@cosmicdrift/kumiko-framework 0.333.0 → 0.335.0

package/dist/engine/boot-validator/screens.js

@@ -4,23 +4,17 @@
 // into validateColumnRendererForm, splitting them would create a
 // same-folder require cycle.
 import { resolveActionIcon } from "@cosmicdrift/kumiko-types/action-icon";
-import { NO_WIDGET_FIELD_TYPES } from "@cosmicdrift/kumiko-types/fields";
+import { NO_WIDGET_FIELD_TYPES, optionsQueryFieldRefs } from "@cosmicdrift/kumiko-types/fields";
 import { NAV_ICON_KEYS } from "@cosmicdrift/kumiko-types/nav-icon";
 import { rowMetaFieldNames } from "../../db/table-builder.js";
-import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta.js";
+import { REFERENCE_LOOKUP_SOURCES } from "../../ui-types/list-row-meta.js";
+import { isEncryptedAtRest } from "../config-helpers.js";
 import { parseRefTarget } from "../parse-ref-target.js";
 import { isKebabSegment, isValidQn, qualifyEntityName } from "../qualified-name.js";
 import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops.js";
 import { isExtensionEditSection, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../screen-helpers.js";
 import { metricField } from "../types/index.js";
-// entityList columns accept exactly the row-meta columns the renderer
-// (computeListViewModel) knows how to type — LIST_ROW_META_COLUMNS, NOT the
-// wider rowMetaFieldNames(softDelete) used below for rowAction payload/visible
-// field refs. Those two checks guard different things: a screen column must
-// be renderable, a payload/visible field reference only needs to exist on the
-// row. Using the wider set here would let a softDelete column like
-// "deletedAt" pass the boot gate and then throw at render-time instead.
-const LIST_ROW_META_COLUMN_NAMES = new Set(Object.keys(LIST_ROW_META_COLUMNS));
+import { LIST_ROW_META_COLUMN_NAMES } from "./entity-list-screens.js";
 // entityList and projectionList both allow a rowAction to double as the
 // row-body click target (rowClick: true, fw#1708/#2164) — at most one per
 // screen, or the renderer can't tell which one should fire.
@@ -471,13 +465,37 @@ function validateFormFieldsMap(featureName, screenId, context, fields, allowEmpt
         if (ftype === "money") {
             validateFormMoneyCurrency(featureName, screenId, context, fname, fdef);
         }
-        validateFormSelectOptions(featureName, screenId, context, fname, fdef);
+        validateFormSelectOptions(featureName, screenId, context, fname, fdef, fieldNames);
+        rejectWriteOnlyFormField(featureName, screenId, context, fname, fdef);
     }
     return fieldNames;
 }
-// Static options XOR optionsQuery on inline-form select fields. The QN
-// existence check lives in query-refs.ts with the other query refs.
-function validateFormSelectOptions(featureName, screenId, context, fieldName, fdef) {
+function validateOptionsQueryFieldRefs(where, fieldName, payload, siblingFieldNames) {
+    for (const ref of optionsQueryFieldRefs(payload)) {
+        if (ref === fieldName) {
+            throw new Error(`${where} optionsQueryPayload references itself ({ field: "${ref}" })`);
+        }
+        if (!siblingFieldNames.has(ref)) {
+            throw new Error(`${where} optionsQueryPayload references unknown field "${ref}" — it must be another field of the same form`);
+        }
+    }
+}
+function isWriteOnlyField(fdef) {
+    return fdef?.writeOnly === true; // @cast-boundary schema-walk
+}
+// Inline forms have no stored value to hide or keep: writeOnly there would
+// render a "set / keep" affordance with nothing behind it.
+function rejectWriteOnlyFormField(featureName, screenId, context, fieldName, fdef) {
+    if (isWriteOnlyField(fdef)) {
+        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) field "${fieldName}" declares writeOnly — ` +
+            `writeOnly only applies to entity fields (nothing to hide on a form that stores no value). ` +
+            `Use format: "password" for a masked input.`);
+    }
+}
+// Static options XOR optionsQuery on inline-form select fields, and `{ field }`
+// payload refs must name another field of the same form. The QN existence check
+// lives in query-refs.ts with the other query refs.
