@cosmicdrift/kumiko-framework 0.372.0 → 0.374.0

package/agents/examples/rate-limiting.md

@@ -13,8 +13,29 @@ End-to-end rate limiting: L1 global-IP + L2 auth + L3 handler opt-in.
 ## What it shows
 
 - Handler `rateLimit: { per, limit, windowSeconds }`
+- Several buckets on one handler: `rateLimit: [{ per: "user", ... }, { per: "tenant+handler", ... }]`
 - How L1/L2 from `buildServer` stack with L3
 
+## Combined buckets
+
+Pass a list to enforce several budgets on one handler, for example a per-caller and a per-tenant cap:
+
+```ts illustration
+r.writeHandler({
+  // ...
+  rateLimit: [
+    { per: "user", limit: 2, windowSeconds: 3600 },
+    { per: "tenant+handler", limit: 3, windowSeconds: 3600 },
+  ],
+});
+```
+
+Each bucket applies on its own. The check is all-or-nothing: if any bucket is exhausted the call
+answers 429 `rate_limited` for that bucket (the one with the longest wait when several are
+exhausted) and no bucket is charged. Each `per` may appear once; an empty list fails at boot.
+An anonymous handler needs every bucket to be ip-keyed, and `{ disabled: true, reason }`
+stays a single declaration.
+
 ## Per-payload limits
 
 A public write handler that mails an address typed by the caller is also limited per
@@ -67,7 +88,8 @@ bun test
 // in each layer's test.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
+import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { createTestUser, TestUsers } from "@cosmicdrift/kumiko-framework/seeding";
 import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-testing/stack";
 import { createRateLimitShowcaseFeature } from "../feature";
 
@@ -130,6 +152,35 @@ describe("L3 — handler opt-in (per-user budget on expensive-search)", () => {
   });
 });
 
+describe("L3 — combined buckets (per-user and per-tenant budget on submit-report)", () => {
+  const submitReport = "rl-showcase:write:submit-report";
+
+  async function rejectedBucket(user: SessionUser): Promise<string | undefined> {
+    const res = await stack.http.write(submitReport, {}, user);
+    expect(res.status).toBe(429);
+    const body = (await res.json()) as { error: { details?: { bucket?: string } } };
+    return body.error.details?.bucket;
+  }
+
+  test("the user bucket rejects first; the tenant bucket only counts accepted requests", async () => {
+    await stack.http.writeOk(submitReport, {}, admin);
+    await stack.http.writeOk(submitReport, {}, admin);
+    expect(await rejectedBucket(admin)).toBe("user");
+
+    // The rejected third call did not touch the tenant bucket: one of its 3 tokens is left.
+    await stack.http.writeOk(submitReport, {}, TestUsers.user);
+    expect(await rejectedBucket(TestUsers.user)).toBe("tenant+handler");
+  });
+
+  test("a caller without Admin or User role is rejected with access_denied before any bucket is charged", async () => {
+    const outsider = createTestUser({ id: 9, tenantId: admin.tenantId, roles: ["Guest"] });
+    const res = await stack.http.write(submitReport, {}, outsider);
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { code: string } };
+    expect(body.error.code).toBe("access_denied");
+  });
+});
+
 describe("L1 — global IP middleware (covers every /api/* request)", () => {
   test("21st request from same IP returns 429 with l1:ip bucket", async () => {
     // L1 sits ahead of auth + every /api/* route. Target an authless,
@@ -205,6 +256,19 @@ export function createRateLimitShowcaseFeature(): FeatureDefinition {
       access: { roles: ["Admin", "User"] },
       rateLimit: { per: "user", limit: 3, windowSeconds: 60 },
     });
+
+    // Combined budget: each caller gets 2 submits per hour and the tenant 3 per hour in
+    // total. Both buckets are checked together; a request one bucket rejects charges neither.
