@cosmicdrift/kumiko-framework 0.328.0 → 0.329.0

package/src/engine/schema-builder.ts

@@ -1,428 +0,0 @@
-import * as z from "zod";
-import { moneyPayloadToMinorUnits } from "../db/money";
-import { isValidIanaTimeZone } from "../time";
-import { assertUnreachable } from "../utils";
-import { withDerivedCells } from "./embedded-derived";
-import type { EmbeddedSubFieldDef, EntityDefinition, FieldDefinition } from "./types";
-import { DEFAULT_CURRENCIES } from "./types";
-
-// True if `n` carries at most `scale` decimal places. A relative epsilon
-// tolerates float artifacts (`0.1 + 0.2 = 0.30000000000000004` is accepted at
-// scale 2) — the exact `toFixed`-roundtrip-equality it replaces rejected such
-// computed-but-in-scale values. A genuinely over-scale value (0.305 @ scale 2)
-// scales to ~30.5, far from any integer, and is still rejected.
-export function isRepresentableAtScale(n: number, scale: number): boolean {
-  const scaled = n * 10 ** scale;
-  const tolerance = Math.abs(scaled) * 8 * Number.EPSILON + Number.EPSILON;
-  return Math.abs(scaled - Math.round(scaled)) <= tolerance;
-}
-
-// Lexikografischer ISO-Vergleich — exakt für `yyyy-mm-dd` (date) und korrekt
-// für ISO-Datetime in konsistenter Repräsentation (gleiche Offset-/Präzisions-
-// Form). Bewusst ohne Date-API (no-date-api-Guard); die Tag-genaue Grenze
-// reicht für min/max-Use-Cases (z.B. Geburtsdatum nicht in der Zukunft).
-function withDateBounds(
-  schema: z.ZodTypeAny,
-  min: string | undefined,
-  max: string | undefined,
-): z.ZodTypeAny {
-  if (min === undefined && max === undefined) return schema;
-  const message =
-    min !== undefined && max !== undefined
-      ? `must be between ${min} and ${max}`
-      : min !== undefined
-        ? `must be on or after ${min}`
-        : `must be on or before ${max}`;
-  return schema.refine(
-    (value: unknown) =>
-      typeof value === "string" &&
-      (min === undefined || value >= min) &&
-      (max === undefined || value <= max),
-    { message },
-  );
-}
-
-function embeddedSubFieldToZod(subField: EmbeddedSubFieldDef): z.ZodTypeAny {
-  switch (subField.type) {
-    case "text":
-      return subField.required ? z.string().min(1) : z.string();
-    case "number":
-      return z.number();
-    case "boolean":
-      return z.boolean();
-    case "date":
-      return z.string().date();
-    case "money":
-      // Signed minor units; the currency lives on the head aggregate, not the
-      // row. The safe-integer cap mirrors bigInt mode:"number" — jsonb has no
-      // BIGINT column behind it, so 2^53 is the real representability boundary.
-      return z.number().int().safe();
-    case "timestamp":
-      // No locatedBy/min/max on EmbeddedSubFieldDef (unlike the top-level
-      // timestamp field) — plain UTC-instant ISO-datetime validation.
-      return z.iso.datetime();
-    case "decimal": {
-      // No numeric column behind jsonb, so the bounds come from float
-      // representability alone: the value scaled by 10^scale must be a safe
-      // integer, i.e. at most `scale` fractional digits within ±2^53.
-      const limit = Number.MAX_SAFE_INTEGER / 10 ** subField.scale;
-      return z
-        .number()
-        .gte(-limit)
-        .lte(limit)
-        .refine((n) => isRepresentableAtScale(n, subField.scale), {
-          message: `at most ${subField.scale} decimal places`,
-        });
-    }
-    case "select": {
-      const [first, ...rest] = subField.options;
-      if (!first) return z.string();
-      return z.enum([first, ...rest]);
-    }
-    case "reference":
-      return z.uuid();
-    default:
-      assertUnreachable(subField, "embedded sub-field type");
-  }
-}
-
-// kumiko-lint-ignore complexity-budget field→zod switch is the single schema source of truth
-export function fieldToZod(
-  field: FieldDefinition,
-  currencies: readonly string[],
-  opts: { readonly applyDefaults?: boolean } = {},
-): z.ZodTypeAny {
-  // Insert callers want `.default(...)` applied so an omitted field falls
-  // back to it; buildUpdateSchema passes applyDefaults: false so an omitted
-  // field on update stays omitted (a `{ title }` patch must not clobber
-  // other columns with their defaults) while a field's own default value is
-  // still known here for "" → default mapping (select case below).
