@cosmicdrift/kumiko-framework 0.351.0 → 0.353.0

package/dist/engine/boot-validator/screens.js

@@ -4,7 +4,7 @@
 // into validateColumnRendererForm, splitting them would create a
 // same-folder require cycle.
 import { resolveActionIcon } from "@cosmicdrift/kumiko-types/action-icon";
-import { NO_WIDGET_FIELD_TYPES, optionsQueryFieldRefs } from "@cosmicdrift/kumiko-types/fields";
+import { NO_WIDGET_FIELD_TYPES, optionsQueryFieldRefs, SELECT_OPTION_TONES, } from "@cosmicdrift/kumiko-types/fields";
 import { NAV_ICON_KEYS } from "@cosmicdrift/kumiko-types/nav-icon";
 import { rowMetaFieldNames } from "../../db/table-builder.js";
 import { REFERENCE_LOOKUP_SOURCES } from "../../ui-types/list-row-meta.js";
@@ -12,9 +12,10 @@ import { isEncryptedAtRest } from "../config-helpers.js";
 import { parseRefTarget } from "../parse-ref-target.js";
 import { isKebabSegment, isValidQn, qualifyEntityName } from "../qualified-name.js";
 import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops.js";
-import { isExtensionEditSection, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../screen-helpers.js";
+import { isExtensionEditSection, isFieldsEditSection, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../screen-helpers.js";
 import { metricField } from "../types/index.js";
 import { LIST_ROW_META_COLUMN_NAMES } from "./entity-list-screens.js";
+import { isSelectOptionTone } from "./select-option-tone.js";
 // entityList and projectionList both allow a rowAction to double as the
 // row-body click target (rowClick: true, fw#1708/#2164) — at most one per
 // screen, or the renderer can't tell which one should fire.
@@ -345,19 +346,41 @@ function validateDrawerTargetAction(featureName, screenId, screenKind, actionLab
             `kind:"drawer" mounts an actionForm inside a Drawer widget — point "screen" at an ` +
             `actionForm screen, or use kind:"navigate" for a full-page target.`);
     }
-    // A prefill key the target form doesn't declare is dropped silently by the
-    // renderer (mergeSearchParamsIntoInitial iterates the target's fields), so
-    // the typo would only show up as an empty field at click time.
+    // The renderer (mergeSearchParamsIntoInitial) silently drops a prefill key
+    // when the target doesn't declare the field, marks it sensitive/password,
+    // or doesn't render it in its layout — each would only show up as an empty
+    // field at click time.
     // skip: no params extractor — nothing to check against the target's fields.
     if (action.params === undefined)
         return;
-    for (const fieldName of rowFieldExtractorKeys(action.params)) {
-        if (Object.hasOwn(target.fields, fieldName))
+    validateDrawerPrefillKeys(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}"`, action.screen, target, action.params);
+}
+function validateDrawerPrefillKeys(where, targetScreenId, target, params) {
+    const renderedFieldNames = new Set();
+    for (const section of target.layout.sections) {
+        if (!isFieldsEditSection(section))
             continue;
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +
-            `params prefills "${fieldName}", which drawer-target "${action.screen}" does not declare as a ` +
-            `field — the renderer would drop it and leave the form empty. Target fields: ` +
-            `${Object.keys(target.fields).sort().join(", ") || "(none)"}.`);
+        for (const spec of sectionFieldSpecs(section))
+            renderedFieldNames.add(normalizeEditField(spec).field);
+    }
+    for (const fieldName of rowFieldExtractorKeys(params)) {
+        if (!Object.hasOwn(target.fields, fieldName)) {
+            throw new Error(`${where} params prefills "${fieldName}", which drawer-target "${targetScreenId}" does not declare as a ` +
+                `field — the renderer would drop it and leave the form empty. Target fields: ` +
+                `${Object.keys(target.fields).sort().join(", ") || "(none)"}.`);
+        }
+        const targetField = target.fields[fieldName];
+        const isSensitiveOrPassword = targetField !== undefined &&
+            (("sensitive" in targetField && targetField.sensitive === true) ||
+                ("format" in targetField && targetField.format === "password"));
+        if (isSensitiveOrPassword) {
+            throw new Error(`${where} params prefills "${fieldName}", which drawer-target "${targetScreenId}" marks as ` +
+                `sensitive or password — the renderer never prefills those fields and would leave the form empty.`);
+        }
+        if (!renderedFieldNames.has(fieldName)) {
+            throw new Error(`${where} params prefills "${fieldName}", which drawer-target "${targetScreenId}" does not render in ` +
+                `its layout — the renderer only prefills fields the layout shows and would drop it.`);
+        }
     }
 }
 // The target can be any screen, so this checks the resolved target's
@@ -493,7 +516,8 @@ function rejectWriteOnlyFormField(featureName, screenId, context, fieldName, fde
     }
 }
 // Static options XOR optionsQuery on inline-form select fields, and `{ field }`
-// payload refs must name another field of the same form. The QN existence check
+// payload refs must name another field of the same form (the payload also feeds
+// optionsAvailabilityQuery). The QN existence check
 // lives in query-refs.ts with the other query refs.
 function validateFormSelectOptions(featureName, screenId, context, fieldName, fdef, siblingFieldNames) {
     if (fdef.type === "select") {