+    r.writeHandler({
+      name: "submit-report",
+      schema: z.object({}),
+      handler: async () => ({ isSuccess: true as const, data: {} }),
+      access: { roles: ["Admin", "User"] },
+      rateLimit: [
+        { per: "user", limit: 2, windowSeconds: 3600 },
+        { per: "tenant+handler", limit: 3, windowSeconds: 3600 },
+      ],
+    });
   });
 }
 ```

package/agents/widgets.md

@@ -118,6 +118,7 @@ Value exports of `@cosmicdrift/kumiko-renderer-web`.
 | `useDraft` | Formular-State für Rechner-Screens: ein Draft-Objekt + `patch` für Teil-Updates + `field(name)` das die `{ id, name, value, onChange }`-Props fertig für die Feld-Widgets (NumberField/MoneyField/PercentField) liefert. |
 | `useForm` |  |
 | `useIsNarrowViewport` |  |
+| `useIsViewportBelow` |  |
 | `useLiveEvents` | Hook für useQuery-like Consumer. |
 | `useLocale` | Liefert den aktuellen LocaleResolver und abonniert automatisch Locale-Änderungen — der aufrufende Component re-rendert sobald die Sprache gewechselt wird. |
 | `useNav` |  |

package/dist/engine/boot-validator/entity-handler.d.ts

@@ -10,6 +10,7 @@ export declare function validateAdditionalRateLimits(featureName: string, handle
 export declare function validatePerCommandTransaction(featureName: string, handlerName: string, handler: FeatureDefinition["writeHandlers"][string]): void;
 export declare function validateTenantlessAnonymous(featureName: string, handlerName: string, handler: FeatureDefinition["writeHandlers"][string]): void;
 export declare function validateRateLimitDisabledReason(featureName: string, kind: "write" | "query" | "stream", handlerName: string, rateLimit: FeatureDefinition["writeHandlers"][string]["rateLimit"]): void;
+export declare function validateRateLimitBucketList(featureName: string, kind: "write" | "query" | "stream", handlerName: string, rateLimit: FeatureDefinition["writeHandlers"][string]["rateLimit"]): void;
 export declare function validateNoAllRoleInHandlerAccess(featureName: string, kind: "write" | "query" | "stream", handlerName: string, access: NonNullable<FeatureDefinition["writeHandlers"][string]["access"]>): void;
 export declare function validateAnonymousRateLimit(featureName: string, kind: "write" | "query" | "stream", handlerName: string, access: NonNullable<FeatureDefinition["writeHandlers"][string]["access"]>, rateLimit: FeatureDefinition["writeHandlers"][string]["rateLimit"]): void;
 export declare function validateMultiStreamProjections(feature: FeatureDefinition): void;

package/dist/engine/boot-validator/entity-handler.js

@@ -1,5 +1,5 @@
 import { SELECT_OPTION_TONES } from "@cosmicdrift/kumiko-types/fields";
-import { isRateLimitDisabled } from "@cosmicdrift/kumiko-types/handlers";
+import { declaredRateLimitOptions, isRateLimitDisabled } from "@cosmicdrift/kumiko-types/handlers";
 import { ZodObject } from "zod";
 import { VARIANT_NAME_PATTERN } from "../../derivatives/variant-key.js";
 import { access as accessPresets } from "../config-helpers.js";
@@ -133,6 +133,7 @@ export function validateHandlerAccess(feature) {
                     `Set { roles: [...] } for role-based access, or { openToAll: { reason: "..." } } for any authenticated user.`);
             }
             validateNoAllRoleInHandlerAccess(feature.name, kind, name, handler.access);
+            validateRateLimitBucketList(feature.name, kind, name, handler.rateLimit);
             validateAnonymousRateLimit(feature.name, kind, name, handler.access, handler.rateLimit);
             validateRateLimitDisabledReason(feature.name, kind, name, handler.rateLimit);
         }
@@ -158,8 +159,17 @@ export function validateAdditionalRateLimits(featureName, handlerName, handler)
     }
     validateAnonymousHasIpBucket(where, handler);
     const shape = handler.schema instanceof ZodObject ? handler.schema.shape : undefined;
+    const seenFields = new Set();
     for (const entry of additionalRateLimits) {
         validatePayloadBucket(where, shape, entry);
+        const field = entry.per.payloadField;
+        // Two entries on one field hash the same value into the same Redis key, so enforceAll
+        // would deduct only one of the costs.
