@cosmicdrift/kumiko-framework 0.113.1 → 1.0.0

package/src/engine/__tests__/define-feature-entity-mapping.test.ts

@@ -29,14 +29,8 @@ describe("defineFeature — bare CRUD verb → entity mapping", () => {
   });
 
   test("feature-name match wins (the fallback is the secondary path)", () => {
-    // Two entities (516/1): with only "note" registered, this would also
-    // pass via the single-entity fallback, proving nothing about the
-    // name-match branch specifically. A second entity ("tag") disables the
-    // fallback (entityKeys.length !== 1), so success here can only come
-    // from entities[name] matching — the branch this test claims to cover.
     const f = defineFeature("note", (r) => {
       r.entity("note", noteEntity);
-      r.entity("tag", tagEntity);
       r.writeHandler(bareCreate);
     });
     expect(f.handlerEntityMappings?.["create"]).toBe("note");

package/src/engine/__tests__/registry.test.ts

@@ -1,8 +1,6 @@
 import { describe, expect, test } from "bun:test";
-import { z } from "zod";
 import { createTenantConfig } from "../config-helpers";
 import { defineFeature } from "../define-feature";
-import { createEntity, createTextField } from "../factories";
 import { createRegistry } from "../registry";
 import type { FeatureDefinition } from "../types/feature";
 
@@ -132,30 +130,4 @@ describe("extensionSelector boot-validation", () => {
       }),
     ).toThrow(/declared twice/);
   });
-
-  // 437/2: createRegistry now delegates this check to
-  // validateExtensionPreSaveWiring (shared with validateBoot's standalone
-  // callers) instead of a duplicate inline computation — pins that
-  // createRegistry itself still enforces it, not just validateBoot.
-  test("throws when extension preSave targets entity with no mapped write handlers", () => {
-    const ext = defineFeature("cap-ext", (r) => {
-      r.extendsRegistrar("credit-cap", {
-        hooks: { preSave: async (changes) => changes },
-      });
-    });
-    const consumer = defineFeature("money-horse", (r) => {
-      r.requires("cap-ext");
-      r.entity("credit", createEntity({ table: "Credits", fields: { name: createTextField() } }));
-      r.writeHandler(
-        "doSomething",
-        z.object({}),
-        async () => ({ isSuccess: true as const, data: {} }),
-        { access: { openToAll: true } },
-      );
-      r.useExtension("credit-cap", "credit");
-    });
-    expect(() => createRegistry([ext, consumer])).toThrow(
-      /no write handler is entity-mapped to "credit"/i,
-    );
-  });
 });

package/src/engine/__tests__/screen.test.ts

@@ -45,46 +45,6 @@ describe("r.screen() — registration", () => {
     expect(feature.screens["product-list"]?.type).toBe("entityList");
   });
 
-  test("stores a projectionList screen bound to an explicit (cross-feature) query", () => {
-    const feature = defineFeature("app", (r) => {
-      r.screen({
-        id: "rent-list",
-        type: "projectionList",
-        query: "ledger:query:schedule:list",
-        columns: [
-          { field: "description", label: "app:col.desc" },
-          {
-            field: "amount",
-            label: "app:col.amount",
-            renderer: { react: { __component: "EuroCell" } },
-          },
-        ],
-      });
-    });
-    const screen = feature.screens["rent-list"];
-    expect(screen?.type).toBe("projectionList");
-    if (screen?.type !== "projectionList") throw new Error("type-narrow failed");
-    expect(screen.query).toBe("ledger:query:schedule:list");
-  });
-
-  test("validateBoot rejects a projectionList with empty columns", () => {
-    const features = [
-      defineFeature("app", (r) => {
-        r.screen({ id: "x", type: "projectionList", query: "app:query:foo:list", columns: [] });
-      }),
-    ];
-    expect(() => validateBoot(features)).toThrow(/empty columns list/i);
-  });
-
-  test("validateBoot rejects a projectionList with an empty query", () => {
-    const features = [
-      defineFeature("app", (r) => {
-        r.screen({ id: "x", type: "projectionList", query: "", columns: ["name"] });
-      }),
-    ];
-    expect(() => validateBoot(features)).toThrow(/empty or non-string query/i);
-  });
-
   test("stores an entityEdit screen with sections + conditional fields", () => {
     const feature = defineFeature("shop", (r) => {
       r.entity("product", productEntity());

