@cosmicdrift/kumiko-framework 0.158.2 → 0.159.1

package/src/engine/types/define-handler.ts

@@ -0,0 +1,94 @@
+import type { ZodType, z } from "zod";
+import type { KumikoEventTypeMap } from "./event-type-map";
+import type {
+  AccessRule,
+  HandlerContext,
+  QueryEvent,
+  RateLimitOption,
+  WriteEvent,
+  WriteResult,
+} from "./handlers";
+import type { PipelineDef } from "./step";
+
+// --- Write Handler Definition ---
+//
+// TMap propagates the strict event-type-map through the handler's
+// HandlerContext. CRITICAL: TMap is declared as a generic parameter on the
+// FUNCTION (defineWriteHandler), not just on the type. Generic-functions
+// substitute TMap at the USE-site (the caller's compile context, where
+// the augmentation is visible); generic-type-aliases substitute at the
+// definition-site (framework's compile, where the augmentation isn't
+// visible) and collapse `keyof TMap` to `never`. See the spike-findings
+// memory for the empirical proof.
+//
+// Two authoring forms — `handler` (free-form) or `perform: stepsPipeline(...)`
+// (step-pipeline). A `perform` is compiled to a handler-function at
+// definition time; the dispatcher only ever sees `handler`.
+
+export type WriteHandlerDefinition<
+  TName extends string = string,
+  TSchema extends ZodType = ZodType,
+  TData = unknown,
+  TMap extends object = KumikoEventTypeMap,
+> = {
+  readonly name: TName;
+  readonly schema: TSchema;
+  readonly access?: AccessRule;
+  readonly unsafeSkipTransitionGuard?: boolean;
+  readonly rateLimit?: RateLimitOption;
+  readonly handler: (
+    event: WriteEvent<z.infer<TSchema>>,
+    context: HandlerContext<TMap>,
+  ) => Promise<WriteResult<TData>>;
+  // Preserved when the author wrote a `perform` block — the original
+  // PipelineDef. Designer/AI/AST tools read this when present; the
+  // dispatcher ignores it and just calls `handler`. Absent on free-form
+  // handlers.
+  readonly perform?: PipelineDef<z.infer<TSchema>, TData>;
+};
+
+// Author-facing input — accepts either the free-form `handler` or the
+// pipeline-form `perform`. defineWriteHandler narrows them to the
+// canonical WriteHandlerDefinition shape.
+export type WriteHandlerInput<
+  TName extends string = string,
+  TSchema extends ZodType = ZodType,
+  TData = unknown,
+  TMap extends object = KumikoEventTypeMap,
+> = {
+  readonly name: TName;
+  readonly schema: TSchema;
+  readonly access?: AccessRule;
+  readonly unsafeSkipTransitionGuard?: boolean;
+  readonly rateLimit?: RateLimitOption;
+} & (
+  | {
+      readonly handler: (
+        event: WriteEvent<z.infer<TSchema>>,
+        context: HandlerContext<TMap>,
+      ) => Promise<WriteResult<TData>>;
+      readonly perform?: never;
+    }
+  | {
+      readonly perform: PipelineDef<z.infer<TSchema>, TData>;
+      readonly handler?: never;
+    }
+);
+
+// --- Query Handler Definition ---
+
+export type QueryHandlerDefinition<
+  TName extends string = string,
+  TSchema extends ZodType = ZodType,
+  TResult = unknown,
+  TMap extends object = KumikoEventTypeMap,
+> = {
+  readonly name: TName;
+  readonly schema: TSchema;
+  readonly access?: AccessRule;
+  readonly rateLimit?: RateLimitOption;
+  readonly handler: (
+    query: QueryEvent<z.infer<TSchema>>,
+    context: HandlerContext<TMap>,
+  ) => Promise<TResult>;
+};

