@cosmicdrift/kumiko-framework 0.384.0 → 0.386.0

package/dist/engine/boot-validator/screens.js

@@ -1,1215 +1,30 @@
-// Screen validation, including the dashboard-panel sub-validators.
-// Dashboard stays here (not a separate dashboard.ts) — validateScreens
-// calls validateDashboardScreen and the dashboard validators call back
-// into validateColumnRendererForm, splitting them would create a
-// same-folder require cycle.
-import { resolveActionIcon } from "@cosmicdrift/kumiko-types/action-icon";
-import { NO_WIDGET_FIELD_TYPES, optionsQueryFieldRefs, SELECT_OPTION_TONES, } from "@cosmicdrift/kumiko-types/fields";
-import { NAV_ICON_KEYS } from "@cosmicdrift/kumiko-types/nav-icon";
-import { DASHBOARD_MIN_REFRESH_SECONDS } from "@cosmicdrift/kumiko-types/screen";
-import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+// Screen validation entry point. The sub-validators live in the screens-*.ts
+// siblings; dependencies only point one way (screens.ts -> dashboard/forms/lists
+// -> actions), so there is no same-folder require cycle.
+import { SELECT_OPTION_TONES } from "@cosmicdrift/kumiko-types/fields";
 import { isListFilterAllowed } from "../../db/entity-field-encryption.js";
 import { rowMetaFieldNames } from "../../db/table-builder.js";
-import { REFERENCE_LOOKUP_SOURCES } from "../../ui-types/list-row-meta.js";
 import { isEncryptedAtRest } from "../config-helpers.js";
-import { parseRefTarget } from "../parse-ref-target.js";
-import { isKebabSegment, isValidQn, qualifyEntityName } from "../qualified-name.js";
+import { qualifyEntityName } from "../qualified-name.js";
 import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops.js";
-import { explicitListScreenId, isExtensionEditSection, isFieldsEditSection, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../screen-helpers.js";
+import { isExtensionEditSection, isFieldsEditSection, isWriteFormEditSection, normalizeEditField, normalizeListColumn, sectionFieldSpecs, } from "../screen-helpers.js";
 import { LIST_ROW_META_COLUMN_NAMES } from "./entity-list-screens.js";
-import { validateFormDerivations, validateFormDerivationsEnforced } from "./form-derivations.js";
+import { isRowClickAction, rejectRedirectOnListRowAction, resolveRowActionNavigateTarget, validateActionFieldRefs, validateActionHasIcon, validateAtMostOneRowClick, validateClientActionName, validateDrawerTargetAction, validateNavigateActionTab, validatePrimaryActionTarget, validateRecordActionRedirect, validateRedirectTarget, validateRowActionNavigateParams, validateScreenVisibleWhen, } from "./screens-actions.js";
+import { validateDashboardActions, validateDashboardRecordBinding, validateDashboardScreen, } from "./screens-dashboard.js";
+import { isWriteOnlyField, rejectWriteOnlyFormField, validateConfigEditSecretField, validateEditFieldExtras, validateFieldFormRefs, validateFieldsXorGroups, validateFillActionTarget, validateFormSelectOptions, validateInlineFormScreen, validateNoWidgetRequiredField, validateSecretMintConfirm, validateTabSections, validateWizardLayout, } from "./screens-forms.js";
+import { assertRefTargetRegistered, rejectInertColumnSortable, validateColumnRendererForm, validateExplicitListScreenExists, validateListActionTargets, validateListFacets, validateRelatedListSection, validateScreenHasNavArea, } from "./screens-lists.js";
 import { isSelectOptionTone } from "./select-option-tone.js";
-function isRowClickAction(action) {
-    return (action.kind === "navigate" || action.kind === "drawer") && action.rowClick === true;
-}
-// entityList and projectionList both allow a rowAction to double as the
-// row-body click target (rowClick: true, fw#1708/#2164) — at most one per
-// screen, or the renderer can't tell which one should fire.
-function validateAtMostOneRowClick(featureName, screenId, screenType, rowActions) {
-    const rowClickActions = rowActions.filter(isRowClickAction);
-    if (rowClickActions.length > 1) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) has ${rowClickActions.length} ` +
-            "rowActions marked rowClick:true — at most one may fire on a row-body click. Mark at most one rowAction with rowClick: true.");
-    }
-}
-// A field type in NO_WIDGET_FIELD_TYPES renders read-only on the auto-wired
-// entityEdit path (#1925) — a required field the user can never fill would
-// block every save. Only the statically-resolvable case is caught here: a
-// literal `required: true` (screen-spec override or entity-level default).
-// A dynamic FieldCondition depends on runtime form values and can't be
-// evaluated at boot; buildFormSchema() silently skips presence-checking it.
-// `embeddedList` and `prefill` only make sense on field types that support them;
-// a misplaced spec would otherwise be a silent no-op.
-function validateEditFieldExtras(featureName, screenId, entityDef, fieldSpec) {
-    const fieldDef = entityDef.fields[fieldSpec.field];
-    // skip: the field name is not on the entity, other checks report unknown fields
-    if (fieldDef === undefined)
-        return;
-    const where = `[Feature ${featureName}] Screen "${screenId}" (entityEdit) field "${fieldSpec.field}"`;
-    const listSpec = fieldSpec.embeddedList;
-    if (listSpec !== undefined) {
-        if (fieldDef.type !== "embedded" || fieldDef.multiple !== true) {
-            throw new Error(`${where} sets embeddedList, which only applies to an embedded list ` +
-                `(createEmbeddedListField); the field is type "${fieldDef.type}". Remove embeddedList or point it at an embedded list field.`);
-        }
-        for (const cell of listSpec.readOnlyCells ?? []) {
-            if (fieldDef.schema[cell] === undefined) {
-                throw new Error(`${where} embeddedList.readOnlyCells names "${cell}", which is not a sub-field ` +
-                    `(known: ${Object.keys(fieldDef.schema).sort().join(", ")}).`);
-            }
-        }
-    }
-    const prefill = fieldSpec.prefill;
-    // skip: no prefill declared
-    if (prefill === undefined)
-        return;
-    if (prefill.kind === "today") {
-        if (fieldDef.type !== "date") {
-            throw new Error(`${where} prefill "today" needs a date field; the field is type "${fieldDef.type}". Use a date field or a different prefill.`);
-        }
-        // skip: today carries no property, nothing further to check
-        return;
-    }
-    const allowsUserId = fieldDef.type === "text" || fieldDef.type === "reference";
-    if (prefill.property === "id" ? !allowsUserId : fieldDef.type !== "text") {
-        throw new Error(`${where} prefill currentUser.${prefill.property} does not fit a field of type ` +
-            `"${fieldDef.type}" (displayName and email need text; id needs text or a reference). Use a fitting field type or a different prefill property.`);
-    }
-}
-// `{ field }` affixes and fillAction params read live form values, so every
-// name must be a field of the same form — a typo would otherwise render no
-// affix or send an undefined param without a hint.
-function validateFieldFormRefs(where, fieldSpec, formFieldNames) {
-    const affixes = [
-        ["prefix", fieldSpec.prefix],
-        ["suffix", fieldSpec.suffix],
-    ];
-    for (const [prop, affix] of affixes) {
-        if (affix === undefined || typeof affix === "string")
-            continue;
-        if (!formFieldNames.has(affix.field)) {
-            throw new Error(`${where} ${prop} references unknown field "${affix.field}" — it must be another field of the same form.`);
-        }
-    }
-    const params = fieldSpec.fillAction?.params;
-    // skip: no fill-action params to cross-check
-    if (params === undefined)
-        return;
-    const sourceFields = "pick" in params ? params.pick : Object.values(params.map);
-    for (const sourceField of sourceFields) {
-        if (!formFieldNames.has(sourceField)) {
-            throw new Error(`${where} fillAction.params reads unknown field "${sourceField}" — it must be a field of the same form.`);
-        }
-    }
-}
-const FILL_ACTION_FIELD_TYPES = ["text", "number", "decimal", "bigInt"];
-// The fill button writes a plain text or numeric query result into the field;
-// a secret value must never be filled from a query response.
-function validateFillActionTarget(where, fieldSpec, fieldDef) {
-    // skip: no fill action, or the field is unknown (reported elsewhere)
-    if (fieldSpec.fillAction === undefined || fieldDef === undefined)
-        return;
-    if (!FILL_ACTION_FIELD_TYPES.includes(fieldDef.type)) {
-        throw new Error(`${where} fillAction needs a ${FILL_ACTION_FIELD_TYPES.join(", ")} field, not "${fieldDef.type}". ` +
-            `Remove fillAction or use a fitting field type.`);
-    }
-    if (isSensitiveOrPasswordField(fieldDef)) {
-        throw new Error(`${where} fillAction targets a sensitive, writeOnly or password field — a query result is ` +
-            `never written into those. Remove fillAction.`);
-    }
-}
-function validateNoWidgetRequiredField(featureName, screenId, entityDef, fieldSpec) {
-    const fieldDef = entityDef.fields[fieldSpec.field];
-    // skip: field doesn't exist or its type already has a widget — nothing to validate.
-    if (fieldDef === undefined || !NO_WIDGET_FIELD_TYPES.includes(fieldDef.type))
-        return;
-    // Embedded LIST fields (`multiple: true`) get their own EmbeddedListField
-    // grid widget (#1838) — only plain (non-list) embedded has no widget.
-    const isEmbeddedList = fieldDef.type === "embedded" && fieldDef.multiple === true;
-    // skip: list variant has a widget — not the no-widget case this guard targets.
-    if (isEmbeddedList)
-        return;
-    // skip: already read-only by spec — no fillable widget needed regardless of type.
-    if (fieldSpec.readOnly === true)
-        return;
-    const entityRequired = "required" in fieldDef && fieldDef.required === true;
-    const isStaticallyRequired = fieldSpec.required === undefined ? entityRequired : fieldSpec.required === true;
-    // skip: not required — a read-only widget-less field is fine to leave empty.
-    if (!isStaticallyRequired)
-        return;
-    throw new Error(`[Feature ${featureName}] Screen "${screenId}" (entityEdit) field "${fieldSpec.field}" is ` +
-        `type "${fieldDef.type}", which renders read-only on the auto-wired entityEdit path — a ` +
-        `required field the user could never fill would block every save. Set required: false, ` +
-        `move the field to a custom-component section, or drop the required constraint.`);
-}
-export function rowFieldExtractorKeys(params) {
-    return "pick" in params ? params.pick : Object.keys(params.map);
-}
-// Mirrors the renderer's navigate: an explicit entityId, or a same-entity
-// entityEdit target (row["id"] auto-fill), opens UPDATE mode, which ignores params.
-export function readsNavigateParamsAsFormPrefill(target, explicitEntityId, sourceScreenEntity) {
-    if (target.type === "actionForm" || target.type === "secretMint")
-        return true;
-    if (target.type !== "entityEdit")
-        return false;
-    if (explicitEntityId !== undefined)
-        return false;
-    return sourceScreenEntity === undefined || target.entity !== sourceScreenEntity;
-}
-// Tier 2.7e navigate rowAction → target-screen params validity. Shared by
-// entityList and projectionList (framework#1708) — projectionList has no
-// `screen.entity`, so there's no same-entity row["id"] auto-fill case: any
-// entityEdit target without an explicit entityId reaches create there.
-//
-// dashboard targets (framework#1708 follow-up, commit 4e0d6cb26) also read
-// URL search params — but only for the single `filter.id` a dashboard
-// declares (useFilterParams in dashboard-body.tsx seeds its value from
-// `nav.searchParams[filter.id]`). A dashboard with no `filter` has nowhere
-// for the value to land, and a params extractor whose keys don't include
-// the filter's id would silently miss it — both are boot errors instead of
-// a silently-empty dashboard.
-function validateRowActionNavigateParams(featureName, screenId, screenType, screenEntity, action, target, actionLabel = "rowAction") {
-    // skip: not a navigate-with-params action — nothing to validate here.
-    if (action.kind !== "navigate" || action.params === undefined)
-        return;
-    // skip: unresolvable/custom target already reported (or exempt) elsewhere.
-    if (target === undefined || target.screen.type === "custom")
-        return;
-    // skip: entityList/projectionList targets also read URL search params (Tier
-    // 2.7c filter-prefill, see use-list-url-state.ts: `<screenId>.q/.sort/
-    // .dir/.page/.f.<field>`), not just actionForm/entityEdit-create.
