@cosmicdrift/kumiko-framework 0.360.0 → 0.362.0

package/dist/db/queries/backfill-pii.js

@@ -8,7 +8,7 @@
 //   - entity lifecycle events (<entity>.created/updated/deleted/forgotten/
 //     restored) for every entity with PII subject annotations — generic over
 //     subject kind (user/tenant/record, fw#2790), since it goes through the
-//     same collectPiiSubjectFields/resolveSubjectForField the live write
+//     same collectPiiEncryptedFields/resolveSubjectForField the live write
 //     path uses
 //   - custom events from the event-PII catalog (r.defineEvent piiFields) —
 //     user/tenant/self subjects, via the same resolveEventSubject the live
@@ -41,6 +41,9 @@
 //      unresolvable (hard-deleted aggregate, no projection) → PII_ERASED_SENTINEL.
 //   Stages 2 and 3 are opt-in and off by default; without them an
 //   unresolvable subject still fails loud into `failures`, as before.
+//   4. owner re-key ({@link PiiBackfillOptions.rekeyTenantKeyedOwnerFields}) —
+//   tenant-keyed ciphertext of a userOwned field moves under the user the
+//   strict chain (stages 1+2, never whenAbsent) names.
 //
 // Snapshots of touched aggregates are dropped per batch (they may cache
 // plaintext); the next snapshotting load recreates them. AFTER a run, rebuild the
@@ -50,8 +53,8 @@ import { asRawClient } from "../../bun-db/index.js";
 import { quoteIdent } from "../../crypto/ciphertext-pattern.js";
 import { configuredEventPiiCatalog } from "../../crypto/event-pii.js";
 import { isLocalKeyKmsAdapter, KeyErasedError, KeyNotFoundError, } from "../../crypto/kms-adapter.js";
-import { configuredPiiSubjectKms, encryptPiiValueForSubject, isPiiCiphertext, PII_ERASED_SENTINEL, } from "../../crypto/pii-field-encryption.js";
-import { collectPiiSubjectFields, resolveEventSubject, resolveSubjectForField, SubjectResolutionError, } from "../../crypto/subject-resolver.js";
+import { configuredPiiSubjectKms, decryptPiiValueForSubject, encryptPiiValueForSubject, isPiiCiphertext, PII_ERASED_SENTINEL, piiCiphertextSubject, } from "../../crypto/pii-field-encryption.js";
+import { collectPiiEncryptedFields, resolveEventSubject, resolveSubjectForField, SubjectResolutionError, } from "../../crypto/subject-resolver.js";
 import { resolveTableName } from "../entity-table-meta.js";
 import { tableExists } from "../schema-inspection.js";
 import { toSnakeCase } from "../table-builder.js";
@@ -59,7 +62,7 @@ const LIFECYCLE_VERBS = ["created", "updated", "deleted", "restored", "forgotten
 function collectPiiTargets(registry) {
     const entityTargets = new Map();
     for (const [name, entity] of registry.getAllEntities()) {
-        const piiFields = collectPiiSubjectFields(entity);
+        const piiFields = collectPiiEncryptedFields(entity);
         if (piiFields.length > 0)
             entityTargets.set(name, { entity, piiFields });
     }
@@ -83,6 +86,7 @@ export async function backfillEventPiiEncryption(db, registry, options = {}) {
         updatedEvents: 0,
         encryptedFields: 0,
         erasedFields: 0,
+        rekeyedFields: 0,
         ownerFromProjection: 0,
         erasedUnresolvable: 0,
         deletedSnapshots: 0,
@@ -100,6 +104,7 @@ export async function backfillEventPiiEncryption(db, registry, options = {}) {
         total.updatedEvents += batch.updatedEvents;
         total.encryptedFields += batch.encryptedFields;
         total.erasedFields += batch.erasedFields;
+        total.rekeyedFields += batch.rekeyedFields;
         total.ownerFromProjection += batch.ownerFromProjection;
         total.erasedUnresolvable += batch.erasedUnresolvable;
         total.deletedSnapshots += batch.deletedSnapshots;
@@ -127,6 +132,7 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         updatedEvents: 0,
         encryptedFields: 0,
         erasedFields: 0,
+        rekeyedFields: 0,
         ownerFromProjection: 0,
         erasedUnresolvable: 0,
         deletedSnapshots: 0,
@@ -168,6 +174,7 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
                 continue;
             result.encryptedFields += outcome.encrypted;
             result.erasedFields += outcome.erased;
+            result.rekeyedFields += outcome.rekeyed;
             result.ownerFromProjection += outcome.ownerFromProjection;
             result.erasedUnresolvable += outcome.erasedUnresolvable;
