@cosmicdrift/kumiko-framework 0.328.0 → 0.328.1

package/dist/engine/boot-validator/security-baseline.d.ts

@@ -0,0 +1,3 @@
+import type { FeatureDefinition } from "../types/index.js";
+export declare const SECURITY_BASELINE_FEATURE_NAMES: readonly ["sessions", "crypto-shredding", "rate-limiting", "audit"];
+export declare function warnOnMissingSecurityBaseline(features: readonly FeatureDefinition[], nodeEnv?: string | undefined): void;

package/dist/engine/boot-validator/security-baseline.js

@@ -0,0 +1,18 @@
+export const SECURITY_BASELINE_FEATURE_NAMES = [
+    "sessions",
+    "crypto-shredding",
+    "rate-limiting",
+    "audit",
+];
+export function warnOnMissingSecurityBaseline(features, nodeEnv = process.env["NODE_ENV"]) {
+    // skip: baseline is only enforced for production boots
+    if (nodeEnv !== "production")
+        return;
+    const mountedNames = new Set(features.map((f) => f.name));
+    const missing = SECURITY_BASELINE_FEATURE_NAMES.filter((name) => !mountedNames.has(name));
+    // skip: every baseline feature is mounted
+    if (missing.length === 0)
+        return;
+    // biome-ignore lint/suspicious/noConsole: boot-time hint, no logger available yet
+    console.warn(`[kumiko:boot] NODE_ENV=production but the security baseline is incomplete — missing feature(s): ${missing.join(", ")}. Mount securityBaselineFeatures() from @cosmicdrift/kumiko-bundled-features/presets (or the missing features individually).`);
+}

package/dist/engine/boot-validator/transfer-graph.d.ts

@@ -0,0 +1,3 @@
+import type { FeatureDefinition } from "../types/index.js";
+export declare const MAX_TRANSFER_DEPTH = 5;
+export declare function validateTransferGraph(feature: FeatureDefinition, featureMap: ReadonlyMap<string, FeatureDefinition>): void;

