@cosmicdrift/kumiko-framework 0.387.0 → 0.389.0

package/dist/engine/feature-ast/pattern-id-schema.js

@@ -0,0 +1,166 @@
+import * as z from "zod";
+const patternIdEntitySchema = z
+    .object({ kind: z.literal("entity"), entityName: z.string() })
+    .strict();
+const patternIdRelationSchema = z
+    .object({ kind: z.literal("relation"), entityName: z.string(), relationName: z.string() })
+    .strict();
+const patternIdNavSchema = z.object({ kind: z.literal("nav"), id: z.string() }).strict();
+const patternIdWorkspaceSchema = z
+    .object({ kind: z.literal("workspace"), id: z.string() })
+    .strict();
+const patternIdScreenSchema = z.object({ kind: z.literal("screen"), id: z.string() }).strict();
+const patternIdWriteHandlerSchema = z
+    .object({ kind: z.literal("writeHandler"), handlerName: z.string() })
+    .strict();
+const patternIdQueryHandlerSchema = z
+    .object({ kind: z.literal("queryHandler"), handlerName: z.string() })
+    .strict();
+const patternIdStreamHandlerSchema = z
+    .object({ kind: z.literal("streamHandler"), handlerName: z.string() })
+    .strict();
+const patternIdHookSchema = z
+    .object({
+    kind: z.literal("hook"),
+    hookType: z.string(),
+    target: z.union([z.string(), z.object({ allOf: z.string() }).strict()]),
+})
+    .strict();
+const patternIdMetricSchema = z
+    .object({ kind: z.literal("metric"), shortName: z.string() })
+    .strict();
+const patternIdSecretSchema = z
+    .object({ kind: z.literal("secret"), shortName: z.string() })
+    .strict();
+const patternIdSecretNamespaceSchema = z
+    .object({ kind: z.literal("secretNamespace"), shortName: z.string() })
+    .strict();
+const patternIdClaimKeySchema = z
+    .object({ kind: z.literal("claimKey"), shortName: z.string() })
+    .strict();
+const patternIdReferenceDataSchema = z
+    .object({ kind: z.literal("referenceData"), entityName: z.string() })
+    .strict();
+const patternIdUseExtensionSchema = z
+    .object({ kind: z.literal("useExtension"), extensionName: z.string(), entityName: z.string() })
+    .strict();
+const patternIdJobSchema = z.object({ kind: z.literal("job"), jobName: z.string() }).strict();
+const patternIdNotificationSchema = z
+    .object({ kind: z.literal("notification"), notificationName: z.string() })
+    .strict();
+const patternIdHttpRouteSchema = z
+    .object({ kind: z.literal("httpRoute"), method: z.string(), path: z.string() })
+    .strict();
+const patternIdProjectionSchema = z
+    .object({ kind: z.literal("projection"), name: z.string() })
+    .strict();
+const patternIdMultiStreamProjectionSchema = z
+    .object({ kind: z.literal("multiStreamProjection"), name: z.string() })
+    .strict();
+const patternIdDefineEventSchema = z
+    .object({ kind: z.literal("defineEvent"), eventName: z.string() })
+    .strict();
+const patternIdExtendsRegistrarSchema = z
+    .object({ kind: z.literal("extendsRegistrar"), extensionName: z.string() })
+    .strict();
+const patternIdAiGenerateSchema = z
+    .object({ kind: z.literal("ai.generate"), stepKey: z.string() })
+    .strict();
+const patternIdAiExtractSchema = z
+    .object({ kind: z.literal("ai.extract"), stepKey: z.string() })
+    .strict();
+const patternIdAiClassifySchema = z
+    .object({ kind: z.literal("ai.classify"), stepKey: z.string() })
+    .strict();
+const patternIdRequiresSchema = z.object({ kind: z.literal("requires") }).strict();
+const patternIdOptionalRequiresSchema = z.object({ kind: z.literal("optionalRequires") }).strict();
+const patternIdReadsConfigSchema = z.object({ kind: z.literal("readsConfig") }).strict();
+const patternIdSystemScopeSchema = z.object({ kind: z.literal("systemScope") }).strict();