-  const applyDefaults = opts.applyDefaults ?? true;
-  switch (field.type) {
-    case "text": {
-      let schema = z.string();
-      if (field.maxLength) schema = schema.max(field.maxLength);
-      if (field.format === "email") schema = schema.email();
-      if (field.format === "url") schema = schema.url();
-      if (field.required) schema = schema.min(1);
-      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-    }
-    case "longText": {
-      // longText hat keine `format`-Variante (per type-design). Nur
-      // optional maxLength + required, sonst ein offener z.string().
-      let schema = z.string();
-      if (field.maxLength) schema = schema.max(field.maxLength);
-      if (field.required) schema = schema.min(1);
-      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-    }
-    case "boolean": {
-      const schema = z.boolean();
-      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-    }
-    case "select": {
-      const [first, ...rest] = field.options;
-      if (!first) return z.string();
-      const enumSchema = z.enum([first, ...rest]);
-      if (field.default !== undefined) {
-        // Untouched <select> sends "" too; with a default that maps to the
-        // default (same semantics as undefined) instead of the invalid-value
-        // rejection from #1702. A field with a default is never "unset" —
-        // true on both insert AND update, so this branch (and its "" → default
-        // mapping) fires regardless of applyDefaults; only the `.default(...)`
-        // schema-level fallback for OMITTED input is update-gated below.
-        // `null` maps the same way: the no-default branch below normalizes
-        // an untouched select to null, and a client that reuses that value
-        // against a since-defaulted field must not get rejected either.
-        const mapped = z.preprocess(
-          (value) => (value === "" || value === null ? field.default : value),
-          enumSchema,
-        );
-        return applyDefaults ? mapped.default(field.default) : mapped;
-      }
-      if (field.required) return enumSchema;
-      // Optional select without a default: an untouched HTML <select> submits
-      // "" for its placeholder option. Treat that as "unset" (null) instead of
-      // an invalid enum value — null (not undefined) so the value survives the
-      // JSON-serialized event payload and an update can actually clear a
-      // previously-set select back to unset, not just skip validation.
-      return z.preprocess((value) => (value === "" ? null : value), enumSchema.nullable());
-    }
-    case "multiSelect": {
-      const [first, ...rest] = field.options;
-      if (!first) return z.array(z.string());
-      // `required: true` heißt non-empty — Analogie zu `text`-Field.
-      // Leeres Array wird rejected; das globale `.optional()`-Wrapping
-      // in buildInsertSchema kümmert sich um „darf fehlen".
-      let schema = z.array(z.enum([first, ...rest]));
-      if (field.required) schema = schema.min(1);
-      return field.default !== undefined && applyDefaults
-        ? schema.default([...field.default])
-        : schema;
-    }
-    case "number": {
-      let schema = z.number();
-      // `integer: true` maps to a Postgres int4 column (entity-table-meta.ts)
-      // — bound it here so an out-of-range write fails loud (400) at the
-      // schema boundary instead of dying in Postgres (22003 → 500).
-      if (field.integer) schema = schema.int().min(-2147483648).max(2147483647);
-      if (field.min !== undefined) schema = schema.min(field.min);
-      if (field.max !== undefined) schema = schema.max(field.max);
-      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-    }
-    case "decimal": {
-      // Stored as numeric(precision, scale), surfaced as JS number. Bound the
-      // value at the write boundary so an over-range or over-scale input fails
-      // loud here instead of being silently rounded/rejected by Postgres.
-      const limit = 10 ** (field.precision - field.scale);
-      const schema = z
-        .number()
-        .gt(-limit)
-        .lt(limit)
-        .refine((n) => isRepresentableAtScale(n, field.scale), {
-          message: `at most ${field.scale} decimal places`,
-        });
-      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-    }
-    case "bigInt": {
-      // JS-`number`-Round-trip via mode:"number"; sicher bis 2^53.