@@ -507,6 +531,12 @@ function validateFormSelectOptions(featureName, screenId, context, fieldName, fd
             }
             validateOptionsQueryFieldRefs(where, fieldName, fdef.optionsQueryPayload, siblingFieldNames);
         }
+        else if (fdef.optionsAvailabilityQuery !== undefined) {
+            if (fdef.optionsAvailabilityQuery.length === 0) {
+                throw new Error(`${where} has an empty optionsAvailabilityQuery`);
+            }
+            validateOptionsQueryFieldRefs(where, fieldName, fdef.optionsQueryPayload, siblingFieldNames);
+        }
         else if (fdef.optionsQueryPayload !== undefined) {
             throw new Error(`${where} has optionsQueryPayload without optionsQuery`);
         }
@@ -557,7 +587,7 @@ function validateFieldsXorGroups(errorPrefix, section) {
         throw new Error(`${errorPrefix} section "${section.title}" declares both fields and groups — pass fields: [] ` +
             `when using groups.`);
     }
-    if (section.fields.length === 0 && section.groups === undefined) {
+    if (section.fields.length === 0 && (section.groups?.length ?? 0) === 0) {
         throw new Error(`${errorPrefix} has a section "${section.title}" with zero fields — drop the section or add ` +
             `fields (or groups) to it.`);
     }
@@ -1041,6 +1071,12 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                     }
                 }
             }
+            for (const [statusValue, tone] of Object.entries(screen.header?.statusTones ?? {})) {
+                if (!isSelectOptionTone(tone)) {
+                    throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) header.statusTones["${statusValue}"] ` +
+                        `is "${String(tone)}" — expected one of ${SELECT_OPTION_TONES.join(", ")}.`);
+                }
+            }
             if (Array.isArray(screen.header?.subtitle)) {
                 if (screen.header.subtitleHref !== undefined) {
                     throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) sets header.subtitleHref ` +
@@ -1736,6 +1772,11 @@ function validateDashboardPanelVisibleWhen(context, visibleWhen) {
         throw new Error(`${context} visibleWhen needs a non-empty query and field.`);
     }
 }
+function validateDashboardPanelSpan(featureName, screenId, panel) {
+    if (panel.span !== undefined && panel.span !== "half" && panel.span !== "full") {
+        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panel.id}" has span "${String(panel.span)}" — expected "half" or "full".`);
+    }
+}
 function validateDashboardStatGroupPanel(featureName, screenId, panel, addPanelId) {
     const context = `[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-group "${panel.id}"`;
     if (panel.stats.length === 0) {
@@ -1744,6 +1785,7 @@ function validateDashboardStatGroupPanel(featureName, screenId, panel, addPanelI
     if (panel.subtitle !== undefined && panel.label === undefined) {
         throw new Error(`${context} sets subtitle without label — an unlabeled group renders as a KPI strip without a header.`);
     }
+    validateDashboardPanelSpan(featureName, screenId, panel);
     validateDashboardPanelVisibleWhen(context, panel.visibleWhen);
     for (const stat of panel.stats) {
         addPanelId(stat.id, "stat-group child");
@@ -1769,8 +1811,9 @@ function validateDashboardChartDisplay(featureName, screenId, panel) {
         throw new Error(`${where} sets scrollable on chart "${panel.chart}" — only "stacked-area" supports it.`);
     }
     validateStackedAreaOnlyProps(where, panel);
-    if (panel.legendTotals !== undefined && typeof panel.legendTotals !== "boolean") {
-        throw new Error(`${where} has a non-boolean legendTotals.`);
+    const nonBooleanProp = ["brush", "legendTotals"].find((prop) => panel[prop] !== undefined && typeof panel[prop] !== "boolean");
+    if (nonBooleanProp !== undefined) {
+        throw new Error(`${where} has a non-boolean ${nonBooleanProp}.`);
     }
     for (const [key, color] of Object.entries(panel.seriesColors ?? {})) {
         if (typeof color !== "string" || color.trim() === "") {
@@ -1787,7 +1830,7 @@ function validateStackedAreaOnlyProps(where, panel) {
     // skip: stacked-area is the one chart kind that supports these props
     if (panel.chart === "stacked-area")
         return;
-    const stackedAreaOnly = ["markerKinds", "legendTotals", "ranges"].filter((prop) => panel[prop] !== undefined);
+    const stackedAreaOnly = ["markerKinds", "legendTotals", "ranges", "brush"].filter((prop) => panel[prop] !== undefined);
     if (stackedAreaOnly.length > 0) {
         throw new Error(`${where} sets ${stackedAreaOnly.join(", ")} on chart "${panel.chart}" — only "stacked-area" supports it.`);
     }
@@ -1856,12 +1899,7 @@ function validateDashboardQueryPanel(featureName, screenId, panel, featureMap) {
     if (!panel.query || typeof panel.query !== "string") {
         throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panel.id}" has empty or non-string query.`);
     }
-    if ("span" in panel &&
-        panel.span !== undefined &&
-        panel.span !== "half" &&
-        panel.span !== "full") {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panel.id}" has span "${String(panel.span)}" — expected "half" or "full".`);
-    }
+    validateDashboardPanelSpan(featureName, screenId, panel);
     if (panel.kind === "stat") {
         if (panel.valueField.length === 0) {
             throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-panel "${panel.id}" has empty valueField.`);

