@cosmicdrift/kumiko-framework 0.261.0 → 0.263.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.261.0",
+  "version": "0.263.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.261.0",
+    "@cosmicdrift/kumiko-types": "0.263.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.261.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.263.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,30 @@
 [
+  {
+    "version": "0.263.0",
+    "type": "breaking",
+    "title": "Forms are prefilled from URL query parameters only for fields a declarative `navigate` action declares as `params` (fw#2852).",
+    "detail": "`buildAppSchema` now derives `urlPrefillFields` per actionForm/secretMint/entityEdit-create screen from every navigate `params` that targets it — entityList/projectionList rowActions, projectionDetail/entityEdit actions, relatedList rowActions, and projectionDetail metrics; a form nothing targets takes nothing from the URL. Previously any query parameter matching a field name was taken, so a crafted link could seed e.g. an IBAN or e-mail field. Declared params keep working. `sensitive` and `format: \"password\"` fields are still never prefilled — not from the URL, an allowlist, or a handoff.",
+    "migration": "Code that prefills a form via `nav.navigate` + `nav.setSearchParams` without a declared `params` (known: publicstatus `custom-field-list`, phronexsis `driver-map-node-panel`, kumiko-enterprise ai-agent `openForm` client tool / `agentPrefill=1`) must switch to a declared `navigate` action with `params`, or — for programmatic prefill — to `useNavigateWithInitialValues()` from `@cosmicdrift/kumiko-renderer`. No codemod."
+  },
+  {
+    "version": "0.263.0",
+    "type": "improvement",
+    "title": "New `useNavigateWithInitialValues()` hands a form screen initial values in memory instead of the query string (fw#2852).",
+    "detail": "`useNavigateWithInitialValues()`, exported from `@cosmicdrift/kumiko-renderer`, returns `(target: ScreenTarget, initialValues: Readonly<Record<string, unknown>>) => void`, which navigates to a form screen and carries the initial values in memory rather than as URL search params — for programmatic prefill outside a declared `navigate` `params` action. `sensitive` and `format: \"password\"` fields are still never prefilled, same as URL and allowlist prefill."
+  },
+  {
+    "version": "0.263.0",
+    "type": "fix",
+    "title": "`projectField`/`projectEntity` now forward field metadata the client schema previously dropped (fw#2852).",
+    "detail": "`projectField`/`projectEntity` (`packages/framework/src/engine/build-app-schema.ts`) now forward number `unit`, entity `defaultCurrency`, text `format`, timestamp `locatedBy`, file/image `accept`/`maxSize`/`variants`, decimal `scale` (incl. embedded sub-fields), and `sensitive` into the client schema; previously they were lost on the way, so the unit suffix did not render, money fields fell back to \"EUR\", password masking and the never-prefill-sensitive rule were inactive client-side."
+  },
+  {
+    "version": "0.262.0",
+    "type": "improvement",
+    "title": "Boot validator warns when NODE_ENV=production boots without the security baseline (fw#2857).",
+    "detail": "`SECURITY_BASELINE_FEATURE_NAMES` (`@cosmicdrift/kumiko-framework/engine`) names the four security-relevant feature names the boot validator expects in a production app: `sessions`, `crypto-shredding`, `rate-limiting`, `audit`. `validateBoot` now calls `warnOnMissingSecurityBaseline(features)` (`engine/boot-validator/security-baseline.ts`) after every other check; when `process.env.NODE_ENV === \"production\"` and one or more of those feature names is absent from the mounted feature list (matched by exact `FeatureDefinition.name`, not by require-chain inference), it logs one `console.warn` naming the missing feature(s) and pointing at `securityBaselineFeatures()`. It never throws and is a no-op for any other `NODE_ENV` value (including `undefined`). Mount `securityBaselineFeatures()` from `@cosmicdrift/kumiko-bundled-features/presets` to silence it.",
+    "migration": "No action required for existing apps outside production. Apps that boot with `NODE_ENV=production` and don't already mount `sessions`/`crypto-shredding`/`rate-limiting`/`audit` will see a new boot-time `console.warn` — mount the missing feature(s) individually or via `securityBaselineFeatures()` to remove it."
+  },
   {
     "version": "0.261.0",
     "type": "breaking",

