@cosmicdrift/kumiko-framework 0.386.0 → 0.388.0

package/dist/engine/boot-validator/security-baseline.js

@@ -1,3 +1,5 @@
+import { createFallbackLogger } from "../../logging/utils.js";
+const log = createFallbackLogger("kumiko:boot");
 export const SECURITY_BASELINE_FEATURE_NAMES = [
     "sessions",
     "crypto-shredding",
@@ -13,6 +15,5 @@ export function warnOnMissingSecurityBaseline(features, nodeEnv = process.env["N
     // skip: every baseline feature is mounted
     if (missing.length === 0)
         return;
-    // biome-ignore lint/suspicious/noConsole: boot-time hint, no logger available yet
-    console.warn(`[kumiko:boot] NODE_ENV=production but the security baseline is incomplete — missing feature(s): ${missing.join(", ")}. Mount securityBaselineFeatures() from @cosmicdrift/kumiko-bundled-features/presets (or the missing features individually).`);
+    log.warn(`NODE_ENV=production but the security baseline is incomplete — missing feature(s): ${missing.join(", ")}. Mount securityBaselineFeatures() from @cosmicdrift/kumiko-bundled-features/presets (or the missing features individually).`);
 }

package/dist/engine/boot-validator/transfer-graph.js

@@ -1,12 +1,12 @@
 import { parseRefTargetEntityName } from "../parse-ref-target.js";
 import { findOverDeepTransferChain, MAX_TRANSFER_DEPTH, resolveTransferAdjacency, } from "../transfer-adjacency.js";
-// --- Transfer-graph boot validation (fw#3088) ---
+// --- Transfer-graph boot validation ---
 //
 // tenant-handover walks an entity graph across the tenant boundary along two
 // declared edge kinds: `parentRef` and plain `reference` fields. Two shapes
 // cannot be walked, and both have to fail loudly here rather than silently
 // leaving rows behind in the source tenant — the partial move is exactly what
-// #3088 exists to end.
+// this validation exists to end.
 //
 // Scoped to entities declaring `transferable: true`, so a consumer that has
 // one of these shapes but never hands that entity over is unaffected.

package/dist/engine/boot-validator/workspaces.js

@@ -33,9 +33,9 @@ export function validateWorkspaces(feature, allNavQns) {
     }
 }
 const SETTINGS_HUB_AUDIENCE_NAV_QN_SET = new Set(SETTINGS_HUB_AUDIENCE_NAV_QNS);
-// fw#3019: apps that assign navs to workspaces via `r.workspace({ nav })`
-// or `r.nav({ workspaces })` never pass an explicit navAllowlist (solon#113)
-// — without this, warnOnUnreachableNavScreens never runs for them. Both
+// Apps that assign navs to workspaces via `r.workspace({ nav })`
+// or `r.nav({ workspaces })` never pass an explicit navAllowlist — without
+// this, warnOnUnreachableNavScreens never runs for them. Both
 // `WorkspaceDefinition.nav` and `NavDefinition.workspaces` already hold
 // fully-qualified QNs (validateWorkspaces/validateNavs compare them
 // directly against allNavQns/allWorkspaceQns), so no re-qualification is

package/dist/engine/bridge-stub.js

@@ -12,7 +12,7 @@ import { createAnonymousUser } from "./system-user.js";
 // anything downstream accidentally reaches for them.
 //
 // Use: `{ db, registry, ...bridgeStub() }`
-const notAvailable = (what) => async () => {
+const notAvailable = (what) => async (..._args) => {
     throw new Error(`ctx.${what} not available in this context — use the dispatcher, not a stubbed handler context`);
 };
 // Noop observability — hand back the shared fallback tracer so ctx.tracer has
@@ -24,11 +24,10 @@ export function bridgeStub(opts) {
     // anonymous default values when no user is passed explicitly. Test code
     // that cares about identity passes its own SessionUser here and gets it
     // back on ctx.
-    const stubUser = opts?.user ??
