@cosmicdrift/kumiko-framework 0.234.0 → 0.235.1

package/src/engine/boot-validator/entity-list-screens.ts

@@ -1,9 +1,17 @@
+import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta";
 import { normalizeListColumn } from "../screen-helpers";
 import type { EntityListScreenDefinition, FeatureDefinition } from "../types";
 
 /** Operator lists default searchable; low-cardinality audit trails stay opt-out. */
 export const SEARCHABLE_FALSE_WHITELIST = new Set(["download-attempt-list"]);
 
+// Same set computeListViewModel (headless) can actually render — NOT
+// db/table-builder's rowMetaFieldNames(softDelete), which also carries
+// isDeleted/deletedAt/deletedById. Accepting those here would let a
+// softDelete column pass the boot gate and then throw at render-time
+// because the renderer's LIST_ROW_META_COLUMNS doesn't know them.
+const LIST_ROW_META_COLUMN_NAMES = new Set(Object.keys(LIST_ROW_META_COLUMNS));
+
 function hasFilterableFields(feature: FeatureDefinition, entityName: string): boolean {
   const entities = feature.entities;
   if (!entities) return false;
@@ -71,7 +79,11 @@ function validateOneEntityListScreen(
     if (normalized.label === undefined) {
       const entity = feature.entities?.[screen.entity];
       const isDerived = entity?.derivedFields?.[normalized.field] !== undefined;
-      if (!entity?.fields[normalized.field] && !isDerived) {
+      // Row-meta column (id/tenantId/version/insertedAt/modifiedAt/...) is a
+      // real base-table column without being a declared entity field — e.g.
+      // a SystemAdmin cross-tenant list exposing tenantId.
+      const isRowMeta = LIST_ROW_META_COLUMN_NAMES.has(normalized.field);
+      if (!entity?.fields[normalized.field] && !isDerived && !isRowMeta) {
         throw new Error(`${prefix}: unknown column field "${normalized.field}"`);
       }
     }

package/src/engine/boot-validator/i18n-keys.ts

@@ -6,13 +6,15 @@ import {
   requiredKeysFromScreen,
   requiredKeysFromWorkspace,
 } from "../../i18n/required-surface-keys";
-import { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE } from "../build-config-feature-schema";
+import {
+  buildConfigFeatureSchema,
+  type ConfigFeatureSchema,
+  SETTINGS_HUB_FEATURE,
+} from "../build-config-feature-schema";
 import { createRegistry } from "../registry";
 import type { FeatureDefinition } from "../types";
-import type { Registry } from "../types/feature";
 
-function requiredKeysFromGeneratedConfigHub(registry: Registry): readonly string[] {
-  const schema = buildConfigFeatureSchema(registry);
+function requiredKeysFromGeneratedConfigHub(schema: ConfigFeatureSchema): readonly string[] {
   if (schema.navs.length === 0) return [];
   const out = new Set<string>();
 
@@ -33,6 +35,7 @@ function requiredKeysFromGeneratedConfigHub(registry: Registry): readonly string
     for (const key of requiredKeysFromWorkspace(schema.workspace.definition)) out.add(key);
   }
   out.add("config.settings.title");
+  if (schema.screens.some((s) => s.type === "secretsEdit")) out.add("config.secrets.title");
   for (const scope of ["system", "tenant", "user"] as const) {
     out.add(`config.settings.${scope}`);
   }
@@ -62,6 +65,11 @@ function hasDefinedTranslation(defined: Set<string>, key: string): boolean {
 export function validateI18nSurfaceKeys(features: readonly FeatureDefinition[]): void {
   const defined = buildEffectiveTranslationKeys(features);
   const registry = createRegistry(features);
+  const generatedConfigHub = buildConfigFeatureSchema(registry);
+  // The secrets screen's labels/hints come from the `r.secret()` declaration
+  // itself, not from r.translations — without this, every app with a
+  // declared secret would fail boot on its own generated keys.
+  for (const key of Object.keys(generatedConfigHub.translations ?? {})) defined.add(key);
 
   for (const feature of features) {
     if (!featureHasI18nSurface(feature)) continue;
@@ -76,7 +84,7 @@ export function validateI18nSurfaceKeys(features: readonly FeatureDefinition[]):
     }
   }
 
