@cosmicdrift/kumiko-types 0.384.0 → 0.386.0

package/dist/screen.d.ts

@@ -1,7 +1,10 @@
-import type { FieldIconKey } from "./field-icon.ts";
-import type { FieldCondition, FieldDefinition, FormFieldDefinition, SelectOptionTone } from "./fields.ts";
-import type { AccessRule, AgentScreenHints } from "./handlers.ts";
-import type { IconKey, NavIconKey } from "./nav-icon.ts";
+import type { NavIconKey } from "./nav-icon.ts";
+import type { ActionFormScreenDefinition, SecretMintScreenDefinition } from "./screen-action-form.ts";
+import type { ConfigEditScreenDefinition, CustomScreenDefinition, SecretsEditScreenDefinition } from "./screen-custom-config.ts";
+import type { DashboardScreenDefinition } from "./screen-dashboard.ts";
+import type { EntityEditScreenDefinition } from "./screen-entity-edit.ts";
+import type { EntityListScreenDefinition } from "./screen-entity-list.ts";
+import type { ProjectionDetailScreenDefinition, ProjectionListScreenDefinition } from "./screen-projection.ts";
 export type { FieldIconKey } from "./field-icon.ts";
 export type PlatformComponent = {
     readonly react?: unknown;
@@ -79,1879 +82,6 @@ export type FormatSpec = {
 }[keyof FieldFormatRegistry];
 export type FieldRenderer = PlatformComponent | string | FormatSpec;
 export type { FieldCondition } from "./fields.ts";
-export type ListColumnSpec = string | {
-    readonly field: string;
-    readonly renderer?: FieldRenderer;
-    /** Optional header, overriding the default
-     *  `<feature>:entity:<entity>:field:<field>` i18n convention. Resolved
-     *  through `translate` like any header — an i18n key, or a plain literal
-     *  shown verbatim if it isn't a key. Also the way to declare a *virtual*
-     *  column whose `field` is NOT an entity field — a presentational column
-     *  drawn entirely by a `columnRenderer` component that reads the `row`
-     *  (e.g. a tag-chips cell), not a stored value. Such a column needs a
-     *  label; without one it is rejected at boot as an unknown field. `field`
-     *  is then just a stable column key (pick any unique slug). */
-    readonly label?: string;
-    /** Marks a column on a query-backed list (projectionList, relatedList,
-     *  dashboard list, expandableRow) as drawn by a renderer rather than read
-     *  from a row field. Without it, a query that declares an `outputSchema`
-     *  must return `field`; a `label` alone does not exempt the column, since
-     *  nearly every column carries one. */
-    readonly virtual?: boolean;
-    /** Marks this column as a reference lookup instead of a plain value —
-     *  for projectionList/relatedList columns, which have no
-     *  `EntityDefinition` to carry a real `reference` field type. Same
-     *  target convention as `parseRefTarget`: an entity name (same
-     *  feature) or `feature:entity` (cross-feature). Ignored on
-     *  `entityList` columns, where the field's own declared type always
-     *  wins. */
-    readonly refEntity?: string;
-    /** Row field on the referenced entity shown as the label (default
-     *  "id"). Only meaningful together with `refEntity`. */
-    readonly refLabelField?: string;
-    /** Marks this column as sortable via a clickable header — for
-     *  relatedList columns, which have no `EntityDefinition` field to carry
-     *  `sortable` on. Ignored on `entityList` columns, where the entity
-     *  field's own `sortable` flag wins. */
-    readonly sortable?: boolean;
-    /** Value type of a relatedList column, which has no `EntityDefinition`
-     *  field to derive it from. Numeric types right-align the column and its
-     *  header with tabular figures, like an entityList column of that field
-     *  type. Ignored on entityList columns, where the field's own type wins. */
-    readonly valueType?: "number" | "decimal" | "bigInt" | "money";
-    /** Leaves the column out of the compact card layout used below the
-     *  `md` breakpoint (tables keep it). For columns that only make sense
-     *  next to the others, like a sort key. */
-    readonly hideOnNarrow?: boolean;
-    /** Dashboard list panels only. "bar": field holds a 0..1 fraction, drawn
-     *  as bar + percent. "badge": field holds a label, drawn as a pill whose
-     *  tone comes from `badgeToneField`. "datetime": field holds an ISO string or
-     *  epoch ms, shown in the user's locale and time zone. Other list renderers
-     *  ignore it. */
-    readonly display?: ListColumnDisplay;
-    /** Row field naming the badge tone; only with `display: "badge"`. */
-    readonly badgeToneField?: string;
-};
-export type ListColumnDisplay = "bar" | "badge" | "datetime";
-export type ListBadgeTone = "positive" | "warn" | "negative" | "neutral";
-export type ListPaginationMode = "pages" | "infinite" | false;
-export type ListSortDir = "asc" | "desc";
-export type ListSortSpec = {
-    readonly field: string;
-    readonly dir: ListSortDir;
-};
-export type ScreenFilterOp = "eq" | "ne" | "lt" | "gt" | "lte" | "gte" | "in";
-export type ScreenFilter = {
-    readonly field: string;
-    readonly op: ScreenFilterOp;
-    readonly value: unknown;
-};
-/** Declarative row-field extractor — JSON-safe (no function prop, survives
- *  GET /api/schema / buildAppSchema).
- *
- *  `pick`: extracts fields 1:1. `{ pick: ["id", "version"] }` → `{ id: row.id, version: row.version }`
- *  `map`:  renames fields.      `{ map: { incidentId: "id" } }` → `{ incidentId: row.id }`
- *
- *  Limitation: computed/templated values can't be expressed this way —
- *  that logic belongs server-side in the write handler. */
-export type RowFieldExtractor = {
-    readonly pick: readonly string[];
-} | {
-    readonly map: Readonly<Record<string, string>>;
-};
-/** How a row action renders inline in the row-action column. `"button"` is a
- *  bordered button (its colour follows the action's `style`), `"link"` a text
- *  link, `"icon"` an icon-only button (needs a resolved icon, falls back to
- *  `"link"` without one). `"responsive"` is a `"button"` with icon and label
- *  from tablet width up and an icon-only button below it, the label staying the
- *  accessible name (needs a resolved icon, falls back to `"button"` without
- *  one). Unset: the renderer decides (primary action as link, the rest in the
- *  kebab menu). */
-export type RowActionDisplay = "button" | "link" | "icon" | "responsive";
-/** Row-action column layout. `"adaptive"` (default): primary action as link,
- *  the rest in a kebab menu — except actions with an explicit `display`, which
- *  stay inline. `"inline"`: every action inline, no kebab. */
-export type RowActionMode = "adaptive" | "inline";
-export type RowAction = RowActionWriteHandler | RowActionNavigate | RowActionDrawer | RowActionClientAction;
-export type RowActionWriteHandler = {
-    /** Default für RowActions ohne explizit gesetzten `kind` —
-     *  Backwards-kompatible Form. Kann auch explizit gesetzt werden. */
-    readonly kind?: "writeHandler";
-    /** Stable id pro Screen — kebab-case, eindeutig im Action-Set. */
-    readonly id: string;
-    /** Anzeige-Text (i18n-Key). */
-    readonly label: string;
-    /** Qualified-Name des Server-Handlers, z.B.
-     *  "publicstatus:write:maintenance:start". Wird via useDispatcher
-     *  dispatcht. */
-    readonly handler: string;
-    /** Deklarativer Payload pro Row. Default = `{ id: row.id }`.
-     *  `pick` extrahiert Felder gleichen Namens; `map` benennt um. */
-    readonly payload?: RowFieldExtractor;
-    /** i18n-Key für die Confirm-Dialog-Description. Wenn gesetzt, öffnet
-     *  ein Modal vor der Ausführung — der User muss explizit bestätigen.
-     *  Zusammen mit `style: "danger"` ist das die Standard-Sicherheits-
-     *  Garde für destruktive Aktionen. */
-    readonly confirm?: string;
-    /** i18n-Key für den Confirm-Button-Text im Dialog. Default = `label`
-     *  (also "Delete" → "Delete"-Button im Confirm). Setzen wenn die
-     *  Action einen langen Namen hat ("Mark Subscription as Cancelled")
-     *  und der Button kürzer sein soll ("Cancel Subscription"). */
-    readonly confirmLabel?: string;
-    /** Conditional Visibility pro Row. */
-    readonly visible?: FieldCondition;
-    /** Visual-Style. "danger" rendert rot + erzwingt einen Confirm-
-     *  Dialog (auch ohne expliziten `confirm`-Key). */
-    readonly style?: "primary" | "secondary" | "danger";
-    /** Overrides the id-based default icon (see ACTION_ICON_BY_ID in
-     *  kumiko-renderer) — closed IconKey vocabulary into the ICONS registry
-     *  (renderer/web), analogous to EditFieldSpec.icon. */
-    readonly icon?: IconKey;
-    /** Inline render form in the row-action column — see `RowActionDisplay`. */
-    readonly display?: RowActionDisplay;
-    /** Where to go after the write succeeded instead of staying on the shown
-     *  record. Same forms as entityEdit `redirect`. Honored on record actions
-     *  (projectionDetail header/section actions, entityEdit header/section
-     *  actions); a valid `returnTo` wins under the same rule as
-     *  entityEdit.redirect. Not used by list row actions. Without it, an action
-     *  deleting the shown record (`<feature>:write:<entity>:delete` with that
-     *  record's id) leaves to `returnTo`/the list; any other action refetches. */
-    readonly redirect?: string | ActionFormRedirect;
-};
-export type RowActionNavigateBase = {
-    readonly kind: "navigate";
-    readonly id: string;
-    readonly label: string;
-    /** Feldname dessen Wert als entityId in den URL-Pfad eingebettet wird
-     *  (`/<workspace>/<screen>/<entityId>`). entityEdit liest die Id
-     *  AUSSCHLIESSLICH aus dem Pfad. Default: "id" wenn der Ziel-Screen ein
-     *  entityEdit ist ODER wenn `entity` (statt `screen`) gesetzt ist. */
-    readonly entityId?: string;
-    /** Declarative URL search params extracted from the clicked row.
-     *  Both actionForm and entityEdit-create targets read `params` as
-     *  initial values (pre-filling the form). entityEdit-update does
-     *  not — the existing record's values take precedence.
-     *  `pick` extracts fields of the same name; `map` renames them. */
-    readonly params?: RowFieldExtractor;
-    /** Section id of the tab to activate on the target projectionDetail
-     *  (layout.mode "tabs"); merged into the navigate search params next to
-     *  returnTo. Boot validator checks the id exists on the target. */
-    readonly tab?: string;
-    /** Conditional Visibility pro Row. */
-    readonly visible?: FieldCondition;
-    /** Visual style only — unlike the writeHandler variants, "danger" does not
-     *  force a confirm dialog here: the target form is the confirmation. */
-    readonly style?: "primary" | "secondary" | "danger";
-    /** Wenn true, löst ein Klick auf die ganze Zeile (nicht nur das Aktionsmenü)
-     *  diese navigate-Action aus. Max. eine pro Liste (Boot-Validator prüft). Nur
-     *  auf navigate — ein Row-Klick darf keinen (evtl. destruktiven, unbestätigten)
-     *  Write auslösen, daher nicht auf writeHandler-Actions. */
-    readonly rowClick?: boolean;
-    /** Overrides the id-based default icon (see ACTION_ICON_BY_ID in
-     *  kumiko-renderer) — closed IconKey vocabulary into the ICONS registry
-     *  (renderer/web), analogous to EditFieldSpec.icon. */
-    readonly icon?: IconKey;
-    /** Inline render form in the row-action column — see `RowActionDisplay`. */
-    readonly display?: RowActionDisplay;
-};
-/** Exactly one of `screen` / `entity` — mutual exclusivity is type-enforced
- *  (boot validator still rejects both/neither for untyped schemas). */
-export type RowActionNavigate = RowActionNavigateBase & ({
-    /** Screen-id (kurz, unqualified). Boot-Validator prüft Existenz im
-     *  selben Feature. */
-    readonly screen: string;
-    readonly entity?: never;
-} | {
-    /** Entity-Name statt Screen-Id (fw#2228) — löst zur Boot-Zeit auf den
-     *  Screen auf, der `detailFor: "<entity>"` deklariert (siehe ObjectTarget/
-     *  resolveTarget in @cosmicdrift/kumiko-renderer's nav.tsx). */
-    readonly entity: string;
-    readonly screen?: never;
-});
-export type RowActionDrawer = {
-    readonly kind: "drawer";
-    readonly id: string;
-    readonly label: string;
-    /** Short, unqualified id of an `actionForm` screen in the same feature.