package/src/engine/__tests__/soft-delete-cleanup.test.ts

@@ -31,9 +31,6 @@ describe("registry soft-delete auto-wiring", () => {
     const key = registry.getConfigKey(SOFT_DELETE_GRACE_DAYS_KEY);
     expect(key?.type).toBe("number");
     expect(key?.default).toBe(DEFAULT_GRACE_DAYS);
-    // 565/2: min must be 1, not 0 — graceDays: 0 means "hard-delete every
-    // currently soft-deleted row on the next cron run", not "no cleanup".
-    expect(key?.bounds?.min).toBe(1);
   });
 
   test("also injects the system-scope cleanup job (not perTenant)", () => {

package/src/engine/boot-validator/gdpr-storage.ts

@@ -1,4 +1,3 @@
-import { EXT_USER_DATA } from "../extension-names";
 import type { FeatureDefinition } from "../types";
 
 // Providers whose bytes do not survive a process restart. Only "inmemory"
@@ -66,7 +65,7 @@ export function validateGdprStoragePersistence(features: readonly FeatureDefinit
 export function validateGdprHookCompleteness(features: readonly FeatureDefinition[]): void {
   for (const feature of features) {
     for (const usage of feature.extensionUsages) {
-      if (usage.extensionName !== EXT_USER_DATA) continue;
+      if (usage.extensionName !== "userData") continue;
       const hasExport = typeof usage.options?.["export"] === "function";
       const hasDelete = typeof usage.options?.["delete"] === "function";
       if (hasExport && !hasDelete) {

package/src/engine/boot-validator/index.ts

@@ -1,4 +1,3 @@
-import { validateEntityFieldEncryptionAvailable } from "../../db/entity-field-encryption";
 import { QnTypes, qualifyEntityName } from "../qualified-name";
 import type { ClaimKeyDefinition, FeatureDefinition } from "../types";
 import { validateApiExposureMatching, validateExtensionUsages } from "./api-ext";
@@ -180,12 +179,8 @@ export function validateBoot(features: readonly FeatureDefinition[]): void {
   validateGdprStoragePersistence(features);
   validateGdprHookCompleteness(features);
 
-  if (hasEncryptedFields) {
-    // Availability check, not env-presence: eagerly building the keyring
-    // catches malformed keys (wrong length, bad base64) at boot instead of
-    // on the first encrypted read in prod. An injected cipher (test seam,
-    // custom KMS provider) satisfies the requirement without env keys.
-    validateEntityFieldEncryptionAvailable();
+  if (hasEncryptedFields && !process.env["ENCRYPTION_KEY"]) {
+    throw new Error("ENCRYPTION_KEY environment variable is required (encrypted fields in use)");
   }
 
   if (hasFileFields && !process.env["FILE_STORAGE_PROVIDER"]) {

package/src/engine/boot-validator/screens-nav.ts

@@ -141,27 +141,6 @@ export function validateScreens(
       continue;
     }
 
-    if (screen.type === "projectionList") {
-      // Query-getrieben, keine Entity → nur query + columns prüfen (die
-      // Column-Felder können nicht gegen eine Entity gecheckt werden; sie
-      // werden zur Render-Zeit gegen die Projection-Rows aufgelöst).
-      if (!screen.query || typeof screen.query !== "string") {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionList) has empty or non-string query.`,
-        );
-      }
-      if (screen.columns.length === 0) {
-        throw new Error(
-          `[Feature ${feature.name}] Screen "${screenId}" (projectionList) has an empty columns list — ` +
-            `declare at least one column.`,
-        );
-      }
-      for (const col of screen.columns) {
-        validateColumnRendererForm(feature.name, screenId, normalizeListColumn(col));
-      }
-      continue;
-    }
-
     if (screen.type === "configEdit") {
       // configEdit: layout/fields wie actionForm validieren, plus
       // Cross-Check dass jeder qualifizierte Config-Key registriert