+function validateFormSelectOptions(featureName, screenId, context, fieldName, fdef, siblingFieldNames) {
     if (fdef.type === "select") {
         const where = `[Feature ${featureName}] Screen "${screenId}" (${context}) select field "${fieldName}"`;
         if (fdef.optionsQuery !== undefined) {
@@ -487,6 +505,7 @@ function validateFormSelectOptions(featureName, screenId, context, fieldName, fd
             if (fdef.options.length > 0) {
                 throw new Error(`${where} declares both options and optionsQuery — pick one`);
             }
+            validateOptionsQueryFieldRefs(where, fieldName, fdef.optionsQueryPayload, siblingFieldNames);
         }
         else if (fdef.optionsQueryPayload !== undefined) {
             throw new Error(`${where} has optionsQueryPayload without optionsQuery`);
@@ -593,8 +612,21 @@ function validateRedirectTarget(feature, screenId, screenKind, redirect, allScre
             `name the success-payload field carrying the navigation id, or use the plain string ` +
             `redirect form to navigate with the handler's own "id".`);
     }
+    // The renderer reads idFrom verbatim (Object.hasOwn), so stray whitespace
+    // never matches and the navigation silently lands without an entityId.
+    if (typeof redirect !== "string" && redirect.idFrom !== redirect.idFrom.trim()) {
+        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${screenKind}) redirect.idFrom "${redirect.idFrom}" ` +
+            `has leading/trailing whitespace — it would never match a payload field.`);
+    }
     validateScreenNavTarget(feature.name, screenId, screenKind, "redirect", redirectTarget, allScreenQns, feature.screens);
 }
+// A writeHandler record action's redirect (projectionDetail/entityEdit
+// header and section actions) follows the entityEdit.redirect rule.
+function validateRecordActionRedirect(feature, screenId, screenKind, action, allScreenQns) {
+    if (action.kind !== "navigate" && action.kind !== "drawer" && action.redirect !== undefined) {
+        validateRedirectTarget(feature, screenId, screenKind, action.redirect, allScreenQns);
+    }
+}
 function validateInlineFormNavTargets(feature, screenId, screen, kind, allScreenQns) {
     if (screen.redirect !== undefined) {
         validateRedirectTarget(feature, screenId, kind, screen.redirect, allScreenQns);
@@ -792,7 +824,16 @@ function validateRelatedListToolbarActions(args, toolbarActions) {
         }
     }
 }
-export function validateScreens(feature, featureMap, allWriteHandlerQns, allScreenQns, allConfigKeyQns, screensByShortId, detailForScreens) {
+// Only a navigate action that sets `tab` needs the target resolved (to check
+// the tab id); plain navigates are validated elsewhere. One place for every
+// section-level action site so a new site can't forget the tab check.
+function validateNavigateActionTab(featureName, screenId, screenType, actionLabel, action, lookups) {
+    // skip: only navigate actions with an explicit tab need target validation
+    if (action.kind !== "navigate" || action.tab === undefined)
+        return;
+    resolveRowActionNavigateTarget(featureName, screenId, screenType, actionLabel, action, lookups.allScreenQns, lookups.navTargetShortIds, lookups.screensByShortId, lookups.detailForScreens);
+}
+export function validateScreens(feature, featureMap, allWriteHandlerQns, allScreenQns, configKeyDefsByQn, screensByShortId, detailForScreens) {
     // navigate-Targets (rowAction/toolbarAction) dürfen cross-feature zeigen —
     // der Runtime-Router (create-app) löst eine bare screenId app-weit über ALLE
     // Features auf (eine deklarative Liste im owning-Feature der Entity navigiert
@@ -801,6 +842,12 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
     // zusätzlich eine voll-qualifizierte Cross-Feature-QN (resolveScreenTargetQn,
     // #1946) — kurze IDs bleiben same-feature wie zuvor.
     const navTargetShortIds = screenShortIdsFrom(allScreenQns);
+    const navigateLookups = {
+        allScreenQns,
+        navTargetShortIds,
+        screensByShortId,
+        detailForScreens,
+    };
     for (const [screenId, screen] of Object.entries(feature.screens)) {
         validateScreenHasNavArea(feature, screenId, screen, featureMap);
         if (screen.type === "custom") {
@@ -921,14 +968,18 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                             `there is no fallback to the raw column name.`);
                     }
                     const navigate = typeof metric === "string" ? undefined : metric.navigate;
-                    if (navigate?.tab !== undefined) {
+                    if (navigate !== undefined) {
                         if (navigate.screen === undefined && navigate.entity === undefined) {
-                            if (!screen.layout.sections.some((section) => section.id === navigate.tab)) {
+                            if (navigate.tab !== undefined &&
+                                !screen.layout.sections.some((section) => section.id === navigate.tab)) {
                                 throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) metric "${field}" ` +
                                     `navigates to tab "${navigate.tab}", which is not a section id on this screen.`);
                             }
                         }
                         else {
+                            // Also runs without `tab`: a typo'd screen/entity or an entity
+                            // target without entityId would otherwise render a clickable
+                            // metric that silently does nothing.