package/dist/engine/boot-validator/transfer-graph.js

@@ -0,0 +1,120 @@
+import { parseRefTargetEntityName } from "../parse-ref-target.js";
+// --- Transfer-graph boot validation (fw#3088) ---
+//
+// tenant-handover walks an entity graph across the tenant boundary along two
+// declared edge kinds: `parentRef` and plain `reference` fields. Two shapes
+// cannot be walked, and both have to fail loudly here rather than silently
+// leaving rows behind in the source tenant — the partial move is exactly what
+// #3088 exists to end.
+//
+// Scoped to entities declaring `transferable: true`, so a consumer that has
+// one of these shapes but never hands that entity over is unaffected.
+// The single definition of the limit. It lives here rather than next to the
+// resolver in bundled-features because the dependency only runs that way:
+// bundled-features imports from the framework, never the reverse.
+//
+// Guards against a schema whose reference edges span more levels than anyone
+// intended — a runaway graph would move rows an operator never associated with
+// the handover. Deliberately a constant and not per-feature config: the limit
+// is a safety net, and a configurable one gets raised by whoever trips it
+// instead of prompting them to reconsider their graph.
+export const MAX_TRANSFER_DEPTH = 5;
+function allEntities(featureMap) {
+    const out = [];
+    for (const feature of featureMap.values()) {
+        for (const [name, entity] of Object.entries(feature.entities ?? {})) {
+            out.push({ name, entity });
+        }
+    }
+    return out;
+}
+function referenceTargets(entity) {
+    const targets = [];
+    for (const field of Object.values(entity.fields)) {
+        if (field.type !== "reference")
+            continue;
+        if (field.multiple === true)
+            continue;
+        targets.push(parseRefTargetEntityName(field.entity));
+    }
+    return targets;
+}
+// A `multiple` reference stores a jsonb array of ids, which the handover's
+// `= ANY($ids)` column match cannot address. Declaring one on a transferable
+// entity would mean its rows never move with their host.
+function validateNoMultipleReferenceEdge(entry, featureName) {
+    // skip: the entity never travels, so the shape that would strand its rows
+    // during a handover cannot arise — rejecting it would break consumers that
+    // legitimately declare a multiple reference on a non-transferable entity.
+    if (entry.entity.transferable !== true)
+        return;
+    for (const [fieldName, field] of Object.entries(entry.entity.fields)) {
+        if (field.type !== "reference" || field.multiple !== true)
+            continue;
+        throw new Error(`[Kumiko TransferGraph] entity "${entry.name}" declares transferable: true and a ` +
+            `multiple reference field "${fieldName}" -> "${field.entity}" (feature: "${featureName}"). ` +
+            `A multiple reference stores a jsonb array, which the tenant-handover transfer graph ` +
+            `cannot match rows on — those rows would stay behind in the source tenant. ` +
+            `Fix: model the link as a single reference on the owning side, or drop transferable ` +
+            `from "${entry.name}".`);
+    }
+}
+// Depth is measured over reference edges between transferable entities, the
+// only chain that nests (parentRef is one level by construction — see
+// engine/boot-validator/parent-ref.ts).
+//
+// `onPath` counts NODES, the limit counts EDGES: a chain of exactly
+// MAX_TRANSFER_DEPTH edges holds MAX_TRANSFER_DEPTH + 1 entities, and the
+// mover runs MAX_TRANSFER_DEPTH rounds of one hop each, so it still walks that
+// chain whole. Rejecting it here would make a schema the mover handles
+// correctly refuse to boot.
+function longestTransferableChain(startName, bySource, onPath) {
+    if (onPath.length > MAX_TRANSFER_DEPTH + 1)
+        return onPath;
+    for (const target of bySource.get(startName) ?? []) {
+        // skip: a cycle revisits a type already on this path, and schema depth
+        // cannot measure how far it actually runs — that depends on the rows, not
+        // the declaration. The mover carries this one instead, failing with
+        // `transfer_graph_too_deep` when its rounds run out (#3131).
+        if (onPath.includes(target))
+            continue;
+        const deeper = longestTransferableChain(target, bySource, [...onPath, target]);
+        if (deeper !== undefined)
+            return deeper;
+    }
+    return undefined;
+}
+export function validateTransferGraph(feature, featureMap) {
+    for (const [name, entity] of Object.entries(feature.entities ?? {})) {
+        validateNoMultipleReferenceEdge({ name, entity }, feature.name);
+    }
+    const transferable = new Set(allEntities(featureMap)
+        .filter((e) => e.entity.transferable === true)
+        .map((e) => e.name));
+    // Edges point child -> parent in the schema; the graph walks parent -> child,
+    // so the lookup is inverted here.
+    const childrenByParent = new Map();
+    for (const { name, entity } of allEntities(featureMap)) {
+        if (!transferable.has(name))
+            continue;
+        for (const target of referenceTargets(entity)) {
+            if (!transferable.has(target))
+                continue;
+            const children = childrenByParent.get(target) ?? [];
+            children.push(name);
+            childrenByParent.set(target, children);
+        }
+    }
+    for (const [name, entity] of Object.entries(feature.entities ?? {})) {
+        if (entity.transferable !== true)
+            continue;
+        const tooDeep = longestTransferableChain(name, childrenByParent, [name]);
+        if (tooDeep !== undefined) {
+            throw new Error(`[Kumiko TransferGraph] the transfer graph rooted at entity "${name}" is deeper than ` +
+                `the ${MAX_TRANSFER_DEPTH}-level limit (feature: "${feature.name}"): ` +
+                `${tooDeep.join(" -> ")}. Beyond that depth tenant-handover would move fewer rows ` +
+                `than the declaration implies. Fix: flatten the chain, or drop transferable from an ` +
+                `entity in it that should not move with its host.`);
+        }
+    }
+}

package/dist/engine/boot-validator/url-prefill-fields.d.ts

@@ -0,0 +1,2 @@
+import type { FeatureDefinition } from "../types/index.js";
+export declare function collectUrlPrefillFieldsByScreenQn(features: readonly FeatureDefinition[]): Map<string, Set<string>>;