package/src/engine/types/entity-handlers.ts

@@ -0,0 +1,30 @@
+import type { EntityDefinition } from "./fields";
+import type { AccessRule, QueryHandlerDef, WriteHandlerDef } from "./handlers";
+
+export type EntityHandlerOptions = { readonly access?: AccessRule };
+
+export type EntityQueryHandlerOptions = EntityHandlerOptions & {
+  /** Reads across every tenant instead of the caller's own — for a
+   *  SystemAdmin-only operator inspector over an otherwise tenant-scoped
+   *  entity. Scope this to the ONE handler that needs it rather than making
+   *  the whole feature r.systemScope(), which would drop tenant isolation
+   *  from every other handler the feature registers too. */
+  readonly crossTenant?: boolean;
+};
+
+export type EntityCrudVerb = "create" | "update" | "delete" | "restore" | "list" | "detail";
+
+export type RegisterEntityCrudOptions = {
+  readonly write?: EntityHandlerOptions;
+  readonly read?: EntityQueryHandlerOptions;
+  readonly verbs?: Partial<Record<EntityCrudVerb, boolean>>;
+  /** Default true. Set false when the entity was already registered (e.g. before r.relation). */
+  readonly registerEntity?: boolean;
+};
+
+/** Minimal registrar surface — keeps entity-handlers free of define-feature imports. */
+export type EntityCrudRegistrar = {
+  entity(name: string, definition: EntityDefinition): unknown;
+  writeHandler(def: WriteHandlerDef): unknown;
+  queryHandler(def: QueryHandlerDef): unknown;
+};

package/src/engine/types/event-type-map.ts

@@ -1,37 +1 @@
-// Cross-Feature Compile-Time-Type-Map.
-//
-// Zweck: ctx.appendEvent / ctx.queryProjection / dispatcher.write gegen ein
-// statisch bekanntes Schema-Bild prüfen, statt erst zur Boot- oder Runtime
-// (zod-validate) zu scheitern. Designer/AI-Layer profitiert dadurch sofort:
-// Autocomplete kennt alle Event-Typen aller geladenen Features, payload-
-// Shape-Mismatches werden im Editor angezeigt, nicht erst beim Boot.
-//
-// Befüllung erfolgt per Feature über `declare module "@cosmicdrift/kumiko-framework/engine"`
-// — entweder hand-geschrieben (für stabile Frameworks-Internals) oder vom
-// Codegen-Skript erzeugt (für apps/bundled-features). Empty defaults sind
-// kein Bug: ein Feature ohne Augmentation ist runtime-pluggable und nutzt
-// die Fallback-Overload mit `unknown` payload.
-//
-// Pattern für hand-geschriebene Augmentation am File-Top:
-//
-//   declare module "@cosmicdrift/kumiko-framework/engine" {
-//     interface KumikoEventTypeMap {
-//       "users:user.created": z.infer<typeof userCreatedSchema>;
-//     }
-//   }
-
-// MUST be `interface` (not `type`): only interfaces support TS declaration-
-// merging. Apps/features extend these via `declare module "@cosmicdrift/kumiko-framework/engine"`
-// blocks. A `type X = {}` alias would silently break that augmentation channel.
-
-// biome-ignore lint/suspicious/noEmptyInterface: declaration-merging marker — augmented per feature
-export interface KumikoEventTypeMap {}
-
-// biome-ignore lint/suspicious/noEmptyInterface: declaration-merging marker
-export interface KumikoEntityTypeMap {}
-
-// biome-ignore lint/suspicious/noEmptyInterface: declaration-merging marker
-export interface KumikoHandlerPayloadMap {}
-
-// biome-ignore lint/suspicious/noEmptyInterface: declaration-merging marker
-export interface KumikoHandlerResultMap {}
+export * from "@cosmicdrift/kumiko-types/event-type-map";