-  for (const key of requiredKeysFromGeneratedConfigHub(registry)) {
+  for (const key of requiredKeysFromGeneratedConfigHub(generatedConfigHub)) {
     if (!hasDefinedTranslation(defined, key)) {
       throw new Error(`[i18n] Settings-Hub: required translation key missing: "${key}"`);
     }

package/src/engine/boot-validator/screens.ts

@@ -6,6 +6,7 @@
 
 import { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
 import { rowMetaFieldNames } from "../../db/table-builder";
+import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta";
 import { isKebabSegment, isValidQn, qualifyEntityName } from "../qualified-name";
 import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops";
 import { isExtensionEditSection, normalizeEditField, normalizeListColumn } from "../screen-helpers";
@@ -26,6 +27,15 @@ import type {
   ToolbarAction,
 } from "../types/screen";
 
+// entityList columns accept exactly the row-meta columns the renderer
+// (computeListViewModel) knows how to type — LIST_ROW_META_COLUMNS, NOT the
+// wider rowMetaFieldNames(softDelete) used below for rowAction payload/visible
+// field refs. Those two checks guard different things: a screen column must
+// be renderable, a payload/visible field reference only needs to exist on the
+// row. Using the wider set here would let a softDelete column like
+// "deletedAt" pass the boot gate and then throw at render-time instead.
+const LIST_ROW_META_COLUMN_NAMES = new Set(Object.keys(LIST_ROW_META_COLUMNS));
+
 // entityList and projectionList both allow a rowAction to double as the
 // row-body click target (rowClick: true, fw#1708/#2164) — at most one per
 // screen, or the renderer can't tell which one should fire.
@@ -991,6 +1001,11 @@ export function validateScreens(
       continue;
     }
 
+    // secretsEdit is generator-only (buildConfigFeatureSchema) — never
+    // authored via r.screen, so feature.screens never actually carries one.
+    // Kept here only so this loop's type narrowing stays exhaustive.
+    if (screen.type === "secretsEdit") continue;
+
     // entityList / entityEdit: entity-refs are feature-local.
     const entityDef = feature.entities?.[screen.entity];
     if (!entityDef) {
@@ -1031,14 +1046,23 @@ export function validateScreens(
       }
       for (const col of screen.columns) {
         const normalized = normalizeListColumn(col);
+        // A row-meta column (id/tenantId/version/insertedAt/modifiedAt/...) is a
+        // real DB column without being a declared entity field — e.g. a
+        // SystemAdmin cross-tenant list exposing tenantId. Accept it like a
+        // regular field name — but only the columns computeListViewModel can
+        // actually render (LIST_ROW_META_COLUMN_NAMES), not the wider
+        // softDelete-aware rowMeta set used below for payload/visible refs.
+        //
         // A virtual presentational column (drawn by a columnRenderer component
         // from the row, e.g. tag chips) needs BOTH a label AND a renderer —
         // renderer is what actually makes it "virtual" (label alone still
         // needs list.ts's virtual-branch to have something to draw; without
         // a renderer the column would render nothing). A column with neither
-        // matching a real field NOR a renderer is a typo worth failing the boot.
+        // matching a real field/row-meta column NOR a renderer is a typo worth
+        // failing the boot.
         if (
           !columnFieldNames.has(normalized.field) &&
+          !LIST_ROW_META_COLUMN_NAMES.has(normalized.field) &&
           !(normalized.label !== undefined && normalized.renderer !== undefined)
         ) {
           throw new Error(