package/dist/engine/boot-validator/url-prefill-fields.js

@@ -0,0 +1,106 @@
+import { qualifyEntityName } from "../qualified-name.js";
+import { collectScreensByShortId, readsNavigateParamsAsFormPrefill, rowFieldExtractorKeys, } from "./screens.js";
+function isNavigateKind(action) {
+    return action.kind === undefined || action.kind === "navigate";
+}
+function scopeActions(actions, sourceScreenEntity, implicitParams) {
+    return (actions ?? []).map((action) => ({ action, sourceScreenEntity, implicitParams }));
+}
+// Same key the renderer falls back to when a relatedList toolbarAction has no
+// `params` of its own: `parentFilter.field`, else `parentParam`, else "id".
+function relatedListParentParamField(section) {
+    return section.parentFilter?.field ?? section.parentParam ?? "id";
+}
+function projectionDetailNavigateActions(screen) {
+    return [
+        ...scopeActions(screen.actions, screen.detailFor),
+        ...screen.layout.sections.flatMap((section) => section.kind === "relatedList" ? scopeActions(section.rowActions, undefined) : []),
+        ...screen.layout.sections.flatMap((section) => section.kind === "relatedList"
+            ? scopeActions(section.toolbarActions, undefined, {
+                pick: [relatedListParentParamField(section)],
+            })
+            : []),
+        ...(screen.metrics ?? []).flatMap((metric) => typeof metric === "string" || metric.navigate === undefined
+            ? []
+            : scopeActions([metric.navigate], undefined)),
+    ];
+}
+function navigateActionsOf(screen) {
+    switch (screen.type) {
+        case "entityList":
+            return scopeActions(screen.rowActions, screen.entity);
+        case "projectionList":
+            return scopeActions(screen.rowActions, undefined);
+        case "entityEdit":
+            return scopeActions(screen.actions, screen.entity);
+        case "projectionDetail":
+            return projectionDetailNavigateActions(screen);
+        default:
+            return [];
+    }
+}
+function toNavigateParamsSource(action, params, sourceScreenEntity) {
+    return {
+        ...(action.screen !== undefined && { screen: action.screen }),
+        ...(action.entity !== undefined && { entity: action.entity }),
+        ...(action.entityId !== undefined && { entityId: action.entityId }),
+        params,
+        sourceScreenEntity,
+    };
+}
+// Every declarative navigate that writes params into the target's URL —
+// the same sources validateScreens pairs with validateRowActionNavigateParams,
+// plus projectionDetail metrics (runMetricNavigate), which reuse that shape —
+// plus a relatedList toolbarAction with no `params` of its own, which still
+// writes its implicit parent-id param at runtime (see `implicitParams`).
+function navigateParamsSources(screen) {
+    return navigateActionsOf(screen).flatMap(({ action, sourceScreenEntity, implicitParams }) => {
+        if (!isNavigateKind(action))
+            return [];
+        const params = action.params ?? implicitParams;
+        return params === undefined ? [] : [toNavigateParamsSource(action, params, sourceScreenEntity)];
+    });
+}
+// Per target screen QN, the union of field names any navigate `params` may
+// prefill from the URL. A form screen absent from the map accepts no URL prefill.
+export function collectUrlPrefillFieldsByScreenQn(features) {
+    const screensByShortId = collectScreensByShortId(features);
+    const detailForByEntity = new Map();
+    for (const feature of features) {
+        for (const [shortId, screen] of Object.entries(feature.screens)) {
+            if (screen.detailFor !== undefined && !detailForByEntity.has(screen.detailFor)) {
+                detailForByEntity.set(screen.detailFor, { featureName: feature.name, shortId, screen });
+            }
+        }
+    }
+    const result = new Map();
+    for (const feature of features) {
+        for (const screen of Object.values(feature.screens)) {
+            for (const source of navigateParamsSources(screen)) {
+                const target = resolveTarget(source, screensByShortId, detailForByEntity);
+                if (target === undefined)
+                    continue;
+                const explicitEntityId = source.entity !== undefined ? (source.entityId ?? "id") : source.entityId;
+                if (!readsNavigateParamsAsFormPrefill(target.screen, explicitEntityId, source.sourceScreenEntity)) {
+                    continue;
+                }
+                const qn = qualifyEntityName(target.featureName, "screen", target.shortId);
+                const fields = result.get(qn) ?? new Set();
+                for (const key of rowFieldExtractorKeys(source.params))
+                    fields.add(key);
+                result.set(qn, fields);
+            }
+        }
+    }
+    return result;
+}
+// Runtime resolution: a bare screen id matches the first feature registering
+// it (create-app's router); an entity target opens its detailFor screen with an id.
+function resolveTarget(source, screensByShortId, detailForByEntity) {
+    if (source.entity !== undefined)
+        return detailForByEntity.get(source.entity);
+    if (source.screen === undefined)
+        return undefined;
+    const match = screensByShortId.get(source.screen)?.[0];
+    return match === undefined ? undefined : { ...match, shortId: source.screen };
+}