package/src/engine/__tests__/build-app-schema-url-prefill.test.ts

@@ -0,0 +1,153 @@
+import { describe, expect, test } from "bun:test";
+import { buildAppSchema } from "../build-app-schema";
+import { defineFeature } from "../define-feature";
+import { createRegistry } from "../registry";
+import type { EntityDefinition } from "../types/fields";
+import type { ScreenDefinition } from "../types/screen";
+
+const leaseEntity = {
+  fields: { name: { type: "text" }, iban: { type: "text" } },
+} as unknown as EntityDefinition;
+const itemEntity = {
+  fields: { leaseId: { type: "text" }, note: { type: "text" } },
+} as unknown as EntityDefinition;
+
+const leasesFeature = defineFeature("leases", (r) => {
+  r.entity("lease", leaseEntity);
+  r.entity("item", itemEntity);
+  r.screen({
+    id: "lease-list",
+    type: "entityList",
+    entity: "lease",
+    columns: ["name"],
+    rowActions: [
+      {
+        kind: "navigate",
+        id: "add-item",
+        label: "add",
+        screen: "item-create",
+        params: { map: { leaseId: "id" } },
+      },
+      {
+        kind: "navigate",
+        id: "pay",
+        label: "pay",
+        screen: "record-payment",
+        params: { pick: ["name"] },
+      },
+      {
+        kind: "navigate",
+        id: "edit",
+        label: "edit",
+        screen: "lease-edit",
+        params: { pick: ["iban"] },
+      },
+      {
+        kind: "drawer",
+        id: "note",
+        label: "note",
+        screen: "drawer-only-form",
+        params: { pick: ["note"] },
+      },
+    ],
+  });
+  r.screen({
+    id: "lease-edit",
+    type: "entityEdit",
+    entity: "lease",
+    layout: { sections: [{ title: "x", fields: ["name", "iban"] }] },
+    actions: [
+      {
+        kind: "navigate",
+        id: "pay-party",
+        label: "pay",
+        screen: "record-payment",
+        params: { map: { partyId: "id" } },
+      },
+    ],
+  });
+  r.screen({
+    id: "lease-detail",
+    type: "projectionDetail",
+    query: "leases:query:lease:detail",
+    layout: { sections: [] },
+    metrics: [
+      {
+        field: "openItems",
+        label: "items",
+        navigate: { screen: "item-create", params: { map: { note: "summary" } } },
+      },
+    ],
+  });
+  r.screen({
+    id: "item-create",
+    type: "entityEdit",
+    entity: "item",
+    layout: { sections: [{ title: "x", fields: ["leaseId", "note"] }] },
+  });
+  r.screen({
+    id: "record-payment",
+    type: "actionForm",
+    handler: "leases:write:payment:record",
+    fields: { name: { type: "text" }, partyId: { type: "text" }, iban: { type: "text" } },
+    layout: { sections: [{ title: "x", fields: ["name", "partyId", "iban"] }] },
+    urlPrefillFields: ["iban"],
+  } as ScreenDefinition);
+  r.screen({
+    id: "drawer-only-form",
+    type: "actionForm",
+    handler: "leases:write:item:note",
+    fields: { note: { type: "text" } },
+    layout: { sections: [{ title: "x", fields: ["note"] }] },
+  });
+});
+
+const billingFeature = defineFeature("billing", (r) => {
+  r.entity("invoice", { fields: { payee: { type: "text" } } } as unknown as EntityDefinition);
+  r.screen({
+    id: "invoice-list",
+    type: "entityList",
+    entity: "invoice",
+    columns: ["payee"],
+    rowActions: [
+      {
+        kind: "navigate",
+        id: "pay",
+        label: "pay",
+        screen: "record-payment",
+        params: { map: { name: "payee" } },
+      },
+    ],
+  });
+});
+
+function urlPrefillFieldsOf(featureName: string, screenId: string): unknown {
+  const app = buildAppSchema(createRegistry([leasesFeature, billingFeature]));
+  const screen = app.features
+    .find((f) => f.featureName === featureName)
+    ?.screens.find((s) => s.id.endsWith(`:${screenId}`) || s.id === screenId);
+  if (screen === undefined) throw new Error(`screen ${featureName}/${screenId} not projected`);
+  return "urlPrefillFields" in screen ? screen.urlPrefillFields : undefined;
+}
+
+describe("buildAppSchema — urlPrefillFields derived from navigate params", () => {
+  test("a cross-entity entityEdit-create target gets exactly the declared params keys", () => {
+    expect(urlPrefillFieldsOf("leases", "item-create")).toEqual(["leaseId", "note"]);
+  });
+
+  test("keys from several sources and features are unioned; an authored value is overwritten", () => {
+    expect(urlPrefillFieldsOf("leases", "record-payment")).toEqual(["name", "partyId"]);
+  });
+
+  test("a form no navigate params targets gets an empty list — drawer params do not count", () => {
+    expect(urlPrefillFieldsOf("leases", "drawer-only-form")).toEqual([]);
+  });
+
+  test("a same-entity entityEdit target opens in update mode and gets no URL prefill", () => {
+    expect(urlPrefillFieldsOf("leases", "lease-edit")).toEqual([]);
+  });
+
+  test("non-form screens carry no urlPrefillFields", () => {
+    expect(urlPrefillFieldsOf("leases", "lease-list")).toBeUndefined();
+  });
+});

