@cosmicdrift/kumiko-framework 0.158.2 → 0.160.0

package/src/engine/types/hooks.ts

@@ -1,184 +1,2 @@
-import type { StoredEvent } from "../../event-store/event-store";
-import type { AppContext } from "./handlers";
-import type { EntityId } from "./identifiers";
-
-// --- Validation ---
-
-export type ValidationError = {
-  readonly field: string;
-  readonly error: string;
-};
-
-export type ValidationHookFn = (
-  data: Readonly<Record<string, unknown>>,
-) => readonly ValidationError[] | null;
-
-// --- Save/Delete Context (what hooks receive) ---
-
-export type SaveContext = {
-  readonly kind: "save";
-  readonly id: EntityId;
-  readonly data: Readonly<Record<string, unknown>>;
-  readonly changes: Readonly<Record<string, unknown>>;
-  readonly previous: Readonly<Record<string, unknown>>;
-  readonly isNew: boolean;
-  readonly entityName?: string | undefined;
-  // The event that produced this save. Populated by the event-store-executor;
-  // the pipeline uses it to drive projections inside the same transaction.
-  // Optional because hand-crafted SaveContexts (tests, custom executors) may
-  // not have an event — projections just skip in that case.
-  readonly event?: StoredEvent | undefined;
-};
-
-export type DeleteContext = {
-  readonly kind: "delete";
-  readonly id: EntityId;
-  readonly data: Readonly<Record<string, unknown>>;
-  readonly entityName?: string | undefined;
-  // See SaveContext.event — same semantics.
-  readonly event?: StoredEvent | undefined;
-};
-
-export type LifecycleResult = SaveContext | DeleteContext;
-
-// --- Lifecycle Hooks ---
-
-export type PreSaveHookFn = (
-  changes: Record<string, unknown>,
-  context: AppContext & {
-    readonly previous: Readonly<Record<string, unknown>>;
-    readonly isNew: boolean;
-  },
-) => Promise<Record<string, unknown>>;
-
-export type PostSaveHookFn = (result: SaveContext, context: AppContext) => Promise<void>;
-
-// Batch-variant: called once at the end of a dispatcher batch with every
-// successful SaveContext. The per-save PostSaveHookFn still fires for
-// side-effects that need per-entity semantics (SSE); PostSaveBatch exists
-// for adapters that can amortise work across the whole batch (e.g. search
-// index batch-writes, bulk webhook fanout).
-export type PostSaveBatchHookFn = (
-  results: readonly SaveContext[],
-  context: AppContext,
-) => Promise<void>;
-
-export type PreDeleteHookFn = (payload: DeleteContext, context: AppContext) => Promise<void>;
-
-export type PostDeleteHookFn = (payload: DeleteContext, context: AppContext) => Promise<void>;
-
-export type PostDeleteBatchHookFn = (
-  payloads: readonly DeleteContext[],
-  context: AppContext,
-) => Promise<void>;
-
-export type PreQueryHookFn = (
-  payload: Record<string, unknown>,
-  context: AppContext,
-) => Promise<Record<string, unknown>>;
-
-// postQuery — fires after query-handler-execute, before field-access-read-filter.
-// Hook receives normalized rows + entityName + can mutate rows (e.g., merge
-// custom-fields, add computed-counts, attach related-data). Mutation result
-// replaces original rows. Hook is responsible for its own field-access-logic
-// on added fields (field-access-filter only knows entity's stammfields).
-export type PostQueryHookFn = (
-  result: {
-    // undefined for standalone queries (no-colon handler names like
-    // "ns:dashboard") — those have no backing entity, but handler-keyed
-    // postQuery hooks still fire on them.
-    readonly entityName: string | undefined;
-    readonly rows: ReadonlyArray<Record<string, unknown>>;
-  },
-  context: AppContext,
-) => Promise<{ rows: ReadonlyArray<Record<string, unknown>> }>;
-
-export type LifecycleHookFn =
-  | PreSaveHookFn
-  | PostSaveHookFn
-  | PreDeleteHookFn
-  | PostDeleteHookFn
-  | PreQueryHookFn
-  | PostQueryHookFn;
-
-// --- Hook Phases ---
-//
-// inTransaction: Hook runs inside the DB transaction. Failures roll back
