@cosmicdrift/kumiko-framework 0.327.0 → 0.328.1

package/src/engine/boot-validator/security-baseline.ts

@@ -1,26 +0,0 @@
-import type { FeatureDefinition } from "../types";
-
-export const SECURITY_BASELINE_FEATURE_NAMES = [
-  "sessions",
-  "crypto-shredding",
-  "rate-limiting",
-  "audit",
-] as const;
-
-export function warnOnMissingSecurityBaseline(
-  features: readonly FeatureDefinition[],
-  nodeEnv: string | undefined = process.env["NODE_ENV"],
-): void {
-  // skip: baseline is only enforced for production boots
-  if (nodeEnv !== "production") return;
-
-  const mountedNames = new Set(features.map((f) => f.name));
-  const missing = SECURITY_BASELINE_FEATURE_NAMES.filter((name) => !mountedNames.has(name));
-  // skip: every baseline feature is mounted
-  if (missing.length === 0) return;
-
-  // biome-ignore lint/suspicious/noConsole: boot-time hint, no logger available yet
-  console.warn(
-    `[kumiko:boot] NODE_ENV=production but the security baseline is incomplete — missing feature(s): ${missing.join(", ")}. Mount securityBaselineFeatures() from @cosmicdrift/kumiko-bundled-features/presets (or the missing features individually).`,
-  );
-}