package/src/engine/define-feature.ts

@@ -15,7 +15,6 @@ import type {
   ConfigKeyType,
   ConfigSeedDef,
   EntityDefinition,
-  EntityProjectionExtension,
   EntityRef,
   EventDef,
   EventMigrationDef,
@@ -142,7 +141,6 @@ export function defineFeature<const TName extends string, TExports = undefined>(
   const secretKeys: Record<string, SecretKeyDefinition> = {};
   const projections: Record<string, ProjectionDefinition> = {};
   const multiStreamProjections: Record<string, MultiStreamProjectionDefinition> = {};
-  const entityProjectionExtensions: Record<string, EntityProjectionExtension[]> = {};
   const rawTables: Record<string, RawTableEntry> = {};
   const unmanagedTables: Record<string, UnmanagedTableEntry> = {};
   const authClaimsHooks: AuthClaimsFn[] = [];
@@ -729,20 +727,6 @@ export function defineFeature<const TName extends string, TExports = undefined>(
       multiStreamProjections[definition.name] = definition;
     },
 
-    extendEntityProjection(entityName: string, extension: EntityProjectionExtension): void {
-      if (Object.keys(extension.apply).length === 0) {
-        throw new Error(
-          `[Feature ${name}] extendEntityProjection("${entityName}") has no apply handlers. ` +
-            `Declare at least one event type, otherwise the rebuild replay has nothing to do.`,
-        );
-      }
-      // Entity existence + apply-key collisions are validated at registry
-      // build — r.entity may legally be called after this in the same feature.
-      const list = entityProjectionExtensions[entityName] ?? [];
-      list.push(extension);
-      entityProjectionExtensions[entityName] = list;
-    },
-
     authClaims(fn: AuthClaimsFn): void {
       authClaimsHooks.push(fn);
     },
@@ -1013,7 +997,6 @@ export function defineFeature<const TName extends string, TExports = undefined>(
     metrics,
     secretKeys,
     projections,
-    entityProjectionExtensions,
     multiStreamProjections,
     authClaimsHooks,
     claimKeys,

package/src/engine/define-handler.ts

@@ -90,20 +90,7 @@ export function defineWriteHandler<
   // responses get `[]`, so existing call-sites are unaffected. Checking it in a
   // parameter post-inference (not as a `TData extends …` constraint, which TS
   // rejects as circular, TS2313) is what makes inference survive.
-  //
-  // Membership form `true extends ContainsSecret<TData>` (556/1), not
-  // `ContainsSecret<TData> extends true`: when TData is a union like
-  // `{ok:true} | {s:Secret<string>}`, the naked-type-parameter conditional in
-  // ContainsSecret DISTRIBUTES over the union, so the result is
-  // `false | true` = `boolean`, not the literal `true` — `ContainsSecret<
-  // TData> extends true` is then false (boolean isn't assignable to the
-  // literal true) and the old check silently fell through to `[]` even with
-  // a real leak in one branch. Putting the naked `true` on the LEFT instead
-  // keeps the check fail-closed for the union case (`true extends boolean`
-  // is true) without eagerly normalizing ContainsSecret<TData> against a
-  // literal — which is what blew up TS's instantiation depth on generic
-  // call-sites (createTokenRequestHandler's still-unresolved TSuccessKind).
-  ..._noSecretInResponse: true extends ContainsSecret<TData>
+  ..._noSecretInResponse: ContainsSecret<TData> extends true
     ? [
         secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field.",
       ]
@@ -187,8 +174,7 @@ export function defineQueryHandler<
   def: QueryHandlerDefinition<TName, TSchema, TResult, TMap>,
   // R6: phantom rest-param — see defineWriteHandler. Forbids a Secret<> in the
   // inferred query response `TResult` at compile time; `[]` for clean responses.
-  // Membership form (556/1) — see defineWriteHandler's comment for why.
-  ..._noSecretInResponse: true extends ContainsSecret<TResult>
+  ..._noSecretInResponse: ContainsSecret<TResult> extends true
     ? [
         secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field.",
       ]