-//   the entire write. Use for: DB-based side-effects (counter updates,
-//   dependent entity writes).
-//
-// afterCommit (default): Hook runs after the transaction commits. Failures
-//   are logged but don't affect the write. Use for: external systems
-//   (SSE broadcast, search index, email, webhooks).
-
-export const HookPhases = {
-  inTransaction: "inTransaction",
-  afterCommit: "afterCommit",
-} as const;
-
-export type HookPhase = (typeof HookPhases)[keyof typeof HookPhases];
-
-// Owner-tag shared across every hook structure. The lifecycle pipeline uses
-// it to skip hooks whose owning feature is globally disabled:
-//   - A concrete feature name like "orders" → subject to the feature-toggle
-//     filter (skipped when "orders" is disabled).
-//   - "*" (star) → invariant plumbing, never filtered. Reserved for
-//     extension-provided hooks and framework-internal hooks that belong to
-//     the pipeline itself, not a feature.
-//   - Omitted (undefined) → treated as "*". Supports tests that hand-build
-//     HookMap objects without caring about ownership.
-export type HookOwner = { readonly featureName?: string };
-
-export type PhasedHook<TFn> = {
-  readonly fn: TFn;
-  readonly phase: HookPhase;
-} & HookOwner;
-
-// Flat (non-phased) hook — preSave, preQuery. Same owner contract, no
-// phase semantics because these hooks run exactly once per handler pass
-// before/around the DB transaction.
-export type OwnedFn<TFn> = {
-  readonly fn: TFn;
-} & HookOwner;
-
-// --- Hook Maps ---
-
-// Slots are optional: defineFeature materializes every slot, but hand-built
-// FeatureDefinitions at system boundaries (test fixtures, partial boots —
-// see registry.test.ts "slot robustness") legitimately omit them, and the
-// registry merge paths tolerate undefined. The type mirrors that contract.
-export type HookMap = {
-  readonly validation?: Readonly<Record<string, ValidationHookFn>>;
-  readonly preSave?: Readonly<Record<string, readonly OwnedFn<PreSaveHookFn>[]>>;
-  readonly postSave?: Readonly<Record<string, readonly PhasedHook<PostSaveHookFn>[]>>;
-  readonly preDelete?: Readonly<Record<string, readonly PhasedHook<PreDeleteHookFn>[]>>;
-  readonly postDelete?: Readonly<Record<string, readonly PhasedHook<PostDeleteHookFn>[]>>;
-  readonly preQuery?: Readonly<Record<string, readonly OwnedFn<PreQueryHookFn>[]>>;
-  readonly postQuery?: Readonly<Record<string, readonly OwnedFn<PostQueryHookFn>[]>>;
-};
-
-export type EntityHookMap = {
-  readonly postSave?: Readonly<Record<string, readonly PhasedHook<PostSaveHookFn>[]>>;
-  readonly preDelete?: Readonly<Record<string, readonly PhasedHook<PreDeleteHookFn>[]>>;
-  readonly postDelete?: Readonly<Record<string, readonly PhasedHook<PostDeleteHookFn>[]>>;
-  readonly postQuery?: Readonly<Record<string, readonly OwnedFn<PostQueryHookFn>[]>>;
-};
-
-// Search-Payload-Extension (F3) — contributor function that adds flat
-// fields to an entity's search-document. Fires synchronously during
-// buildSearchDocument (in `system-hooks.ts`), receives current entity
-// state, returns extra fields to merge into the search-index payload.
-//
-// Use-cases: custom-fields-bundle (merge customFields-jsonb-keys flat
-// into index), tags-bundle (project tags-array as searchable), computed-
-// fields (denormalize related-counts).
-//
-// IMPORTANT: contributor must be deterministic per (entityName, entityId,
-// state). Async-allowed for future-proofing but discouraged — the
-// indexing path runs once per entity-write, sync extension is
-// near-zero-cost.
-export type SearchPayloadContributorFn = (args: {
-  readonly entityName: string;
-  readonly entityId: EntityId;
-  readonly state: Record<string, unknown>;
-}) => Record<string, unknown> | Promise<Record<string, unknown>>;
+// Legacy path — re-exported for callers still importing this module directly.
+export * from "@cosmicdrift/kumiko-types/hooks";