-    if (target.screen.type === "entityList" || target.screen.type === "projectionList")
-        return;
-    if (target.screen.type === "dashboard") {
-        const targetDescriptor = action.screen !== undefined ? `"${action.screen}"` : `entity "${action.entity}"`;
-        const { filter, record, timeRange } = target.screen;
-        const readIds = [filter?.id, record?.param, timeRange?.id].filter((id) => id !== undefined);
-        if (readIds.length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" sets ` +
-                `params on navigate-target ${targetDescriptor} (dashboard) — target dashboard declares no ` +
-                `filter, time range or record binding — params would be a no-op. Remove the params extractor, or add a \`filter\` (or a \`record\` binding) to the ` +
-                `target dashboard so it has somewhere to read the value from.`);
-        }
-        const extractedKeys = rowFieldExtractorKeys(action.params);
-        if (!readIds.some((id) => extractedKeys.includes(id))) {
-            const readDescriptor = filter !== undefined && readIds.length === 1
-                ? `filter id is "${filter.id}"`
-                : `URL params are [${readIds.join(", ")}]`;
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" sets ` +
-                `params [${extractedKeys.join(", ")}] on navigate-target ${targetDescriptor} (dashboard) whose ` +
-                `${readDescriptor} — none of the extracted keys match, so the value would stay ` +
-                `unset. Fix the params extractor to produce one of these keys, or remove it.`);
-        }
-        // skip: a read id is present and the extractor's keys cover it — valid dashboard deep-link.
-        return;
-    }
-    if (!readsNavigateParamsAsFormPrefill(target.screen, action.entityId, screenEntity)) {
-        const isEntityEditUpdate = target.screen.type === "entityEdit";
-        const reason = isEntityEditUpdate
-            ? `resolves to UPDATE mode (${action.entityId !== undefined
-                ? `explicit entityId "${action.entityId}"`
-                : `same entity "${screenEntity}" auto-fills row["id"]`})`
-            : `screen type "${target.screen.type}"`;
-        const targetDescriptor = action.screen !== undefined ? `"${action.screen}"` : `entity "${action.entity}"`;
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-            `sets params on navigate-target ${targetDescriptor} which ${reason} — only actionForm, ` +
-            `secretMint and entityEdit-create targets read URL search params as initial values. Remove ` +
-            `the params extractor or retarget to an actionForm / secretMint / cross-entity ` +
-            `entityEdit-create screen.`);
-    }
-    const formTarget = target.screen;
-    if ((formTarget.type === "actionForm" || formTarget.type === "secretMint") &&
-        formTarget.submitPrefilled === true) {
-        validateDrawerPrefillKeys(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}"`, "navigate-target", action.screen ?? `entity "${action.entity}"`, formTarget, action.params);
-    }
-}
-// Shared by projectionDetail and entityEdit: a tab strip needs something to
-// label each tab with and a stable id per tab — the id anchors the ?tab=
-// param on projectionDetail and the jump-to-erroring-tab logic on entityEdit
-// (fw#3134).
-function validateTabSections(featureName, screenId, screenType, sections) {
-    if (sections.length < 2) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "tabs" but only ` +
-            `${sections.length} section(s) — tabs need at least 2 sections.`);
-    }
-    const tabIds = new Set();
-    sections.forEach((section, index) => {
-        if (section.title === undefined || section.title.trim().length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "tabs" but ` +
-                `sections[${index}] has no title — every tab needs a title.`);
-        }
-        if (section.id === undefined || section.id.trim().length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "tabs" but ` +
-                `sections[${index}] ("${section.title}") has no id — every tab needs a stable id.`);
-        }
-        if (!isKebabSegment(section.id)) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) sections[${index}] ` +
-                `("${section.title}") has id "${section.id}" — must be kebab-case.`);
-        }
-        if (tabIds.has(section.id)) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) has duplicate tab id ` +
-                `"${section.id}" (sections[${index}]). Give each tab section a unique id.`);
-        }
-        tabIds.add(section.id);
-    });
-}
-// Wizard layouts (mode: "wizard") need >= 2 titled sections — a single or
-// untitled step would leave the progress indicator blank, so both fail at
-// boot rather than as a broken step UI.
-function validateWizardLayout(featureName, screenId, screenType, layout, featureMap) {
-    // entityEdit renders tabs like wizard steps: every section stays mounted,
-    // submit validates across all of them, and a field error jumps to the tab
-    // holding it (fw#3134). The other three have no such jump — actionForm and
-    // secretMint are one-shot forms, configEdit fires a write per field — so a
-    // required field on a hidden tab would still block their submit silently.
-    if (layout.mode === "tabs") {
-        if (screenType !== "entityEdit") {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) sets mode: "tabs" — tabs are only ` +
-                `supported on projectionDetail and entityEdit. Use mode: "wizard" or "single" instead.`);
-        }
-        validateTabSections(featureName, screenId, screenType, layout.sections);
-    }
-    // "form-draft" is hardcoded because the framework layer must not depend on
-    // @cosmicdrift/kumiko-bundled-features — same precedence as the
-    // "user-data-rights" check in gdpr-storage.ts.
-    if (layout.draft === true) {
-        if (layout.mode !== "wizard") {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) sets draft: true but ` +
-                `mode is not "wizard" — draft persistence only applies to wizard layouts. Remove ` +
-                `draft: true or set mode: "wizard".`);
-        }
-        if (!featureMap.has("form-draft")) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) sets draft: true but the ` +
-                `bundled feature "form-draft" is not mounted — every resume would silently lose its ` +
-                `values. Add createFormDraftFeature() from @cosmicdrift/kumiko-bundled-features to the app's ` +
-                `feature list.`);
-        }
-    }
-    // skip: mode omitted/"single" — no wizard constraints apply.
-    if (layout.mode !== "wizard")
-        return;
-    if (layout.sections.length < 2) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "wizard" but only ` +
-            `${layout.sections.length} section(s) — a wizard needs at least 2 sections (one per step).`);
-    }
-    layout.sections.forEach((section, index) => {
-        if (section.title === undefined || section.title.trim().length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) has mode: "wizard" but ` +
-                `sections[${index}] has no title — every wizard step needs a title.`);
-        }
-    });
-}
-// --- Screen validation ---
-//
-// For every r.screen() declaration check what's locally knowable at boot:
-//   - entityList / entityEdit: the referenced entity must exist in the
-//     feature (cross-feature entity-refs aren't allowed — a feature owns
-//     the screens over its own entities) and every column/field ref must
-//     name a real field on that entity
-//   - custom: the renderer must at least have one platform component set
-//     (react OR native), otherwise the screen is structurally empty
-//
-// Field-level renderer QN strings (cross-feature `component:` references)
-// are NOT validated here — the r.uiComponent registry that would resolve
-// them ships in M4/M5. Until then those are kept opaque on purpose.
-// every action rendered in a Card title row (screen-level
-// `actions`, section-level `actions`, `emptyState.action`) must draw an
-// icon — declared or id-derived (resolveActionIcon, same resolver the
-// renderer uses). Uncovered here: entityList/projectionList rowActions —
-// those render inside a DataTable row, not a Card title row, so they keep
-// today's "icon optional" behavior.
-//
-// Registration check (not just "resolved is not undefined"): action.icon is
-// typed IconKey, a closed union — but that only protects call sites this
-// repo's own `tsc --build` actually covers (samples and external consumers
-// aren't in that project graph). The renderer's actionIconFor
-// (renderer/src/web/primitives/index.tsx) already falls back to "no icon"
-// for an unregistered key instead of crashing — this check makes the same
-// gap fail loudly at boot instead of silently at render.
-function isRegisteredIcon(icon) {
-    return isOneOf(NAV_ICON_KEYS, icon);
-}
-export function validateActionHasIcon(featureName, screenId, screenType, context, action) {
-    const resolved = resolveActionIcon(action.id, action.icon);
-    if (resolved === undefined || !isRegisteredIcon(resolved)) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${context} "${action.id}" has no ` +
-            `resolvable icon — set icon to a key registered in NAV_ICONS, or use an id that resolves one of ` +
-            `its kebab segments via the default icon map (resolveActionIcon).`);
-    }
-}
-// Tier 2.7e-3: deklarative Feld-Referenzen einer Action gegen die Entity-
-// Felder pinnen — ein Tippfehler in pick/map-Quellfeldern oder
-// visible.field erzeugte sonst still `undefined` im Payload bzw. dauerhaft
-// falsche Sichtbarkeit (gleiche "Typo fällt erst beim Klick"-Klasse wie
-// navigate/handler). Exported for query-output-columns.ts, which reuses it
-// against a projectionDetail's outputSchema-derived record shape instead of
-// an entity's field map (relatedList toolbarActions' visible/params).
-export function validateActionFieldRefs(featureName, screenId, actionKind, actionId, action, fieldNames, rowMeta) {
-    // ToolbarAction.payload ist ein STATISCHER Record (kein Row-Context) —
-    // nur echte pick/map-Extractoren werden gegen die Feldnamen geprüft.
-    const isExtractor = (v) => typeof v === "object" && v !== null && ("pick" in v || "map" in v);
-    const payload = "payload" in action && isExtractor(action.payload) ? action.payload : undefined;
-    const params = "params" in action && isExtractor(action.params) ? action.params : undefined;
-    const visible = "visible" in action ? action.visible : undefined;
-    const entityId = "entityId" in action ? action.entityId : undefined;
-    const known = () => [...fieldNames].sort().join(", ") || "(none)";
-    const checkExtractor = (label, extractor) => {
-        // skip: extractor ist ein optionaler Action-Slot — ohne ihn gibt es
-        // keine Feld-Referenzen zu validieren.
-        if (extractor === undefined) {
-            return;
-        }
-        const sources = "pick" in extractor ? extractor.pick : Object.values(extractor.map);
-        for (const source of sources) {
-            if (rowMeta.has(source))
-                continue;
-            if (!fieldNames.has(source)) {
-                throw new Error(`[Feature ${featureName}] Screen "${screenId}" ${actionKind} "${actionId}" ` +
-                    `${label} references unknown field "${source}". Known fields: ${known()}.`);
-            }
-        }
-    };
-    checkExtractor("payload", payload);
-    checkExtractor("params", params);
-    if (visible !== undefined &&
-        typeof visible !== "boolean" &&
-        !rowMeta.has(visible.field) &&
-        !fieldNames.has(visible.field)) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" ${actionKind} "${actionId}" ` +
-            `visible.field references unknown field "${visible.field}". Known fields: ${known()}.`);
-    }
-    if (entityId !== undefined && entityId !== "id" && !fieldNames.has(entityId)) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" ${actionKind} "${actionId}" ` +
-            `entityId references unknown field "${entityId}". Known fields: ${known()}.`);
-    }
-}
-// Two features registering the same short screen-id is a silent routing
-// footgun: create-app.tsx's runtime router resolves a bare navigate-target
-// id by scanning features[] and taking the first match — the collision
-// never surfaces as an error, the second feature's screen is just
-// unreachable by that id (and always the same one that loses, in whatever
-// order the app composed its features).
-export function validateScreenShortIdCollisions(screensByShortId) {
-    for (const [shortId, entries] of screensByShortId) {
-        const featureNames = new Set(entries.map((e) => e.featureName));
-        if (featureNames.size > 1) {
-            throw new Error(`Screen short-id "${shortId}" is registered by ${featureNames.size} features ` +
-                `(${[...featureNames].join(", ")}) — the runtime router resolves a bare navigate-target ` +
-                `id by taking the first match, so all but one of these screens would be unreachable by ` +
-                `that id. Give each screen a distinct id.`);
-        }
-    }
-}
-// redirect/cancelTarget accept either a same-feature short id (unchanged
-// behavior, qualified against the owning feature) or a fully-qualified
-// cross-feature screen QN (`<feature>:screen:<id>`) given verbatim — a
-// short id can never itself be a valid QN (QN_SEGMENT forbids colons), so
-// the two forms don't collide.
-export function resolveScreenTargetQn(featureName, target) {
-    return isValidQn(target) ? target : qualifyEntityName(featureName, "screen", target);
-}
-function validateScreenNavTarget(featureName, screenId, screenKind, fieldName, value, allScreenQns, screens) {
-    const candidateQn = resolveScreenTargetQn(featureName, value);
-    if (!allScreenQns.has(candidateQn)) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${fieldName} "${value}" ` +
-            `does not resolve to a registered screen (checked "${candidateQn}"). Known screens ` +
-            `in this feature: ${[...Object.keys(screens)].sort().join(", ") || "(none)"}.`);
-    }
-}
-// kind:"drawer" resolves same-feature only — unlike navigate/redirect,
-// which the runtime router resolves app-wide (see the comment on
-// validateScreens below), the drawer mounts the target inline using this
-// feature's schema, so a cross-feature reference could never actually
-// render. Two distinct failure messages: dangling reference vs. wrong
-// screen type. Shared by ToolbarAction (fw#2225) and RowAction (fw#2710)
-// drawer variants — same target-resolution rule, only the label in the
-// error message ("toolbarAction" vs. "rowAction" vs. "action") differs.