package/src/engine/__tests__/build-app-schema.test.ts

@@ -420,10 +420,10 @@ describe("buildAppSchema", () => {
       "default", // array-valued for multiSelect — projectField's
       // isJsonSafeValue() (fw#2497) now recurses into arrays/plain
       // objects instead of only string/number/boolean/null.
+      "sensitive", // write-response redaction server-side AND the renderer's prefill block
     ] as const;
 
     const SERVER_ONLY_KEYS = [
-      "sensitive", // controls write-response redaction, never rendered
       "access", // server-side authz check, not a renderer concern
       "pii", // PII classification, drives crypto/storage — not client-relevant
       "userOwned", // same: subject-key annotation, server/crypto-only
@@ -582,6 +582,95 @@ describe("buildAppSchema", () => {
     expect(fields["avatar"]?.["capture"]).toBeUndefined();
   });
 
+  test("number unit (static and sibling-field form) and entity defaultCurrency survive the projection", () => {
+    // Regression: the edit view-model reads `unit` and `entity.defaultCurrency`,
+    // but the client schema never carried them — the suffix never rendered and
+    // money fields always fell back to "EUR".
+    const entity = {
+      defaultCurrency: "USD",
+      fields: {
+        distance: { type: "number", unit: "mi" },
+        mileage: { type: "number", unit: { field: "mileageUnit" } },
+        mileageUnit: { type: "text" },
+        count: { type: "number" },
+        bogus: { type: "number", unit: { field: () => "km" } },
+      },
+    } as unknown as EntityDefinition;
+
+    const f = defineFeature("ent", (r) => {
+      r.entity("thing", entity);
+    });
+    const app = buildAppSchema(createRegistry([f]));
+    const projected = app.features[0]!.entities["thing"] as unknown as {
+      defaultCurrency?: string;
+      fields: Record<string, Record<string, unknown>>;
+    };
+
+    expect(projected.defaultCurrency).toBe("USD");
+    expect(projected.fields["distance"]?.["unit"]).toBe("mi");
+    expect(projected.fields["mileage"]?.["unit"]).toEqual({ field: "mileageUnit" });
+    expect(projected.fields["count"]?.["unit"]).toBeUndefined();
+    expect(projected.fields["bogus"]?.["unit"]).toBeUndefined();
+    expect(JSON.parse(JSON.stringify(projected))).toEqual(projected);
+  });
+
+  test("entity without defaultCurrency omits the key", () => {
+    const f = defineFeature("ent", (r) => {
+      r.entity("thing", { fields: { label: { type: "text" } } } as unknown as EntityDefinition);
+    });
+    const app = buildAppSchema(createRegistry([f]));
+    expect("defaultCurrency" in app.features[0]!.entities["thing"]!).toBe(false);
+  });
+
+  test("text format, timestamp locatedBy, file accept/maxSize, image variants and decimal scale survive the projection", () => {
+    // Regression: all of these are read by the edit view-model (password
+    // masking, wall-clock input, upload constraints, preview variant, derived
+    // embedded-cell rounding) but were missing from the client schema.
+    const entity = {
+      fields: {
+        secret: { type: "text", format: "password" },
+        pickupAt: { type: "timestamp", locatedBy: "pickupTz" },
+        pickupTz: { type: "tz" },
+        contract: { type: "file", accept: ["application/pdf"], maxSize: "5mb" },
+        photo: {
+          type: "image",
+          accept: ["image/*"],
+          maxSize: "10mb",
+          variants: { thumb: { fit: "cover", size: { width: 120, height: 120 } } },
+        },
+        positions: {
+          type: "embedded",
+          multiple: true,
+          schema: { price: { type: "decimal", scale: 2 } },
+        },
+      },
+    } as unknown as EntityDefinition;
+
+    const f = defineFeature("ent", (r) => {
+      r.entity("thing", entity);
+    });
+    const app = buildAppSchema(createRegistry([f]));
+    const fields = (
+      app.features[0]!.entities["thing"] as unknown as {
+        fields: Record<string, Record<string, unknown>>;
+      }
+    ).fields;
+
+    expect(fields["secret"]?.["format"]).toBe("password");
+    expect(fields["pickupAt"]?.["locatedBy"]).toBe("pickupTz");
+    expect(fields["contract"]?.["accept"]).toEqual(["application/pdf"]);
+    expect(fields["contract"]?.["maxSize"]).toBe("5mb");
+    expect(fields["photo"]?.["accept"]).toEqual(["image/*"]);
+    expect(fields["photo"]?.["variants"]).toEqual({
+      thumb: { fit: "cover", size: { width: 120, height: 120 } },
+    });
+    const positionsSchema = fields["positions"]?.["schema"] as Record<
+      string,
+      Record<string, unknown>
+    >;
+    expect(positionsSchema["price"]?.["scale"]).toBe(2);
+  });
+
   test("embedded: minItems/maxItems/derived/totals/totalsMatch überleben die Projection (fw#2497)", () => {
     // Regression: `totals` carries "Renderer metadata: numeric sub-field
     // names to sum in a totals row" in its own doc-comment but was never

