@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/engine/__tests__/field-access.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { checkWriteFieldRoles, filterReadFields } from "../field-access";
+import { checkWriteFieldRoles, filterReadFields, PII_MASKED_VALUE } from "../field-access";
 import type { EntityDefinition } from "../types";
 
 const entity: EntityDefinition = {
@@ -25,6 +25,28 @@ describe("filterReadFields", () => {
     const filtered = filterReadFields(entity, row, admin);
     expect(filtered["secret"]).toBe("visible");
   });
+
+  test("masks piiEncrypted fields instead of stripping them (kumiko-platform#463)", () => {
+    const entityWithPii: EntityDefinition = {
+      fields: {
+        ...entity.fields,
+        iban: {
+          type: "text",
+          piiEncrypted: true,
+          tenantOwned: true,
+          access: { read: { admin: "all" } },
+        },
+      },
+    };
+    const row = { id: 1, title: "Hello", secret: "hidden", iban: "DE89370400440532013000" };
+
+    const filteredForEditor = filterReadFields(entityWithPii, row, editor);
+    expect(filteredForEditor["secret"]).toBeUndefined();
+    expect(filteredForEditor["iban"]).toBe(PII_MASKED_VALUE);
+
+    const filteredForAdmin = filterReadFields(entityWithPii, row, admin);
+    expect(filteredForAdmin["iban"]).toBe("DE89370400440532013000");
+  });
 });
 
 describe("checkWriteFieldRoles", () => {

package/src/engine/__tests__/hook-phases.test.ts

@@ -59,11 +59,11 @@ describe("HookPhases defaults", () => {
     expect(entry?.[0]?.phase).toBe(HookPhases.inTransaction);
   });
 
-  test("entityHook postSave defaults to afterCommit, preDelete is forced inTransaction", () => {
+  test("hook({allOf}) postSave defaults to afterCommit, preDelete is forced inTransaction", () => {
     const feature = defineFeature("test", (r) => {
       const thing = r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.entityHook("postSave", thing, noopSave);
-      r.entityHook("preDelete", thing, async () => undefined);
+      r.hook("postSave", { allOf: thing }, noopSave);
+      r.hook("preDelete", { allOf: thing }, async () => undefined);
     });
 
     expect(feature.entityHooks?.postSave?.["thing"]?.[0]?.phase).toBe(HookPhases.afterCommit);
@@ -120,8 +120,8 @@ describe("Registry phase filtering", () => {
 
     const feature = defineFeature("test", (r) => {
       const thing = r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.entityHook("postSave", thing, inTxFn, { phase: HookPhases.inTransaction });
-      r.entityHook("postSave", thing, afterFn);
+      r.hook("postSave", { allOf: thing }, inTxFn, { phase: HookPhases.inTransaction });
+      r.hook("postSave", { allOf: thing }, afterFn);
     });
 
     const registry = createRegistry([feature]);

package/src/engine/__tests__/membership-roles.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import {
+  buildSessionRoles,
   FORBIDDEN_MEMBERSHIP_ROLES,
   findForbiddenMembershipRole,
   isForbiddenMembershipRole,
@@ -41,23 +42,16 @@ describe("forbidden membership roles", () => {
 // ONLY the membership portion, never the merged result — so a legitimate
 // SystemAdmin in globalRoles survives, a resurrected one in membership does not.
 describe("merge semantics (globalRoles never filtered)", () => {
-  function merge(
-    globalRoles: readonly string[],
-    membershipRoles: readonly string[],
-  ): readonly string[] {
-    return Array.from(new Set([...globalRoles, ...stripForbiddenMembershipRoles(membershipRoles)]));
-  }
-
   test("global SystemAdmin survives (no regression for real admins)", () => {
-    expect(merge(["SystemAdmin"], [])).toContain("SystemAdmin");
+    expect(buildSessionRoles(["SystemAdmin"], [])).toContain("SystemAdmin");
   });
 
   test("membership SystemAdmin is stripped (resurrected role neutralised)", () => {
-    expect(merge([], ["SystemAdmin"])).not.toContain("SystemAdmin");
+    expect(buildSessionRoles([], ["SystemAdmin"])).not.toContain("SystemAdmin");
   });
 