package/dist/engine/boot-validator/select-option-tone.d.ts

@@ -0,0 +1,2 @@
+import { type SelectOptionTone } from "@cosmicdrift/kumiko-types/fields";
+export declare function isSelectOptionTone(value: unknown): value is SelectOptionTone;

package/dist/engine/boot-validator/select-option-tone.js

@@ -0,0 +1,4 @@
+import { SELECT_OPTION_TONES } from "@cosmicdrift/kumiko-types/fields";
+export function isSelectOptionTone(value) {
+    return SELECT_OPTION_TONES.some((tone) => tone === value);
+}

package/dist/engine/build-app-schema.js

@@ -268,6 +268,7 @@ export function findNonJsonSafePath(value, path) {
 // one that contradicts the schema.
 function projectScreens(featureName, screens, registry, urlPrefillFieldsByScreenQn, encryptedConfigKeyQns) {
     return Object.entries(screens).map(([shortId, screen]) => {
+        assertValidScreenMultilineRows(featureName, shortId, screen);
         if (screen.type === "configEdit")
             return projectConfigEditScreen(screen, encryptedConfigKeyQns);
         if (screen.type === "projectionList")
@@ -330,7 +331,7 @@ function deriveProjectionListCapabilities(schema) {
 function projectEntities(entities) {
     const out = {};
     for (const [name, entity] of Object.entries(entities)) {
-        out[name] = projectEntity(entity);
+        out[name] = projectEntity(name, entity);
     }
     return out;
 }
@@ -339,9 +340,10 @@ function projectEntities(entities) {
 // einzeln auszuhandeln, walken wir die Field-Map und filtern auf die
 // Whitelist. Was nicht durchkommt: Server-only-runtime wie ZodValidate-
 // Functions, Computed-Functions, Default-Functions.
-function projectEntity(entity) {
+function projectEntity(entityName, entity) {
     const fieldsOut = {};
     for (const [fieldName, fieldDef] of Object.entries(entity.fields)) {
+        assertValidMultilineRows(`Entity "${entityName}"`, fieldName, fieldDef);
         fieldsOut[fieldName] = projectField(fieldDef);
     }
     // derivedFields MÜSSEN mit ins Client-Schema (nur die Metadaten, nicht die
@@ -380,6 +382,32 @@ function projectEntity(entity) {
 function projectDerivedField(derivedDef) {
     return { valueType: derivedDef.valueType };
 }
+// A textarea height that is not a positive integer cannot render anywhere; fail
+// at boot with the field name instead of letting each renderer guess a fallback.
+function assertValidMultilineRows(owner, fieldName, fieldDef) {
+    const multiline = fieldDef.type === "text" || fieldDef.type === "longText" ? fieldDef.multiline : undefined;
+    const rows = typeof multiline === "object" ? multiline.rows : undefined;
+    // Non-number values are not JSON-safe and get dropped by the projection below.
+    if (typeof rows === "number" && (!Number.isInteger(rows) || rows < 1)) {
+        throw new Error(`${owner} field "${fieldName}": multiline.rows must be a positive integer, got ${rows}`);
+    }
+}
+// Screen forms carry their own inline field maps into the client schema.
+function assertValidScreenMultilineRows(featureName, shortId, screen) {
+    const owner = `Screen "${featureName}:${shortId}"`;
+    const check = (fields) => {
+        for (const [fieldName, fieldDef] of Object.entries(fields)) {
+            assertValidMultilineRows(owner, fieldName, fieldDef);
+        }
+    };
+    if (screen.type === "configEdit" || screen.type === "actionForm")
+        check(screen.fields);
+    if (screen.type === "secretMint") {
+        check(screen.fields);
+        if (screen.confirm !== undefined)
+            check(screen.confirm.fields);