-     *  Boot validator rejects a missing screen and a screen whose `type`
-     *  isn't `actionForm` — same check as ToolbarAction's drawer variant
-     *  (see docs/plans/bundled-features-screen-standardisierung.md §2.6c). */
-    readonly screen: string;
-    /** Declarative prefill extracted from the clicked row. `pick` extracts
-     *  fields of the same name; `map` renames them. */
-    readonly params?: RowFieldExtractor;
-    /** Per-row conditional visibility. */
-    readonly visible?: FieldCondition;
-    /** Visual style only — unlike the writeHandler variants, "danger" does not
-     *  force a confirm dialog here: the target form is the confirmation. */
-    readonly style?: "primary" | "secondary" | "danger";
-    /** Overrides the id-based default icon (see ACTION_ICON_BY_ID in
-     *  kumiko-renderer) — closed IconKey vocabulary into the ICONS registry
-     *  (renderer/web), analogous to EditFieldSpec.icon. */
-    readonly icon?: IconKey;
-    /** Inline render form in the row-action column — see `RowActionDisplay`. */
-    readonly display?: RowActionDisplay;
-    /** Drawer heading (i18n key) instead of the action `label`. `{name}`
-     *  placeholders resolve from the drawer prefill (`params`), formatted for
-     *  display like `ActionFormScreenDefinition.summary`. */
-    readonly title?: string;
-    /** Line under the drawer heading (i18n key or a bare `{name}` template),
-     *  resolved like `title`. */
-    readonly subtitle?: string;
-    /** Clicking the row opens this drawer with that row's `params`. At most one
-     *  `rowClick` action (navigate or drawer) per list; rejected on
-     *  projectionDetail header actions, like navigate's. */
-    readonly rowClick?: boolean;
-};
-export type RowActionClientAction = {
-    readonly kind: "clientAction";
-    readonly id: string;
-    readonly label: string;
-    /** Registered client handler name, `<feature>:<kebab>`, e.g.
-     *  "auth-email-password:request-password-reset". Resolved when the action is
-     *  triggered; a name no client feature registered shows an error toast. */
-    readonly action: string;
-    /** Payload handed to the handler, picked from the row (or the shown record).
-     *  Default `{ id: row.id }`, like a writeHandler. */
-    readonly payload?: RowFieldExtractor;
-    /** i18n key for the confirm dialog description. */
-    readonly confirm?: string;
-    /** i18n key for the confirm button, default `label`. */
-    readonly confirmLabel?: string;
-    /** Conditional visibility per row. */
-    readonly visible?: FieldCondition;
-    /** Visual style. "danger" forces a confirm dialog, like a writeHandler. */
-    readonly style?: "primary" | "secondary" | "danger";
-    /** Overrides the id-based default icon, see `RowActionWriteHandler.icon`. */
-    readonly icon?: IconKey;
-    /** Inline render form in the row-action column — see `RowActionDisplay`. */
-    readonly display?: RowActionDisplay;
-    /** i18n key of the toast shown after the handler reported `{ ok: true }`
-     *  (default `kumiko.clientAction.success`). */
-    readonly successMessage?: string;
-};
-export type ToolbarAction = {
-    readonly kind: "navigate";
-    readonly id: string;
-    readonly label: string;
-    /** Screen-id (kurz, unqualified) zu dem navigiert wird. */
-    readonly screen: string;
-    /** Section id of the tab to activate on the target projectionDetail
-     *  (layout.mode "tabs"); merged into the navigate search params next to
-     *  returnTo. Boot validator checks the id exists on the target. */
-    readonly tab?: string;
-    /** Visual style only — unlike the writeHandler variant, "danger" does
-     *  not force a confirm dialog here: the target form is the
-     *  confirmation. */
-    readonly style?: "primary" | "secondary" | "danger";
-} | {
-    readonly kind: "writeHandler";
-    readonly id: string;
-    readonly label: string;
-    readonly handler: string;
-    /** Statischer Payload ohne row-Context. Default = `{}`. */
-    readonly payload?: Record<string, unknown>;
-    /** i18n-Key für Confirm-Dialog-Description. Wenn gesetzt UND/ODER
-     *  style="danger": Modal vor der Ausführung. */
-    readonly confirm?: string;
-    /** i18n-Key für Confirm-Button-Text im Dialog. Default = `label`. */
-    readonly confirmLabel?: string;
-    readonly style?: "primary" | "secondary" | "danger";
-} | {
-    readonly kind: "drawer";
-    readonly id: string;
-    readonly label: string;
-    /** Short, unqualified id of an `actionForm` screen in the same
-     *  feature. Boot validator rejects a missing screen and a screen
-     *  whose `type` isn't `actionForm` — the caller decides full-page
-     *  vs. drawer, not the form (see docs/plans/bundled-features-screen-
-     *  standardisierung.md §2.6c). */
-    readonly screen: string;
-    /** Visual style only — unlike the writeHandler variant, "danger" does
-     *  not force a confirm dialog here: the target form is the
-     *  confirmation. */
-    readonly style?: "primary" | "secondary" | "danger";
-    /** Drawer heading (i18n key) instead of `label`. */
-    readonly title?: string;
-    /** Line under the drawer heading (i18n key). */
-    readonly subtitle?: string;
-};
-export type RelatedListToolbarAction = (Extract<ToolbarAction, {
-    readonly kind: "navigate";
-}> & {
-    /** Conditional visibility, evaluated against the relatedList's parent
-     *  record (the "Akte"). */
-    readonly visible?: FieldCondition;
-    /** Declarative URL search params extracted from the parent record,
-     *  prefilling the target screen. Replaces the implicit
-     *  `{ [parentParam]: parentId }` default when set. */
-    readonly params?: RowFieldExtractor;
-}) | (Extract<ToolbarAction, {
-    readonly kind: "writeHandler";
-}> & {
-    readonly visible?: FieldCondition;
-}) | (Extract<ToolbarAction, {
-    readonly kind: "drawer";
-}> & {
-    readonly visible?: FieldCondition;
-});
-/** Expandable area of an `entityList` row: a relatedList of the row's record.
- *  `id` (tab id) and `countField` (tab badge) have no meaning outside a tabs
- *  layout and are therefore omitted. `kind` stays the discriminator so further
- *  expansion kinds can be added without a breaking change. */
-export type EntityListExpandableRow = Omit<EditRelatedListSection, "id" | "countField">;
-/** An extra choice on a facet next to the field's own options: a named
- *  bundle of values ("Running" = several statuses) or "no filter" (`values:
- *  []`, e.g. "All"). Chips only. */
-export type EntityListFacetExtraOption = {
-    readonly id: string;
-    /** i18n key. */
-    readonly label: string;
-    /** Option values this choice selects; `[]` selects nothing, i.e. no filter. */
-    readonly values: readonly string[];
-    /** Where the chip sits relative to the field's own options. Default "start". */
-    readonly position?: "start" | "end";
-};
-export type EntityListFacetConfig = {
-    /** `"select"` (default): dropdown with checkboxes. `"chips"`: one toggle
-     *  chip per option, single choice. */
-    readonly display?: "select" | "chips";
-    /** Chips show how many rows each option matches (other facets and the
-     *  search apply). Counts come from the list query itself, one `limit: 1`
-     *  count request per chip. */
-    readonly showCounts?: boolean;
-    /** Chips with zero matching rows are not shown. Needs counts; implies
-     *  `showCounts`'s requests even when the number itself is not shown. */
-    readonly hideEmpty?: boolean;
-    readonly extraOptions?: readonly EntityListFacetExtraOption[];
-};
-export type EntityListScreenDefinition = {
-    readonly id: string;
-    readonly type: "entityList";
-    /** Default true: the screen fills the shell content height, its body scrolls
-     *  inside and the pager / action bar stays pinned. `false` restores page
-     *  scroll (table grows with its rows, pager below the last row, form footer
-     *  in the flow). */
-    readonly fillHeight?: boolean;
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    readonly entity: string;
-    /** Short screen id (same feature) the create button opens instead of the entity's default edit screen. */
-    readonly createScreen?: string;
-    /** Set by the role projection when `createScreen` is not reachable for the role: the renderer then shows no create button instead of falling back to the entity's edit screen. Not for app authors. */
-    readonly createUnavailable?: boolean;
-    /** `false` hides this list's "+ New" button (and the empty-state create CTA) while the entity's edit screen keeps its create branch for other entry points, e.g. a prefilled action. Default `true`. */
-    readonly allowCreate?: boolean;
-    readonly columns: readonly ListColumnSpec[];
-    readonly rowRenderer?: PlatformComponent;
-    readonly cardRenderer?: PlatformComponent;
-    /** Per-row actions, rendered as an actions column on the right.
-     *  Adaptive (default, see `rowActionMode`): the primary action as a link,
-     *  the rest in the kebab menu; actions with an explicit `display` stay
-     *  inline. Array order is UI order. */
-    readonly rowActions?: readonly RowAction[];
-    /** Layout of the row-action column — see `RowActionMode`. */
-    readonly rowActionMode?: RowActionMode;
-    /** Toolbar-Aktionen (List-Header). "Open Incident", "Schedule Maintenance"
-     *  etc. — neben "+ Neu" wenn vorhanden. Reihenfolge im Array = UI-
-     *  Reihenfolge, primary-style links. */
-    readonly toolbarActions?: readonly ToolbarAction[];
-    /** Expandable area under each row: a relatedList of the row's record
-     *  (parentId = the row's `id`). Rows get a toggle button; several rows can
-     *  be open at once. Its own row actions run against the sub-list rows, and
-     *  a successful write also reloads this list. */
-    readonly expandableRow?: EntityListExpandableRow;
-    /** Server-side Filter, fest am Screen — drei Buckets derselben
-     *  Entity ohne Custom-Pages (z.B. "Upcoming" / "Active" / "Past"
-     *  Maintenance). User-side q-Search läuft AUF dem gefilterten Set
-     *  oben drauf. Boot-Validator pinst dass field in der Entity existiert. */
-    readonly filter?: ScreenFilter;
-    readonly pagination?: ListPaginationMode;
-    readonly pageSize?: number;
-    readonly defaultSort?: ListSortSpec;
-    /** Initial facet selection, per filterable field: option values (string
-     *  facets) or a boolean. Applies only while the URL carries no value for
-     *  that field, so a link or the user's own choice wins; picking "no filter"
-     *  (an `extraOptions` entry with `values: []`, or clearing the facet) is
-     *  remembered in the URL and is not overridden again. */
-    readonly defaultFilters?: Readonly<Record<string, readonly string[] | boolean>>;
-    /** Per-facet display options for the entity's `filterable` fields, keyed by
-     *  field name. `false` hides the facet's control (its filter stays usable
-     *  through `defaultFilters` and the URL). Fields without an entry keep the
-     *  default dropdown. */
-    readonly facets?: Readonly<Record<string, EntityListFacetConfig | false>>;
-    /** Replaces the default empty-list title/hint; the create button stays when the list can create. */
-    readonly emptyState?: ListEmptyStateSpec;
-    /** i18n key for the primary create button label (default `kumiko.actions.create`). */
-    readonly createLabel?: string;
-    /** i18n key for the search field placeholder (default `kumiko.list.search-placeholder`). */
-    readonly searchPlaceholder?: string;
-    readonly searchable?: boolean;
-    readonly slots?: ScreenSlots;
-    readonly access?: AccessRule;
-};
-export type ListFacetSpec = {
-    readonly field: string;
-    readonly type: "select";
-    readonly label: string;
-    readonly options: readonly {
-        readonly value: string;
-        readonly label: string;
-    }[];
-} | {
-    readonly field: string;
-    readonly type: "boolean";
-    readonly label: string;
-    readonly trueLabel: string;
-    readonly falseLabel: string;
-} | {
-    readonly field: string;
-    readonly type: "reference";
-    readonly label: string;
-    /** Entity name (same feature) or `feature:entity` (cross-feature), same
-     *  convention as `ListColumnSpec.refEntity`. Options load at render time. */
-    readonly entity: string;
-    /** Row field on the referenced entity shown as the option label
-     *  (default "id"). */
-    readonly labelField?: string;
-} | {
-    /** Declarative only — the date field the range narrows. It is NOT sent
-     *  to the server (the bounds go under `params`); it namespaces the
-     *  facet's URL keys and tells a reading agent which column this list
-     *  is time-rangeable on. */
-    readonly field: string;
-    readonly type: "dateRange";
-    readonly label: string;
-    /** Query-payload keys the chosen bounds are sent under as ISO instants.