package/src/engine/extensions/user-data.ts

@@ -14,7 +14,7 @@
 // Siehe docs/plans/datenschutz/user-data-rights.md.
 
 import type { DbRunner } from "../../db/connection";
-import type { Registry, TenantId } from "../types";
+import type { TenantId } from "../types";
 
 // SessionUser.id ist plattformweit `string` (kein Brand-Type). Wenn
 // jemals ein UserId-Brand eingefuehrt wird, ersetzt man hier den
@@ -70,17 +70,6 @@ export interface UserDataStorageProvider {
 
 export interface UserDataHookCtx {
   readonly db: DbRunner;
-  /**
-   * The app registry. A forget hook that must erase CHILD read-model rows past
-   * the entity's own row — m:n join projections, per-parent detail projections —
-   * uses it to run those custom projections for the executor's
-   * `<entity>.forgotten` event: `runProjectionsForEvent(result.data.event,
-   * ctx.registry, ctx.db)`. `executor.forget` purges only its OWN projection,
-   * and the dispatcher's post-command projection pass does not fire in the forget
-   * pipeline (a job, not a dispatched command), so the hook must trigger the
-   * cascade itself. Live-erase + rebuild `<parent>.forgotten`-apply converge.
-   */
-  readonly registry: Registry;
   readonly tenantId: TenantId;
   readonly userId: UserId;
   /**

package/src/engine/index.ts

@@ -6,6 +6,7 @@ export {
   validateAppCustomScreenWriteQns,
   validateBoot,
 } from "./boot-validator";
+export { validateExtensionPreSaveWiring } from "./boot-validator/entity-handler";
 export { type BuildAppSchemaOptions, buildAppSchema } from "./build-app-schema";
 export type { ConfigFeatureSchema } from "./build-config-feature-schema";
 export {
@@ -169,12 +170,8 @@ export {
   checkWriteFieldRoles,
   filterReadFields,
 } from "./field-access";
-// findForbiddenMembershipRole/isForbiddenMembershipRole/
-// stripForbiddenMembershipRoles are Public API for host apps that build
-// their own membership handlers. FORBIDDEN_MEMBERSHIP_ROLES itself stays
-// internal (637/3) — exporting the raw Set would make its representation a
-// semver promise; the predicate functions are the intended surface.
 export {
+  FORBIDDEN_MEMBERSHIP_ROLES,
   findForbiddenMembershipRole,
   isForbiddenMembershipRole,
   stripForbiddenMembershipRoles,