package/dist/engine/boot-validator/workspaces.d.ts

@@ -0,0 +1,20 @@
+import type { FeatureDefinition, NavDefinition, WorkspaceDefinition } from "../types/index.js";
+export declare function collectWorkspaceQns(features: readonly FeatureDefinition[]): Map<string, WorkspaceDefinition & {
+    readonly featureName: string;
+}>;
+export declare function validateWorkspaces(feature: FeatureDefinition, allNavQns: ReadonlyMap<string, NavDefinition & {
+    readonly featureName: string;
+}>): void;
+export declare function deriveNavAllowlistFromWorkspaces(allNavQns: ReadonlyMap<string, NavDefinition & {
+    readonly featureName: string;
+}>, allWorkspaceQns: ReadonlyMap<string, WorkspaceDefinition & {
+    readonly featureName: string;
+}>): ReadonlySet<string>;
+export declare function resolveNavAllowlist(explicitAllowlist: ReadonlySet<string> | undefined, allNavQns: ReadonlyMap<string, NavDefinition & {
+    readonly featureName: string;
+}>, allWorkspaceQns: ReadonlyMap<string, WorkspaceDefinition & {
+    readonly featureName: string;
+}>): ReadonlySet<string> | undefined;
+export declare function validateDefaultWorkspaceUniqueness(allWorkspaceQns: ReadonlyMap<string, WorkspaceDefinition & {
+    readonly featureName: string;
+}>): void;

package/dist/engine/boot-validator/workspaces.js

@@ -0,0 +1,81 @@
+// Workspace validation.
+import { SETTINGS_HUB_AUDIENCE_NAV_QNS } from "../build-config-feature-schema.js";
+import { qualifyEntityName } from "../qualified-name.js";
+// --- Workspace validation ---
+//
+// Per-app workspace registry, built once up front. Carries `featureName`
+// alongside the definition so error messages can point at the offending
+// feature without a parallel reverse index.
+export function collectWorkspaceQns(features) {
+    const map = new Map();
+    for (const f of features) {
+        for (const [wsId, wsDef] of Object.entries(f.workspaces)) {
+            const qualified = qualifyEntityName(f.name, "workspace", wsId);
+            map.set(qualified, { ...wsDef, featureName: f.name });
+        }
+    }
+    return map;
+}
+export function validateWorkspaces(feature, allNavQns) {
+    for (const [wsId, wsDef] of Object.entries(feature.workspaces)) {
+        if (wsDef.nav !== undefined) {
+            for (const navQn of wsDef.nav) {
+                // Settings-Hub audience navs are generated post-boot (buildAppSchema), never via r.nav() — exempt so an inline-placement reference doesn't trip the boot validator.
+                if (SETTINGS_HUB_AUDIENCE_NAV_QN_SET.has(navQn))
+                    continue;
+                if (!allNavQns.has(navQn)) {
+                    throw new Error(`[Feature ${feature.name}] Workspace "${wsId}" references nav "${navQn}" ` +
+                        `which is not registered. Expected a qualified name of the form ` +
+                        `"<feature>:nav:<id>" pointing at an r.nav() declaration.`);
+                }
+            }
+        }
+    }
+}
+const SETTINGS_HUB_AUDIENCE_NAV_QN_SET = new Set(SETTINGS_HUB_AUDIENCE_NAV_QNS);
+// fw#3019: apps that assign navs to workspaces via `r.workspace({ nav })`
+// or `r.nav({ workspaces })` never pass an explicit navAllowlist (solon#113)
+// — without this, warnOnUnreachableNavScreens never runs for them. Both
+// `WorkspaceDefinition.nav` and `NavDefinition.workspaces` already hold
+// fully-qualified QNs (validateWorkspaces/validateNavs compare them
+// directly against allNavQns/allWorkspaceQns), so no re-qualification is
+// needed here.
+export function deriveNavAllowlistFromWorkspaces(allNavQns, allWorkspaceQns) {
+    const allowlist = new Set();
+    for (const wsDef of allWorkspaceQns.values()) {
+        for (const navQn of wsDef.nav ?? []) {
+            allowlist.add(navQn);
+        }
+    }
+    for (const [navQn, navDef] of allNavQns) {
+        if (navDef.workspaces !== undefined && navDef.workspaces.length > 0) {
+            allowlist.add(navQn);
+        }
+    }
+    return allowlist;
+}
+// App-provided navAllowlist always wins (app knowledge beats derivation).
+// Falling back to derivation only when the app has workspaces at all avoids
+// flagging every nav as unreachable in a workspace-free app.
+export function resolveNavAllowlist(explicitAllowlist, allNavQns, allWorkspaceQns) {
+    if (explicitAllowlist !== undefined)
+        return explicitAllowlist;
+    if (allWorkspaceQns.size === 0)
+        return undefined;
+    return deriveNavAllowlistFromWorkspaces(allNavQns, allWorkspaceQns);
+}
+// Single-default rule across the entire app. Mirrors how createApp validates
+// roles up front — a second `default: true` is a configuration error, not a
+// runtime fallback. Apps without any default fall back to "first workspace
+// the user has access to" at render time (handled by shellWorkspaces).
+export function validateDefaultWorkspaceUniqueness(allWorkspaceQns) {
+    const defaults = [];
+    for (const [qn, ws] of allWorkspaceQns) {
+        if (ws.default === true)
+            defaults.push(qn);
+    }
+    if (defaults.length > 1) {
+        throw new Error(`[Kumiko Workspaces] Multiple workspaces declare default: true — ` +
+            `${defaults.join(", ")}. At most one workspace per app may be the default.`);
+    }
+}