+        if (seenFields.has(field)) {
+            throw new Error(`${where} with payloadField "${field}" more than once — both entries would share one ` +
+                `Redis bucket per value. Keep one entry per payloadField.`);
+        }
+        seenFields.add(field);
     }
 }
 function validateAnonymousHasIpBucket(where, handler) {
@@ -168,9 +178,7 @@ function validateAnonymousHasIpBucket(where, handler) {
     // skip: only anonymous callers need an ip bucket
     if (!allowsAnonymous)
         return;
-    const hasIpBucket = rateLimit !== undefined &&
-        !isRateLimitDisabled(rateLimit) &&
-        IP_BUCKETED_RATE_LIMIT_PER.has(rateLimit.per);
+    const hasIpBucket = declaredRateLimitOptions(rateLimit).some((option) => IP_BUCKETED_RATE_LIMIT_PER.has(option.per));
     if (!hasIpBucket) {
         throw new Error(`${where} and allows anonymous callers, but has no ip-keyed rateLimit ` +
             `(per: "ip" or "ip+handler", not disabled). Payload buckets only complement the IP bucket. Set rateLimit: { per: "ip", ... } on the handler.`);
@@ -217,13 +225,16 @@ export function validateTenantlessAnonymous(featureName, handlerName, handler) {
         throw new Error(`${where} but its access is not exactly { roles: ["anonymous"] } — a tenantless request ` +
             `carries no principal beyond the anonymous visitor. Set access to { roles: ["anonymous"] } or remove tenantlessAnonymous.`);
     }
-    if (!handler.rateLimit || isRateLimitDisabled(handler.rateLimit)) {
+    const options = declaredRateLimitOptions(handler.rateLimit);
+    if (options.length === 0) {
         throw new Error(`${where} without a rateLimit — a handler reachable on hosts that resolve no tenant ` +
             `needs a real upper bound (rateLimit: { per: "ip", ... }); { disabled: true } does not count.`);
     }
-    if (!IP_SCOPED_RATE_LIMIT_PER.includes(handler.rateLimit.per)) {
-        throw new Error(`${where} with rateLimit.per "${handler.rateLimit.per}" — every anonymous visitor shares the same ` +
-            `tenant/user bucket, so one caller could exhaust it for all. Use ${IP_SCOPED_RATE_LIMIT_PER.map((per) => `"${per}"`).join(" or ")}.`);
+    for (const { per } of options) {
+        if (IP_SCOPED_RATE_LIMIT_PER.includes(per))
+            continue;
+        throw new Error(`${where} with rateLimit.per "${per}" — every anonymous visitor shares the same ` +
+            `tenant/user bucket, so one caller could exhaust it for all. Use ${IP_SCOPED_RATE_LIMIT_PER.map((allowed) => `"${allowed}"`).join(" or ")}.`);
     }
 }
 export function validateRateLimitDisabledReason(featureName, kind, handlerName, rateLimit) {
@@ -236,6 +247,23 @@ export function validateRateLimitDisabledReason(featureName, kind, handlerName,
             `be rate-limited.`);
     }
 }
+export function validateRateLimitBucketList(featureName, kind, handlerName, rateLimit) {
+    // skip: a single option or a disabled declaration has no bucket list to check
+    if (!Array.isArray(rateLimit))
+        return;
+    const where = `${kind} handler "${featureName}:${kind}:${handlerName}"`;
+    if (rateLimit.length === 0) {
+        throw new Error(`${where} declares rateLimit as an empty array — declare at least one bucket or drop the option.`);
+    }
+    const seen = new Set();
+    for (const { per } of rateLimit) {
+        if (seen.has(per)) {
+            throw new Error(`${where} declares rateLimit with per "${per}" more than once — both entries would share one ` +
+                `Redis bucket with conflicting limits. Keep one entry per "per".`);
+        }
+        seen.add(per);
+    }
+}
 // No session ever carries the role "all" — `roles: ["all"]` is unreachable dead config, not a wildcard.