-        createAnonymousUser("00000000-0000-0000-0000-000000000000"); // @cast-boundary engine-bridge
+    const stubUser = opts?.user ?? createAnonymousUser("00000000-0000-0000-0000-000000000000");
     return {
         user: stubUser,
-        query: notAvailable("query"), // @cast-boundary engine-bridge
+        query: notAvailable("query"),
         queryAs: notAvailable("queryAs"),
         write: notAvailable("write"),
         writeAs: notAvailable("writeAs"),

package/dist/engine/build-app-schema.js

@@ -1,22 +1,22 @@
-// Erzeugt aus einer Server-Registry das client-safe AppSchema das die
-// Browser-Renderer-Pipeline konsumiert. Genauer Zweck: dev-server kann
-// die ganze hand-geschriebene `clientSchema`-Spiegelung abschaffen, der
-// Server schickt einfach das aufgelöste AppSchema beim Boot mit.
+// Builds the client-safe AppSchema from a server registry for the
+// browser renderer pipeline. The dev server can therefore drop its entire
+// hand-written `clientSchema` mirror and simply send the resolved AppSchema
+// during boot.
 //
-// JSON-Safety: Wir projezieren explizit auf eine Whitelist statt
-// JSON.stringify-roundtripping. Functions würden silent gedroppt und
-// Zod-Schemas (v4 hat .toJSON, aber emittiert ein _zod-Envelope) würden
-// als komische Ghost-Properties auftauchen. Das hier ist ein bewusster
-// Vertrag: was die Browser-Renderer-Pipeline liest, taucht hier auf.
-// Neue Browser-needed-Fields müssen explizit erweitert werden.
+// JSON safety: project explicitly onto a whitelist instead of round-tripping
+// through JSON.stringify. Functions would be silently dropped, and Zod schemas
+// (v4 has .toJSON, but emits a _zod envelope) would appear as strange ghost
+// properties. This is an intentional contract: everything read by the browser
+// renderer pipeline must appear here. New fields needed by the browser must be
+// added explicitly.
 //
-// Aktuell projeziert (Stand 2026-04-25):
+// Currently projected:
 //   Entity:    { table?, fields: { type, required?, sortable?, default? } }
-//   Screen:    verbatim (ScreenDefinition ist von Haus aus JSON-safe —
-//              custom-screens haben keine functions, layout/columns/etc.
-//              sind plain literals)
-//   Nav:       verbatim (NavDefinition ist nur strings + literals)
-//   Workspace: verbatim definition + getWorkspaceNavs() von der Registry
+//   Screen:    verbatim (ScreenDefinition is JSON-safe by design —
+//              custom screens have no functions; layout/columns/etc. are
+//              plain literals)
+//   Nav:       verbatim (NavDefinition contains only strings + literals)
+//   Workspace: verbatim definition + getWorkspaceNavs() from the registry
 //   Translations: verbatim feature.translations (raw r.translations keys,
 //                 unfiltered — see FeatureSchema.translations doc)
 //
@@ -24,11 +24,13 @@
 // The schema route strips features the caller's tenant has switched off
 // (r.toggleable) via stripDisabledFeaturesFromAppSchema.
 import { ZodObject } from "zod";
+import { createFallbackLogger } from "../logging/utils.js";
 import { collectUrlPrefillFieldsByScreenQn } from "./boot-validator/url-prefill-fields.js";
 import { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, } from "./build-config-feature-schema.js";
 import { isEncryptedAtRest } from "./config-helpers.js";
 import { isListQueryWithoutSearchableFields } from "./entity-list-searchability.js";
 import { QnTypes, qualifyEntityName } from "./qualified-name.js";
+const log = createFallbackLogger("kumiko");
 export function buildAppSchema(registry, options = {}) {
     const features = [];
     const urlPrefillFieldsByScreenQn = collectUrlPrefillFieldsByScreenQn([
@@ -52,7 +54,7 @@ export function buildAppSchema(registry, options = {}) {
             screens: projectScreens(featureName, feature.screens, registry, urlPrefillFieldsByScreenQn, encryptedConfigKeyQns),
             ...(navs.length > 0 && { navs }),
             ...(contentCollections.length > 0 && { contentCollections }),
-            // #1059: verbatim r.translations({keys}) — see FeatureSchema.translations
+            // Verbatim r.translations({keys}) — see FeatureSchema.translations
             // doc for why this must NOT go through registry.getAllTranslations()
             // (double-prefixes features that already qualify their own keys).