package/dist/engine/boot-validator/zod-shape.d.ts

@@ -0,0 +1,5 @@
+import { type ZodType } from "zod";
+import type { $ZodType } from "zod/v4/core";
+export declare function getZodObjectShape(schema: ZodType | undefined): Record<string, ZodType> | undefined;
+export declare function getZodRowShape(schema: ZodType | undefined): Record<string, ZodType> | undefined;
+export declare function collectZodObjectKeys(schema: $ZodType | undefined): ReadonlySet<string>;

package/dist/engine/boot-validator/zod-shape.js

@@ -0,0 +1,110 @@
+import { ZodArray, ZodCatch, ZodDefault, ZodIntersection, ZodLazy, ZodNonOptional, ZodNullable, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodReadonly, ZodRecord, ZodTuple, ZodUnion, ZodXor, } from "zod";
+// Drills through wrapper types (.nullable(), .optional(), .default()) a
+// handler's schema may use around its actual object/array shape — e.g. a
+// detail query returning `Row | null` when the record doesn't exist.
+// Bounded to avoid looping on a pathological schema.
+function unwrapZodType(schema) {
+    let current = schema;
+    for (let i = 0; i < 8; i++) {
+        if (current instanceof ZodOptional ||
+            current instanceof ZodNullable ||
+            current instanceof ZodDefault) {
+            // @cast-boundary schema-walk — Zod v4's .unwrap() types its result as
+            // the core $ZodType, not the z.ZodType wrapper; same runtime instance
+            // (see env/_zod-introspect.ts for the same drill on ZodDefault/Optional).
+            current = current.unwrap();
+            continue;
+        }
+        break;
+    }
+    return current;
+}
+// Non-ZodObject schemas (e.g. a z.union across payload shapes) and an
+// absent schema both fall through to "shape unknown" — callers treat that
+// as "capability absent" and skip the check rather than throwing, the same
+// policy projection-list-screens.ts already uses for input-schema checks.
+export function getZodObjectShape(schema) {
+    if (schema === undefined)
+        return undefined;
+    const unwrapped = unwrapZodType(schema);
+    return unwrapped instanceof ZodObject ? unwrapped.shape : undefined;
+}
+// The shape of one row for a query whose result follows the paged-list
+// contract `{ rows: T[], nextCursor, total? }` (projectionList/relatedList/
+// dashboard-list `query`) — unwraps `rows` (a ZodArray) to its element
+// schema, then that element's own shape.
+export function getZodRowShape(schema) {
+    const objectShape = getZodObjectShape(schema);
+    const rowsField = objectShape?.["rows"];
+    if (rowsField === undefined)
+        return undefined;
+    const rowsArray = unwrapZodType(rowsField);
+    // @cast-boundary schema-walk — same core-vs-wrapper gap as .unwrap() above.
+    return rowsArray instanceof ZodArray
+        ? getZodObjectShape(rowsArray.element)
+        : undefined;
+}
+const SINGLE_INNER_SCHEMA_CLASSES = [
+    ZodOptional,
+    ZodNullable,
+    ZodDefault,
+    ZodPrefault,
+    ZodNonOptional,
+    ZodCatch,
+    ZodReadonly,
+    ZodLazy,
+];
+function isSingleInnerSchema(schema) {
+    return SINGLE_INNER_SCHEMA_CLASSES.some((schemaClass) => schema instanceof schemaClass);
+}
+function combinatorChildSchemas(schema) {
+    if (schema instanceof ZodUnion || schema instanceof ZodXor)