package/src/engine/types/http-route.ts

@@ -1,72 +1 @@
-// HTTP-Route-Definition — feature-deklarierte HTTP-Endpoints außerhalb
-// der /api/write|query|batch-Pipeline. Use-Case: RSS/Atom-Feeds, OpenAPI-
-// Specs, OG-Image-Generators, Webhook-Receiver — alles wo der Feature-
-// Author das Wire-Format selbst kontrolliert.
-//
-// Pattern symmetrisch zu r.queryHandler / r.writeHandler: Definition als
-// Teil des Features (nicht des App-Bootstrapping). Phase-3 Multi-Tenant
-// wird trivial weil tenant-context via host-resolution greift.
-//
-// Escape-hatch bleibt: runProdApp.extraRoutes für hand-rolled Routes die
-// nichts mit einem Feature zu tun haben (z.B. plattform-spezifische
-// Static-Serving-Logic).
-
-import type { Context } from "hono";
-
-/** Subset von HTTP-Methoden den wir aktiv unterstützen. Hono spricht
- *  alle, aber das hier sind die einzigen die ein Feature-Author
- *  realistisch deklariert. */
-export type HttpRouteMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
-
-/** Dependencies die der Handler vom Framework bekommt. App-Author kann
- *  die App selbst aufrufen (`deps.app.fetch(...)` für intern-call) oder
- *  direkt per dispatcher Daten ziehen. Db/Redis sind die rohen Connections
- *  — wer Tenant-Scope braucht muss durch dispatcher.query gehen.
- *
- *  Hono-typing: `Context<any, any>` weil das Hono-Type-Param-Setup nur
- *  intern relevant ist. Concrete Hono-app wird im Boot-Path zugewiesen. */
-export type HttpRouteHandlerDeps = {
-  /** Die Hono-app — Handler kann via app.fetch(...) interne Routes
-   *  ansprechen (z.B. /api/query mit der vollen Auth-/Anonymous-Chain). */
-  // biome-ignore lint/suspicious/noExplicitAny: Hono's generic-Param ist im Framework-Boundary unsichtbar
-  readonly app: import("hono").Hono<any, any>;
-  /** Run a query handler in-process, forcing a SPECIFIC tenant — WITHOUT
-   *  going through the public /api/query HTTP layer (no header parsing, no
-   *  anonymousAccess tenant resolution). The synthesized caller carries
-   *  anonymous-level access ONLY (same role a real anonymous request would
-   *  have, no more) — the primitive forces the tenant, not the privilege
-   *  level, so it stays safe to call from any `anonymous: true` route
-   *  without risking a field-level disclosure a real anonymous caller
-   *  couldn't already get. Use this whenever the route needs a tenant
-   *  other than the one the request resolves to (e.g. always
-   *  SYSTEM_TENANT_ID regardless of the visited host) — spoofing that via
-   *  an internal X-Tenant header on `app.fetch(...)` is indistinguishable
-   *  from an external client and gets rejected by resolverTrust:
-   *  "authoritative" anonymousAccess configs (see auth-middleware.ts). */
-  readonly systemQuery: (
-    type: string,
-    payload: unknown,
-    tenantId: import("./identifiers").TenantId,
-  ) => Promise<unknown>;
-};
-
-export type HttpRouteHandler = (
-  // biome-ignore lint/suspicious/noExplicitAny: Hono Context-Generics sind im Framework-Boundary unsichtbar
-  c: Context<any, any>,
-  deps: HttpRouteHandlerDeps,
-) => Response | Promise<Response>;
-
-export type HttpRouteDefinition = {
-  /** HTTP-Methode — bei Hono-Mount via app.{get,post,...}(path). */
-  readonly method: HttpRouteMethod;
-  /** URL-Pfad (Hono-Pattern, z.B. "/feed.xml" oder "/og/:tenantId.png"). */
-  readonly path: string;
-  /** Wenn true, bypasses die /api/*-Auth-Middleware. Default false —
-   *  Routes liegen außerhalb /api/* und sehen die Auth-Middleware
-   *  ohnehin nicht; das Flag ist semantisch (= "diese Route ist
-   *  bewusst öffentlich") für Boot-Validator + Doku. */
-  readonly anonymous?: boolean;
-  /** Hono-Handler. Bekommt Hono-Context + Framework-Deps; returnt
-   *  Response (sync oder async). */
-  readonly handler: HttpRouteHandler;
-};
+export * from "@cosmicdrift/kumiko-types/http-route";