package/src/engine/boot-validator/transfer-graph.ts

@@ -1,135 +0,0 @@
-import { parseRefTargetEntityName } from "../parse-ref-target";
-import type { EntityDefinition, FeatureDefinition } from "../types";
-
-// --- Transfer-graph boot validation (fw#3088) ---
-//
-// tenant-handover walks an entity graph across the tenant boundary along two
-// declared edge kinds: `parentRef` and plain `reference` fields. Two shapes
-// cannot be walked, and both have to fail loudly here rather than silently
-// leaving rows behind in the source tenant — the partial move is exactly what
-// #3088 exists to end.
-//
-// Scoped to entities declaring `transferable: true`, so a consumer that has
-// one of these shapes but never hands that entity over is unaffected.
-
-// The single definition of the limit. It lives here rather than next to the
-// resolver in bundled-features because the dependency only runs that way:
-// bundled-features imports from the framework, never the reverse.
-//
-// Guards against a schema whose reference edges span more levels than anyone
-// intended — a runaway graph would move rows an operator never associated with
-// the handover. Deliberately a constant and not per-feature config: the limit
-// is a safety net, and a configurable one gets raised by whoever trips it
-// instead of prompting them to reconsider their graph.
-export const MAX_TRANSFER_DEPTH = 5;
-
-type EntityEntry = { readonly name: string; readonly entity: EntityDefinition };
-
-function allEntities(featureMap: ReadonlyMap<string, FeatureDefinition>): readonly EntityEntry[] {
-  const out: EntityEntry[] = [];
-  for (const feature of featureMap.values()) {
-    for (const [name, entity] of Object.entries(feature.entities ?? {})) {
-      out.push({ name, entity });
-    }
-  }
-  return out;
-}
-
-function referenceTargets(entity: EntityDefinition): readonly string[] {
-  const targets: string[] = [];
-  for (const field of Object.values(entity.fields)) {
-    if (field.type !== "reference") continue;
-    if (field.multiple === true) continue;
-    targets.push(parseRefTargetEntityName(field.entity));
-  }
-  return targets;
-}
-
-// A `multiple` reference stores a jsonb array of ids, which the handover's
-// `= ANY($ids)` column match cannot address. Declaring one on a transferable
-// entity would mean its rows never move with their host.
-function validateNoMultipleReferenceEdge(entry: EntityEntry, featureName: string): void {
-  // skip: the entity never travels, so the shape that would strand its rows
-  // during a handover cannot arise — rejecting it would break consumers that
-  // legitimately declare a multiple reference on a non-transferable entity.
-  if (entry.entity.transferable !== true) return;
-  for (const [fieldName, field] of Object.entries(entry.entity.fields)) {
-    if (field.type !== "reference" || field.multiple !== true) continue;
-    throw new Error(
-      `[Kumiko TransferGraph] entity "${entry.name}" declares transferable: true and a ` +
-        `multiple reference field "${fieldName}" -> "${field.entity}" (feature: "${featureName}"). ` +
-        `A multiple reference stores a jsonb array, which the tenant-handover transfer graph ` +
-        `cannot match rows on — those rows would stay behind in the source tenant. ` +
-        `Fix: model the link as a single reference on the owning side, or drop transferable ` +
-        `from "${entry.name}".`,
-    );
-  }
-}
-
-// Depth is measured over reference edges between transferable entities, the
-// only chain that nests (parentRef is one level by construction — see
-// engine/boot-validator/parent-ref.ts).
-//
-// `onPath` counts NODES, the limit counts EDGES: a chain of exactly
-// MAX_TRANSFER_DEPTH edges holds MAX_TRANSFER_DEPTH + 1 entities, and the
-// mover runs MAX_TRANSFER_DEPTH rounds of one hop each, so it still walks that
-// chain whole. Rejecting it here would make a schema the mover handles
-// correctly refuse to boot.
-function longestTransferableChain(
-  startName: string,
-  bySource: ReadonlyMap<string, readonly string[]>,
-  onPath: readonly string[],
-): readonly string[] | undefined {
-  if (onPath.length > MAX_TRANSFER_DEPTH + 1) return onPath;
-  for (const target of bySource.get(startName) ?? []) {
-    // skip: a cycle revisits a type already on this path, and schema depth
-    // cannot measure how far it actually runs — that depends on the rows, not
-    // the declaration. The mover carries this one instead, failing with
-    // `transfer_graph_too_deep` when its rounds run out (#3131).
-    if (onPath.includes(target)) continue;
-    const deeper = longestTransferableChain(target, bySource, [...onPath, target]);
-    if (deeper !== undefined) return deeper;
-  }
-  return undefined;
-}
-
-export function validateTransferGraph(
-  feature: FeatureDefinition,
-  featureMap: ReadonlyMap<string, FeatureDefinition>,
-): void {
-  for (const [name, entity] of Object.entries(feature.entities ?? {})) {
-    validateNoMultipleReferenceEdge({ name, entity }, feature.name);
-  }
-
-  const transferable = new Set(
-    allEntities(featureMap)
-      .filter((e) => e.entity.transferable === true)
-      .map((e) => e.name),
-  );
-  // Edges point child -> parent in the schema; the graph walks parent -> child,
-  // so the lookup is inverted here.
-  const childrenByParent = new Map<string, string[]>();
-  for (const { name, entity } of allEntities(featureMap)) {
-    if (!transferable.has(name)) continue;
-    for (const target of referenceTargets(entity)) {
-      if (!transferable.has(target)) continue;
-      const children = childrenByParent.get(target) ?? [];
-      children.push(name);
-      childrenByParent.set(target, children);
-    }
-  }
-
-  for (const [name, entity] of Object.entries(feature.entities ?? {})) {
-    if (entity.transferable !== true) continue;
-    const tooDeep = longestTransferableChain(name, childrenByParent, [name]);
-    if (tooDeep !== undefined) {
-      throw new Error(
-        `[Kumiko TransferGraph] the transfer graph rooted at entity "${name}" is deeper than ` +
-          `the ${MAX_TRANSFER_DEPTH}-level limit (feature: "${feature.name}"): ` +
-          `${tooDeep.join(" -> ")}. Beyond that depth tenant-handover would move fewer rows ` +
-          `than the declaration implies. Fix: flatten the chain, or drop transferable from an ` +
-          `entity in it that should not move with its host.`,
-      );
-    }
-  }
-}