package/src/engine/types/feature.ts

@@ -204,6 +204,13 @@ export type UiHints = {
 
 // --- Feature Definition (output of defineFeature) ---
 
+// Ctx passed to r.bootCheck(fn) — the full mounted-feature set, so a check
+// can inspect any other feature's shape (entities, PII fields, etc.).
+export type BootCheckContext = {
+  readonly features: readonly FeatureDefinition[];
+};
+export type BootCheckFn = (ctx: BootCheckContext) => void;
+
 export type FeatureDefinition = {
   readonly name: string;
   // Docs-lead paragraph declared via r.describe(). Flows through the
@@ -276,6 +283,13 @@ export type FeatureDefinition = {
    * UND das Provider-Feature muss in requires/optionalRequires sein.
    */
   readonly usedApis: ReadonlySet<string>;
+  /**
+   * Boot-time mount-invariant checks declared via `r.bootCheck(fn)`. Run
+   * once per feature after all other boot-validators, each with a ctx
+   * exposing the full mounted-feature set — throw to fail the boot with a
+   * feature-authored message (framework wraps it with `[Feature <name>]`).
+   */
+  readonly bootChecks: readonly BootCheckFn[];
   readonly referenceData: readonly ReferenceDataDef[];
   readonly notifications: Readonly<Record<string, NotificationDefinition>>;
   readonly events: Readonly<Record<string, EventDef>>;
@@ -617,6 +631,37 @@ export type FeatureRegistrar<TFeature extends string = string> = {
    */
   usesApi(apiName: string): void;
 
+  /**
+   * Declares a boot-time mount-invariant for this feature. `fn` runs once
+   * at boot with a ctx exposing every mounted feature — throw to fail the
+   * boot with a clear message. Multiple calls per feature are allowed.
+   *
+   * Use for cross-feature invariants that `r.requires` can't express
+   * because they're conditional (only fail when the feature has a
+   * specific shape), e.g. "if this feature has PII entities, some
+   * user-data-hook feature must be mounted" (the prompt-store trap,
+   * kumiko-enterprise#229 — a UserData feature was written but never
+   * mounted, and nothing caught it at boot):
+   *
+   * ```ts
+   * defineFeature("prompt-store", (r) => {
+   *   const promptFields = { text: { type: "text", pii: true } };
+   *   r.entity("prompt", { fields: promptFields });
+   *   r.bootCheck(({ features }) => {
+   *     // Conditional on this feature's own shape (has a pii field) —
+   *     // r.requires("user-data-hook") can't express that, it would fail
+   *     // even for a prompt-store variant with no PII fields at all.
+   *     const hasPiiField = Object.values(promptFields).some((f) => f.pii);
+   *     const hasUserDataHook = features.some((f) => f.name === "user-data-hook");
+   *     if (hasPiiField && !hasUserDataHook) {
+   *       throw new Error("prompt-store has PII fields but no user-data-hook feature is mounted");
+   *     }
+   *   });
+   * });
+   * ```
+   */
+  bootCheck(fn: BootCheckFn): void;
+
   // Declare a metric. Short name (without kumiko_<feature>_ prefix) — Framework
   // qualifies it on boot. Validation (snake_case + typ-suffix) runs at boot.
   // Usage at runtime: ctx.metrics.inc("created_total", { status: "new" }).

package/src/engine/types/fields.ts

@@ -1,11 +1,11 @@
 // --- Field Types ---
 
-// OwnershipMap is declared in engine/ownership.ts — field-access maps to
+// OwnershipMap is declared in ./ownership.ts — field-access maps to
 // per-role ownership rules. A legacy `readonly string[]` form is still
 // accepted at the type layer during migration: features that pass an
 // array are auto-normalized to { [role]: "all" } at registry build.
 // Long-term: string[] disappears.
-import type { OwnershipMap } from "../ownership";
+import type { OwnershipMap } from "./ownership";
 
 export type FieldAccess = {
   readonly read?: OwnershipMap | readonly string[];
@@ -312,25 +312,23 @@ export type ReferenceFieldDef = {
 