+    }
+}
 // Per-field whitelist. Every forwarded value must be JSON-safe (literal, or
 // an array/plain-object built only from JSON-safe values) — even though the
 // FieldDefinition types only type `default` as a literal, the sample-authoring
@@ -428,6 +456,9 @@ function projectField(fieldDef) {
     // fw#2780: author-supplied picker source — without it the client falls back to the list handler.
     if (typeof def["optionsQuery"] === "string")
         out["optionsQuery"] = def["optionsQuery"];
+    // Select: tier/tenant availability of the static options, loaded by the renderer.
+    if (typeof def["optionsAvailabilityQuery"] === "string")
+        out["optionsAvailabilityQuery"] = def["optionsAvailabilityQuery"];
     if (typeof def["multiple"] === "boolean")
         out["multiple"] = def["multiple"];
     // MultiSelect: display picks checkboxes vs. combobox in the renderer,

package/dist/engine/build-config-feature-schema.js

@@ -415,10 +415,16 @@ function buildSecretsEditScreen(screenId, secrets, access, declaredTranslationKe
     // need a writable local type; each entry is still a fresh, never-mutated object.
     const translations = {};
     const sections = [];
+    const seenFieldIds = new Map();
     for (const feature of [...new Set(secrets.map((s) => s.feature))]) {
         const fieldIds = [];
         for (const s of secrets.filter((v) => v.feature === feature)) {
             const fieldId = `${s.feature}-${s.shortKey}`;
+            const prevQn = seenFieldIds.get(fieldId);
+            if (prevQn !== undefined) {
+                throw new Error(`[Settings-Hub] secrets "${prevQn}" and "${s.qn}" both resolve to field id "${fieldId}" — rename one secret or its feature.`);
+            }
+            seenFieldIds.set(fieldId, s.qn);
             fieldIds.push(fieldId);
             secretKeys[fieldId] = s.qn;
             const labelKey = `config.secret.${s.feature}.${s.shortKey}.label`;

package/dist/engine/dedupe-features.js

@@ -6,15 +6,31 @@ function dedupeOptionsShallowEqual(a, b) {
     }
     return true;
 }
+function sameKeys(a, b) {
+    const aKeys = Object.keys(a ?? {});
+    const bKeys = new Set(Object.keys(b ?? {}));
+    return aKeys.length === bKeys.size && aKeys.every((key) => bKeys.has(key));
+}
+// dedupeOptions is a declaration, not proof: two same-named features that both
+// carry `{}` but register different surface must still clash, not silently drop one.
+function sameRegisteredSurface(a, b) {
+    return (sameKeys(a.entities, b.entities) &&
+        sameKeys(a.writeHandlers, b.writeHandlers) &&
+        sameKeys(a.queryHandlers, b.queryHandlers) &&
+        sameKeys(a.streamHandlers, b.streamHandlers));
+}
 function isInterchangeable(existing, next) {
     if (existing === next)
         return true;
     if (existing.dedupeOptions !== undefined && next.dedupeOptions !== undefined) {
-        return dedupeOptionsShallowEqual(existing.dedupeOptions, next.dedupeOptions);
+        return (dedupeOptionsShallowEqual(existing.dedupeOptions, next.dedupeOptions) &&
+            sameRegisteredSurface(existing, next));
     }
     return false;
 }
 // First occurrence wins: runtimes late-bind closure state (sessions' autoRevoke) on the kept instance.
+// An app holding its own handle to a later, dropped instance would bind state the registry never
+// runs — resolve the kept instance from the composed list (`features.find(name)`), not a local handle.
 export function dedupeFeatures(features) {
     const byName = new Map();
     const result = [];