                             resolveRowActionNavigateTarget(feature.name, screenId, "projectionDetail", "metric", {
                                 kind: "navigate",
                                 id: field,
@@ -936,7 +987,7 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                                 ...(navigate.screen !== undefined ? { screen: navigate.screen } : {}),
                                 ...(navigate.entity !== undefined ? { entity: navigate.entity } : {}),
                                 ...(navigate.entityId !== undefined ? { entityId: navigate.entityId } : {}),
-                                tab: navigate.tab,
+                                ...(navigate.tab !== undefined ? { tab: navigate.tab } : {}),
                             }, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens);
                         }
                     }
@@ -978,17 +1029,13 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                 if (section.actions !== undefined) {
                     for (const action of section.actions) {
                         validateActionHasIcon(feature.name, screenId, "projectionDetail", `section "${sectionLabel}" action`, action);
-                        if (action.kind === "navigate" && action.tab !== undefined) {
-                            resolveRowActionNavigateTarget(feature.name, screenId, "projectionDetail", `section "${sectionLabel}" action`, action, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens);
-                        }
+                        validateRecordActionRedirect(feature, screenId, "projectionDetail", action, allScreenQns);
+                        validateNavigateActionTab(feature.name, screenId, "projectionDetail", `section "${sectionLabel}" action`, action, navigateLookups);
                     }
                 }
                 if (section.kind === "relatedList" && section.emptyState?.action !== undefined) {
                     validateActionHasIcon(feature.name, screenId, "projectionDetail", `section "${sectionLabel}" emptyState action`, section.emptyState.action);
-                    if (section.emptyState.action.kind === "navigate" &&
-                        section.emptyState.action.tab !== undefined) {
-                        resolveRowActionNavigateTarget(feature.name, screenId, "projectionDetail", `section "${sectionLabel}" emptyState action`, section.emptyState.action, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens);
-                    }
+                    validateNavigateActionTab(feature.name, screenId, "projectionDetail", `section "${sectionLabel}" emptyState action`, section.emptyState.action, navigateLookups);
                 }
                 if (isExtensionEditSection(section)) {
                     // projectionDetail is read-only (no composed form submit) — an
@@ -1048,6 +1095,14 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                         throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) section "${section.title}" ` +
                             `(writeForm) has zero fields — drop the section or add fields to it.`);
                     }
+                    // A ref to a fieldDef the form never renders would never resolve.
+                    const writeFormFieldNames = new Set(
+                    // kumiko-lint-ignore section-fields-raw writeForm sections carry no groups (EditWriteFormSection)
+                    section.fields.map((f) => normalizeEditField(f).field));
+                    for (const [defName, fdef] of Object.entries(section.fieldDefs)) {
+                        validateFormSelectOptions(feature.name, screenId, `projectionDetail section "${section.title}" writeForm`, defName, fdef, writeFormFieldNames);
+                        rejectWriteOnlyFormField(feature.name, screenId, `projectionDetail section "${section.title}" writeForm`, defName, fdef);
+                    }
                     // kumiko-lint-ignore section-fields-raw writeForm sections carry no groups (EditWriteFormSection)
                     for (const f of section.fields) {
                         const fieldName = normalizeEditField(f).field;
@@ -1085,6 +1140,7 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
             if (screen.actions !== undefined) {
                 for (const action of screen.actions) {
                     validateActionHasIcon(feature.name, screenId, "projectionDetail", "action", action);
+                    validateRecordActionRedirect(feature, screenId, "projectionDetail", action, allScreenQns);
                     if (action.kind === "navigate" && action.rowClick === true) {
                         throw new Error(`[Feature ${feature.name}] Screen "${qualifyEntityName(feature.name, "screen", screenId)}" ` +
                             `(projectionDetail) action "${action.id}" sets rowClick: true — there is no row to ` +
@@ -1128,7 +1184,7 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                     throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (configEdit) field "${fname}" has no ` +
                         `\`type\` set. Each field must declare a type (e.g. "text", "number", "select").`);
                 }