+        return schema.options;
+    if (schema instanceof ZodIntersection)
+        return [schema.def.left, schema.def.right];
+    // z.preprocess() carries the accepted shape on `out`, .transform() on `in`.
+    if (schema instanceof ZodPipe)
+        return [schema.in, schema.out];
+    return [];
+}
+function childSchemas(schema) {
+    if (schema instanceof ZodObject)
+        return Object.values(schema.shape);
+    if (schema instanceof ZodArray)
+        return [schema.element];
+    if (schema instanceof ZodRecord)
+        return [schema.valueType];
+    if (schema instanceof ZodTuple) {
+        const { items, rest } = schema.def;
+        return rest ? [...items, rest] : items;
+    }
+    if (isSingleInnerSchema(schema))
+        return [schema.unwrap()];
+    return combinatorChildSchemas(schema);
+}
+// A z.lazy() getter that builds a fresh schema per call never revisits a node.
+const MAX_WALKED_SCHEMAS = 10_000;
+// Object keys at any depth, so a field nested in an intersection, union or an
+// update's `changes` object is found too.
+export function collectZodObjectKeys(schema) {
+    const keys = new Set();
+    if (schema === undefined)
+        return keys;
+    const visited = new Set();
+    const pending = [schema];
+    for (let next = pending.pop(); next !== undefined; next = pending.pop()) {
+        if (visited.has(next))
+            continue;
+        if (visited.size >= MAX_WALKED_SCHEMAS) {
+            throw new Error(`collectZodObjectKeys: schema has more than ${MAX_WALKED_SCHEMAS} nodes — ` +
+                "a z.lazy() getter probably returns a new schema on every call; hoist it into a constant.");
+        }
+        visited.add(next);
+        if (next instanceof ZodObject) {
+            for (const key of Object.keys(next.shape))
+                keys.add(key);
+        }
+        pending.push(...childSchemas(next));
+    }
+    return keys;
+}

package/dist/engine/boot-validator.d.ts

@@ -0,0 +1 @@
+export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, type ValidateBootOptions, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";

package/dist/engine/boot-validator.js

@@ -0,0 +1 @@
+export { collectWriteHandlerQns, MAX_TRANSFER_DEPTH, SECURITY_BASELINE_FEATURE_NAMES, validateAppCustomScreenWriteQns, validateBoot, } from "./boot-validator/index.js";

package/dist/engine/build-app-schema.d.ts

@@ -0,0 +1,14 @@
+import type { AppSchema } from "../ui-types/index.js";
+import type { Registry } from "./types/feature.js";
+export type BuildAppSchemaOptions = {
+    /** Dev-server authoring hints (Settings-Hub placement). Default off — only
+     *  `createKumikoServer` opts in; prod boot + unit tests stay silent. */
+    readonly authoringWarnings?: boolean;
+    /** Forwarded onto every FeatureSchema.searchAdapterMissing. Set by the boot
+     *  entrypoint (createKumikoServer, runProdApp) from its own
+     *  context.searchAdapter presence check — buildAppSchema itself has no
+     *  context, only the registry. Omit/false when a SearchAdapter is wired. */
+    readonly searchAdapterMissing?: boolean;
+};
+export declare function buildAppSchema(registry: Registry, options?: BuildAppSchemaOptions): AppSchema;
+export declare function findNonJsonSafePath(value: unknown, path: string): string | null;