@cosmicdrift/kumiko-framework 0.387.0 → 0.388.0

package/dist/engine/schema-builder.js

@@ -77,139 +77,230 @@ function embeddedSubFieldToZod(subField) {
             assertUnreachable(subField, "embedded sub-field type");
     }
 }
-// kumiko-lint-ignore complexity-budget field→zod switch is the single schema source of truth
+function textFieldToZod(field, { applyDefaults, isUpdate }) {
+    let schema = z.string();
+    if (field.maxLength)
+        schema = schema.max(field.maxLength);
+    if (field.minLength) {
+        // "" must stay valid for optional fields and writeOnly updates (""
+        // = unchanged); `required` rejects it separately via min(1) below.
+        const minLength = field.minLength;
+        schema = schema.refine((value) => value.length === 0 || value.length >= minLength, {
+            message: `at least ${minLength} characters`,
+        });
+    }
+    if (field.writeOnly === true) {
+        // Update: "" = unchanged (dropped before the executor), null = clear,
+        // unless required. Create: "" would leave a required field unset.
+        if (!isUpdate)
+            return field.required ? schema.min(1) : schema;
+        return field.required ? schema : schema.nullable();
+    }
+    if (field.format === "email")
+        schema = schema.email();
+    if (field.format === "url")
+        schema = schema.url();
+    if (field.format === "iban") {
+        // "" stays valid for an optional field; `required` rejects it via min(1) below.
+        schema = schema.superRefine((value, ctx) => {
+            if (value !== "" && !isValidIban(value)) {
+                ctx.addIssue({ code: "invalid_format", format: "iban", input: value });
+            }
+        });
+    }
+    if (field.format === "month") {
+        // "" stays valid for an optional field; `required` rejects it via min(1) below.
+        schema = schema.refine((value) => value === "" || MONTH_PATTERN.test(value), {
+            message: "expected a month as YYYY-MM",
+        });
+    }
+    if (field.required)
+        schema = schema.min(1);
+    return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
+}
+function longTextFieldToZod(field, applyDefaults) {
+    // longText has no `format` variant (by type design). Only optional
+    // maxLength and required are supported; otherwise it is an unrestricted
+    // z.string().
+    let schema = z.string();
+    if (field.maxLength)
+        schema = schema.max(field.maxLength);
+    if (field.required)
+        schema = schema.min(1);
+    return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
+}
+function selectFieldToZod(field, applyDefaults) {
+    const [first, ...rest] = field.options;
+    if (!first)
+        return z.string();
+    const enumSchema = z.enum([first, ...rest]);
+    if (field.default !== undefined) {
+        // Untouched <select> sends "" too; with a default that maps to the
+        // default (same semantics as undefined) instead of the invalid-value
+        // rejection. A field with a default is never "unset" —
+        // true on both insert AND update, so this branch (and its "" → default
+        // mapping) fires regardless of applyDefaults; only the `.default(...)`
+        // schema-level fallback for OMITTED input is update-gated below.
+        // `null` maps the same way: the no-default branch below normalizes
+        // an untouched select to null, and a client that reuses that value
+        // against a defaulted field must not get rejected either.
+        const mapped = z.preprocess((value) => (value === "" || value === null ? field.default : value), enumSchema);
+        return applyDefaults ? mapped.default(field.default) : mapped;
+    }
+    if (field.required)
+        return enumSchema;
+    // Optional select without a default: an untouched HTML <select> submits
+    // "" for its placeholder option. Treat that as "unset" (null) instead of
+    // an invalid enum value — null (not undefined) so the value survives the
+    // JSON-serialized event payload and an update can actually clear a
+    // previously-set select back to unset, not just skip validation.
+    return z.preprocess((value) => (value === "" ? null : value), enumSchema.nullable());
+}
+function multiSelectFieldToZod(field, applyDefaults) {
+    const [first, ...rest] = field.options;
+    if (!first)
+        return z.array(z.string());
+    // `required: true` means non-empty, as with a `text` field.
+    // An empty array is rejected; the global `.optional()` wrapping
+    // in buildInsertSchema determines whether the field may be omitted.
+    let schema = z.array(z.enum([first, ...rest]));
+    if (field.required)
+        schema = schema.min(1);
+    return field.default !== undefined && applyDefaults ? schema.default([...field.default]) : schema;
