@cosmicdrift/kumiko-framework 1.0.0 → 2.0.0

package/src/engine/define-handler.ts

@@ -1,81 +1,19 @@
 import type { ZodType, z } from "zod";
 import type { ContainsSecret } from "../secrets/types";
 import { runPipeline } from "./run-pipeline";
+import type { HandlerContext, KumikoEventTypeMap, WriteEvent, WriteResult } from "./types";
 import type {
-  AccessRule,
-  HandlerContext,
-  KumikoEventTypeMap,
-  QueryEvent,
-  RateLimitOption,
-  WriteEvent,
-  WriteResult,
-} from "./types";
-import type { PipelineDef } from "./types/step";
+  QueryHandlerDefinition,
+  WriteHandlerDefinition,
+  WriteHandlerInput,
+} from "./types/define-handler";
 
-// --- Write Handler Definition ---
-//
-// TMap propagates the strict event-type-map through the handler's
-// HandlerContext. CRITICAL: TMap is declared as a generic parameter on the
-// FUNCTION (defineWriteHandler), not just on the type. Generic-functions
-// substitute TMap at the USE-site (the caller's compile context, where
-// the augmentation is visible); generic-type-aliases substitute at the
-// definition-site (framework's compile, where the augmentation isn't
-// visible) and collapse `keyof TMap` to `never`. See the spike-findings
-// memory for the empirical proof.
-//
-// Two authoring forms — `handler` (free-form) or `perform: pipeline(...)`
-// (step-pipeline). A `perform` is compiled to a handler-function at
-// definition time; the dispatcher only ever sees `handler`.
-
-export type WriteHandlerDefinition<
-  TName extends string = string,
-  TSchema extends ZodType = ZodType,
-  TData = unknown,
-  TMap extends object = KumikoEventTypeMap,
-> = {
-  readonly name: TName;
-  readonly schema: TSchema;
-  readonly access?: AccessRule;
-  readonly unsafeSkipTransitionGuard?: boolean;
-  readonly rateLimit?: RateLimitOption;
-  readonly handler: (
-    event: WriteEvent<z.infer<TSchema>>,
-    context: HandlerContext<TMap>,
-  ) => Promise<WriteResult<TData>>;
-  // Preserved when the author wrote a `perform` block — the original
-  // PipelineDef. Designer/AI/AST tools read this when present; the
-  // dispatcher ignores it and just calls `handler`. Absent on free-form
-  // handlers.
-  readonly perform?: PipelineDef<z.infer<TSchema>, TData>;
-};
-
-// Author-facing input — accepts either the free-form `handler` or the
-// pipeline-form `perform`. defineWriteHandler narrows them to the
-// canonical WriteHandlerDefinition shape.
-export type WriteHandlerInput<
-  TName extends string = string,
-  TSchema extends ZodType = ZodType,
-  TData = unknown,
-  TMap extends object = KumikoEventTypeMap,
-> = {
-  readonly name: TName;
-  readonly schema: TSchema;
-  readonly access?: AccessRule;
-  readonly unsafeSkipTransitionGuard?: boolean;
-  readonly rateLimit?: RateLimitOption;
-} & (
-  | {
-      readonly handler: (
-        event: WriteEvent<z.infer<TSchema>>,
-        context: HandlerContext<TMap>,
-      ) => Promise<WriteResult<TData>>;
-      readonly perform?: never;
-    }
-  | {
-      readonly perform: PipelineDef<z.infer<TSchema>, TData>;
-      readonly handler?: never;
-    }
-);
+export type {
+  QueryHandlerDefinition,
+  StreamHandlerDefinition,
+  WriteHandlerDefinition,
+  WriteHandlerInput,
+} from "./types/define-handler";
 