   test("global admin + tenant membership keeps both, deduped", () => {
-    expect([...merge(["SystemAdmin"], ["Admin", "SystemAdmin"])].sort()).toEqual(
+    expect([...buildSessionRoles(["SystemAdmin"], ["Admin", "SystemAdmin"])].sort()).toEqual(
       ["Admin", "SystemAdmin"].sort(),
     );
   });

package/src/engine/__tests__/nav.test.ts

@@ -1,9 +1,14 @@
 import { describe, expect, test } from "bun:test";
-import { validateBoot } from "../boot-validator";
+import { withBootValidatorFixture } from "../../testing/boot-validator-fixture";
+import { validateBoot as validateBootRaw } from "../boot-validator";
 import { defineFeature } from "../define-feature";
 import { createEntity, createTextField } from "../factories";
 import { createRegistry } from "../registry";
 
+function validateBoot(features: Parameters<typeof validateBootRaw>[0]): void {
+  validateBootRaw(withBootValidatorFixture(features));
+}
+
 function productEntity() {
   return createEntity({
     table: "products",
@@ -75,6 +80,86 @@ describe("r.nav() — registration", () => {
   });
 });
 
+describe("r.screen({ nav }) — inline nav sugar", () => {
+  test("synthesizes a nav entry from the screen's id", () => {
+    const feature = defineFeature("shop", (r) => {
+      r.entity("product", productEntity());
+      r.screen({
+        id: "products",
+        type: "entityList",
+        entity: "product",
+        columns: ["name"],
+        nav: { label: "shop:nav.products", icon: "box", order: 5 },
+      });
+    });
+    expect(feature.navs["products"]).toMatchObject({
+      id: "products",
+      label: "shop:nav.products",
+      icon: "box",
+      order: 5,
+      screen: "shop:screen:products",
+    });
+  });
+
+  test("supports parent like a standalone r.nav()", () => {
+    const feature = defineFeature("shop", (r) => {
+      r.nav({ id: "catalog", label: "x" });
+      r.entity("product", productEntity());
+      r.screen({
+        id: "products",
+        type: "entityList",
+        entity: "product",
+        columns: ["name"],
+        nav: { label: "y", parent: "shop:nav:catalog" },
+      });
+    });
+    expect(feature.navs["products"]?.parent).toBe("shop:nav:catalog");
+  });
+
+  test("passes the same boot-validation as a standalone r.nav()", () => {
+    const feature = defineFeature("shop", (r) => {
+      r.entity("product", productEntity());
+      r.screen({
+        id: "products",
+        type: "entityList",
+        entity: "product",
+        columns: ["name"],
+        nav: { label: "y" },
+      });
+    });
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
+  test("screen without nav registers no nav entry", () => {
+    const feature = defineFeature("shop", (r) => {
+      r.entity("product", productEntity());
+      r.screen({
+        id: "products",
+        type: "entityList",
+        entity: "product",
+        columns: ["name"],
+      });
+    });
+    expect(feature.navs["products"]).toBeUndefined();
+  });
+
+  test("rejects when a standalone r.nav() already used the screen's id", () => {
+    expect(() =>
+      defineFeature("shop", (r) => {
+        r.nav({ id: "products", label: "standalone" });
+        r.entity("product", productEntity());
+        r.screen({
+          id: "products",
+          type: "entityList",
+          entity: "product",
+          columns: ["name"],
+          nav: { label: "inline" },
+        });
+      }),
+    ).toThrow(/already registered/);
+  });
+});
+
 describe("createRegistry — nav indexing", () => {
   test("indexes nav entries by qualified name", () => {
     const feature = defineFeature("shop", (r) => {

package/src/engine/__tests__/pipeline-engine.test.ts

@@ -1,4 +1,4 @@
-// Pipeline-engine unit tests — defineWriteHandler({ perform: pipeline(...) })
+// Pipeline-engine unit tests — defineWriteHandler({ perform: stepsPipeline(...) })
 // boundary, run-pipeline runner contract, defineStep registry guards.
 // Sub-step-builders (branch, forEach) live in pipeline-sub-pipelines.test.ts;
 // boot-validator in validate-projection-allowlist.test.ts.
@@ -9,7 +9,7 @@ import { z } from "zod";
 import { TestUsers } from "../../stack";
 import { defineWriteHandler } from "../define-handler";
 import { defineStep } from "../define-step";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 import type { WriteEvent } from "../types/handlers";
 import { buildMinimalCtx } from "./_pipeline-test-utils";
 