-function validateDrawerTargetAction(featureName, screenId, screenKind, actionLabel, action, screens) {
-    const target = screens[action.screen];
-    if (target === undefined) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +
-            `drawer-target "${action.screen}" does not resolve to a registered screen in this feature. ` +
-            `kind:"drawer" only resolves same-feature screens (unlike kind:"navigate", which can target ` +
-            `screens in any feature) — the drawer mounts the target inline using this feature's schema. ` +
-            `Known screens in this feature: ${[...Object.keys(screens)].sort().join(", ") || "(none)"}.`);
-    }
-    // secretMint is intentionally excluded — a one-time secret reveal belongs on
-    // its own page, not layered in a Drawer above a list.
-    if (target.type !== "actionForm") {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +
-            `drawer-target "${action.screen}" is a "${target.type}" screen, not an actionForm. ` +
-            `kind:"drawer" mounts an actionForm inside a Drawer widget — point "screen" at an ` +
-            `actionForm screen, or use kind:"navigate" for a full-page target.`);
-    }
-    // The renderer (mergeSearchParamsIntoInitial) silently drops a prefill key
-    // when the target doesn't declare the field, marks it sensitive/password,
-    // or doesn't render it in its layout — each would only show up as an empty
-    // field at click time.
-    // skip: no params extractor — nothing to check against the target's fields.
-    if (action.params === undefined)
-        return;
-    validateDrawerPrefillKeys(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}"`, "drawer-target", action.screen, target, action.params);
-}
-function renderedEditFieldNames(sections) {
-    const names = new Set();
-    for (const section of sections) {
-        if (!isFieldsEditSection(section))
-            continue;
-        for (const spec of sectionFieldSpecs(section))
-            names.add(normalizeEditField(spec).field);
-    }
-    return names;
-}
-function isSensitiveOrPasswordField(field) {
-    return (field !== undefined &&
-        (("sensitive" in field && field.sensitive === true) ||
-            ("writeOnly" in field && field.writeOnly === true) ||
-            ("format" in field && field.format === "password")));
-}
-export function validateDrawerPrefillKeys(where, targetLabel, targetScreenId, target, params) {
-    const renderedFieldNames = renderedEditFieldNames(target.layout.sections);
-    for (const fieldName of rowFieldExtractorKeys(params)) {
-        // A `load` form reads only the record id from these params, never a value.
-        if (fieldName === "id" && target.type === "actionForm" && target.load !== undefined)
-            continue;
-        if (!Object.hasOwn(target.fields, fieldName)) {
-            throw new Error(`${where} params prefills "${fieldName}", which ${targetLabel} "${targetScreenId}" does not declare as a ` +
-                `field — the renderer would drop it and leave the form empty. Target fields: ` +
-                `${Object.keys(target.fields).sort().join(", ") || "(none)"}.`);
-        }
-        if (isSensitiveOrPasswordField(target.fields[fieldName])) {
-            throw new Error(`${where} params prefills "${fieldName}", which ${targetLabel} "${targetScreenId}" marks as ` +
-                `sensitive or password — the renderer never prefills those fields and would leave the form empty. Remove that param or prefill a non-sensitive field.`);
-        }
-        if (!renderedFieldNames.has(fieldName)) {
-            throw new Error(`${where} params prefills "${fieldName}", which ${targetLabel} "${targetScreenId}" does not render in ` +
-                `its layout — the renderer only prefills fields the layout shows and would drop it.`);
-        }
-    }
-}
-// The target can be any screen, so this checks the resolved target's
-// sections, not the host's.
-function validateRowActionNavigateTab(featureName, screenId, screenType, actionLabel, action, target) {
-    // skip: no tab declared — nothing to check against the target's sections
-    if (action.tab === undefined)
-        return;
-    if (target === undefined) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-            `sets tab "${action.tab}", but its navigate-target could not be resolved to a screen. Point the navigate-target at a registered screen.`);
-    }
-    if (target.screen.type !== "projectionDetail" || target.screen.layout.mode !== "tabs") {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-            `sets tab "${action.tab}", but navigate-target screen "${target.screen.id}" is not a ` +
-            `projectionDetail with layout.mode "tabs" — only those read the tab param. Remove the tab or navigate to a projectionDetail screen with layout.mode "tabs".`);
-    }
-    const sectionIds = target.screen.layout.sections
-        .map((section) => section.id)
-        .filter((id) => id !== undefined);
-    if (!sectionIds.includes(action.tab)) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-            `navigates to tab "${action.tab}", which is not a section id on target screen ` +
-            `"${target.screen.id}". Available: ${sectionIds.join(", ") || "(none)"}.`);
-    }
-}
-function resolveRowActionNavigateTarget(featureName, screenId, screenType, actionLabel, action, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens) {
-    if (action.entity !== undefined) {
-        if (action.screen !== undefined) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-                `sets both "screen" and "entity" — exactly one navigate-target form is allowed.`);
-        }
-        if (screenType !== "entityList" && action.entityId === undefined) {
-            // entityList rows are always a real entity record, so row["id"] is a
-            // safe implicit default. projectionList/projectionDetail rows come from
-            // an arbitrary query projection with no guaranteed "id" field — an
-            // entity-target there needs an explicit entityId, or navigation silently
-            // opens the detail screen with no entity context at runtime.
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-                `navigate-target entity "${action.entity}" needs an explicit "entityId" — ${screenType} rows ` +
-                `come from a query projection with no guaranteed "id" field.`);
-        }
-        const detail = detailForScreens.get(action.entity);
-        if (detail === undefined) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-                `navigate-target entity "${action.entity}" has no screen declaring ` +
-                `detailFor: "${action.entity}". Add detailFor: "${action.entity}" to a screen or navigate to a screen directly.`);
-        }
-        validateRowActionNavigateTab(featureName, screenId, screenType, actionLabel, action, detail);
-        return detail;
-    }
-    if (action.screen === undefined) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-            `sets neither "screen" nor "entity" — exactly one navigate-target form is required.`);
-    }
-    const candidateQn = qualifyEntityName(featureName, "screen", action.screen);
-    if (!allScreenQns.has(candidateQn) && !navTargetShortIds.has(action.screen)) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) ${actionLabel} "${action.id}" ` +
-            `navigate-target "${action.screen}" does not resolve to a registered screen in any feature. Use "<feature>:screen:<id>" of an existing screen.`);
-    }
-    const target = screensByShortId.get(action.screen)?.[0];
-    validateRowActionNavigateTab(featureName, screenId, screenType, actionLabel, action, target);
-    return target;
-}
-// Shared by the mint step's own handler (screen.handler) and its optional
-// confirm step (confirm.handler) — both are a bare write-handler QN with the
-// same registration requirement.
-function validateWriteHandlerRegistered(featureName, screenId, context, handler, allWriteHandlerQns) {
-    if (!handler || typeof handler !== "string") {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) has empty or non-string handler. Set handler to a non-empty handler name.`);
-    }
-    if (!allWriteHandlerQns.has(handler)) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) handler "${handler}" ` +
-            `is not a registered write-handler. Check the QN spelling (expected ` +
-            `"<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`);
-    }
-}
-// Every field entry must carry a `type` discriminator. An author typo
-// (`title: { required: true }` without a type) would otherwise let
-// RenderField silently fall through to the default renderer and submit an
-// empty string — failing at boot is clearer. `type as unknown` because
-// FieldDefinition, as a union, only allows known type strings; here we're
-// checking author code that may have circumvented the type check.
-//
-// Parametrized over (fields, layout) instead of a whole screen so a
-// secretMint's own `confirm` step — a second, independent inline form on the
-// same screen — can reuse the same checks as its `fields`/`layout` pair.
-// `allowEmpty` is only ever true for a secretMint's own mint step (an
-// input-less mint, fw#2838): the secret is server-generated and the mint
-// step is just its submit button — actionForm and the confirm step always
-// require at least one field.
-function validateFormFieldsMap(featureName, screenId, context, fields, allowEmpty) {
-    const fieldNames = new Set(Object.keys(fields));
-    if (fieldNames.size === 0 && !allowEmpty) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) has empty fields map — ` +
-            `declare at least one field.`);
-    }
-    for (const [fname, fdef] of Object.entries(fields)) {
-        // @cast-boundary schema-walk — feature-config inspection (Author may circumvent type-check)
-        const ftype = fdef.type;
-        if (typeof ftype !== "string" || ftype.length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) field "${fname}" has no ` +
-                `\`type\` set. Each field must declare a type (e.g. "text", "number", "select").`);
-        }
-        if (ftype === "money") {
-            validateFormMoneyCurrency(featureName, screenId, context, fname, fdef);
-        }
-        validateFormSelectOptions(featureName, screenId, context, fname, fdef, fieldNames);
-        rejectWriteOnlyFormField(featureName, screenId, context, fname, fdef);
-    }
-    return fieldNames;
-}
-function validateOptionsQueryFieldRefs(where, fieldName, payload, siblingFieldNames) {
-    for (const ref of optionsQueryFieldRefs(payload)) {
-        if (ref === fieldName) {
-            throw new Error(`${where} optionsQueryPayload references itself ({ field: "${ref}" }). Reference a different field of the form.`);
-        }
-        if (!siblingFieldNames.has(ref)) {
-            throw new Error(`${where} optionsQueryPayload references unknown field "${ref}" — it must be another field of the same form`);
-        }
-    }
-}
-function isWriteOnlyField(fdef) {
-    return fdef?.writeOnly === true; // @cast-boundary schema-walk
-}
-// A secret on a configEdit form keeps its value out of the client like an encrypted
-// config key does, and the secrets store only exists per tenant.
-function validateConfigEditSecretField(featureName, screen, fieldName, secretQn, featureMap) {
-    const where = `[Feature ${featureName}] Screen "${screen.id}" (configEdit) field "${fieldName}"`;
-    if (screen.configKeys[fieldName] !== undefined) {
-        throw new Error(`${where} is mapped in both configKeys and secretKeys — keep one.`);
-    }
-    if (screen.scope !== "tenant") {
-        throw new Error(`${where} maps secret "${secretQn}" on a ${screen.scope}-scope screen — secrets are tenant-scoped.`);
-    }
-    const fdef = screen.fields[fieldName];
-    if (fdef?.type !== "text" || !isWriteOnlyField(fdef)) {
-        throw new Error(`${where} maps secret "${secretQn}" but is no writeOnly text field — a stored secret never goes back to the client.`);
-    }
-    const declared = [...featureMap.values()].some((feature) => Object.values(feature.secretKeys ?? {}).some((def) => def.qualifiedName === secretQn));
-    if (!declared) {
-        throw new Error(`${where} → secret "${secretQn}" is not declared via r.secret() in any feature.`);
-    }
-}
-// Inline forms have no stored value to hide or keep: writeOnly there would
-// render a "set / keep" affordance with nothing behind it.
-function rejectWriteOnlyFormField(featureName, screenId, context, fieldName, fdef) {
-    if (isWriteOnlyField(fdef)) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) field "${fieldName}" declares writeOnly — ` +
-            `writeOnly only applies to entity fields (nothing to hide on a form that stores no value). ` +
-            `Use format: "password" for a masked input.`);
-    }
-}
-// Static options XOR optionsQuery on inline-form select fields, and `{ field }`
-// payload refs must name another field of the same form (the payload also feeds
-// optionsAvailabilityQuery). The QN existence check
-// lives in query-refs.ts with the other query refs.
-const CONDITIONAL_OPTIONS_ENTITY_ONLY = "conditionalOptions is only supported on entity select fields (enforced by the entity write path)";
-function validateFormSelectOptions(featureName, screenId, context, fieldName, fdef, siblingFieldNames) {
-    if (fdef.type === "select") {
-        const where = `[Feature ${featureName}] Screen "${screenId}" (${context}) select field "${fieldName}"`;
-        if (fdef.conditionalOptions !== undefined) {
-            throw new Error(`${where} declares conditionalOptions — ${CONDITIONAL_OPTIONS_ENTITY_ONLY}. Remove conditionalOptions from this field.`);
-        }
-        if (fdef.optionsQuery !== undefined) {
-            if (fdef.optionsQuery.length === 0) {
-                throw new Error(`${where} has an empty optionsQuery. Set it to a query name or remove it.`);
-            }
-            if (fdef.options.length > 0) {
-                throw new Error(`${where} declares both options and optionsQuery — pick one`);
-            }
-            if (fdef.optionsAvailabilityQuery !== undefined) {
-                throw new Error(`${where} declares both optionsQuery and optionsAvailabilityQuery — availability only applies to static options`);
-            }
-            validateOptionsQueryFieldRefs(where, fieldName, fdef.optionsQueryPayload, siblingFieldNames);
-        }
-        else if (fdef.optionsAvailabilityQuery !== undefined) {
-            if (fdef.optionsAvailabilityQuery.length === 0) {
-                throw new Error(`${where} has an empty optionsAvailabilityQuery. Set it to a query name or remove it.`);
-            }
-            validateOptionsQueryFieldRefs(where, fieldName, fdef.optionsQueryPayload, siblingFieldNames);
-        }
-        else if (fdef.optionsQueryPayload !== undefined) {
-            throw new Error(`${where} has optionsQueryPayload without optionsQuery. Set optionsQuery or remove optionsQueryPayload.`);
-        }
-    }
-    else if (fdef.type === "multiSelect" && fdef.optionsAvailabilityQuery !== undefined) {
-        if (fdef.optionsAvailabilityQuery.length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) multiSelect field "${fieldName}" has an empty optionsAvailabilityQuery. Set it to a query name or remove it.`);
-        }
-    }
-}
-// Fail-closed currency-source gate (fw#2839), the runtime half of the
-// narrowed `FormFieldDefinition` — an untyped JS consumer has no compiler to
-// stop it. An inline form screen has no entity, so a money field there can't
-// borrow `entity.defaultCurrency`: without a declared source the renderer
-// seeds a bare `0` and the handler's zod schema rejects the submit. Entity
-// money fields are exempt — create-app already refuses an entity that holds
-// money without a `defaultCurrency`.
