@cosmicdrift/kumiko-framework 0.96.0 → 0.97.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.96.0",
+  "version": "0.97.1",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -181,7 +181,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.96.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.97.1",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/engine/__tests__/boot-validator.test.ts

@@ -1920,6 +1920,28 @@ describe("boot-validator", () => {
         /rowAction "edit" navigate-target "ghost-screen" does not resolve/,
       );
     });
+
+    test("navigate-target → screen in ANOTHER feature → kein Throw (cross-feature)", () => {
+      // Eine deklarative Liste im owning-Feature der Entity navigiert zum
+      // Custom-Editor der Consumer-App (anderes Feature). Runtime löst die bare
+      // id app-weit auf → der Validator muss das erlauben.
+      const list = defineFeature("shop", (r) => {
+        r.entity("product", createEntity({ fields: { name: createTextField() } }));
+        r.screen({
+          id: "product-list",
+          type: "entityList",
+          entity: "product",
+          columns: ["name"],
+          rowActions: [
+            { kind: "navigate", id: "edit", label: "actions.edit", screen: "product-editor" },
+          ],
+        });
+      });
+      const consumer = defineFeature("app", (r) => {
+        r.screen({ id: "product-editor", type: "custom", renderer: { react: "stub" } });
+      });
+      expect(() => validateBoot([list, consumer])).not.toThrow();
+    });
   });
 
   // --- rowAction kind="writeHandler" handler-QN-Validierung (Tier 2.7e-1 erw.) ---
@@ -2125,6 +2147,25 @@ describe("boot-validator", () => {
         /toolbarAction "open-form" navigate-target "ghost-form" does not resolve/,
       );
     });
+
+    test("navigate-target → screen in ANOTHER feature → kein Throw (cross-feature)", () => {
+      const list = defineFeature("shop", (r) => {
+        r.entity("product", createEntity({ fields: { name: createTextField() } }));
+        r.screen({
+          id: "product-list",
+          type: "entityList",
+          entity: "product",
+          columns: ["name"],
+          toolbarActions: [
+            { kind: "navigate", id: "new", label: "actions.new", screen: "product-editor" },
+          ],
+        });
+      });
+      const consumer = defineFeature("app", (r) => {
+        r.screen({ id: "product-editor", type: "custom", renderer: { react: "stub" } });
+      });
+      expect(() => validateBoot([list, consumer])).not.toThrow();
+    });
   });
 
   describe("entityList toolbarAction writeHandler handler-QN (Tier 2.7e-2)", () => {

package/src/engine/__tests__/build-app-schema.test.ts

@@ -255,6 +255,41 @@ describe("buildAppSchema", () => {
     });
     expect(actions?.find((a) => a.id === "always")?.visible).toBe(true);
   });
+
+  test("derivedFields werden ins Client-Schema projiziert (valueType, ohne derive-fn)", () => {
+    // Regression: projectEntity ließ derivedFields ganz weg → der Client kannte
+    // sie nicht, computeListViewModel warf "references unknown field" für jede
+    // derived entityList-Spalte (z.B. bauspar `phase`). Der executor hängt den
+    // Wert server-seitig an die Row; der Client braucht nur den valueType.
+    const contractEntity = {
+      table: "contracts",
+      fields: { name: { type: "text" } },
+      derivedFields: {
+        phase: { valueType: "text", derive: () => "saving" },
+        balance: { valueType: "decimal", derive: () => 0 },
+      },
+    } as unknown as EntityDefinition;
+
+    const f = defineFeature("credit", (r) => {
+      r.entity("contract", contractEntity);
+      r.screen({
+        id: "list",
+        type: "entityList",
+        entity: "contract",
+        columns: ["name", "phase", "balance"],
+      });
+    });
+
+    const app = buildAppSchema(createRegistry([f]));
+    const entity = app.features.find((feat) => feat.featureName === "credit")?.entities["contract"];
+
+    expect(entity?.derivedFields?.["phase"]?.valueType).toBe("text");
+    expect(entity?.derivedFields?.["balance"]?.valueType).toBe("decimal");
+    // derive-fn ist Server-only — darf NICHT durchkommen (sonst Funktions-Leak
+    // im Browser-Bundle, den die JSON-Safety-Guard fängt).
+    expect(entity?.derivedFields?.["phase"]).not.toHaveProperty("derive");
+    expect(findNonJsonSafePath(app, "schema")).toBeNull();
+  });
 });
 