 // --- Currency ---
 
-export const DEFAULT_CURRENCIES = [
-  "EUR",
-  "USD",
-  "GBP",
-  "CHF",
-  "JPY",
-  "SEK",
-  "NOK",
-  "DKK",
-  "PLN",
-  "CZK",
-  "CAD",
-  "AUD",
-  "NZD",
-  "CNY",
-  "INR",
-] as const;
-
-export type DefaultCurrency = (typeof DEFAULT_CURRENCIES)[number];
+// Keep in sync with DEFAULT_CURRENCIES in ../field-helpers.ts.
+export type DefaultCurrency =
+  | "EUR"
+  | "USD"
+  | "GBP"
+  | "CHF"
+  | "JPY"
+  | "SEK"
+  | "NOK"
+  | "DKK"
+  | "PLN"
+  | "CZK"
+  | "CAD"
+  | "AUD"
+  | "NZD"
+  | "CNY"
+  | "INR";
 
 // --- Embedded Object ---
 
@@ -531,16 +529,6 @@ export type FieldDefinition =
 // `maxSize` and `accept`, which is what upload validation cares about.
 export type AnyFileFieldDef = FileFieldDef | ImageFieldDef | FilesFieldDef | ImagesFieldDef;
 
-export function isFileField(field: FieldDefinition | undefined): field is AnyFileFieldDef {
-  if (!field) return false;
-  return (
-    field.type === "file" ||
-    field.type === "image" ||
-    field.type === "files" ||
-    field.type === "images"
-  );
-}
-
 // --- Derived (computed) fields ---
 //
 // A derived field is read-time only: its value is computed from the stored row

package/src/engine/types/handlers.ts

@@ -166,27 +166,6 @@ export type WriteResult<TData = unknown> =
   | { readonly isSuccess: true; readonly data: TData }
   | WriteFailure;
 
-/**
- * Override the success-side `data` of a WriteResult while forwarding the
- * failure half untouched. Useful for handlers that delegate to the
- * event-store executor (which returns a SaveContext / DeleteContext
- * envelope) but want to keep their own response shape — caller contract
- * stays flat instead of leaking the executor's internals.
- *
- * ```ts
- * const result = await executor.delete({ id }, user, db);
- * return withResponseData(result, { userId, tenantId });
- * ```
- *
- * On failure the same WriteFailure instance is returned — the error
- * object round-trips without any wrapping, so the dispatcher / HTTP layer
- * still read the original error code + httpStatus + i18nKey.
- */
-export function withResponseData<T>(result: WriteResult<unknown>, data: T): WriteResult<T> {
-  if (!result.isSuccess) return result;
-  return { isSuccess: true, data };
-}
-
 // --- Context Types ---
 
 // Forward import: Registry is in feature.ts (circular type import — fine in TS)
@@ -375,7 +354,13 @@ export type HandlerContext<TMap extends object = KumikoEventTypeMap> = SharedCon
   // is on, add extra columns to the export"). The dispatcher gate already
   // blocks calls to handlers of disabled features — this is the fine-grained
   // opt-in counterpart, not a substitute for the gate.
-  readonly hasFeature: (featureName: string) => boolean;
+  //
+  // Async: falls back to the live trial-gate (tenant.inserted_at-derived,
+  // can't live in the boot-cached sync resolver) whenever the synchronous
+  // feature-set says a feature is off — otherwise trial tenants checking a
+  // companion feature (not their own handler's owning feature) would see a
+  // stale `false`.
+  readonly hasFeature: (featureName: string) => Promise<boolean>;
 
   // Append a domain event to a specific aggregate stream in the current tx.
   // Marten-aligned: every event belongs to exactly one aggregate. The runtime
@@ -774,10 +759,6 @@ export type EventMigrationDef = {
 // Anything that carries a name — accepted by hooks, relations, jobs, etc.
 export type NameOrRef = string | { readonly name: string };
 