-function validateFormMoneyCurrency(featureName, screenId, context, fieldName, fdef) {
-    const where = `[Feature ${featureName}] Screen "${screenId}" (${context}) money field "${fieldName}"`;
-    const validForms = `Declare \`currency: { kind: "literal", code: "EUR" }\` for a fixed currency, or ` +
-        `\`currency: { kind: "tenant" }\` to take the tenant-settings bundle's per-tenant currency.`;
-    // @cast-boundary schema-walk — feature-config inspection (Author may circumvent type-check)
-    const currency = fdef.currency;
-    if (currency === undefined) {
-        throw new Error(`${where} must declare where its currency comes from — this screen has no entity whose ` +
-            `\`defaultCurrency\` it could inherit, so the form would seed a bare \`0\` that the ` +
-            `handler's schema rejects. ${validForms}`);
-    }
-    if (typeof currency !== "object" || currency === null) {
-        throw new Error(`${where} has a non-object \`currency\`. ${validForms}`);
-    }
-    const kind = currency.kind;
-    if (kind === "literal") {
-        const code = currency.code;
-        if (typeof code !== "string" || code.trim() === "") {
-            throw new Error(`${where} declares \`currency: { kind: "literal" }\` with an empty or non-string \`code\`. ` +
-                `Pass the ISO code, e.g. { kind: "literal", code: "EUR" }.`);
-        }
-    }
-    else if (kind !== "tenant") {
-        throw new Error(`${where} declares an unknown currency kind ${JSON.stringify(kind)}. ${validForms}`);
-    }
-}
-// `allowEmptySections` mirrors `validateFormFieldsMap`'s `allowEmpty` — the
-// caller only ever passes true together with an actually-empty fields map
-// (an input-less secretMint declares BOTH `fields: {}` and
-// `layout.sections: []`; fields declared with no layout to show them stays
-// an error).
-// `fields`/`groups` are mutually exclusive on a fields-kind section; shared by
-// every EditLayout-walking screen type instead of four hand-rolled copies.
-function validateFieldsXorGroups(errorPrefix, section) {
-    if (section.fields !== undefined && section.groups !== undefined) {
-        throw new Error(`${errorPrefix} section "${section.title}" declares both fields and groups — remove ` +
-            `\`fields: []\` when using groups.`);
-    }
-    if ((section.fields?.length ?? 0) === 0 && (section.groups?.length ?? 0) === 0) {
-        throw new Error(`${errorPrefix} has a section "${section.title}" with zero fields — drop the section or add ` +
-            `fields (or groups) to it.`);
-    }
-}
-function validateFormLayoutSections(featureName, screenId, context, layout, fieldNames, fieldDefs, allowEmptySections) {
-    if (layout.sections.length === 0) {
-        // skip: an input-less secretMint declares fields: {} and sections: [] together — no sections to validate.
-        if (allowEmptySections)
-            return;
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) has an empty sections list — ` +
-            `declare at least one section.`);
-    }
-    for (const section of layout.sections) {
-        if (isExtensionEditSection(section)) {
-            if (section.component?.react === undefined && section.component?.native === undefined) {
-                throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) extension section ` +
-                    `"${section.title}" has no component — declare a react/native component marker.`);
-            }
-            continue;
-        }
-        if (section.kind === "relatedList") {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) relatedList section ` +
-                `"${section.title}" is not supported — relatedList is a projectionDetail-only ` +
-                `primitive (fw#2166). Move the section to a projectionDetail screen or remove it.`);
-        }
-        if (isWriteFormEditSection(section)) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) writeForm section ` +
-                `"${section.title}" is not supported — writeForm is a projectionDetail-only primitive. Move the section to a projectionDetail screen or remove it.`);
-        }
-        validateFieldsXorGroups(`[Feature ${featureName}] Screen "${screenId}" (${context})`, section);
-        for (const fieldSpec of sectionFieldSpecs(section)) {
-            const normalized = normalizeEditField(fieldSpec);
-            if (!fieldNames.has(normalized.field)) {
-                throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${context}) layout references unknown field ` +
-                    `"${normalized.field}". Known fields: ${[...fieldNames].sort().join(", ")}`);
-            }
-            const fieldWhere = `[Feature ${featureName}] Screen "${screenId}" (${context}) field "${normalized.field}"`;
-            validateFieldFormRefs(fieldWhere, normalized, fieldNames);
-            validateFillActionTarget(fieldWhere, normalized, fieldDefs[normalized.field]);
-        }
-    }
-}
-// redirect is either a short screen id (same-feature, e.g. "item-list") or
-// a fully-qualified cross-feature QN (`<feature>:screen:<id>`) — the
-// renderer strips the latter to the short id (lastSegment) when
-// navigating, which the nav-router resolves app-wide (#1946). The object
-// form (fw#2670) carries the same target under `screen` plus the payload
-// field `idFrom`. Shared by actionForm/secretMint (validateInlineFormNavTargets)
-// and entityEdit — same rule, same error message, one place to keep them in sync.
-function validateRedirectTarget(feature, screenId, screenKind, redirect, lookups, 
-// Property name used in error messages (`successLinks[0]` for a success link).
-propertyPath = "redirect") {
-    const { allScreenQns } = lookups;
-    const redirectTarget = typeof redirect === "string" ? redirect : redirect.screen;
-    if (typeof redirect !== "string" &&
-        (typeof redirect.idFrom !== "string" || redirect.idFrom.trim() === "")) {
-        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${screenKind}) ${propertyPath}.idFrom is empty or not a string — ` +
-            `name the success-payload field carrying the navigation id, or use the plain string ` +
-            `redirect form to navigate with the handler's own "id".`);
-    }
-    // The renderer reads idFrom verbatim (Object.hasOwn), so stray whitespace
-    // never matches and the navigation silently lands without an entityId.
-    if (typeof redirect !== "string" && redirect.idFrom !== redirect.idFrom.trim()) {
-        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${screenKind}) ${propertyPath}.idFrom "${redirect.idFrom}" ` +
-            `has leading/trailing whitespace — it would never match a payload field. Remove the whitespace from idFrom.`);
-    }
-    validateScreenNavTarget(feature.name, screenId, screenKind, propertyPath, redirectTarget, allScreenQns, feature.screens);
-    // idFrom only means something to a target that carries a record id; the
-    // renderer drops it silently otherwise. Cross-feature QN targets can't be
-    // typed from here and stay unchecked.
-    const sameFeatureTarget = feature.screens[redirectTarget];
-    if (typeof redirect !== "string" &&
-        sameFeatureTarget !== undefined &&
-        sameFeatureTarget.type !== "entityEdit" &&
-        sameFeatureTarget.type !== "projectionDetail") {
-        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${screenKind}) ${propertyPath}.idFrom is set but target screen ` +
-            `"${redirectTarget}" (${sameFeatureTarget.type}) carries no id — use the plain string form.`);
-    }
-    if (typeof redirect !== "string" && redirect.tab !== undefined) {
-        validateRowActionNavigateTab(feature.name, screenId, screenKind, propertyPath, { kind: "navigate", id: redirectTarget, label: redirectTarget, tab: redirect.tab }, findNavTargetEntry(feature, redirectTarget, lookups));
-    }
-}
-function findNavTargetEntry(feature, target, lookups) {
-    const targetQn = resolveScreenTargetQn(feature.name, target);
-    return lookups.screensByShortId
-        .get(targetQn.slice(targetQn.lastIndexOf(":") + 1))
-        ?.find((entry) => qualifyEntityName(entry.featureName, "screen", entry.screen.id) === targetQn);
-}
-// A success link without idFrom navigates without an id, so its target must not
-// be a record screen (entityEdit/projectionDetail need one).
-function validateIdlessSuccessLink(feature, screenId, screenKind, link, lookups, propertyPath) {
-    validateScreenNavTarget(feature.name, screenId, screenKind, propertyPath, link.screen, lookups.allScreenQns, feature.screens);
-    const target = findNavTargetEntry(feature, link.screen, lookups);
-    const targetType = target?.screen.type;
-    if (targetType === "entityEdit" || targetType === "projectionDetail") {
-        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${screenKind}) ${propertyPath} targets "${link.screen}" ` +
-            `(${targetType}), a record screen — set ${propertyPath}.idFrom to the success-payload field carrying the record id.`);
-    }
-    if (link.tab !== undefined) {
-        validateRowActionNavigateTab(feature.name, screenId, screenKind, propertyPath, { kind: "navigate", id: link.screen, label: link.screen, tab: link.tab }, target);
-    }
-}
-// A clientAction names a handler a client feature registers
-// (ClientFeatureDefinition.clientActions). Nothing server-side can confirm the
-// registration, so the shape is the only boot-time check.
-function validateClientActionName(featureName, screenId, screenKind, actionLabel, action) {
-    const segments = action.action.split(":");
-    const [scope, name] = segments;
-    const wellFormed = segments.length === 2 &&
-        scope !== undefined &&
-        name !== undefined &&
-        isKebabSegment(scope) &&
-        isKebabSegment(name);
-    // skip: well-formed name, nothing to reject
-    if (wellFormed)
-        return;
-    throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +
-        `action "${action.action}" is not a client action name — expected "<feature>:<kebab-name>", ` +
-        `e.g. "auth-email-password:request-password-reset".`);
-}
-// redirect is only honored on record actions; on list/related-list row
-// actions it would be silently dropped, so the author would believe it works.
-function rejectRedirectOnListRowAction(featureName, screenId, screenKind, action) {
-    if (action.kind !== "navigate" &&
-        action.kind !== "drawer" &&
-        action.kind !== "clientAction" &&
-        action.redirect !== undefined) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) rowAction "${action.id}" sets redirect — ` +
-            `redirect is only honored on record actions (projectionDetail/entityEdit header and section ` +
-            `actions) and is ignored on list row actions. Remove it.`);
-    }
-}
-// A writeHandler record action's redirect (projectionDetail/entityEdit
-// header and section actions) follows the entityEdit.redirect rule.
-function validateRecordActionRedirect(feature, screenId, screenKind, action, lookups) {
-    if (action.kind !== "navigate" &&
-        action.kind !== "drawer" &&
-        action.kind !== "clientAction" &&
-        action.redirect !== undefined) {
-        validateRedirectTarget(feature, screenId, screenKind, action.redirect, lookups);
-    }
-}
-// "edit" is the default edit action, which only exists when detailFor names
-// the entity; a typo would otherwise silently fall back to the default precedence.
-function validatePrimaryActionTarget(featureName, screenId, screen) {
-    // skip: no declared primaryAction, the default header precedence applies
-    if (screen.primaryAction === undefined)
-        return;
-    const declaredIds = (screen.actions ?? []).map((action) => action.id);
-    const editIsAvailable = screen.detailFor !== undefined;
-    const targetExists = declaredIds.includes(screen.primaryAction) ||
-        (editIsAvailable && screen.primaryAction === "edit");
-    if (!targetExists) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (projectionDetail) primaryAction "${screen.primaryAction}" ` +
-            `matches no action — use one of the declared action ids (${declaredIds.join(", ") || "none declared"})` +
-            `${editIsAvailable ? ' or "edit"' : ' ("edit" needs detailFor on this screen)'}.`);
-    }
-}
-function validateScreenVisibleWhen(feature, screenId, screen, allScreenQns, featureMap) {
-    const { visibleWhen, fallback } = screen;
-    const context = `[Feature ${feature.name}] Screen "${screenId}" (${screen.type})`;
-    if (visibleWhen === undefined && fallback !== undefined) {
-        throw new Error(`${context} declares fallback without visibleWhen. Add visibleWhen or remove fallback.`);
-    }
-    if (visibleWhen !== undefined && (visibleWhen.query === "" || visibleWhen.field === "")) {
-        throw new Error(`${context} visibleWhen needs a non-empty query and field. Set both visibleWhen.query and visibleWhen.field.`);
-    }
-    if (fallback !== undefined) {
-        validateScreenFallback(feature, screenId, screen.type, fallback, allScreenQns, featureMap);
-    }
-}
-function validateScreenFallback(feature, screenId, screenType, fallback, allScreenQns, featureMap) {
-    const context = `[Feature ${feature.name}] Screen "${screenId}" (${screenType})`;
-    validateScreenNavTarget(feature.name, screenId, screenType, "fallback", fallback, allScreenQns, feature.screens);
-    const fallbackQn = resolveScreenTargetQn(feature.name, fallback);
-    if (fallbackQn === qualifyEntityName(feature.name, "screen", screenId)) {
-        throw new Error(`${context} fallback points at the screen itself. Point fallback at a different screen.`);
-    }
-    // A gated fallback could hide in turn and chain or cycle (A→B→A); one hop keeps the
-    // runtime gate trivially terminating.