+const patternIdToggleableSchema = z.object({ kind: z.literal("toggleable") }).strict();
+const patternIdDescribeSchema = z.object({ kind: z.literal("describe") }).strict();
+const patternIdUiHintsSchema = z.object({ kind: z.literal("uiHints") }).strict();
+const patternIdAdoptsBundledListsSchema = z
+    .object({ kind: z.literal("adoptsBundledLists") })
+    .strict();
+const patternIdConfigSchema = z.object({ kind: z.literal("config") }).strict();
+const patternIdTranslationsSchema = z.object({ kind: z.literal("translations") }).strict();
+const patternIdAuthClaimsSchema = z.object({ kind: z.literal("authClaims") }).strict();
+const patternIdTreeActionsSchema = z.object({ kind: z.literal("treeActions") }).strict();
+export const PATTERN_ID_SCHEMAS_BY_KIND = {
+    entity: patternIdEntitySchema,
+    relation: patternIdRelationSchema,
+    nav: patternIdNavSchema,
+    workspace: patternIdWorkspaceSchema,
+    screen: patternIdScreenSchema,
+    writeHandler: patternIdWriteHandlerSchema,
+    queryHandler: patternIdQueryHandlerSchema,
+    streamHandler: patternIdStreamHandlerSchema,
+    hook: patternIdHookSchema,
+    metric: patternIdMetricSchema,
+    secret: patternIdSecretSchema,
+    secretNamespace: patternIdSecretNamespaceSchema,
+    claimKey: patternIdClaimKeySchema,
+    referenceData: patternIdReferenceDataSchema,
+    useExtension: patternIdUseExtensionSchema,
+    job: patternIdJobSchema,
+    notification: patternIdNotificationSchema,
+    httpRoute: patternIdHttpRouteSchema,
+    projection: patternIdProjectionSchema,
+    multiStreamProjection: patternIdMultiStreamProjectionSchema,
+    defineEvent: patternIdDefineEventSchema,
+    extendsRegistrar: patternIdExtendsRegistrarSchema,
+    "ai.generate": patternIdAiGenerateSchema,
+    "ai.extract": patternIdAiExtractSchema,
+    "ai.classify": patternIdAiClassifySchema,
+    requires: patternIdRequiresSchema,
+    optionalRequires: patternIdOptionalRequiresSchema,
+    readsConfig: patternIdReadsConfigSchema,
+    systemScope: patternIdSystemScopeSchema,
+    toggleable: patternIdToggleableSchema,
+    describe: patternIdDescribeSchema,
+    uiHints: patternIdUiHintsSchema,
+    adoptsBundledLists: patternIdAdoptsBundledListsSchema,
+    config: patternIdConfigSchema,
+    translations: patternIdTranslationsSchema,
+    authClaims: patternIdAuthClaimsSchema,
+    treeActions: patternIdTreeActionsSchema,
+};
+export const patternIdSchema = z.discriminatedUnion("kind", [
+    patternIdEntitySchema,
+    patternIdRelationSchema,
+    patternIdNavSchema,
+    patternIdWorkspaceSchema,
+    patternIdScreenSchema,
+    patternIdWriteHandlerSchema,
+    patternIdQueryHandlerSchema,
+    patternIdStreamHandlerSchema,
+    patternIdHookSchema,
+    patternIdMetricSchema,
+    patternIdSecretSchema,
+    patternIdSecretNamespaceSchema,
+    patternIdClaimKeySchema,
+    patternIdReferenceDataSchema,
+    patternIdUseExtensionSchema,
+    patternIdJobSchema,
+    patternIdNotificationSchema,
+    patternIdHttpRouteSchema,
+    patternIdProjectionSchema,
+    patternIdMultiStreamProjectionSchema,
+    patternIdDefineEventSchema,
+    patternIdExtendsRegistrarSchema,
+    patternIdAiGenerateSchema,
+    patternIdAiExtractSchema,
+    patternIdAiClassifySchema,
+    patternIdRequiresSchema,
+    patternIdOptionalRequiresSchema,
+    patternIdReadsConfigSchema,
+    patternIdSystemScopeSchema,
+    patternIdAdoptsBundledListsSchema,
+    patternIdToggleableSchema,
+    patternIdDescribeSchema,
+    patternIdUiHintsSchema,
+    patternIdConfigSchema,
+    patternIdTranslationsSchema,
+    patternIdAuthClaimsSchema,
+    patternIdTreeActionsSchema,
+]);