package/src/engine/build-app-schema.ts

@@ -160,12 +160,16 @@ function mergeSettingsHubIntoConfigFeature(
       entities: {},
       screens: generated.screens,
       navs: generated.navs,
+      ...(generated.translations !== undefined && { translations: generated.translations }),
     });
   } else {
     features[features.indexOf(existing)] = {
       ...existing,
       screens: [...existing.screens, ...generated.screens],
       navs: [...(existing.navs ?? []), ...generated.navs],
+      ...(generated.translations !== undefined && {
+        translations: { ...existing.translations, ...generated.translations },
+      }),
     };
   }
 }
@@ -462,6 +466,16 @@ function projectField(fieldDef: FieldDefinition): FieldDefinition {
   if (Array.isArray(def["totals"]) && isJsonSafeValue(def["totals"])) out["totals"] = def["totals"];
   if (isPlainObject(def["totalsMatch"]) && isJsonSafeValue(def["totalsMatch"]))
     out["totalsMatch"] = def["totalsMatch"];
+  // embedded lists: the sub-field map itself — without it the client-side
+  // edit view-model iterates `undefined` and the screen crashes (fw#2507).
+  // Recursive per sub-field, NOT a blanket isJsonSafeValue gate: a single
+  // sub-field carrying a validator fn would otherwise drop the whole map,
+  // and a blanket copy would ship server internals.
+  if (isPlainObject(def["schema"])) {
+    out["schema"] = Object.fromEntries(
+      Object.entries(def["schema"]).map(([k, v]) => [k, projectField(v as FieldDefinition)]), // @cast-boundary schema-walk
+    );
+  }
   return out as FieldDefinition; // @cast-boundary schema-walk
 }
 

package/src/engine/build-config-feature-schema.ts

@@ -24,8 +24,8 @@ import {
   createTextField,
 } from "./factories";
 import { isKebabSegment } from "./qualified-name";
-import type { ConfigKeyDefinition } from "./types/config";
-import type { Registry } from "./types/feature";
+import type { ConfigKeyDefinition, TranslationKeys } from "./types/config";
+import type { Registry, SecretKeyDefinition } from "./types/feature";
 import type { FieldDefinition } from "./types/fields";
 import type { AccessRule } from "./types/handlers";
 import type { NavDefinition, NavIconKey } from "./types/nav";
@@ -33,6 +33,8 @@ import type {
   ConfigEditScreenDefinition,
   EditFieldsSection,
   ScreenDefinition,
+  SecretsEditScreenDefinition,
+  SecretsEditSection,
 } from "./types/screen";
 
 // Namespace, unter dem buildAppSchema die generierten Screens/Navs einhängt
@@ -53,6 +55,9 @@ export type ConfigFeatureSchema = {
   // wenn die App bereits Workspaces nutzt (sonst kippt eine workspace-lose
   // App in den Filter-Modus und verliert alle übrigen Navs).
   readonly workspace?: WorkspaceSchema;
+  // Generated i18n keys for the secrets screen (label/hint text pulled from
+  // the `r.secret()` declaration itself, not authored via r.translations).
+  readonly translations?: TranslationKeys;
 };
 
 // Audience-Reihenfolge im Sidebar: Plattform vor Tenant vor Benutzer.
@@ -105,64 +110,231 @@ type MaskedKey = {
 
 type ScopedKey = { readonly key: MaskedKey; readonly roles: readonly string[] };
 
-export function buildConfigFeatureSchema(registry: Registry): ConfigFeatureSchema {
-  const masked = collectMaskedKeys(registry);
-  if (masked.length === 0) return { screens: [], navs: [] };
+type ScopeResult = {
+  readonly screens: readonly ScreenDefinition[];
+  readonly navs: readonly NavDefinition[];
+  readonly translations?: TranslationKeys;
+};
 
