@cosmicdrift/kumiko-framework 0.328.0 → 0.328.1

package/dist/engine/build-app-schema.js

@@ -0,0 +1,494 @@
+// Erzeugt aus einer Server-Registry das client-safe AppSchema das die
+// Browser-Renderer-Pipeline konsumiert. Genauer Zweck: dev-server kann
+// die ganze hand-geschriebene `clientSchema`-Spiegelung abschaffen, der
+// Server schickt einfach das aufgelöste AppSchema beim Boot mit.
+//
+// JSON-Safety: Wir projezieren explizit auf eine Whitelist statt
+// JSON.stringify-roundtripping. Functions würden silent gedroppt und
+// Zod-Schemas (v4 hat .toJSON, aber emittiert ein _zod-Envelope) würden
+// als komische Ghost-Properties auftauchen. Das hier ist ein bewusster
+// Vertrag: was die Browser-Renderer-Pipeline liest, taucht hier auf.
+// Neue Browser-needed-Fields müssen explizit erweitert werden.
+//
+// Aktuell projeziert (Stand 2026-04-25):
+//   Entity:    { table?, fields: { type, required?, sortable?, default? } }
+//   Screen:    verbatim (ScreenDefinition ist von Haus aus JSON-safe —
+//              custom-screens haben keine functions, layout/columns/etc.
+//              sind plain literals)
+//   Nav:       verbatim (NavDefinition ist nur strings + literals)
+//   Workspace: verbatim definition + getWorkspaceNavs() von der Registry
+//   Translations: verbatim feature.translations (raw r.translations keys,
+//                 unfiltered — see FeatureSchema.translations doc)
+//
+// Feature-Toggles: BISHER NICHT GEFILTERT. Wenn ein Feature über die
+// feature-toggles-bundled-feature global deaktiviert ist, erscheint es
+// trotzdem im AppSchema. Reason: die Toggle-Auflösung lebt im pipeline-
+// dispatcher, nicht in der Registry, und wir haben hier keinen TenantDb-
+// Kontext um sie zu lesen. TODO wenn das ein realer Use-Case wird:
+// `effectiveFeatures` Argument annehmen und über alle iterations filtern.
+import { ZodObject } from "zod";
+import { collectUrlPrefillFieldsByScreenQn } from "./boot-validator/url-prefill-fields.js";
+import { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, } from "./build-config-feature-schema.js";
+import { qualifyEntityName } from "./qualified-name.js";
+export function buildAppSchema(registry, options = {}) {
+    const features = [];
+    const urlPrefillFieldsByScreenQn = collectUrlPrefillFieldsByScreenQn([
+        ...registry.features.values(),
+    ]);
+    for (const [featureName, feature] of registry.features) {
+        const navs = Object.values(feature.navs);
+        // The nav entry alone doesn't say which kind a collection lists, so the
+        // client can't derive its tree provider from `navs` — project the
+        // collections separately, with the nav QN already qualified.
+        const contentCollections = Object.values(feature.contentCollections ?? {}).map((collection) => ({
+            ...collection,
+            navQn: `${featureName}:nav:${collection.id}`,
+        }));
+        const featureSchema = {
+            featureName,
+            entities: projectEntities(feature.entities ?? {}),
+            screens: projectScreens(featureName, feature.screens, registry, urlPrefillFieldsByScreenQn),
+            ...(navs.length > 0 && { navs }),
+            ...(contentCollections.length > 0 && { contentCollections }),
+            // #1059: verbatim r.translations({keys}) — see FeatureSchema.translations
+            // doc for why this must NOT go through registry.getAllTranslations()
+            // (double-prefixes features that already qualify their own keys).
+            ...(Object.keys(feature.translations ?? {}).length > 0 && {
+                translations: feature.translations,
+            }),
+            ...(options.searchAdapterMissing === true && { searchAdapterMissing: true }),
+        };
+        features.push(featureSchema);
+    }
+    // Workspaces: getAllWorkspaces() liefert mit QUALIFIZIERTEN ids (das
+    // schreibt die Registry beim Store-Overwrite ein). Die Browser-
+    // Renderer erwartet aber kurze ids (matcht gegen URL-Segment, gegen
+    // navigate({ workspaceId })). Wir gehen direkt durch `feature.workspaces`
+    // — dort sind die ids noch in der Autor-Form (short) — und ziehen die
+    // pre-resolved navMembers aus der Registry.
