payload.searchable;
-  const displayOrder =
-    typeof sf["displayOrder"] === "number" ? sf["displayOrder"] : payload.displayOrder;
-
-  return {
-    entityName: payload.entityName,
-    fieldKey: payload.fieldKey,
-    type: sf.type,
-    required,
-    searchable,
-    displayOrder,
-    serializedField: JSON.stringify({ ...sf, label: payload.label }),
-  };
-}

package/src/custom-fields/lib/parse-serialized-field.ts

@@ -1,64 +0,0 @@
-// Centralised parser for `fieldDefinition.serializedField`.
-//
-// The column is stored as `text` in B1 (entity.ts) — what the db row hands
-// back depends on the driver: postgres-js returns text as a `string`, but
-// jsonb-tolerant drivers and middleware can deliver an already-parsed
-// object. This helper normalises both, validates the shape, and centralises
-// the single boundary cast so callers don't sprinkle `as { … }`-narrowings
-// across the bundle.
-//
-// All structured `serializedField`-keys recognised today (`fieldAccess`,
-// `retention`) live on this shape. New keys go here so the other call-sites
-// can read them via the typed result instead of re-parsing.
-
-import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
-
-export interface SerializedFieldShape {
-  readonly type: string;
-  readonly fieldAccess?: {
-    readonly read?: ReadonlyArray<string>;
-    readonly write?: ReadonlyArray<string>;
-  };
-  readonly retention?: {
-    readonly keepFor: string;
-    readonly strategy: "delete" | "anonymize";
-  };
-}
-
-function isShape(v: unknown): v is SerializedFieldShape {
-  if (!v || typeof v !== "object") return false;
-  // `in` narrows v's type from `object` to `object & { type: unknown }` so
-  // the property access below does not need a cast.
-  if (!("type" in v)) return false;
-  return typeof v.type === "string";
-}
-
-/**
- * Normalises the row's `serialized_field` column. Returns `null` for
- * absent/corrupt rows so callers can short-circuit cleanly without
- * having to mirror the safe-json fallback semantics themselves.
- */
-export function parseSerializedField(raw: unknown): SerializedFieldShape | null {
-  const parsed = typeof raw === "string" ? parseJsonSafe<unknown>(raw, null) : raw;
-  if (!isShape(parsed)) return null;
-  // Fail loud instead of silently dropping the key: a stored definition with
-  // `sensitive` predates #972 and its PII expectations (event-log exclusion,
-  // forget-strip) no longer hold — the field must be recreated.
-  if ("sensitive" in parsed) {
-    throw new Error(
-      "custom-field definition contains the removed `sensitive` key (#972) — custom fields don't support PII. Recreate the field without it; model personal data as a schema entity field with a pii annotation.",
-    );
-  }
-  return parsed;
-}
-
-export interface FieldDefinitionRow {
-  readonly field_key: string;
-  readonly serialized_field: unknown;
-}
-
-export function isFieldDefinitionRow(value: unknown): value is FieldDefinitionRow {
-  if (!value || typeof value !== "object") return false;
-  if (!("field_key" in value)) return false;
-  return typeof value.field_key === "string";
-}

package/src/custom-fields/lib/quota.ts

@@ -1,5 +0,0 @@
-// T1.5e — per-tenant fieldDefinition quota.
-//
-// Re-exports from db/queries/quota.ts for backward-compatible import paths.
-
-export { countTenantFieldDefinitions } from "../db/queries/quota";