             if (!options.dryRun) {
@@ -245,7 +252,11 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
                 for (const projectionRow of projectionRows) {
                     const id = projectionRow["id"];
                     if (typeof id === "string") {
-                        ownersById.set(id, projectionRowToCamel(target.entity, projectionRow));
+                        const rowTenantId = projectionRow["tenant_id"];
+                        ownersById.set(id, {
+                            tenantId: typeof rowTenantId === "string" ? rowTenantId : undefined,
+                            fields: projectionRowToCamel(target.entity, projectionRow),
+                        });
                     }
                 }
             }
@@ -254,15 +265,22 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         return byType;
     }
     async function transformEvent(row, projectionOwners) {
-        const counters = { encrypted: 0, erased: 0, ownerFromProjection: 0, erasedUnresolvable: 0 };
+        const counters = {
+            encrypted: 0,
+            erased: 0,
+            rekeyed: 0,
+            ownerFromProjection: 0,
+            erasedUnresolvable: 0,
+        };
         const payload = structuredClone(row.payload);
+        const tenantId = row.tenant_id; // @cast-boundary db-read — tenant_id column is the branded TenantId
         const catalogFields = eventCatalog.get(row.type);
         if (catalogFields) {
             for (const [field, spec] of Object.entries(catalogFields)) {
                 let subject;
                 try {
                     subject = resolveEventSubject(field, spec, payload, {
-                        tenantId: row.tenant_id, // @cast-boundary db-read — tenant_id column is the branded TenantId
+                        tenantId,
                         aggregateType: row.aggregate_type,
                         aggregateId: row.aggregate_id,
                     });
@@ -284,9 +302,10 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
             const target = entityTargets.get(row.aggregate_type);
             if (!target || !isLifecycleEventOf(row.type, row.aggregate_type))
                 return null;
-            await applyEntityLifecycleFields(target, projectionOwners?.get(row.aggregate_id));
+            const ownerRow = projectionOwnerRowOfTenant(projectionOwners?.get(row.aggregate_id), row.tenant_id);
+            await applyEntityLifecycleFields(target, ownerRow);
         }
-        if (counters.encrypted === 0 && counters.erased === 0)
+        if (counters.encrypted === 0 && counters.erased === 0 && counters.rekeyed === 0)
             return null;
         return { payload, ...counters };
         function bump(outcome) {
@@ -309,14 +328,18 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
                         continue;
                     if (typeof value !== "string")
                         continue;
-                    // Already-ciphertext/sentinel fields must never enter owner
-                    // resolution — an unresolvable owner on an already-handled field
+                    // Already-ciphertext/sentinel fields must never enter the encrypt/erase
+                    // owner resolution — an unresolvable owner on an already-handled field
                     // must stay untouched, not get erased by stage 3.
-                    if (isPiiCiphertext(value) || value === PII_ERASED_SENTINEL)
+                    if (isPiiCiphertext(value)) {
+                        if (options.rekeyTenantKeyedOwnerFields) {
+                            await rekeyField(target.entity, section, field, value, subjectSource, ownerFallback, projectionOwnerRow);
+                        }
+                        continue;
+                    }
+                    if (value === PII_ERASED_SENTINEL)
                         continue;
-                    const resolution = resolveOwnerSubject(target.entity, field, subjectSource, ownerFallback, projectionOwnerRow, 
-                    // @cast-boundary db-read — tenant_id column is the branded TenantId
-                    row.tenant_id, row.aggregate_type);
+                    const resolution = resolveOwnerSubject(target.entity, field, subjectSource, ownerFallback, projectionOwnerRow, tenantId, row.aggregate_type);