 export function defineWriteHandler<
   const TName extends string,
@@ -90,7 +28,20 @@ export function defineWriteHandler<
   // responses get `[]`, so existing call-sites are unaffected. Checking it in a
   // parameter post-inference (not as a `TData extends …` constraint, which TS
   // rejects as circular, TS2313) is what makes inference survive.
-  ..._noSecretInResponse: ContainsSecret<TData> extends true
+  //
+  // Membership form `true extends ContainsSecret<TData>` (556/1), not
+  // `ContainsSecret<TData> extends true`: when TData is a union like
+  // `{ok:true} | {s:Secret<string>}`, the naked-type-parameter conditional in
+  // ContainsSecret DISTRIBUTES over the union, so the result is
+  // `false | true` = `boolean`, not the literal `true` — `ContainsSecret<
+  // TData> extends true` is then false (boolean isn't assignable to the
+  // literal true) and the old check silently fell through to `[]` even with
+  // a real leak in one branch. Putting the naked `true` on the LEFT instead
+  // keeps the check fail-closed for the union case (`true extends boolean`
+  // is true) without eagerly normalizing ContainsSecret<TData> against a
+  // literal — which is what blew up TS's instantiation depth on generic
+  // call-sites (createTokenRequestHandler's still-unresolved TSuccessKind).
+  ..._noSecretInResponse: true extends ContainsSecret<TData>
     ? [
         secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field.",
       ]
@@ -113,7 +64,7 @@ export function defineWriteHandler<
     throw new Error(
       `defineWriteHandler("${def.name}"): both \`handler\` and \`perform\` are set. ` +
         `Pick one — \`handler\` for the free-form async function, ` +
-        `\`perform: pipeline(...)\` for the step-pipeline form. ` +
+        `\`perform: stepsPipeline(...)\` for the step-pipeline form. ` +
         `(See step-vocabulary.md for which form fits.)`,
     );
   }
@@ -147,24 +98,6 @@ export function defineWriteHandler<
   return { ...base, handler: def.handler };
 }
 
-// --- Query Handler Definition ---
-
-export type QueryHandlerDefinition<
-  TName extends string = string,
-  TSchema extends ZodType = ZodType,
-  TResult = unknown,
-  TMap extends object = KumikoEventTypeMap,
-> = {
-  readonly name: TName;
-  readonly schema: TSchema;
-  readonly access?: AccessRule;
-  readonly rateLimit?: RateLimitOption;
-  readonly handler: (
-    query: QueryEvent<z.infer<TSchema>>,
-    context: HandlerContext<TMap>,
-  ) => Promise<TResult>;
-};
-
 export function defineQueryHandler<
   const TName extends string,
   TSchema extends ZodType,
@@ -174,7 +107,8 @@ export function defineQueryHandler<
   def: QueryHandlerDefinition<TName, TSchema, TResult, TMap>,
   // R6: phantom rest-param — see defineWriteHandler. Forbids a Secret<> in the
   // inferred query response `TResult` at compile time; `[]` for clean responses.
-  ..._noSecretInResponse: ContainsSecret<TResult> extends true
+  // Membership form (556/1) — see defineWriteHandler's comment for why.
+  ..._noSecretInResponse: true extends ContainsSecret<TResult>
     ? [
         secretLeak: "A handler response must not contain a Secret<> — call .reveal() and return the plaintext, or drop the field.",
       ]

package/src/engine/define-workflow.ts

@@ -57,7 +57,7 @@ export type WorkflowInput<TPayload = unknown, TData = unknown> = {
  * defineWorkflow({
  *   name: "user-onboarding",
  *   trigger: { kind: "event", eventType: "user.signed-up" },
- *   steps: pipeline(({ event, r }) => [
+ *   steps: stepsPipeline(({ event, r }) => [
  *     r.step.mail.send({ to: () => event.payload.email, subject: "Welcome!", body: "..." }),
  *     r.step.wait({ for: "P1D" }),
  *     r.step.read.findOne("user", { table: userTable, where: ... }),

package/src/engine/effective-features.ts

@@ -1,4 +1,4 @@
-import type { Registry } from "./types";
+import type { FeatureDefinition, Registry } from "./types";
 