             ...(Object.keys(feature.translations ?? {}).length > 0 && {
@@ -62,12 +64,12 @@ export function buildAppSchema(registry, options = {}) {
         };
         features.push(featureSchema);
     }
-    // Workspaces: getAllWorkspaces() liefert mit QUALIFIZIERTEN ids (das
-    // schreibt die Registry beim Store-Overwrite ein). Die Browser-
-    // Renderer erwartet aber kurze ids (matcht gegen URL-Segment, gegen
-    // navigate({ workspaceId })). Wir gehen direkt durch `feature.workspaces`
-    // — dort sind die ids noch in der Autor-Form (short) — und ziehen die
-    // pre-resolved navMembers aus der Registry.
+    // Workspaces: getAllWorkspaces() returns QUALIFIED ids (the Registry writes
+    // them during store overwrite). The browser renderer expects short ids
+    // (matching the URL segment and navigate({ workspaceId })). We therefore
+    // read directly from `feature.workspaces`, where the ids are still in the
+    // author's short form, and obtain the pre-resolved navMembers from the
+    // registry.
     let workspaces = [];
     for (const [featureName, feature] of registry.features) {
         for (const [shortId, definition] of Object.entries(feature.workspaces)) {
@@ -78,16 +80,16 @@ export function buildAppSchema(registry, options = {}) {
             });
         }
     }
-    // Self-Populating Settings-Hub: aus den deklarierten Config-Keys mit `mask`
-    // werden Screens/Navs (+ eine Workspace) abgeleitet und hier eingehängt —
-    // kein manuelles r.screen/r.nav am App-Author.
+    // Self-populating Settings Hub: screens/navs (plus one workspace) are
+    // derived from the declared config keys with `mask` and attached here,
+    // so the app author does not need manual r.screen/r.nav declarations.
     const appHadWorkspaces = workspaces.length > 0;
     const generated = buildConfigFeatureSchema(registry);
     if (generated.screens.length > 0) {
         mergeSettingsHubIntoConfigFeature(features, generated);
-        // Flip-Schutz: nur für Apps die schon Workspaces nutzen. Bei einer
-        // workspace-losen App bleibt app.workspaces undefined → der Renderer zeigt
-        // alle Navs ungefiltert, die Hub-Navs inklusive.
+        // Flip protection: applies only to apps that already use workspaces. For an
+        // app without workspaces, app.workspaces remains undefined, so the renderer
+        // shows all navs without filtering, including the Hub navs.
         if (appHadWorkspaces) {
             const placed = placeSettingsHub(workspaces, generated);
             workspaces = placed.workspaces;
@@ -109,16 +111,16 @@ export function buildAppSchema(registry, options = {}) {
         // instead so a leaked function renderer is actually caught.
         const offender = findNonJsonSafePath(schema, "schema");
         if (offender !== null) {
-            // biome-ignore lint/suspicious/noConsole: dev-only assertion
-            console.error(`[kumiko] buildAppSchema: Output ist nicht JSON-safe — nicht-serialisierbarer Wert bei "${offender}" (Funktions-Renderer oder Klassen-Instanz im Schema?).`, schema);
+            log.error(`buildAppSchema: output is not JSON-safe, non-serializable value at "${offender}" (a function renderer or class instance in the schema?).`, { offender });
         }
     }
     return schema;
 }
-// Hängt die generierten Hub-Screens/Navs an die config-FeatureSchema (qualified
-// dann als config:screen:* / config:nav:*). Existiert sie noch nicht (config
-// bundled-feature nicht gemountet), wird sie angelegt. find-or-create statt
-// fixem Push verhindert eine zweite FeatureSchema mit demselben featureName.