-     *  Explicit rather than a `from`/`to` convention — a query is free to
-     *  name its time bounds anything, and the boot-validator checks these
-     *  keys against the handler's Zod schema. */
-    readonly params: {
-        readonly from: string;
-        readonly to: string;
-    };
-};
-export type ProjectionListScreenDefinition = {
-    readonly id: string;
-    readonly type: "projectionList";
-    /** Default true: the screen fills the shell content height, its body scrolls
-     *  inside and the pager / action bar stays pinned. `false` restores page
-     *  scroll (table grows with its rows, pager below the last row, form footer
-     *  in the flow). */
-    readonly fillHeight?: boolean;
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    readonly query: string;
-    readonly columns: readonly ListColumnSpec[];
-    readonly rowRenderer?: PlatformComponent;
-    readonly cardRenderer?: PlatformComponent;
-    readonly rowActions?: readonly RowAction[];
-    /** Layout of the row-action column — see `RowActionMode`. */
-    readonly rowActionMode?: RowActionMode;
-    readonly toolbarActions?: readonly ToolbarAction[];
-    readonly pagination?: ListPaginationMode;
-    readonly pageSize?: number;
-    readonly defaultSort?: ListSortSpec;
-    /** Replaces the default empty-list title/hint; the create button stays when the list can create. */
-    readonly emptyState?: ListEmptyStateSpec;
-    /** i18n key for the primary create button label (default `kumiko.actions.create`). */
-    readonly createLabel?: string;
-    /** i18n key for the search field placeholder (default `kumiko.list.search-placeholder`). */
-    readonly searchPlaceholder?: string;
-    readonly searchable?: boolean;
-    /** Derived by buildAppSchema from the query handler's Zod schema (`sort`
-     *  param present). Same type serves author and wire schema (no separate
-     *  client-facing screen type exists), so this stays structurally
-     *  writable — validateProjectionListScreens rejects any hand-authored
-     *  value at boot (fw#2165). */
-    readonly sortable?: boolean;
-    /** Derived by buildAppSchema from the query handler's Zod schema (`cursor`
-     *  or `offset` param present). See `sortable` doc for why this is
-     *  boot-enforced rather than type-enforced. */
-    readonly paginated?: boolean;
-    /** Server-side filter, fixed on the screen — see `ScreenFilter` doc above
-     *  (entityList). Field existence can't be checked without an entity; the
-     *  boot-validator only checks structure (`op:"in"` ⇒ array value). */
-    readonly filter?: ScreenFilter;
-    /** User-toggleable facet dropdowns — see `ListFacetSpec` doc. `field`
-     *  must be a declared column, except for `type: "reference"`: it filters
-     *  by id through the bound query's `filters` and needs a registered
-     *  `entity` instead. The bound query handler must accept `filters` in its
-     *  Zod schema — the boot-validator checks both. A
-     *  "dateRange" facet instead needs its two `params` keys in that schema;
-     *  it sends no `filters` entry. */
-    readonly facets?: readonly ListFacetSpec[];
-    readonly slots?: ScreenSlots;
-    readonly access?: AccessRule;
-};
-export type RecordHeaderSubtitlePart = string | {
-    readonly field: string;
-    readonly navigate?: MetricNavigate;
-};
-export type RecordHeaderSpec = {
-    readonly title: string;
-    /** Field name, or several parts (field name or `{ field, navigate }`)
-     *  joined by a separator; parts with an empty value are dropped. */
-    readonly subtitle?: string | readonly RecordHeaderSubtitlePart[];
-    readonly status?: string;
-    /** Record field holding an absolute http(s) URL. When present and the
-     *  field's value is such a URL, the subtitle renders as an external link
-     *  (`target="_blank"`) instead of plain text. Only valid with the string
-     *  form of `subtitle`. */
-    readonly subtitleHref?: string;
-    /** Record field whose value selects the `statusTones` entry, for a badge text that
-     *  carries more than the state (e.g. "Terminated on 31.03.2027"). Defaults to `status`. */
-    readonly statusToneField?: string;
-    /** Badge tone per `statusToneField` value (default: the `status` value); unlisted values fall back to the value heuristic. */
-    readonly statusTones?: {
-        readonly [statusValue: string]: SelectOptionTone;
-    };
-};
-export type MetricNavigate = {
-    readonly screen?: string;
-    readonly entity?: string;
-    readonly entityId?: string;
-    readonly params?: RowFieldExtractor;
-    /** Section id of the tab to activate at the destination. Alone (no
-     *  `screen`/`entity`), it activates that tab on the current record
-     *  instead of navigating away. */
-    readonly tab?: string;
-};
-export type MetricSpec = {
-    readonly field: string;
-    readonly label: string;
-    readonly navigate?: MetricNavigate;
-};
-export type ProjectionDetailScreenDefinition = {
-    readonly id: string;
-    readonly type: "projectionDetail";
-    /** Default true: the screen fills the shell content height, its body scrolls
-     *  inside and the pager / action bar stays pinned. `false` restores page
-     *  scroll (table grows with its rows, pager below the last row, form footer
-     *  in the flow). */
-    readonly fillHeight?: boolean;
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    readonly query: string;
-    /** Query output field whose value titles the page header (breadcrumb) when no `header` is set. */
-    readonly recordTitleField?: string;
-    /** Query-payload key for the row-id. Default "id". */
-    readonly idParam?: string;
-    /** The server determines the shown row from the caller's session/context
-     *  instead of a row id in the path — a self-service screen ("my profile",
-     *  "my data") that has no row to link to (unlike `EntityEditScreenDefinition.
-     *  singleton`, which still resolves via `<entity>:list` limit 1; here the
-     *  query itself owns the row selection, e.g. `user:query:user:me`). The
-     *  query is called WITHOUT the `idParam` key — there is no id to send, so
-     *  the boot-validator rejects declaring `idParam` alongside this flag
-     *  instead of letting one silently win. Stricter than an id-addressed
-     *  screen, not looser: the server picks the row, so no client-supplied id
-     *  can reach the query — a stray id on the path is ignored, never
-     *  forwarded. */
-    readonly singleton?: boolean;
-    readonly layout: EditLayout;
-    /** Optionaler per-Field-Label-i18n-Key (Field-Name → Key), analog zu
-     *  entityEdit.fieldLabels. Die Pseudo-Entity `__projection-detail__` hat
-     *  keinen natürlichen Field-Namespace — fehlt ein Eintrag, gilt die
-     *  Konvention `<feature>:entity:__projection-detail__:field:<name>`. */
-    readonly fieldLabels?: Readonly<Record<string, string>>;
-    /** Record header above the layout — title/subtitle/status name columns
-     *  in the query row (not literals). Rendered only when set. */
-    readonly header?: RecordHeaderSpec;
-    /** Metric band above the layout — column names in the query row, each with its own i18n `label`.
-     *  Rendered only when set. */
-    readonly metrics?: readonly MetricSpec[];
-    /** Parent list screen (kurze id) für eine "Zurück"-Navigation. */
-    readonly listScreenId?: string;
-    readonly slots?: ScreenSlots;
-    readonly access?: AccessRule;
-    /** Header action buttons. Reuses `RowAction` — the screen's single
-     *  displayed record stands in for the "row", so `pick`/`map`, `visible`,
-     *  `confirm`/`confirmLabel` and `style` keep their meaning unchanged.
-     *  `rowClick` has no target here (there is no row to click) and is
-     *  rejected by the boot-validator. */
-    readonly actions?: readonly RowAction[];
-    /** Id of the action that stays the visible header button when the actions
-     *  collapse into a menu (and the one that keeps the phone icon slot when it
-     *  has an icon and no confirm). An `actions` id or `"edit"` (the default edit
-     *  action); default precedence is `edit`, then `style: "primary"`, then the
-     *  first action. */
-    readonly primaryAction?: string;
-    /** How head fields render. Default "text" — plain text instead of a
-     *  disabled Input, since every field on this screen type is forced
-     *  readOnly anyway (there is no write path, see the shim doc above).
-     *  Set "form" to opt back into the disabled-Input look (fw#2245). */
-    readonly valueDisplay?: "form" | "text";
-};
-/** Text a query handler can send untranslated: the renderer translates it. */
-export type DashboardI18nText = {
-    readonly i18nKey: string;
-    readonly i18nParams?: Readonly<Record<string, DashboardTextParam>>;
-};
-/** Minor units (like Money fields), formatted with the user locale. */
-export type DashboardMoneyParam = {
-    readonly kind: "money";
-    readonly amountMinor: number;
-    readonly currency: string;
-};
-/** Epoch ms, rendered as a medium date in the user time zone. */
-export type DashboardDateParam = {
-    readonly kind: "date";
-    readonly atMs: number;
-};
-/** Epoch ms, rendered relative to now ("5 minutes ago", "in 30 seconds") in the
- *  user locale; the text keeps ticking while it is on screen. */
-export type DashboardRelativeTimeParam = {
-    readonly kind: "relativeTime";
-    readonly atMs: number;
-};
-/** Nested DashboardI18nText params resolve first (e.g. a duration "{years} {months}"
- *  with one plural key each); numbers stay raw so plural rules can read `count`. */
-export type DashboardTextParam = string | number | DashboardI18nText | DashboardMoneyParam | DashboardDateParam | DashboardRelativeTimeParam;
-/** Plain string is displayed as-is; DashboardI18nText is translated by the renderer. */
-export type DashboardText = string | DashboardI18nText;
-/** Chart/stat values are minor units, formatted with the user locale. */
-export type DashboardCurrencyFormat = {
-    readonly kind: "currency";
-    readonly currency: string;
-    /** Defaults to the currency's own decimals. */
-    readonly fractionDigits?: number;
-};
-/** The stat value is an epoch ms timestamp, shown relative to now and kept current. */
-export type DashboardRelativeTimeFormat = {
-    readonly kind: "relativeTime";
-};
-/** Stat panels take both formats; chart panels only the currency one. */
-export type DashboardValueFormat = DashboardCurrencyFormat | DashboardRelativeTimeFormat;
-export type DashboardPanelQueryOptions = {
-    /** Static, author-set query parameters merged on top of the screen's
-     *  dynamic filterParams — lets a panel pin a value (e.g. a status facet)
-     *  the screen-wide filter doesn't cover, without needing its own query.
-     *  The panel wins over the screen filter and the time range. */
-    readonly params?: Readonly<Record<string, unknown>>;
-    /** The screen `filter` value is NOT merged into this panel's query (a tenant
-     *  picker must not hit sources without a tenant column). The screen
-     *  `timeRange` still is. */
-    readonly ignoreScreenFilter?: boolean;
-};
-export type DashboardPanelGate = {
-    readonly visibleWhen?: DashboardPanelVisibility;
-};
-export type DashboardPanelSpan = "half" | "full";
-export type DashboardPanelEmptyState = {
-    readonly span?: DashboardPanelSpan;
-    readonly emptyLabel?: string;
-    /** Second line under `emptyLabel`. */
-    readonly emptyHint?: string;
-};
-export declare const DASHBOARD_STAT_TONES: readonly ["default", "positive", "ok", "warn", "negative"];
-export type DashboardStatTone = (typeof DASHBOARD_STAT_TONES)[number];
-export type DashboardStatPanel = DashboardPanelQueryOptions & DashboardPanelGate & {
-    readonly kind: "stat";
-    /** Stable id: kebab-case, unique within the panel set. */
-    readonly id: string;
-    /** Display text (i18n key). */
-    readonly label: string;
-    readonly query: string;
-    readonly valueField: string;
-    readonly subField?: string;
-    readonly toneField?: string;
-    /** Formats a numeric value as currency (minor units) or, with `relativeTime`, as
-     *  a ticking "5 minutes ago" from epoch ms; ignored for string values. The sparkline is not formatted. */
-    readonly valueFormat?: DashboardValueFormat;
-    /** Fixed tone when `toneField` is unset or yields none; not applied while the value is 0. */
-    readonly tone?: DashboardStatTone;
-    /** Record field holding `{ atMs, value | null }[]` (MetricResult.points),
-     *  drawn as a sparkline next to the value. */
-    readonly sparklineField?: string;
-    /** Delta chip (e.g. "↓23 %") next to the label. It renders only when BOTH
-     *  fields are set AND the query handler returns them; otherwise the tile
-     *  looks as it does without a delta. `deltaToneField` falls back to
-     *  `toneField`/"default" when unset. */
-    readonly deltaField?: string;
-    readonly deltaDirectionField?: string;
-    readonly deltaToneField?: string;
-    /** Static icon next to the label. Unlike value/sub/delta it does not vary
-     *  per query result; it is an author decision like the panel itself.