-      // safe-integer-Cap ist explizit damit ein Caller, der einen
-      // Float reinwirft (z.B. parseFloat-Bug), beim Insert sofort
-      // failed statt silent-Truncation zu kassieren.
-      const schema = z.number().int().safe();
-      return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-    }
-    case "money": {
-      const [first, ...rest] = currencies;
-      if (!first) throw new Error("No currencies configured");
-      return z.object({
-        amount: z.number(),
-        currency: z.enum([first, ...rest]),
-      });
-    }
-    case "embedded": {
-      const shape: Record<string, z.ZodTypeAny> = {};
-      for (const [subName, subField] of Object.entries(field.schema)) {
-        const zodSub = embeddedSubFieldToZod(subField);
-        shape[subName] = subField.required ? zodSub : zodSub.optional();
-      }
-      const baseRow = z.object(shape);
-      const derived = field.derived;
-      // The server is the authority for derived cells: a row is recomputed
-      // here, overwriting whatever the client sent, instead of merely
-      // being checked against it.
-      const row =
-        derived === undefined
-          ? baseRow
-          : z.preprocess((value) => withDerivedCells(value, derived, field.schema), baseRow);
-      if (field.multiple !== true) return row;
-      // `required: true` means non-empty, same reading as multiSelect —
-      // whether the key may be omitted at all is decided by buildInsertSchema
-      // off the same flag. `minItems` overrides that default when set.
-      let list = z.array(row);
-      const min = field.minItems ?? (field.required === true ? 1 : undefined);
-      if (min !== undefined) list = list.min(min);
-      if (field.maxItems !== undefined) list = list.max(field.maxItems);
-      return list;
-    }
-    case "jsonb": {
-      // Free-form jsonb — keys sind tenant-/runtime-defined. Validation
-      // passthrough: any plain object passt durch.
-      return z.record(z.string(), z.unknown());
-    }
-    case "date": {
-      const schema = z.string().date();
-      return withDateBounds(schema, field.min, field.max);
-    }
-    case "timestamp": {
-      // Wenn locatedBy gesetzt: Wall-Clock OHNE Offset (ISO-Datetime ohne `Z`).
-      // Sonst: ISO-UTC-Datetime (mit `Z`). Beide werden über z.iso.datetime
-      // gegen das ISO-8601-Schema validiert; die Präzision (mit/ohne Offset)
-      // hängt von locatedBy ab.
-      const schema =
-        field.locatedBy !== undefined ? z.iso.datetime({ local: true }) : z.iso.datetime();
-      return withDateBounds(schema, field.min, field.max);
-    }
-    case "tz": {
-      // IANA-Zonenname, validiert gegen die Runtime-Zonenliste
-      // (isValidIanaTimeZone). Ein ungültiger Name failt hier am
-      // Write-Boundary statt erst später in ctx.tz.parse / Temporal.
-      return z.string().refine(isValidIanaTimeZone, { message: "invalid IANA time zone" });
-    }
-    case "locatedTimestamp": {
-      // Combined Wall-Clock+TZ Object. Beim Write akzeptieren wir entweder
-      // { at, tz } (typisch UI-Form, utc wird berechnet) oder { utc, tz }
-      // (typisch Server-zu-Server, at wird berechnet). Beim Read liefert
-      // der Read-Wrapper alle drei Felder (siehe Phase D in MIGRATION.md).
-      //
-      // Hier nur die Schema-Garantie: mindestens tz + (at ODER utc).
-      const at = z.iso.datetime({ local: true });
-      const tz = z.string().refine(isValidIanaTimeZone, { message: "invalid IANA time zone" });
-      const utc = z.iso.datetime();
-      return z.union([
-        z.object({ at, tz, utc: utc.optional() }),
-        z.object({ utc, tz, at: at.optional() }),
-      ]);
-    }
-    case "file":
-    case "image": {
-      // Single file: stores a fileRef UUID — must match fileRefsTable.id
-      // (uuid column). Pre-fix this was z.number() from an era when the
-      // column was (wrongly) integer; the table-builder fix to uuid needs
-      // a matching validation-layer fix here or the CRUD pipeline rejects
-      // every valid UUID with "expected number".