+}
+function numberFieldToZod(field, applyDefaults) {
+    let schema = z.number();
+    // `integer: true` maps to a Postgres int4 column (entity-table-meta.ts)
+    // — bound it here so an out-of-range write fails loud (400) at the
+    // schema boundary instead of dying in Postgres (22003 → 500).
+    if (field.integer)
+        schema = schema.int().min(-2147483648).max(2147483647);
+    if (field.min !== undefined)
+        schema = schema.min(field.min);
+    if (field.max !== undefined)
+        schema = schema.max(field.max);
+    return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
+}
+function decimalFieldToZod(field, applyDefaults) {
+    // Stored as numeric(precision, scale), surfaced as JS number. Bound the
+    // value at the write boundary so an over-range or over-scale input fails
+    // loud here instead of being silently rounded/rejected by Postgres.
+    const limit = 10 ** (field.precision - field.scale);
+    const schema = z
+        .number()
+        .gt(-limit)
+        .lt(limit)
+        .refine((n) => isRepresentableAtScale(n, field.scale), {
+        message: `at most ${field.scale} decimal places`,
+    });
+    return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
+}
+function moneyFieldToZod(currencies) {
+    const [first, ...rest] = currencies;
+    if (!first)
+        throw new Error("No currencies configured");
+    return z.object({
+        amount: z.number(),
+        currency: z.enum([first, ...rest]),
+    });
+}
+function embeddedFieldToZod(field) {
+    const shape = {};
+    for (const [subName, subField] of Object.entries(field.schema)) {
+        const zodSub = embeddedSubFieldToZod(subField);
+        shape[subName] = subField.required ? zodSub : zodSub.optional();
+    }
+    const baseRow = z.object(shape);
+    const derived = field.derived;
+    // The server is the authority for derived cells: a row is recomputed
+    // here, overwriting whatever the client sent, instead of merely
+    // being checked against it.
+    const row = derived === undefined
+        ? baseRow
+        : z.preprocess((value) => withDerivedCells(value, derived, field.schema), baseRow);
+    if (field.multiple !== true)
+        return row;
+    // `required: true` means non-empty, same reading as multiSelect —
+    // whether the key may be omitted at all is decided by buildInsertSchema
+    // off the same flag. `minItems` overrides that default when set.
+    let list = z.array(row);
+    if (field.maxItems !== undefined)
+        list = list.max(field.maxItems);
+    const min = field.minItems ?? (field.required === true ? 1 : undefined);
+    if (min === undefined)
+        return list;
+    // A custom issue rather than min(): other arrays (multiSelect) share zod's
+    // too_small and must not read "rows"; the bridge honours params.i18nKey.
+    // The refinement is invisible to z.toJSONSchema; the meta keeps minItems for agent manifests.
+    return list.meta({ minItems: min }).superRefine((rows, ctx) => {
+        // skip: the minimum is met, nothing to report
+        if (rows.length >= min)
+            return;
+        ctx.addIssue({
+            code: "custom",
+            input: rows,
+            params: {
+                i18nKey: `errors.validation.list_min_rows.${min === 1 ? "one" : "other"}`,
+                minimum: min,
+            },
+        });
+    });
+}
+function timestampFieldToZod(field) {
+    // When locatedBy is set: wall-clock time without an offset (ISO datetime
+    // without `Z`). Otherwise: ISO UTC datetime (with `Z`). Both are validated
+    // against the ISO-8601 schema through z.iso.datetime; precision (with or
+    // without an offset) depends on locatedBy.
+    const schema = field.locatedBy !== undefined ? z.iso.datetime({ local: true }) : z.iso.datetime();
+    return withDateBounds(schema, field.min, field.max);
+}
+function locatedTimestampToZod() {
+    // Combined wall-clock and time-zone object. On write, either
+    // { at, tz } (typical for a UI form, with utc calculated) or { utc, tz }
+    // (typical for server-to-server communication, with at calculated) is
+    // accepted. On read, the read wrapper provides all three fields.
+    //
+    // The schema guarantees only tz plus at least one of at or utc.
+    const at = z.iso.datetime({ local: true });
+    const tz = z.string().refine(isValidIanaTimeZone, { message: "invalid IANA time zone" });
+    const utc = z.iso.datetime();
+    return z.union([
+        z.object({ at, tz, utc: utc.optional() }),
+        z.object({ utc, tz, at: at.optional() }),
+    ]);
+}
+function fileListFieldToZod(field) {
+    // Multi file: array of fileRef UUIDs. Same story as the singular
+    // variant — the element type has to match the UUID column on
+    // fileRefsTable.id.