-                validateFormSelectOptions(feature.name, screenId, "configEdit", fname, fdef);
+                validateFormSelectOptions(feature.name, screenId, "configEdit", fname, fdef, fieldNames);
             }
             if (screen.layout.sections.length === 0) {
                 throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (configEdit) has an empty sections list — ` +
@@ -1170,10 +1226,16 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                         `keinen Eintrag in configKeys-Map. Jedes deklarierte Field braucht ein Mapping zu ` +
                         `einem qualifizierten Config-Key (\`<feature>:config:<short>\`).`);
                 }
-                if (!allConfigKeyQns.has(qualified)) {
+                const configKeyDef = configKeyDefsByQn.get(qualified);
+                if (configKeyDef === undefined) {
                     throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (configEdit) field "${fname}" → ` +
                         `Config-Key "${qualified}" ist in keiner Feature-Registry deklariert. Tippfehler? ` +
-                        `Erwartetes Format: "<feature>:config:<short>". Bekannte Keys: ${[...allConfigKeyQns].sort().join(", ") || "(keine)"}`);
+                        `Erwartetes Format: "<feature>:config:<short>". Bekannte Keys: ${[...configKeyDefsByQn.keys()].sort().join(", ") || "(keine)"}`);
+                }
+                if (isWriteOnlyField(screen.fields[fname]) && !isEncryptedAtRest(configKeyDef)) {
+                    throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (configEdit) field "${fname}" declares writeOnly ` +
+                        `but config key "${qualified}" is not encrypted at rest — writeOnly on a configEdit field ` +
+                        `only hides a stored secret (declare the key with encrypted: true or backing: "secrets").`);
                 }
             }
             continue;
@@ -1265,6 +1327,9 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                     throw new Error(buildUnknownFieldMessage(feature.name, screenId, normalized.field, screen.entity, columnFieldNames));
                 }
                 validateColumnRendererForm(feature.name, screenId, normalized);
+                if (normalized.refEntity !== undefined) {
+                    assertRefTargetRegistered(`[Feature ${feature.name}] Screen "${screenId}" (entityList)`, `column "${normalized.field}" (refEntity)`, normalized.refEntity, feature.name, featureMap);
+                }
             }
             // Pagination/Sort/Search-Validierung: Author-Fehler beim Boot
             // fangen, damit kein "warum kommt die Liste leer / falsch
@@ -1456,9 +1521,8 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                     const sectionLabel = section.title ?? section.id ?? "(untitled)";
                     for (const action of section.actions) {
                         validateActionHasIcon(feature.name, screenId, "entityEdit", `section "${sectionLabel}" action`, action);
-                        if (action.kind === "navigate" && action.tab !== undefined) {
-                            resolveRowActionNavigateTarget(feature.name, screenId, "entityEdit", `section "${sectionLabel}" action`, action, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens);
-                        }
+                        validateRecordActionRedirect(feature, screenId, "entityEdit", action, allScreenQns);
+                        validateNavigateActionTab(feature.name, screenId, "entityEdit", `section "${sectionLabel}" action`, action, navigateLookups);
                     }
                 }
                 if (isExtensionEditSection(section)) {
@@ -1493,6 +1557,7 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
             // row to click either.
             if (screen.actions !== undefined) {
                 for (const action of screen.actions) {
+                    validateRecordActionRedirect(feature, screenId, "entityEdit", action, allScreenQns);
                     if (action.kind === "navigate" && action.rowClick === true) {
                         throw new Error(`[Feature ${feature.name}] Screen "${qualifyEntityName(feature.name, "screen", screenId)}" ` +
                             `(entityEdit) action "${action.id}" sets rowClick: true — there is no row to click ` +
@@ -1552,7 +1617,7 @@ function validateDashboardScreen(featureName, screenId, screen, featureMap) {
             validateDashboardScreenPanel(featureName, screenId, panel, featureMap);
         }
         else {
-            validateDashboardQueryPanel(featureName, screenId, panel);
+            validateDashboardQueryPanel(featureName, screenId, panel, featureMap);
         }
     }
     if (screen.filter !== undefined) {
@@ -1606,6 +1671,15 @@ export function validateDashboardScreenPanel(featureName, screenId, panel, featu
         throw new Error(`${context} embeds "${targetQn}" of type "${target.type}", which can't be embedded — allowed: ` +
             `${[...EMBEDDABLE_SCREEN_TYPES].join(", ")}. Use a custom panel for app components.`);
     }
+    // ActionFormBody/SecretMintBody navigate via nav.navigate after submit or
+    // cancel even when embedded, which would pull the user off the dashboard.