-  // Verbatim (unprefixed) keys as the client sees them — NOT getAllTranslations()
-  // (server-merged, "feature:"-prefixed, see build-app-schema.ts:77-81).
+// Verbatim (unprefixed) keys as the client sees them — NOT getAllTranslations()
+// (server-merged, "feature:"-prefixed, see build-app-schema.ts:77-81).
+function collectDeclaredTranslationKeys(registry: Registry): Set<string> {
   const declaredTranslationKeys = new Set<string>();
   for (const f of registry.features.values()) {
     for (const key of Object.keys(f.translations ?? {})) declaredTranslationKeys.add(key);
   }
+  return declaredTranslationKeys;
+}
+
+// Per-feature configEdit screen + child-nav, one pair per feature present in
+// `visible` at this scope.
+function buildFeatureScreensAndNavs(
+  scope: ConfigScope,
+  visible: readonly ScopedKey[],
+  declaredTranslationKeys: ReadonlySet<string>,
+): { screens: ScreenDefinition[]; navs: NavDefinition[] } {
+  const screens: ScreenDefinition[] = [];
+  const navs: NavDefinition[] = [];
+  for (const feature of featuresPresent(visible.map((v) => v.key))) {
+    const group = visible.filter((v) => v.key.feature === feature);
+    const ordered = sortByMaskOrder(group.map((v) => v.key));
+    const access = rolesToAccess(group.flatMap((v) => v.roles));
+    const shortId = `${feature}-${scope}`;
+
+    screens.push(buildScreen(shortId, scope, feature, ordered, access, declaredTranslationKeys));
+    // A tenant/user-home key with an elevated write role (SystemAdmin on a
+    // tenant key, see ELEVATED_ROLES) surfaces the SAME feature under two
+    // audience navs (cascade-default screen + home screen) — both would
+    // otherwise carry the identical `${feature}.settings` label. Opt-in
+    // scoped override (`${feature}.settings.${scope}`) disambiguates only
+    // where a feature actually declares one; every single-scope feature
+    // keeps the plain key unchanged.
+    const scopedLabel = `${feature}.settings.${scope}`;
+    navs.push({
+      id: shortId,
+      label: declaredTranslationKeys.has(scopedLabel) ? scopedLabel : `${feature}.settings`,
+      parent: audienceNavShortId(scope),
+      screen: shortId,
+      icon: ordered[0]?.def.mask?.icon ?? "settings",
+      order: minMaskOrder(ordered),
+      access,
+    });
+  }
+  return { screens, navs };
+}
+
+// Everything generated for one audience scope: the audience-parent nav, the
+// per-feature configEdit screens+navs, and (tenant-scope only, when secrets
+// are enabled) the secrets screen. Null when nothing is visible at this scope.
+function buildScopeResult(
+  scope: ConfigScope,
+  masked: readonly MaskedKey[],
+  secretsEnabled: boolean,
+  secretsWriteHandler: ReturnType<Registry["getWriteHandler"]>,
+  declaredSecrets: readonly DeclaredSecret[],
+  declaredTranslationKeys: ReadonlySet<string>,
+): ScopeResult | null {
+  const visible = scopedKeysAt(masked, scope);
+  // Secrets attach to the tenant-audience nav regardless of whether any
+  // config key is visible there — they alone must be enough to open it.
+  const includeSecrets = secretsEnabled && scope === "tenant";
+  if (visible.length === 0 && !includeSecrets) return null;
+
+  const configAccess = rolesToAccess(visible.flatMap((v) => v.roles));
+  const secretsAccess = secretsWriteHandler?.access;
+  const screens: ScreenDefinition[] = [];
+  const navs: NavDefinition[] = [];
+  // Audience-Parent: Gruppierungs-Knoten ohne Screen.
+  navs.push({
+    id: audienceNavShortId(scope),
+    label: `config.settings.${scope}`,
+    icon: SCOPE_ICON[scope],
+    order: SCOPE_ORDER[scope],
+    access: includeSecrets ? unionAccessRules([configAccess, secretsAccess]) : configAccess,
+  });
+
+  const perFeature = buildFeatureScreensAndNavs(scope, visible, declaredTranslationKeys);
+  screens.push(...perFeature.screens);
+  navs.push(...perFeature.navs);
+
+  let translations: TranslationKeys | undefined;
+  if (includeSecrets) {
+    const generated = buildSecretsScreen(declaredSecrets, secretsAccess, declaredTranslationKeys);
+    screens.push(generated.screen);
+    navs.push(generated.nav);
+    translations = generated.translations;
+  }
+
+  return { screens, navs, ...(translations !== undefined && { translations }) };
+}
+
+export function buildConfigFeatureSchema(registry: Registry): ConfigFeatureSchema {
+  const masked = collectMaskedKeys(registry);
+  const declaredSecrets = collectDeclaredSecrets(registry);
+  // The `secrets` feature must actually be mounted (its set-handler
+  // registered) for a declared `r.secret()` to have anywhere to write to.
+  const secretsWriteHandler = registry.getWriteHandler("secrets:write:set");
+  const secretsEnabled = secretsWriteHandler !== undefined && declaredSecrets.length > 0;
+  if (masked.length === 0 && !secretsEnabled) return { screens: [], navs: [] };
+
+  const declaredTranslationKeys = collectDeclaredTranslationKeys(registry);
 