package/src/engine/boot-validator/__tests__/security-baseline.test.ts

@@ -0,0 +1,107 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { defineFeature } from "../../define-feature";
+import type { FeatureDefinition } from "../../types";
+import { validateBoot } from "../index";
+import {
+  SECURITY_BASELINE_FEATURE_NAMES,
+  warnOnMissingSecurityBaseline,
+} from "../security-baseline";
+
+function stubFeature(name: string): FeatureDefinition {
+  return defineFeature(name, () => {});
+}
+
+describe("warnOnMissingSecurityBaseline", () => {
+  let warnSpy: ReturnType<typeof spyOn<Console, "warn">>;
+
+  beforeEach(() => {
+    warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  test("production + no baseline features → warns once, naming all four", () => {
+    warnOnMissingSecurityBaseline([], "production");
+
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const msg = String(warnSpy.mock.calls[0]?.[0]);
+    for (const name of SECURITY_BASELINE_FEATURE_NAMES) {
+      expect(msg).toContain(name);
+    }
+  });
+
+  test("production + only sessions/audit mounted → warns about the missing two only", () => {
+    const features = [stubFeature("sessions"), stubFeature("audit")];
+
+    warnOnMissingSecurityBaseline(features, "production");
+
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const msg = String(warnSpy.mock.calls[0]?.[0]);
+    expect(msg).toContain("crypto-shredding");
+    expect(msg).toContain("rate-limiting");
+    expect(msg).not.toContain("missing feature(s): sessions");
+  });
+
+  test("production + all four baseline features mounted → no warning", () => {
+    const features = SECURITY_BASELINE_FEATURE_NAMES.map((name) => stubFeature(name));
+
+    warnOnMissingSecurityBaseline(features, "production");
+
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+
+  test.each(["development", "test", undefined])(
+    "nodeEnv=%p + no baseline features → no warning",
+    (nodeEnv) => {
+      warnOnMissingSecurityBaseline([], nodeEnv);
+
+      expect(warnSpy).not.toHaveBeenCalled();
+    },
+  );
+
+  test("never throws, regardless of nodeEnv or mounted features", () => {
+    expect(() => warnOnMissingSecurityBaseline([], "production")).not.toThrow();
+    expect(() => warnOnMissingSecurityBaseline([], "development")).not.toThrow();
+    expect(() =>
+      warnOnMissingSecurityBaseline(
+        SECURITY_BASELINE_FEATURE_NAMES.map((name) => stubFeature(name)),
+        "production",
+      ),
+    ).not.toThrow();
+  });
+});
+
+describe("validateBoot + security baseline warning", () => {
+  const originalNodeEnv = process.env["NODE_ENV"];
+  let warnSpy: ReturnType<typeof spyOn<Console, "warn">>;
+
+  beforeEach(() => {
+    warnSpy = spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+    if (originalNodeEnv === undefined) {
+      delete process.env["NODE_ENV"];
+    } else {
+      process.env["NODE_ENV"] = originalNodeEnv;
+    }
+  });
+
+  test("production boot with all four baseline stubs mounted does not throw and does not warn", () => {
+    process.env["NODE_ENV"] = "production";
+    const features = SECURITY_BASELINE_FEATURE_NAMES.map((name) => stubFeature(name));
+
+    expect(() => validateBoot(features)).not.toThrow();
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+
+  test("production boot with no baseline features mounted warns but does not throw", () => {
+    process.env["NODE_ENV"] = "production";
+
+    expect(() => validateBoot([])).not.toThrow();
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+  });
+});