package/dist/engine/entity-handlers.js

@@ -198,11 +198,14 @@ export function defineEntityWriteHandler(name, entity, options) {
     // query-handler branch below: this ONE write handler reads/writes across
     // every tenant without making the whole feature r.systemScope().
     const crossTenantReason = resolveCrossTenantReason(name, options);
+    // create always writes into the acting user's own tenant, so its FK,
+    // unique and preSave lookups must stay tenant-filtered even when the
+    // handler declares cross-tenant access for the row-addressing verbs.
     const dbFor = (ctx) => {
         if (ctx.systemDb) {
             return ctx.systemDb.acknowledgeCrossTenant(`entity convention handler for r.systemScope() feature (${name})`);
         }
-        return crossTenantReason !== undefined
+        return crossTenantReason !== undefined && verb !== "create"
             ? acknowledgeConventionCrossTenant(ctx.db, crossTenantReason)
             : ctx.db;
     };
@@ -539,18 +542,24 @@ export function registerEntityCrud(r, entityName, entity, options) {
     };
     const resolveWriteOpts = (verb) => {
         const excludeFields = verb === "create" || verb === "update" ? options?.excludeFields?.[verb] : undefined;
+        const verbAgent = options?.agents?.[verb];
         return {
             ...writeOpts,
             access: requireAccess(verb, options?.verbAccess?.[verb] ?? writeOpts?.access),
             description: options?.descriptions?.[verb] ?? writeOpts?.description,
+            ...(verbAgent !== undefined && { agent: verbAgent }),
             ...(excludeFields !== undefined && { excludeFields }),
         };
     };
-    const resolveReadOpts = (verb) => ({
-        ...readOpts,
-        access: requireAccess(verb, options?.verbAccess?.[verb] ?? readOpts?.access),
-        description: options?.descriptions?.[verb] ?? readOpts?.description,
-    });
+    const resolveReadOpts = (verb) => {
+        const verbAgent = options?.agents?.[verb];
+        return {
+            ...readOpts,
+            access: requireAccess(verb, options?.verbAccess?.[verb] ?? readOpts?.access),
+            description: options?.descriptions?.[verb] ?? readOpts?.description,
+            ...(verbAgent !== undefined && { agent: verbAgent }),
+        };
+    };
     if (verbs.create) {
         r.writeHandler(defineEntityCreateHandler(entityName, entity, resolveWriteOpts("create")));
     }

package/dist/engine/feature-builder-state.d.ts

@@ -1,8 +1,7 @@
 import type { WebSocketRouteDefinition } from "@cosmicdrift/kumiko-types/websocket-route";
 import type * as z from "zod";
-import type { ZodType } from "zod";
 import type { HttpRouteDefinition } from "./types/http-route.js";
-import type { AuthClaimsFn, BootCheckFn, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventMigrationDef, ExtensionSelectorDef, FeatureMetricDef, JobDefinition, LifecycleHookFn, MultiStreamProjectionDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableEntry, StreamHandlerDef, TranslationKeys, TreeActionDef, UiHints, ValidationHookFn, WriteHandlerDef } from "./types/index.js";
+import type { AuthClaimsFn, BootCheckFn, ClaimKeyDefinition, ConfigKeyDefinition, ConfigSeedDef, EntityDefinition, EntityProjectionExtension, EventDef, EventMigrationDef, ExtensionSelectorDef, FeatureMetricDef, JobDefinition, LifecycleHookFn, MultiStreamProjectionDefinition, NotificationDefinition, OwnedFn, PhasedHook, PostDeleteHookFn, PostQueryHookFn, PostSaveHookFn, PreDeleteHookFn, ProjectionDefinition, QueryHandlerDef, ReferenceDataDef, RegistrarExtensionDef, RegistrarExtensionRegistration, RelationDefinition, SearchPayloadContributorFn, SecretKeyDefinition, SecretNamespaceDefinition, StoreTableEntry, StreamHandlerDef, TranslationKeys, TreeActionDef, UiHints, ValidationHookFn, WriteHandlerDef } from "./types/index.js";
 import type { ContentCollectionDefinition, NavDefinition } from "./types/nav.js";
 import type { ScreenDefinition } from "./types/screen.js";
 import type { WorkspaceDefinition } from "./types/workspace.js";
@@ -23,11 +22,7 @@ export type FeatureBuilderState = {
     configKeys: Record<string, ConfigKeyDefinition>;
     configSeeds: ConfigSeedDef[];
     jobs: Record<string, JobDefinition>;
-    events: Record<string, {
-        name: string;
-        schema: ZodType;
-        version: number;
-    }>;
+    events: Record<string, EventDef>;
     eventMigrations: Record<string, EventMigrationDef[]>;
     configReads: string[];
     entityPostSave: Record<string, PhasedHook<PostSaveHookFn>[]>;