package/src/engine/registry.ts

@@ -7,7 +7,6 @@ import {
 import { asEntityTableMeta } from "../db/query";
 import { buildEntityTable } from "../db/table-builder";
 import { buildMetricName, validateMetricName } from "../observability";
-import { validateExtensionPreSaveWiring } from "./boot-validator/entity-handler";
 import { type QnType, qualifyEntityName } from "./qualified-name";
 import {
   buildSoftDeleteCleanupJob,
@@ -23,7 +22,6 @@ import type {
   ConfigKeyDefinition,
   ConfigSeedDef,
   EntityDefinition,
-  EntityProjectionExtension,
   EntityRelations,
   EventDef,
   EventUpcastFn,
@@ -83,7 +81,6 @@ function buildImplicitProjection(
   entity: EntityDefinition,
   qualify: typeof qualifyEntityName,
   backingTable?: unknown,
-  extensions: readonly EntityProjectionExtension[] = [],
 ): ProjectionDefinition {
   const name = qualify(featureName, "projection", `${entityName}${IMPLICIT_PROJECTION_SUFFIX}`);
   // Backing table (r.entity(name, def, { table })) is the one physical table
@@ -118,28 +115,9 @@ function buildImplicitProjection(
   if (entity.softDelete) {
     apply[`${entityName}.restored`] = handler;
   }
-  // r.extendEntityProjection: merge extension applies into the rebuild
-  // replay. Collisions with lifecycle applies (or another extension) are
-  // authoring bugs — fail at boot, not by silently overwriting a handler.
-  const extraSources: string[] = [];
-  for (const ext of extensions) {
-    for (const [eventType, fn] of Object.entries(ext.apply)) {
-      if (apply[eventType]) {
-        throw new Error(
-          `Implicit projection "${name}": extendEntityProjection apply-key "${eventType}" ` +
-            `collides with an existing handler (entity lifecycle apply or another extension).`,
-        );
-      }
-      apply[eventType] = fn;
-    }
-    for (const s of ext.sources ?? []) {
-      if (s !== entityName && !extraSources.includes(s)) extraSources.push(s);
-    }
-  }
   return {
     name,
     source: entityName,
-    ...(extraSources.length > 0 && { extraSources }),
     table: drizzleTable,
     apply,
     isImplicit: true,
@@ -953,18 +931,6 @@ export function createRegistry(features: readonly FeatureDefinition[]): Registry
   // vermeidet Kollisionen wenn jemand z.B. eine Cross-Aggregate-Projection
   // mit Entity-Name registriert.
   for (const feature of features) {
-    // extendEntityProjection targets must exist as r.entity in the SAME
-    // feature — a typo'd entity name would otherwise vanish silently and the
-    // extension's events would still be wiped on rebuild.
-    for (const extEntity of Object.keys(feature.entityProjectionExtensions ?? {})) {
-      if (!feature.entities?.[extEntity]) {
-        throw new Error(
-          `[Feature ${feature.name}] extendEntityProjection("${extEntity}"): no r.entity ` +
-            `with that name in this feature. Declare the entity first — the extension ` +
-            `merges into its implicit projection.`,
-        );
-      }
-    }
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
       const def = buildImplicitProjection(
         feature.name,
@@ -972,7 +938,6 @@ export function createRegistry(features: readonly FeatureDefinition[]): Registry
         entity,
         qualify,
         feature.entityTables?.[entityName],
-        feature.entityProjectionExtensions?.[entityName] ?? [],
       );
       if (projectionMap.has(def.name)) {
         throw new Error(
@@ -1052,11 +1017,26 @@ export function createRegistry(features: readonly FeatureDefinition[]): Registry
     }
   }
 
-  // Extension preSave: useExtension on an entity must have at least one mapped
-  // write handler. Shared with validateBoot's standalone callers (437/2) —
-  // schema-cli's `validate` runs validateBoot on raw FEATURES without ever
-  // building a Registry, so this can't live only here.
-  validateExtensionPreSaveWiring(features);
+  // Extension preSave: useExtension on an entity must have at least one mapped write handler.
+  const extensionsWithPreSave = new Set<string>();
+  for (const f of features) {
+    for (const [extName, def] of Object.entries(f.registrarExtensions ?? {})) {
+      if (def.hooks?.preSave) extensionsWithPreSave.add(extName);
+    }
+  }
+  for (const usage of extensionUsages) {
+    if (!extensionsWithPreSave.has(usage.extensionName)) continue;
+    const hasMapped = [...writeHandlerMap.keys()].some(
+      (qn) => handlerEntityMap.get(qn) === usage.entityName,
+    );
+    if (!hasMapped) {
+      throw new Error(
+        `Feature "${usage.featureName}" uses extension "${usage.extensionName}" with preSave on entity "${usage.entityName}" ` +
+          `but no write handler is entity-mapped to "${usage.entityName}". ` +
+          `Use create/update/delete on a matching entity or name the handler "entity:verb".`,
+      );
+    }
+  }
 