-     *  Resolved through the same extensionSectionComponents registry as custom
-     *  panels; the registered component usually ignores
-     *  entityName/entityId/filterParams (a plain icon has no entity context). */
-    readonly icon?: PlatformComponent;
-    /** Static CSS color value (e.g. "var(--color-debt)") for the icon chip,
-     *  passed straight to the tile without a registry lookup. Applies ONLY when
-     *  `icon` is set (StatCard renders the chip only together with an icon);
-     *  without an icon the value is silently dropped. Without `accentColor` the
-     *  chip follows the tone, including a `toneField` value delivered per result.
-     *  An accent that should change with the result (e.g. by sign) goes through
-     *  `toneField`; leave `accentColor` unset then. */
-    readonly accentColor?: string;
-};
-export type DashboardChartKind = "timeseries" | "stacked-bars" | "segment-bars" | "stacked-area";
-export type DashboardChartTone = "positive" | "negative" | "active" | "neutral";
-/** Look of the markers whose `kind` matches: a dashed guide line through the
- *  plot plus a colored pin. `color` (raw CSS color) wins over `tone`. */
-export type DashboardChartMarkerKind = {
-    readonly tone?: DashboardChartTone;
-    readonly color?: string;
-    /** i18n key; with `markerLegend: "legend"` the chart legend lists the markers of this kind under it. */
-    readonly label?: string;
-};
-/** One option of a stacked-area range switch. Without `months` the option
- *  shows every bucket; with it, a window of that many months anchored at
- *  `todayMs` (or the last bucket). `label` is an i18n key. */
-export type DashboardChartRangeOption = {
-    readonly value: string;
-    readonly label: string;
-    readonly months?: number;
-};
-export type DashboardChartRanges = {
-    readonly options: readonly DashboardChartRangeOption[];
-    readonly default: string;
-};
-export type DashboardChartPanel = DashboardPanelQueryOptions & DashboardPanelEmptyState & DashboardPanelGate & {
-    readonly kind: "chart";
-    readonly id: string;
-    readonly label: string;
-    readonly chart: DashboardChartKind;
-    readonly query: string;
-    /** i18n key under the title, e.g. "7 days, by creation day". */
-    readonly subtitle?: string;
-    /** Series/segment/line key -> tone; unmapped keys fall back to a palette. */
-    readonly seriesTones?: Readonly<Record<string, DashboardChartTone>>;
-    /** Series/segment/line key -> raw CSS color (e.g. "var(--color-debt)"); wins over `seriesTones`. */
-    readonly seriesColors?: Readonly<Record<string, string>>;
-    /** Formats values as currency (minor units): y ticks, legend totals and tooltips on
-     *  stacked-bars/segment-bars/stacked-area, only the y ticks on timeseries. */
-    readonly valueFormat?: DashboardCurrencyFormat;
-    /** i18n key of a unit label. Only for chart "timeseries": shown once above the y ticks instead of on every tick. */
-    readonly unit?: string;
-    /** Only for chart "stacked-area": fixed width per bucket, plot scrolls horizontally. */
-    readonly scrollable?: boolean;
-    /** Only for chart "stacked-area": marker `kind` -> look. Markers without a
-     *  declared kind keep the neutral numbered pin. */
-    readonly markerKinds?: Readonly<Record<string, DashboardChartMarkerKind>>;
-    /** Only for chart "stacked-area": false hides the per-series sums in the
-     *  legend (they mean nothing for balances). Default true. */
-    readonly legendTotals?: boolean;
-    /** Only for chart "stacked-area": range switch in the panel header. */
-    readonly ranges?: DashboardChartRanges;
-    /** Only for chart "stacked-area": scrubber under the plot to drag the visible window; starts at today. */
-    readonly brush?: boolean;
-    /** Only for chart "stacked-area": date format of axis and marker labels.
-     *  Default automatic: day and month below 18 visible months, month and year above. */
-    readonly dateFormat?: "day" | "month";
-    /** Only for chart "stacked-area": window the uncontrolled chart starts in.
-     *  "from-today" starts at today even when `ranges.default` is set. Default "default-range". */
-    readonly initialWindow?: "default-range" | "from-today";
-    /** Only for chart "stacked-area": "legend" drops the numbered marker list; pins become
-     *  plain dots with a tooltip and the legend lists marker kinds (see `markerKinds[].label`). Default "list". */
-    readonly markerLegend?: "list" | "legend";
-    /** Only for chart "stacked-area": true writes each marker label vertically next to its guide line on wide panels; narrow panels keep the pins. Default false. */
-    readonly markerLabels?: boolean;
-};
-export type DashboardListPanel = DashboardPanelQueryOptions & DashboardPanelEmptyState & DashboardPanelGate & {
-    readonly kind: "list";
-    readonly id: string;
-    readonly label: string;
-    readonly query: string;
-    readonly columns: readonly ListColumnSpec[];
-};
-export type DashboardStatGroupPanel = DashboardPanelGate & {
-    readonly kind: "stat-group";
-    readonly id: string;
-    readonly label?: string;
-    /** i18n key, a line under `label`; the boot validator requires `label`. */
-    readonly subtitle?: string;
-    readonly span?: DashboardPanelSpan;
-    readonly stats: readonly DashboardStatPanel[];
-};
-export type DashboardFeedPanel = DashboardPanelQueryOptions & DashboardPanelEmptyState & DashboardPanelGate & {
-    readonly kind: "feed";
-    readonly id: string;
-    readonly label: string;
-    readonly query: string;
-};
-export type DashboardProgressTone = "default" | "danger";
-export type DashboardProgressListPanel = DashboardPanelQueryOptions & DashboardPanelEmptyState & DashboardPanelGate & {
-    readonly kind: "progress-list";
-    readonly id: string;
-    readonly label: string;
-    readonly query: string;
-};
-export type DashboardCustomPanel = {
-    readonly kind: "custom";
-    readonly id: string;
-    readonly component: PlatformComponent;
-};
-export type DashboardTextBlock = {
-    readonly kind: "heading";
-    readonly text: string;
-} | {
-    readonly kind: "paragraph";
-    readonly text: string;
-    /** Default "muted", like body copy inside panels. */
-    readonly emphasis?: "muted" | "strong";
-} | {
-    readonly kind: "list";
-    readonly items: readonly string[];
-} | {
-    readonly kind: "code";
-    readonly code: string;
-} | {
-    readonly kind: "hint";
-    readonly text: string;
-} | {
-    readonly kind: "link";
-    /** Link label (i18n key). */
-    readonly text: string;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>`. */
-    readonly screen: string;
-    /** Show the link only to users holding one of these roles. Display
-     *  gate only: the target screen's own `access` stays the enforcement. */
-    readonly roles?: readonly string[];
-};
-export type DashboardTextPanel = DashboardPanelGate & {
-    readonly kind: "text";
-    readonly id: string;
-    /** Panel title (i18n key). */
-    readonly label?: string;
-    readonly span?: DashboardPanelSpan;
-    readonly blocks: readonly DashboardTextBlock[];
-};
-export type DashboardPanelVisibility = {
-    readonly query: string;
-    readonly field: string;
-    readonly eq: string | number | boolean | null;
-};
-export type DashboardScreenPanel = {
-    readonly kind: "screen";
-    readonly id: string;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>`. */
-    readonly screen: string;
-    readonly label?: string;
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` embedded in this
-     *  panel's place when `visibleWhen` is unmet or its query fails (nothing while it loads).
-     *  Needs `visibleWhen`; the target must not have a `visibleWhen` of its own. */
-    readonly fallback?: string;
-    /** Render the embedded form without its own card frame and padding, aligned to
-     *  the dashboard's page grid like a standalone settings screen. Default false
-     *  (framed card); set for panels whose body is a settings-list form, where a
-     *  card inside the page would double the inset. */
-    readonly chromeless?: boolean;
-};
-export type DashboardPanelDefinition = DashboardStatPanel | DashboardStatGroupPanel | DashboardChartPanel | DashboardListPanel | DashboardFeedPanel | DashboardProgressListPanel | DashboardTextPanel | DashboardCustomPanel | DashboardScreenPanel;
-export type DashboardFilterDefinition = {
-    readonly id: string;
-    readonly label: string;
-    readonly kind: "select";
-    readonly placeholder?: string;
-    /** i18n-Key für den "(alle)"-Eintrag. */
-    readonly allLabel?: string;
-    readonly options?: readonly {
-        readonly value: string;
-        readonly label: string;
-    }[];
-    /** Query-Result-Contract: `{ rows: { value: string; label: string }[] }`. */
-    readonly optionsQuery?: string;
-};
-export type DashboardTimeRangeDefinition = {
-    readonly id: string;
-    /** `label` is an i18n key. */
-    readonly options: readonly {
-        readonly value: string;
-        readonly label: string;
-    }[];
-    readonly default: string;
-};
-export type DashboardScopeDefinition = {
-    readonly badge: string;
-    readonly notice?: string;
-};
-/** Minimum polling interval of `DashboardScreenDefinition.refresh`; shorter values are rejected
- *  at boot (`seconds`) or raised at runtime (`field`). */
-export declare const DASHBOARD_MIN_REFRESH_SECONDS = 5;
-export type DashboardRecordBinding = {
-    /** URL search param carrying the record id. Without it the dashboard shows a
-     *  hint instead of its panels and runs no query. */
-    readonly param: string;
-    /** Key of the id in each panel query payload. Default: `param`. */
-    readonly payloadKey?: string;
-    /** Optional query for the record row (QN). It receives `{ [payloadKey]: id }`
-     *  and returns a flat row; `actions` take that row as their input and
-     *  `refresh.field` and `titleField` read from it. */
-    readonly query?: string;
-    /** Field of the record row shown as the page title. Needs `query`. */
-    readonly titleField?: string;
-};
-/** Polling of the record and all panel queries, never faster than
- *  DASHBOARD_MIN_REFRESH_SECONDS. `field` reads the seconds from the record row
- *  (needs `record.query`), so a monitor can be polled at its own check interval. */
-export type DashboardRefresh = {
-    readonly seconds: number;
-} | {
-    readonly field: string;
-};
-export type DashboardScreenDefinition = {
-    readonly id: string;
-    readonly type: "dashboard";
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    readonly panels: readonly DashboardPanelDefinition[];
-    /** Binds the dashboard to one record via a URL search param, see DashboardRecordBinding. */
-    readonly record?: DashboardRecordBinding;
-    /** Header actions on the bound record (writeHandler, navigate, clientAction).