 // Callback that returns the current global-toggle override for a feature.
 // `true`  = explicit global row says enabled.
@@ -11,6 +11,16 @@ import type { Registry } from "./types";
 // a Map lookup to keep compute() allocation-light.
 export type ToggleReader = (featureName: string) => boolean | undefined;
 
+// A feature is toggleable iff it declared r.toggleable() at define-time
+// (toggleableDefault set). Non-toggleable features are always-on and ignore
+// overrides entirely — used here, by compose-tier-resolver, and by
+// tier-engine's always-on set to agree on the same rule.
+export function isToggleableFeature(
+  feature: FeatureDefinition,
+): feature is FeatureDefinition & { toggleableDefault: boolean } {
+  return feature.toggleableDefault !== undefined;
+}
+
 // Compute the set of effectively-enabled features for the current call.
 //
 // Rules (AND-combined, any false wins):
@@ -35,7 +45,7 @@ export function computeEffectiveFeatures(
   // Raw enablement, before cascade.
   const raw = new Map<string, boolean>();
   for (const feature of registry.features.values()) {
-    if (feature.toggleableDefault === undefined) {
+    if (!isToggleableFeature(feature)) {
       raw.set(feature.name, true);
       continue;
     }

package/src/engine/entity-handlers.ts

@@ -18,6 +18,21 @@ import type {
   QueryHandlerDef,
   WriteHandlerDef,
 } from "./types";
+import type {
+  EntityCrudRegistrar,
+  EntityCrudVerb,
+  EntityHandlerOptions,
+  EntityQueryHandlerOptions,
+  RegisterEntityCrudOptions,
+} from "./types/entity-handlers";
+
+export type {
+  EntityCrudRegistrar,
+  EntityCrudVerb,
+  EntityHandlerOptions,
+  EntityQueryHandlerOptions,
+  RegisterEntityCrudOptions,
+} from "./types/entity-handlers";
 
 // Convention-based handler factories for event-sourced aggregates.
 //
@@ -27,6 +42,9 @@ import type {
 //
 // Two API shapes — pick one per project, don't mix:
 //
+//   PREFERRED — full standard CRUD set in one call:
+//     r.crud("note", noteEntity, { write: { access }, read: { access } })
+//
 //   PREFERRED — one function per verb, type-safe, no magic strings:
 //     r.writeHandler(defineEntityCreateHandler("note", noteEntity, { access }))
 //     r.writeHandler(defineEntityUpdateHandler("note", noteEntity, { access }))
@@ -173,7 +191,15 @@ export function defineEntityWriteHandler(
         changes: buildUpdateSchema(entity),
       });
       handler = async (event, ctx) =>
-        executor.update(event.payload as UpdatePayload, event.user, ctx.db); // @cast-boundary engine-payload
+        // skipUnchanged (#464): API-driven updates diff against the stored
+        // row so a resubmitted-but-identical field doesn't force a fresh
+        // pii/encrypted ciphertext. Direct executor.update() callers (e.g.
+        // KEK-rotation, the user-data-rights #494 backfill) don't go through
+        // this handler and keep today's always-re-encrypt behavior, which
+        // they rely on to intentionally force a fresh event/ciphertext.
+        executor.update(event.payload as UpdatePayload, event.user, ctx.db, {
+          skipUnchanged: true,
+        }); // @cast-boundary engine-payload
       break;
     case "delete":
       schema = idSchema;
@@ -319,16 +345,6 @@ export function defineEntityQueryHandler(
 // would need a Branded-EntityDefinition with `softDelete: true` literal
 // — feasible but not yet wired; the runtime guard catches misuse.
 