 describe("findNonJsonSafePath", () => {

package/src/engine/boot-validator/screens-nav.ts

@@ -88,6 +88,13 @@ export function validateScreens(
   allScreenQns: ReadonlySet<string>,
   allConfigKeyQns: ReadonlySet<string>,
 ): void {
+  // navigate-Targets (rowAction/toolbarAction) dürfen cross-feature zeigen —
+  // der Runtime-Router (create-app) löst eine bare screenId app-weit über ALLE
+  // Features auf (eine deklarative Liste im owning-Feature der Entity navigiert
+  // so zu den Custom-Editoren der Consumer-App). Der Validator spiegelt das:
+  // same-feature ODER irgendein Feature. (redirect/cancelTarget bleiben bewusst
+  // same-feature: deren Router baut die URL direkt aus der kurzen id.)
+  const navTargetShortIds = screenShortIdsFrom(allScreenQns);
   for (const [screenId, screen] of Object.entries(feature.screens)) {
     if (screen.type === "custom") {
       if (!screen.renderer.react && !screen.renderer.native) {
@@ -429,10 +436,10 @@ export function validateScreens(
         for (const action of screen.rowActions) {
           if (action.kind === "navigate") {
             const candidateQn = qualifyEntityName(feature.name, "screen", action.screen);
-            if (!allScreenQns.has(candidateQn)) {
+            if (!allScreenQns.has(candidateQn) && !navTargetShortIds.has(action.screen)) {
               throw new Error(
                 `[Feature ${feature.name}] Screen "${screenId}" (entityList) rowAction "${action.id}" ` +
-                  `navigate-target "${action.screen}" does not resolve to a registered screen in this feature.`,
+                  `navigate-target "${action.screen}" does not resolve to a registered screen in any feature.`,
               );
             }
           } else {
@@ -462,10 +469,10 @@ export function validateScreens(
         for (const action of screen.toolbarActions) {
           if (action.kind === "navigate") {
             const candidateQn = qualifyEntityName(feature.name, "screen", action.screen);
-            if (!allScreenQns.has(candidateQn)) {
+            if (!allScreenQns.has(candidateQn) && !navTargetShortIds.has(action.screen)) {
               throw new Error(
                 `[Feature ${feature.name}] Screen "${screenId}" (entityList) toolbarAction "${action.id}" ` +
-                  `navigate-target "${action.screen}" does not resolve to a registered screen in this feature.`,
+                  `navigate-target "${action.screen}" does not resolve to a registered screen in any feature.`,
               );
             }
           } else {
@@ -615,6 +622,19 @@ export function collectScreenQns(features: readonly FeatureDefinition[]): Set<st
   return set;
 }
 
+// Bare Screen-ids (ohne `<feature>:screen:`-Prefix) aus den qualifizierten
+// QNs — für die app-weite Auflösung von navigate-Targets (s. validateScreens).
+// Spiegelt den Runtime-Router, der bare ids feature-übergreifend matcht.
+export function screenShortIdsFrom(allScreenQns: ReadonlySet<string>): Set<string> {
+  const marker = ":screen:";
+  const set = new Set<string>();
+  for (const qn of allScreenQns) {
+    const at = qn.indexOf(marker);
+    if (at !== -1) set.add(qn.slice(at + marker.length));
+  }
+  return set;
+}
+
 // Sammelt alle qualifizierten Write-Handler-QNs (`<feature>:write:<short>`).
 // Wird vom actionForm-Screen-Validator genutzt um zu prüfen ob der
 // im Schema deklarierte handler tatsächlich registriert ist —

package/src/engine/build-app-schema.ts

@@ -32,7 +32,7 @@ import {
   SETTINGS_HUB_FEATURE,
 } from "./build-config-feature-schema";
 import type { Registry } from "./types/feature";
-import type { FieldDefinition } from "./types/fields";
+import type { DerivedFieldDef, FieldDefinition } from "./types/fields";
 
 export type BuildAppSchemaOptions = {
   /** Dev-server authoring hints (Settings-Hub placement). Default off — only
@@ -285,16 +285,33 @@ function projectEntity(entity: EntityDefinition): EntityDefinition {
   for (const [fieldName, fieldDef] of Object.entries(entity.fields)) {
     fieldsOut[fieldName] = projectField(fieldDef);
   }
+  // derivedFields MÜSSEN mit ins Client-Schema (nur die Metadaten, nicht die
+  // derive-fn): computeListViewModel löst eine entityList-Spalte über
+  // `entity.derivedFields[field].valueType` auf — fehlt der Eintrag, wirft es
+  // "references unknown field". Der executor hat den Wert server-seitig schon
+  // an die Row gehängt; der Client braucht nur den valueType für den Renderer.
+  const derivedOut: Record<string, DerivedFieldDef> = {};
+  for (const [name, derivedDef] of Object.entries(entity.derivedFields ?? {})) {
+    derivedOut[name] = projectDerivedField(derivedDef);
+  }
   // EntityDefinition akzeptiert idType/access/searchWeight als optional —
   // wir lassen die weg weil der Browser-Renderer sie nicht liest. `table`
   // schicken wir mit, falls Apps `entity.table` direkt referenzieren.
   // Kein Cast nötig: alle weggelassenen Felder sind `?`-optional.
   return {
     fields: fieldsOut,
+    ...(Object.keys(derivedOut).length > 0 && { derivedFields: derivedOut }),
     ...(typeof entity.table === "string" && { table: entity.table }),
   };
 }
 