-     *  The row is the `record.query` row, or `{ id, [payloadKey]: id }` without a
-     *  query. After a success the record and all panels refetch. Needs `record`;
-     *  no drawer, redirect or rowClick. */
-    readonly actions?: readonly RowAction[];
-    readonly refresh?: DashboardRefresh;
-    readonly filter?: DashboardFilterDefinition;
-    /** Segmented control in the toolbar; the value lives in URL search param
-     *  `id` and is merged into EVERY panel query (also ignoreScreenFilter ones). */
-    readonly timeRange?: DashboardTimeRangeDefinition;
-    /** Marks the screen as spanning more than the caller's own scope. */
-    readonly scope?: DashboardScopeDefinition;
-    /** Show the "Updated at" timestamp in the toolbar. Default true; turn off for
-     *  dashboards that host forms rather than live metrics, where a load time
-     *  next to the form reads as stale data. */
-    readonly showUpdatedAt?: boolean;
-    readonly slots?: ScreenSlots;
-    readonly access?: AccessRule;
-};
-export type EditFieldSpec = string | {
-    readonly field: string;
-    readonly span?: number;
-    readonly visible?: FieldCondition;
-    readonly readOnly?: FieldCondition;
-    readonly required?: FieldCondition;
-    readonly renderer?: FieldRenderer;
-    /** `false` keeps the field out of the submitted payload — for values
-     *  that are shown or prefilled for display only (a label, a counter)
-     *  and that the write handler's schema does not accept. Validation and
-     *  rendering are unchanged. */
-    readonly submit?: false;
-    /** Prefix icon on the input — closed FieldIconKey vocabulary into
-     *  the FIELD_ICONS registry (renderer/web), analogous to
-     *  `ScreenNavSugar.icon` / NavIconKey. Only takes effect for
-     *  single-line `type: "text"` and `"number"` — a `text` field with
-     *  `multiline` routes to a textarea (no icon slot), and other input
-     *  kinds (select, combobox, date, …) silently ignore the key. */
-    readonly icon?: FieldIconKey;
-    /** Input placeholder (i18n key, falls back to the literal). Only for
-     *  single-line text, number and textarea inputs; other kinds ignore it. */
-    readonly placeholder?: string;
-    /** Static text shown before the input (i18n key, falls back to the
-     *  literal), or `{ field }` for the current form value of another field
-     *  (a hidden field carrying e.g. a base domain). Only for single-line
-     *  text and number inputs; other kinds ignore it. */
-    readonly prefix?: FieldAffix;
-    /** Same as `prefix`, shown after the input. */
-    readonly suffix?: FieldAffix;
-    /** Button beside the input that runs a query and writes one scalar of
-     *  its result into this field. Also offered on a readOnly field, where
-     *  the value can only come from the suggestion. Only for single-line
-     *  text and number inputs; other kinds ignore it. */
-    readonly fillAction?: FieldFillAction;
-    /** Marks this field as a reference lookup instead of a plain value —
-     *  for projectionDetail fields, which have no `EntityDefinition` to
-     *  carry a real `reference` field type. Same target convention as
-     *  `parseRefTarget` (and `ListColumnSpec.refEntity`): an entity name
-     *  (same feature) or `feature:entity` (cross-feature). Ignored on
-     *  `entityEdit` fields, where the field's own declared type always
-     *  wins. */
-    readonly refEntity?: string;
-    /** Row field on the referenced entity shown as the label (default
-     *  "id"). Only meaningful together with `refEntity`. */
-    readonly refLabelField?: string;
-    /** Embedded-list fields only (`createEmbeddedListField`). */
-    readonly embeddedList?: EmbeddedListEditSpec;
-    /** Fills an empty value when the create form opens; the update form and
-     *  values from URL params or a handoff are never touched. Unlike a
-     *  field `default`, it is not applied server-side. */
-    readonly prefill?: EditFieldPrefill;
-};
-export type FieldAffix = string | {
-    readonly field: string;
-};
-export type FieldFillAction = {
-    /** i18n key (falls back to the literal) of the button label. */
-    readonly label: string;
-    /** Qualified query name, run with the current form values picked by `params`. */
-    readonly query: string;
-    /** Key in the query result written into the field; the value must be a
-     *  string or a number, anything else counts as a failed fill. */
-    readonly field: string;
-    /** Form fields sent as the query payload (none: an empty payload). */
-    readonly params?: RowFieldExtractor;
-};
-export type EmbeddedListEditSpec = {
-    /** Sub-fields shown as read-only cells; every other cell stays editable. */
-    readonly readOnlyCells?: readonly string[];
-    /** `true` keeps the rows as they are: no add, remove, duplicate, move or
-     *  paste-appended rows. Cells stay editable (unless in `readOnlyCells`). */
-    readonly fixedRows?: boolean;
-};
-export type EditFieldPrefill = {
-    readonly kind: "today";
-} | {
-    readonly kind: "currentUser";
-    readonly property: "displayName" | "email" | "id";
-};
-export type EditSectionSpec = EditFieldsSection | EditExtensionSection | EditRelatedListSection | EditWriteFormSection;
-type EditFieldsSectionBase = {
-    /** Kebab-case tab id, used as the `?tab=` value. Required by the
-     *  boot-validator when the enclosing `EditLayout.mode` is "tabs". */
-    readonly id?: string;
-    readonly kind?: "fields";
-    /** Optional. Ohne Titel rendert die Section nur ihre Felder (keine h3-
-     *  Überschrift) — für flache Forms (Card-Titel + Felder direkt, ein
-     *  einzelner Abschnitt) wie bei den meisten shadcn-Form-Mustern. */
-    readonly title?: string;
-    /** Optional help text under the block heading (i18n key or raw string,
-     *  like `title`) — makes a form usable without training instead of
-     *  falling back to custom JSX for help text. Renders through the same
-     *  `subtitle` slot as `FormProps.subtitle`. Works without `title` too
-     *  (subtitle-only section). */
-    readonly description?: string;
-    readonly columns?: number;
-    /** Rendered left of the section title, `text-muted-foreground` — closed
-     *  IconKey vocabulary into the ICONS registry (renderer/web), analogous
-     *  to EditFieldSpec.icon. No title → no icon, and no heuristic derives
-     *  one from the title (titles are free i18n strings). */
-    readonly icon?: IconKey;
-    /** Record field rendered as a count badge in the tab label when the
-     *  enclosing `EditLayout.mode` is "tabs" (e.g. an open-items counter).
-     *  Ignored outside tabs mode or when the field's value is not a finite
-     *  number. */
-    readonly countField?: string;
-    /** Short line (i18n key) under this step's title in the wizard step rail
-     *  and in the "up next" box. Wizard layouts only; unlike `description` it
-     *  is not shown inside the step. */
-    readonly subtitle?: string;
-    /** Rendered top-right in the section's Card title row — same
-     *  navigate/drawer/writeHandler dispatch as `ProjectionDetailScreenDefinition.actions`,
-     *  evaluated against the same record. Every action must resolve an icon
-     *  (declared or id-derived); the boot-validator rejects one that doesn't. */
-    readonly actions?: readonly RowAction[];
-};
-export type EditFieldGroup = {
-    readonly title: string;
-    readonly fields: readonly EditFieldSpec[];
-    /** Default 2. */
-    readonly columns?: number;
-};
-/** Either a flat `fields` grid or titled `groups` cards, never both: the groups branch has no
- *  `fields` key, so a raw `.fields` read on a section does not compile — use `sectionFieldSpecs`. */
-export type EditFieldsSection = EditFieldsSectionBase & ({
-    readonly fields: readonly EditFieldSpec[];
-} | {
-    /** Splits the section into multiple titled cards instead of one flat grid; fields named
-     *  here still need to exist. */
-    readonly groups: readonly EditFieldGroup[];
-});
-export type EditExtensionSection = {
-    /** Kebab-case tab id, used as the `?tab=` value. Required by the
-     *  boot-validator when the enclosing `EditLayout.mode` is "tabs". */
-    readonly id?: string;
-    readonly kind: "extension";
-    readonly title: string;
-    readonly component: PlatformComponent;
-    /** When true, the extension registers via `useExtensionFormSubmit` and the
-     *  surrounding form's Save button should activate for its dirty state.
-     *  Omit/false for extensions that persist through their own dispatcher
-     *  writes (e.g. notes-history NotesSection) — otherwise a read-only form
-     *  shows a Save button that does nothing (fw#2359). */
-    readonly contributesToFormSubmit?: boolean;
-    /** Overrides the host-derived entity name passed to the mounted component.
-     *  Required on `projectionDetail` (which has no real entity — the host
-     *  value there is an internal placeholder) so a self-persisting extension
-     *  like NotesSection filters/writes against the right domain entity. Takes
-     *  precedence over the host value on every screen type. */
-    readonly entityName?: string;
-    /** Record field rendered as a count badge in the tab label when the
-     *  enclosing `EditLayout.mode` is "tabs" (e.g. an open-items counter).
-     *  Ignored outside tabs mode or when the field's value is not a finite
-     *  number. */
-    readonly countField?: string;
-    /** Rendered top-right in the section's Card title row — same
-     *  navigate/drawer/writeHandler dispatch as `ProjectionDetailScreenDefinition.actions`,
-     *  evaluated against the same record. Every action must resolve an icon
-     *  (declared or id-derived); the boot-validator rejects one that doesn't. */
-    readonly actions?: readonly RowAction[];
-};
-/** Rows are grouped by `field` in order of first appearance. Every group gets
- *  a collapsible header. */
-export type RelatedListGroupBy = {
-    readonly field: string;
-    /** Groups whose field value equals this start collapsed; the others start open. */
-    readonly collapsedWhen?: string | number | boolean | null;
-    /** i18n key of the group header. Placeholders: `{count}` rows in the group,
-     *  `{value}` the group's field value, `{lastDate}` the group's latest
-     *  `dateField` value as a locale date. A group with neither `label` nor an
-     *  entry in `labels` renders its rows without a header and never collapses. */
-    readonly label?: string;
-    /** Header i18n key per group value (as string), overriding `label`. */
-    readonly labels?: Readonly<Record<string, string>>;
-    /** Row field (ISO date or timestamp) behind `{lastDate}`. */
-    readonly dateField?: string;
-};
-/** Group key of a field value; `collapsedWhen` and row values both go through it. */
-export declare function relatedListGroupKey(value: unknown): string;
-export declare function relatedListGroupHeaderLabel(groupBy: RelatedListGroupBy, groupKey: string): string | undefined;
-/** Row tint rule: rows where the `FieldCondition` (`{ field, eq }`, `{ field,
- *  in }` …) holds get the tone. `bad` renders red. */
-export type RelatedListRowTone = Exclude<FieldCondition, boolean> & {
-    readonly tone: SelectOptionTone;
-};
-/** Replacement for the default "no rows" box of a list. `title`/`description`
- *  are i18n keys. `action` is a record action evaluated against an empty
- *  record on list screens (the parent record on a relatedList); its icon must
- *  resolve, same as `ProjectionDetailScreenDefinition.actions`. A narrowed list
- *  (search term or changed filters) shows the neutral "no matches" text instead. */
-export type ListEmptyStateSpec = {
-    readonly title: string;
-    readonly description?: string;
-    readonly action?: RowAction;
-};
-export type EditRelatedListSection = {
-    /** Kebab-case tab id, used as the `?tab=` value. Required by the
-     *  boot-validator when the enclosing `EditLayout.mode` is "tabs". */
-    readonly id?: string;
-    readonly kind: "relatedList";
-    readonly title: string;
-    /** Fully qualified query QN. Same paged envelope as projectionList.query:
-     *  `{ rows, nextCursor, total? }`. */
-    readonly query: string;
-    /** Query-payload key the parent record's id is passed under. Default "id". */
-    readonly parentParam?: string;
-    /** Server-side WHERE clause pinning this section to the parent record —
-     *  sent as `payload.filter: { field, op: "eq", value: parentId }`, kept
-     *  out of the user-facet `filters` array so it can't be cleared by facet
-     *  interaction. Lets a tab reuse the generic `<entity>:list` query instead
-     *  of a bespoke child-rows handler. Mutually exclusive with `parentParam`
-     *  (the boot-validator rejects both). `field` must be a real field on the
-     *  entity behind `query`, and that query's Zod schema must accept
-     *  `filter` (same requirement `filter`/`facets` already have). The filter is
-     *  client-supplied: any caller may omit it, so the bound query must authorize
-     *  the ENTIRE row set it can return, not just the parent's children. */
-    readonly parentFilter?: {
-        readonly field: string;
-    };
-    readonly columns: readonly ListColumnSpec[];
-    /** Entity the query's rows belong to: an entity name (same feature) or
-     *  `feature:entity`. Columns that name one of its fields render like an
-     *  entityList column of that field (select as a status badge with the
-     *  translated option label, dates locale-formatted, default header from the
-     *  field's label key). The column's own `sortable` still decides the
-     *  header sort. Without it every column renders as plain text. */
-    readonly entity?: string;
-    /** i18n key for the one-line hint at the left of the tab toolbar. */
-    readonly description?: string;
-    /** i18n key holding plural forms for the footer count ("1 Position",
-     *  "3 Positionen"). Omitted: generic "entries" wording. */
-    readonly itemNoun?: string;
-    readonly pageSize?: number;
-    /** Initial sort on mount, applied client-side over the already-loaded rows
-     *  (this section has no pager; if the fetch is truncated, `nextCursor !== null`,
-     *  the section shows a hint banner that the sort covers only the loaded rows).