@@ -19,7 +19,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:noop",
       schema: z.object({ greeting: z.string() }),
       access: { roles: ["User"] },
-      perform: pipeline<{ greeting: string }, { echoed: string }>(({ event, r }) => [
+      perform: stepsPipeline<{ greeting: string }, { echoed: string }>(({ event, r }) => [
         r.step.return(() => ({
           isSuccess: true as const,
           data: { echoed: event.payload.greeting },
@@ -49,7 +49,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:static",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: boolean }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: boolean }>(({ r }) => [
         r.step.return({ isSuccess: true as const, data: { ok: true } }),
       ]),
     });
@@ -89,7 +89,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:no-return",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, never>(() => []),
+      perform: stepsPipeline<Record<string, never>, never>(() => []),
     });
 
     await expect(
@@ -105,7 +105,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:thread",
       schema: z.object({ base: z.number() }),
       access: { roles: ["User"] },
-      perform: pipeline<{ base: number }, { sum: number }>(({ event, r }) => [
+      perform: stepsPipeline<{ base: number }, { sum: number }>(({ event, r }) => [
         r.step.compute("offset", () => 10),
         r.step.compute("doubledBase", () => event.payload.base * 2),
         r.step.return(({ steps }) => ({
@@ -133,7 +133,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:fresh",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { tick: number }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { tick: number }>(({ r }) => [
         r.step.compute("tick", () => ++counter),
         r.step.return(({ steps }) => ({
           isSuccess: true as const,
@@ -161,7 +161,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       name: "demo:unknown-kind",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, never>(() => [
+      perform: stepsPipeline<Record<string, never>, never>(() => [
         // Hand-crafted instance with a kind that's never been registered —
         // simulates a typo in a future step-builder factory.
         { kind: "this-step-does-not-exist", args: {} },
@@ -190,7 +190,7 @@ describe("pipeline engine (return / compute / registry guards)", () => {
       schema: z.object({}),
       access: { roles: ["User"] },
       handler: async () => ({ isSuccess: true as const, data: {} }),
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.return({ isSuccess: true as const, data: { ok: true } }),
       ]),
     } as unknown as Parameters<typeof defineWriteHandler>[0];

package/src/engine/__tests__/pipeline-handler.integration.test.ts

@@ -60,7 +60,7 @@ import {
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";
 import { createEntity, createTextField } from "../factories";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 
 const echoSchema = z.object({ greeting: z.string() });
 