-    const [fallbackFeatureName = "", , fallbackShortId = ""] = fallbackQn.split(":");
-    if (featureMap.get(fallbackFeatureName)?.screens[fallbackShortId]?.visibleWhen !== undefined) {
-        throw new Error(`${context} fallback "${fallback}" has its own visibleWhen; a fallback must always render.`);
-    }
-}
-function validateInlineFormNavTargets(feature, screenId, screen, kind, lookups) {
-    const { allScreenQns } = lookups;
-    if (screen.redirect !== undefined) {
-        validateRedirectTarget(feature, screenId, kind, screen.redirect, lookups);
-    }
-    if (screen.type === "actionForm" &&
-        screen.successFacts !== undefined &&
-        screen.redirect !== undefined) {
-        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (actionForm) sets both redirect and successFacts — ` +
-            `redirect leaves the screen, successFacts are shown on it. Use one of them.`);
-    }
-    if (screen.type === "actionForm" && screen.successLinks !== undefined) {
-        if (screen.redirect !== undefined) {
-            throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (actionForm) sets both redirect and successLinks — ` +
-                `redirect leaves the screen, successLinks keep it open. Use one of them.`);
-        }
-        screen.successLinks.forEach((link, index) => {
-            const propertyPath = `successLinks[${index}]`;
-            if (link.idFrom === undefined) {
-                validateIdlessSuccessLink(feature, screenId, "actionForm", link, lookups, propertyPath);
-            }
-            else {
-                validateRedirectTarget(feature, screenId, kind, { ...link, idFrom: link.idFrom }, lookups, propertyPath);
-            }
-        });
-    }
-    if (typeof screen.cancelTarget === "string") {
-        // Same rule as redirect — `false` (no Cancel button) needs no validation.
-        validateScreenNavTarget(feature.name, screenId, kind, "cancelTarget", screen.cancelTarget, allScreenQns, feature.screens);
-    }
-}
-// actionForm/secretMint have no entity link, only a write-handler QN +
-// inline fields: checks handler registration, field types, layout refs, and nav targets.
-function validateInlineFormScreen(feature, screenId, screen, kind, allWriteHandlerQns, lookups, featureMap) {
-    validateWriteHandlerRegistered(feature.name, screenId, kind, screen.handler, allWriteHandlerQns);
-    // Only a secretMint's own mint step may skip fields/sections entirely
-    // (input-less mint, fw#2838) — actionForm always needs at least one field.
-    const allowEmptyMintForm = kind === "secretMint";
-    const fieldNames = validateFormFieldsMap(feature.name, screenId, kind, screen.fields, allowEmptyMintForm);
-    validateFormLayoutSections(feature.name, screenId, kind, screen.layout, fieldNames, screen.fields, allowEmptyMintForm && fieldNames.size === 0);
-    validateWizardLayout(feature.name, screenId, kind, screen.layout, featureMap);
-    if (screen.type === "actionForm") {
-        validateFormDerivations(feature.name, screenId, screen);
-        validateFormDerivationsEnforced(feature.name, screenId, screen, featureMap);
-    }
-    if (screen.type === "actionForm" &&
-        screen.load?.singleton === true &&
-        screen.load.idParam !== undefined) {
-        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (actionForm) sets both load.singleton: true ` +
-            `and load.idParam — singleton means the query picks the row from the caller's context, so ` +
-            `there is no record id to send under idParam. Remove idParam.`);
-    }
-    validateInlineFormNavTargets(feature, screenId, screen, kind, lookups);
-}
-// SecretMintConfirmStep (fw#2838): an optional proof-of-receipt form rendered
-// on the reveal card in place of the bare acknowledge button (TOTP enrollment:
-// scan the code, then enter one). Unlike the mint step, confirm always needs
-// at least one field — a step whose only job is proving receipt with no input
-// would be meaningless — and its layout is a single plain form, never a
-// wizard/tabs flow and never a persisted draft: a one-time reveal-confirm is
-// not a multi-step flow, and persisting a draft of it would re-open the leak
-// fw#2548 closed (a lingering copy of the just-revealed secret in storage).
-function validateSecretMintConfirm(feature, screenId, screen, allWriteHandlerQns) {
-    const confirm = screen.confirm;
-    // skip: the screen declares no confirm step — nothing to validate.
-    if (confirm === undefined)
-        return;
-    const context = "secretMint confirm";
-    validateWriteHandlerRegistered(feature.name, screenId, context, confirm.handler, allWriteHandlerQns);
-    const fieldNames = validateFormFieldsMap(feature.name, screenId, context, confirm.fields, false);
-    validateFormLayoutSections(feature.name, screenId, context, confirm.layout, fieldNames, confirm.fields, false);
-    if (confirm.layout.mode !== undefined && confirm.layout.mode !== "single") {
-        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${context}) sets layout.mode: ` +
-            `"${confirm.layout.mode}" — a one-time reveal confirm step must stay a single-step form. ` +
-            `Remove mode or set it to "single".`);
-    }
-    if (confirm.layout.draft === true) {
-        throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${context}) sets layout.draft: true — ` +
-            `persisting a draft of the reveal-confirm step would leak the one-time secret into storage, ` +
-            `the exact leak fw#2548 closed. Remove draft: true.`);
-    }
-    // skip: no carry list declared — no carried fields to cross-check against confirm.fields.
-    if (confirm.carry === undefined)
-        return;
-    for (const carryField of confirm.carry) {
-        if (typeof carryField !== "string" || carryField.trim() === "") {
-            throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${context}) has an empty or non-string ` +
-                `entry in "carry". Use non-empty strings in carry.`);
-        }
-        if (fieldNames.has(carryField)) {
-            throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (${context}) carry field "${carryField}" ` +
-                `also names a confirm.fields entry — a carried mint-payload value would silently ` +
-                `overwrite the user-entered field of the same name. Rename one of them.`);
-        }
-    }
-}
-// validateScreenHasNavArea runs once per screen; the index is built once per
-// featureMap (immutable during boot) instead of re-scanning every feature each call.
-const navAreaIndexByFeatureMap = new WeakMap();
-function navTargetScreenQns(nav) {
-    return [nav.screen, nav.createAction?.screen, ...(nav.actions ?? []).map((a) => a.screen)].filter((qn) => qn !== undefined);
-}
-function getNavAreaIndex(featureMap) {
-    const cached = navAreaIndexByFeatureMap.get(featureMap);
-    if (cached !== undefined)
-        return cached;
-    const navTargetQns = new Set();
-    const allScreens = [];
-    let anyNavRegistered = false;
-    for (const f of featureMap.values()) {
-        allScreens.push(...Object.values(f.screens));
-        for (const nav of Object.values(f.navs)) {
-            anyNavRegistered = true;
-            for (const qn of navTargetScreenQns(nav))
-                navTargetQns.add(qn);
-        }
-    }
-    const index = { anyNavRegistered, navTargetQns, allScreens };
-    navAreaIndexByFeatureMap.set(featureMap, index);
-    return index;
-}
-// resolveNavParentScreen falls back to a heuristic when the explicit
-// listScreenId matches no screen, so a typo would silently get the guess.
-function validateExplicitListScreenExists(featureName, screenId, screen, screensByShortId) {
-    const listScreenId = explicitListScreenId(screen);
-    // skip: no explicit listScreenId, the nav heuristic applies and there is nothing to validate
-    if (listScreenId === undefined)
-        return;
-    const shortId = listScreenId.slice(listScreenId.lastIndexOf(":") + 1);
-    // skip: the explicit listScreenId resolves to a mounted screen
-    if (screensByShortId.has(shortId))
-        return;
-    throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screen.type}) listScreenId "${listScreenId}" ` +
-        `matches no mounted screen — fix the id or mount the list screen.`);
-}
-// Every screen must resolve nav via `nav`, `r.nav()`, a parent list, or
-// `dormant: true`. Skipped when the composed set has no nav entries at all.
-function validateScreenHasNavArea(feature, screenId, screen, featureMap) {
-    // skip: the screen already declares its own nav entry.
-    if (screen.nav !== undefined)
-        return;
-    // skip: explicitly opted out via `dormant: true`.
-    if (screen.dormant === true)
-        return;
-    const { anyNavRegistered, navTargetQns, allScreens } = getNavAreaIndex(featureMap);
-    // skip: no nav entries exist anywhere in the composed set — a feature/
-    // recipe/test fixture booted without an app shell, not an omission.
-    if (!anyNavRegistered)
-        return;
-    const targetQn = qualifyEntityName(feature.name, "screen", screenId);
-    // skip: a standalone r.nav() elsewhere already points at this screen.
-    if (navTargetQns.has(targetQn))
-        return;
-    // skip: resolves to a parent list via listScreenId/rowAction-target/same-entity.
-    if (resolveNavParentScreen(allScreens, screen, (s) => s.id) !== undefined)
-        return;
-    throw new Error(`[Feature ${feature.name}] Screen "${targetQn}" has no nav entry and no resolvable list — ` +
-        `declare listScreenId (or a rowAction/toolbarAction navigate target from a list screen), add ` +
-        `a standalone r.nav() pointing at it, or set dormant: true if it's intentionally reachable ` +
-        `only via a direct link/redirect or a consuming app's own r.nav().`);
-}
-// Shared by projectionDetail relatedList sections and entityList.expandableRow:
-// both render a relatedList whose rows come from an arbitrary query.
-function validateRelatedListSection(args) {
-    const { featureName, featureMap, where, section } = args;
-    if (!section.query || typeof section.query !== "string") {
-        throw new Error(`[Feature ${featureName}] ${where} has empty or non-string query. Set query to a registered query name.`);
-    }
-    if (section.entity !== undefined) {
-        assertRefTargetRegistered(`[Feature ${featureName}] ${where}`, "entity", section.entity, featureName, featureMap);
-    }
-    for (const col of section.columns) {
-        const normalizedCol = normalizeListColumn(col);
-        if (normalizedCol.refEntity !== undefined) {
-            assertRefTargetRegistered(`[Feature ${featureName}] ${where}`, `column "${normalizedCol.field}" (refEntity)`, normalizedCol.refEntity, featureName, featureMap);
-        }
-    }
-    if (section.rowClick !== undefined) {
-        const targetEntity = section.rowClick.entity;
-        const hasDetailScreen = [...featureMap.values()].some((f) => Object.values(f.screens).some((s) => s.detailFor === targetEntity));
-        if (!hasDetailScreen) {
-            throw new Error(`[Feature ${featureName}] ${where} ` +
-                `rowClick targets entity "${targetEntity}", but no screen declares ` +
-                `detailFor: "${targetEntity}". Add detailFor: "${targetEntity}" to the screen that shows it.`);
-        }
-    }
-    if (section.rowActions !== undefined)
-        validateRelatedListRowActions(args, section.rowActions);
-    if (section.defaultSort !== undefined)
-        validateRelatedListDefaultSort(args, section.defaultSort);
-    if (section.facets !== undefined) {
-        validateListFacets(`[Feature ${featureName}] ${where}`, section.facets, section.columns, featureName, featureMap);
-    }
-    if (section.toolbarActions !== undefined) {
-        validateRelatedListToolbarActions(args, section.toolbarActions);
-    }
-}
-// An empty list has no row, so params resolve against an empty record.
-function rejectEmptyStateActionParams(ctx, actionLabel, action) {
-    const params = action.kind === "navigate" || action.kind === "drawer" ? action.params : undefined;
-    if (params !== undefined) {
-        throw new Error(`[Feature ${ctx.featureName}] ${ctx.where} ${actionLabel} "${action.id}" sets params — an empty list ` +
-            `has no row to read them from, so they would resolve against an empty record. Remove the params.`);
-    }
-}
-// Target checks shared by list/related-list rowActions and emptyState.action:
-// navigate target + params, drawer target, write-handler registration.