                     if (resolution.kind === "unannotated")
                         continue;
                     if (resolution.kind === "unresolved") {
@@ -335,6 +358,32 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
                 }
             }
         }
+        async function rekeyField(entity, section, field, ciphertext, subjectSource, ownerFallback, projectionOwnerRow) {
+            const rekey = await rekeyTenantKeyedValue({
+                subjectKms,
+                kmsCtx,
+                dryRun: options.dryRun === true,
+                isForgottenSubject: (subject) => isForgottenSubject(subject, row.aggregate_id),
+                predictOutcome: predictEncryptOutcome,
+            }, {
+                entity,
+                field,
+                ciphertext,
+                tenantId,
+                aggregateType: row.aggregate_type,
+                subjectSource,
+                ownerFallback,
+                projectionOwnerRow,
+            });
+            if (rekey.kind === "rekeyed") {
+                section[field] = rekey.value;
+                counters.rekeyed++;
+            }
+            else if (rekey.kind === "erased") {
+                section[field] = PII_ERASED_SENTINEL;
+                counters.erased++;
+            }
+        }
         async function encryptField(section, field, subject) {
             const value = section[field];
             if (value === null || value === undefined)
@@ -399,6 +448,62 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         return scanCache.destroyedTenants;
     }
 }
+// aggregate_id is only unique per tenant: another tenant's projection row must not name the owner.
+function projectionOwnerRowOfTenant(owner, tenantId) {
+    if (owner === undefined)
+        return undefined;
+    return owner.tenantId === undefined || owner.tenantId === tenantId ? owner.fields : undefined;
+}
+function isPlainUserOwnedField(entity, field) {
+    const fieldDef = entity.fields[field];
+    if (fieldDef === undefined || !("userOwned" in fieldDef) || fieldDef.userOwned === undefined) {
+        return false;
+    }
+    return !("recordOwned" in fieldDef && fieldDef.recordOwned === true);
+}
+// Stage 4. In dryRun the "rekeyed" value is the untouched ciphertext (nothing is written).
+async function rekeyTenantKeyedValue(deps, target) {
+    const { entity, field, ciphertext } = target;
+    if (!isPlainUserOwnedField(entity, field) || !isTenantKeyedUnder(ciphertext, target.tenantId)) {
+        return { kind: "unchanged" };
+    }
+    const resolution = resolveOwnerSubject(entity, field, target.subjectSource, target.ownerFallback, target.projectionOwnerRow, target.tenantId, target.aggregateType);
+    if (resolution.kind !== "resolved" || resolution.subject.kind !== "user") {
+        return { kind: "unchanged" };
+    }
+    const userSubject = resolution.subject;
+    if (await deps.isForgottenSubject(userSubject))
+        return { kind: "erased" };
+    if (deps.dryRun) {
+        return (await deps.predictOutcome(userSubject)) === "erased"
+            ? { kind: "erased" }
+            : { kind: "rekeyed", value: ciphertext };
+    }
+    const plaintext = await decryptPiiValueForSubject(deps.subjectKms, ciphertext, deps.kmsCtx, field);
+    if (plaintext === PII_ERASED_SENTINEL)
+        return { kind: "erased" };
+    try {
+        const value = await encryptPiiValueForSubject(deps.subjectKms, userSubject, plaintext, deps.kmsCtx, field);
+        return { kind: "rekeyed", value };
+    }
+    catch (e) {
+        if (e instanceof KeyErasedError)
+            return { kind: "erased" };
+        throw e;
+    }
+}
+// Only the row's own tenant key counts: another tenant's or a user's key is
+// never decrypted here.
+function isTenantKeyedUnder(ciphertext, tenantId) {
+    try {
+        const subject = piiCiphertextSubject(ciphertext);
+        return subject.kind === "tenant" && subject.tenantId === tenantId;
+    }
+    catch {
+        // skip: a malformed ciphertext prefix is not ours to re-key
+        return false;
+    }
+}
 function attemptResolve(entity, field, source, opts) {
     try {
         return { ok: true, subject: resolveSubjectForField(entity, field, source, opts) };