-     *  `field` must name a column with `sortable: true` — boot-validator pins
-     *  that, same as `entityList.defaultSort`. */
-    readonly defaultSort?: ListSortSpec;
-    /** Renders a search box whose debounced term rides along as
-     *  `payload.search` on this section's own query. Opt-in, unlike
-     *  `projectionList.searchable` (derived from the bound query's schema): a
-     *  relatedList query is an ordinary child-rows handler, so a `search`
-     *  parameter in its schema is not by itself a statement that this section
-     *  should offer search. The boot-validator rejects `true` when the query's
-     *  Zod schema has no `search` parameter. */
-    readonly searchable?: boolean;
-    /** User-toggleable facet dropdowns — same explicit-label `ListFacetSpec` as
-     *  `projectionList.facets` (a relatedList has no entity to derive filterable
-     *  fields from). `field` must be a declared column, except for
-     *  `type: "reference"`: it filters by id through the bound query's
-     *  `filters` and needs a registered `entity` instead. The bound query
-     *  handler must accept `filters` in its Zod schema — the boot-validator
-     *  checks both. Selected values ride along as `payload.filters`. */
-    readonly facets?: readonly ListFacetSpec[];
-    /** Row click opens the target entity's detail screen via ObjectTarget —
-     *  the `detailFor` lookup owns the entity→screen mapping, so no screenId
-     *  is named here. `idColumn` names the row key holding that id (default
-     *  "id"). Omit `rowClick` for a non-interactive list. */
-    readonly rowClick?: {
-        readonly entity: string;
-        readonly idColumn?: string;
-    };
-    /** Per-row actions — same type and dispatch semantics as `entityList`/
-     *  `projectionList`'s `rowActions` (writeHandler dispatch with a
-     *  declarative `payload` extractor, or navigate). A successful
-     *  writeHandler action re-runs this section's own query, same as a
-     *  projectionList row action re-running its list query. */
-    readonly rowActions?: readonly RowAction[];
-    /** Layout of the row-action column — see `RowActionMode`. */
-    readonly rowActionMode?: RowActionMode;
-    /** Groups rows by the value of a field under collapsible group headers. */
-    readonly groupBy?: RelatedListGroupBy;
-    /** Tints rows whose field matches — a declarative rule, not a function, so
-     *  the screen definition stays serializable. */
-    readonly rowTone?: RelatedListRowTone;
-    /** Toolbar actions above the table — same type and dispatch semantics as
-     *  `entityList`/`projectionList`'s `toolbarActions` ("+ Anlegen" etc.),
-     *  plus `visible`/`params` evaluated against the parent record (see
-     *  RelatedListToolbarAction). */
-    readonly toolbarActions?: readonly RelatedListToolbarAction[];
-    /** Record field rendered as a count badge in the tab label when the
-     *  enclosing `EditLayout.mode` is "tabs" (e.g. an open-items counter).
-     *  Ignored outside tabs mode or when the field's value is not a finite
-     *  number. */
-    readonly countField?: string;
-    /** Rendered top-right in the section's Card title row — same
-     *  navigate/drawer/writeHandler dispatch as `ProjectionDetailScreenDefinition.actions`,
-     *  evaluated against the parent record. Every action must resolve an icon
-     *  (declared or id-derived); the boot-validator rejects one that doesn't.
-     *  Distinct from `toolbarActions` (rendered inside the DataTable toolbar) —
-     *  this is the Card-level title-row action. */
-    readonly actions?: readonly RowAction[];
-    /** Rendered inside the section's Card in place of the table when this
-     *  section's query returns zero rows. Omitted: the DataTable default
-     *  ("kumiko.list.no-entries") applies. `action`'s icon must resolve, same
-     *  as `actions` above. */
-    readonly emptyState?: ListEmptyStateSpec;
-};
-export type EditWriteFormSection = {
-    /** Kebab-case tab id, used as the `?tab=` value. Required by the
-     *  boot-validator when the enclosing `EditLayout.mode` is "tabs". */
-    readonly id?: string;
-    readonly kind: "writeForm";
-    readonly title?: string;
-    readonly description?: string;
-    readonly columns?: number;
-    readonly icon?: IconKey;
-    /** Field-type map for this section's own form — same shape as
-     *  `ActionFormScreenDefinition.fields`. */
-    readonly fieldDefs: Readonly<Record<string, FieldDefinition>>;
-    /** Rendered fields, in order — same shape as `EditFieldsSection.fields`.
-     *  Every referenced field must have an entry in `fieldDefs`. */
-    readonly fields: readonly EditFieldSpec[];
-    /** Write-handler QN dispatched on submit. The submitted values (not a
-     *  diff) land 1:1 as payload, same as `ActionFormScreenDefinition.handler`.
-     *  The payload carries only this section's own fields — no parent/record
-     *  id is injected automatically. To thread the host record's id through,
-     *  declare it in `fieldDefs` with `visible: false` on its `fields` entry:
-     *  it gets prefilled from the loaded record like any other field and rides
-     *  along in the submit payload without being shown in the form. */
-    readonly handler: string;
-    /** i18n-key for the submit button. Default: "kumiko.actions.save". */
-    readonly submitLabel?: string;
-    /** Rendered top-right in the section's Card title row — same
-     *  navigate/drawer/writeHandler dispatch as `ProjectionDetailScreenDefinition.actions`,
-     *  evaluated against the same record. Every action must resolve an icon
-     *  (declared or id-derived); the boot-validator rejects one that doesn't. */
-    readonly actions?: readonly RowAction[];
-};
-export type FormWidth = "3xl" | "4xl" | "full";
-export type EditLayout = {
-    readonly sections: readonly EditSectionSpec[];
-    /** Default "4xl" (a centered column, narrower than list chrome), unless
-     *  the app overrides it via `createKumikoApp({ screenWidth })`. Override
-     *  per-screen to "3xl" for a narrower column or "full" to match list
-     *  chrome. */
-    readonly width?: FormWidth;
-    /** Default "single". "wizard" renders one section per step (with
-     *  progress + per-step validation) instead of all sections at once —
-     *  boot-validator requires >= 2 sections, each with a title, when set.
-     *  "tabs" renders one section per tab (projectionDetail only — the
-     *  boot-validator rejects it on entityEdit, see the check for the reason);
-     *  requires >= 2 sections, each with a title and an `id`. */
-    readonly mode?: "single" | "wizard" | "tabs";
-    /** "settings-list" lays each section out as a band with a title column on
-     *  the left and one hairline-separated row per field (label + help left,
-     *  control right) — the familiar settings pattern, for screens that are a
-     *  list of independent preferences rather than one record form. Default
-     *  "form" keeps the grid of cells. */
-    readonly variant?: "form" | "settings-list";
-    /** Persists in-progress wizard state as a resumable draft instead of
-     *  discarding it on navigation away. */
-    readonly draft?: boolean;
-    /** Wizard layouts only. `upNext: true` adds an "up next" box to the step
-     *  rail with the following step's title and `subtitle`; the last step
-     *  shows none. */
-    readonly wizard?: {
-        readonly aside?: {
-            readonly upNext: true;
-        };
-    };
-};
-export type EntityWriteExcludedFields = {
-    readonly create?: readonly string[];
-    readonly update?: readonly string[];
-};
-export type EntityEditScreenDefinition = {
-    readonly id: string;
-    readonly type: "entityEdit";
-    /** Default true: the screen fills the shell content height, its body scrolls
-     *  inside and the pager / action bar stays pinned. `false` restores page
-     *  scroll (table grows with its rows, pager below the last row, form footer
-     *  in the flow). */
-    readonly fillHeight?: boolean;
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    /** Derived by buildAppSchema from the navigate `params` targeting this
-     *  screen — the only URL query keys the create form prefills. An authored
-     *  value is overwritten. */
-    readonly urlPrefillFields?: readonly string[];
-    /** Derived by buildAppSchema from the entity's create/update write handlers
-     *  (`excludeFields`): create hides these fields, update shows them read-only.
-     *  An authored value is overwritten. */
-    readonly writeExcludedFields?: EntityWriteExcludedFields;
-    readonly entity: string;
-    /** Entity field whose value names the loaded record in the header breadcrumb (edit mode only). */
-    readonly recordTitleField?: string;
-    /** Screen title (i18n key) with `{field}` placeholders filled from the
-     *  current form values, so the title follows what the user types (create
-     *  wizard: "Add {make} {model}"). Falls back to the plain title while the
-     *  placeholders are still empty. */
-    readonly titleTemplate?: string;
-    /** Shows a saved record read-only while the condition holds for the loaded
-     *  record (not for unsaved form values): all fields disabled, no save, discard
-     *  or delete button; record `actions` stay. The title uses
-     *  `screen:<id>.view.title`, then `screen:<id>.title`. Never applies to create.
-     *  The entity's `lockedWhen` always applies as well; set this only to add a
-     *  UI-only condition (either one shows the view).
-     *  UI only: the update handler still has to enforce access. */
-    readonly readOnly?: FieldCondition;
-    readonly layout: EditLayout;
-    /** Optionaler i18n-Key (oder Roh-String) für den Submit-Button. Default
-     *  `kumiko.actions.save`. Lässt den Auto-Edit-Screen domain-spezifische
-     *  CTAs zeigen ("Save Address", "Create item") statt generisch "Speichern". */
-    readonly submitLabel?: string;
-    /** Default true. `false` für Entities deren Create über einen eigenen
-     *  Lifecycle-Write läuft (z.B. incident:open mit Event-Stream + Joins)
-     *  statt über `<entity>:create`: unterdrückt den automatischen
-     *  „+ Neu"-Button auf entityList-Screens dieser Entity und rendert den
-     *  Create-Branch (Aufruf ohne entityId) als Fehler statt eines Forms,
-     *  dessen Submit gegen einen nicht registrierten Handler liefe. */
-    readonly allowCreate?: boolean;
-    /** Default true. `false` wenn kein `<entity>:delete`-Handler existiert
-     *  (History-/Audit-Erhalt): unterdrückt den Löschen-Button im
-     *  Update-Form. */
-    readonly allowDelete?: boolean;
-    /** Default false. `true` for singleton entities (exactly one record per
-     *  tenant: organization, settings, tenant profile). A call without an
-     *  `entityId` first resolves the existing record via `<entity>:list`
-     *  (limit 1) and renders the update branch with prefill on a hit,
-     *  instead of blindly creating another one. The create branch only
-     *  fires when the table is empty (and `allowCreate: false` still
-     *  applies there). */
-    readonly singleton?: boolean;
-    /** Navigate to this screen ID after a successful save (create or update).
-     *  Either a same-feature short screen-ID, or a fully-qualified
-     *  cross-feature screen QN (`<feature>:screen:<id>`) — the nav-router
-     *  resolves both against the schema; boot-validator checks the target
-     *  resolves to a registered screen. Overrides the default post-save
-     *  target (the entity's list screen); delete is unaffected and still
-     *  always navigates to the list. A cross-feature QN hard-couples this
-     *  feature to the target at boot time — an app that doesn't mount the
-     *  target feature fails the boot-validator; only use this form in a
-     *  reusable feature when the target feature is guaranteed to be
-     *  mounted alongside it.