package/src/engine/types/identifiers.ts

@@ -1,47 +1 @@
-// Domain-identifier type aliases. Used everywhere a tenantId/userId/aggregateId
-// travels through the framework. One declaration per concept so future
-// representation changes (branded types, UUID validation, opaque wrappers)
-// land in a single place.
-
-// Tenant identifier — UUID string today. May become branded/opaque later
-// without touching call sites.
-export type TenantId = string;
-
-// Lowercase UUID (any RFC-4122 variant). Strict enough to keep client-
-// supplied junk (e.g. SQL fragments, path-traversal probes) out of the
-// pipeline; loose enough that v4 / v7 / nil all match. Any caller that
-// already holds a TenantId from a trusted source (JWT payload, server
-// config) skips this — the helper is for **untrusted input** crossing
-// the system boundary.
-const TENANT_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-
-// Validates a candidate string against the tenantId format and returns it
-// as a TenantId, or `null` when it doesn't match. Use at every system
-// boundary that admits untrusted input (HTTP headers, cookies, query
-// params). Returning null instead of throwing keeps the caller in charge
-// of the rejection shape — middleware returns 400, batch jobs may filter
-// + log, and unit tests don't need a try/catch.
-export function parseTenantId(value: unknown): TenantId | null {
-  if (typeof value !== "string") return null;
-  if (!TENANT_ID_REGEX.test(value)) return null;
-  return value;
-}
-
-// "System-scope" tenant marker: handlers carry this tenantId when the event
-// doesn't belong to any particular tenant (reference data, cross-tenant
-// jobs, global config). The concrete UUID is a valid v4 (not all-zeroes —
-// Postgres' UUID type rejects invalid variants), chosen to be easy to
-// eyeball in logs. Central constant so call sites don't re-type the string
-// and the isSystemTenant() check stays in sync.
-export const SYSTEM_TENANT_ID: TenantId = "00000000-0000-4000-8000-000000000000";
-
-export function isSystemTenant(tenantId: TenantId | null | undefined): boolean {
-  return !tenantId || tenantId === SYSTEM_TENANT_ID;
-}
-
-// Primary-key identifier for any entity row. Two shapes coexist because of
-// the entity-def `idType` switch: classic CRUD entities keep `serial` (number),
-// while tenant + ES aggregates run on `uuid` (string). Call sites that pass
-// the id through to the DB layer stay agnostic; only code that formats ids
-// for URLs, logs, or cache keys needs `String(id)` — JS coerces both safely.
-export type EntityId = number | string;
+export * from "@cosmicdrift/kumiko-types/identifiers";

package/src/engine/types/index.ts

@@ -1,14 +1,8 @@
-// Barrel: re-exports all types from logical modules
+// Barrel: re-exports all types from @cosmicdrift/kumiko-types, plus the
+// runtime helpers below that stay framework-side.
 // Duplicate types (OnDeleteStrategy, ConfigScope, ConcurrencyMode, LifecycleHookType)
 // are defined ONLY in constants.ts — re-exported here for backwards compatibility.
 