-function validateListActionTargets(ctx, actionLabel, action) {
-    const { featureName, screenId, screenType } = ctx;
-    rejectRedirectOnListRowAction(featureName, screenId, screenType, action);
-    if (actionLabel === "emptyState action")
-        rejectEmptyStateActionParams(ctx, actionLabel, action);
-    if (action.kind === "navigate") {
-        const target = resolveRowActionNavigateTarget(featureName, screenId, screenType, actionLabel, action, ctx.allScreenQns, ctx.navTargetShortIds, ctx.screensByShortId, ctx.detailForScreens);
-        validateRowActionNavigateParams(featureName, screenId, screenType, ctx.screenEntity, action, target, actionLabel);
-    }
-    else if (action.kind === "drawer") {
-        validateDrawerTargetAction(featureName, screenId, screenType, actionLabel, action, ctx.screens);
-    }
-    else if (action.kind === "clientAction") {
-        validateClientActionName(featureName, screenId, screenType, actionLabel, action);
-    }
-    else if (!ctx.allWriteHandlerQns.has(action.handler)) {
-        throw new Error(`[Feature ${featureName}] ${ctx.where} ` +
-            `${actionLabel} "${action.id}" handler "${action.handler}" ` +
-            `is not a registered write-handler. Check the QN spelling (expected ` +
-            `"<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`);
-    }
-}
-function validateRelatedListRowActions(args, rowActions) {
-    const { featureName, screenId, screenType, where, section, screens, allWriteHandlerQns, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens, } = args;
-    for (const action of rowActions) {
-        validateListActionTargets({
-            featureName,
-            screenId,
-            screenType,
-            screenEntity: undefined,
-            where,
-            screens,
-            allWriteHandlerQns,
-            allScreenQns,
-            navTargetShortIds,
-            screensByShortId,
-            detailForScreens,
-        }, "rowAction", action);
-    }
-    // section.rowClick (legacy, navigate-only) and a rowActions entry
-    // marked rowClick:true both claim the row-body click — same
-    // at-most-one constraint as entityList/projectionList's
-    // validateAtMostOneRowClick, just spanning two fields instead of one.
-    const rowClickActionCount = rowActions.filter(isRowClickAction).length;
-    const legacyRowClickCount = section.rowClick !== undefined ? 1 : 0;
-    if (rowClickActionCount + legacyRowClickCount > 1) {
-        throw new Error(`[Feature ${featureName}] ${where} ` +
-            `has both a rowClick and ${rowClickActionCount} rowActions marked ` +
-            `rowClick:true — at most one may fire on a row-body click.`);
-    }
-}
-function validateRelatedListDefaultSort(args, defaultSort) {
-    const { featureName, where, section } = args;
-    const sortField = defaultSort.field;
-    const col = section.columns.find((c) => normalizeListColumn(c).field === sortField);
-    if (col === undefined) {
-        throw new Error(`[Feature ${featureName}] ${where} ` +
-            `defaultSort.field "${sortField}" is not a listed column. Use a listed column as defaultSort.field.`);
-    }
-    if (normalizeListColumn(col).sortable !== true) {
-        throw new Error(`[Feature ${featureName}] ${where} ` +
-            `defaultSort.field "${sortField}" is not sortable. Set sortable: true on ` +
-            `the column or pick another field.`);
-    }
-}
-// Only drawer-kind and navigate actions that set tab are validated here;
-// plain navigate (no tab) and writeHandler toolbarActions have no boot check yet.
-function validateRelatedListToolbarActions(args, toolbarActions) {
-    const { featureName, screenId, screenType, screens, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens, } = args;
-    for (const action of toolbarActions) {
-        if (action.kind === "drawer") {
-            validateDrawerTargetAction(featureName, screenId, screenType, "toolbarAction", action, screens);
-        }
-        if (action.kind === "navigate" && action.tab !== undefined) {
-            resolveRowActionNavigateTarget(featureName, screenId, screenType, "toolbarAction", action, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens);
-        }
-    }
-}
-// Only a navigate action that sets `tab` needs the target resolved (to check
-// the tab id); plain navigates are validated elsewhere. One place for every
-// section-level action site so a new site can't forget the tab check.
-function validateNavigateActionTab(featureName, screenId, screenType, actionLabel, action, lookups) {
-    // skip: only navigate actions with an explicit tab need target validation
-    if (action.kind !== "navigate" || action.tab === undefined)
-        return;
-    resolveRowActionNavigateTarget(featureName, screenId, screenType, actionLabel, action, lookups.allScreenQns, lookups.navTargetShortIds, lookups.screensByShortId, lookups.detailForScreens);
-}
+export { readsNavigateParamsAsFormPrefill, resolveScreenTargetQn, rowFieldExtractorKeys, validateActionFieldRefs, validateActionHasIcon, validateDrawerPrefillKeys, validateScreenShortIdCollisions, } from "./screens-actions.js";
+export { validateDashboardCustomPanel, validateDashboardScreenPanel } from "./screens-dashboard.js";
+export { validateColumnRendererForm } from "./screens-lists.js";
 export function validateScreens(feature, featureMap, allWriteHandlerQns, allScreenQns, configKeyDefsByQn, screensByShortId, detailForScreens) {
-    // navigate-Targets (rowAction/toolbarAction) dürfen cross-feature zeigen —
-    // der Runtime-Router (create-app) löst eine bare screenId app-weit über ALLE
-    // Features auf (eine deklarative Liste im owning-Feature der Entity navigiert
-    // so zu den Custom-Editoren der Consumer-App). Der Validator spiegelt das:
-    // same-feature ODER irgendein Feature. redirect/cancelTarget akzeptieren
-    // zusätzlich eine voll-qualifizierte Cross-Feature-QN (resolveScreenTargetQn,
-    // #1946) — kurze IDs bleiben same-feature wie zuvor.
+    // navigate targets (rowAction/toolbarAction) may point cross-feature: the
+    // runtime router (create-app) resolves a bare screenId app-wide across ALL
+    // features (a declarative list in the entity's owning feature navigates to
+    // the consumer app's custom editors this way). The validator mirrors that:
+    // same feature OR any feature. redirect/cancelTarget additionally accept a
+    // fully qualified cross-feature QN (resolveScreenTargetQn, #1946); short IDs
+    // stay same-feature as before.
     const navTargetShortIds = screenShortIdsFrom(allScreenQns);
     const navigateLookups = {
         allScreenQns,
@@ -1258,9 +73,9 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
             continue;
         }
         if (screen.type === "projectionList") {
-            // Query-getrieben, keine Entity → nur query + columns prüfen (die
-            // Column-Felder können nicht gegen eine Entity gecheckt werden; sie
-            // werden zur Render-Zeit gegen die Projection-Rows aufgelöst).
+            // Query-driven, no entity, so only query + columns are checked (the
+            // column fields cannot be checked against an entity; they resolve
+            // against the projection rows at render time).
             if (!screen.query || typeof screen.query !== "string") {
                 throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionList) has empty or non-string query. Set query to a registered query name.`);
             }
@@ -1329,9 +144,9 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
             continue;
         }
         if (screen.type === "projectionDetail") {
-            // Query-getrieben wie projectionList, aber Single-Row + Layout statt
-            // Columns. Kein Entity-Check möglich — Felder werden render-seitig
-            // gegen die Query-Response aufgelöst, nicht gegen eine Entity.
+            // Query-driven like projectionList, but a single row plus layout instead
+            // of columns. No entity check is possible: fields resolve against the
+            // query response at render time, not against an entity.
             if (!screen.query || typeof screen.query !== "string") {
                 throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) has empty or non-string query. Set query to a registered query name.`);
             }
@@ -2059,594 +874,6 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
         }
     }
 }
-// Panel-getrieben, keine Entity — Struktur-Checks (eindeutige Panel-Ids,
-// non-empty Queries/Columns/valueField); die Query-Contracts (Stat-Record,
-// Points-Envelope, Paged-Rows) werden zur Render-Zeit aufgelöst.
-function validateDashboardScreen(featureName, screenId, screen, featureMap) {
-    if (screen.panels.length === 0) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) has an empty panels list — ` +
-            `declare at least one panel.`);
-    }
-    const panelIds = new Set();
-    const addPanelId = (id, context) => {
-        if (panelIds.has(id)) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) has duplicate panel id "${id}" (${context}). Give each panel a unique id.`);
-        }
-        panelIds.add(id);
-    };
-    for (const panel of screen.panels) {
-        addPanelId(panel.id, panel.kind);
-        if (panel.kind === "stat-group") {
-            validateDashboardStatGroupPanel(featureName, screenId, panel, addPanelId);
-        }
-        else if (panel.kind === "custom") {
-            validateDashboardCustomPanel(featureName, screenId, panel);
-        }
-        else if (panel.kind === "screen") {
-            validateDashboardScreenPanel(featureName, screenId, panel, featureMap);
-        }
-        else if (panel.kind === "text") {
-            validateDashboardTextPanel(featureName, screenId, panel, featureMap);
-        }
-        else {
-            validateDashboardQueryPanel(featureName, screenId, panel, featureMap);
-        }
-    }
-    if (screen.filter !== undefined) {
-        validateDashboardFilterDefinition(featureName, screenId, screen.filter);
-    }
-    if (screen.timeRange !== undefined) {
-        validateDashboardTimeRange(featureName, screenId, screen.timeRange, screen.filter?.id);
-    }
-}
-function validateDashboardActions(featureName, screenId, screen, allWriteHandlerQns, lookups) {
-    const { allScreenQns, navTargetShortIds, screensByShortId, detailForScreens } = lookups;
-    // Header actions run on the bound record like projectionDetail's, minus
-    // what needs a drawer host or a record screen to leave.
-    for (const action of screen.actions ?? []) {
-        const where = `[Feature ${featureName}] Screen "${screenId}" (dashboard) action "${action.id}"`;
-        validateActionHasIcon(featureName, screenId, "dashboard", "action", action);
-        if (isRowClickAction(action)) {
-            throw new Error(`${where} sets rowClick: true — a dashboard has no row to click. Remove rowClick.`);
-        }
-        if (action.kind === "drawer") {
-            throw new Error(`${where} is a drawer action — a dashboard has no drawer host. Use a navigate, ` +
-                `writeHandler or clientAction action.`);
-        }
-        if (action.kind === "navigate") {
-            const target = resolveRowActionNavigateTarget(featureName, screenId, "dashboard", "action", action, allScreenQns, navTargetShortIds, screensByShortId, detailForScreens);
-            validateRowActionNavigateParams(featureName, screenId, "dashboard", screen.detailFor, action, target);
-        }
-        else if (action.kind === "clientAction") {
-            validateClientActionName(featureName, screenId, "dashboard", "action", action);
-        }
-        else {
-            if (action.redirect !== undefined) {
-                throw new Error(`${where} sets redirect — a dashboard action stays on the dashboard and refetches ` +
-                    `after success. Remove redirect.`);
-            }
-            if (!allWriteHandlerQns.has(action.handler)) {
-                throw new Error(`${where} handler "${action.handler}" is not a registered write-handler. Check the QN ` +
-                    `spelling (expected "<feature>:write:<short>") and that the handler is declared via r.writeHandler(...).`);
-            }
-        }
-    }
-}
-// record / actions / refresh hang together: actions and a field-driven refresh
-// read the record row, and the record id travels in the URL next to the
-// filter and time-range values.