-     *
-     *  The object form additionally names the success-payload field the
-     *  navigation id comes from (`ActionFormRedirect.idFrom`) — needed when
-     *  the edited record is a child and the target screen is the parent's
-     *  detail screen. Update falls back to the loaded record when the
-     *  success payload doesn't carry that field flatly; create falls back
-     *  to the submitted form values. */
-    readonly redirect?: string | ActionFormRedirect;
-    /** Parent list screen (short id) for breadcrumb + nav highlighting when
-     *  this screen has no nav entry of its own. Same field/semantics as on
-     *  `custom`/`projectionDetail`; an explicit value here wins over the
-     *  entity-list heuristic (rowAction target / same-entity entityList). */
-    readonly listScreenId?: string;
-    /** Optionaler per-Field-Label-i18n-Key (Field-Name → Key), überschreibt
-     *  die Default-Konvention `<feature>:entity:<entity>:field:<name>`.
-     *  Primär für configEdit: dessen Pseudo-Entity `__config-edit__` hat
-     *  keinen natürlichen Field-Namespace — der Settings-Hub injiziert hier
-     *  das `mask.title`-Label des Config-Keys. Fehlt ein Eintrag, gilt die
-     *  Konvention. */
-    readonly fieldLabels?: Readonly<Record<string, string>>;
-    /** Record actions. Reuses `RowAction` — analogous to
-     *  `ProjectionDetailScreenDefinition.actions` (the loaded record stands
-     *  in for the "row"). `rowClick` has no target here and is rejected by
-     *  the boot-validator, same as on projectionDetail. Not rendered in
-     *  create mode — every action targets an existing record, which the
-     *  create branch doesn't have yet. By default an action renders with the
-     *  secondary form actions (footer, next to copy-link/delete/cancel);
-     *  `placement: "menu"` moves it into the header "…" menu, ahead of
-     *  copy-link/delete. Without a header menu (drawer, card form, shell
-     *  without a header slot) a "menu" action falls back to inline. */
-    readonly actions?: readonly EntityEditAction[];
-    readonly slots?: ScreenSlots;
-    readonly access?: AccessRule;
-};
-export type EntityEditActionPlacement = "inline" | "menu";
-export type EntityEditAction = RowAction & {
-    readonly placement?: EntityEditActionPlacement;
-};
-/** A form field computed from other fields of the same form. `listSum` adds one
- *  numeric cell over all rows of an embedded list field; its `whenEmpty`
- *  fallback applies while the list has no rows (it must not be a `listSum`). */
-export type FormFieldDerivation = {
-    readonly op: "sum" | "subtract" | "multiply" | "percent";
-    readonly from: readonly string[];
-} | {
-    readonly op: "listSum";
-    readonly list: string;
-    readonly cell: string;
-    readonly whenEmpty?: FormFieldDerivationWithoutList;
-};
-export type FormFieldDerivationWithoutList = Extract<FormFieldDerivation, {
-    from: unknown;
-}>;
-export type ActionFormScreenDefinition = {
-    readonly id: string;
-    readonly type: "actionForm";
-    /** Default true: the screen fills the shell content height, its body scrolls
-     *  inside and the pager / action bar stays pinned. `false` restores page
-     *  scroll (table grows with its rows, pager below the last row, form footer
-     *  in the flow). */
-    readonly fillHeight?: boolean;
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    /** Derived by buildAppSchema — see EntityEditScreenDefinition.urlPrefillFields. */
-    readonly urlPrefillFields?: readonly string[];
-    /** Derived by buildAppSchema from the `excludedFields` of the called `handler`; the form
-     *  shows these fields read-only, not required and never in the payload. An authored value is overwritten. */
-    readonly writeExcludedFields?: readonly string[];
-    /** Submit is enabled without edits: values seeded from navigate `params` count as the
-     *  user's intent. Every required field the layout hides with `visible: false` must hold a
-     *  value, otherwise submit stays disabled (boot-checked against navigate `params`). */
-    readonly submitPrefilled?: boolean;
-    /** Write-Handler-QN der bei Submit gerufen wird. Form-Object landet
-     *  1:1 als payload — Handler-Schema (Zod) validiert weiter. */
-    readonly handler: string;
-    /** Form-Shape: Field-Map pro Name. Nutzt dieselben FieldDefinitions
-     *  wie Entity-Felder. Mindestens ein Feld erforderlich (Boot-
-     *  Validator).
-     *
-     *  A `money` field here must name its own currency source: this screen
-     *  has no entity whose `defaultCurrency` it could inherit (fw#2839). */
-    readonly fields: Readonly<Record<string, FormFieldDefinition>>;
-    /** Fields computed from other fields, shown read-only and recomputed on every
-     *  change. A `listSum` over an empty list without `whenEmpty` leaves the field
-     *  a normal input, and then the client value counts. Otherwise the client value
-     *  is never trusted: the handler must wrap its schema with
-     *  `withFormDerivations(schema, screen)`, which the boot validator enforces.
-     *  A field read only as `whenEmpty` operand is read-only while every such list has rows. */
-    readonly derive?: Readonly<Record<string, FormFieldDerivation>>;
-    /** Layout analog zu EntityEditScreen: sections mit fields aus dem
-     *  fields-Map oben. */
-    readonly layout: EditLayout;
-    /** Per-field label i18n key override, same type/semantics as
-     *  `EntityEditScreenDefinition.fieldLabels`. Falls back to the convention when absent. */
-    readonly fieldLabels?: Readonly<Record<string, string>>;
-    /** i18n-key für den Submit-Button. Default: i18n-Default des
-     *  Renderers (typischerweise "actions.submit"). */
-    readonly submitLabel?: string;
-    /** Extra buttons in the form footer next to the submit button. A click
-     *  applies `patch` to the form values, then submits the form (same
-     *  validation, same handler) — e.g. a "Mark as posted" button that sets
-     *  `posted: true`. The patched field need not be rendered by the layout.
-     *  Order in the array = order in the footer, before the submit button. */
-    readonly footerActions?: readonly ActionFormFooterAction[];
-    /** Context box above the fields (i18n keys). `{name}` placeholders resolve from the
-     *  drawer prefill (`params` of the opening row action), formatted for display. */
-    readonly summary?: {
-        readonly title: string;
-        readonly subtitle?: string;
-    };
-    /** Visual style of the submit button. "danger" renders it red — for a form
-     *  whose handler is destructive (terminate, revoke, delete), so the warning
-     *  isn't lost on the way from the calling screen to this one. Default "primary". */
-    readonly submitStyle?: "primary" | "danger";
-    /** i18n key of a confirmation shown above the form after a successful submit
-     *  when the screen stays put (no `redirect`, not drawer-hosted). `{field}`
-     *  placeholders resolve from the submitted values; a `reference` field shows
-     *  the chosen record's label (its `labelField`), not the id — so a
-     *  cross-tenant admin form can name the record it just changed. */
-    readonly successMessage?: string;
-    /** Navigate to this screen ID after a successful submit: either a short
-     *  ID (e.g. "item-list" — same feature, the nav-router resolves to the
-     *  full path) or a fully-qualified cross-feature QN
-     *  (`<feature>:screen:<id>`). If not set, the user stays on the form
-     *  screen. Boot-validator checks that the target resolves to a
-     *  registered screen. A cross-feature QN hard-couples this feature to
-     *  the target at boot time — an app that doesn't mount the target
-     *  feature fails the boot-validator; only use this form in a reusable
-     *  feature when the target feature is guaranteed to be mounted
-     *  alongside it.
-     *
-     *  The object form additionally names the success-payload field the
-     *  navigation id comes from (`ActionFormRedirect.idFrom`) — needed when
-     *  the handler creates a child record but the target screen is the
-     *  parent's detail screen (fw#2670). */
-    readonly redirect?: string | ActionFormRedirect;
-    /** Links shown in the success box after a successful submit while the
-     *  screen stays put. Targets resolve like `redirect` (the id comes from the
-     *  handler's success payload); a link without a string id is hidden.
-     *  Mutually exclusive with `redirect`. */
-    readonly successLinks?: readonly ActionFormSuccessLink[];
-    /** Key figures from the handler's success payload, shown in the success box
-     *  while the screen stays put (e.g. charged/skipped/failed of a batch run).
-     *  Mutually exclusive with `redirect`. */
-    readonly successFacts?: readonly ActionFormSuccessFact[];
-    /** Reset the form to its initial values after a successful submit (prefill
-     *  kept, typed values cleared). Only applies while the screen stays put,
-     *  i.e. without `redirect`. */
-    readonly resetOnSuccess?: boolean;
-    /** Load the initial values from a query. The record id comes from the route
-     *  (or the drawer row id) and is sent as `{ [idParam]: id }`; the result,
-     *  picked to `fields`, becomes the initial values. Turns URL prefill off:
-     *  search params never reach the form. */
-    readonly load?: ActionFormLoad;
-    /** Target of the Cancel button. Default: `redirect` (historical
-     *  behavior — Cancel and the submit-redirect then land in the same
-     *  place). `false` = no Cancel button; correct for single-action
-     *  screens with no discardable state (e.g. "Send test mail"), where
-     *  Cancel would just be a second path to the same target. Accepts the
-     *  same string targets as `redirect` (short ID or cross-feature QN);
-     *  boot-validator checks it. A cross-feature QN hard-couples this
-     *  feature to the target at boot time — an app that doesn't mount the
-     *  target feature fails the boot-validator; only use this form in a
-     *  reusable feature when the target feature is guaranteed to be
-     *  mounted alongside it. */
-    readonly cancelTarget?: string | false;
-    /** Parent list screen (short id) for breadcrumb + nav highlighting when
-     *  this screen has no nav entry of its own. Same field/semantics as on
-     *  `custom`/`projectionDetail`/`entityEdit`; an explicit value here wins
-     *  over the rowAction heuristic. */
-    readonly listScreenId?: string;
-    readonly slots?: ScreenSlots;
-    readonly access?: AccessRule;
-};
-export type ActionFormFooterAction = {
-    /** Stable id (kebab-case), used for the test id. */
-    readonly id: string;
-    /** i18n key. */
-    readonly label: string;
-    readonly icon?: IconKey;
-    /** Button style. Default "secondary". */
-    readonly variant?: "primary" | "secondary" | "danger";
-    /** Form values set before the submit. JSON-safe literals only. */
-    readonly patch: Readonly<Record<string, string | number | boolean | null>>;
-};
-/** Redirect target plus the success-payload field carrying the navigation
- *  id. The write-handler reports the id of what it wrote (`data.id`); when
- *  that record is a child and the target screen shows its parent, the
- *  parent id has to be read from a different field instead of forcing the
- *  handler to misreport its own result (fw#2670). */
-export type ActionFormRedirect = {
-    /** Same target forms as the string `redirect`: short screen ID
-     *  (same-feature) or a fully-qualified cross-feature screen QN. */
-    readonly screen: string;
-    /** Flat field name in the handler's success payload, e.g. "leaseId".
-     *  Only used when the target screen type carries an id (`entityEdit`,
-     *  `projectionDetail`); a non-string or missing value navigates without
-     *  an id, same as a payload without `id` does today. */
-    readonly idFrom: string;
-    /** Section id to open on the target `projectionDetail` with `layout.mode:
-     *  "tabs"` (the `tab` search param, same as `ToolbarAction` navigate `tab`).