+    if ((target.type === "actionForm" || target.type === "secretMint") &&
+        (target.redirect !== undefined ||
+            (target.cancelTarget !== undefined && target.cancelTarget !== false))) {
+        throw new Error(`${context} embeds "${targetQn}", which sets redirect/cancelTarget — an embedded form would ` +
+            `navigate away from the dashboard on submit or cancel. Embed a screen without redirect and ` +
+            `with cancelTarget: false (or omitted).`);
+    }
     const visibleWhen = panel.visibleWhen;
     if (visibleWhen !== undefined && (visibleWhen.query === "" || visibleWhen.field === "")) {
         throw new Error(`${context} visibleWhen needs a non-empty query and field.`);
@@ -1631,7 +1705,7 @@ export function validateDashboardCustomPanel(featureName, screenId, panel) {
             `declare a react/native component marker.`);
     }
 }
-function validateDashboardQueryPanel(featureName, screenId, panel) {
+function validateDashboardQueryPanel(featureName, screenId, panel, featureMap) {
     if (!panel.query || typeof panel.query !== "string") {
         throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panel.id}" has empty or non-string query.`);
     }
@@ -1649,7 +1723,11 @@ function validateDashboardQueryPanel(featureName, screenId, panel) {
             throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) list-panel "${panel.id}" has an empty columns list.`);
         }
         for (const col of panel.columns) {
-            validateColumnRendererForm(featureName, screenId, normalizeListColumn(col));
+            const normalized = normalizeListColumn(col);
+            validateColumnRendererForm(featureName, screenId, normalized);
+            if (normalized.refEntity !== undefined) {
+                assertRefTargetRegistered(`[Feature ${featureName}] Screen "${screenId}" (dashboard) list-panel "${panel.id}"`, `column "${normalized.field}" (refEntity)`, normalized.refEntity, featureName, featureMap);
+            }
         }
     }
 }
@@ -1714,10 +1792,14 @@ export function validateColumnRendererForm(featureName, screenId, column) {
 function assertRefTargetRegistered(prefix, subject, refTarget, currentFeatureName, featureMap) {
     const target = parseRefTarget(refTarget, currentFeatureName);
     const targetFeature = featureMap.get(target.featureName);
-    if (targetFeature?.entities?.[target.entityName] === undefined) {
+    if (targetFeature === undefined) {
+        throw new Error(`${prefix} ${subject} targets entity "${refTarget}", but feature "${target.featureName}" is not ` +
+            `mounted — mount it and declare r.requires("${target.featureName}").`);
+    }
+    if (targetFeature.entities?.[target.entityName] === undefined) {
         throw new Error(`${prefix} ${subject} targets entity "${refTarget}", which does not resolve to a ` +
             `registered entity. Known entities in feature "${target.featureName}": ` +
-            `${Object.keys(targetFeature?.entities ?? {})
+            `${Object.keys(targetFeature.entities ?? {})
                 .sort()
                 .join(", ") || "(none)"}.`);
     }
@@ -1758,8 +1840,28 @@ function validateListFacets(prefix, facets, columns, currentFeatureName, feature
         }
         if (facet.type === "reference") {
             assertRefTargetRegistered(prefix, `facet "${facet.field}" (type "reference")`, facet.entity, currentFeatureName, featureMap);
+            assertReferenceListHandlerRegistered(prefix, `facet "${facet.field}" (type "reference")`, facet.entity, currentFeatureName, featureMap);
+        }
+    }
+}
+// The facet's options are loaded at render time by dispatching the target's
+// list query (renderer useReferenceLookup, incl. its REFERENCE_LOOKUP_SOURCES
+// override); a missing or unregistered handler is swallowed there and leaves
+// a permanently empty dropdown, so it has to fail at boot instead.
+function assertReferenceListHandlerRegistered(prefix, subject, refTarget, currentFeatureName, featureMap) {
+    const target = parseRefTarget(refTarget, currentFeatureName);
+    const override = REFERENCE_LOOKUP_SOURCES[`${target.featureName}:${target.entityName}`];
+    const expectedQn = override?.queryQn ??
+        qualifyEntityName(target.featureName, "query", `${target.entityName}:list`);
+    for (const feature of featureMap.values()) {
+        for (const handlerName of Object.keys(feature.queryHandlers ?? {})) {
+            // skip: expected list handler found
+            if (qualifyEntityName(feature.name, "query", handlerName) === expectedQn)
+                return;
         }
     }
+    throw new Error(`${prefix} ${subject} loads its options from query "${expectedQn}", which is not a registered ` +
+        `query handler — register the entity's list handler (defineEntityListHandler) or the facet renders an empty dropdown.`);
 }
 export function findEntityFeature(entityName, featureMap) {
     for (const [name, feature] of featureMap) {

package/dist/engine/boot-validator/transfer-graph.js

@@ -40,9 +40,10 @@ function referenceTargets(entity) {
     return targets;
 }
 // A `multiple` reference stores a jsonb array of ids, which the handover's
-// `= ANY($ids)` column match cannot address. Declaring one on a transferable
-// entity would mean its rows never move with their host.
-function validateNoMultipleReferenceEdge(entry, featureName) {
+// `= ANY($ids)` column match cannot address. Declaring one towards a transferable
+// entity would mean its rows never move with their host. A target outside the
+// graph (e.g. a plain lookup) is never a host, so it cannot strand anything.
+function validateNoMultipleReferenceEdge(entry, featureName, transferable) {
     // skip: the entity never travels, so the shape that would strand its rows
     // during a handover cannot arise — rejecting it would break consumers that
     // legitimately declare a multiple reference on a non-transferable entity.