package/src/custom-fields/lib/value-schema.ts

@@ -1,91 +0,0 @@
-import {
-  DEFAULT_CURRENCIES,
-  type FieldDefinition,
-  fieldToZod,
-} from "@cosmicdrift/kumiko-framework/engine";
-import type * as z from "zod";
-import { SUPPORTED_FIELD_TYPES } from "../constants";
-
-// Builds a Zod schema that validates a custom-field VALUE against its
-// fieldDefinition. Reuses the framework's `fieldToZod` (Builder-Reuse /
-// Stammfeld-Identität, Plan-Doc) — one field-type-schema source, no drift
-// between Stammfeld- and Custom-Field-validation.
-//
-// Scope: type-shape only. fieldToZod also folds `required`, `maxLength`,
-// `format`, and `default` into Zod refinements; we strip those before the
-// call so set-custom-field rejects type-mismatches and only type-mismatches.
-// Required-on-set, default-application, and length/format-enforcement remain
-// out-of-scope per the Plan-Doc ("Stammfeld-Identität" lists them as
-// separate concerns).
-//
-// Vocabulary bridge: custom-fields expose `enum` (Plan + `r.field.enum([...])`)
-// where the framework's FieldDefinition calls the equivalent type `select`
-// with an `options` array.
-//
-// Returns `null` when the serialized field is unparseable or names a type
-// outside the custom-fields-supported set — callers then skip value-validation.
-
-const SUPPORTED_TYPES_SET: ReadonlySet<string> = new Set(SUPPORTED_FIELD_TYPES);
-const SUPPORTED_EMBEDDED_SUB_TYPES: ReadonlySet<string> = new Set([
-  "text",
-  "number",
-  "boolean",
-  "date",
-]);
-
-// Constraint-keys fieldToZod converts into Zod refinements. Stripped so the
-// resulting schema validates the type-shape only, not the constraint.
-const CONSTRAINT_KEYS = ["required", "maxLength", "format", "default"] as const;
-
-export function buildCustomFieldValueSchema(parsedField: unknown): z.ZodTypeAny | null {
-  if (!parsedField || typeof parsedField !== "object") return null;
-  const obj = parsedField as Record<string, unknown>;
-  const rawType = obj["type"];
-  if (typeof rawType !== "string") return null;
-  if (!SUPPORTED_TYPES_SET.has(rawType)) return null;
-
-  // Embedded sub-fields: pre-check the sub-type set so we surface unknown
-  // sub-types as "skip validation" (return null) rather than letting
-  // fieldToZod's assertUnreachable throw and the catch swallow real bugs.
-  // Build a constraint-stripped copy of each sub-field in the same pass —
-  // symmetric with the top-level strip below. Without it a sub-field's
-  // `required` folds into z.string().min(1) + non-optional, re-enforcing a
-  // constraint the contract ("type-mismatches and ONLY type-mismatches")
-  // drops everywhere else.
-  let strippedSubSchema: Record<string, Record<string, unknown>> | undefined;
-  if (rawType === "embedded") {
-    const schema = obj["schema"];
-    if (!schema || typeof schema !== "object") return null;
-    strippedSubSchema = {};
-    for (const [subKey, sub] of Object.entries(schema)) {
-      if (!sub || typeof sub !== "object") return null;
-      const subObj = sub as Record<string, unknown>;
-      const subType = subObj["type"];
-      if (typeof subType !== "string" || !SUPPORTED_EMBEDDED_SUB_TYPES.has(subType)) {
-        return null;
-      }
-      const strippedSub = { ...subObj };
-      for (const k of CONSTRAINT_KEYS) delete strippedSub[k];
-      strippedSubSchema[subKey] = strippedSub;
-    }
-  }
-
-  const fieldDef: Record<string, unknown> = { ...obj };
-  for (const k of CONSTRAINT_KEYS) delete fieldDef[k];
-  if (strippedSubSchema !== undefined) fieldDef["schema"] = strippedSubSchema;
-  if (rawType === "enum") {
-    fieldDef["type"] = "select";
-    fieldDef["options"] = obj["values"] ?? obj["options"] ?? [];
-  }
-
-  // fieldToZod's money case validates `currency` against the passed list, not
-  // a field-level key — so surface the field's own currency when it declares
-  // one, else fall back to the framework defaults.
-  const currencies =
-    typeof obj["currency"] === "string" ? [obj["currency"] as string] : DEFAULT_CURRENCIES;
-
-  // @cast-boundary serialized-field is the dehydrated r.field.X() output =
-  // a FieldDefinition; fieldToZod reads only its type-specific keys (the
-  // extra fieldAccess/retention/label keys are ignored).
-  return fieldToZod(fieldDef as unknown as FieldDefinition, currencies);
-}