+    const ids = z.array(z.uuid());
+    return field.maxCount === undefined ? ids : ids.max(field.maxCount);
+}
 export function fieldToZod(field, currencies, opts = {}) {
     // Insert callers want `.default(...)` applied so an omitted field falls
     // back to it; buildUpdateSchema passes applyDefaults: false so an omitted
     // field on update stays omitted (a `{ title }` patch must not clobber
     // other columns with their defaults) while a field's own default value is
-    // still known here for "" → default mapping (select case below).
+    // still known here for "" → default mapping (selectFieldToZod).
     const applyDefaults = opts.applyDefaults ?? true;
+    const ctx = { applyDefaults, isUpdate: opts.isUpdate === true };
     switch (field.type) {
-        case "text": {
-            let schema = z.string();
-            if (field.maxLength)
-                schema = schema.max(field.maxLength);
-            if (field.minLength) {
-                // "" must stay valid for optional fields and writeOnly updates (""
-                // = unchanged); `required` rejects it separately via min(1) below.
-                const minLength = field.minLength;
-                schema = schema.refine((value) => value.length === 0 || value.length >= minLength, {
-                    message: `at least ${minLength} characters`,
-                });
-            }
-            if (field.writeOnly === true) {
-                // Update: "" = unchanged (dropped before the executor), null = clear,
-                // unless required. Create: "" would leave a required field unset.
-                if (opts.isUpdate !== true)
-                    return field.required ? schema.min(1) : schema;
-                return field.required ? schema : schema.nullable();
-            }
-            if (field.format === "email")
-                schema = schema.email();
-            if (field.format === "url")
-                schema = schema.url();
-            if (field.format === "iban") {
-                // "" stays valid for an optional field; `required` rejects it via min(1) below.
-                schema = schema.superRefine((value, ctx) => {
-                    if (value !== "" && !isValidIban(value)) {
-                        ctx.addIssue({ code: "invalid_format", format: "iban", input: value });
-                    }
-                });
-            }
-            if (field.format === "month") {
-                // "" stays valid for an optional field; `required` rejects it via min(1) below.
-                schema = schema.refine((value) => value === "" || MONTH_PATTERN.test(value), {
-                    message: "expected a month as YYYY-MM",
-                });
-            }
-            if (field.required)
-                schema = schema.min(1);
-            return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-        }
-        case "longText": {
-            // longText has no `format` variant (by type design). Only optional
-            // maxLength and required are supported; otherwise it is an unrestricted
-            // z.string().
-            let schema = z.string();
-            if (field.maxLength)
-                schema = schema.max(field.maxLength);
-            if (field.required)
-                schema = schema.min(1);
-            return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-        }
+        case "text":
+            return textFieldToZod(field, ctx);
+        case "longText":
+            return longTextFieldToZod(field, applyDefaults);
         case "boolean": {
             const schema = z.boolean();
             return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
         }
-        case "select": {
-            const [first, ...rest] = field.options;
-            if (!first)
-                return z.string();
-            const enumSchema = z.enum([first, ...rest]);
-            if (field.default !== undefined) {
-                // Untouched <select> sends "" too; with a default that maps to the
-                // default (same semantics as undefined) instead of the invalid-value
-                // rejection. A field with a default is never "unset" —
-                // true on both insert AND update, so this branch (and its "" → default
-                // mapping) fires regardless of applyDefaults; only the `.default(...)`
-                // schema-level fallback for OMITTED input is update-gated below.
-                // `null` maps the same way: the no-default branch below normalizes
-                // an untouched select to null, and a client that reuses that value
-                // against a defaulted field must not get rejected either.
-                const mapped = z.preprocess((value) => (value === "" || value === null ? field.default : value), enumSchema);