-// Re-export types that were duplicated in types.ts but are canonical in constants.ts
-export type {
-  ConcurrencyMode,
-  ConfigScope,
-  LifecycleHookType,
-  OnDeleteStrategy,
-} from "../constants";
 export type {
   ConfigAccessor,
   ConfigAccessorFactory,
@@ -53,15 +47,30 @@ export type {
   TranslationKeys,
   TranslationsDef,
   UiExtensionDef,
-} from "./config";
+} from "@cosmicdrift/kumiko-types/config";
+export type {
+  QueryHandlerDefinition,
+  StreamHandlerDefinition,
+  WriteHandlerDefinition,
+  WriteHandlerInput,
+} from "@cosmicdrift/kumiko-types/define-handler";
+export type {
+  EntityCrudRegistrar,
+  EntityCrudVerb,
+  EntityHandlerOptions,
+  EntityQueryHandlerOptions,
+  RegisterEntityCrudOptions,
+} from "@cosmicdrift/kumiko-types/entity-handlers";
 // Cross-Feature Compile-Time-Type-Map — features extend per declare-module.
 export type {
   KumikoEntityTypeMap,
   KumikoEventTypeMap,
   KumikoHandlerPayloadMap,
   KumikoHandlerResultMap,
-} from "./event-type-map";
+} from "@cosmicdrift/kumiko-types/event-type-map";
 export type {
+  BootCheckContext,
+  BootCheckFn,
   FeatureDefinition,
   FeatureMetricDef,
   FeatureMetricType,
@@ -76,7 +85,7 @@ export type {
   StoreTableOptions,
   UiHintOption,
   UiHints,
-} from "./feature";
+} from "@cosmicdrift/kumiko-types/feature";
 export type {
   AnyFileFieldDef,
   BigIntFieldDef,
@@ -114,8 +123,7 @@ export type {
   TimestampFieldDef,
   TransitionMap,
   TzFieldDef,
-} from "./fields";
-export { DEFAULT_CURRENCIES, isFileField } from "./fields";
+} from "@cosmicdrift/kumiko-types/fields";
 export type {
   AccessRule,
   AggregateStreamHandle,
@@ -154,6 +162,8 @@ export type {
   RateLimitOption,
   RateLimitPer,
   SessionUser,
+  StreamHandlerDef,
+  StreamHandlerFn,
   TryAppendEventFn,
   TryAppendEventResult,
   UnsafeAppendEventFn,
@@ -161,8 +171,7 @@ export type {
   WriteHandlerDef,
   WriteHandlerFn,
   WriteResult,
-} from "./handlers";
-export { resolveName, withResponseData } from "./handlers";
+} from "@cosmicdrift/kumiko-types/handlers";
 export type {
   DeleteContext,
   EntityHookMap,
@@ -185,18 +194,32 @@ export type {
   SearchPayloadContributorFn,
   ValidationError,
   ValidationHookFn,
-} from "./hooks";
-export { HookPhases } from "./hooks";
+} from "@cosmicdrift/kumiko-types/hooks";
 export type {
   HttpRouteDefinition,
   HttpRouteHandler,
   HttpRouteHandlerDeps,
   HttpRouteMethod,
-} from "./http-route";
+} from "@cosmicdrift/kumiko-types/http-route";
 // Domain-identifier type aliases — see identifiers.ts for rationale.
-export type { EntityId, TenantId } from "./identifiers";
-export { isSystemTenant, parseTenantId, SYSTEM_TENANT_ID } from "./identifiers";
-export type { NavDefinition } from "./nav";
+export type { EntityId, TenantId } from "@cosmicdrift/kumiko-types/identifiers";
+export {
+  isSystemTenant,
+  parseTenantId,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-types/identifiers";
+export type { NavDefinition } from "@cosmicdrift/kumiko-types/nav";
+export type {
+  FromRule,
+  FromRuleKind,
+  OwnershipClause,
+  OwnershipMap,
+  OwnershipRef,
+  OwnershipRule,
+  SqlFragment,
+  WhereRule,
+  WhereRuleContext,
+} from "@cosmicdrift/kumiko-types/ownership";
 export type {
   EntityProjectionExtension,
   MspErrorMode,
@@ -206,14 +229,14 @@ export type {
   ProjectionDefinition,
   ProjectionTable,
   SingleStreamApplyFn,
-} from "./projection";
+} from "@cosmicdrift/kumiko-types/projection";
 export type {
   BelongsToRelation,
   EntityRelations,
   HasManyRelation,
   ManyToManyRelation,
   RelationDefinition,
-} from "./relations";
+} from "@cosmicdrift/kumiko-types/relations";
 export type {
   ActionFormScreenDefinition,
   ConfigEditScreenDefinition,
@@ -252,14 +275,8 @@ export type {
   ScreenFilterOp,
   ScreenSlots,
   ToolbarAction,
-} from "./screen";
-export {
-  isExtensionEditSection,
-  isFormatSpec,
-  normalizeEditField,
-  normalizeListColumn,
-} from "./screen";
-export type { TargetRef } from "./target-ref";
+} from "@cosmicdrift/kumiko-types/screen";
+export type { TargetRef } from "@cosmicdrift/kumiko-types/target-ref";
 export type {
   Subscribe,
   TreeAction,
@@ -268,5 +285,21 @@ export type {
   TreeChildrenSubscribe,
   TreeNode,
   TreeNodeState,
-} from "./tree-node";
-export type { WorkspaceDefinition } from "./workspace";
+} from "@cosmicdrift/kumiko-types/tree-node";
+export type { WorkspaceDefinition } from "@cosmicdrift/kumiko-types/workspace";
+// Re-export types that were duplicated in types.ts but are canonical in constants.ts
+export type {
+  ConcurrencyMode,
+  ConfigScope,
+  LifecycleHookType,
+  OnDeleteStrategy,
+} from "../constants";
+export { DEFAULT_CURRENCIES, isFileField } from "../field-helpers";
+export { resolveName, withResponseData } from "../handler-helpers";
+export { HookPhases } from "../hook-helpers";
+export {
+  isExtensionEditSection,
+  isFormatSpec,
+  normalizeEditField,
+  normalizeListColumn,
+} from "../screen-helpers";