package/dist/engine/feature-config-events-jobs.js

@@ -73,6 +73,9 @@ export function buildConfigEventsJobsMethods(state, name) {
             if (field === normalized.ownerField) {
                 throw new Error(`[Feature ${name}] defineEvent("${eventName}"): piiFields."${field}" cannot use itself as the owner field — the subject id is a plaintext pseudonymous fk, the pii field is the value it owns.`);
             }
+            if (normalized.ownerField === "id") {
+                throw new Error(`[Feature ${name}] defineEvent("${eventName}"): piiFields."${field}" uses owner field "id" — on entities \`of: "id"\` means record-owned, but on events it would encrypt under a phantom user key that a forget never reaches. Use \`personal: "self"\` for a record-owned event field.`);
+            }
             for (const required of [field, normalized.ownerField]) {
                 if (shape && !(required in shape)) {
                     throw new Error(`[Feature ${name}] defineEvent("${eventName}"): piiFields references "${required}" which is not a field of the payload schema.`);

package/dist/engine/feature-entity-handlers.js

@@ -55,7 +55,7 @@ function agentSlots(source) {
     };
 }
 function requireInlineHandlerArgs(kind, schema, handler, options) {
-    if (!schema || !handler || !options) {
+    if (!schema || !handler || !options?.access) {
         throw new Error(`${kind} inline form requires schema + handler + options.access`);
     }
     return { schema, handler, options };

package/dist/engine/i18n-key.js

@@ -1,10 +1,21 @@
 // Dot-form labels are indistinguishable from literal display text ("actions.open"),
 // so authors mark the i18n ones explicitly; the registry is what boot validation reads.
-const explicitDotFormKeys = new Set();
+// Marking is by string value and therefore global across features. The registry sits on
+// globalThis so a second installed copy of the framework still reads the marks the
+// other copy wrote; otherwise they are silently ignored and #2313 reopens.
+const REGISTRY_KEY = Symbol.for("kumiko.i18n.explicitDotFormKeys");
+function explicitDotFormKeys() {
+    const existing = Reflect.get(globalThis, REGISTRY_KEY);
+    if (existing instanceof Set)
+        return existing;
+    const created = new Set();
+    Reflect.set(globalThis, REGISTRY_KEY, created);
+    return created;
+}
 export function i18nKey(value) {
-    explicitDotFormKeys.add(value);
+    explicitDotFormKeys().add(value);
     return value;
 }
 export function isExplicitDotFormKey(value) {
-    return explicitDotFormKeys.has(value);
+    return explicitDotFormKeys().has(value);
 }

package/dist/engine/index.d.ts

@@ -59,7 +59,7 @@ export { createRegistry } from "./registry.js";
 export type { ClampInfo, ResolveOptions } from "./resolve-config-or-param.js";
 export { resolveConfigOrParam } from "./resolve-config-or-param.js";
 export type { AssignableAppRoles, AssignableFromRole } from "./role-assignment.js";
-export { assignableAppRolesFromUsages, assignableAppRolesOf, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
+export { assignableAppRolesFromUsages, assignableAppRolesOf, BUILT_IN_MEMBERSHIP_ROLES, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
 export { runsInLane } from "./run-in.js";
 export type { StepListOutcome } from "./run-pipeline.js";
 export { runPipeline, runStepList } from "./run-pipeline.js";