-      return z.uuid();
-    }
-    case "files":
-    case "images": {
-      // Multi file: array of fileRef UUIDs. Same story as the singular
-      // variant — the element type has to match the UUID column on
-      // fileRefsTable.id.
-      return z.array(z.uuid());
-    }
-    case "reference":
-      // Tier 2.7e-3: Validiert UUID-shape. Existenz-Check der Reference
-      // (Row im referenced Table existiert + Tenant-Scope) ist Server-
-      // side-Verantwortung im Handler / Foreign-Key-Constraint, nicht
-      // im Schema-Validator (würde sonst Round-trip zur DB beim Parse).
-      // Multi-Mode (Tier 2.7e-Multi): Array von UUIDs.
-      return field.multiple === true ? z.array(z.uuid()) : z.uuid();
-    default:
-      assertUnreachable(field, "field type");
-  }
-}
-
-// Cross-field check for `EmbeddedFieldDef.totalsMatch`: the sum of a list
-// subfield across every row must equal a sibling top-level money field.
-// Runs via the same z.object().safeParse() call on both the client
-// (form-controller's runValidate) and the server (write handler) — one
-// mechanism, no separate client/server validation path to keep in sync.
-// Row cells have no currency of their own (they're minor units in the
-// entity's default currency); a sibling tagged with a different currency
-// fails the check even if the raw minor-unit amounts happen to match.
-//
-// Known limitation: compares against rounded `derived` cells, i.e.
-// "sum-of-rounded" not "round-of-sum" (kumiko-framework#1866). Follow-up
-// for a computed, read-only sibling total: kumiko-framework#1873.
-// kumiko-lint-ignore complexity-budget currency-equality check on sibling money payloads
-function applyTotalsMatchRefinements(
-  entity: EntityDefinition,
-  schema: z.ZodObject<Record<string, z.ZodTypeAny>>,
-): z.ZodObject<Record<string, z.ZodTypeAny>> {
-  let result = schema;
-  for (const [fieldName, field] of Object.entries(entity.fields)) {
-    if (field.type !== "embedded" || field.totalsMatch === undefined) continue;
-    const totalsMatch = field.totalsMatch;
-    result = result.superRefine((values, ctx) => {
-      for (const [subFieldName, siblingFieldName] of Object.entries(totalsMatch)) {
-        const rawRows = values[fieldName];
-        const siblingRaw = values[siblingFieldName];
-        // Neither side sent → nothing to check (unrelated partial update).
-        if (rawRows === undefined && siblingRaw === undefined) continue;
-        // One side of a totalsMatch pair without the other → reject. Update
-        // payloads only carry `changes`, so omitting the sibling would otherwise
-        // silently leave sum ≠ total (fw#1841).
-        if (rawRows === undefined || siblingRaw === undefined) {
-          ctx.addIssue({
-            code: "custom",
-            path: [rawRows === undefined ? fieldName : siblingFieldName],
-            message: `totalsMatch requires both "${fieldName}" and "${siblingFieldName}" in the same payload`,
-          });
-          continue;
-        }
-        // Not an array -> a different refinement already rejects the shape;
-        // this check isn't the right place to report it.
-        if (!Array.isArray(rawRows)) continue;
-        const siblingMinor = moneyPayloadToMinorUnits(siblingRaw);
-        if (siblingMinor === undefined) continue;
-        const siblingCurrency =
-          typeof siblingRaw === "object" && siblingRaw !== null && "currency" in siblingRaw
-            ? (siblingRaw as { currency: unknown }).currency
-            : undefined;
-        const entityCurrency = entity.defaultCurrency ?? DEFAULT_CURRENCIES[0];
-        if (typeof siblingCurrency === "string" && siblingCurrency !== entityCurrency) {
-          ctx.addIssue({
-            code: "custom",
-            path: [siblingFieldName],
-            message: `"${siblingFieldName}" currency (${siblingCurrency}) does not match the entity's default currency (${entityCurrency}) that "${fieldName}" rows are summed in`,
-          });
-          continue;
-        }
-        const sumMinor = rawRows.reduce((total: number, row: unknown) => {
-          const value =
-            typeof row === "object" && row !== null
-              ? (row as Record<string, unknown>)[subFieldName]
-              : undefined;
-          return total + (typeof value === "number" ? value : 0);
-        }, 0);
-        if (sumMinor !== siblingMinor) {
-          ctx.addIssue({
-            code: "custom",
-            path: [fieldName],
-            message: `Sum of "${subFieldName}" across "${fieldName}" (${sumMinor}) does not match "${siblingFieldName}" (${siblingMinor})`,
-          });
-        }
-      }
-    });
-  }
-  return result;
-}
-
-// An excluded field stays in the shape as "must be absent" instead of being
-// dropped: zod strips unknown keys silently, so a client still sending it
-// would otherwise get a success without the write happening.