+// Nur valueType durch — die derive-fn ist Server-only und NICHT JSON-safe
+// (würde sonst die Output-Walk-Guard triggern). Der Cast bridged die
+// fn-lose Projektion auf DerivedFieldDef (Client liest nur valueType).
+function projectDerivedField(derivedDef: DerivedFieldDef): DerivedFieldDef {
+  return { valueType: derivedDef.valueType } as DerivedFieldDef; // @cast-boundary schema-walk
+}
+
 // Whitelist pro Field. `default` darf nur durch wenn Literal (string/
 // number/boolean/null) — auch wenn die FieldDefinition-Types „default"
 // nur als Literal typisieren, hat das Sample-Pattern

package/src/pipeline/__tests__/dispatcher.test.ts

@@ -74,6 +74,32 @@ describe("dispatcher.write", () => {
     }
   });
 
+  test("ip-bucketed handler with no IP + no resolver skips rate-limit (es-ops seed/job path)", async () => {
+    // Regression: the es-ops seed/job dispatcher has no RateLimitResolver. An
+    // ip-bucketed handler invoked from there has no client IP to bucket on, so
+    // it must SKIP the rate-limit — not throw "no RateLimitResolver is
+    // configured". (The HTTP path still has the resolver for real anon writes.)
+    const rlFeature = defineFeature("rl", (r) => {
+      r.entity("item", createEntity({ table: "Items", fields: { name: createTextField() } }));
+      r.writeHandler(
+        "item:create",
+        z.object({ name: z.string() }),
+        async (event) => ({ isSuccess: true, data: { name: event.payload.name } }),
+        {
+          access: { openToAll: true },
+          rateLimit: { per: "ip+handler", limit: 3, windowSeconds: 60 },
+        },
+      );
+    });
+    const dispatcher = createDispatcher(createRegistry([rlFeature]), {});
+    const result = await dispatcher.write(
+      "rl:write:item:create",
+      { name: "seeded" },
+      createTestUser(),
+    );
+    expect(result.isSuccess).toBe(true);
+  });
+
   test("ctx.user ist Convenience-Alias auf event.user (gleicher Wert)", async () => {
     // Pinst dass der Handler auf ctx.user zugreifen kann ohne den
     // typo-resistenten event.user-Pfad zu nutzen. Identitätsprüfung

package/src/pipeline/dispatcher.ts

@@ -701,21 +701,24 @@ export function createDispatcher(
     //       handler.rateLimit !== undefined, so this branch only fires
     //       if a future caller forgets the inline check.
     if (!rateLimit) return;
-    if (!context.rateLimit) {
-      throw new InternalError({
-        message: `Handler "${handlerName}" declares rateLimit but no RateLimitResolver is configured. Load the rate-limiting feature or remove the option.`,
-      });
-    }
     const reqCtx = requestContext.get();
     const bucket = buildBucketKey(rateLimit, {
       handlerName,
       user,
       ip: reqCtx?.ip,
     });
-    // skip: ip-bucketed handler called from a non-HTTP entry point
-    //       (job, MSP-apply) — no client IP to bucket on. Pass through;
-    //       L1/L2 middleware handle the HTTP-side ip caps.
+    // skip: ip-bucketed handler called from a non-HTTP entry point (job, seed,
+    //       MSP-apply) — no client IP to bucket on, nothing to enforce. Pass
+    //       through BEFORE requiring a resolver, so system/seed writes through
+    //       such a handler don't need a RateLimitResolver wired (the es-ops
+    //       seed dispatcher has none). L1/L2 middleware handle the HTTP-side
+    //       ip caps.
     if (bucket.kind === "skip") return;
+    if (!context.rateLimit) {
+      throw new InternalError({
+        message: `Handler "${handlerName}" declares rateLimit but no RateLimitResolver is configured. Load the rate-limiting feature or remove the option.`,
+      });
+    }
     await context.rateLimit.enforce(bucket.key, {
       limit: rateLimit.limit,
       windowSeconds: rateLimit.windowSeconds,