-                return applyDefaults ? mapped.default(field.default) : mapped;
-            }
-            if (field.required)
-                return enumSchema;
-            // Optional select without a default: an untouched HTML <select> submits
-            // "" for its placeholder option. Treat that as "unset" (null) instead of
-            // an invalid enum value — null (not undefined) so the value survives the
-            // JSON-serialized event payload and an update can actually clear a
-            // previously-set select back to unset, not just skip validation.
-            return z.preprocess((value) => (value === "" ? null : value), enumSchema.nullable());
-        }
-        case "multiSelect": {
-            const [first, ...rest] = field.options;
-            if (!first)
-                return z.array(z.string());
-            // `required: true` means non-empty, as with a `text` field.
-            // An empty array is rejected; the global `.optional()` wrapping
-            // in buildInsertSchema determines whether the field may be omitted.
-            let schema = z.array(z.enum([first, ...rest]));
-            if (field.required)
-                schema = schema.min(1);
-            return field.default !== undefined && applyDefaults
-                ? schema.default([...field.default])
-                : schema;
-        }
-        case "number": {
-            let schema = z.number();
-            // `integer: true` maps to a Postgres int4 column (entity-table-meta.ts)
-            // — bound it here so an out-of-range write fails loud (400) at the
-            // schema boundary instead of dying in Postgres (22003 → 500).
-            if (field.integer)
-                schema = schema.int().min(-2147483648).max(2147483647);
-            if (field.min !== undefined)
-                schema = schema.min(field.min);
-            if (field.max !== undefined)
-                schema = schema.max(field.max);
-            return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-        }
-        case "decimal": {
-            // Stored as numeric(precision, scale), surfaced as JS number. Bound the
-            // value at the write boundary so an over-range or over-scale input fails
-            // loud here instead of being silently rounded/rejected by Postgres.
-            const limit = 10 ** (field.precision - field.scale);
-            const schema = z
-                .number()
-                .gt(-limit)
-                .lt(limit)
-                .refine((n) => isRepresentableAtScale(n, field.scale), {
-                message: `at most ${field.scale} decimal places`,
-            });
-            return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
-        }
+        case "select":
+            return selectFieldToZod(field, applyDefaults);
+        case "multiSelect":
+            return multiSelectFieldToZod(field, applyDefaults);
+        case "number":
+            return numberFieldToZod(field, applyDefaults);
+        case "decimal":
+            return decimalFieldToZod(field, applyDefaults);
         case "bigInt": {
             // JS-`number` round-trip via mode:"number"; exact up to 2^53.
             // The safe-integer cap ensures that a caller passing a float (for example,
@@ -218,111 +309,36 @@ export function fieldToZod(field, currencies, opts = {}) {
             const schema = z.number().int().safe();
             return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;
         }
-        case "money": {
-            const [first, ...rest] = currencies;
-            if (!first)
-                throw new Error("No currencies configured");
-            return z.object({
-                amount: z.number(),
-                currency: z.enum([first, ...rest]),
-            });
-        }
-        case "embedded": {
-            const shape = {};
-            for (const [subName, subField] of Object.entries(field.schema)) {
-                const zodSub = embeddedSubFieldToZod(subField);
-                shape[subName] = subField.required ? zodSub : zodSub.optional();
-            }
-            const baseRow = z.object(shape);
-            const derived = field.derived;
-            // The server is the authority for derived cells: a row is recomputed
-            // here, overwriting whatever the client sent, instead of merely
-            // being checked against it.
-            const row = derived === undefined
-                ? baseRow
-                : z.preprocess((value) => withDerivedCells(value, derived, field.schema), baseRow);
-            if (field.multiple !== true)
-                return row;
-            // `required: true` means non-empty, same reading as multiSelect —