package/src/engine/boot-validator/index.ts

@@ -61,6 +61,7 @@ import {
   validateScreenShortIdCollisions,
   validateScreens,
 } from "./screens";
+import { warnOnMissingSecurityBaseline } from "./security-baseline";
 import {
   collectWorkspaceQns,
   validateDefaultWorkspaceUniqueness,
@@ -72,6 +73,7 @@ export { validateAppCustomScreenWriteQns } from "./custom-screen-write-qns";
 // an den Codegen zu übergeben. Nicht Teil von validateBoot, aber
 // dieselbe Extraktionslogik.
 export { collectWriteHandlerQns } from "./nav";
+export { SECURITY_BASELINE_FEATURE_NAMES } from "./security-baseline";
 
 export type ValidateBootOptions = {
   /** Warn when an access role is used by exactly one handler/config-key/
@@ -254,6 +256,7 @@ export function validateBoot(
 
   validateConfigReads(features, allConfigKeys);
   warnOnToggleableDependencies(features, featureMap);
+  warnOnMissingSecurityBaseline(features);
   if (options?.warnOnUniqueAccessRoles === true) {
     warnOnUniqueAccessRoles(features);
   }

package/src/engine/boot-validator/screens.ts

@@ -101,6 +101,23 @@ function validateNoWidgetRequiredField(
   );
 }
 
+export function rowFieldExtractorKeys(params: RowFieldExtractor): readonly string[] {
+  return "pick" in params ? params.pick : Object.keys(params.map);
+}
+
+// Mirrors the renderer's navigate: an explicit entityId, or a same-entity
+// entityEdit target (row["id"] auto-fill), opens UPDATE mode, which ignores params.
+export function readsNavigateParamsAsFormPrefill(
+  target: ScreenDefinition,
+  explicitEntityId: string | undefined,
+  sourceScreenEntity: string | undefined,
+): boolean {
+  if (target.type === "actionForm" || target.type === "secretMint") return true;
+  if (target.type !== "entityEdit") return false;
+  if (explicitEntityId !== undefined) return false;
+  return sourceScreenEntity === undefined || target.entity !== sourceScreenEntity;
+}
+
 // Tier 2.7e navigate rowAction → target-screen params validity. Shared by
 // entityList and projectionList (framework#1708) — projectionList has no
 // `screen.entity`, so there's no same-entity row["id"] auto-fill case: any
@@ -142,8 +159,7 @@ function validateRowActionNavigateParams(
           `target dashboard so it has somewhere to read the value from.`,
       );
     }
-    const extractedKeys =
-      "pick" in action.params ? action.params.pick : Object.keys(action.params.map);
+    const extractedKeys = rowFieldExtractorKeys(action.params);
     if (!extractedKeys.includes(filter.id)) {
       throw new Error(
         `[Feature ${featureName}] Screen "${screenId}" (${screenType}) rowAction "${action.id}" sets ` +
@@ -156,16 +172,8 @@ function validateRowActionNavigateParams(
     return;
   }
 
-  const isEntityEditUpdate =
-    target.screen.type === "entityEdit" &&
-    (action.entityId !== undefined ||
-      (screenEntity !== undefined && target.screen.entity === screenEntity));
-  if (
-    (target.screen.type !== "actionForm" &&
-      target.screen.type !== "secretMint" &&
-      target.screen.type !== "entityEdit") ||
-    isEntityEditUpdate
-  ) {
+  if (!readsNavigateParamsAsFormPrefill(target.screen, action.entityId, screenEntity)) {
+    const isEntityEditUpdate = target.screen.type === "entityEdit";
     const reason = isEntityEditUpdate
       ? `resolves to UPDATE mode (${
           action.entityId !== undefined
@@ -417,9 +425,7 @@ function validateDrawerTargetAction(
   // the typo would only show up as an empty field at click time.
   // skip: no params extractor — nothing to check against the target's fields.
   if (action.params === undefined) return;
-  const prefilledFields =
-    "pick" in action.params ? action.params.pick : Object.keys(action.params.map);
-  for (const fieldName of prefilledFields) {
+  for (const fieldName of rowFieldExtractorKeys(action.params)) {
     if (Object.hasOwn(target.fields, fieldName)) continue;
     throw new Error(
       `[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +

package/src/engine/boot-validator/security-baseline.ts

@@ -0,0 +1,26 @@
+import type { FeatureDefinition } from "../types";
+
+export const SECURITY_BASELINE_FEATURE_NAMES = [
+  "sessions",
+  "crypto-shredding",
+  "rate-limiting",
+  "audit",
+] as const;
+
+export function warnOnMissingSecurityBaseline(
+  features: readonly FeatureDefinition[],
+  nodeEnv: string | undefined = process.env["NODE_ENV"],
+): void {
+  // skip: baseline is only enforced for production boots
+  if (nodeEnv !== "production") return;
+
+  const mountedNames = new Set(features.map((f) => f.name));
+  const missing = SECURITY_BASELINE_FEATURE_NAMES.filter((name) => !mountedNames.has(name));
+  // skip: every baseline feature is mounted
+  if (missing.length === 0) return;
+
+  // biome-ignore lint/suspicious/noConsole: boot-time hint, no logger available yet
+  console.warn(
+    `[kumiko:boot] NODE_ENV=production but the security baseline is incomplete — missing feature(s): ${missing.join(", ")}. Mount securityBaselineFeatures() from @cosmicdrift/kumiko-bundled-features/presets (or the missing features individually).`,
+  );
+}

package/src/engine/boot-validator/url-prefill-fields.ts

@@ -0,0 +1,159 @@
+import { qualifyEntityName } from "../qualified-name";
+import type { FeatureDefinition } from "../types";
+import type {
+  ProjectionDetailScreenDefinition,
+  RowFieldExtractor,
+  ScreenDefinition,
+} from "../types/screen";
+import {
+  collectScreensByShortId,
+  readsNavigateParamsAsFormPrefill,
+  rowFieldExtractorKeys,
+} from "./screens";
+
+type NavigateParamsSource = {
+  readonly screen?: string;
+  readonly entity?: string;
+  readonly entityId?: string;
+  readonly params: RowFieldExtractor;
+  readonly sourceScreenEntity: string | undefined;
+};
+
+type NavigateActionLike = {
+  readonly kind?: string;
+  readonly screen?: string;
+  readonly entity?: string;
+  readonly entityId?: string;
+  readonly params?: RowFieldExtractor;
+};
+type NavigateActionWithParams = NavigateActionLike & { readonly params: RowFieldExtractor };
+type ScopedNavigateAction = {
+  readonly action: NavigateActionLike;
+  readonly sourceScreenEntity: string | undefined;
+};
+
+function isNavigateKind(action: NavigateActionLike): boolean {
+  return action.kind === undefined || action.kind === "navigate";
+}
+function isNavigateWithParams(action: NavigateActionLike): action is NavigateActionWithParams {
+  return isNavigateKind(action) && action.params !== undefined;
+}
+function scopeActions(
+  actions: readonly NavigateActionLike[] | undefined,
+  sourceScreenEntity: string | undefined,
+): ScopedNavigateAction[] {
+  return (actions ?? []).map((action) => ({ action, sourceScreenEntity }));
+}
+function projectionDetailNavigateActions(
+  screen: ProjectionDetailScreenDefinition,
+): ScopedNavigateAction[] {
+  return [
+    ...scopeActions(screen.actions, screen.detailFor),
+    ...screen.layout.sections.flatMap((section) =>
+      section.kind === "relatedList" ? scopeActions(section.rowActions, undefined) : [],
+    ),
+    ...(screen.metrics ?? []).flatMap((metric) =>
+      typeof metric === "string" || metric.navigate === undefined
+        ? []
+        : scopeActions([metric.navigate], undefined),
+    ),
+  ];
+}
+function navigateActionsOf(screen: ScreenDefinition): ScopedNavigateAction[] {
+  switch (screen.type) {
+    case "entityList":
+      return scopeActions(screen.rowActions, screen.entity);
+    case "projectionList":
+      return scopeActions(screen.rowActions, undefined);
+    case "entityEdit":
+      return scopeActions(screen.actions, screen.entity);
+    case "projectionDetail":