-type EntityHandlerOptions = { readonly access?: AccessRule };
-type EntityQueryHandlerOptions = EntityHandlerOptions & {
-  /** Reads across every tenant instead of the caller's own — for a
-   *  SystemAdmin-only operator inspector over an otherwise tenant-scoped
-   *  entity. Scope this to the ONE handler that needs it rather than making
-   *  the whole feature r.systemScope(), which would drop tenant isolation
-   *  from every other handler the feature registers too. */
-  readonly crossTenant?: boolean;
-};
-
 // @wrapper-known semantic-alias
 export function defineEntityCreateHandler(
   entityName: string,
@@ -434,3 +450,52 @@ export function defineProjectionQueryHandler(
     ...(options?.access && { access: options.access }),
   };
 }
+
+function defaultCrudVerbs(entity: EntityDefinition): Record<EntityCrudVerb, boolean> {
+  return {
+    create: true,
+    update: true,
+    delete: true,
+    restore: entity.softDelete === true,
+    list: true,
+    detail: true,
+  };
+}
+
+/** Register standard entity CRUD handlers in one call. Access stays explicit — no openToAll default. */
+export function registerEntityCrud(
+  r: EntityCrudRegistrar,
+  entityName: string,
+  entity: EntityDefinition,
+  options?: RegisterEntityCrudOptions,
+): void {
+  const verbs = { ...defaultCrudVerbs(entity), ...options?.verbs };
+  if (verbs.restore && entity.softDelete !== true) {
+    throw new Error(`restore requested but entity "${entityName}" has no softDelete: true`);
+  }
+
+  if (options?.registerEntity !== false) {
+    r.entity(entityName, entity);
+  }
+  const writeOpts = options?.write;
+  const readOpts = options?.read;
+
+  if (verbs.create) {
+    r.writeHandler(defineEntityCreateHandler(entityName, entity, writeOpts));
+  }
+  if (verbs.update) {
+    r.writeHandler(defineEntityUpdateHandler(entityName, entity, writeOpts));
+  }
+  if (verbs.delete) {
+    r.writeHandler(defineEntityDeleteHandler(entityName, entity, writeOpts));
+  }
+  if (verbs.restore) {
+    r.writeHandler(defineEntityRestoreHandler(entityName, entity, writeOpts));
+  }
+  if (verbs.list) {
+    r.queryHandler(defineEntityListHandler(entityName, entity, readOpts));
+  }
+  if (verbs.detail) {
+    r.queryHandler(defineEntityDetailHandler(entityName, entity, readOpts));
+  }
+}

package/src/engine/extensions/tenant-data.ts

@@ -0,0 +1,19 @@
+// Hook-Signatur-Types für EXT_TENANT_DATA (DSGVO tenant-scoped destroy).
+//
+// Mirror of engine/extensions/user-data.ts at tenant granularity.
+// tenant-lifecycle orchestrates destroy via registry.getExtensionUsages(EXT_TENANT_DATA).
+
+import type { DbRunner } from "../../db/connection";
+import type { Registry, TenantId } from "../types";
+
+export interface TenantDataHookCtx {
+  readonly db: DbRunner;
+  readonly registry: Registry;
+  readonly tenantId: TenantId;
+}
+
+export type TenantDataDestroyHook = (ctx: TenantDataHookCtx) => Promise<void>;
+
+export interface TenantDataExtensionHooks {
+  readonly destroy: TenantDataDestroyHook;
+}

package/src/engine/extensions/user-data.ts

@@ -14,7 +14,7 @@
 // Siehe docs/plans/datenschutz/user-data-rights.md.
 
 import type { DbRunner } from "../../db/connection";
-import type { TenantId } from "../types";
+import type { Registry, TenantId } from "../types";
 
 // SessionUser.id ist plattformweit `string` (kein Brand-Type). Wenn
 // jemals ein UserId-Brand eingefuehrt wird, ersetzt man hier den
@@ -70,6 +70,17 @@ export interface UserDataStorageProvider {
 