   // Validate: all relation targets must reference existing entities
   for (const [entityName, rels] of relationMap) {
@@ -1141,9 +1121,6 @@ export function createRegistry(features: readonly FeatureDefinition[]): Registry
   const allDomainEventNames = new Set(eventMap.keys());
   for (const [projName, projDef] of projectionMap) {
     const sources = Array.isArray(projDef.source) ? projDef.source : [projDef.source];
-    // extraSources (r.extendEntityProjection) sit in the rebuild filter, so
-    // their auto-verbs are legitimately observable apply-keys too.
-    const rebuildSources = [...sources, ...(projDef.extraSources ?? [])];
     const validEventTypes = new Set<string>();
     // Two source-modes are legal:
     //
@@ -1161,7 +1138,7 @@ export function createRegistry(features: readonly FeatureDefinition[]): Registry
     //      or `jobRun` (BullMQ-callback-driven lifecycle, no executor).
     //      A "Shape-Anchor"-entity is no longer needed for this case.
     const isEventsOnlySource = !sources.every((src) => entityMap.has(src));
-    for (const src of rebuildSources) {
+    for (const src of sources) {
       if (entityMap.has(src)) {
         for (const verb of AUTO_EVENT_VERBS) validEventTypes.add(`${src}.${verb}`);
       }

package/src/engine/soft-delete-cleanup.ts

@@ -29,11 +29,7 @@ export const softDeleteGraceDaysConfig: ConfigKeyDefinition = {
   default: DEFAULT_GRACE_DAYS,
   scope: "tenant",
   access: { read: ["TenantAdmin", "SystemAdmin"], write: ["SystemAdmin"] },
-  // min: 1, not 0 (565/2) — graceDays: 0 doesn't mean "no cleanup", it means
-  // "hard-delete every currently soft-deleted row on the next cron run".
-  // Clamping (not rejecting) keeps the resolve-config-or-param clamp path's
-  // existing silent-below-bound / audited-crossing behavior.
-  bounds: { min: 1 },
+  bounds: { min: 0 },
 };
 
 export const softDeleteCleanupJob: JobHandlerFn = async (_payload, ctx) => {
@@ -60,7 +56,7 @@ export const softDeleteCleanupJob: JobHandlerFn = async (_payload, ctx) => {
         db,
       )
     : undefined;
-  const graceDays = typeof resolved === "number" && resolved >= 1 ? resolved : DEFAULT_GRACE_DAYS;
+  const graceDays = typeof resolved === "number" && resolved >= 0 ? resolved : DEFAULT_GRACE_DAYS;
   const cutoff = Temporal.Now.instant().subtract({ hours: graceDays * 24 });
 
   for (const proj of registry.getAllProjections().values()) {

package/src/engine/types/feature.ts

@@ -62,11 +62,7 @@ import type {
 } from "./hooks";
 import type { HttpRouteDefinition } from "./http-route";
 import type { NavDefinition } from "./nav";
-import type {
-  EntityProjectionExtension,
-  MultiStreamProjectionDefinition,
-  ProjectionDefinition,
-} from "./projection";
+import type { MultiStreamProjectionDefinition, ProjectionDefinition } from "./projection";
 import type { EntityRelations, RelationDefinition } from "./relations";
 import type { ScreenDefinition } from "./screen";
 import type { TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe } from "./tree-node";
@@ -185,15 +181,26 @@ export type UnmanagedTableDef = UnmanagedTableEntry & {
 // Keep this list lean. Anything that already has a home on the feature
 // (configKeys.scope/default/encrypted, secretKeys, requires, etc.) lives there.
 // Only add fields here that are genuinely UI-only.
-// "select"/"text" variants dropped (569/1) — no bundled feature uses anything
-// but "boolean" yet and the picker doesn't render them either; re-add once a
-// real feature needs them.
-export type UiHintOption = {
-  readonly key: string;
-  readonly label: string;
-  readonly type: "boolean";
-  readonly default: boolean;
-};
+export type UiHintOption =
+  | {
+      readonly key: string;
+      readonly label: string;
+      readonly type: "boolean";
+      readonly default: boolean;
+    }
+  | {
+      readonly key: string;
+      readonly label: string;
+      readonly type: "select";
+      readonly options: readonly string[];
+      readonly default: string;
+    }
+  | {
+      readonly key: string;
+      readonly label: string;
+      readonly type: "text";
+      readonly default?: string;
+    };
 