-export function resolveName(ref: NameOrRef): string {
-  return typeof ref === "string" ? ref : ref.name;
-}
-
 export type EntityRef = {
   readonly name: string;
   readonly table: string;

package/src/engine/types/hooks.ts

@@ -1,4 +1,5 @@
 import type { StoredEvent } from "../../event-store/event-store";
+import type { HookPhases } from "../hook-helpers";
 import type { AppContext } from "./handlers";
 import type { EntityId } from "./identifiers";
 
@@ -101,21 +102,6 @@ export type LifecycleHookFn =
   | PreQueryHookFn
   | PostQueryHookFn;
 
-// --- Hook Phases ---
-//
-// inTransaction: Hook runs inside the DB transaction. Failures roll back
-//   the entire write. Use for: DB-based side-effects (counter updates,
-//   dependent entity writes).
-//
-// afterCommit (default): Hook runs after the transaction commits. Failures
-//   are logged but don't affect the write. Use for: external systems
-//   (SSE broadcast, search index, email, webhooks).
-
-export const HookPhases = {
-  inTransaction: "inTransaction",
-  afterCommit: "afterCommit",
-} as const;
-
 export type HookPhase = (typeof HookPhases)[keyof typeof HookPhases];
 
 // Owner-tag shared across every hook structure. The lifecycle pipeline uses

package/src/engine/types/http-route.ts

@@ -1,72 +1 @@
-// HTTP-Route-Definition — feature-deklarierte HTTP-Endpoints außerhalb
-// der /api/write|query|batch-Pipeline. Use-Case: RSS/Atom-Feeds, OpenAPI-
-// Specs, OG-Image-Generators, Webhook-Receiver — alles wo der Feature-
-// Author das Wire-Format selbst kontrolliert.
-//
-// Pattern symmetrisch zu r.queryHandler / r.writeHandler: Definition als
-// Teil des Features (nicht des App-Bootstrapping). Phase-3 Multi-Tenant
-// wird trivial weil tenant-context via host-resolution greift.
-//
-// Escape-hatch bleibt: runProdApp.extraRoutes für hand-rolled Routes die
-// nichts mit einem Feature zu tun haben (z.B. plattform-spezifische
-// Static-Serving-Logic).
-
-import type { Context } from "hono";
-
-/** Subset von HTTP-Methoden den wir aktiv unterstützen. Hono spricht
- *  alle, aber das hier sind die einzigen die ein Feature-Author
- *  realistisch deklariert. */
-export type HttpRouteMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
-
-/** Dependencies die der Handler vom Framework bekommt. App-Author kann
- *  die App selbst aufrufen (`deps.app.fetch(...)` für intern-call) oder
- *  direkt per dispatcher Daten ziehen. Db/Redis sind die rohen Connections
- *  — wer Tenant-Scope braucht muss durch dispatcher.query gehen.
- *
- *  Hono-typing: `Context<any, any>` weil das Hono-Type-Param-Setup nur
- *  intern relevant ist. Concrete Hono-app wird im Boot-Path zugewiesen. */
-export type HttpRouteHandlerDeps = {
-  /** Die Hono-app — Handler kann via app.fetch(...) interne Routes
-   *  ansprechen (z.B. /api/query mit der vollen Auth-/Anonymous-Chain). */
-  // biome-ignore lint/suspicious/noExplicitAny: Hono's generic-Param ist im Framework-Boundary unsichtbar
-  readonly app: import("hono").Hono<any, any>;
-  /** Run a query handler in-process, forcing a SPECIFIC tenant — WITHOUT
-   *  going through the public /api/query HTTP layer (no header parsing, no
-   *  anonymousAccess tenant resolution). The synthesized caller carries
-   *  anonymous-level access ONLY (same role a real anonymous request would
-   *  have, no more) — the primitive forces the tenant, not the privilege
-   *  level, so it stays safe to call from any `anonymous: true` route
-   *  without risking a field-level disclosure a real anonymous caller
-   *  couldn't already get. Use this whenever the route needs a tenant
-   *  other than the one the request resolves to (e.g. always
-   *  SYSTEM_TENANT_ID regardless of the visited host) — spoofing that via
-   *  an internal X-Tenant header on `app.fetch(...)` is indistinguishable
-   *  from an external client and gets rejected by resolverTrust:
-   *  "authoritative" anonymousAccess configs (see auth-middleware.ts). */
-  readonly systemQuery: (
-    type: string,
-    payload: unknown,
-    tenantId: import("./identifiers").TenantId,
-  ) => Promise<unknown>;
-};
-
-export type HttpRouteHandler = (
-  // biome-ignore lint/suspicious/noExplicitAny: Hono Context-Generics sind im Framework-Boundary unsichtbar
-  c: Context<any, any>,
-  deps: HttpRouteHandlerDeps,
-) => Response | Promise<Response>;
-
-export type HttpRouteDefinition = {
-  /** HTTP-Methode — bei Hono-Mount via app.{get,post,...}(path). */
-  readonly method: HttpRouteMethod;
-  /** URL-Pfad (Hono-Pattern, z.B. "/feed.xml" oder "/og/:tenantId.png"). */
-  readonly path: string;
-  /** Wenn true, bypasses die /api/*-Auth-Middleware. Default false —
-   *  Routes liegen außerhalb /api/* und sehen die Auth-Middleware
-   *  ohnehin nicht; das Flag ist semantisch (= "diese Route ist
-   *  bewusst öffentlich") für Boot-Validator + Doku. */
-  readonly anonymous?: boolean;
-  /** Hono-Handler. Bekommt Hono-Context + Framework-Deps; returnt
-   *  Response (sync oder async). */
-  readonly handler: HttpRouteHandler;
-};
+export * from "@cosmicdrift/kumiko-types/http-route";