@@ -70,7 +70,7 @@ const echoHandler = defineWriteHandler({
   name: "echo",
   schema: echoSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof echoSchema>, { echoed: string; from: string }>(
+  perform: stepsPipeline<z.infer<typeof echoSchema>, { echoed: string; from: string }>(
     ({ event, r }) => [
       r.step.return(() => ({
         isSuccess: true as const,
@@ -90,7 +90,7 @@ const explodeHandler = defineWriteHandler({
   name: "explode",
   schema: explodeSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof explodeSchema>, never>(({ r }) => [
+  perform: stepsPipeline<z.infer<typeof explodeSchema>, never>(({ r }) => [
     r.step.return(() => {
       throw new Error("boom");
     }),
@@ -106,7 +106,7 @@ const compoundHandler = defineWriteHandler({
   name: "compound",
   schema: compoundSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof compoundSchema>, { sum: number; userId: string }>(
+  perform: stepsPipeline<z.infer<typeof compoundSchema>, { sum: number; userId: string }>(
     ({ event, r }) => [
       r.step.compute("offset", () => 100),
       r.step.compute("doubledBase", () => event.payload.base * 2),
@@ -147,7 +147,7 @@ const logHandler = defineWriteHandler({
   schema: logSchema,
   access: { roles: ["Admin"] },
   // Outer-`event`-capture pattern — see compoundHandler above for the why.
-  perform: pipeline<z.infer<typeof logSchema>, { correlationId: string }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof logSchema>, { correlationId: string }>(({ event, r }) => [
     r.step.unsafeProjectionUpsert({
       table: pipelineDemoLogTable,
       on: ["correlationId"],
@@ -182,7 +182,7 @@ const widgetCreateHandler = defineWriteHandler({
   name: "widget:create",
   schema: widgetSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof widgetSchema>, { id: string }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof widgetSchema>, { id: string }>(({ event, r }) => [
     r.step.aggregate.create("widget", {
       executor: widgetExecutor,
       data: () => ({ label: event.payload.label }),
@@ -202,7 +202,7 @@ const annotateHandler = defineWriteHandler({
   name: "widget:annotate",
   schema: annotateSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof annotateSchema>, { id: string }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof annotateSchema>, { id: string }>(({ event, r }) => [
     r.step.aggregate.create("widget", {
       executor: widgetExecutor,
       data: () => ({ label: event.payload.label }),
@@ -230,7 +230,7 @@ const widgetUpdateHandler = defineWriteHandler({
   name: "widget:update",
   schema: widgetUpdateSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof widgetUpdateSchema>, { id: string }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof widgetUpdateSchema>, { id: string }>(({ event, r }) => [
     r.step.aggregate.update("widget", {
       executor: widgetExecutor,
       id: () => event.payload.id,
@@ -254,7 +254,7 @@ const widgetBrokenHandler = defineWriteHandler({
   name: "widget:create-broken",
   schema: z.object({}),
   access: { roles: ["Admin"] },
-  perform: pipeline<Record<string, never>, { id: string }>(({ r }) => [
+  perform: stepsPipeline<Record<string, never>, { id: string }>(({ r }) => [
     r.step.aggregate.create("widget", {
       executor: widgetExecutor,
       // Intentionally omits the `label` field that the entity declares
@@ -278,7 +278,7 @@ const widgetCreateThenThrowHandler = defineWriteHandler({
   name: "widget:create-then-throw",
   schema: z.object({ label: z.string() }),
   access: { roles: ["Admin"] },
-  perform: pipeline<{ label: string }, never>(({ event, r }) => [
+  perform: stepsPipeline<{ label: string }, never>(({ event, r }) => [
     r.step.aggregate.create("widget", {
       executor: widgetExecutor,
       data: () => ({ label: event.payload.label }),
@@ -303,7 +303,7 @@ const forEachThenThrowHandler = defineWriteHandler({
   name: "widget:foreach-then-throw",
   schema: forEachThenThrowSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<{ labels: string[] }, never>(({ event, r }) => [
+  perform: stepsPipeline<{ labels: string[] }, never>(({ event, r }) => [
     r.step.forEach({
       over: () => event.payload.labels,
       as: "label",
@@ -337,7 +337,7 @@ const lookupHandler = defineWriteHandler({
   name: "widget:lookup",
   schema: lookupSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof lookupSchema>, { found: boolean; label: string | null }>(
+  perform: stepsPipeline<z.infer<typeof lookupSchema>, { found: boolean; label: string | null }>(
     ({ event, r }) => [
       r.step.read.findOne("widget", {
         table: widgetTable,
@@ -358,7 +358,7 @@ const listAllHandler = defineWriteHandler({
   name: "widget:list",
   schema: z.object({}),
   access: { roles: ["Admin"] },
-  perform: pipeline<Record<string, never>, { count: number }>(({ r }) => [
+  perform: stepsPipeline<Record<string, never>, { count: number }>(({ r }) => [
     r.step.read.findMany("widgets", { table: widgetTable }),
     r.step.return(({ steps }) => ({
       isSuccess: true as const,
@@ -374,7 +374,7 @@ const listLimitedHandler = defineWriteHandler({
   name: "widget:list-one",
   schema: z.object({}),
   access: { roles: ["Admin"] },
-  perform: pipeline<Record<string, never>, { count: number }>(({ r }) => [
+  perform: stepsPipeline<Record<string, never>, { count: number }>(({ r }) => [
     r.step.read.findMany("widgets", { table: widgetTable, limit: 1 }),
     r.step.return(({ steps }) => ({
       isSuccess: true as const,
@@ -388,7 +388,7 @@ const purgeLogHandler = defineWriteHandler({
   name: "log:purge",
   schema: purgeLogSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof purgeLogSchema>, { ok: true }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof purgeLogSchema>, { ok: true }>(({ event, r }) => [
     r.step.unsafeProjectionDelete({
       table: pipelineDemoLogTable,
       where: () => ({ correlationId: event.payload.correlationId }),
@@ -403,7 +403,7 @@ const conditionalLogHandler = defineWriteHandler({
   name: "log:conditional",
   schema: conditionalLogSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof conditionalLogSchema>, { ok: true }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof conditionalLogSchema>, { ok: true }>(({ event, r }) => [
     r.step.branch({
       if: () => event.payload.message.length > 0,
       onTrue: [
@@ -428,7 +428,7 @@ const bulkLogHandler = defineWriteHandler({
   name: "log:bulk",
   schema: bulkLogSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<z.infer<typeof bulkLogSchema>, { count: number }>(({ event, r }) => [
+  perform: stepsPipeline<z.infer<typeof bulkLogSchema>, { count: number }>(({ event, r }) => [
     r.step.forEach({
       over: () => event.payload.correlationIds,
       as: "correlationId",
@@ -476,7 +476,7 @@ const demoPipelineFeature = defineFeature("demoPipeline", (r) => {
 let stack: TestStack;
 const admin = TestUsers.admin;
 