package/dist/engine/index.js

@@ -55,7 +55,7 @@ export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.js";
 export { readClaim } from "./read-claim.js";
 export { createRegistry } from "./registry.js";
 export { resolveConfigOrParam } from "./resolve-config-or-param.js";
-export { assignableAppRolesFromUsages, assignableAppRolesOf, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
+export { assignableAppRolesFromUsages, assignableAppRolesOf, BUILT_IN_MEMBERSHIP_ROLES, canActorAssignRole, findForbiddenRoleAssignment, isAssignableByRole, mergeAssignedRoles, } from "./role-assignment.js";
 export { runsInLane } from "./run-in.js";
 export { runPipeline, runStepList } from "./run-pipeline.js";
 export { buildInsertSchema, buildUpdateSchema, fieldToZod, SYSTEM_ONLY_JSON_SCHEMA_KEY, } from "./schema-builder.js";

package/dist/engine/pipeline.js

@@ -79,9 +79,26 @@ export function stepsPipeline(closure) {
 // carried in (D4, workflow-resume-loop.md), never an unchecked external
 // value.
 export function buildPipelineSteps(pipelineDef, event) {
-    return pipelineDef.build({
+    const steps = pipelineDef.build({
         event,
         r: stepBuilder,
         awaits: (pipelineDef.awaits ?? {}),
     });
+    assertUniqueWaitForEventTypes(steps);
+    return steps;
+}
+// waitForEvent's result key is the awaited event type, so a second wait on the
+// same type would overwrite the first one's resumed payload.
+function assertUniqueWaitForEventTypes(steps) {
+    const seen = new Set();
+    for (const step of steps) {
+        if (step.kind !== "workflow.waitForEvent")
+            continue;
+        const { event } = step.args; // @cast-boundary engine-payload
+        if (seen.has(event)) {
+            throw new Error(`r.step.waitForEvent: event "${String(event)}" is awaited more than once in one workflow — ` +
+                "each awaits entry can back only one waitForEvent step.");
+        }
+        seen.add(event);
+    }
 }

package/dist/engine/project-app-schema-for-roles.js

@@ -530,20 +530,26 @@ function projectActionFormScreen(screen, feature, indices, keptScreenQns) {
     };
 }
 function projectSecretMintScreen(screen, feature, indices, keptScreenQns) {
-    const { redirect, cancelTarget, layout, listScreenId, ...rest } = screen;
+    const { redirect, cancelTarget, layout, listScreenId, confirm, ...rest } = screen;
     const nextRedirect = projectRedirect(feature.featureName, redirect, keptScreenQns);
     const nextCancelTarget = projectCancelTarget(feature.featureName, cancelTarget, keptScreenQns);
     const nextLayout = projectEditLayout(layout, feature, indices, keptScreenQns);
     const nextListScreenId = projectListScreenId(listScreenId, indices, keptScreenQns);
+    const nextConfirmLayout = confirm === undefined
+        ? undefined
+        : projectEditLayout(confirm.layout, feature, indices, keptScreenQns);
     const unchanged = nextRedirect === redirect &&
         nextCancelTarget === cancelTarget &&
         nextLayout === layout &&
-        nextListScreenId === listScreenId;
+        nextListScreenId === listScreenId &&
+        nextConfirmLayout === confirm?.layout;
     if (unchanged)
         return screen;
     return {
         ...rest,
         layout: nextLayout,
+        ...(confirm !== undefined &&
+            nextConfirmLayout !== undefined && { confirm: { ...confirm, layout: nextConfirmLayout } }),
         ...(nextRedirect !== undefined && { redirect: nextRedirect }),
         ...(nextCancelTarget !== undefined && { cancelTarget: nextCancelTarget }),
         ...(nextListScreenId !== undefined && { listScreenId: nextListScreenId }),

package/dist/engine/role-assignment.d.ts

@@ -1,4 +1,6 @@
 import type { Registry } from "./types/feature.js";
+/** Every membership role the engine ranks, excluding the internal `system` actor. */
+export declare const BUILT_IN_MEMBERSHIP_ROLES: readonly string[];
 declare const ASSIGNABLE_FROM_ROLE_LIST: readonly ["User", "Member", "Editor", "Admin", "TenantAdmin", "SystemAdmin"];
 export type AssignableFromRole = (typeof ASSIGNABLE_FROM_ROLE_LIST)[number];
 /** App role → lowest built-in role allowed to assign it. */

package/dist/engine/role-assignment.js

@@ -16,6 +16,8 @@ const ROLE_RANKS = new Map([
     ["SystemAdmin", 4],
     ["system", 5],
 ]);
+/** Every membership role the engine ranks, excluding the internal `system` actor. */
+export const BUILT_IN_MEMBERSHIP_ROLES = [...ROLE_RANKS.keys()].filter((role) => role !== "system");
 const ASSIGNABLE_FROM_ROLE_LIST = [
     "User",
     "Member",