+// Attaches the generated Hub screens/navs to the config FeatureSchema
+// (qualified as config:screen:* / config:nav:*). If it does not yet exist
+// (because the config bundled feature is not mounted), it is created. Using
+// find-or-create instead of an unconditional push prevents a second
+// FeatureSchema with the same featureName.
 function mergeSettingsHubIntoConfigFeature(features, generated) {
     const existing = features.find((f) => f.featureName === SETTINGS_HUB_FEATURE);
     if (existing === undefined) {
@@ -202,8 +204,7 @@ function warnUnplacedAudiences(unplaced) {
     // skip: every audience placed — nothing to warn about
     if (unplaced.length === 0)
         return;
-    // biome-ignore lint/suspicious/noConsole: dev-only authoring hint
-    console.warn(`[kumiko] Settings-Hub: ${unplaced.join(", ")} nicht in einer App-Workspace platziert — ` +
+    log.warn(`Settings-Hub: ${unplaced.join(", ")} nicht in einer App-Workspace platziert — ` +
         `erscheint im Standalone-"Einstellungen"-Tab. Referenziere ` +
         `${unplaced.map((id) => `${SETTINGS_HUB_FEATURE}:nav:${id}`).join(", ")} ` +
         `in einer r.workspace.nav, um die Gruppe inline zu zeigen.`);
@@ -212,8 +213,7 @@ function warnDanglingAudienceRefs(dangling) {
     // skip: no dangling refs — nothing to warn about
     if (dangling.length === 0)
         return;
-    // biome-ignore lint/suspicious/noConsole: dev-only authoring hint
-    console.warn(`[kumiko] Settings-Hub: ${dangling
+    log.warn(`Settings-Hub: ${dangling
         .map((id) => `${SETTINGS_HUB_FEATURE}:nav:${id}`)
         .join(", ")} in einer Workspace referenziert, aber nie generiert — ` +
         `keine Config-Keys für diesen Scope registriert. Tippfehler oder ` +
@@ -260,8 +260,8 @@ export function findNonJsonSafePath(value, path) {
 }
 // projectionList screens don't declare searchable/sortable/paginated as
 // authoring intent — they're derived here from the bound query handler's
-// Zod schema, the source of truth for what parameters it actually accepts
-// (fw#2165). A hand-written `searchable: true` still wins over the derived
+// Zod schema, the source of truth for what parameters it actually accepts.
+// A hand-written `searchable: true` still wins over the derived
 // default (screen.searchable ?? derived); the boot-validator (3a) rejects
 // one that contradicts the schema.
 function projectScreens(featureName, screens, registry, urlPrefillFieldsByScreenQn, encryptedConfigKeyQns) {
@@ -372,30 +372,30 @@ function projectEntities(entities) {
     }
     return out;
 }
-// EntityDefinition ist eine Discriminated-Union an Field-Types — wir
-// kennen alle JSON-safe Properties pro Field-Type. Statt jede Variante
-// einzeln auszuhandeln, walken wir die Field-Map und filtern auf die
-// Whitelist. Was nicht durchkommt: Server-only-runtime wie ZodValidate-
-// Functions, Computed-Functions, Default-Functions.
+// EntityDefinition is a discriminated union of field types, and we know the
+// JSON-safe properties for each type. Rather than handling every variant
+// separately, walk the field map and filter it through the whitelist. Values
+// that do not pass through include server-only runtime values such as
+// ZodValidate functions, computed functions, and default functions.
 function projectEntity(entityName, entity) {
     const fieldsOut = {};
     for (const [fieldName, fieldDef] of Object.entries(entity.fields)) {
         assertValidMultilineRows(`Entity "${entityName}"`, fieldName, fieldDef);
         fieldsOut[fieldName] = projectField(fieldDef);
     }
-    // derivedFields MÜSSEN mit ins Client-Schema (nur die Metadaten, nicht die
-    // derive-fn): computeListViewModel löst eine entityList-Spalte über
-    // `entity.derivedFields[field].valueType` auf — fehlt der Eintrag, wirft es
-    // "references unknown field". Der executor hat den Wert server-seitig schon
-    // an die Row gehängt; der Client braucht nur den valueType für den Renderer.
+    // derivedFields MUST be included in the client schema (metadata only, not the
+    // derive function): computeListViewModel resolves an entityList column via
+    // `entity.derivedFields[field].valueType`; without the entry it throws
+    // "references unknown field". The executor has already attached the value
+    // server-side to the row; the client only needs valueType for rendering.
     const derivedOut = {};
     for (const [name, derivedDef] of Object.entries(entity.derivedFields ?? {})) {
         derivedOut[name] = projectDerivedField(derivedDef);
     }
-    // EntityDefinition akzeptiert idType/access/searchWeight als optional —
-    // wir lassen die weg weil der Browser-Renderer sie nicht liest. `table`
-    // schicken wir mit, falls Apps `entity.table` direkt referenzieren.