 export function validateNoAllRoleInHandlerAccess(featureName, kind, handlerName, access) {
     // skip: openToAll has no roles list to check
@@ -260,19 +288,22 @@ export function validateAnonymousRateLimit(featureName, kind, handlerName, acces
     // skip: disabled declarations carry no `.per` to bucket on
     if (isRateLimitDisabled(rateLimit))
         return;
-    if (!rateLimit) {
+    const options = declaredRateLimitOptions(rateLimit);
+    if (options.length === 0) {
         throw new Error(`${kind} handler "${featureName}:${kind}:${handlerName}" allows anonymous callers but declares no ` +
             `rateLimit — an anonymous, internet-facing endpoint needs an upper bound. Set rateLimit: ` +
             `{ per: "ip", limit: ..., windowSeconds: ... }, or the documented exception ` +
             `rateLimit: { disabled: true, reason: "..." }.`);
     }
-    // skip: rate-limit is already keyed on something safe (ip / tenant)
-    if (!USER_BUCKETED_RATE_LIMIT_PER.has(rateLimit.per))
-        return;
-    throw new Error(`${kind} handler "${featureName}:${kind}:${handlerName}" allows anonymous callers but uses ` +
-        `rateLimit.per="${rateLimit.per}" — every anonymous request shares user.id="anonymous", ` +
-        `so this bucket would be a single global tap any caller could drain. ` +
-        `Use rateLimit.per="ip" or "ip+handler" for anonymous endpoints.`);
+    for (const { per } of options) {
+        // skip: this bucket is keyed on something safe (ip / tenant)
+        if (!USER_BUCKETED_RATE_LIMIT_PER.has(per))
+            continue;
+        throw new Error(`${kind} handler "${featureName}:${kind}:${handlerName}" allows anonymous callers but uses ` +
+            `rateLimit.per="${per}" — every anonymous request shares user.id="anonymous", ` +
+            `so this bucket would be a single global tap any caller could drain. ` +
+            `Use rateLimit.per="ip" or "ip+handler" for anonymous endpoints.`);
+    }
 }
 // --- MultiStreamProjection delivery-invariant ---
 //

package/dist/engine/boot-validator/projection-list-screens.js

@@ -1,5 +1,5 @@
-import { ENTITY_CONVENTION_QUERY_BRAND } from "@cosmicdrift/kumiko-types/handlers";
-import { parseQn, QnTypes, qualifyEntityName } from "../qualified-name.js";
+import { isListQueryWithoutSearchableFields, resolveEntityBehindListQuery, } from "../entity-list-searchability.js";
+import { QnTypes, qualifyEntityName } from "../qualified-name.js";
 import { isEditLayoutScreen } from "../screen-helpers.js";
 import { relatedListGroupHeaderLabel, relatedListGroupKey, } from "../types/index.js";
 import { SEARCHABLE_FALSE_WHITELIST } from "./entity-list-screens.js";
@@ -28,28 +28,38 @@ function schemaAccepts(schema, key) {
     const shape = getZodObjectShape(schema);
     return shape !== undefined && key in shape;
 }
-function validateOneProjectionListScreen(feature, screen, queryHandlers) {
+// sortable/paginated are derived by buildAppSchema from the query's Zod
+// schema (fw#2165) — there is no separate wire type from the author-facing
+// ProjectionListScreenDefinition, so hand-authoring them would otherwise be
+// silently overwritten with no signal to the author. Reject outright.