 export interface UserDataHookCtx {
   readonly db: DbRunner;
+  /**
+   * The app registry. A forget hook that must erase CHILD read-model rows past
+   * the entity's own row — m:n join projections, per-parent detail projections —
+   * uses it to run those custom projections for the executor's
+   * `<entity>.forgotten` event: `runProjectionsForEvent(result.data.event,
+   * ctx.registry, ctx.db)`. `executor.forget` purges only its OWN projection,
+   * and the dispatcher's post-command projection pass does not fire in the forget
+   * pipeline (a job, not a dispatched command), so the hook must trigger the
+   * cascade itself. Live-erase + rebuild `<parent>.forgotten`-apply converge.
+   */
+  readonly registry: Registry;
   readonly tenantId: TenantId;
   readonly userId: UserId;
   /**
@@ -134,11 +145,27 @@ export type UserDataExportHook = (ctx: UserDataHookCtx) => Promise<UserDataExpor
  *
  * Idempotent — wenn der Job zweimal läuft (Crash-Recovery), darf der
  * Hook nicht crashen.
+ *
+ * Return additive to `void`: a hook can return `{status:"ok"}` or
+ * `{status:"incomplete", reason}` to signal a partial success to the
+ * cleanup runner (e.g. an external provider call failed) without
+ * throwing/rolling back the sub-transaction. Existing `void` returners
+ * stay valid unchanged — including ones explicitly typed
+ * `Promise<void>` (an explicitly-annotated hook, unlike a contextually-
+ * typed arrow literal, needs `void` in the union itself: `void` is not
+ * assignable to `undefined`).
  */
+// Intentional: void (not undefined) is required here so an explicitly-typed
+// `Promise<void>` hook stays assignable (see UserDataDeleteHook's doc
+// comment above).
+export type UserDataDeleteHookResult =
+  // biome-ignore lint/suspicious/noConfusingVoidType: see comment above
+  void | { readonly status: "ok" } | { readonly status: "incomplete"; readonly reason: string };
+
 export type UserDataDeleteHook = (
   ctx: UserDataHookCtx,
   strategy: UserDataDeleteStrategy,
-) => Promise<void>;
+) => Promise<UserDataDeleteHookResult>;
 
 /**
  * Komplette Hook-Tafel für EXT_USER_DATA. Sprint 2 user-data-rights

package/src/engine/factories.ts

@@ -133,6 +133,12 @@ export function createMultiSelectField<const TOptions extends readonly string[]>
   };
 }
 
+/**
+ * Numeric field — `double precision` column by default (fractional values
+ * allowed end to end). Pass `integer: true` for a 32-bit `integer` column
+ * with `.int()` write-boundary validation. Need exact decimal storage
+ * instead (money-adjacent math)? Use `createDecimalField` (`numeric`).
+ */
 export function createNumberField<R extends true | false = false>(
   overrides?: Partial<Omit<NumberFieldDef, "type" | "required">> & { required?: R },
 ): NumberFieldDef & { required: R } {
@@ -230,8 +236,8 @@ export function createDateField<R extends true | false = false>(
  * (createdAt, loginAt, actualPickupAt). Temporal.Instant intern.
  *
  * Mit `locatedBy: "<name>Tz"` wird das Feld zum Wall-Clock-Pair eines
- * Termins an einem Ort — bevorzuge dafür den `locatedTimestamp(name)`
- * Helper, der Pair + Marker atomar erzeugt.
+ * Termins an einem Ort — bevorzuge dafür `createLocatedTimestampField()`,
+ * das EIN atomares Feld statt eines lose verdrahteten Pairs erzeugt.
  */
 export function createTimestampField<R extends true | false = false>(
   overrides?: Partial<Omit<TimestampFieldDef, "type" | "required">> & { required?: R },
@@ -300,53 +306,6 @@ export function createLocatedTimestampField<R extends true | false = false>(
   } as LocatedTimestampFieldDef & { required: R }; // @cast-boundary engine-payload
 }
 