-describe("defineWriteHandler({ perform: pipeline(...) }) — real dispatcher path", () => {
+describe("defineWriteHandler({ perform: stepsPipeline(...) }) — real dispatcher path", () => {
   beforeAll(async () => {
     stack = await setupTestStack({ features: [demoPipelineFeature] });
     // Push the read-side-projection table — not registered as an entity,

package/src/engine/__tests__/pipeline-observability.integration.test.ts

@@ -20,7 +20,7 @@ import { createRecordingProvider, type RecordingProvider } from "../../testing";
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";
 import { createEntity, createTextField } from "../factories";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 
 // Handler whose step bodies emit a span + a metric. The recording
 // provider afterwards lets us assert both landed.
@@ -30,7 +30,7 @@ const observedHandler = defineWriteHandler({
   name: "observed",
   schema: observedSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+  perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
     r.step.compute("traced", (ctx) => {
       // Span emitted from inside a step. End it explicitly because
       // step.run is sync-or-async-but-not-otel-instrumented; the

package/src/engine/__tests__/pipeline-performance.integration.test.ts

@@ -1,6 +1,6 @@
 // Pipeline-engine performance smoke-test.
 //
-// Compares the M.1 pipeline-form handler ({ perform: pipeline(...) })
+// Compares the M.1 pipeline-form handler ({ perform: stepsPipeline(...) })
 // against the equivalent free-form handler ({ handler: async (...) })
 // over N identical writes against the real Postgres stack. The point
 // is NOT to optimise — the pipeline-form is a thin wrapper, not a
@@ -28,7 +28,7 @@ import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } fr
 import { defineFeature } from "../define-feature";
 import { defineWriteHandler } from "../define-handler";
 import { createEntity, createNumberField, createTextField } from "../factories";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 
 // Same logical operation in both handler-forms: read input, return a
 // trivial transformed payload. No DB-write — the goal is to compare
@@ -41,7 +41,7 @@ const trivialPipeline = defineWriteHandler({
   name: "trivial:pipeline",
   schema: trivialSchema,
   access: { roles: ["Admin"] },
-  perform: pipeline<{ n: number }, { doubled: number }>(({ event, r }) => [
+  perform: stepsPipeline<{ n: number }, { doubled: number }>(({ event, r }) => [
     r.step.return(() => ({
       isSuccess: true as const,
       data: { doubled: event.payload.n * 2 },