-    // Kein Cast nötig: alle weggelassenen Felder sind `?`-optional.
+    // EntityDefinition accepts idType/access/searchWeight as optional, but we omit
+    // them because the browser renderer does not read them. `table` is included
+    // in case apps reference `entity.table` directly.
+    // No cast is needed: all omitted fields are optional (`?`).
     return {
         fields: fieldsOut,
         // @cast-boundary schema-walk: EntityDefinition.derivedFields is typed for
@@ -413,10 +413,10 @@ function projectEntity(entityName, entity) {
         ...(entity.lockedWhen !== undefined && { lockedWhen: entity.lockedWhen }),
     };
 }
-// Nur valueType durch — die derive-fn ist Server-only und NICHT JSON-safe
-// (würde sonst die Output-Walk-Guard triggern). Gibt ehrlich
-// ClientDerivedFieldDef zurück statt eine DerivedFieldDef vorzutäuschen,
-// die keine derive-fn hat.
+// Only valueType is forwarded — the derive function is server-only and is not
+// JSON-safe (it would otherwise trigger the output-walk guard). Return
+// ClientDerivedFieldDef honestly instead of pretending to return a
+// DerivedFieldDef without its derive function.
 function projectDerivedField(derivedDef) {
     return { valueType: derivedDef.valueType };
 }
@@ -446,138 +446,98 @@ function assertValidScreenMultilineRows(featureName, shortId, screen) {
             check(screen.confirm.fields);
     }
 }
-// Per-field whitelist. Every forwarded value must be JSON-safe (literal, or
-// an array/plain-object built only from JSON-safe values) — even though the
-// FieldDefinition types only type `default` as a literal, the sample-authoring
-// pattern `as unknown as EntityDefinition` has already let function-valued
-// defaults slip through. This whitelist is defense-in-depth that catches them
-// BEFORE JSON.stringify silently drops them in the browser-injection pipeline.
-// The same check gates the structured properties below (`multiline`,
-// `derived`, `totals`, `totalsMatch`) — a top-level `Array.isArray`/plain-
-// object check alone would let a function survive one level deep.
-//
-// Cast at the exit `as EntityFieldDefinition`: type-system-wise our out-map only
-// satisfies the discriminated union with an unnarrowed `type` string — the
-// cast bridges the variant inference TS can't recompute from a generic
-// Record.
-// kumiko-lint-ignore complexity-budget flat per-property whitelist walk, one independent `if` per FieldDefinition property — same shape as schema-builder.ts's field→zod switch
-function projectField(fieldDef) {
-    const def = fieldDef; // @cast-boundary schema-walk
-    const out = {};
-    if (typeof def["type"] === "string")
-        out["type"] = def["type"];
-    if (typeof def["required"] === "boolean")
-        out["required"] = def["required"];
-    if (typeof def["sortable"] === "boolean")
-        out["sortable"] = def["sortable"];
-    // filterable steuert die Faceted-Filter-Dropdowns im Renderer (select/
-    // boolean) — muss daher ins Client-Schema.
-    if (typeof def["filterable"] === "boolean")
-        out["filterable"] = def["filterable"];
-    if (typeof def["searchable"] === "boolean")
-        out["searchable"] = def["searchable"];
-    if (isJsonSafeValue(def["default"]))
-        out["default"] = def["default"];
-    // Select: options-Liste ist plain JSON, durchschicken.
-    if (Array.isArray(def["options"]))
-        out["options"] = def["options"];
-    if (isJsonSafeObject(def["optionTones"]))
-        out["optionTones"] = def["optionTones"];
-    // Reference: entity-Target + labelField + multiple müssen zum Renderer.
-    // Der ReferenceInput baut die Options-Query aus refEntity/refFeature und
-    // resolved das Label über labelField — ohne diese Properties fällt das
-    // Dropdown leer aus (QN wird `<feature>:query::list` → 404).
-    if (typeof def["entity"] === "string")
-        out["entity"] = def["entity"];
-    if (typeof def["labelField"] === "string")
-        out["labelField"] = def["labelField"];
-    // fw#2780: author-supplied picker source — without it the client falls back to the list handler.