+function rejectHandAuthoredDerivedFlags(prefix, screen) {
+    if (screen.sortable !== undefined) {
+        throw new Error(`${prefix}: sortable is derived from the query's Zod schema, don't set it`);
+    }
+    if (screen.paginated !== undefined) {
+        throw new Error(`${prefix}: paginated is derived from the query's Zod schema, don't set it`);
+    }
+}
+function validateOneProjectionListScreen(feature, screen, queryHandlers, featureMap) {
     const prefix = `[projectionList] Feature "${feature.name}" screen "${screen.id}"`;
-    const schema = queryHandlers.get(screen.query)?.schema;
+    const handler = queryHandlers.get(screen.query);
+    const schema = handler?.schema;
+    // buildAppSchema derives searchable: false for these, so no whitelist entry is needed.
+    const searchDerivedOff = isListQueryWithoutSearchableFields(screen.query, handler, (name) => findEntity(featureMap, name));
     if (screen.searchable === true && !schemaAccepts(schema, "search")) {
         throw new Error(`${prefix}: searchable: true but query "${screen.query}" has no "search" parameter in its Zod schema. Add a "search" field to the query schema or remove searchable: true.`);
     }
+    if (screen.searchable === true && searchDerivedOff) {
+        throw new Error(`${prefix}: searchable: true but query "${screen.query}" lists an entity with no searchable field, so a search would never match. Mark a field searchable: true on the entity or remove searchable: true.`);
+    }
     if (screen.searchable === false &&
         schemaAccepts(schema, "search") &&
+        !searchDerivedOff &&
         !SEARCHABLE_FALSE_WHITELIST.has(screen.id)) {
         throw new Error(`${prefix}: query "${screen.query}" accepts "search" but searchable: false disables it — remove searchable: false or add "${screen.id}" to SEARCHABLE_FALSE_WHITELIST`);
     }
-    // sortable/paginated are derived by buildAppSchema from the query's Zod
-    // schema (fw#2165) — there is no separate wire type from the author-facing
-    // ProjectionListScreenDefinition, so hand-authoring them would otherwise be
-    // silently overwritten with no signal to the author. Reject outright.
-    if (screen.sortable !== undefined) {
-        throw new Error(`${prefix}: sortable is derived from the query's Zod schema, don't set it`);
-    }
-    if (screen.paginated !== undefined) {
-        throw new Error(`${prefix}: paginated is derived from the query's Zod schema, don't set it`);
-    }
-    const searchActive = screen.searchable !== false && schemaAccepts(schema, "search");
+    rejectHandAuthoredDerivedFlags(prefix, screen);
+    const searchActive = screen.searchable !== false && !searchDerivedOff && schemaAccepts(schema, "search");
     const sortActive = schemaAccepts(schema, "sort");
     if ((searchActive || sortActive) && screen.defaultSort === undefined) {
         throw new Error(`${prefix}: defaultSort required when search or sort is active. Set defaultSort: { field, direction }.`);
@@ -132,11 +142,12 @@ function validateProjectionListFacetsSchemaAcceptance(prefix, screen, schema) {
 }
 export function validateProjectionListScreens(features) {
     const queryHandlers = buildQueryHandlerMap(features);
+    const featureMap = new Map(features.map((f) => [f.name, f]));
     for (const feature of features) {
         for (const screen of Object.values(feature.screens)) {
             if (screen.type !== "projectionList")
                 continue;
-            validateOneProjectionListScreen(feature, screen, queryHandlers);
+            validateOneProjectionListScreen(feature, screen, queryHandlers, featureMap);
         }
     }
 }
@@ -155,26 +166,6 @@ function validateRelatedListFacets(prefix, section, schema) {
         return;
     throw new Error(`${prefix}: declares facets but query "${section.query}" has no "filters" parameter in its Zod schema — add filters: z.array(z.object({ field: z.string(), op: z.literal("in"), value: z.unknown() })).optional() (or reuse entityListSchema's shape) to the handler's schema.`);
 }
-// parentFilter resolves an entity field map to
-// check `field` against ONLY when the query is one of the entity-convention
-// factories (defineEntityListHandler et al., branded by
-// ENTITY_CONVENTION_QUERY_BRAND) — a hand-written handler carries no entity,
-// same "capability absent, no throw" policy as schemaAccepts above. The
-// entity name comes from the handler's own `<entityName>:list` naming
-// convention (parseHandlerName in entity-handlers.ts), recovered here from
-// the query's fully qualified name.