+    let workspaces = [];
+    for (const [featureName, feature] of registry.features) {
+        for (const [shortId, definition] of Object.entries(feature.workspaces)) {
+            const qualified = `${featureName}:workspace:${shortId}`;
+            workspaces.push({
+                definition: { ...definition, id: shortId },
+                navMembers: registry.getWorkspaceNavs(qualified),
+            });
+        }
+    }
+    // Self-Populating Settings-Hub: aus den deklarierten Config-Keys mit `mask`
+    // werden Screens/Navs (+ eine Workspace) abgeleitet und hier eingehängt —
+    // kein manuelles r.screen/r.nav am App-Author.
+    const appHadWorkspaces = workspaces.length > 0;
+    const generated = buildConfigFeatureSchema(registry);
+    if (generated.screens.length > 0) {
+        mergeSettingsHubIntoConfigFeature(features, generated);
+        // Flip-Schutz: nur für Apps die schon Workspaces nutzen. Bei einer
+        // workspace-losen App bleibt app.workspaces undefined → der Renderer zeigt
+        // alle Navs ungefiltert, die Hub-Navs inklusive.
+        if (appHadWorkspaces) {
+            const placed = placeSettingsHub(workspaces, generated);
+            workspaces = placed.workspaces;
+            if (placed.standalone !== undefined)
+                workspaces.push(placed.standalone);
+            if (options.authoringWarnings === true) {
+                warnUnplacedAudiences(placed.unplaced);
+                warnDanglingAudienceRefs(placed.danglingRefs);
+            }
+        }
+    }
+    const schema = {
+        features,
+        ...(workspaces.length > 0 && { workspaces }),
+    };
+    if (typeof process !== "undefined" && process.env.NODE_ENV !== "production") {
+        // A stringify-roundtrip comparison can never fire here: JSON.stringify
+        // drops functions/undefined identically on both sides. Walk the value
+        // instead so a leaked function renderer is actually caught.
+        const offender = findNonJsonSafePath(schema, "schema");
+        if (offender !== null) {
+            // biome-ignore lint/suspicious/noConsole: dev-only assertion
+            console.error(`[kumiko] buildAppSchema: Output ist nicht JSON-safe — nicht-serialisierbarer Wert bei "${offender}" (Funktions-Renderer oder Klassen-Instanz im Schema?).`, schema);
+        }
+    }
+    return schema;
+}
+// Hängt die generierten Hub-Screens/Navs an die config-FeatureSchema (qualified
+// dann als config:screen:* / config:nav:*). Existiert sie noch nicht (config
+// bundled-feature nicht gemountet), wird sie angelegt. find-or-create statt
+// fixem Push verhindert eine zweite FeatureSchema mit demselben featureName.
+function mergeSettingsHubIntoConfigFeature(features, generated) {
+    const existing = features.find((f) => f.featureName === SETTINGS_HUB_FEATURE);
+    if (existing === undefined) {
+        features.push({
+            featureName: SETTINGS_HUB_FEATURE,
+            entities: {},
+            screens: generated.screens,
+            navs: generated.navs,
+            ...(generated.translations !== undefined && { translations: generated.translations }),
+        });
+    }
+    else {
+        features[features.indexOf(existing)] = {
+            ...existing,
+            screens: [...existing.screens, ...generated.screens],
+            navs: [...(existing.navs ?? []), ...generated.navs],
+            ...(generated.translations !== undefined && {
+                translations: { ...existing.translations, ...generated.translations },
+            }),
+        };
+    }
+}
+// Audience children referenced via navMembers get attached inline (slice-filter would otherwise hide non-member children); the standalone switcher keeps only unplaced audiences so nothing duplicates or silently vanishes.
+function placeSettingsHub(appWorkspaces, generated) {
+    const prefix = `${SETTINGS_HUB_FEATURE}:nav:`;
+    const audienceShortIds = new Set();
+    const childParent = new Map();
+    const childrenByAudience = new Map();
+    for (const nav of generated.navs) {
+        if (nav.parent === undefined) {
+            audienceShortIds.add(nav.id);
+        }
+        else {
+            childParent.set(nav.id, nav.parent);
+            const list = childrenByAudience.get(nav.parent) ?? [];
+            list.push(nav.id);
+            childrenByAudience.set(nav.parent, list);
+        }
+    }
+    const placedAudiences = new Set();
+    // Config-hub navs a workspace references but that were never generated (no
+    // audience and no known child) — e.g. `config:nav:audience-user` without any
+    // registered user-scope config keys. Otherwise the reference vanishes
+    // silently (silent-skip).