-function validateDashboardRecordBinding(featureName, screenId, screen) {
-    const where = `[Feature ${featureName}] Screen "${screenId}" (dashboard)`;
-    const { record, refresh } = screen;
-    if (record === undefined) {
-        if (screen.actions !== undefined) {
-            throw new Error(`${where} declares actions without a record — the actions run on the bound record. ` +
-                `Add record: { param } or remove actions.`);
-        }
-    }
-    else {
-        validateDashboardRecordShape(where, record, [screen.filter?.id, screen.timeRange?.id]);
-    }
-    // skip: no refresh declared, nothing to validate
-    if (refresh === undefined)
-        return;
-    validateDashboardRefresh(where, refresh, record);
-}
-function validateDashboardRecordShape(where, record, otherUrlParamIds) {
-    if (typeof record.param !== "string" || record.param.length === 0) {
-        throw new Error(`${where} record.param is empty. Name the URL search param carrying the id.`);
-    }
-    if (record.payloadKey !== undefined && record.payloadKey.length === 0) {
-        throw new Error(`${where} record.payloadKey is empty. Omit it to reuse record.param as the payload key.`);
-    }
-    if (record.query !== undefined && record.query.length === 0) {
-        throw new Error(`${where} record.query is empty. Set a registered query name or omit it.`);
-    }
-    if (record.titleField !== undefined && isTitleFieldUnusable(record)) {
-        throw new Error(`${where} record.titleField needs record.query and a field name — the title is read ` +
-            `from the record row.`);
-    }
-    const payloadKey = record.payloadKey ?? record.param;
-    for (const other of otherUrlParamIds) {
-        if (other !== undefined && (other === record.param || other === payloadKey)) {
-            throw new Error(`${where} record.param/payloadKey "${other}" collides with the filter or timeRange id — ` +
-                `all of them live in the URL search params and panel payloads. Use a different name.`);
-        }
-    }
-}
-function isTitleFieldUnusable(record) {
-    return record.query === undefined || record.titleField === "";
-}
-function validateDashboardRefresh(where, refresh, record) {
-    if ("seconds" in refresh && "field" in refresh) {
-        throw new Error(`${where} refresh sets both seconds and field — set exactly one.`);
-    }
-    if ("seconds" in refresh) {
-        if (!isRefreshSecondsAllowed(refresh.seconds)) {
-            throw new Error(`${where} refresh.seconds "${String(refresh.seconds)}" must be a number of at least ` +
-                `${DASHBOARD_MIN_REFRESH_SECONDS} — shorter intervals would hammer every panel query.`);
-        }
-        // skip: seconds validated, field rules below do not apply
-        return;
-    }
-    if (refresh.field.length === 0) {
-        throw new Error(`${where} refresh.field is empty. Name the record field holding the seconds.`);
-    }
-    if (record?.query === undefined) {
-        throw new Error(`${where} refresh.field "${refresh.field}" needs record.query to read the seconds from. ` +
-            `Add record: { param, query } or use refresh: { seconds }.`);
-    }
-}
-function isRefreshSecondsAllowed(seconds) {
-    return Number.isFinite(seconds) && seconds >= DASHBOARD_MIN_REFRESH_SECONDS;
-}
-function validateDashboardTimeRange(featureName, screenId, timeRange, filterId) {
-    const prefix = `[Feature ${featureName}] Screen "${screenId}" (dashboard) timeRange`;
-    if (timeRange.id.length === 0)
-        throw new Error(`${prefix} has an empty id. Set a non-empty id.`);
-    if (timeRange.id === filterId) {
-        throw new Error(`${prefix} id "${timeRange.id}" collides with the filter id — both live in the URL search params. Use an id different from the filter id.`);
-    }
-    if (timeRange.options.length === 0) {
-        throw new Error(`${prefix}.options is empty — declare at least one option.`);
-    }
-    const values = new Set();
-    for (const option of timeRange.options) {
-        if (option.value.length === 0 || option.label.length === 0) {
-            throw new Error(`${prefix} option needs a non-empty value and label. Give every option both.`);
-        }
-        if (values.has(option.value)) {
-            throw new Error(`${prefix}.options has duplicate value "${option.value}". Use each option value once.`);
-        }
-        values.add(option.value);
-    }
-    if (!values.has(timeRange.default)) {
-        throw new Error(`${prefix}.default "${timeRange.default}" is not among the options (${[...values].join(", ")}). Set default to one of the options.`);
-    }
-}
-const EMBEDDABLE_SCREEN_TYPES = new Set([
-    "projectionList",
-    "actionForm",
-    "secretMint",
-    "configEdit",
-    "secretsEdit",
-]);
-function validateEmbeddableScreenRef(context, prop, ref, featureName, featureMap) {
-    const targetQn = resolveScreenTargetQn(featureName, ref);
-    const [targetFeatureName = "", , targetShortId = ""] = targetQn.split(":");
-    const target = featureMap.get(targetFeatureName)?.screens[targetShortId];
-    if (target === undefined) {
-        throw new Error(`${context} ${prop} "${ref}" does not resolve to a registered screen (checked "${targetQn}"). ` +
-            `Use a same-feature short id or a cross-feature QN "<feature>:screen:<id>".`);
-    }
-    if (!EMBEDDABLE_SCREEN_TYPES.has(target.type)) {
-        throw new Error(`${context} embeds "${targetQn}" of type "${target.type}", which can't be embedded — allowed: ` +
-            `${[...EMBEDDABLE_SCREEN_TYPES].join(", ")}. Use a custom panel for app components.`);
-    }
-    // ActionFormBody/SecretMintBody navigate via nav.navigate after submit or
-    // cancel even when embedded, which would pull the user off the dashboard.
-    if ((target.type === "actionForm" || target.type === "secretMint") &&
-        (target.redirect !== undefined ||
-            (target.cancelTarget !== undefined && target.cancelTarget !== false))) {
-        throw new Error(`${context} embeds "${targetQn}", which sets redirect/cancelTarget — an embedded form would ` +
-            `navigate away from the dashboard on submit or cancel. Embed a screen without redirect and ` +
-            `with cancelTarget: false (or omitted).`);
-    }
-    return target;
-}
-export function validateDashboardScreenPanel(featureName, screenId, panel, featureMap) {
-    const context = `[Feature ${featureName}] Screen "${screenId}" (dashboard) screen-panel "${panel.id}"`;
-    validateEmbeddableScreenRef(context, "screen", panel.screen, featureName, featureMap);
-    validateDashboardPanelVisibleWhen(context, panel.visibleWhen);
-    // skip: no fallback declared, nothing more to validate
-    if (panel.fallback === undefined)
-        return;
-    if (panel.visibleWhen === undefined) {
-        throw new Error(`${context} declares fallback without visibleWhen. Add visibleWhen or remove fallback.`);
-    }
-    const target = validateEmbeddableScreenRef(context, "fallback", panel.fallback, featureName, featureMap);
-    // A gated fallback could hide in turn; the tile would show nothing where it promised a stand-in.
-    if (target.visibleWhen !== undefined) {
-        throw new Error(`${context} fallback "${panel.fallback}" has its own visibleWhen; a fallback must always render.`);
-    }
-}
-function validateDashboardTextPanel(featureName, screenId, panel, featureMap) {
-    const context = `[Feature ${featureName}] Screen "${screenId}" (dashboard) text-panel "${panel.id}"`;
-    if (panel.blocks.length === 0) {
-        throw new Error(`${context} has an empty blocks list. Add at least one block.`);
-    }
-    validateDashboardPanelSpan(featureName, screenId, panel);
-    validateDashboardPanelVisibleWhen(context, panel.visibleWhen);
-    for (const block of panel.blocks) {
-        if (block.kind === "list" && block.items.length === 0) {
-            throw new Error(`${context} has a list block without items. Add items or remove the block.`);
-        }
-        if (block.kind === "link")
-            validateDashboardTextLinkBlock(context, block, featureName, featureMap);
-    }
-}
-function validateDashboardTextLinkBlock(context, block, featureName, featureMap) {
-    const targetQn = resolveScreenTargetQn(featureName, block.screen);
-    const [targetFeatureName = "", , targetShortId = ""] = targetQn.split(":");
-    if (featureMap.get(targetFeatureName)?.screens[targetShortId] === undefined) {
-        throw new Error(`${context} link block screen "${block.screen}" does not resolve to a registered screen ` +
-            `(checked "${targetQn}"). Use a same-feature short id or a cross-feature QN "<feature>:screen:<id>".`);
-    }
-    if (block.roles?.length === 0) {
-        throw new Error(`${context} link block "${block.screen}" has an empty roles list, which would hide it from everyone. ` +
-            `List the roles or omit roles.`);
-    }
-}
-function validateDashboardPanelVisibleWhen(context, visibleWhen) {
-    if (visibleWhen !== undefined && (visibleWhen.query === "" || visibleWhen.field === "")) {
-        throw new Error(`${context} visibleWhen needs a non-empty query and field. Set both visibleWhen.query and visibleWhen.field.`);
-    }
-}
-function validateDashboardPanelSpan(featureName, screenId, panel) {
-    if (panel.span !== undefined && panel.span !== "half" && panel.span !== "full") {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panel.id}" has span "${String(panel.span)}" — expected "half" or "full".`);
-    }
-}
-function validateDashboardStatGroupPanel(featureName, screenId, panel, addPanelId) {
-    const context = `[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-group "${panel.id}"`;
-    if (panel.stats.length === 0) {
-        throw new Error(`${context} has an empty stats list. Add at least one stat.`);
-    }
-    if (panel.subtitle !== undefined && panel.label === undefined) {
-        throw new Error(`${context} sets subtitle without label — an unlabeled group renders as a KPI strip without a header. Set a label or remove subtitle.`);
-    }
-    validateDashboardPanelSpan(featureName, screenId, panel);
-    validateDashboardPanelVisibleWhen(context, panel.visibleWhen);
-    for (const stat of panel.stats) {
-        addPanelId(stat.id, "stat-group child");
-        if (stat.visibleWhen !== undefined) {
-            throw new Error(`${context} child "${stat.id}" sets visibleWhen — gate the whole group instead; a hidden cell would leave a gap in the strip.`);
-        }
-        if (!stat.query || typeof stat.query !== "string") {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-group "${panel.id}" child "${stat.id}" has empty or non-string query. Set query to a registered query name.`);
-        }
-        if (stat.valueField.length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-group "${panel.id}" child "${stat.id}" has empty valueField. Set valueField to a field of the query result.`);
-        }
-        validateDashboardValueFormat(featureName, screenId, stat.id, stat.valueFormat, STAT_VALUE_FORMATS);
-    }
-}
-function validateFromTodayWindowReach(where, panel) {
-    if (panel.initialWindow === "from-today" && panel.ranges === undefined && panel.brush !== true) {
-        throw new Error(`${where}.initialWindow "from-today" needs ranges or brush, otherwise data before today is unreachable.`);
-    }
-}
-function validateChartScrollableAndUnit(where, panel) {
-    if (panel.scrollable !== undefined && typeof panel.scrollable !== "boolean") {
-        throw new Error(`${where} has a non-boolean scrollable. Use true or false.`);
-    }
-    if (panel.scrollable === true && panel.chart !== "stacked-area") {
-        throw new Error(`${where} sets scrollable on chart "${panel.chart}" — only "stacked-area" supports it. Remove scrollable or use chart "stacked-area".`);
-    }
-    if (panel.unit !== undefined && panel.chart !== "timeseries") {
-        throw new Error(`${where} sets unit on chart "${panel.chart}" — only "timeseries" supports it. Remove unit or use chart "timeseries".`);
-    }
-}
-function validateDashboardChartDisplay(featureName, screenId, panel) {
-    validateDashboardValueFormat(featureName, screenId, panel.id, panel.valueFormat, CHART_VALUE_FORMATS);
-    const where = `[Feature ${featureName}] Screen "${screenId}" (dashboard) chart-panel "${panel.id}"`;
-    validateChartScrollableAndUnit(where, panel);
-    validateStackedAreaOnlyProps(where, panel);
-    validateStackedAreaEnumProp(where, "dateFormat", panel.dateFormat, ["day", "month"]);
-    validateStackedAreaEnumProp(where, "initialWindow", panel.initialWindow, [
-        "default-range",
-        "from-today",
-    ]);
-    validateStackedAreaEnumProp(where, "markerLegend", panel.markerLegend, ["list", "legend"]);
-    const nonBooleanProp = ["brush", "legendTotals", "markerLabels"].find((prop) => panel[prop] !== undefined && typeof panel[prop] !== "boolean");
-    if (nonBooleanProp !== undefined) {
-        throw new Error(`${where} has a non-boolean ${nonBooleanProp}. Use true or false.`);
-    }
-    validateFromTodayWindowReach(where, panel);
-    for (const [key, color] of Object.entries(panel.seriesColors ?? {})) {
-        if (typeof color !== "string" || color.trim() === "") {
-            throw new Error(`${where} seriesColors["${key}"] must be a non-empty CSS color.`);
-        }
-    }
-    for (const [kind, look] of Object.entries(panel.markerKinds ?? {})) {
-        validateDashboardChartMarkerKind(`${where} markerKinds["${kind}"]`, look);
-    }
-    if (panel.ranges !== undefined)
-        validateDashboardChartRanges(`${where} ranges`, panel.ranges);
-}
-function validateStackedAreaEnumProp(where, prop, value, allowed) {
-    // skip: optional prop, nothing to validate when unset
-    if (value === undefined)
-        return;
-    if (!allowed.includes(value)) {
-        throw new Error(`${where}.${prop} "${String(value)}" must be one of ${allowed.join(", ")}.`);
-    }
-}
-function validateStackedAreaOnlyProps(where, panel) {
-    // skip: stacked-area is the one chart kind that supports these props
-    if (panel.chart === "stacked-area")
-        return;
-    const stackedAreaOnly = [
-        "markerKinds",
-        "legendTotals",
-        "ranges",
-        "brush",
-        "dateFormat",
-        "initialWindow",
-        "markerLegend",
-        "markerLabels",
-    ].filter((prop) => panel[prop] !== undefined);
-    if (stackedAreaOnly.length > 0) {