-    if (typeof def["optionsQuery"] === "string")
-        out["optionsQuery"] = def["optionsQuery"];
+const isStringValue = (value) => typeof value === "string";
+const isBooleanValue = (value) => typeof value === "boolean";
+const isNumberValue = (value) => typeof value === "number";
+const isTrueValue = (value) => value === true;
+const isNumberOrStringValue = (value) => typeof value === "number" || typeof value === "string";
+const isBooleanOrJsonSafeObject = (value) => typeof value === "boolean" || isJsonSafeObject(value);
+const isUnitSpec = (value) => typeof value === "string" || (isPlainObject(value) && typeof value["field"] === "string");
+// Forwarded in this order, so the client schema keeps its key order.
+const FORWARDED_FIELD_PROPERTIES = [
+    ["type", isStringValue],
+    ["required", isBooleanValue],
+    ["sortable", isBooleanValue],
+    // filterable controls the faceted filter dropdowns in the renderer (select/
+    // boolean), so it must be included in the client schema.
+    ["filterable", isBooleanValue],
+    ["searchable", isBooleanValue],
+    ["default", isJsonSafeValue],
+    // Select: the options list is plain JSON, so forward it.
+    ["options", Array.isArray],
+    ["optionTones", isJsonSafeObject],
+    // Reference: entity target, labelField, and multiple are required by the
+    // renderer. ReferenceInput builds the options query from refEntity/refFeature
+    // and resolves the label through labelField; without these properties, the
+    // dropdown is empty (the QN becomes `<feature>:query::list` → 404).
+    ["entity", isStringValue],
+    ["labelField", isStringValue],
+    // Author-supplied picker source — without it the client falls back to the list handler.
+    ["optionsQuery", isStringValue],
     // Select: tier/tenant availability of the static options, loaded by the renderer.
-    if (typeof def["optionsAvailabilityQuery"] === "string")
-        out["optionsAvailabilityQuery"] = def["optionsAvailabilityQuery"];
+    ["optionsAvailabilityQuery", isStringValue],
     // Select: options only offered while a sibling-field condition holds; the renderer filters, the write path enforces.
-    if (Array.isArray(def["conditionalOptions"]))
-        out["conditionalOptions"] = def["conditionalOptions"];
-    if (typeof def["multiple"] === "boolean")
-        out["multiple"] = def["multiple"];
+    ["conditionalOptions", Array.isArray],
+    ["multiple", isBooleanValue],
     // MultiSelect: display picks checkboxes vs. combobox in the renderer,
     // columns/maxRows size the checkbox grid — without these the renderer
-    // always falls back to the combobox (fw#2494). Select: display picks
+    // always falls back to the combobox. Select: display picks
     // "radio" | "dropdown" the same way.
-    if (typeof def["display"] === "string")
-        out["display"] = def["display"];
-    if (typeof def["columns"] === "number")
-        out["columns"] = def["columns"];
-    if (typeof def["maxRows"] === "number")
-        out["maxRows"] = def["maxRows"];
+    ["display", isStringValue],
+    ["columns", isNumberValue],
+    ["maxRows", isNumberValue],
     // text/longText: textarea row count — DefaultInput renders a single-line
-    // input otherwise (fw#2497).
-    if (typeof def["multiline"] === "boolean" || isJsonSafeObject(def["multiline"]))
-        out["multiline"] = def["multiline"];
+    // input otherwise.
+    ["multiline", isBooleanOrJsonSafeObject],
     // number: Zod write-boundary bounds. date/timestamp/locatedTimestamp:
-    // ISO-string picker bounds — same keys, different literal type (fw#2497).
-    if (typeof def["min"] === "number" || typeof def["min"] === "string")
-        out["min"] = def["min"];
-    if (typeof def["max"] === "number" || typeof def["max"] === "string")
-        out["max"] = def["max"];
-    // date/timestamp/locatedTimestamp: display/parsing locale override (fw#2497).
-    if (typeof def["locale"] === "string")
-        out["locale"] = def["locale"];
-    // image/images: which camera a mobile capture opens (fw#2497).
-    if (typeof def["capture"] === "string")
-        out["capture"] = def["capture"];
+    // ISO-string picker bounds — same keys, different literal type.
+    ["min", isNumberOrStringValue],
+    ["max", isNumberOrStringValue],
+    // date/timestamp/locatedTimestamp: display/parsing locale override.