package/dist/db/table-builder.d.ts

@@ -137,7 +137,9 @@ type ColumnsForField<K extends string, F extends FieldDefinition> = F extends {
     readonly [P in K]: NullCol<string>;
 } : F extends {
     type: "files" | "images";
-} ? Record<never, never> : never;
+} ? {
+    readonly [P in K]: Col<readonly string[]>;
+} : never;
 type UnionToIntersection<U> = (U extends unknown ? (k: U) => void : never) extends (k: infer I) => void ? I : never;
 type ColumnsForEntity<F extends FieldsMap> = UnionToIntersection<{
     [K in keyof F & string]: ColumnsForField<K, F[K]>;

package/dist/db/table-builder.js

@@ -12,7 +12,7 @@ export function physicalColumnName(table, field) {
     return table[field]?.name ?? toSnakeCase(field);
 }
 // Returns column(s) for a field. Most fields return a single entry,
-// money returns two (amount + currency), files/images return none.
+// money returns two (amount + currency).
 //
 // `required: true` auf einem FieldDefinition mappt **immer** auf .notNull()
 // in der DB-Spalte. Die alte Implementation hat das nur für reference-
@@ -173,11 +173,8 @@ function fieldToColumns(name, field, entity) {
         }
         case "files":
         case "images":
-            // Multi file: no column in entity table, resolved via FileRef table
-            // over (entityType, entityId, fieldName). A bridge-table with
-            // CASCADE + sort-order is a later improvement; today plural files
-            // live entirely in fileRefsTable.
-            return {};
+            // Ordered fileRef UUID array, same shape as multiSelect: never null.
+            return { [name]: jsonb(snakeName).default([]).notNull() };
         default:
             assertUnreachable(field, "field type");
     }