-            // whether the key may be omitted at all is decided by buildInsertSchema
-            // off the same flag. `minItems` overrides that default when set.
-            let list = z.array(row);
-            if (field.maxItems !== undefined)
-                list = list.max(field.maxItems);
-            const min = field.minItems ?? (field.required === true ? 1 : undefined);
-            if (min === undefined)
-                return list;
-            // A custom issue rather than min(): other arrays (multiSelect) share zod's
-            // too_small and must not read "rows"; the bridge honours params.i18nKey.
-            return list.superRefine((rows, ctx) => {
-                // skip: the minimum is met, nothing to report
-                if (rows.length >= min)
-                    return;
-                ctx.addIssue({
-                    code: "custom",
-                    input: rows,
-                    params: {
-                        i18nKey: `errors.validation.list_min_rows.${min === 1 ? "one" : "other"}`,
-                        minimum: min,
-                    },
-                });
-            });
-        }
-        case "jsonb": {
+        case "money":
+            return moneyFieldToZod(currencies);
+        case "embedded":
+            return embeddedFieldToZod(field);
+        case "jsonb":
             // Free-form jsonb — keys are tenant-/runtime-defined. Validation
             // passes through any plain object.
             return z.record(z.string(), z.unknown());
-        }
-        case "date": {
-            const schema = z.string().date();
-            return withDateBounds(schema, field.min, field.max);
-        }
-        case "timestamp": {
-            // When locatedBy is set: wall-clock time without an offset (ISO datetime
-            // without `Z`). Otherwise: ISO UTC datetime (with `Z`). Both are validated
-            // against the ISO-8601 schema through z.iso.datetime; precision (with or
-            // without an offset) depends on locatedBy.
-            const schema = field.locatedBy !== undefined ? z.iso.datetime({ local: true }) : z.iso.datetime();
-            return withDateBounds(schema, field.min, field.max);
-        }
-        case "tz": {
+        case "date":
+            return withDateBounds(z.string().date(), field.min, field.max);
+        case "timestamp":
+            return timestampFieldToZod(field);
+        case "tz":
             // IANA time-zone name, validated against the runtime's zone list
             // (isValidIanaTimeZone). An invalid name fails at the write boundary
             // instead of later in ctx.tz.parse / Temporal.
             return z.string().refine(isValidIanaTimeZone, { message: "invalid IANA time zone" });
-        }
-        case "locatedTimestamp": {
-            // Combined wall-clock and time-zone object. On write, either
-            // { at, tz } (typical for a UI form, with utc calculated) or { utc, tz }
-            // (typical for server-to-server communication, with at calculated) is
-            // accepted. On read, the read wrapper provides all three fields.
-            //
-            // The schema guarantees only tz plus at least one of at or utc.
-            const at = z.iso.datetime({ local: true });
-            const tz = z.string().refine(isValidIanaTimeZone, { message: "invalid IANA time zone" });
-            const utc = z.iso.datetime();
-            return z.union([
-                z.object({ at, tz, utc: utc.optional() }),
-                z.object({ utc, tz, at: at.optional() }),
-            ]);
-        }
+        case "locatedTimestamp":
+            return locatedTimestampToZod();
         case "file":
-        case "image": {
+        case "image":
             // Single file: stores a fileRef UUID — must match fileRefsTable.id
             // (uuid column). Pre-fix this was z.number() from an era when the
             // column was (wrongly) integer; the table-builder fix to uuid needs
             // a matching validation-layer fix here or the CRUD pipeline rejects
             // every valid UUID with "expected number".
             return z.uuid();
-        }
         case "files":
-        case "images": {
-            // Multi file: array of fileRef UUIDs. Same story as the singular
-            // variant — the element type has to match the UUID column on
-            // fileRefsTable.id.
-            const ids = z.array(z.uuid());
-            return field.maxCount === undefined ? ids : ids.max(field.maxCount);
-        }
+        case "images":
+            return fileListFieldToZod(field);
         case "reference":
             // Validates the UUID shape. Checking that the reference exists
             // (the row exists in the referenced table and belongs to the tenant) is