+    const danglingRefs = new Set();
+    const workspaces = appWorkspaces.map((ws) => {
+        const additions = [];
+        for (const member of ws.navMembers) {
+            if (!member.startsWith(prefix))
+                continue;
+            const shortId = member.slice(prefix.length);
+            if (!audienceShortIds.has(shortId)) {
+                if (!childParent.has(shortId))
+                    danglingRefs.add(shortId);
+                continue;
+            }
+            placedAudiences.add(shortId);
+            for (const child of childrenByAudience.get(shortId) ?? []) {
+                const childQn = `${prefix}${child}`;
+                if (!ws.navMembers.includes(childQn) && !additions.includes(childQn)) {
+                    additions.push(childQn);
+                }
+            }
+        }
+        return additions.length > 0 ? { ...ws, navMembers: [...ws.navMembers, ...additions] } : ws;
+    });
+    const audienceOf = (shortId) => audienceShortIds.has(shortId) ? shortId : (childParent.get(shortId) ?? shortId);
+    let standalone;
+    if (generated.workspace !== undefined && placedAudiences.size < audienceShortIds.size) {
+        const remaining = generated.workspace.navMembers.filter((member) => {
+            const shortId = member.startsWith(prefix) ? member.slice(prefix.length) : member;
+            return !placedAudiences.has(audienceOf(shortId));
+        });
+        if (remaining.length > 0)
+            standalone = { ...generated.workspace, navMembers: remaining };
+    }
+    const unplaced = placedAudiences.size > 0 ? [...audienceShortIds].filter((id) => !placedAudiences.has(id)) : [];
+    return { workspaces, standalone, unplaced, danglingRefs: [...danglingRefs] };
+}
+function warnUnplacedAudiences(unplaced) {
+    // skip: every audience placed — nothing to warn about
+    if (unplaced.length === 0)
+        return;
+    // biome-ignore lint/suspicious/noConsole: dev-only authoring hint
+    console.warn(`[kumiko] Settings-Hub: ${unplaced.join(", ")} nicht in einer App-Workspace platziert — ` +
+        `erscheint im Standalone-"Einstellungen"-Tab. Referenziere ` +
+        `${unplaced.map((id) => `${SETTINGS_HUB_FEATURE}:nav:${id}`).join(", ")} ` +
+        `in einer r.workspace.nav, um die Gruppe inline zu zeigen.`);
+}
+function warnDanglingAudienceRefs(dangling) {
+    // skip: no dangling refs — nothing to warn about
+    if (dangling.length === 0)
+        return;
+    // biome-ignore lint/suspicious/noConsole: dev-only authoring hint
+    console.warn(`[kumiko] Settings-Hub: ${dangling
+        .map((id) => `${SETTINGS_HUB_FEATURE}:nav:${id}`)
+        .join(", ")} in einer Workspace referenziert, aber nie generiert — ` +
+        `keine Config-Keys für diesen Scope registriert. Tippfehler oder ` +
+        `vorzeitige Referenz? Der Eintrag rendert sonst unsichtbar.`);
+}
+// PlatformComponent slots ({ react, native }) legitimately hold component
+// functions — JSON.stringify drops them at inject-time and the client
+// re-resolves by name, so the walker treats them as opaque.
+function isPlatformComponentShape(value) {
+    const keys = Object.keys(value);
+    return keys.length > 0 && keys.every((k) => k === "react" || k === "native");
+}
+// Returns the path of the first value JSON.stringify would drop or distort
+// (function, undefined, symbol, bigint, non-finite number, class instance) —
+// or null when the value is JSON-safe apart from PlatformComponent slots.
+export function findNonJsonSafePath(value, path) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return null;
+    if (typeof value === "number")
+        return Number.isFinite(value) ? null : path;
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            const hit = findNonJsonSafePath(value[i], `${path}[${i}]`);
+            if (hit !== null)
+                return hit;
+        }
+        return null;
+    }
+    if (typeof value === "object") {
+        const proto = Object.getPrototypeOf(value);
+        if (proto !== Object.prototype && proto !== null)
+            return path;
+        if (isPlatformComponentShape(value))
+            return null;
+        for (const [key, entry] of Object.entries(value)) {
+            const hit = findNonJsonSafePath(entry, `${path}.${key}`);
+            if (hit !== null)
+                return hit;
+        }
+        return null;
+    }
+    // function, symbol, bigint, undefined
+    return path;
+}
+// projectionList screens don't declare searchable/sortable/paginated as
+// authoring intent — they're derived here from the bound query handler's
+// Zod schema, the source of truth for what parameters it actually accepts
+// (fw#2165). A hand-written `searchable: true` still wins over the derived
+// default (screen.searchable ?? derived); the boot-validator (3a) rejects
+// one that contradicts the schema.