package/src/engine/boot-validator/url-prefill-fields.ts

@@ -1,178 +0,0 @@
-import { qualifyEntityName } from "../qualified-name";
-import type { FeatureDefinition } from "../types";
-import type {
-  EditRelatedListSection,
-  ProjectionDetailScreenDefinition,
-  RowFieldExtractor,
-  ScreenDefinition,
-} from "../types/screen";
-import {
-  collectScreensByShortId,
-  readsNavigateParamsAsFormPrefill,
-  rowFieldExtractorKeys,
-} from "./screens";
-
-type NavigateParamsSource = {
-  readonly screen?: string;
-  readonly entity?: string;
-  readonly entityId?: string;
-  readonly params: RowFieldExtractor;
-  readonly sourceScreenEntity: string | undefined;
-};
-
-type NavigateActionLike = {
-  readonly kind?: string;
-  readonly screen?: string;
-  readonly entity?: string;
-  readonly entityId?: string;
-  readonly params?: RowFieldExtractor;
-};
-type ScopedNavigateAction = {
-  readonly action: NavigateActionLike;
-  readonly sourceScreenEntity: string | undefined;
-  /** Used when the action itself declares no `params` — the field a
-   *  relatedList toolbarAction's parent id lands under at runtime
-   *  (RelatedListSection's `navigatePrefill`, related-list-section.tsx). */
-  readonly implicitParams?: RowFieldExtractor;
-};
-
-function isNavigateKind(action: NavigateActionLike): boolean {
-  return action.kind === undefined || action.kind === "navigate";
-}
-function scopeActions(
-  actions: readonly NavigateActionLike[] | undefined,
-  sourceScreenEntity: string | undefined,
-  implicitParams?: RowFieldExtractor,
-): ScopedNavigateAction[] {
-  return (actions ?? []).map((action) => ({ action, sourceScreenEntity, implicitParams }));
-}
-// Same key the renderer falls back to when a relatedList toolbarAction has no
-// `params` of its own: `parentFilter.field`, else `parentParam`, else "id".
-function relatedListParentParamField(section: EditRelatedListSection): string {
-  return section.parentFilter?.field ?? section.parentParam ?? "id";
-}
-function projectionDetailNavigateActions(
-  screen: ProjectionDetailScreenDefinition,
-): ScopedNavigateAction[] {
-  return [
-    ...scopeActions(screen.actions, screen.detailFor),
-    ...screen.layout.sections.flatMap((section) =>
-      section.kind === "relatedList" ? scopeActions(section.rowActions, undefined) : [],
-    ),
-    ...screen.layout.sections.flatMap((section) =>
-      section.kind === "relatedList"
-        ? scopeActions(section.toolbarActions, undefined, {
-            pick: [relatedListParentParamField(section)],
-          })
-        : [],
-    ),
-    ...(screen.metrics ?? []).flatMap((metric) =>
-      typeof metric === "string" || metric.navigate === undefined
-        ? []
-        : scopeActions([metric.navigate], undefined),
-    ),
-  ];
-}
-function navigateActionsOf(screen: ScreenDefinition): ScopedNavigateAction[] {
-  switch (screen.type) {
-    case "entityList":
-      return scopeActions(screen.rowActions, screen.entity);
-    case "projectionList":
-      return scopeActions(screen.rowActions, undefined);
-    case "entityEdit":
-      return scopeActions(screen.actions, screen.entity);
-    case "projectionDetail":
-      return projectionDetailNavigateActions(screen);
-    default:
-      return [];
-  }
-}
-function toNavigateParamsSource(
-  action: NavigateActionLike,
-  params: RowFieldExtractor,
-  sourceScreenEntity: string | undefined,
-): NavigateParamsSource {
-  return {
-    ...(action.screen !== undefined && { screen: action.screen }),
-    ...(action.entity !== undefined && { entity: action.entity }),