package/dist/engine/feature-ast/patterns.d.ts

@@ -18,6 +18,7 @@ export type EntityPattern = {
     readonly source: SourceLocation;
     readonly entityName: string;
     readonly definition: EntityDefinition;
+    readonly backingTable?: RawRefSentinel;
 };
 export type RelationPattern = {
     readonly kind: "relation";
@@ -60,6 +61,10 @@ export type SystemScopePattern = {
     readonly kind: "systemScope";
     readonly source: SourceLocation;
 };
+export type AdoptsBundledListsPattern = {
+    readonly kind: "adoptsBundledLists";
+    readonly source: SourceLocation;
+};
 export type ToggleablePattern = {
     readonly kind: "toggleable";
     readonly source: SourceLocation;
@@ -302,8 +307,16 @@ export type UnknownPattern = {
     readonly source: SourceLocation;
     readonly methodName: string;
 };
-export type FeaturePattern = EntityPattern | RelationPattern | NavPattern | WorkspacePattern | ConfigPattern | TranslationsPattern | RequiresPattern | OptionalRequiresPattern | SystemScopePattern | ToggleablePattern | DescribePattern | UiHintsPattern | MetricPattern | SecretPattern | SecretNamespacePattern | ClaimKeyPattern | ReferenceDataPattern | ReadsConfigPattern | UseExtensionPattern | UsesApiPattern | ExposesApiPattern | TreeActionsPattern | ScreenPattern | WriteHandlerPattern | QueryHandlerPattern | StreamHandlerPattern | HookPattern | JobPattern | NotificationPattern | AuthClaimsPattern | HttpRoutePattern | ProjectionPattern | MultiStreamProjectionPattern | DefineEventPattern | ExtendsRegistrarPattern | EnvSchemaPattern | AiGeneratePattern | AiExtractPattern | AiClassifyPattern | UnknownPattern;
+export type FeaturePattern = EntityPattern | RelationPattern | NavPattern | WorkspacePattern | ConfigPattern | TranslationsPattern | RequiresPattern | OptionalRequiresPattern | SystemScopePattern | AdoptsBundledListsPattern | ToggleablePattern | DescribePattern | UiHintsPattern | MetricPattern | SecretPattern | SecretNamespacePattern | ClaimKeyPattern | ReferenceDataPattern | ReadsConfigPattern | UseExtensionPattern | UsesApiPattern | ExposesApiPattern | TreeActionsPattern | ScreenPattern | WriteHandlerPattern | QueryHandlerPattern | StreamHandlerPattern | HookPattern | JobPattern | NotificationPattern | AuthClaimsPattern | HttpRoutePattern | ProjectionPattern | MultiStreamProjectionPattern | DefineEventPattern | ExtendsRegistrarPattern | EnvSchemaPattern | AiGeneratePattern | AiExtractPattern | AiClassifyPattern | UnknownPattern;
 export type FeaturePatternKind = FeaturePattern["kind"];
+export type MembersByKind<U extends {
+    readonly kind: string;
+}> = {
+    readonly [K in U["kind"]]: Extract<U, {
+        readonly kind: K;
+    }>;
+};
+export type FeaturePatternOfKind = MembersByKind<FeaturePattern>;
 export type Editability = "static" | "mixed" | "opaque";
 export declare function getEditability(pattern: FeaturePattern): Editability;
 export {};