@@ -51,6 +52,8 @@ function validateNoMultipleReferenceEdge(entry, featureName) {
     for (const [fieldName, field] of Object.entries(entry.entity.fields)) {
         if (field.type !== "reference" || field.multiple !== true)
             continue;
+        if (!transferable.has(parseRefTargetEntityName(field.entity)))
+            continue;
         throw new Error(`[Kumiko TransferGraph] entity "${entry.name}" declares transferable: true and a ` +
             `multiple reference field "${fieldName}" -> "${field.entity}" (feature: "${featureName}"). ` +
             `A multiple reference stores a jsonb array, which the tenant-handover transfer graph ` +
@@ -85,12 +88,12 @@ function longestTransferableChain(startName, bySource, onPath) {
     return undefined;
 }
 export function validateTransferGraph(feature, featureMap) {
-    for (const [name, entity] of Object.entries(feature.entities ?? {})) {
-        validateNoMultipleReferenceEdge({ name, entity }, feature.name);
-    }
     const transferable = new Set(allEntities(featureMap)
         .filter((e) => e.entity.transferable === true)
         .map((e) => e.name));
+    for (const [name, entity] of Object.entries(feature.entities ?? {})) {
+        validateNoMultipleReferenceEdge({ name, entity }, feature.name, transferable);
+    }
     // Edges point child -> parent in the schema; the graph walks parent -> child,
     // so the lookup is inverted here.
     const childrenByParent = new Map();

package/dist/engine/boot-validator/url-prefill-fields.js

@@ -20,12 +20,14 @@ function subtitlePartNavigates(screen) {
 function projectionDetailNavigateActions(screen) {
     return [
         ...scopeActions(screen.actions, screen.detailFor),
-        ...screen.layout.sections.flatMap((section) => section.kind === "relatedList" ? scopeActions(section.rowActions, undefined) : []),
-        ...screen.layout.sections.flatMap((section) => section.kind === "relatedList"
-            ? scopeActions(section.toolbarActions, undefined, {
-                pick: [relatedListParentParamField(section)],
-            })
-            : []),
+        ...screen.layout.sections.flatMap((section) => section.kind !== "relatedList"
+            ? []
+            : [
+                ...scopeActions(section.rowActions, undefined),
+                ...scopeActions(section.toolbarActions, undefined, {
+                    pick: [relatedListParentParamField(section)],
+                }),
+            ]),
         ...(screen.metrics ?? []).flatMap((metric) => typeof metric === "string" || metric.navigate === undefined
             ? []
             : scopeActions([metric.navigate], undefined)),

package/dist/engine/boot-validator/zod-shape.js

@@ -1,4 +1,4 @@
-import { ZodArray, ZodCatch, ZodDefault, ZodIntersection, ZodLazy, ZodNonOptional, ZodNullable, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodReadonly, ZodRecord, ZodTuple, ZodUnion, ZodXor, } from "zod";
+import { ZodArray, ZodCatch, ZodDefault, ZodIntersection, ZodLazy, ZodMap, ZodNonOptional, ZodNullable, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodPromise, ZodReadonly, ZodRecord, ZodSet, ZodTuple, ZodUnion, ZodXor, } from "zod";
 // Drills through wrapper types (.nullable(), .optional(), .default()) a
 // handler's schema may use around its actual object/array shape — e.g. a
 // detail query returning `Row | null` when the record doesn't exist.
@@ -27,7 +27,10 @@ export function getZodObjectShape(schema) {
     if (schema === undefined)
         return undefined;
     const unwrapped = unwrapZodType(schema);
-    return unwrapped instanceof ZodObject ? unwrapped.shape : undefined;
+    // loose()/catchall() objects accept keys beyond the declared shape, so the
+    // declared keys are not the full set callers may legitimately reference.
+    const hasOpenKeys = unwrapped instanceof ZodObject && unwrapped.def.catchall !== undefined;
+    return unwrapped instanceof ZodObject && !hasOpenKeys ? unwrapped.shape : undefined;
 }
 // The shape of one row for a query whose result follows the paged-list
 // contract `{ rows: T[], nextCursor, total? }` (projectionList/relatedList/
@@ -68,12 +71,22 @@ function combinatorChildSchemas(schema) {
     return [];
 }
 function childSchemas(schema) {
-    if (schema instanceof ZodObject)
-        return Object.values(schema.shape);
+    if (schema instanceof ZodObject) {
+        // .catchall()/z.looseObject() values: keys are arbitrary, but a nested
+        // object inside the catchall schema can still carry personal-data fields.