-    ...(action.entityId !== undefined && { entityId: action.entityId }),
-    params,
-    sourceScreenEntity,
-  };
-}
-
-// Every declarative navigate that writes params into the target's URL —
-// the same sources validateScreens pairs with validateRowActionNavigateParams,
-// plus projectionDetail metrics (runMetricNavigate), which reuse that shape —
-// plus a relatedList toolbarAction with no `params` of its own, which still
-// writes its implicit parent-id param at runtime (see `implicitParams`).
-function navigateParamsSources(screen: ScreenDefinition): NavigateParamsSource[] {
-  return navigateActionsOf(screen).flatMap(({ action, sourceScreenEntity, implicitParams }) => {
-    if (!isNavigateKind(action)) return [];
-    const params = action.params ?? implicitParams;
-    return params === undefined ? [] : [toNavigateParamsSource(action, params, sourceScreenEntity)];
-  });
-}
-
-// Per target screen QN, the union of field names any navigate `params` may
-// prefill from the URL. A form screen absent from the map accepts no URL prefill.
-export function collectUrlPrefillFieldsByScreenQn(
-  features: readonly FeatureDefinition[],
-): Map<string, Set<string>> {
-  const screensByShortId = collectScreensByShortId(features);
-  const detailForByEntity = new Map<
-    string,
-    { readonly featureName: string; readonly shortId: string; readonly screen: ScreenDefinition }
-  >();
-  for (const feature of features) {
-    for (const [shortId, screen] of Object.entries(feature.screens)) {
-      if (screen.detailFor !== undefined && !detailForByEntity.has(screen.detailFor)) {
-        detailForByEntity.set(screen.detailFor, { featureName: feature.name, shortId, screen });
-      }
-    }
-  }
-
-  const result = new Map<string, Set<string>>();
-  for (const feature of features) {
-    for (const screen of Object.values(feature.screens)) {
-      for (const source of navigateParamsSources(screen)) {
-        const target = resolveTarget(source, screensByShortId, detailForByEntity);
-        if (target === undefined) continue;
-        const explicitEntityId =
-          source.entity !== undefined ? (source.entityId ?? "id") : source.entityId;
-        if (
-          !readsNavigateParamsAsFormPrefill(
-            target.screen,
-            explicitEntityId,
-            source.sourceScreenEntity,
-          )
-        ) {
-          continue;
-        }
-        const qn = qualifyEntityName(target.featureName, "screen", target.shortId);
-        const fields = result.get(qn) ?? new Set<string>();
-        for (const key of rowFieldExtractorKeys(source.params)) fields.add(key);
-        result.set(qn, fields);
-      }
-    }
-  }
-  return result;
-}
-
-// Runtime resolution: a bare screen id matches the first feature registering
-// it (create-app's router); an entity target opens its detailFor screen with an id.
-function resolveTarget(
-  source: NavigateParamsSource,
-  screensByShortId: ReturnType<typeof collectScreensByShortId>,
-  detailForByEntity: ReadonlyMap<
-    string,
-    { readonly featureName: string; readonly shortId: string; readonly screen: ScreenDefinition }
-  >,
-):
-  | { readonly featureName: string; readonly shortId: string; readonly screen: ScreenDefinition }
-  | undefined {
-  if (source.entity !== undefined) return detailForByEntity.get(source.entity);
-  if (source.screen === undefined) return undefined;
-  const match = screensByShortId.get(source.screen)?.[0];
-  return match === undefined ? undefined : { ...match, shortId: source.screen };
-}