package/dist/engine/feature-ast/patterns.js

@@ -59,56 +59,49 @@
 // against this constant to decide "form vs read-only span" — the actual
 // SourceLocation lives at the matching path in `opaqueProps`.
 export const SCREEN_OPAQUE_MARKER = "$opaque";
+const EDITABILITY_BY_KIND = {
+    entity: "static",
+    relation: "static",
+    nav: "static",
+    workspace: "static",
+    config: "static",
+    translations: "static",
+    requires: "static",
+    optionalRequires: "static",
+    systemScope: "static",
+    toggleable: "static",
+    describe: "static",
+    metric: "static",
+    secret: "static",
+    secretNamespace: "static",
+    claimKey: "static",
+    referenceData: "static",
+    readsConfig: "static",
+    useExtension: "static",
+    usesApi: "static",
+    exposesApi: "static",
+    treeActions: "static",
+    screen: "mixed",
+    writeHandler: "mixed",
+    queryHandler: "mixed",
+    streamHandler: "mixed",
+    hook: "mixed",
+    job: "mixed",
+    notification: "mixed",
+    httpRoute: "mixed",
+    projection: "mixed",
+    multiStreamProjection: "mixed",
+    defineEvent: "mixed",
+    "ai.generate": "mixed",
+    "ai.extract": "mixed",
+    "ai.classify": "mixed",
+    authClaims: "opaque",
+    extendsRegistrar: "opaque",
+    envSchema: "opaque",
+    uiHints: "opaque",
+    adoptsBundledLists: "opaque",
+    unknown: "opaque",
+};
 export function getEditability(pattern) {
-    switch (pattern.kind) {
-        case "entity":
-        case "relation":
-        case "nav":
-        case "workspace":
-        case "config":
-        case "translations":
-        case "requires":
-        case "optionalRequires":
-        case "systemScope":
-        case "toggleable":
-        case "describe":
-        case "metric":
-        case "secret":
-        case "secretNamespace":
-        case "claimKey":
-        case "referenceData":
-        case "readsConfig":
-        case "useExtension":
-        case "usesApi":
-        case "exposesApi":
-        case "treeActions":
-            return "static";
-        case "screen":
-        case "writeHandler":
-        case "queryHandler":
-        case "streamHandler":
-        case "hook":
-        case "job":
-        case "notification":
-        case "httpRoute":
-        case "projection":
-        case "multiStreamProjection":
-        case "defineEvent":
-        case "ai.generate":
-        case "ai.extract":
-        case "ai.classify":
-            return "mixed";
-        case "authClaims":
-        case "extendsRegistrar":
-        case "envSchema":
-        case "uiHints":
-        case "unknown":
-            return "opaque";
-        default: {
-            // Exhaustiveness guard — adding a new pattern kind without
-            // updating this switch produces a compile error here.
-            const _exhaustive = pattern;
-            return _exhaustive;
-        }
-    }
+    return EDITABILITY_BY_KIND[pattern.kind];
 }