package/dist/engine/screen-helpers.js

@@ -92,7 +92,7 @@ export function normalizeListColumn(c) {
         process.env.NODE_ENV !== "production" &&
         col.renderer !== undefined &&
         typeof col.renderer === "function") {
-        log.warn(`normalizeListColumn: Feld "${col.field}" hat einen Funktions-Renderer — dieser wird von JSON.stringify verworfen. Bitte auf FormatSpec ({ format: "..." }) migrieren.`);
+        log.warn(`normalizeListColumn: field "${col.field}" has a function renderer, which JSON.stringify drops. Migrate it to a FormatSpec ({ format: "..." }).`);
     }
     return col;
 }

package/dist/engine/screen-kind.d.ts

@@ -0,0 +1,7 @@
+import type { ScreenDefinition } from "./types/screen.ts";
+export type ScreenKind = ScreenDefinition["type"];
+export type ScreenOfKind = {
+    readonly [K in ScreenKind]: Extract<ScreenDefinition, {
+        readonly type: K;
+    }>;
+};

package/dist/engine/screen-kind.js

@@ -0,0 +1 @@
+export {};

package/dist/engine/strip-disabled-features-from-app-schema.js

@@ -11,42 +11,79 @@
 // gone it also drops every action, redirect, nav and workspace member that
 // pointed at them. The one reference it does not resolve is a nav `parent`
 // pointing at a missing nav; that is pruned here.
+import { createFallbackLogger, scrubLogText } from "../logging/index.js";
 import { resolveScreenTargetQn } from "./boot-validator/screens.js";
 import { isToggleableFeature } from "./effective-features.js";
+import { isPureGroupingNav } from "./project-app-schema-for-roles.js";
 import { isValidQn, qualifyEntityName } from "./qualified-name.js";
+const schemaLogger = createFallbackLogger("app-schema");
 // Sorted, so the result doubles as a stable cache key. The trial gate is
 // consulted like the dispatcher's feature gate does, but only for toggleable
 // features: a trial can only unlock tier (toggleable) features, so a
-// cascade-disabled always-on feature needs no gate call.
+// cascade-disabled always-on feature needs no gate call. A failing gate counts
+// as "not unlocked" (the handlers answer 403 then anyway), so a gate outage
+// hides the add-on instead of taking the whole schema endpoint down.
 export async function resolveDisabledFeatureNames(registry, effectiveFeatures, tenantId) {
     const enabled = effectiveFeatures(tenantId);
-    const disabled = [];
-    for (const [featureName, feature] of registry.features) {
-        if (enabled.has(featureName))
-            continue;
-        if (isToggleableFeature(feature) &&
-            (await effectiveFeatures.trialGate?.(tenantId, featureName))) {
-            continue;
+    const trialGate = effectiveFeatures.trialGate;
+    const disabled = [...registry.features].filter(([featureName]) => !enabled.has(featureName));
+    const unlockedByTrial = await Promise.all(disabled.map(async ([featureName, feature]) => {
+        if (trialGate === undefined || !isToggleableFeature(feature))
+            return false;
+        try {
+            return await trialGate(tenantId, featureName);
         }
-        disabled.push(featureName);
-    }
-    return disabled.sort();
+        catch (error) {
+            schemaLogger.warn("trial gate failed, treating feature as not unlocked", {
+                featureName,
+                error: scrubLogText(error instanceof Error ? error.message : String(error)),
+            });
+            return false;
+        }
+    }));
+    return disabled
+        .filter((_, index) => !unlockedByTrial[index])
+        .map(([featureName]) => featureName)
+        .sort();
 }
 function navParentQn(featureName, parent) {
     return isValidQn(parent) ? parent : qualifyEntityName(featureName, "nav", parent);
 }
-// Navs of enabled features whose parent chain ends in a removed nav.
+function navQnsByParent(features) {
+    const childrenByParent = new Map();
+    for (const feature of features) {
+        for (const nav of feature.navs ?? []) {
+            if (nav.parent === undefined)
+                continue;
+            const parentQn = navParentQn(feature.featureName, nav.parent);
+            const children = childrenByParent.get(parentQn) ?? [];
+            children.push(qualifyEntityName(feature.featureName, "nav", nav.id));
+            childrenByParent.set(parentQn, children);
+        }
+    }
+    return childrenByParent;
+}
+// Navs of enabled features whose parent chain ends in a removed nav, plus pure grouping
+// navs whose children are all removed (an empty section the role projection cannot drop,
+// because it only drops groups that still have children).
 function collectOrphanedNavQns(features, removedNavQns) {
     const orphaned = new Set();
+    const childrenByParent = navQnsByParent(features);
     let changed = true;
     while (changed) {
         changed = false;
         for (const feature of features) {
             for (const nav of feature.navs ?? []) {
                 const qn = qualifyEntityName(feature.featureName, "nav", nav.id);
-                if (removedNavQns.has(qn) || nav.parent === undefined)
+                if (removedNavQns.has(qn))
                     continue;
-                if (removedNavQns.has(navParentQn(feature.featureName, nav.parent))) {
+                const parentRemoved = nav.parent !== undefined &&
+                    removedNavQns.has(navParentQn(feature.featureName, nav.parent));
+                const children = childrenByParent.get(qn) ?? [];
+                const emptiedGroup = isPureGroupingNav(nav) &&
+                    children.length > 0 &&
+                    children.every((childQn) => removedNavQns.has(childQn));
+                if (parentRemoved || emptiedGroup) {
                     removedNavQns.add(qn);
                     orphaned.add(qn);
                     changed = true;