package/src/engine/boot-validator/workspaces.ts

@@ -1,106 +0,0 @@
-// Workspace validation.
-
-import { SETTINGS_HUB_AUDIENCE_NAV_QNS } from "../build-config-feature-schema";
-import { qualifyEntityName } from "../qualified-name";
-import type { FeatureDefinition, NavDefinition, WorkspaceDefinition } from "../types";
-
-// --- Workspace validation ---
-//
-// Per-app workspace registry, built once up front. Carries `featureName`
-// alongside the definition so error messages can point at the offending
-// feature without a parallel reverse index.
-
-export function collectWorkspaceQns(
-  features: readonly FeatureDefinition[],
-): Map<string, WorkspaceDefinition & { readonly featureName: string }> {
-  const map = new Map<string, WorkspaceDefinition & { readonly featureName: string }>();
-  for (const f of features) {
-    for (const [wsId, wsDef] of Object.entries(f.workspaces)) {
-      const qualified = qualifyEntityName(f.name, "workspace", wsId);
-      map.set(qualified, { ...wsDef, featureName: f.name });
-    }
-  }
-  return map;
-}
-
-export function validateWorkspaces(
-  feature: FeatureDefinition,
-  allNavQns: ReadonlyMap<string, NavDefinition & { readonly featureName: string }>,
-): void {
-  for (const [wsId, wsDef] of Object.entries(feature.workspaces)) {
-    if (wsDef.nav !== undefined) {
-      for (const navQn of wsDef.nav) {
-        // Settings-Hub audience navs are generated post-boot (buildAppSchema), never via r.nav() — exempt so an inline-placement reference doesn't trip the boot validator.
-        if (SETTINGS_HUB_AUDIENCE_NAV_QN_SET.has(navQn)) continue;
-        if (!allNavQns.has(navQn)) {
-          throw new Error(
-            `[Feature ${feature.name}] Workspace "${wsId}" references nav "${navQn}" ` +
-              `which is not registered. Expected a qualified name of the form ` +
-              `"<feature>:nav:<id>" pointing at an r.nav() declaration.`,
-          );
-        }
-      }
-    }
-  }
-}
-
-const SETTINGS_HUB_AUDIENCE_NAV_QN_SET: ReadonlySet<string> = new Set(
-  SETTINGS_HUB_AUDIENCE_NAV_QNS,
-);
-
-// fw#3019: apps that assign navs to workspaces via `r.workspace({ nav })`
-// or `r.nav({ workspaces })` never pass an explicit navAllowlist (solon#113)
-// — without this, warnOnUnreachableNavScreens never runs for them. Both
-// `WorkspaceDefinition.nav` and `NavDefinition.workspaces` already hold
-// fully-qualified QNs (validateWorkspaces/validateNavs compare them
-// directly against allNavQns/allWorkspaceQns), so no re-qualification is
-// needed here.
-export function deriveNavAllowlistFromWorkspaces(
-  allNavQns: ReadonlyMap<string, NavDefinition & { readonly featureName: string }>,
-  allWorkspaceQns: ReadonlyMap<string, WorkspaceDefinition & { readonly featureName: string }>,
-): ReadonlySet<string> {
-  const allowlist = new Set<string>();
-  for (const wsDef of allWorkspaceQns.values()) {
-    for (const navQn of wsDef.nav ?? []) {
-      allowlist.add(navQn);
-    }
-  }
-  for (const [navQn, navDef] of allNavQns) {
-    if (navDef.workspaces !== undefined && navDef.workspaces.length > 0) {
-      allowlist.add(navQn);
-    }
-  }
-  return allowlist;
-}
-
-// App-provided navAllowlist always wins (app knowledge beats derivation).
-// Falling back to derivation only when the app has workspaces at all avoids
-// flagging every nav as unreachable in a workspace-free app.
-export function resolveNavAllowlist(
-  explicitAllowlist: ReadonlySet<string> | undefined,
-  allNavQns: ReadonlyMap<string, NavDefinition & { readonly featureName: string }>,
-  allWorkspaceQns: ReadonlyMap<string, WorkspaceDefinition & { readonly featureName: string }>,
-): ReadonlySet<string> | undefined {
-  if (explicitAllowlist !== undefined) return explicitAllowlist;
-  if (allWorkspaceQns.size === 0) return undefined;
-  return deriveNavAllowlistFromWorkspaces(allNavQns, allWorkspaceQns);
-}
-
-// Single-default rule across the entire app. Mirrors how createApp validates
-// roles up front — a second `default: true` is a configuration error, not a
-// runtime fallback. Apps without any default fall back to "first workspace
-// the user has access to" at render time (handled by shellWorkspaces).
-export function validateDefaultWorkspaceUniqueness(
-  allWorkspaceQns: ReadonlyMap<string, WorkspaceDefinition & { readonly featureName: string }>,
-): void {
-  const defaults: string[] = [];
-  for (const [qn, ws] of allWorkspaceQns) {
-    if (ws.default === true) defaults.push(qn);
-  }
-  if (defaults.length > 1) {
-    throw new Error(
-      `[Kumiko Workspaces] Multiple workspaces declare default: true — ` +
-        `${defaults.join(", ")}. At most one workspace per app may be the default.`,
-    );
-  }
-}