 export type UiHints = {
   // Picker-facing label ("Auth · Email + Password" instead of the bare
@@ -303,12 +310,6 @@ export type FeatureDefinition = {
   // Projections declared via r.projection(). Keyed by projection name; executor
   // looks them up by source-entity at write-time.
   readonly projections: Readonly<Record<string, ProjectionDefinition>>;
-  // Implicit-projection extensions declared via r.extendEntityProjection().
-  // Keyed by entity name; merged into that entity's implicit projection at
-  // registry build so rebuildProjection replays the extension's events.
-  readonly entityProjectionExtensions?: Readonly<
-    Record<string, readonly EntityProjectionExtension[]>
-  >;
   // Multi-stream projections — cross-aggregate async read-models. Keyed by
   // short name; the dispatcher wraps each into an EventConsumer with its
   // own cursor.
@@ -623,15 +624,6 @@ export type FeatureRegistrar<TFeature extends string = string> = {
   // per-consumer ordering and dead-letter behaviour.
   multiStreamProjection(definition: MultiStreamProjectionDefinition): void;
 
-  // Merge extra apply handlers (+ extra event sources) into an entity's
-  // implicit projection so rebuildProjection replays event types a bundled
-  // extension materializes into the HOST entity's table (custom-fields
-  // pattern). Rebuild-only: the inline runner skips implicit projections —
-  // live delivery stays with the extension's own MSP. The entity must be
-  // declared via r.entity in the SAME feature; unknown entities and
-  // apply-key collisions fail at registry build.
-  extendEntityProjection(entityName: string, extension: EntityProjectionExtension): void;
-
   // Register a function that contributes claims into SessionUser.claims at
   // login time. Multiple features (and multiple calls within one feature)
   // are allowed; returns are merged. Keys are auto-prefixed with the feature

package/src/engine/types/fields.ts

@@ -524,9 +524,7 @@ export function isFileField(field: FieldDefinition | undefined): field is AnyFil
 // --- Derived (computed) fields ---
 //
 // A derived field is read-time only: its value is computed from the stored row
-// (and the clock) when an entityList query runs (676/2 — NOT detail; only the
-// "list" case in entity-handlers.ts calls augmentDerivedFields), never
-// persisted. It lives in
+// (and the clock) when a list/detail query runs, never persisted. It lives in
 // `EntityDefinition.derivedFields` — deliberately NOT in `fields`, so it
 // produces no DB column, never enters a write schema, and can't be the target
 // of an entityEdit. A declarative `entityList` can name it like any column and

package/src/engine/types/handlers.ts

@@ -40,19 +40,6 @@ export type SessionUser = {
   // When present, middleware can validate that the sid is still alive before
   // accepting the request (session revocation).
   readonly sid?: string;
-  // Set ONLY when the request authenticated via a Personal Access Token
-  // (bearer, PAT_TOKEN_PREFIX). Absent for cookie/JWT logins, which stay
-  // unrestricted. `allowedQns` are the QN globs the token's granted scopes
-  // expand to; the API boundary (routes.ts) rejects any dispatch type not
-  // matched by one of them (fail-closed). `scopes` are the granted scope
-  // names, kept for audit/display only.
-  readonly pat?: {
-    // The token row id — the per-token key for PAT rate limiting. Not the
-    // secret; safe to carry on the principal.
-    readonly tokenId: string;
-    readonly scopes: readonly string[];
-    readonly allowedQns: readonly string[];
-  };
 };
 