package/dist/engine/validate-projection-allowlist.js

@@ -24,6 +24,7 @@
 // statically; today it lives in this comment + the StepBuilder doc.
 import { KUMIKO_META_SYMBOL } from "@cosmicdrift/kumiko-types/schema-table-types";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
+import { resolveTableName } from "../db/entity-table-meta.js";
 import { schemaTableName } from "../db/table-introspection.js";
 import { getStep } from "./define-step.js";
 import { buildPipelineSteps } from "./pipeline.js";
@@ -79,7 +80,7 @@ export function validateProjectionAllowlist(features) {
     const aggregateTables = new Map();
     for (const f of features) {
         for (const [entityName, entity] of Object.entries(f.entities ?? {})) {
-            const tableName = entity.table ?? entityName;
+            const tableName = resolveTableName(entityName, entity, undefined);
             const existing = aggregateTables.get(tableName);
             if (existing && existing !== f.name) {
                 throw new Error(`Aggregate-table "${tableName}" is registered by both feature "${existing}" and feature "${f.name}" via r.entity. ` +

package/dist/entrypoint/index.d.ts

@@ -10,7 +10,7 @@ import type { Lifecycle } from "../lifecycle/index.ts";
 import type { ObservabilityProvider } from "../observability/index.ts";
 import type { Dispatcher, DispatcherOptions } from "../pipeline/dispatcher.ts";
 import type { EventDedup, EventDispatcher } from "../pipeline/index.ts";
-import type { SystemHooks } from "../pipeline/lifecycle-pipeline.ts";
+import type { LifecycleHooks, SystemHooks } from "../pipeline/lifecycle-pipeline.ts";
 export type BaseEntrypointOptions = {
     readonly registry: Registry;
     readonly context: AppContext;
@@ -21,6 +21,7 @@ export type BaseEntrypointOptions = {
     readonly systemHooks?: SystemHooks;
     readonly eventDedup?: EventDedup;
     readonly lifecycle?: Lifecycle;
+    readonly instanceId?: ServerOptions["instanceId"];
 };
 type JobsBlock = {
     readonly redisUrl: string;
@@ -49,6 +50,7 @@ export type ApiEntrypointOptions = BaseEntrypointOptions & {
         readonly runLocal?: boolean;
     };
     readonly trustedProxyHops?: ServerOptions["trustedProxyHops"];
+    readonly errorDocs?: ServerOptions["errorDocs"];
 };
 export type WorkerEntrypointOptions = BaseEntrypointOptions & JobsBlock & {
     readonly eventDispatcher?: ServerOptions["eventDispatcher"];
@@ -61,6 +63,7 @@ export type ApiEntrypoint = {
     readonly lifecycle: Lifecycle;
     readonly observability: ObservabilityProvider;
     readonly dispatcher: Dispatcher;
+    readonly lifecycleHooks: LifecycleHooks;
     readonly eventDispatcher?: EventDispatcher;
     readonly mode: "api";
     start(): Promise<void>;