+    ["locale", isStringValue],
+    // image/images: which camera a mobile capture opens.
+    ["capture", isStringValue],
     // number: display-only suffix, static or read from a sibling field of the row.
-    const unit = def["unit"];
-    if (typeof unit === "string" || (isPlainObject(unit) && typeof unit["field"] === "string"))
-        out["unit"] = unit;
+    ["unit", isUnitSpec],
     // number/decimal/bigInt: `false` drops thousands separators (e.g. a year).
-    if (typeof def["grouping"] === "boolean")
-        out["grouping"] = def["grouping"];
+    ["grouping", isBooleanValue],
     // text: "password" masks the input and blocks URL prefill in the renderer.
-    if (typeof def["format"] === "string")
-        out["format"] = def["format"];
+    ["format", isStringValue],
     // Write-response redaction stays server-side; the renderer needs the flag to
     // refuse any prefill (URL or handoff) into the field.
-    if (def["sensitive"] === true)
-        out["sensitive"] = true;
+    ["sensitive", isTrueValue],
     // Without it the renderer shows a plain text input for a field whose value never leaves the server.
-    if (def["writeOnly"] === true)
-        out["writeOnly"] = true;
+    ["writeOnly", isTrueValue],
     // timestamp: the edit view-model derives its wall-clock input mode from this.
-    if (typeof def["locatedBy"] === "string")
-        out["locatedBy"] = def["locatedBy"];
+    ["locatedBy", isStringValue],
     // file/image/images: upload picker constraints; the first variant key picks
     // the preview variant.
-    if (isJsonSafeArray(def["accept"]))
-        out["accept"] = def["accept"];
-    if (typeof def["maxSize"] === "string")
-        out["maxSize"] = def["maxSize"];
-    if (isJsonSafeObject(def["variants"]))
-        out["variants"] = def["variants"];
+    ["accept", isJsonSafeArray],
+    ["maxSize", isStringValue],
+    ["variants", isJsonSafeObject],
     // decimal, incl. embedded sub-fields: rounding of derived embedded-list cells.
-    if (typeof def["scale"] === "number")
-        out["scale"] = def["scale"];
-    // money: declared currency source (MoneyCurrencySource, fw#2933) — without
+    ["scale", isNumberValue],
+    // money: declared currency source (MoneyCurrencySource) — without
     // it the renderer can't tell a "currency: { kind: 'tenant' }" field apart
     // from an undeclared one and always falls back to entity.defaultCurrency.
-    if (isJsonSafeObject(def["currency"]))
-        out["currency"] = def["currency"];
+    ["currency", isJsonSafeObject],
     // embedded lists: row-count bounds, computed cells, totals row, and the
-    // sibling-money-field totals check (fw#2497).
-    if (typeof def["minItems"] === "number")
-        out["minItems"] = def["minItems"];
-    if (typeof def["maxItems"] === "number")
-        out["maxItems"] = def["maxItems"];
-    if (isJsonSafeObject(def["derived"]))
-        out["derived"] = def["derived"];
-    if (isJsonSafeArray(def["totals"]))
-        out["totals"] = def["totals"];
-    if (isJsonSafeObject(def["totalsMatch"]))
-        out["totalsMatch"] = def["totalsMatch"];
+    // sibling-money-field totals check.
+    ["minItems", isNumberValue],
+    ["maxItems", isNumberValue],
+    ["derived", isJsonSafeObject],
+    ["totals", isJsonSafeArray],
+    ["totalsMatch", isJsonSafeObject],
+];
+function projectField(fieldDef) {
+    const def = fieldDef; // @cast-boundary schema-walk
+    const out = {};
+    for (const [key, isForwarded] of FORWARDED_FIELD_PROPERTIES) {
+        if (isForwarded(def[key]))
+            out[key] = def[key];
+    }
     // embedded lists: the sub-field map itself — without it the client-side
-    // edit view-model iterates `undefined` and the screen crashes (fw#2507).
+    // edit view-model iterates `undefined` and the screen crashes.
     // Recursive per sub-field, NOT a blanket isJsonSafeValue gate: a single
     // sub-field carrying a validator fn would otherwise drop the whole map,
     // and a blanket copy would ship server internals.