package/src/engine/boot-validator/zod-shape.ts

@@ -1,142 +0,0 @@
-import {
-  ZodArray,
-  ZodCatch,
-  ZodDefault,
-  ZodIntersection,
-  ZodLazy,
-  ZodNonOptional,
-  ZodNullable,
-  ZodObject,
-  ZodOptional,
-  ZodPipe,
-  ZodPrefault,
-  ZodReadonly,
-  ZodRecord,
-  ZodTuple,
-  type ZodType,
-  ZodUnion,
-  ZodXor,
-} from "zod";
-import type { $ZodType } from "zod/v4/core";
-
-// Drills through wrapper types (.nullable(), .optional(), .default()) a
-// handler's schema may use around its actual object/array shape — e.g. a
-// detail query returning `Row | null` when the record doesn't exist.
-// Bounded to avoid looping on a pathological schema.
-function unwrapZodType(schema: ZodType): ZodType {
-  let current: ZodType = schema;
-  for (let i = 0; i < 8; i++) {
-    if (
-      current instanceof ZodOptional ||
-      current instanceof ZodNullable ||
-      current instanceof ZodDefault
-    ) {
-      // @cast-boundary schema-walk — Zod v4's .unwrap() types its result as
-      // the core $ZodType, not the z.ZodType wrapper; same runtime instance
-      // (see env/_zod-introspect.ts for the same drill on ZodDefault/Optional).
-      current = current.unwrap() as ZodType;
-      continue;
-    }
-    break;
-  }
-  return current;
-}
-
-// Non-ZodObject schemas (e.g. a z.union across payload shapes) and an
-// absent schema both fall through to "shape unknown" — callers treat that
-// as "capability absent" and skip the check rather than throwing, the same
-// policy projection-list-screens.ts already uses for input-schema checks.
-export function getZodObjectShape(
-  schema: ZodType | undefined,
-): Record<string, ZodType> | undefined {
-  if (schema === undefined) return undefined;
-  const unwrapped = unwrapZodType(schema);
-  return unwrapped instanceof ZodObject ? unwrapped.shape : undefined;
-}
-
-// The shape of one row for a query whose result follows the paged-list
-// contract `{ rows: T[], nextCursor, total? }` (projectionList/relatedList/
-// dashboard-list `query`) — unwraps `rows` (a ZodArray) to its element
-// schema, then that element's own shape.
-export function getZodRowShape(schema: ZodType | undefined): Record<string, ZodType> | undefined {
-  const objectShape = getZodObjectShape(schema);
-  const rowsField = objectShape?.["rows"];
-  if (rowsField === undefined) return undefined;
-  const rowsArray = unwrapZodType(rowsField);
-  // @cast-boundary schema-walk — same core-vs-wrapper gap as .unwrap() above.
-  return rowsArray instanceof ZodArray
-    ? getZodObjectShape(rowsArray.element as ZodType)
-    : undefined;
-}
-
-type SingleInnerSchema =
-  | ZodOptional
-  | ZodNullable
-  | ZodDefault
-  | ZodPrefault
-  | ZodNonOptional
-  | ZodCatch
-  | ZodReadonly
-  | ZodLazy;
-
-const SINGLE_INNER_SCHEMA_CLASSES = [
-  ZodOptional,
-  ZodNullable,
-  ZodDefault,
-  ZodPrefault,
-  ZodNonOptional,
-  ZodCatch,
-  ZodReadonly,
-  ZodLazy,
-] as const;
-
-function isSingleInnerSchema(schema: $ZodType): schema is SingleInnerSchema {
-  return SINGLE_INNER_SCHEMA_CLASSES.some((schemaClass) => schema instanceof schemaClass);
-}
-
-function combinatorChildSchemas(schema: $ZodType): readonly $ZodType[] {
-  if (schema instanceof ZodUnion || schema instanceof ZodXor) return schema.options;
-  if (schema instanceof ZodIntersection) return [schema.def.left, schema.def.right];
-  // z.preprocess() carries the accepted shape on `out`, .transform() on `in`.
-  if (schema instanceof ZodPipe) return [schema.in, schema.out];
-  return [];
-}
-
-function childSchemas(schema: $ZodType): readonly $ZodType[] {
-  if (schema instanceof ZodObject) return Object.values(schema.shape);
-  if (schema instanceof ZodArray) return [schema.element];
-  if (schema instanceof ZodRecord) return [schema.valueType];
-  if (schema instanceof ZodTuple) {
-    const { items, rest } = schema.def;
-    return rest ? [...items, rest] : items;
-  }
-  if (isSingleInnerSchema(schema)) return [schema.unwrap()];
-  return combinatorChildSchemas(schema);
-}
-
-// A z.lazy() getter that builds a fresh schema per call never revisits a node.
-const MAX_WALKED_SCHEMAS = 10_000;
-
-// Object keys at any depth, so a field nested in an intersection, union or an
-// update's `changes` object is found too.
-export function collectZodObjectKeys(schema: $ZodType | undefined): ReadonlySet<string> {
-  const keys = new Set<string>();
-  if (schema === undefined) return keys;
-  const visited = new Set<$ZodType>();
-  const pending: $ZodType[] = [schema];
-  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
-    if (visited.has(next)) continue;
-    if (visited.size >= MAX_WALKED_SCHEMAS) {
-      throw new Error(
-        `collectZodObjectKeys: schema has more than ${MAX_WALKED_SCHEMAS} nodes — ` +
-          "a z.lazy() getter probably returns a new schema on every call; hoist it into a constant.",
-      );
-    }
-    visited.add(next);
-    if (next instanceof ZodObject) {
-      for (const key of Object.keys(next.shape)) keys.add(key);
-    }
-    pending.push(...childSchemas(next));
-  }
-  return keys;
-}

package/src/engine/boot-validator.ts

@@ -1,8 +0,0 @@
-export {
-  collectWriteHandlerQns,
-  MAX_TRANSFER_DEPTH,
-  SECURITY_BASELINE_FEATURE_NAMES,
-  type ValidateBootOptions,
-  validateAppCustomScreenWriteQns,
-  validateBoot,
-} from "./boot-validator/index";