-function notWritableField(): z.ZodTypeAny {
-  return z.never().optional();
-}
-
-export function buildInsertSchema(
-  entity: EntityDefinition,
-  currencies: readonly string[] = [...DEFAULT_CURRENCIES],
-  excludedFields: readonly string[] = [],
-): z.ZodObject<Record<string, z.ZodTypeAny>> {
-  const shape: Record<string, z.ZodTypeAny> = {};
-
-  for (const [name, field] of Object.entries(entity.fields)) {
-    if (excludedFields.includes(name)) {
-      shape[name] = notWritableField();
-      continue;
-    }
-    const zodField = fieldToZod(field, currencies);
-    const hasDefault = "default" in field && field.default !== undefined;
-    const isRequired = "required" in field && field.required === true;
-    shape[name] = isRequired || hasDefault ? zodField : zodField.optional();
-  }
-
-  // Caller-chosen aggregate id for idempotent creates (deterministic-id
-  // patterns). Accepting it here only lets it survive parsing — the create
-  // handler still honors it only for a system-identity caller (jobs/hooks
-  // via createSystemUser), never for an ordinary HTTP-authenticated user.
-  shape["id"] = z.uuid().optional();
-
-  return applyTotalsMatchRefinements(entity, z.object(shape));
-}
-
-export function buildUpdateSchema(
-  entity: EntityDefinition,
-  currencies: readonly string[] = [...DEFAULT_CURRENCIES],
-  excludedFields: readonly string[] = [],
-): z.ZodObject<Record<string, z.ZodTypeAny>> {
-  const shape: Record<string, z.ZodTypeAny> = {};
-
-  for (const [name, field] of Object.entries(entity.fields)) {
-    if (excludedFields.includes(name)) {
-      shape[name] = notWritableField();
-      continue;
-    }
-    // Update schemas never apply defaults for OMITTED fields — a user that
-    // sends only `{ title }` means "only change title"; zod defaults would
-    // silently inject default values for every omitted field and clobber
-    // existing data via the event-store-executor's `changes` payload.
-    // The field is passed through un-stripped (unlike before fw#1703) so
-    // fieldToZod still knows the default for its "" → default mapping
-    // (e.g. select) — applyDefaults: false only suppresses the schema-level
-    // `.default(...)` fallback for a genuinely omitted key.
-    shape[name] = fieldToZod(field, currencies, { applyDefaults: false }).optional();
-  }
-
-  return applyTotalsMatchRefinements(entity, z.object(shape));
-}

package/src/engine/screen-filter-ops.ts

@@ -1,60 +0,0 @@
-// Screen-Filter (Tier 2.7c) — Op-vs-Field-Type-Compatibility.
-//
-// Wer darf was filtern?
-//   - text/select/multiSelect: nur equality-Ops (eq, ne, in). lt/gt
-//     auf Strings ist semantisch fast immer Tippfehler (lexicographic
-//     compare nutzt der Author selten bewusst); Author kann den
-//     Filter dann einfach nicht setzen.
-//   - boolean: eq, ne (in/lt/gt sinnlos für 2-Werte-Type).
-//   - number/money/decimal/date/timestamp/locatedTimestamp: alle 7
-//     Ops — die Felder sind natürlich vergleichbar.
-//
-// Boot-Validator nutzt diese Map um Author-Fehler früh zu fangen
-// ("filter mit op:lt auf einem text-Feld" → Boot-Fail). Erweitert sich
-// transparent: neuer Field-Type → hier eintragen + sortable/filterable-
-// Flag im Type-Def, sonst lehnt der Validator das Field generell ab.