package/dist/engine/feature-ast/render.js

@@ -30,92 +30,53 @@ export const VERSION_HEADER = `// kumiko-feature-version: ${FEATURE_FILE_VERSION
  * trailing newline; callers compose statements with their own joiner.
  */
 export function renderPattern(pattern) {
-    switch (pattern.kind) {
-        case "requires":
-            return renderRequires(pattern);
-        case "optionalRequires":
-            return renderOptionalRequires(pattern);
-        case "readsConfig":
-            return renderReadsConfig(pattern);
-        case "systemScope":
-            return renderSystemScope(pattern);
-        case "toggleable":
-            return renderToggleable(pattern);
-        case "describe":
-            return renderDescribe(pattern);
-        case "uiHints":
-            return renderUiHints(pattern);
-        case "entity":
-            return renderEntity(pattern);
-        case "relation":
-            return renderRelation(pattern);
-        case "nav":
-            return renderNav(pattern);
-        case "workspace":
-            return renderWorkspace(pattern);
-        case "config":
-            return renderConfig(pattern);
-        case "translations":
-            return renderTranslations(pattern);
-        case "metric":
-            return renderMetric(pattern);
-        case "secret":
-            return renderSecret(pattern);
-        case "secretNamespace":
-            return renderSecretNamespace(pattern);
-        case "claimKey":
-            return renderClaimKey(pattern);
-        case "referenceData":
-            return renderReferenceData(pattern);
-        case "useExtension":
-            return renderUseExtension(pattern);
-        case "screen":
-            return renderScreen(pattern);
-        case "writeHandler":
-            return renderWriteHandler(pattern);
-        case "queryHandler":
-            return renderQueryHandler(pattern);
-        case "streamHandler":
-            return renderStreamHandler(pattern);
-        case "hook":
-            return renderHook(pattern);
-        case "job":
-            return renderJob(pattern);
-        case "notification":
-            return renderNotification(pattern);
-        case "authClaims":
-            return renderAuthClaims(pattern);
-        case "httpRoute":
-            return renderHttpRoute(pattern);
-        case "projection":
-            return renderProjection(pattern);
-        case "multiStreamProjection":
-            return renderMultiStreamProjection(pattern);
-        case "defineEvent":
-            return renderDefineEvent(pattern);
-        case "extendsRegistrar":
-            return renderExtendsRegistrar(pattern);
-        case "usesApi":
-            return renderUsesApi(pattern);
-        case "exposesApi":
-            return renderExposesApi(pattern);
-        case "treeActions":
-            return renderTreeActions(pattern);
-        case "envSchema":
-            return renderEnvSchema(pattern);
-        case "ai.generate":
-            return renderAiGenerate(pattern);
-        case "ai.extract":
-            return renderAiExtract(pattern);
-        case "ai.classify":
-            return renderAiClassify(pattern);
-        case "unknown":
-            return renderUnknown(pattern);
-        default: {
-            const _exhaustive = pattern;
-            return _exhaustive;
-        }
-    }
+    return renderPatternOfKind(pattern.kind, pattern);
+}
+const PATTERN_RENDERERS = {
+    requires: renderRequires,
+    optionalRequires: renderOptionalRequires,
+    readsConfig: renderReadsConfig,
+    systemScope: renderSystemScope,
+    toggleable: renderToggleable,
+    describe: renderDescribe,
+    uiHints: renderUiHints,
+    adoptsBundledLists: renderAdoptsBundledLists,
+    entity: renderEntity,
+    relation: renderRelation,
+    nav: renderNav,
+    workspace: renderWorkspace,
+    config: renderConfig,
+    translations: renderTranslations,
+    metric: renderMetric,
+    secret: renderSecret,
+    secretNamespace: renderSecretNamespace,
+    claimKey: renderClaimKey,
+    referenceData: renderReferenceData,
+    useExtension: renderUseExtension,
+    screen: renderScreen,
+    writeHandler: renderWriteHandler,
+    queryHandler: renderQueryHandler,
+    streamHandler: renderStreamHandler,
+    hook: renderHook,
+    job: renderJob,
+    notification: renderNotification,
+    authClaims: renderAuthClaims,
+    httpRoute: renderHttpRoute,
+    projection: renderProjection,
+    multiStreamProjection: renderMultiStreamProjection,
+    defineEvent: renderDefineEvent,
+    extendsRegistrar: renderExtendsRegistrar,
+    usesApi: renderUsesApi,
+    exposesApi: renderExposesApi,
+    treeActions: renderTreeActions,
+    envSchema: renderEnvSchema,
+    "ai.generate": renderAiGenerate,
+    "ai.extract": renderAiExtract,
+    "ai.classify": renderAiClassify,
+    unknown: renderUnknown,
+};
+function renderPatternOfKind(kind, pattern) {
+    return PATTERN_RENDERERS[kind](pattern);
 }
 // =============================================================================
 // JSON-Like Value Renderer — emits TypeScript-source-compatible literals.
@@ -195,6 +156,9 @@ function renderReadsConfig(p) {
 function renderSystemScope(_p) {
     return "r.systemScope();";
 }
+function renderAdoptsBundledLists(_p) {
+    return "r.adoptsBundledLists();";
+}
 function renderToggleable(p) {
     return `r.toggleable({ default: ${p.default} });`;
 }
@@ -206,7 +170,8 @@ function renderEntity(p) {
     // losing `name` to the sentinel shortcut — spread the reference verbatim
     // next to the name instead.
     if (isRawRefSentinel(p.definition)) {
-        return `r.entity({ name: ${JSON.stringify(p.entityName)}, ...${p.definition.__raw} });`;
+        const backingTable = p.backingTable ? `, backingTable: ${p.backingTable.__raw}` : "";
+        return `r.entity({ name: ${JSON.stringify(p.entityName)}, ...${p.definition.__raw}${backingTable} });`;
     }
     const merged = { name: p.entityName, ...p.definition };
     return `r.entity(${renderValue(merged)});`;

package/dist/engine/feature-builder-state.d.ts

@@ -57,6 +57,7 @@ export type FeatureBuilderState = {
     translations: TranslationKeys;
     isSystemScoped: boolean;
     toggleableDefault: boolean | undefined;
+    adoptsBundledLists: boolean;
     description: string | undefined;
     uiHints: UiHints | undefined;
     treeActions: Readonly<Record<string, TreeActionDef>> | undefined;

package/dist/engine/feature-builder-state.js

@@ -57,6 +57,7 @@ export function createInitialFeatureBuilderState() {
         translations: {},
         isSystemScoped: false,
         toggleableDefault: undefined,
+        adoptsBundledLists: false,
         description: undefined,
         uiHints: undefined,
         treeActions: undefined,