+        const { catchall } = schema.def;
+        return catchall ? [...Object.values(schema.shape), catchall] : Object.values(schema.shape);
+    }
     if (schema instanceof ZodArray)
         return [schema.element];
     if (schema instanceof ZodRecord)
         return [schema.valueType];
+    if (schema instanceof ZodMap)
+        return [schema.keyType, schema.valueType];
+    if (schema instanceof ZodSet)
+        return [schema.def.valueType];
+    if (schema instanceof ZodPromise)
+        return [schema.unwrap()];
     if (schema instanceof ZodTuple) {
         const { items, rest } = schema.def;
         return rest ? [...items, rest] : items;

package/dist/engine/build-app-schema.js

@@ -29,12 +29,14 @@
 import { ZodObject } from "zod";
 import { collectUrlPrefillFieldsByScreenQn } from "./boot-validator/url-prefill-fields.js";
 import { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, } from "./build-config-feature-schema.js";
-import { qualifyEntityName } from "./qualified-name.js";
+import { isEncryptedAtRest } from "./config-helpers.js";
+import { QnTypes, qualifyEntityName } from "./qualified-name.js";
 export function buildAppSchema(registry, options = {}) {
     const features = [];
     const urlPrefillFieldsByScreenQn = collectUrlPrefillFieldsByScreenQn([
         ...registry.features.values(),
     ]);
+    const encryptedConfigKeyQns = collectEncryptedConfigKeyQns(registry);
     for (const [featureName, feature] of registry.features) {
         const navs = Object.values(feature.navs);
         // The nav entry alone doesn't say which kind a collection lists, so the
@@ -47,7 +49,7 @@ export function buildAppSchema(registry, options = {}) {
         const featureSchema = {
             featureName,
             entities: projectEntities(feature.entities ?? {}),
-            screens: projectScreens(featureName, feature.screens, registry, urlPrefillFieldsByScreenQn),
+            screens: projectScreens(featureName, feature.screens, registry, urlPrefillFieldsByScreenQn, encryptedConfigKeyQns),
             ...(navs.length > 0 && { navs }),
             ...(contentCollections.length > 0 && { contentCollections }),
             // #1059: verbatim r.translations({keys}) — see FeatureSchema.translations
@@ -262,8 +264,10 @@ export function findNonJsonSafePath(value, path) {
 // (fw#2165). A hand-written `searchable: true` still wins over the derived
 // default (screen.searchable ?? derived); the boot-validator (3a) rejects
 // one that contradicts the schema.
-function projectScreens(featureName, screens, registry, urlPrefillFieldsByScreenQn) {
+function projectScreens(featureName, screens, registry, urlPrefillFieldsByScreenQn, encryptedConfigKeyQns) {
     return Object.entries(screens).map(([shortId, screen]) => {
+        if (screen.type === "configEdit")
+            return projectConfigEditScreen(screen, encryptedConfigKeyQns);
         if (screen.type === "projectionList")
             return projectProjectionListScreen(screen, registry);
         if (screen.type === "actionForm" ||
@@ -275,6 +279,31 @@ function projectScreens(featureName, screens, registry, urlPrefillFieldsByScreen
         return screen;
     });
 }
+function collectEncryptedConfigKeyQns(registry) {
+    const qns = new Set();
+    for (const [featureName, feature] of registry.features) {
+        for (const [key, def] of Object.entries(feature.configKeys)) {
+            if (isEncryptedAtRest(def))
+                qns.add(qualifyEntityName(featureName, QnTypes.config, key));
+        }
+    }
+    return qns;
+}
+// A hand-written configEdit field over an encrypted-at-rest key would load the
+// read mask as editable text and a partial edit would overwrite the secret with
+// it. Forcing writeOnly here matches what deriveField does for generated screens.
+function projectConfigEditScreen(screen, encryptedConfigKeyQns) {
+    let fields;
+    for (const [fieldName, field] of Object.entries(screen.fields)) {
+        const qualified = screen.configKeys[fieldName];
+        if (field.type !== "text" || qualified === undefined || !encryptedConfigKeyQns.has(qualified)) {
+            continue;
+        }
+        fields ??= { ...screen.fields };
+        fields[fieldName] = { ...field, writeOnly: true };
+    }
+    return fields === undefined ? screen : { ...screen, fields };
+}
 function projectProjectionListScreen(screen, registry) {
     const schema = registry.getQueryHandler(screen.query)?.schema;
     const capabilities = deriveProjectionListCapabilities(schema);
@@ -384,7 +413,7 @@ function projectField(fieldDef) {
     // Select: options-Liste ist plain JSON, durchschicken.
     if (Array.isArray(def["options"]))
         out["options"] = def["options"];
-    if (isPlainObject(def["optionTones"]) && isJsonSafeValue(def["optionTones"]))
+    if (isJsonSafeObject(def["optionTones"]))
         out["optionTones"] = def["optionTones"];
     // Reference: entity-Target + labelField + multiple müssen zum Renderer.
     // Der ReferenceInput baut die Options-Query aus refEntity/refFeature und
@@ -410,8 +439,7 @@ function projectField(fieldDef) {
         out["maxRows"] = def["maxRows"];
     // text/longText: textarea row count — DefaultInput renders a single-line
     // input otherwise (fw#2497).