-function resolveEntityBehindQuery(queryQn, handler, featureMap) {
-    if (handler === undefined || handler[ENTITY_CONVENTION_QUERY_BRAND] !== true)
-        return undefined;
-    let entityName;
-    try {
-        entityName = parseQn(queryQn).name.split(":")[0] ?? "";
-    }
-    catch {
-        return undefined;
-    }
-    return entityName === "" ? undefined : findEntity(featureMap, entityName);
-}
 // parentFilter lets a relatedList reuse the
 // generic `<entity>:list` query instead of a bespoke child-rows handler —
 // same 422 footgun as facets/filter above, plus its own mutual-exclusivity
@@ -193,7 +184,7 @@ function validateRelatedListParentFilter(prefix, section, schema, handler, featu
             `Zod schema — add filter: z.object({ field: z.string(), op: z.enum(["eq","ne","lt","gt","lte","gte","in"]), ` +
             `value: z.unknown() }).optional() (or reuse entityListSchema's shape) to the handler's schema.`);
     }
-    const entity = resolveEntityBehindQuery(section.query, handler, featureMap);
+    const entity = resolveEntityBehindListQuery(section.query, handler, (name) => findEntity(featureMap, name));
     if (entity !== undefined && entity.fields[section.parentFilter.field] === undefined) {
         throw new Error(`${prefix}: parentFilter.field "${section.parentFilter.field}" is not a declared field on the ` +
             `entity behind query "${section.query}". Known fields: ${Object.keys(entity.fields).sort().join(", ")}.`);

package/dist/engine/boot-validator/query-refs.js

@@ -1,3 +1,4 @@
+import { isFieldsEditSection, normalizeEditField, sectionFieldSpecs } from "../screen-helpers.js";
 import { buildQueryHandlerMap } from "./projection-list-screens.js";
 const NOT_REGISTERED_SUFFIX = "is not a registered query-handler. Check the QN spelling (expected " +
     '"<feature>:query:<short>") and that the handler is declared via r.queryHandler(...).';
@@ -29,19 +30,30 @@ function checkVisibleWhenQueryRef(queryHandlers, query, buildPrefix) {
 // types) keeps this collector correct if that restriction is ever lifted.
 function checkEditLayoutQueryRefs(queryHandlers, featureName, screenId, screenType, layout) {
     for (const section of layout.sections) {
+        if (isFieldsEditSection(section)) {
+            for (const fieldSpec of sectionFieldSpecs(section)) {
+                const { field, fillAction } = normalizeEditField(fieldSpec);
+                if (fillAction === undefined)
+                    continue;
+                checkQueryRef(queryHandlers, fillAction.query, () => `[Feature ${featureName}] Screen "${screenId}" (${screenType}) field "${field}" fillAction`);
+            }
+        }
         if (section.kind !== "relatedList")
             continue;
         checkQueryRef(queryHandlers, section.query, () => `[Feature ${featureName}] Screen "${screenId}" (${screenType}) relatedList section "${section.title}"`);
     }
 }
 function checkDashboardQueryRefs(queryHandlers, featureName, screenId, screen) {
+    if (screen.record?.query !== undefined) {
+        checkQueryRef(queryHandlers, screen.record.query, () => `[Feature ${featureName}] Screen "${screenId}" (dashboard) record`);
+    }
     for (const panel of screen.panels) {
         if (panel.kind === "custom")
             continue;
         if (panel.visibleWhen !== undefined) {
             checkVisibleWhenQueryRef(queryHandlers, panel.visibleWhen.query, () => `[Feature ${featureName}] Screen "${screenId}" (dashboard) ${panel.kind === "screen" ? "screen-panel" : "panel"} "${panel.id}" visibleWhen`);