-
-import type { FieldDefinition, ScreenFilterOp } from "./types";
-
-const EQUALITY_ONLY = ["eq", "ne", "in"] as const satisfies readonly ScreenFilterOp[];
-const COMPARABLE = [
-  "eq",
-  "ne",
-  "lt",
-  "gt",
-  "lte",
-  "gte",
-  "in",
-] as const satisfies readonly ScreenFilterOp[];
-const BOOL_OPS = ["eq", "ne"] as const satisfies readonly ScreenFilterOp[];
-
-export function getAllowedFilterOps(field: FieldDefinition): readonly ScreenFilterOp[] {
-  switch (field.type) {
-    case "text":
-    case "select":
-    case "multiSelect":
-      return EQUALITY_ONLY;
-    case "boolean":
-      return BOOL_OPS;
-    case "number":
-    case "money":
-    case "decimal":
-    case "date":
-    case "timestamp":
-    case "locatedTimestamp":
-      return COMPARABLE;
-    // tz/embedded/file/image/files/images: nicht filterbar — Author
-    // kann das Feld nicht als filterable: true markieren (Boot-
-    // Validator weist `filterable: true` auf den Types ohnehin schon
-    // ab, weil das Flag dort gar nicht im Type-Def steht).
-    default:
-      return [];
-  }
-}
-
-// Author hat das Feld als filterable markiert? Tz/Embedded/File-Types
-// haben das Flag gar nicht im Type-Def, also fangen wir das per
-// `"filterable" in field`-Narrow ab.
-export function isFieldFilterable(field: FieldDefinition): boolean {
-  return "filterable" in field && field.filterable === true;
-}

package/src/engine/screen-helpers.ts

@@ -1,161 +0,0 @@
-import type {
-  ActionFormScreenDefinition,
-  ConfigEditScreenDefinition,
-  EditExtensionSection,
-  EditFieldSpec,
-  EditFieldsSection,
-  EditSectionSpec,
-  EditWriteFormSection,
-  EntityEditScreenDefinition,
-  FieldCondition,
-  FormatSpec,
-  ListColumnSpec,
-  ProjectionDetailScreenDefinition,
-  RowAction,
-  ScreenDefinition,
-  SecretMintScreenDefinition,
-  ToolbarAction,
-} from "./types/screen";
-
-// Every screen type carrying `listScreenId` declares it identically; centralizing
-// here keeps the switch the only place that grows for a new screen type.
-export function explicitListScreenId(screen: ScreenDefinition): string | undefined {
-  switch (screen.type) {
-    case "custom":
-    case "projectionDetail":
-    case "entityEdit":
-    case "actionForm":
-    case "secretMint":
-      return screen.listScreenId;
-    default:
-      return undefined;
-  }
-}
-
-// Shared by the renderer breadcrumb and the boot-validator so both resolve
-// parents the same way; `getId` lets each caller normalize `screen.id`.
-export function resolveNavParentScreen(
-  screens: readonly ScreenDefinition[],
-  detail: ScreenDefinition,
-  getId: (screen: ScreenDefinition) => string,
-): ScreenDefinition | undefined {
-  const detailScreenId = getId(detail);
-
-  const listFromExplicit = ((): ScreenDefinition | undefined => {
-    const explicitId = explicitListScreenId(detail);
-    return explicitId !== undefined ? screens.find((s) => getId(s) === explicitId) : undefined;
-  })();
-
-  // rowActions, toolbarActions, and drawer-kind actions (which mount inline
-  // and have no page of their own) all count as "reached from" this list.
-  const navigatesToDetail = (
-    actions: readonly (RowAction | ToolbarAction)[] | undefined,
-  ): boolean =>
-    (actions ?? []).some(
-      (a) => (a.kind === "navigate" || a.kind === "drawer") && a.screen === detailScreenId,
-    );
-  const listFromRowAction = screens.find((s) => {
-    if (s.type !== "entityList" && s.type !== "projectionList") return false;
-    return navigatesToDetail(s.rowActions) || navigatesToDetail(s.toolbarActions);
-  });
-
-  const listFromEntity =
-    detail.type === "entityEdit"
-      ? screens.find((s) => s.type === "entityList" && s.entity === detail.entity)
-      : undefined;
-
-  return listFromExplicit ?? listFromRowAction ?? listFromEntity;
-}
-
-export type EditLayoutScreen =
-  | ProjectionDetailScreenDefinition
-  | EntityEditScreenDefinition
-  | ActionFormScreenDefinition
-  | ConfigEditScreenDefinition
-  | SecretMintScreenDefinition;
-
-// Shared by boot-validators that walk the EditLayout shape (entityEdit's
-// layout, reused verbatim by projectionDetail/actionForm/configEdit/secretMint).