-     *  Boot rejects other targets and unknown section ids. */
-    readonly tab?: string;
-};
-export type ActionFormLoad = {
-    /** Query QN that returns the record. */
-    readonly query: string;
-    /** Payload key carrying the record id (default "id"). */
-    readonly idParam?: string;
-    /** The query picks the row from the caller's tenant/session context, so the
-     *  form loads without a record id and the query is called WITHOUT `idParam`
-     *  (same semantics as `ProjectionDetailScreenDefinition.singleton`). Boot
-     *  rejects declaring `idParam` alongside it. */
-    readonly singleton?: boolean;
-};
-/** One key figure of the success box, read from the handler's success payload. */
-export type ActionFormSuccessFact = {
-    /** Flat field name in the handler's success payload. A number or string is
-     *  shown as one value, an array a comma-separated list (numbers, strings and
-     *  `{ label }` objects). A missing field hides the fact. */
-    readonly field: string;
-    /** Label (i18n key). */
-    readonly label: string;
-};
-/** A redirect target rendered as a link in the success box. */
-export type ActionFormSuccessLink = Omit<ActionFormRedirect, "idFrom"> & {
-    /** Success-payload field carrying the navigation id. Required for a record
-     *  target (`entityEdit`, `projectionDetail`); omit it for a list, dashboard
-     *  or form target, which opens without an id. */
-    readonly idFrom?: string;
-    /** Link text (i18n key). */
-    readonly label: string;
-};
-/** Author-declared field shown once after a mint-form submit — API token,
- *  recovery codes, similar one-time secrets. */
-export type SecretRevealField = {
-    /** Flat field name in the handler's success payload. */
-    readonly field: string;
-    /** i18n key for this value's label. */
-    readonly label: string;
-    /** "code" (default) renders one monospaced value; "list" renders a
-     *  string-array payload one value per line (recovery codes); "qr" renders
-     *  the value as a scannable QR code (otpauth://-style enrollment URI) —
-     *  platforms without a QR-capable SecretReveal primitive fall back to the
-     *  monospaced text display. */
-    readonly display?: "code" | "list" | "qr";
-    /** Default true — offer a copy-to-clipboard control next to the value. */
-    readonly copyable?: boolean;
-};
-/** Post-reveal proof-of-receipt step. A mint whose effect is only armed once
- *  the user proves they received the secret (TOTP enrollment: scan the code,
- *  then enter one) declares it here — the reveal card renders this form in
- *  place of the bare acknowledge button. */
-export type SecretMintConfirmStep = {
-    /** Write-handler QN dispatched when the confirm form is submitted. */
-    readonly handler: string;
-    readonly fields: Readonly<Record<string, FormFieldDefinition>>;
-    readonly layout: EditLayout;
-    /** Mint success-payload fields merged into the confirm payload (e.g. a
-     *  short-lived setup token). Held in component state only — never rendered,
-     *  never in the URL, a query cache, nav or a persisted draft. */
-    readonly carry?: readonly string[];
-    readonly submitLabel?: string;
-    /** i18n key for the banner shown after a successful confirm when the screen
-     *  declares no `redirect`. Default "kumiko.secretMint.done". */
-    readonly doneMessage?: string;
-};
-export type SecretReveal = {
-    readonly fields: readonly SecretRevealField[];
-    /** i18n key. Default "kumiko.secretMint.title". */
-    readonly title?: string;
-    /** i18n key for the "this is the only time you see it" warning.
-     *  Default "kumiko.secretMint.warning". */
-    readonly warning?: string;
-    /** i18n key for the acknowledge button. Default "kumiko.secretMint.confirm". */
-    readonly confirmLabel?: string;
-    /** i18n key for a checkbox on the reveal card ("I have saved my recovery
-     *  codes"). While unchecked, the confirm step's submit or the acknowledge
-     *  button stays disabled. The tick is UI-only and never part of a payload. */
-    readonly acknowledge?: string;
-};
-/** Mint form → one-time reveal → explicit confirm. The secret (API token,
- *  recovery codes) lives only in the write-handler's own success payload —
- *  no stored value backs it, so no query can redisplay it later. That gap
- *  is why this needs its own screen type instead of a flag on `actionForm`,
- *  which discards the success payload after extracting the navigation id. */
-export type SecretMintScreenDefinition = {
-    readonly id: string;
-    readonly type: "secretMint";
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    /** Derived by buildAppSchema — see EntityEditScreenDefinition.urlPrefillFields. */
-    readonly urlPrefillFields?: readonly string[];
-    /** Submit is enabled without edits: values seeded from navigate `params` count as the
-     *  user's intent. Every required field the layout hides with `visible: false` must hold a
-     *  value, otherwise submit stays disabled (boot-checked against navigate `params`). */
-    readonly submitPrefilled?: boolean;
-    /** Write-handler QN dispatched on submit. */
-    readonly handler: string;
-    readonly fields: Readonly<Record<string, FormFieldDefinition>>;
-    readonly layout: EditLayout;
-    /** Navigate here after the reveal is confirmed. Short id (same-feature) or
-     *  a fully-qualified cross-feature screen QN — no result-id navigation
-     *  form exists here (unlike `ActionFormScreenDefinition.redirect`), since
-     *  the confirmed screen carries no entity id to thread through. */
-    readonly redirect?: string;
-    readonly cancelTarget?: string | false;
-    readonly listScreenId?: string;
-    readonly access?: AccessRule;
-    readonly reveal: SecretReveal;
-    /** i18n-key for the mint button. Default: renderer's own default. */
-    readonly submitLabel?: string;
-    /** Proof-of-receipt step rendered on the reveal card in place of the bare
-     *  acknowledge button — see `SecretMintConfirmStep` doc. */
-    readonly confirm?: SecretMintConfirmStep;
-};
-export type CustomScreenRoute = {
-    readonly path: string;
-    readonly component: PlatformComponent;
-};
-export type CustomScreenDefinition = {
-    readonly id: string;
-    readonly type: "custom";
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    readonly renderer: PlatformComponent;
-    readonly routes?: readonly CustomScreenRoute[];
-    /** Parent list screen for breadcrumb when this detail is not in nav. */
-    readonly listScreenId?: string;
-    readonly access?: AccessRule;
-    /** This screen is registered without a self-owned `r.nav()` entry by
-     *  design — an app opts in by navving it explicitly (e.g. a settings-area
-     *  self-service screen). `createKumikoApp`'s boot diagnostic
-     *  (kumiko-framework#2025) skips dormant screens instead of flagging
-     *  every consumer that doesn't mount the client plugin as a false
-     *  positive (kumiko-framework#2034). Only set this on screens the
-     *  feature itself never navs — a screen the feature DOES nav still needs
-     *  its client plugin mounted by every consumer, and should keep
-     *  triggering the diagnostic if it's missing. Also gates the
-     *  boot-validator's nav-area check, same as `dormant` on other screens. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-};
-export type ConfigEditScreenDefinition = {
-    readonly id: string;
-    readonly type: "configEdit";
-    /** Default true: the form fills the shell content height with a pinned
-     *  footer. `false` restores the card layout with the footer in the flow. */
-    readonly fillHeight?: boolean;
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    /** scope für config:write:set Calls. Muss zur Scope-Deklaration der
-     *  in `configKeys` referenzierten Keys passen — Boot-Validator
-     *  prüft das gegen die Registry. */
-    readonly scope: "tenant" | "system" | "user";
-    /** Map: form-field-name (kurz, wie im Layout referenziert) → voll-
-     *  qualifizierter Config-Key (`<feature>:config:<short>`). Boot-
-     *  Validator prüft dass jeder qualifizierte Key in der Registry
-     *  bekannt ist. */
-    readonly configKeys: Readonly<Record<string, string>>;
-    /** Field name → qualified secret key (`<feature>:secret:<short>`), tenant scope only.
-     *  Such a field is a writeOnly text field with no `configKeys` entry; the same save
-     *  writes it through secrets:write:set (or secrets:write:delete on removal). */
-    readonly secretKeys?: Readonly<Record<string, string>>;
-    /** Form-Shape pro Field-Name. Selbe FieldDefinitions wie auf
-     *  Entities/ActionForm. Field-Names matchen die Keys in `configKeys`
-     *  — Boot-Validator pinnt das. */
-    readonly fields: Readonly<Record<string, FieldDefinition>>;
-    /** Layout: Sections mit Field-Refs. Identisch zu entityEdit/
-     *  actionForm. */
-    readonly layout: EditLayout;
-    /** Optionaler per-Field-Label-i18n-Key (Field-Name → Key). Der
-     *  Settings-Hub setzt hier `mask.title` des jeweiligen Config-Keys,
-     *  damit das am Key deklarierte Label am generierten Feld erscheint —
-     *  ohne es unter der `__config-edit__`-Konvention zu duplizieren.
-     *  Fehlt ein Eintrag, gilt die Konvention. */
-    readonly fieldLabels?: Readonly<Record<string, string>>;
-    /** Per-field help text i18n key (Field-Name → Key), from `mask.description`. */
-    readonly fieldDescriptions?: Readonly<Record<string, string>>;
-    /** Field names whose config key declares `required: true` — drives the
-     *  "Not set. Required." origin line, not form validation. */
-    readonly requiredFields?: readonly string[];
-    /** i18n-key für den Submit-Button. Default: "kumiko.actions.save". */
-    readonly submitLabel?: string;
-    readonly slots?: ScreenSlots;
-    readonly access?: AccessRule;
-};
-export type SecretsEditSection = {
-    readonly title?: string;
-    readonly fields: readonly string[];
-};
-export type SecretsEditScreenDefinition = {
-    readonly id: string;
-    readonly type: "secretsEdit";
-    readonly nav?: ScreenNavSugar;
-    readonly detailFor?: string;
-    readonly description?: string;
-    readonly agent?: AgentScreenHints;
-    /** Screen has no nav entry by design (opened via link or navved by the
-     *  app); exempts it from the nav-area boot check. */
-    readonly dormant?: boolean;
-    /** UI-only gate, also on direct URL access; handlers still enforce access. Unmet or failed renders `fallback`. */
-    readonly visibleWhen?: DashboardPanelVisibility;
-    /** Same-feature short id or cross-feature QN `<feature>:screen:<id>` shown when `visibleWhen` is unmet (default: standard notice). */
-    readonly fallback?: string;
-    /** field id -> qualified secret name (`<feature>:secret:<kebab>`). */
-    readonly secretKeys: Readonly<Record<string, string>>;
-    /** field id -> i18n key for the label. */
-    readonly fieldLabels: Readonly<Record<string, string>>;
-    /** field id -> i18n key for the hint, only where the declaration carries one. */
-    readonly fieldHints?: Readonly<Record<string, string>>;
-    /** field ids whose declaration set `required: true`. */
-    readonly requiredFields?: readonly string[];
-    /** field id -> write access derived from the key's `writeRoles`. The screen
-     *  hides fields the viewer fails; UI only, the secrets write gate stays
-     *  authoritative. */
-    readonly fieldAccess?: Readonly<Record<string, AccessRule>>;
-    readonly sections: readonly SecretsEditSection[];
-    readonly access?: AccessRule;
-};
 export type ScreenSlots = {
     readonly header?: PlatformComponent;
     /** entityEdit / actionForm: rendered on the right of the form title, same row. */
@@ -1977,3 +107,11 @@ export type ScreenNavSugar = {
     readonly order?: number;
 };
 export type ScreenDefinition = EntityListScreenDefinition | ProjectionListScreenDefinition | ProjectionDetailScreenDefinition | DashboardScreenDefinition | EntityEditScreenDefinition | ActionFormScreenDefinition | ConfigEditScreenDefinition | SecretsEditScreenDefinition | SecretMintScreenDefinition | CustomScreenDefinition;
+export type { ActionFormFooterAction, ActionFormLoad, ActionFormRedirect, ActionFormScreenDefinition, ActionFormSuccessFact, ActionFormSuccessLink, FormFieldDerivation, FormFieldDerivationWithoutList, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, } from "./screen-action-form.ts";
+export type { ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, SecretsEditScreenDefinition, SecretsEditSection, } from "./screen-custom-config.ts";
+export type { DashboardChartKind, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardChartTone, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelEmptyState, DashboardPanelGate, DashboardPanelQueryOptions, DashboardPanelSpan, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScopeDefinition, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardStatTone, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardTimeRangeDefinition, DashboardValueFormat, } from "./screen-dashboard.ts";
+export { DASHBOARD_MIN_REFRESH_SECONDS, DASHBOARD_STAT_TONES } from "./screen-dashboard.ts";
+export type { EditExtensionSection, EditFieldGroup, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityWriteExcludedFields, FieldAffix, FieldFillAction, FormWidth, ListEmptyStateSpec, RelatedListGroupBy, RelatedListRowTone, } from "./screen-entity-edit.ts";
+export { relatedListGroupHeaderLabel, relatedListGroupKey } from "./screen-entity-edit.ts";
+export type { EntityListExpandableRow, EntityListFacetConfig, EntityListFacetExtraOption, EntityListScreenDefinition, ListBadgeTone, ListColumnDisplay, ListColumnSpec, ListPaginationMode, ListSortDir, ListSortSpec, RelatedListToolbarAction, RowAction, RowActionClientAction, RowActionDisplay, RowActionDrawer, RowActionMode, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenFilter, ScreenFilterOp, ToolbarAction, } from "./screen-entity-list.ts";
+export type { ListFacetSpec, MetricNavigate, MetricSpec, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, } from "./screen-projection.ts";