         }
-        if (panel.kind === "screen")
+        if (panel.kind === "screen" || panel.kind === "text")
             continue;
         if (panel.kind === "stat-group") {
             for (const stat of panel.stats) {
@@ -70,6 +82,18 @@ function checkFormFieldQueryRefs(queryHandlers, featureName, screenId, screenTyp
         }
     }
 }
+function checkEditFormScreenQueryRefs(queryHandlers, featureName, screenId, screen) {
+    checkEditLayoutQueryRefs(queryHandlers, featureName, screenId, screen.type, screen.layout);
+    if (screen.type === "actionForm" && screen.load !== undefined) {
+        checkQueryRef(queryHandlers, screen.load.query, () => `[Feature ${featureName}] Screen "${screenId}" (actionForm) load`);
+    }
+    if (screen.type !== "entityEdit") {
+        checkFormFieldQueryRefs(queryHandlers, featureName, screenId, screen.type, screen.fields);
+    }
+    if (screen.type === "secretMint" && screen.confirm !== undefined) {
+        checkFormFieldQueryRefs(queryHandlers, featureName, screenId, "secretMint confirm", screen.confirm.fields);
+    }
+}
 function checkScreenQueryRefs(queryHandlers, featureName, screenId, screen) {
     if (screen.visibleWhen !== undefined) {
         checkVisibleWhenQueryRef(queryHandlers, screen.visibleWhen.query, () => `[Feature ${featureName}] Screen "${screenId}" (${screen.type}) visibleWhen`);
@@ -90,13 +114,7 @@ function checkScreenQueryRefs(queryHandlers, featureName, screenId, screen) {
         screen.type === "actionForm" ||
         screen.type === "configEdit" ||
         screen.type === "secretMint") {
-        checkEditLayoutQueryRefs(queryHandlers, featureName, screenId, screen.type, screen.layout);
-        if (screen.type !== "entityEdit") {
-            checkFormFieldQueryRefs(queryHandlers, featureName, screenId, screen.type, screen.fields);
-        }
-        if (screen.type === "secretMint" && screen.confirm !== undefined) {
-            checkFormFieldQueryRefs(queryHandlers, featureName, screenId, "secretMint confirm", screen.confirm.fields);
-        }
+        checkEditFormScreenQueryRefs(queryHandlers, featureName, screenId, screen);
     }
     else if (screen.type === "dashboard") {
         checkDashboardQueryRefs(queryHandlers, featureName, screenId, screen);

package/dist/engine/boot-validator/screens.d.ts

@@ -3,7 +3,7 @@ import type { ConfigKeyDefinition, FeatureDefinition } from "../types/index.ts";
 import type { ActionFormScreenDefinition, DashboardCustomPanel, DashboardScreenPanel, RelatedListToolbarAction, RowAction, RowFieldExtractor, ScreenDefinition, SecretMintScreenDefinition, ToolbarAction } from "../types/screen.ts";
 export declare function rowFieldExtractorKeys(params: RowFieldExtractor): readonly string[];
 export declare function readsNavigateParamsAsFormPrefill(target: ScreenDefinition, explicitEntityId: string | undefined, sourceScreenEntity: string | undefined): boolean;
-export declare function validateActionHasIcon(featureName: string, screenId: string, screenType: "projectionDetail" | "entityEdit" | "entityList" | "projectionList", context: string, action: {
+export declare function validateActionHasIcon(featureName: string, screenId: string, screenType: "projectionDetail" | "entityEdit" | "entityList" | "projectionList" | "dashboard", context: string, action: {
     readonly id: string;
     readonly icon?: IconKey;
 }): void;