-export function isEditLayoutScreen(screen: ScreenDefinition): screen is EditLayoutScreen {
-  return (
-    screen.type === "projectionDetail" ||
-    screen.type === "entityEdit" ||
-    screen.type === "actionForm" ||
-    screen.type === "configEdit" ||
-    screen.type === "secretMint"
-  );
-}
-
-export function isExtensionEditSection(section: EditSectionSpec): section is EditExtensionSection {
-  return section.kind === "extension";
-}
-
-export function isFieldsEditSection(section: EditSectionSpec): section is EditFieldsSection {
-  return section.kind === undefined || section.kind === "fields";
-}
-
-export function isWriteFormEditSection(section: EditSectionSpec): section is EditWriteFormSection {
-  return section.kind === "writeForm";
-}
-
-/** Structural shape of every section that can carry `fields` and/or `groups` —
- *  matches EditWriteFormSection (no `groups`) too, so callers need no narrowing. */
-export type FieldsOrGroupsSection = {
-  readonly fields: readonly EditFieldSpec[];
-  readonly groups?: readonly {
-    readonly title: string;
-    readonly fields: readonly EditFieldSpec[];
-  }[];
-};
-
-// Union of both sources, unlike the boot-validator's either-or flattening: that
-// one runs after the fields-XOR-groups check, collectors run without it and must
-// not drop a source (fw#2986).
-export function sectionFieldSpecs(section: FieldsOrGroupsSection): readonly EditFieldSpec[] {
-  // kumiko-lint-ignore section-fields-raw this IS the union reader — the groups source is added on the same line
-  return [...section.fields, ...(section.groups?.flatMap((group) => group.fields) ?? [])];
-}
-
-// Type guard — narrows FieldRenderer to FormatSpec. Useful for renderer
-// authors who branch on the three FieldRenderer variants without manual
-// "format" in renderer checks.
-export function isFormatSpec(r: unknown): r is FormatSpec {
-  return typeof r === "object" && r !== null && "format" in r && typeof r.format === "string";
-}
-
-// Collapse the string-shorthand into the object form. Both the boot-validator
-// and (later) ui-core's view-model builder iterate over fields/columns — the
-// helper keeps that loop from growing two branches everywhere.
-export function normalizeListColumn(c: ListColumnSpec): Exclude<ListColumnSpec, string> {
-  const col = typeof c === "string" ? { field: c } : c;
-  if (
-    typeof process !== "undefined" &&
-    process.env.NODE_ENV !== "production" &&
-    col.renderer !== undefined &&
-    typeof col.renderer === "function"
-  ) {
-    // biome-ignore lint/suspicious/noConsole: dev-only warning
-    console.warn(
-      `[kumiko] normalizeListColumn: Feld "${col.field}" hat einen Funktions-Renderer — dieser wird von JSON.stringify verworfen. Bitte auf FormatSpec ({ format: "..." }) migrieren.`,
-    );
-  }
-  return col;
-}
-
-/** Evaluates a declarative FieldCondition against the current row/form
- *  values. THE single implementation — renderer (row-action visibility),
- *  headless view-model (visible/readOnly/required) and render-edit
- *  (form-condition closures) reuse it; three hand-rolled copies had
- *  already drifted in shape. */
-export function evalFieldCondition(cond: FieldCondition, values: Record<string, unknown>): boolean {
-  if (typeof cond === "boolean") return cond;
-  const val = values[cond.field];
-  if ("eq" in cond) return val === cond.eq;
-  if ("in" in cond) return cond.in.includes(val);
-  if ("notIn" in cond) return !cond.notIn.includes(val);
-  return val !== cond.ne;
-}
-
-export function normalizeEditField(f: EditFieldSpec): Exclude<EditFieldSpec, string> {
-  return typeof f === "string" ? { field: f } : f;
-}