-/**
- * @deprecated Verwende stattdessen `createLocatedTimestampField()` —
- * EIN Field-Type statt zwei lose Pair-Felder. Migration: ersetze
- * `...locatedTimestamp("pickup")` durch `pickup: createLocatedTimestampField()`.
- *
- * Wall-Clock-Termin an einem Ort — Helper der ZWEI verbundene Felder
- * erzeugt. Bevorzugte Form für jeden Date-Wert mit Location-Bezug
- * (Pickup, Delivery, Meeting, Schedule).
- *
- * ```ts
- * r.entity("order", {
- *   fields: {
- *     ...locatedTimestamp("pickup"),    // → pickupAt + pickupTz
- *     ...locatedTimestamp("delivery"),  // → deliveryAt + deliveryTz
- *   },
- * });
- * ```
- *
- * Zur Laufzeit wird:
- * - DB: `<name>_at TIMESTAMPTZ` (UTC) + `<name>_tz TEXT` (IANA-Name)
- * - JSON: `{ <name>At: "2026-04-03T10:00:00", <name>Tz: "Europe/Lisbon" }`
- *   (Wall-Clock OHNE Offset, plus IANA-Name — zwei getrennte Felder)
- * - Reducer/Apply: kann mit Temporal.ZonedDateTime arbeiten
- *
- * Optionen pro Feld (z.B. `required` auf den At-Teil) per zweitem Argument.
- */
-export function locatedTimestamp(
-  name: string,
-  overrides?: { readonly required?: boolean; readonly access?: TimestampFieldDef["access"] },
-): Readonly<Record<string, TimestampFieldDef | TzFieldDef>> {
-  const atName = `${name}At`;
-  const tzName = `${name}Tz`;
-  return {
-    [atName]: {
-      type: "timestamp",
-      locatedBy: tzName,
-      required: overrides?.required,
-      access: overrides?.access,
-    },
-    [tzName]: {
-      type: "tz",
-      required: overrides?.required,
-      access: overrides?.access,
-    },
-  };
-}
-
 export function createFileField(overrides?: Partial<Omit<FileFieldDef, "type">>): FileFieldDef {
   return { type: "file", ...overrides };
 }

package/src/engine/feature-ast/__tests__/canonical-form.test.ts

@@ -56,7 +56,10 @@ defineFeature("todoList", (r) => {
   r.defineEvent({
     name: "taskCompleted",
     schema: z.object({ id: z.string() }),
-    version: 1,
+    version: 2,
+    migrations: {
+      "1": (old) => ({ ...old, done: true }),
+    },
   });
 
   r.writeHandler({
@@ -75,6 +78,15 @@ defineFeature("todoList", (r) => {
     access: { openToAll: true },
   });
 
+  r.streamHandler({
+    name: "task:stream",
+    schema: z.object({ prompt: z.string() }),
+    handler: async function* (input, ctx) {
+      yield "token";
+    },
+    access: { roles: ["user"] },
+  });
+
   r.hook({
     type: "postSave",
     target: "task",
@@ -83,9 +95,9 @@ defineFeature("todoList", (r) => {
     },
   });
 
-  r.entityHook({
+  r.hook({
     type: "postDelete",
-    entity: "task",
+    target: { allOf: "task" },
     handler: async (event, ctx) => {
       console.log("task deleted");
     },
@@ -127,13 +139,6 @@ defineFeature("todoList", (r) => {
 
   r.useExtension({ name: "auditLog", entity: "task" });
 
-  r.eventMigration({
-    event: "taskCompleted",
-    fromVersion: 1,
-    toVersion: 2,
-    transform: (old) => ({ ...old, done: true }),
-  });
-
   r.job({
     name: "cleanupExpired",
     schedule: { cron: "0 3 * * *" },
@@ -199,7 +204,7 @@ describe("Canonical Object-Form — parser akzeptiert + extrahiert", () => {
     expect(unknowns).toEqual([]);
   });
 