   const screens: ScreenDefinition[] = [];
   const navs: NavDefinition[] = [];
+  let translations: TranslationKeys | undefined;
 
   for (const scope of SCOPES_BROAD_TO_DEEP) {
-    const visible = scopedKeysAt(masked, scope);
-    if (visible.length === 0) continue;
+    const result = buildScopeResult(
+      scope,
+      masked,
+      secretsEnabled,
+      secretsWriteHandler,
+      declaredSecrets,
+      declaredTranslationKeys,
+    );
+    if (result === null) continue;
+    screens.push(...result.screens);
+    navs.push(...result.navs);
+    if (result.translations !== undefined) translations = result.translations;
+  }
 
-    // Audience-Parent: Gruppierungs-Knoten ohne Screen.
-    navs.push({
-      id: audienceNavShortId(scope),
-      label: `config.settings.${scope}`,
-      icon: SCOPE_ICON[scope],
-      order: SCOPE_ORDER[scope],
-      access: rolesToAccess(visible.flatMap((v) => v.roles)),
+  // Every masked key machine-only and no secrets → no human hub, and no
+  // (empty) settings switcher.
+  if (navs.length === 0) return { screens, navs };
+  return {
+    screens,
+    navs,
+    workspace: buildSettingsWorkspace(navs),
+    ...(translations !== undefined && { translations }),
+  };
+}
+
+type DeclaredSecret = {
+  readonly qn: string;
+  readonly feature: string;
+  readonly shortKey: string;
+  readonly def: SecretKeyDefinition;
+};
+
+function collectDeclaredSecrets(registry: Registry): DeclaredSecret[] {
+  const out: DeclaredSecret[] = [];
+  for (const [qn, def] of registry.getAllSecretKeys()) {
+    const sep = qn.indexOf(":secret:");
+    if (sep === -1) continue;
+    out.push({
+      qn,
+      feature: qn.slice(0, sep),
+      shortKey: qn.slice(sep + ":secret:".length),
+      def,
     });
+  }
+  return out.sort(
+    (a, b) => a.feature.localeCompare(b.feature) || a.shortKey.localeCompare(b.shortKey),
+  );
+}
+
+// One screen for ALL declared secrets (not one per feature — a per-feature
+// nav would collide with the same feature's configEdit nav under
+// audience-tenant). `access` mirrors the secrets `set`-handler's own access
+// rule verbatim so a screen never permits more than the handler itself does.
+function buildSecretsScreen(
+  secrets: readonly DeclaredSecret[],
+  access: AccessRule | undefined,
+  declaredTranslationKeys: ReadonlySet<string>,
+): { screen: SecretsEditScreenDefinition; nav: NavDefinition; translations: TranslationKeys } {
+  const secretKeys: Record<string, string> = {};
+  const fieldLabels: Record<string, string> = {};
+  const fieldHints: Record<string, string> = {};
+  const requiredFields: string[] = [];
+  // Mutable outer record — TranslationKeys' Readonly<Record<...>> index
+  // signature only permits reading, so the top-level assignments below
+  // need a writable local type; each entry is still a fresh, never-mutated object.
+  const translations: Record<string, Readonly<Record<string, string>>> = {};
+  const sections: SecretsEditSection[] = [];
 