-    if (typeof def["multiline"] === "boolean" ||
-        (isPlainObject(def["multiline"]) && isJsonSafeValue(def["multiline"])))
+    if (typeof def["multiline"] === "boolean" || isJsonSafeObject(def["multiline"]))
         out["multiline"] = def["multiline"];
     // number: Zod write-boundary bounds. date/timestamp/locatedTimestamp:
     // ISO-string picker bounds — same keys, different literal type (fw#2497).
@@ -439,16 +467,19 @@ function projectField(fieldDef) {
     // refuse any prefill (URL or handoff) into the field.
     if (def["sensitive"] === true)
         out["sensitive"] = true;
+    // Without it the renderer shows a plain text input for a field whose value never leaves the server.
+    if (def["writeOnly"] === true)
+        out["writeOnly"] = true;
     // timestamp: the edit view-model derives its wall-clock input mode from this.
     if (typeof def["locatedBy"] === "string")
         out["locatedBy"] = def["locatedBy"];
     // file/image/images: upload picker constraints; the first variant key picks
     // the preview variant.
-    if (Array.isArray(def["accept"]) && isJsonSafeValue(def["accept"]))
+    if (isJsonSafeArray(def["accept"]))
         out["accept"] = def["accept"];
     if (typeof def["maxSize"] === "string")
         out["maxSize"] = def["maxSize"];
-    if (isPlainObject(def["variants"]) && isJsonSafeValue(def["variants"]))
+    if (isJsonSafeObject(def["variants"]))
         out["variants"] = def["variants"];
     // decimal, incl. embedded sub-fields: rounding of derived embedded-list cells.
     if (typeof def["scale"] === "number")
@@ -456,7 +487,7 @@ function projectField(fieldDef) {
     // money: declared currency source (MoneyCurrencySource, fw#2933) — without
     // it the renderer can't tell a "currency: { kind: 'tenant' }" field apart
     // from an undeclared one and always falls back to entity.defaultCurrency.
-    if (isPlainObject(def["currency"]) && isJsonSafeValue(def["currency"]))
+    if (isJsonSafeObject(def["currency"]))
         out["currency"] = def["currency"];
     // embedded lists: row-count bounds, computed cells, totals row, and the
     // sibling-money-field totals check (fw#2497).
@@ -464,11 +495,11 @@ function projectField(fieldDef) {
         out["minItems"] = def["minItems"];
     if (typeof def["maxItems"] === "number")
         out["maxItems"] = def["maxItems"];
-    if (isPlainObject(def["derived"]) && isJsonSafeValue(def["derived"]))
+    if (isJsonSafeObject(def["derived"]))
         out["derived"] = def["derived"];
-    if (Array.isArray(def["totals"]) && isJsonSafeValue(def["totals"]))
+    if (isJsonSafeArray(def["totals"]))
         out["totals"] = def["totals"];
-    if (isPlainObject(def["totalsMatch"]) && isJsonSafeValue(def["totalsMatch"]))
+    if (isJsonSafeObject(def["totalsMatch"]))
         out["totalsMatch"] = def["totalsMatch"];
     // embedded lists: the sub-field map itself — without it the client-side
     // edit view-model iterates `undefined` and the screen crashes (fw#2507).
@@ -486,15 +517,30 @@ function isPlainObject(value) {
     const proto = Object.getPrototypeOf(value);
     return proto === Object.prototype || proto === null;
 }
-function isJsonSafeValue(value) {
+function isJsonSafeObject(value) {
+    return isPlainObject(value) && isJsonSafeValue(value);
+}
+function isJsonSafeArray(value) {
+    return Array.isArray(value) && isJsonSafeValue(value);
+}
+// `ancestors` tracks the current path only, so a shared (non-cyclic) sub-object
+// stays valid while a self-reference returns false instead of overflowing the stack.
+function isJsonSafeValue(value, ancestors = new Set()) {
     if (value === null)
         return true;
     const t = typeof value;
-    if (t === "string" || t === "number" || t === "boolean")
+    if (t === "string" || t === "boolean")
         return true;
-    if (Array.isArray(value))
-        return value.every(isJsonSafeValue);
-    if (isPlainObject(value))
-        return Object.values(value).every(isJsonSafeValue);
-    return false;
+    // NaN/Infinity serialize to null via JSON.stringify.
+    if (t === "number")
+        return Number.isFinite(value);
+    if (typeof value !== "object" || !(Array.isArray(value) || isPlainObject(value)))
+        return false;
+    if (ancestors.has(value))
+        return false;
+    ancestors.add(value);
+    const children = Array.isArray(value) ? value : Object.values(value);
+    const safe = children.every((child) => isJsonSafeValue(child, ancestors));
+    ancestors.delete(value);
+    return safe;
 }