package/dist/engine/boot-validator/access-declarations.js

@@ -67,16 +67,25 @@ function validateEscapeHatchReason(feature, kind, handlerName, escapeHatch) {
         }
     }
 }
-function validatePersonalDataOnlyOnWrite(feature, kind, handlerName, access) {
-    // skip: write handlers may declare personalData, or it wasn't declared here
-    if (kind === "write" || declaredPersonalData(access) === undefined)
+function validatePersonalDataSupportedForKind(feature, kind, handlerName, access) {
+    // skip: nothing declared
+    if (declaredPersonalData(access) === undefined)
         return;
-    const property = "openToAll" in access ? "openToAll.personalData" : "access.personalData";
-    throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
-        `${property} — it only applies to write handlers, whose input is ` +
-        "checked for personal-data fields.");
+    // skip: write handlers accept every personalData declaration
+    if (kind === "write")
+        return;
+    const isOpenToAll = "openToAll" in access;
+    // skip: query handlers may declare access.personalData, its value is validated separately
+    if (kind === "query" && !isOpenToAll)
+        return;
+    const property = isOpenToAll ? "openToAll.personalData" : "access.personalData";
+    const onlyAllowed = kind === "query"
+        ? 'only access.personalData: "public-intake" applies to query handlers, which write ' +
+            "personal data through nested writes of an anonymous request."
+        : "it only applies to write handlers, whose input is checked for personal-data fields.";
+    throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ${property} — ${onlyAllowed}`);
 }
-function validatePersonalDataValue(feature, handlerName, access) {
+function validatePersonalDataValue(feature, kind, handlerName, access) {
     const declared = declaredPersonalData(access);
     // skip: nothing declared
     if (declared === undefined)
@@ -85,17 +94,17 @@ function validatePersonalDataValue(feature, handlerName, access) {
         // skip: the one supported value on openToAll
         if (declared === "tenant-members")
             return;
-        throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares an unknown ` +
+        throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares an unknown ` +
             `openToAll.personalData ${JSON.stringify(declared)} — the only supported value is "tenant-members".`);
     }
     if (declared !== "public-intake") {
-        throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares an unknown ` +
+        throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares an unknown ` +
             `access.personalData ${JSON.stringify(declared)} — the only supported value is "public-intake".`);
     }
     // skip: roles include "anonymous", which personalData: "public-intake" requires
     if (accessAllowsAnonymous(access))
         return;
-    throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares ` +
+    throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
         'access.personalData: "public-intake" but its roles do not include ' +
         `"${ANONYMOUS_ROLE}" — personalData: "public-intake" only applies to handlers ` +
         "that allow anonymous callers.");
@@ -150,14 +159,14 @@ function validateAnonymousPersonalData(feature, handlerName, handler) {
 }
 // The rateLimit is the only protection of a public-intake handler, so the
 // generic anonymous opt-out (rateLimit: { disabled: true }) must not apply.
-function validatePublicIntakeRateLimit(feature, handlerName, handler) {
-    // skip: not a public-intake handler, or its rateLimit is active
+function validatePublicIntakeRateLimit(feature, kind, handlerName, handler) {
+    // skip: not a public-intake handler
     if (declaredPersonalData(handler.access) !== "public-intake")
         return;
     // skip: rateLimit is active
     if (!isRateLimitDisabled(handler.rateLimit))
         return;
-    throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares ` +
+    throw new Error(`[Feature ${feature.name}] ${kind} handler "${handlerName}" declares ` +
         'access.personalData: "public-intake" with rateLimit: { disabled: true } — the rateLimit ' +
         'is the only protection for anonymous personal-data writes. Declare rateLimit: { per: "ip" ' +
         'or "ip+handler", ... } instead.');
@@ -166,19 +175,21 @@ export function validateAccessDeclarations(feature) {
     for (const [handlerName, handler] of Object.entries(feature.writeHandlers)) {
         validateOpenToAllReason(feature, "write", handlerName, handler.access);
         validateEscapeHatchReason(feature, "write", handlerName, handler.escapeHatch);
-        validatePersonalDataValue(feature, handlerName, handler.access);
+        validatePersonalDataValue(feature, "write", handlerName, handler.access);
         validateOpenToAllPersonalData(feature, handlerName, handler);
         validateAnonymousPersonalData(feature, handlerName, handler);
-        validatePublicIntakeRateLimit(feature, handlerName, handler);
+        validatePublicIntakeRateLimit(feature, "write", handlerName, handler);
     }
     for (const [handlerName, handler] of Object.entries(feature.queryHandlers)) {
         validateOpenToAllReason(feature, "query", handlerName, handler.access);
         validateEscapeHatchReason(feature, "query", handlerName, handler.escapeHatch);
-        validatePersonalDataOnlyOnWrite(feature, "query", handlerName, handler.access);
+        validatePersonalDataSupportedForKind(feature, "query", handlerName, handler.access);
+        validatePersonalDataValue(feature, "query", handlerName, handler.access);
+        validatePublicIntakeRateLimit(feature, "query", handlerName, handler);
     }
     for (const [handlerName, handler] of Object.entries(feature.streamHandlers)) {
         validateOpenToAllReason(feature, "stream", handlerName, handler.access);
         validateEscapeHatchReason(feature, "stream", handlerName, handler.escapeHatch);
-        validatePersonalDataOnlyOnWrite(feature, "stream", handlerName, handler.access);
+        validatePersonalDataSupportedForKind(feature, "stream", handlerName, handler.access);
     }
 }