-    for (const feature of featuresPresent(visible.map((v) => v.key))) {
-      const group = visible.filter((v) => v.key.feature === feature);
-      const ordered = sortByMaskOrder(group.map((v) => v.key));
-      const access = rolesToAccess(group.flatMap((v) => v.roles));
-      const shortId = `${feature}-${scope}`;
-
-      screens.push(buildScreen(shortId, scope, feature, ordered, access, declaredTranslationKeys));
-      // A tenant/user-home key with an elevated write role (SystemAdmin on a
-      // tenant key, see ELEVATED_ROLES) surfaces the SAME feature under two
-      // audience navs (cascade-default screen + home screen) — both would
-      // otherwise carry the identical `${feature}.settings` label. Opt-in
-      // scoped override (`${feature}.settings.${scope}`) disambiguates only
-      // where a feature actually declares one; every single-scope feature
-      // keeps the plain key unchanged.
-      const scopedLabel = `${feature}.settings.${scope}`;
-      navs.push({
-        id: shortId,
-        label: declaredTranslationKeys.has(scopedLabel) ? scopedLabel : `${feature}.settings`,
-        parent: audienceNavShortId(scope),
-        screen: shortId,
-        icon: ordered[0]?.def.mask?.icon ?? "settings",
-        order: minMaskOrder(ordered),
-        access,
-      });
+  for (const feature of [...new Set(secrets.map((s) => s.feature))]) {
+    const fieldIds: string[] = [];
+    for (const s of secrets.filter((v) => v.feature === feature)) {
+      const fieldId = `${s.feature}-${s.shortKey}`;
+      fieldIds.push(fieldId);
+      secretKeys[fieldId] = s.qn;
+      const labelKey = `config.secret.${s.feature}.${s.shortKey}.label`;
+      fieldLabels[fieldId] = labelKey;
+      translations[labelKey] = { ...s.def.label };
+      if (s.def.hint !== undefined) {
+        const hintKey = `config.secret.${s.feature}.${s.shortKey}.hint`;
+        fieldHints[fieldId] = hintKey;
+        translations[hintKey] = { ...s.def.hint };
+      }
+      if (s.def.required === true) requiredFields.push(fieldId);
     }
+    const titleKey = `${feature}.settings`;
+    sections.push({
+      ...(declaredTranslationKeys.has(titleKey) && { title: titleKey }),
+      fields: fieldIds,
+    });
   }
 
-  // Alle masked Keys maschinen-only → kein menschlicher Hub, kein (leerer)
-  // Settings-Switcher.
-  if (navs.length === 0) return { screens, navs };
-  return { screens, navs, workspace: buildSettingsWorkspace(navs) };
+  const screen: SecretsEditScreenDefinition = {
+    id: "secrets",
+    type: "secretsEdit",
+    secretKeys,
+    fieldLabels,
+    ...(Object.keys(fieldHints).length > 0 && { fieldHints }),
+    ...(requiredFields.length > 0 && { requiredFields }),
+    sections,
+    ...(access !== undefined && { access }),
+  };
+  const nav: NavDefinition = {
+    id: "secrets",
+    label: "config.secrets.title",
+    parent: audienceNavShortId("tenant"),
+    screen: "secrets",
+    icon: "key",
+    order: 900,
+    ...(access !== undefined && { access }),
+  };
+  return { screen, nav, translations };
 }
 
 // Keys visible at `scope`, paired with their effective write roles AT that

package/src/engine/index.ts

@@ -440,6 +440,8 @@ export type {
   ScreenNavSugar,
   ScreenSlots,
   SecretKeyHandle,
+  SecretsEditScreenDefinition,
+  SecretsEditSection,
   SelectFieldDef,
   SessionUser,
   StreamHandlerDef,

package/src/engine/registry-validate.ts

@@ -587,6 +587,22 @@ export function validateJobTriggers(state: RegistryState): void {
   }
 }
 
+export function validateBootGates(state: RegistryState): void {
+  // Boot gates run inline in JobRunner.start(), which has neither the
+  // per-tenant fan-out (that re-enqueues) nor the sequential lock's
+  // re-enqueue-and-return path. Both would make the gate pass silently
+  // without ever running the handler.
+  for (const [jobName, jobDef] of state.jobMap) {
+    if (!jobDef.bootGate) continue;
+    if (jobDef.perTenant) {
+      throw new Error(`Job "${jobName}" cannot combine bootGate with perTenant`);
+    }
+    if (jobDef.concurrency === "sequential") {
+      throw new Error(`Job "${jobName}" cannot combine bootGate with concurrency "sequential"`);
+    }
+  }
+}
+
 export function validateExtensionUsageTargets(state: RegistryState): void {
   // Validate: extension usages must reference existing extensions
   for (const usage of state.extensionUsages) {