+      return projectionDetailNavigateActions(screen);
+    default:
+      return [];
+  }
+}
+function toNavigateParamsSource(
+  action: NavigateActionWithParams,
+  sourceScreenEntity: string | undefined,
+): NavigateParamsSource {
+  return {
+    ...(action.screen !== undefined && { screen: action.screen }),
+    ...(action.entity !== undefined && { entity: action.entity }),
+    ...(action.entityId !== undefined && { entityId: action.entityId }),
+    params: action.params,
+    sourceScreenEntity,
+  };
+}
+
+// Every declarative navigate that writes `params` into the target's URL —
+// the same sources validateScreens pairs with validateRowActionNavigateParams,
+// plus projectionDetail metrics (runMetricNavigate), which reuse that shape.
+function navigateParamsSources(screen: ScreenDefinition): NavigateParamsSource[] {
+  return navigateActionsOf(screen).flatMap(({ action, sourceScreenEntity }) =>
+    isNavigateWithParams(action) ? [toNavigateParamsSource(action, sourceScreenEntity)] : [],
+  );
+}
+
+// Per target screen QN, the union of field names any navigate `params` may
+// prefill from the URL. A form screen absent from the map accepts no URL prefill.
+export function collectUrlPrefillFieldsByScreenQn(
+  features: readonly FeatureDefinition[],
+): Map<string, Set<string>> {
+  const screensByShortId = collectScreensByShortId(features);
+  const detailForByEntity = new Map<
+    string,
+    { readonly featureName: string; readonly shortId: string; readonly screen: ScreenDefinition }
+  >();
+  for (const feature of features) {
+    for (const [shortId, screen] of Object.entries(feature.screens)) {
+      if (screen.detailFor !== undefined && !detailForByEntity.has(screen.detailFor)) {
+        detailForByEntity.set(screen.detailFor, { featureName: feature.name, shortId, screen });
+      }
+    }
+  }
+
+  const result = new Map<string, Set<string>>();
+  for (const feature of features) {
+    for (const screen of Object.values(feature.screens)) {
+      for (const source of navigateParamsSources(screen)) {
+        const target = resolveTarget(source, screensByShortId, detailForByEntity);
+        if (target === undefined) continue;
+        const explicitEntityId =
+          source.entity !== undefined ? (source.entityId ?? "id") : source.entityId;
+        if (
+          !readsNavigateParamsAsFormPrefill(
+            target.screen,
+            explicitEntityId,
+            source.sourceScreenEntity,
+          )
+        ) {
+          continue;
+        }
+        const qn = qualifyEntityName(target.featureName, "screen", target.shortId);
+        const fields = result.get(qn) ?? new Set<string>();
+        for (const key of rowFieldExtractorKeys(source.params)) fields.add(key);
+        result.set(qn, fields);
+      }
+    }
+  }
+  return result;
+}
+
+// Runtime resolution: a bare screen id matches the first feature registering
+// it (create-app's router); an entity target opens its detailFor screen with an id.
+function resolveTarget(
+  source: NavigateParamsSource,
+  screensByShortId: ReturnType<typeof collectScreensByShortId>,
+  detailForByEntity: ReadonlyMap<
+    string,
+    { readonly featureName: string; readonly shortId: string; readonly screen: ScreenDefinition }
+  >,
+):
+  | { readonly featureName: string; readonly shortId: string; readonly screen: ScreenDefinition }
+  | undefined {
+  if (source.entity !== undefined) return detailForByEntity.get(source.entity);
+  if (source.screen === undefined) return undefined;
+  const match = screensByShortId.get(source.screen)?.[0];
+  return match === undefined ? undefined : { ...match, shortId: source.screen };
+}