package/dist/engine/boot-validator/card-meta-overflow.js

@@ -1,4 +1,4 @@
-import { CARD_META_MAX, cardColumnRoles } from "../../ui-types/card-column-roles.js";
+import { CARD_META_MAX, cardColumnRoles, cardFileDisplayKind, } from "../../ui-types/card-column-roles.js";
 import { LIST_ROW_META_COLUMNS } from "../../ui-types/list-row-meta.js";
 import { parseRefTarget } from "../parse-ref-target.js";
 import { normalizeListColumn } from "../screen-helpers.js";
@@ -19,11 +19,14 @@ function resolveColumnType(spec, storedType, entity) {
 function countOverflow(feature, screen, location, columns, storedTypeOf, entity) {
     const cardColumns = columns.map((spec) => {
         const col = normalizeListColumn(spec);
+        const type = resolveColumnType(spec, storedTypeOf(col.field), entity);
+        const fileKind = cardFileDisplayKind(type, col.renderer);
         return {
             field: col.field,
-            type: resolveColumnType(spec, storedTypeOf(col.field), entity),
+            type,
             renderer: col.renderer,
             hideOnNarrow: col.hideOnNarrow,
+            ...(fileKind !== undefined && { fileDisplay: { kind: fileKind } }),
         };
     });
     const { meta } = cardColumnRoles(cardColumns);

package/dist/engine/boot-validator/entity-handler.d.ts

@@ -23,6 +23,7 @@ export declare function validateEntitySelectAvailabilityQuery(feature: FeatureDe
 export declare function validateEntitySelectConditionalOptions(feature: FeatureDefinition): void;
 export declare function validateMultiSelectFields(feature: FeatureDefinition): void;
 export declare function validateImageVariants(feature: FeatureDefinition): void;
+export declare function validateLockedWhen(feature: FeatureDefinition): void;
 export declare function validateTransitions(feature: FeatureDefinition): void;
 export declare function validateExtendSchemaCollisions(feature: FeatureDefinition): void;
 export declare function validateDerivedFieldCollisions(feature: FeatureDefinition): void;

package/dist/engine/boot-validator/entity-handler.js

@@ -341,7 +341,7 @@ export function validateEntityIndexes(feature) {
                         field.type === "images" ||
                         (field.type === "reference" && field.multiple === true))) {
                     throw new Error(`${where}: column "${col}" is a multi-value field (${field.type}) — ` +
-                        `these have no DB column to index on. Use a single-value field or remove from the index.`);
+                        `a jsonb array cannot be indexed as a column. Use a single-value field or remove from the index.`);
                 }
                 if (field && field.type === "longText") {
                     // longText ist semantisch "potentially-megabytes content" — ein
@@ -857,6 +857,43 @@ export function validateImageVariants(feature) {
         }
     }
 }
+// --- lockedWhen validation ---
+function isCiphertextAtRest(field) {
+    return (("pii" in field && field.pii === true) ||
+        ("userOwned" in field && field.userOwned !== undefined) ||
+        ("tenantOwned" in field && field.tenantOwned === true) ||
+        ("recordOwned" in field && field.recordOwned === true) ||
+        ("encrypted" in field && field.encrypted === true));
+}
+// Types whose stored value is a plain scalar that the condition's `===` can match.
+// Compound, temporal, array and bigint columns come back in another shape than the
+// literal an author writes, so such a lock would silently never hold.
+const LOCKABLE_FIELD_TYPES = new Set([
+    "text",
+    "longText",
+    "boolean",
+    "select",
+    "number",
+    "reference",
+]);
+export function validateLockedWhen(feature) {
+    for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+        const { lockedWhen } = entity;
+        if (typeof lockedWhen !== "object")
+            continue;
+        const where = `Entity "${entityName}" in feature "${feature.name}": lockedWhen field "${lockedWhen.field}"`;
+        const field = entity.fields[lockedWhen.field];
+        if (!field) {
+            throw new Error(`${where} is not a field of the entity (known: ${Object.keys(entity.fields).sort().join(", ")}).`);
+        }
+        if (isCiphertextAtRest(field)) {
+            throw new Error(`${where} is personal or encrypted — the lock condition is evaluated on the stored value, which is ciphertext. Use a plaintext field.`);
+        }
+        if (!LOCKABLE_FIELD_TYPES.has(field.type)) {
+            throw new Error(`${where} has type "${field.type}", which does not store a plain scalar the condition can compare. Use a text, select, boolean, number or reference field.`);
+        }
+    }
+}
 // --- Transition validation ---
 export function validateTransitions(feature) {
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {

package/dist/engine/boot-validator/index.js

@@ -10,7 +10,7 @@ import { validateFeatureBootChecks } from "./boot-check.js";
 import { validateCardMetaOverflow } from "./card-meta-overflow.js";
 import { validateCircularDeps, validateConfigKeyAllowPerRequest, validateConfigKeyBacking, validateConfigKeyBounds, validateConfigKeyComputed, validateConfigKeyOptionsQuery, validateConfigKeyPiiEncrypted, validateConfigKeyRequired, validateConfigReads, warnOnToggleableDependencies, } from "./config-deps.js";
 import { collectDetailForScreens } from "./detail-screens.js";
-import { validateDerivedFieldCollisions, validateEmbeddedFields, validateEncryptedFields, validateEntityIndexes, validateEntitySelectAvailabilityQuery, validateEntitySelectConditionalOptions, validateEntitySelectOptionsQuery, validateExtendSchemaCollisions, validateExtensionPreSaveWiring, validateFileFields, validateHandlerAccess, validateImageVariants, validateLocatedTimestamps, validateMultiSelectFields, validateMultiStreamProjections, validateReferenceFields, validateSearchableFieldReadAccess, validateTransitions, } from "./entity-handler.js";
+import { validateDerivedFieldCollisions, validateEmbeddedFields, validateEncryptedFields, validateEntityIndexes, validateEntitySelectAvailabilityQuery, validateEntitySelectConditionalOptions, validateEntitySelectOptionsQuery, validateExtendSchemaCollisions, validateExtensionPreSaveWiring, validateFileFields, validateHandlerAccess, validateImageVariants, validateLocatedTimestamps, validateLockedWhen, validateMultiSelectFields, validateMultiStreamProjections, validateReferenceFields, validateSearchableFieldReadAccess, validateTransitions, } from "./entity-handler.js";
 import { validateEntityListScreens } from "./entity-list-screens.js";
 import { validateGdprStoragePersistence } from "./gdpr-storage.js";
 import { validateGlobalTenancyEntities } from "./global-tenancy.js";
@@ -181,6 +181,7 @@ export function validateBoot(rawFeatures, options) {
         validateReferenceFields(feature, featureMap, queryHandlerQns);
         validateHandlerFieldReferences(feature, featureMap);
         validateTransitions(feature);
+        validateLockedWhen(feature);
         validateExtensionUsages(feature, extensionProviders);
         validateExtendSchemaCollisions(feature);
         validateDerivedFieldCollisions(feature);

package/dist/engine/boot-validator/query-output-columns.js

@@ -97,6 +97,9 @@ function checkProjectionDetailOutputFields(queryHandlers, featureName, screenId,
         }
         if (screen.header.status !== undefined)
             checkHeaderField("status", screen.header.status);
+        if (screen.header.statusToneField !== undefined) {
+            checkHeaderField("statusToneField", screen.header.statusToneField);
+        }
     }
     if (screen.recordTitleField !== undefined) {
         const field = screen.recordTitleField;

package/dist/engine/boot-validator/screens.d.ts

@@ -3,7 +3,7 @@ import type { ConfigKeyDefinition, FeatureDefinition } from "../types/index.js";
 import type { DashboardCustomPanel, DashboardScreenPanel, RelatedListToolbarAction, RowAction, RowFieldExtractor, ScreenDefinition, ToolbarAction } from "../types/screen.js";
 export declare function rowFieldExtractorKeys(params: RowFieldExtractor): readonly string[];
 export declare function readsNavigateParamsAsFormPrefill(target: ScreenDefinition, explicitEntityId: string | undefined, sourceScreenEntity: string | undefined): boolean;
-export declare function validateActionHasIcon(featureName: string, screenId: string, screenType: "projectionDetail" | "entityEdit", context: string, action: {
+export declare function validateActionHasIcon(featureName: string, screenId: string, screenType: "projectionDetail" | "entityEdit" | "entityList" | "projectionList", context: string, action: {
     readonly id: string;
     readonly icon?: IconKey;
 }): void;