package/dist/engine/schema-builder.js

@@ -87,6 +87,14 @@ export function fieldToZod(field, currencies, opts = {}) {
             let schema = z.string();
             if (field.maxLength)
                 schema = schema.max(field.maxLength);
+            if (field.minLength) {
+                // "" must stay valid for optional fields and writeOnly updates (""
+                // = unchanged); `required` rejects it separately via min(1) below.
+                const minLength = field.minLength;
+                schema = schema.refine((value) => value.length === 0 || value.length >= minLength, {
+                    message: `at least ${minLength} characters`,
+                });
+            }
             if (field.writeOnly === true) {
                 // Update: "" = unchanged (dropped before the executor), null = clear,
                 // unless required. Create: "" would leave a required field unset.

package/dist/engine/where-rule-lint.js

@@ -17,9 +17,9 @@ const SELF_COMPARISON_RE = new RegExp(`(${QUALIFIED_SRC})\\s*(?<![!<>=])=(?!=)\\
 const QUALIFIED_PARSE_RE = new RegExp(`^(${IDENT_SRC})(?:\\.(${IDENT_SRC}))?$`);
 // Resolve the SQL column names a table exposes, so the lint can tell a
 // real column reference apart from a table alias / function name / SQL
-// keyword. Returns an empty set when nothing is derivable; the column-aware
-// check then finds no bare column and is effectively skipped (only the
-// self-comparison check still applies).
+// keyword. Returns an empty set when nothing is derivable; callers that need
+// the column-aware check must treat that as "unknown" (see
+// assertQualifiedWhereFragment, which fails closed on it).
 export function tableColumnSqlNames(table) {
     if (table === null || typeof table !== "object")
         return new Set();
@@ -182,6 +182,9 @@ export function assertQualifiedWhereFragment(sqlText, columnSqlNames, scope) {
     // the fail-open shape this lint targets is impossible here.
     if (!/\bSELECT\b/i.test(cleaned))
         return;
+    if (columnSqlNames.size === 0) {
+        throw new Error(`[Kumiko Ownership] ${scope}: cannot verify where-rule SQL containing a subquery — the table's column set is unknown, so unqualified column references cannot be detected.`);
+    }
     const unqualified = findUnqualifiedColumnReference(cleaned, columnSqlNames);
     if (unqualified !== null) {
         throw new Error(`[Kumiko Ownership] ${scope}: where-rule SQL references column "${unqualified}" unqualified inside a subquery. Postgres binds an unqualified name to the innermost table first, which silently turns the ownership predicate into a tautology (fail-open). Qualify it with the outer table, e.g. \`\${ctx.tableName}.${unqualified}\`.`);

package/dist/env/index.d.ts

@@ -88,6 +88,10 @@ export type ParseEnvOptions = {
     /** When set, error suggestions include `pulumi config set <prefix>...`. */
     readonly pulumiPrefix?: string;
 };
+/** Validates `env` against `schema` and throws KumikoBootError on any issue.
+ *  A `kms: true` field delivered only as `<NAME>_CIPHERTEXT` passes validation but
+ *  is `undefined` in the result despite its `string` type — it is only set once
+ *  the boot-time decrypt (resolvePlatformKeks) has run. */
 export declare function parseEnv<S extends z.ZodObject<z.ZodRawShape>>(schema: S, env: Record<string, string | undefined>, options?: ParseEnvOptions): z.infer<S>;
 /** Dry-Run-Gegenstück zu parseEnv (KUMIKO_DRY_RUN_ENV-Pfad): parst jedes
  *  Feld einzeln und liefert ein ehrliches Partial — vorhandene Werte kommen

package/dist/env/index.js

@@ -259,6 +259,10 @@ function safeParseReportingThrows(schema, input) {
         ]);
     }
 }
+/** Validates `env` against `schema` and throws KumikoBootError on any issue.
+ *  A `kms: true` field delivered only as `<NAME>_CIPHERTEXT` passes validation but
+ *  is `undefined` in the result despite its `string` type — it is only set once
+ *  the boot-time decrypt (resolvePlatformKeks) has run. */
 export function parseEnv(schema, env, options = {}) {
     // Filter undefined values to keep Zod's required-vs-invalid signal clean.
     // (process.env returns string|undefined; passing undefined would parse