package/src/engine/boot-validator.ts

@@ -1,5 +1,6 @@
 export {
   collectWriteHandlerQns,
+  SECURITY_BASELINE_FEATURE_NAMES,
   type ValidateBootOptions,
   validateAppCustomScreenWriteQns,
   validateBoot,

package/src/engine/build-app-schema.ts

@@ -36,11 +36,13 @@ import type {
   ScreenDefinition,
   WorkspaceSchema,
 } from "../ui-types";
+import { collectUrlPrefillFieldsByScreenQn } from "./boot-validator/url-prefill-fields";
 import {
   buildConfigFeatureSchema,
   type ConfigFeatureSchema,
   SETTINGS_HUB_FEATURE,
 } from "./build-config-feature-schema";
+import { qualifyEntityName } from "./qualified-name";
 import type { Registry } from "./types/feature";
 import type { ClientDerivedFieldDef, DerivedFieldDef, FieldDefinition } from "./types/fields";
 
@@ -57,6 +59,9 @@ export type BuildAppSchemaOptions = {
 
 export function buildAppSchema(registry: Registry, options: BuildAppSchemaOptions = {}): AppSchema {
   const features: FeatureSchema[] = [];
+  const urlPrefillFieldsByScreenQn = collectUrlPrefillFieldsByScreenQn([
+    ...registry.features.values(),
+  ]);
   for (const [featureName, feature] of registry.features) {
     const navs = Object.values(feature.navs);
     // The nav entry alone doesn't say which kind a collection lists, so the
@@ -71,7 +76,7 @@ export function buildAppSchema(registry: Registry, options: BuildAppSchemaOption
     const featureSchema: FeatureSchema = {
       featureName,
       entities: projectEntities(feature.entities ?? {}),
-      screens: projectScreens(feature.screens, registry),
+      screens: projectScreens(featureName, feature.screens, registry, urlPrefillFieldsByScreenQn),
       ...(navs.length > 0 && { navs }),
       ...(contentCollections.length > 0 && { contentCollections }),
       // #1059: verbatim r.translations({keys}) — see FeatureSchema.translations
@@ -308,12 +313,25 @@ export function findNonJsonSafePath(value: unknown, path: string): string | null
 // default (screen.searchable ?? derived); the boot-validator (3a) rejects
 // one that contradicts the schema.
 function projectScreens(
+  featureName: string,
   screens: Readonly<Record<string, ScreenDefinition>>,
   registry: Registry,
+  urlPrefillFieldsByScreenQn: ReadonlyMap<string, ReadonlySet<string>>,
 ): ScreenDefinition[] {
-  return Object.values(screens).map((screen) =>
-    screen.type === "projectionList" ? projectProjectionListScreen(screen, registry) : screen,
-  );
+  return Object.entries(screens).map(([shortId, screen]) => {
+    if (screen.type === "projectionList") return projectProjectionListScreen(screen, registry);
+    if (
+      screen.type === "actionForm" ||
+      screen.type === "secretMint" ||
+      screen.type === "entityEdit"
+    ) {
+      const declared = urlPrefillFieldsByScreenQn.get(
+        qualifyEntityName(featureName, "screen", shortId),
+      );
+      return { ...screen, urlPrefillFields: declared === undefined ? [] : [...declared].sort() };
+    }
+    return screen;
+  });
 }
 
 function projectProjectionListScreen(
@@ -390,6 +408,9 @@ function projectEntity(entity: EntityDefinition): EntityDefinition {
       derivedFields: derivedOut as unknown as Record<string, DerivedFieldDef>,
     }),
     ...(typeof entity.table === "string" && { table: entity.table }),
+    ...(typeof entity.defaultCurrency === "string" && {
+      defaultCurrency: entity.defaultCurrency,
+    }),
   };
 }
 
@@ -457,6 +478,25 @@ function projectField(fieldDef: FieldDefinition): FieldDefinition {
   if (typeof def["locale"] === "string") out["locale"] = def["locale"];
   // image: which camera a mobile capture opens (fw#2497).
   if (typeof def["capture"] === "string") out["capture"] = def["capture"];
+  // number: display-only suffix, static or read from a sibling field of the row.
+  const unit = def["unit"];
+  if (typeof unit === "string" || (isPlainObject(unit) && typeof unit["field"] === "string"))
+    out["unit"] = unit;
+  // text: "password" masks the input and blocks URL prefill in the renderer.
+  if (typeof def["format"] === "string") out["format"] = def["format"];
+  // Write-response redaction stays server-side; the renderer needs the flag to
+  // refuse any prefill (URL or handoff) into the field.
+  if (def["sensitive"] === true) out["sensitive"] = true;
+  // timestamp: the edit view-model derives its wall-clock input mode from this.
+  if (typeof def["locatedBy"] === "string") out["locatedBy"] = def["locatedBy"];
+  // file/image/images: upload picker constraints; the first variant key picks
+  // the preview variant.
+  if (Array.isArray(def["accept"]) && isJsonSafeValue(def["accept"])) out["accept"] = def["accept"];
+  if (typeof def["maxSize"] === "string") out["maxSize"] = def["maxSize"];
+  if (isPlainObject(def["variants"]) && isJsonSafeValue(def["variants"]))
+    out["variants"] = def["variants"];
+  // decimal, incl. embedded sub-fields: rounding of derived embedded-list cells.
+  if (typeof def["scale"] === "number") out["scale"] = def["scale"];
   // embedded lists: row-count bounds, computed cells, totals row, and the
   // sibling-money-field totals check (fw#2497).
   if (typeof def["minItems"] === "number") out["minItems"] = def["minItems"];

package/src/engine/index.ts

@@ -3,6 +3,7 @@
 export { hasAccess } from "./access";
 export {
   collectWriteHandlerQns,
+  SECURITY_BASELINE_FEATURE_NAMES,
   validateAppCustomScreenWriteQns,
   validateBoot,
 } from "./boot-validator";