package/dist/engine/feature-entity-handlers.js

@@ -130,6 +130,9 @@ export function buildEntityHandlerMethods(state, name) {
                 ...(def.unsafeSkipTransitionGuard && { unsafeSkipTransitionGuard: true }),
                 ...(def.rateLimit && { rateLimit: def.rateLimit }),
                 ...(def.additionalRateLimits && { additionalRateLimits: def.additionalRateLimits }),
+                ...(def.rateLimitCost && {
+                    rateLimitCost: def.rateLimitCost, // @cast-boundary engine-bridge
+                }),
                 ...(def.escapeHatch && { escapeHatch: def.escapeHatch }),
                 ...transactionPhaseSlots(def),
                 ...(def.tenantlessAnonymous && { tenantlessAnonymous: true }),

package/dist/engine/feature-manifest.d.ts

@@ -40,6 +40,7 @@ export type ManifestFeature = {
     readonly name: string;
     readonly description: string | null;
     readonly toggleableDefault: boolean | null;
+    readonly adoptsBundledLists?: true;
     readonly requires: readonly string[];
     readonly optionalRequires: readonly string[];
     readonly configReads: readonly string[];

package/dist/engine/feature-manifest.js

@@ -59,6 +59,7 @@ export function buildManifestFromRegistry(registry, options) {
             name: feature.name,
             description: feature.description ?? null,
             toggleableDefault: feature.toggleableDefault ?? null,
+            ...(feature.adoptsBundledLists && { adoptsBundledLists: true }),
             requires: [...feature.requires],
             optionalRequires: [...feature.optionalRequires],
             configReads: [...feature.configReads],

package/dist/engine/field-access.d.ts

@@ -1,6 +1,7 @@
 import type { EntityDefinition, SessionUser } from "./types/index.ts";
 export declare function maskWriteOnlyFields<T extends Readonly<Record<string, unknown>>>(entity: EntityDefinition, row: T): T;
 export declare function dropEmptyWriteOnlyValues<T extends Readonly<Record<string, unknown>>>(entity: EntityDefinition, values: T): T;
+export declare function userMayReadFieldInBulk(entity: EntityDefinition, fieldName: string, user: Pick<SessionUser, "roles">): boolean;
 export declare function filterReadFields(entity: EntityDefinition, data: Readonly<Record<string, unknown>>, user: SessionUser): Record<string, unknown>;
 export declare function checkWriteFieldRoles(entity: EntityDefinition, changes: Readonly<Record<string, unknown>>, user: SessionUser): string | null;
 export declare function checkWriteFieldOwnership(entity: EntityDefinition, submittedChanges: Readonly<Record<string, unknown>>, user: SessionUser, oldRow?: Readonly<Record<string, unknown>>, rowContext?: Readonly<Record<string, unknown>>): string | null;

package/dist/engine/field-access.js

@@ -35,6 +35,18 @@ export function dropEmptyWriteOnlyValues(entity, values) {
         delete kept[name];
     return kept; // @cast-boundary engine-payload
 }
+// Role-level gate for bulk exports: false for writeOnly fields and for fields whose read-access
+// map grants none of the user's roles. Per-row ownership rules are not evaluated here; those
+// cells come back empty from the list query itself.
+export function userMayReadFieldInBulk(entity, fieldName, user) {
+    const field = entity.fields[fieldName];
+    if (!field)
+        return false;
+    if (field.type === "text" && field.writeOnly === true)
+        return false;
+    const accessMap = normalizeAccessEntry(field.access?.read);
+    return accessMap === undefined || user.roles.some((role) => accessMap[role] !== undefined);
+}
 // Field-level read filtering. Returns a copy of `data` with fields stripped
 // if the user's roles don't grant read access OR the ownership-rule for the
 // matching role doesn't accept this concrete row. Fields without access