 // --- Claim Keys (r.claimKey declarations) ---
@@ -235,9 +222,8 @@ type SharedContextFields = {
   // Encryption round-trip partner for the config feature. Separate from
   // configResolver so the read-only resolver contract stays clean — the
   // set handler needs to encrypt on write, the resolver needs to decrypt
-  // on read, and both reach for the same cipher. Wired via extraContext;
-  // run{Prod,Dev}App build it from the secrets master key automatically.
-  readonly configEncryption?: import("../../secrets").EnvelopeCipher;
+  // on read, and both reach for the same provider. Wired via extraContext.
+  readonly configEncryption?: import("../../db").EncryptionProvider;
   // Rate-limit resolver. Wired by the framework when the `rate-limiting`
   // feature is loaded — pipeline reads handler.rateLimit and calls
   // .enforce() on this resolver before access-check. Absent when the

package/src/engine/types/index.ts

@@ -196,7 +196,6 @@ export type { EntityId, TenantId } from "./identifiers";
 export { isSystemTenant, parseTenantId, SYSTEM_TENANT_ID } from "./identifiers";
 export type { NavDefinition } from "./nav";
 export type {
-  EntityProjectionExtension,
   MspErrorMode,
   MspErrorPolicy,
   MultiStreamApplyFn,
@@ -230,7 +229,6 @@ export type {
   FormatSpec,
   ListColumnSpec,
   PlatformComponent,
-  ProjectionListScreenDefinition,
   RowAction,
   RowActionNavigate,
   RowActionWriteHandler,

package/src/engine/types/projection.ts

@@ -51,11 +51,6 @@ export type ProjectionDefinition = {
   // index projections so the executor doesn't scan all projections on every
   // write.
   readonly source: string | readonly string[];
-  // Additional aggregate-types whose events the rebuild replay must include
-  // beyond `source`. Fed by r.extendEntityProjection — an extension can react
-  // to events on foreign streams (e.g. "field-definition") while `source`
-  // keeps meaning "the owning entity" for consumers like soft-delete-cleanup.
-  readonly extraSources?: readonly string[];
   // Drizzle-table the projection materializes into. User owns the schema —
   // framework just guarantees the TX and event delivery.
   readonly table: ProjectionTable;
@@ -72,23 +67,6 @@ export type ProjectionDefinition = {
   readonly isImplicit?: boolean;
 };
 
-// Extension merged into an entity's implicit projection at registry build.
-// Lets a bundled feature that writes into the HOST entity's table via events
-// (custom-fields pattern) hook those event types into the entity's rebuild
-// replay — without it, a rebuild resets everything the extension wrote.
-// Live delivery stays with the extension's own MSP: implicit projections are
-// skipped by the inline runner, so the apply here runs ONLY during rebuild.
-export type EntityProjectionExtension = {
-  // Aggregate-types beyond the entity's own stream whose events the rebuild
-  // must scan (e.g. "field-definition"). Omit when all extension events are
-  // appended on the host entity's stream.
-  readonly sources?: readonly string[];
-  // Keyed by fully-qualified event type. Must not collide with the entity's
-  // built-in lifecycle applies (<entity>.created/updated/...) or another
-  // extension — collisions fail at boot.
-  readonly apply: Readonly<Record<string, SingleStreamApplyFn>>;
-};
-
 // Per-lifecycle error policy for a MultiStreamProjection. Mirrors Marten's
 // Projections.Errors / Projections.RebuildErrors split — a projection can
 // be lenient during steady-state delivery but strict during rebuild (or