package/src/engine/types/nav.ts

@@ -1,67 +1,2 @@
-import type { AccessRule } from "./handlers";
-import type { TargetRef } from "./target-ref";
-import type { TreeAction } from "./tree-node";
-
-// Nav entry declaration. Every feature that wants to appear in the app's
-// navigation tree registers one or more entries via r.nav(). The engine
-// keeps the list flat — ui-core's resolveNavigation assembles the parent/
-// child tree at render time, so changes (toggles, access-gating) don't
-// require re-indexing a tree shape server-side.
-//
-// Cross-feature references are allowed: `screen` may point at any
-// registered screen QN, `parent` at any registered nav QN. The boot
-// validator checks both references exist + rejects parent cycles.
-export type NavDefinition = {
-  // Feature author writes the feature-local short id ("catalog"); the
-  // registry overwrites `id` with the qualified name ("shop:nav:catalog")
-  // in its stored copy. Callers of `registry.getNav(qn)` /
-  // `getTopLevelNavs()` / `getNavsByParent(...)` always see the qualified
-  // id — no parallel reverse index needed. `feature.navs[shortId]` on the
-  // unregistered FeatureDefinition keeps the short form.
-  readonly id: string;
-  // i18n translation key. Resolved at render time by the renderer's
-  // useTranslation hook; engine keeps it opaque.
-  readonly label: string;
-  // Icon key — whatever the icon registry of the active renderer understands.
-  // Engine doesn't validate; unknown icons surface as a missing icon on screen,
-  // not a boot failure.
-  readonly icon?: string;
-  // Qualified name of a parent nav entry ("<feature>:nav:<id>"). Omit for
-  // top-level entries. Boot-validator rejects cycles + dangling refs.
-  readonly parent?: string;
-  // Sort weight within the parent's children (lower = earlier). Ties are
-  // broken by registration order — features registered later appear lower.
-  readonly order?: number;
-  // Qualified name of the screen this entry navigates to
-  // ("<feature>:screen:<id>"). Omit for pure grouping entries (a parent-only
-  // nav node that renders a sub-tree but has no target screen itself).
-  readonly screen?: string;
-  // Polymorphes Klick-Ziel (öffnet die EditorPanel-Maske via Target-
-  // Resolver) — Alternative zu `screen`. Ein Knoten trägt screen XOR
-  // target; der Renderer dispatcht das target statt einen Route-Link zu
-  // rendern. Gespiegelt aus dem alten Visual-Tree (TreeNode.target).
-  readonly target?: TargetRef;
-  // Hover-Actions rechts in der Zeile (VS-Code-Pattern) — erst bei Hover
-  // sichtbar. Reihenfolge wie deklariert.
-  readonly actions?: readonly TreeAction[];
-  // „+"-Affordance am Knoten. Klick dispatcht createAction.target; der
-  // Provider weiß was „leer befüllen" für ihn heißt (neuer Page-Slug etc.).
-  readonly createAction?: TreeAction;
-  // Children kommen zur Laufzeit aus einem registrierten nav-provider
-  // (lazy beim Ausklappen, SSE-live via treeEntities), keyed auf diese
-  // Nav-QN. Macht den Knoten expandable auch ohne statische children.
-  readonly provider?: boolean;
-  // Role / openToAll gate. The nav resolver hides entries the user can't
-  // reach; leave unset to always show (engine stays un-opinionated about
-  // who sees what — apps that need default-deny can set { roles: [] }).
-  // If `screen` is set and `access` is left unset, the client-side nav
-  // builder (buildNavRegistrySliceForApp) fills this in from the target
-  // screen's own `access` — a nav entry never invites a role into a 403.
-  // An explicit `access` here always wins over the screen's.
-  readonly access?: AccessRule;
-  // Workspace QNs this entry self-assigns to. Merged at boot with any
-  // r.workspace({ nav: [...] }) explicit lists. Omit to leave workspace
-  // membership decided solely by the workspace's nav list (or both empty
-  // → entry belongs to no workspace).
-  readonly workspaces?: readonly string[];
-};
+// Legacy path — re-exported for callers still importing this module directly.
+export * from "@cosmicdrift/kumiko-types/nav";

package/src/engine/types/ownership.ts

@@ -0,0 +1,2 @@
+// Legacy path — re-exported for callers still importing this module directly.
+export * from "@cosmicdrift/kumiko-types/ownership";