package/dist/engine/form-derivations.js

@@ -101,17 +101,30 @@ function sumListCell(rows, listField, cell) {
     return sum;
 }
 function targetCurrency(field, current, sourceCurrency) {
+    // The client value is last: it must never override what the field or its sources dictate.
+    if (field.type === "money" && field.currency.kind === "literal")
+        return field.currency.code;
+    if (sourceCurrency !== undefined)
+        return sourceCurrency;
     if (isPlainObject(current) &&
         typeof current["currency"] === "string" &&
         current["currency"] !== "") {
         return current["currency"];
     }
-    if (sourceCurrency !== undefined)
-        return sourceCurrency;
-    if (field.type === "money" && field.currency.kind === "literal")
-        return field.currency.code;
     return undefined;
 }
+function computeOrdinary(derivation, values, fields) {
+    const operands = derivation.from.map((name) => readOperand(values, fields, name));
+    const currencies = new Set(operands.flatMap((operand) => operand.currency ?? []));
+    const sourceCurrency = currencies.values().next().value;
+    // Operands in different currencies have no meaningful sum.
+    if (currencies.size > 1)
+        return { computed: undefined, sourceCurrency };
+    return {
+        computed: computeDerivedCellValue(derivation.op, operands.map((operand) => operand.value)),
+        sourceCurrency,
+    };
+}
 /** Recomputes every derived head field of an action form from its inputs.
  *  Pure and client-safe: the renderer runs it live, the server runs it
  *  again (`withFormDerivations`) and overwrites whatever the client sent.
@@ -148,9 +161,7 @@ export function applyFormDerivations(values, screen) {
             ordinary = derivation;
         }
         if (ordinary !== undefined) {
-            const operands = ordinary.from.map((name) => readOperand(result, screen.fields, name));
-            sourceCurrency = operands.find((operand) => operand.currency !== undefined)?.currency;
-            computed = computeDerivedCellValue(ordinary.op, operands.map((operand) => operand.value));
+            ({ computed, sourceCurrency } = computeOrdinary(ordinary, result, screen.fields));
         }
         if (computed === undefined) {
             delete result[target];

package/dist/engine/handler-field-references.js

@@ -5,7 +5,7 @@ const MAX_WRAPPER_DEPTH = 8;
 const MAX_NESTING_DEPTH = 8;
 const referenceMetaSchema = z.union([
     z.string().min(1),
-    z.object({ entity: z.string().min(1), by: z.string().min(1).optional() }),
+    z.strictObject({ entity: z.string().min(1), by: z.string().min(1).optional() }),
 ]);
 function rawReferenceMeta(field) {
     const meta = zodMeta(field);

package/dist/engine/index.d.ts

@@ -1,6 +1,7 @@
 export { handlerFieldLabelKey, handlerTitleKey } from "../i18n/required-surface-keys.ts";
 export { hasAccess } from "./access.ts";
 export { isPrincipalStatusPlugin, isTenantLifecycleStatusPlugin, type PrincipalProfile, type PrincipalStatus, type PrincipalStatusPlugin, TENANT_TEARDOWN_STATUSES, type TenantLifecycleStatusPlugin, } from "./active-membership.ts";
+export { validateBundledListsOptions } from "./boot-validator/bundled-lists-table.ts";
 export { PII_DIRECT_NAME_HINTS, PII_USER_OWNED_NAME_HINTS, PII_USER_REFERENCE_NAME_HINTS, } from "./boot-validator/entity-handler.ts";
 export { entityHasAnonymizableSubjectField } from "./boot-validator/pii-retention.ts";
 export { type CardMetaOverflow, collectCardMetaOverflow, collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator.ts";
@@ -59,7 +60,6 @@ export { parseRefTarget, parseRefTargetEntityName } from "./parse-ref-target.ts"
 export { buildPipelineSteps, stepsPipeline } from "./pipeline.ts";
 export { projectAppSchemaForRoles } from "./project-app-schema-for-roles.ts";
 export { defineApply, defineMspApply, setFields } from "./projection-helpers.ts";
-export { providerPluginContextFromHandler, providerPluginContextFromJob, } from "./provider-plugin-context.ts";
 export type { BuiltinQnType, ParsedQn, QnType } from "./qualified-name.ts";
 export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.ts";
 export { readClaim } from "./read-claim.ts";
@@ -87,7 +87,7 @@ export { assertNotificationVariables, templateVariable, templateVariablesToZod,
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, requireTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.ts";
 export { findOverDeepTransferChain, resolveTransferAdjacency as resolveEntityTransferAdjacency, type TransferAdjacency, type TransferEdge, type TransferEdgeLink, } from "./transfer-adjacency.ts";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.ts";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootOptionName, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDeferral, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, ProviderPluginContext, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StackBootRequirement, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.ts";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootOptionName, BundledListsOptions, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExpandableRowGrouping, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDeferral, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, ListTableOptions, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StackBootRequirement, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateImagesVariableDef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.ts";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HookPhases, HTTP_ERROR_CODE_PATTERN, isAgentVisibleScreen, isDeliveryErrorCode, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.ts";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.ts";
 export { runValidation } from "./validation.ts";