package/src/engine/registry.ts

@@ -27,6 +27,7 @@ import {
   populateHandlerEntityMappings,
   publishEventPiiCatalog,
   resolveNotificationTriggersAndRegisterHooks,
+  validateBootGates,
   validateEntityHookTargets,
   validateEventMigrationVersions,
   validateExtensionSelectors,
@@ -79,6 +80,7 @@ export function createRegistry(features: readonly FeatureDefinition[]): Registry
   validateLifecycleHookTargets(state);
   validateEntityHookTargets(state, features);
   validateJobTriggers(state);
+  validateBootGates(state);
   validateExtensionUsageTargets(state);
   computeHasRateLimitedHandler(state);
   publishEventPiiCatalog(state);

package/src/engine/types/index.ts

@@ -297,6 +297,8 @@ export type {
   ScreenFilterOp,
   ScreenNavSugar,
   ScreenSlots,
+  SecretsEditScreenDefinition,
+  SecretsEditSection,
   ToolbarAction,
   UnitKey,
 } from "@cosmicdrift/kumiko-types/screen";

package/src/i18n/index.ts

@@ -13,6 +13,7 @@ export {
   pickAcceptLanguage,
   resolveHeaderLocale,
 } from "./request-locale";
+export { SETTINGS_HUB_I18N } from "./settings-hub-keys";
 
 export type I18nOptions = {
   defaultLocale: string;

package/src/i18n/required-surface-keys.ts

@@ -13,6 +13,7 @@ import type {
   ProjectionListScreenDefinition,
   RowAction,
   ScreenDefinition,
+  SecretsEditScreenDefinition,
   ToolbarAction,
   WorkspaceDefinition,
 } from "../engine/types";
@@ -223,6 +224,16 @@ export function requiredKeysFromScreen(
       }
       break;
     }
+    case "secretsEdit": {
+      const secretsEdit = screen as SecretsEditScreenDefinition;
+      for (const key of Object.values(secretsEdit.fieldLabels))
+        pushKey(out, key, treatDotFormAsKey);
+      for (const key of Object.values(secretsEdit.fieldHints ?? {})) {
+        pushKey(out, key, treatDotFormAsKey);
+      }
+      for (const section of secretsEdit.sections) pushKey(out, section.title, treatDotFormAsKey);
+      break;
+    }
     case "projectionDetail": {
       const detail = screen as ProjectionDetailScreenDefinition;
       for (const section of detail.layout.sections) {

package/src/i18n/settings-hub-keys.ts

@@ -0,0 +1,28 @@
+import type { TranslationKeys } from "../engine/types/config";
+
+/**
+ * Settings-Hub chrome keys (parent-nav labels, secrets-screen title/strings)
+ * needed by ANY app that mounts a foundation feature producing a hub nav —
+ * `secrets` is auto-mounted (see FOUNDATION_FEATURES in
+ * @cosmicdrift/kumiko-dev-server scaffold-app.ts) while `config` stays
+ * optional, so these keys must be shippable without `config` present.
+ * Both `config` and `secrets` ship this bundle via r.translations — see
+ * @cosmicdrift/kumiko-bundled-features config/i18n.ts (CONFIG_FEATURE_I18N)
+ * and secrets/feature.ts. Owned here (not in bundled-features) because the
+ * Settings-Hub generator that requires these keys
+ * (build-config-feature-schema.ts) lives in this package.
+ */
+export const SETTINGS_HUB_I18N: TranslationKeys = {
+  "config.settings.title": { en: "Settings" },
+  "config.settings.system": { en: "Platform" },
+  "config.settings.tenant": { en: "Tenant" },
+  "config.settings.user": { en: "Personal" },
+  "config.secrets.title": { en: "Secrets" },
+  "config.secrets.notSet": { en: "Not set" },
+  "config.secrets.set": { en: "Set" },
+  "config.secrets.required": { en: "Required" },
+  "config.secrets.placeholder": { en: "Enter a value" },
+  "config.secrets.replacePlaceholder": { en: "Enter a new value to replace" },
+  "config.secrets.delete": { en: "Delete" },
+  "screen:secrets.title": { en: "Secrets" },
+};