-        throw new Error(`${where} sets ${stackedAreaOnly.join(", ")} on chart "${panel.chart}" — only "stacked-area" supports it. Remove these props or use chart "stacked-area".`);
-    }
-}
-const DASHBOARD_CHART_TONES = new Set([
-    "positive",
-    "negative",
-    "active",
-    "neutral",
-]);
-function validateDashboardChartMarkerKind(where, look) {
-    if (look.tone === undefined && look.color === undefined) {
-        throw new Error(`${where} needs a tone or a color. Set tone or color.`);
-    }
-    if (look.tone !== undefined && !DASHBOARD_CHART_TONES.has(look.tone)) {
-        throw new Error(`${where}.tone "${String(look.tone)}" is not one of ${[...DASHBOARD_CHART_TONES].join(", ")}.`);
-    }
-    if (look.color !== undefined && (typeof look.color !== "string" || look.color.trim() === "")) {
-        throw new Error(`${where}.color must be a non-empty CSS color.`);
-    }
-    if (look.label !== undefined && (typeof look.label !== "string" || look.label.trim() === "")) {
-        throw new Error(`${where}.label must be a non-empty i18n key.`);
-    }
-}
-function validateDashboardChartRanges(where, ranges) {
-    if (ranges.options.length === 0) {
-        throw new Error(`${where}.options is empty — declare at least one option.`);
-    }
-    const values = new Set();
-    for (const option of ranges.options) {
-        if (option.value.length === 0 || option.label.length === 0) {
-            throw new Error(`${where} option needs a non-empty value and label. Give every option both.`);
-        }
-        if (values.has(option.value)) {
-            throw new Error(`${where}.options has duplicate value "${option.value}". Use each option value once.`);
-        }
-        if (option.months !== undefined && (!Number.isInteger(option.months) || option.months <= 0)) {
-            throw new Error(`${where} option "${option.value}" months "${String(option.months)}" must be a positive integer.`);
-        }
-        values.add(option.value);
-    }
-    if (!values.has(ranges.default)) {
-        throw new Error(`${where}.default "${ranges.default}" is not among the options (${[...values].join(", ")}). Set default to one of the options.`);
-    }
-}
-const CURRENCY_CODE_RE = /^[A-Z]{3}$/;
-const MAX_VALUE_FORMAT_FRACTION_DIGITS = 4;
-const STAT_VALUE_FORMATS = [
-    "currency",
-    "relativeTime",
-];
-const CHART_VALUE_FORMATS = ["currency"];
-function validateDashboardValueFormat(featureName, screenId, panelId, valueFormat, allowedKinds) {
-    // skip: valueFormat is optional, nothing to validate without it
-    if (valueFormat === undefined)
-        return;
-    const where = `[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panelId}" valueFormat`;
-    if (!allowedKinds.includes(valueFormat.kind)) {
-        throw new Error(`${where}.kind "${String(valueFormat.kind)}" must be ${allowedKinds.map((kind) => `"${kind}"`).join(" or ")}.`);
-    }
-    // skip: relativeTime carries no options
-    if (valueFormat.kind === "relativeTime")
-        return;
-    if (!CURRENCY_CODE_RE.test(valueFormat.currency)) {
-        throw new Error(`${where}.currency "${String(valueFormat.currency)}" must be a 3-letter uppercase ISO currency code.`);
-    }
-    const digits = valueFormat.fractionDigits;
-    if (digits !== undefined &&
-        (!Number.isInteger(digits) || digits < 0 || digits > MAX_VALUE_FORMAT_FRACTION_DIGITS)) {
-        throw new Error(`${where}.fractionDigits "${String(digits)}" must be an integer from 0 to ${MAX_VALUE_FORMAT_FRACTION_DIGITS}.`);
-    }
-}
-export function validateDashboardCustomPanel(featureName, screenId, panel) {
-    if (panel.component.react === undefined && panel.component.native === undefined) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) custom-panel "${panel.id}" has no component — ` +
-            `declare a react/native component marker.`);
-    }
-}
-function validateDashboardQueryPanel(featureName, screenId, panel, featureMap) {
-    if (!panel.query || typeof panel.query !== "string") {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panel.id}" has empty or non-string query. Set query to a registered query name.`);
-    }
-    validateDashboardPanelSpan(featureName, screenId, panel);
-    if (panel.kind === "stat") {
-        if (panel.valueField.length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) stat-panel "${panel.id}" has empty valueField. Set valueField to a field of the query result.`);
-        }
-        validateDashboardValueFormat(featureName, screenId, panel.id, panel.valueFormat, STAT_VALUE_FORMATS);
-    }
-    validateDashboardPanelVisibleWhen(`[Feature ${featureName}] Screen "${screenId}" (dashboard) panel "${panel.id}"`, panel.visibleWhen);
-    if (panel.kind === "chart")
-        validateDashboardChartDisplay(featureName, screenId, panel);
-    if (panel.kind === "list") {
-        if (panel.columns.length === 0) {
-            throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) list-panel "${panel.id}" has an empty columns list. Add at least one column.`);
-        }
-        for (const col of panel.columns) {
-            const normalized = normalizeListColumn(col);
-            validateColumnRendererForm(featureName, screenId, normalized);
-            if (normalized.refEntity !== undefined) {
-                assertRefTargetRegistered(`[Feature ${featureName}] Screen "${screenId}" (dashboard) list-panel "${panel.id}"`, `column "${normalized.field}" (refEntity)`, normalized.refEntity, featureName, featureMap);
-            }
-        }
-    }
-}
-function validateDashboardFilterDefinition(featureName, screenId, filter) {
-    if (filter.id.length === 0) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) filter has an empty id. Set a non-empty id.`);
-    }
-    if (filter.label.length === 0) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) filter has an empty label. Set a non-empty label.`);
-    }
-    const hasOptions = filter.options !== undefined;
-    const hasOptionsQuery = filter.optionsQuery !== undefined;
-    if (hasOptions === hasOptionsQuery) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) filter must set exactly one of ` +
-            `options/optionsQuery.`);
-    }
-    if (hasOptions && (filter.options?.length ?? 0) === 0) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) filter.options is empty — ` +
-            `declare at least one option or use optionsQuery instead.`);
-    }
-    if (hasOptionsQuery && filter.optionsQuery?.length === 0) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (dashboard) filter.optionsQuery is empty. Set optionsQuery to a query name or remove it.`);
-    }
-}
-// Form-check für ListColumn-Renderer in der PlatformComponent-Form
-// (`{ react: { __component: "Name" } }`). Der Server kennt die client-
-// seitige columnRenderers-Map nicht — also nur prüfen ob die Struktur
-// stimmt: wenn `react` als Object gesetzt ist, MUSS `__component` ein
-// nicht-leerer String sein. Ein client-seitig ausgelassener Key löst
-// nur eine Warnung aus, kein Boot-Fail.
-// Column-level sortable: true only enables relatedList headers. On entityList
-// the entity field's flag wins; on projectionList sortable comes from the
-// query schema and a column can only opt OUT with sortable: false.
-function rejectInertColumnSortable(featureName, screenId, screenType, column) {
-    const isInert = screenType === "entityList" ? column.sortable !== undefined : column.sortable === true;
-    // skip: the sortable flag is meaningful for this screen type
-    if (!isInert)
-        return;
-    const source = screenType === "entityList"
-        ? "set sortable: true on the entity field instead"
-        : "sorting is derived from the query's Zod schema; only sortable: false is honored";
-    throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenType}) column "${column.field}" sets sortable — ` +
-        `it is ignored here; ${source}. Remove sortable from this column.`);
-}
-export function validateColumnRendererForm(featureName, screenId, column) {
-    const renderer = column.renderer;
-    // skip: nur die PlatformComponent-Form ({ react: { __component: "..." } })
-    // wird strukturell validiert. Funktions-, String-QN- und null/undefined-
-    // Renderer sind alle gültige andere Formen — kein Form-Fehler.
-    if (renderer === null || typeof renderer !== "object")
-        return;
-    // @cast-boundary schema-walk — feature-config renderer-shape introspection
-    const react = renderer.react;
-    // skip: kein react-Branch → entweder native-only oder kein
-    // PlatformComponent — beides außerhalb dieses Checks.
-    if (react === undefined || react === null)
-        return;
-    if (typeof react !== "object") {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" column "${column.field}" has a renderer with ` +
-            `a non-object \`react\` branch — expected \`{ react: { __component: "Name" } }\`.`);
-    }
-    // @cast-boundary schema-walk — feature-config react-branch introspection
-    const component = react.__component;
-    // skip: ohne __component-Schlüssel ist das keine String-Key-Form
-    // (z.B. ein zukünftiger direkter Component-Ref); nicht unsere Domäne.
-    if (component === undefined)
-        return;
-    if (typeof component !== "string" || component.length === 0) {
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" column "${column.field}" has a renderer with ` +
-            `\`react.__component\` = ${JSON.stringify(component)} — expected a non-empty string identifying ` +
-            `a client-side columnRenderers entry.`);
-    }
-}
-// Shared entity-target resolution for reference facets, refEntity columns
-// (projectionList/relatedList) and refEntity fields (projectionDetail).
-function assertRefTargetRegistered(prefix, subject, refTarget, currentFeatureName, featureMap) {
-    const target = parseRefTarget(refTarget, currentFeatureName);
-    const targetFeature = featureMap.get(target.featureName);
-    if (targetFeature === undefined) {
-        throw new Error(`${prefix} ${subject} targets entity "${refTarget}", but feature "${target.featureName}" is not ` +
-            `mounted — mount it and declare r.requires({ features: ["${target.featureName}"] }).`);
-    }
-    if (targetFeature.entities?.[target.entityName] === undefined) {
-        throw new Error(`${prefix} ${subject} targets entity "${refTarget}", which does not resolve to a ` +
-            `registered entity. Known entities in feature "${target.featureName}": ` +
-            `${Object.keys(targetFeature.entities ?? {})
-                .sort()
-                .join(", ") || "(none)"}.`);
-    }
-}
-// Facets (fw#2224) — unlike filter, a field inventory IS available here: the
-// declared columns. A facet on a field with no column is almost always a
-// typo (the user never sees the field anywhere), so this is hard-checked
-// rather than just documented. Shared by projectionList and relatedList
-// (fw#2740) — `prefix` carries the caller's own screen/section message lead-in.
-//
-// `type: "reference"` is exempt from the same-name-column rule (fw akte-
-// bedienkonzept-2): it filters by an id field (e.g. "propertyId") but
-// displays a different, human-readable column (e.g. "propertyLabel") — a
-// column named after the filter field would almost never exist, and
-// requiring one anyway would force apps to add a column no design calls
-// for just to satisfy this check. Its own `entity` is mandatory on the type
-// (TS, not just this validator) and is resolved below — that explicit,
-// checked declaration is this facet type's field inventory, filling the
-// same "not just a typo" role the column-name check plays for select/
-// boolean facets. select/boolean facets keep the column requirement
-// unchanged: both filter and display the same field, so a facet with no
-// matching column is still almost always a typo.
-function validateListFacets(prefix, facets, columns, currentFeatureName, featureMap) {
-    const columnFieldNames = new Set(columns.map((col) => normalizeListColumn(col).field));
-    const seenFacetFields = new Set();
-    for (const facet of facets) {
-        if (seenFacetFields.has(facet.field)) {
-            throw new Error(`${prefix} declares facet "${facet.field}" more than once. Declare each facet field once.`);
-        }
-        seenFacetFields.add(facet.field);
-        if (facet.type !== "reference" && !columnFieldNames.has(facet.field)) {
-            throw new Error(`${prefix} facet references field "${facet.field}" which is not a declared column. ` +
-                `Known columns: ${[...columnFieldNames].sort().join(", ")}`);
-        }
-        if (facet.type === "select" && facet.options.length === 0) {
-            throw new Error(`${prefix} facet "${facet.field}" (type "select") has an empty options list — ` +
-                `declare at least one option.`);
-        }
-        if (facet.type === "reference") {
-            assertRefTargetRegistered(prefix, `facet "${facet.field}" (type "reference")`, facet.entity, currentFeatureName, featureMap);
-            assertReferenceListHandlerRegistered(prefix, `facet "${facet.field}" (type "reference")`, facet.entity, currentFeatureName, featureMap);
-        }
-    }
-}
-// The facet's options are loaded at render time by dispatching the target's
-// list query (renderer useReferenceLookup, incl. its REFERENCE_LOOKUP_SOURCES
-// override); a missing or unregistered handler is swallowed there and leaves
-// a permanently empty dropdown, so it has to fail at boot instead.
-function assertReferenceListHandlerRegistered(prefix, subject, refTarget, currentFeatureName, featureMap) {
-    const target = parseRefTarget(refTarget, currentFeatureName);
-    const override = REFERENCE_LOOKUP_SOURCES[`${target.featureName}:${target.entityName}`];
-    const expectedQn = override?.queryQn ??
-        qualifyEntityName(target.featureName, "query", `${target.entityName}:list`);
-    for (const feature of featureMap.values()) {
-        for (const handlerName of Object.keys(feature.queryHandlers ?? {})) {
-            // skip: expected list handler found
-            if (qualifyEntityName(feature.name, "query", handlerName) === expectedQn)
-                return;
-        }
-    }
-    throw new Error(`${prefix} ${subject} loads its options from query "${expectedQn}", which is not a registered ` +
-        `query handler — register the entity's list handler (defineEntityListHandler) or the facet renders an empty dropdown.`);
-}
 export function findEntityFeature(entityName, featureMap) {
     for (const [name, feature] of featureMap) {
         if (feature.entities?.[entityName])