package/src/engine/types/identifiers.ts

@@ -1,47 +1 @@
-// Domain-identifier type aliases. Used everywhere a tenantId/userId/aggregateId
-// travels through the framework. One declaration per concept so future
-// representation changes (branded types, UUID validation, opaque wrappers)
-// land in a single place.
-
-// Tenant identifier — UUID string today. May become branded/opaque later
-// without touching call sites.
-export type TenantId = string;
-
-// Lowercase UUID (any RFC-4122 variant). Strict enough to keep client-
-// supplied junk (e.g. SQL fragments, path-traversal probes) out of the
-// pipeline; loose enough that v4 / v7 / nil all match. Any caller that
-// already holds a TenantId from a trusted source (JWT payload, server
-// config) skips this — the helper is for **untrusted input** crossing
-// the system boundary.
-const TENANT_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-
-// Validates a candidate string against the tenantId format and returns it
-// as a TenantId, or `null` when it doesn't match. Use at every system
-// boundary that admits untrusted input (HTTP headers, cookies, query
-// params). Returning null instead of throwing keeps the caller in charge
-// of the rejection shape — middleware returns 400, batch jobs may filter
-// + log, and unit tests don't need a try/catch.
-export function parseTenantId(value: unknown): TenantId | null {
-  if (typeof value !== "string") return null;
-  if (!TENANT_ID_REGEX.test(value)) return null;
-  return value;
-}
-
-// "System-scope" tenant marker: handlers carry this tenantId when the event
-// doesn't belong to any particular tenant (reference data, cross-tenant
-// jobs, global config). The concrete UUID is a valid v4 (not all-zeroes —
-// Postgres' UUID type rejects invalid variants), chosen to be easy to
-// eyeball in logs. Central constant so call sites don't re-type the string
-// and the isSystemTenant() check stays in sync.
-export const SYSTEM_TENANT_ID: TenantId = "00000000-0000-4000-8000-000000000000";
-
-export function isSystemTenant(tenantId: TenantId | null | undefined): boolean {
-  return !tenantId || tenantId === SYSTEM_TENANT_ID;
-}
-
-// Primary-key identifier for any entity row. Two shapes coexist because of
-// the entity-def `idType` switch: classic CRUD entities keep `serial` (number),
-// while tenant + ES aggregates run on `uuid` (string). Call sites that pass
-// the id through to the DB layer stay agnostic; only code that formats ids
-// for URLs, logs, or cache keys needs `String(id)` — JS coerces both safely.
-export type EntityId = number | string;
+export * from "@cosmicdrift/kumiko-types/identifiers";