-  test("alle 28 Pattern-Kinds sind erfasst", () => {
+  test("alle Pattern-Kinds sind erfasst", () => {
     const kinds: ReadonlySet<string> = new Set(result.patterns.map((p) => p.kind));
     const expected = [
       // Static
@@ -223,8 +228,8 @@ describe("Canonical Object-Form — parser akzeptiert + extrahiert", () => {
       "screen",
       "writeHandler",
       "queryHandler",
+      "streamHandler",
       "hook",
-      "entityHook",
       "job",
       "notification",
       "authClaims",
@@ -232,7 +237,6 @@ describe("Canonical Object-Form — parser akzeptiert + extrahiert", () => {
       "projection",
       "multiStreamProjection",
       "defineEvent",
-      "eventMigration",
     ];
     for (const e of expected) {
       expect(kinds.has(e), `expected kind "${e}"`).toBe(true);
@@ -265,12 +269,14 @@ describe("Canonical Object-Form — parser akzeptiert + extrahiert", () => {
     });
   });
 
-  test("entityHook Pattern: type + entity aus Object-Form", () => {
-    const entityHook = result.patterns.find((p) => p.kind === "entityHook");
+  test("hook Pattern: entity-wide { allOf } target aus Object-Form", () => {
+    const entityHook = result.patterns.find(
+      (p) => p.kind === "hook" && p.hookType === "postDelete",
+    );
     expect(entityHook).toMatchObject({
-      kind: "entityHook",
+      kind: "hook",
       hookType: "postDelete",
-      entityName: "task",
+      target: { allOf: "task" },
     });
   });
 
@@ -283,12 +289,13 @@ describe("Canonical Object-Form — parser akzeptiert + extrahiert", () => {
     expect(claim).toMatchObject({ kind: "claimKey", shortName: "teamId" });
   });
 
-  test("defineEvent: name + version aus Object-Form", () => {
+  test("defineEvent: name + version + migrations aus Object-Form", () => {
     const ev = result.patterns.find((p) => p.kind === "defineEvent");
     expect(ev).toMatchObject({
       kind: "defineEvent",
       eventName: "taskCompleted",
-      version: 1,
+      version: 2,
+      migrations: { "1": expect.anything() },
     });
   });
 
@@ -334,16 +341,6 @@ describe("Canonical Object-Form — parser akzeptiert + extrahiert", () => {
     });
   });
 
-  test("eventMigration: event + fromVersion + toVersion aus Object-Form", () => {
-    const em = result.patterns.find((p) => p.kind === "eventMigration");
-    expect(em).toMatchObject({
-      kind: "eventMigration",
-      eventName: "taskCompleted",
-      fromVersion: 1,
-      toVersion: 2,
-    });
-  });
-
   test("job: name + handlerBody.raw enthält den Closure-Body", () => {
     const job = result.patterns.find((p) => p.kind === "job");
     expect(job).toMatchObject({ kind: "job", jobName: "cleanupExpired" });

package/src/engine/feature-ast/__tests__/fixtures/cross-file-registrar/feature.ts

@@ -0,0 +1,9 @@
+import { registerFooScreens } from "./screens";
+
+// biome-ignore lint/suspicious/noExplicitAny: structural parser test fixture, never executed or type-checked at runtime
+declare function defineFeature(name: string, setup: (r: any) => void): void;
+
+defineFeature("cross-file-registrar", (r) => {
+  r.requires("config");
+  registerFooScreens(r);
+});

package/src/engine/feature-ast/__tests__/fixtures/cross-file-registrar/screens.ts

@@ -0,0 +1,4 @@
+// biome-ignore lint/suspicious/noExplicitAny: structural parser test fixture, never executed or type-checked at runtime
+export function registerFooScreens(r: any) {
+  r.nav({ id: "foo", label: "Foo" });
+}

package/src/engine/feature-ast/__tests__/parse-happy-path.test.ts

@@ -71,7 +71,7 @@ defineFeature("todoList", (r) => {
     console.log("task saved");
   });
 
-  r.entityHook("postDelete", "task", async (event, ctx) => {
+  r.hook("postDelete", { allOf: "task" }, async (event, ctx) => {
     console.log("task deleted");
   });
 
@@ -136,7 +136,6 @@ describe("parseSourceFile against a complete inline-form feature", () => {
       "writeHandler",
       "queryHandler",
       "hook",
-      "entityHook",
       "metric",
       "secret",
       "claimKey",