package/src/engine/__tests__/pipeline-sub-pipelines.test.ts

@@ -9,7 +9,7 @@ import { describe, expect, it } from "bun:test";
 import { z } from "zod";
 import { TestUsers } from "../../stack";
 import { defineWriteHandler } from "../define-handler";
-import { pipeline } from "../pipeline";
+import { stepsPipeline } from "../pipeline";
 import { buildBranchStep } from "../steps/branch";
 import { buildForEachStep } from "../steps/for-each";
 import { buildReturnStep } from "../steps/return";
@@ -21,7 +21,7 @@ describe("r.step.branch", () => {
       name: "demo:branch-then",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { value: number }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { value: number }>(({ r }) => [
         r.step.branch({
           if: () => true,
           onTrue: [r.step.compute("inThen", () => 42)],
@@ -47,7 +47,7 @@ describe("r.step.branch", () => {
       name: "demo:branch-else",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { value: number }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { value: number }>(({ r }) => [
         r.step.branch({
           if: () => false,
           onTrue: [r.step.compute("inThen", () => 42)],
@@ -72,7 +72,7 @@ describe("r.step.branch", () => {
       name: "demo:branch-noop",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ran: boolean }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ran: boolean }>(({ r }) => [
         r.step.branch({
           if: () => false,
           onTrue: [r.step.compute("ran", () => true)],
@@ -122,7 +122,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.forEach({
           over: () => [10, 20, 30],
           as: "n",
@@ -153,7 +153,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach-cleanup",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.forEach({
           over: () => [1],
           as: "tmp",
@@ -180,7 +180,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach-empty",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.forEach({
           over: () => [],
           as: "n",
@@ -233,7 +233,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach-throws",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, never>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, never>(({ r }) => [
         r.step.forEach({
           over: () => [1, 2, 3],
           as: "item",
@@ -266,7 +266,7 @@ describe("r.step.forEach", () => {
       name: "demo:foreach-bad-over",
       schema: z.object({}),
       access: { roles: ["User"] },
-      perform: pipeline<Record<string, never>, { ok: true }>(({ r }) => [
+      perform: stepsPipeline<Record<string, never>, { ok: true }>(({ r }) => [
         r.step.forEach({
           // Cast: TypeScript would normally catch this; the test exercises
           // the runtime guard for hand-crafted / dynamically built cases.

package/src/engine/__tests__/post-query-hook.test.ts

@@ -10,7 +10,7 @@ const stubContext = {} as unknown as AppContext;
 // postQuery-Hook (F1) — feuert nach Query-Handler-Execute, vor Field-Access-
 // Read-Filter. Zwei Registrierungs-Pfade:
 //   - r.hook("postQuery", "ns:query:list", fn) — handler-keyed
-//   - r.entityHook("postQuery", "thing", fn)   — entity-keyed (alle Queries)
+//   - r.hook("postQuery", { allOf: "thing" }, fn)   — entity-keyed (alle Queries)
 //
 // Diese Tests pinnen die Invarianten:
 //   1. Beide Registrierungs-Pfade landen in unabhängigen Maps
@@ -35,10 +35,10 @@ describe("postQuery hook registration", () => {
     expect(entry?.[0]?.featureName).toBe("test");
   });
 
-  test("r.entityHook('postQuery', entity, fn) lands in entity-keyed entityHooks map", () => {
+  test("r.hook('postQuery', { allOf: entity }, fn) lands in entity-keyed entityHooks map", () => {
     const feature = defineFeature("test", (r) => {
       const thing = r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.entityHook("postQuery", thing, noop);
+      r.hook("postQuery", { allOf: thing }, noop);
     });
 
     const entry = feature.entityHooks?.postQuery?.["thing"];
@@ -52,8 +52,8 @@ describe("postQuery hook registration", () => {
 
     const feature = defineFeature("test", (r) => {
       const thing = r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.entityHook("postQuery", thing, hookA);
-      r.entityHook("postQuery", thing, hookB);
+      r.hook("postQuery", { allOf: thing }, hookA);
+      r.hook("postQuery", { allOf: thing }, hookB);
     });
 
     expect(feature.entityHooks?.postQuery?.["thing"]).toHaveLength(2);
@@ -81,7 +81,7 @@ describe("Registry getters", () => {
 
     const feature = defineFeature("test", (r) => {
       const thing = r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.entityHook("postQuery", thing, fn);
+      r.hook("postQuery", { allOf: thing }, fn);
     });
 
     const registry = createRegistry([feature]);
@@ -109,7 +109,7 @@ describe("Hook function semantics", () => {
 
     const feature = defineFeature("test", (r) => {
       const thing = r.entity("thing", createEntity({ table: "things", fields: {} }));
-      r.entityHook("postQuery", thing, enrich);
+      r.hook("postQuery", { allOf: thing }, enrich);
     });
 
     const registry = createRegistry([feature]);