package/src/engine/types/index.ts

@@ -9,6 +9,15 @@ export type {
   LifecycleHookType,
   OnDeleteStrategy,
 } from "../constants";
+export { DEFAULT_CURRENCIES, isFileField } from "../field-helpers";
+export { resolveName, withResponseData } from "../handler-helpers";
+export { HookPhases } from "../hook-helpers";
+export {
+  isExtensionEditSection,
+  isFormatSpec,
+  normalizeEditField,
+  normalizeListColumn,
+} from "../screen-helpers";
 export type {
   ConfigAccessor,
   ConfigAccessorFactory,
@@ -54,6 +63,18 @@ export type {
   TranslationsDef,
   UiExtensionDef,
 } from "./config";
+export type {
+  QueryHandlerDefinition,
+  WriteHandlerDefinition,
+  WriteHandlerInput,
+} from "./define-handler";
+export type {
+  EntityCrudRegistrar,
+  EntityCrudVerb,
+  EntityHandlerOptions,
+  EntityQueryHandlerOptions,
+  RegisterEntityCrudOptions,
+} from "./entity-handlers";
 // Cross-Feature Compile-Time-Type-Map — features extend per declare-module.
 export type {
   KumikoEntityTypeMap,
@@ -62,6 +83,8 @@ export type {
   KumikoHandlerResultMap,
 } from "./event-type-map";
 export type {
+  BootCheckContext,
+  BootCheckFn,
   FeatureDefinition,
   FeatureMetricDef,
   FeatureMetricType,
@@ -115,7 +138,6 @@ export type {
   TransitionMap,
   TzFieldDef,
 } from "./fields";
-export { DEFAULT_CURRENCIES, isFileField } from "./fields";
 export type {
   AccessRule,
   AggregateStreamHandle,
@@ -162,7 +184,6 @@ export type {
   WriteHandlerFn,
   WriteResult,
 } from "./handlers";
-export { resolveName, withResponseData } from "./handlers";
 export type {
   DeleteContext,
   EntityHookMap,
@@ -186,7 +207,6 @@ export type {
   ValidationError,
   ValidationHookFn,
 } from "./hooks";
-export { HookPhases } from "./hooks";
 export type {
   HttpRouteDefinition,
   HttpRouteHandler,
@@ -197,6 +217,17 @@ export type {
 export type { EntityId, TenantId } from "./identifiers";
 export { isSystemTenant, parseTenantId, SYSTEM_TENANT_ID } from "./identifiers";
 export type { NavDefinition } from "./nav";
+export type {
+  FromRule,
+  FromRuleKind,
+  OwnershipClause,
+  OwnershipMap,
+  OwnershipRef,
+  OwnershipRule,
+  SqlFragment,
+  WhereRule,
+  WhereRuleContext,
+} from "./ownership";
 export type {
   EntityProjectionExtension,
   MspErrorMode,
@@ -253,12 +284,6 @@ export type {
   ScreenSlots,
   ToolbarAction,
 } from "./screen";
-export {
-  isExtensionEditSection,
-  isFormatSpec,
-  normalizeEditField,
-  normalizeListColumn,
-} from "./screen";
 export type { TargetRef } from "./target-ref";
 export type {
   Subscribe,