+function projectScreens(featureName, screens, registry, urlPrefillFieldsByScreenQn) {
+    return Object.entries(screens).map(([shortId, screen]) => {
+        if (screen.type === "projectionList")
+            return projectProjectionListScreen(screen, registry);
+        if (screen.type === "actionForm" ||
+            screen.type === "secretMint" ||
+            screen.type === "entityEdit") {
+            const declared = urlPrefillFieldsByScreenQn.get(qualifyEntityName(featureName, "screen", shortId));
+            return { ...screen, urlPrefillFields: declared === undefined ? [] : [...declared].sort() };
+        }
+        return screen;
+    });
+}
+function projectProjectionListScreen(screen, registry) {
+    const schema = registry.getQueryHandler(screen.query)?.schema;
+    const capabilities = deriveProjectionListCapabilities(schema);
+    return {
+        ...screen,
+        searchable: screen.searchable ?? capabilities.searchable,
+        sortable: capabilities.sortable,
+        paginated: capabilities.paginated,
+    };
+}
+// Zod v4: a ZodObject's param names live on `.shape`. A schema that isn't a
+// ZodObject (e.g. a z.union across payload shapes) yields no capability
+// instead of throwing — same as a missing/unresolved query handler.
+function deriveProjectionListCapabilities(schema) {
+    const shape = schema instanceof ZodObject ? schema.shape : undefined;
+    return {
+        searchable: shape !== undefined && "search" in shape,
+        sortable: shape !== undefined && "sort" in shape,
+        paginated: shape !== undefined && ("cursor" in shape || "offset" in shape),
+    };
+}
+function projectEntities(entities) {
+    const out = {};
+    for (const [name, entity] of Object.entries(entities)) {
+        out[name] = projectEntity(entity);
+    }
+    return out;
+}
+// EntityDefinition ist eine Discriminated-Union an Field-Types — wir
+// kennen alle JSON-safe Properties pro Field-Type. Statt jede Variante
+// einzeln auszuhandeln, walken wir die Field-Map und filtern auf die
+// Whitelist. Was nicht durchkommt: Server-only-runtime wie ZodValidate-
+// Functions, Computed-Functions, Default-Functions.
+function projectEntity(entity) {
+    const fieldsOut = {};
+    for (const [fieldName, fieldDef] of Object.entries(entity.fields)) {
+        fieldsOut[fieldName] = projectField(fieldDef);
+    }
+    // derivedFields MÜSSEN mit ins Client-Schema (nur die Metadaten, nicht die
+    // derive-fn): computeListViewModel löst eine entityList-Spalte über
+    // `entity.derivedFields[field].valueType` auf — fehlt der Eintrag, wirft es
+    // "references unknown field". Der executor hat den Wert server-seitig schon
+    // an die Row gehängt; der Client braucht nur den valueType für den Renderer.
+    const derivedOut = {};
+    for (const [name, derivedDef] of Object.entries(entity.derivedFields ?? {})) {
+        derivedOut[name] = projectDerivedField(derivedDef);
+    }
+    // EntityDefinition akzeptiert idType/access/searchWeight als optional —
+    // wir lassen die weg weil der Browser-Renderer sie nicht liest. `table`
+    // schicken wir mit, falls Apps `entity.table` direkt referenzieren.
+    // Kein Cast nötig: alle weggelassenen Felder sind `?`-optional.
+    return {
+        fields: fieldsOut,
+        // @cast-boundary schema-walk: EntityDefinition.derivedFields is typed for
+        // the SERVER (derive required); this is the one place a client schema
+        // narrows it to ClientDerivedFieldDef (valueType only) — the cast lives
+        // at the actual server/client type boundary instead of inside
+        // projectDerivedField, which now honestly returns the narrower type.
+        ...(Object.keys(derivedOut).length > 0 && {
+            derivedFields: derivedOut,
+        }),
+        ...(typeof entity.table === "string" && { table: entity.table }),
+        ...(typeof entity.defaultCurrency === "string" && {
+            defaultCurrency: entity.defaultCurrency,
+        }),
+    };
+}
+// Nur valueType durch — die derive-fn ist Server-only und NICHT JSON-safe
+// (würde sonst die Output-Walk-Guard triggern). Gibt ehrlich
+// ClientDerivedFieldDef zurück statt eine DerivedFieldDef vorzutäuschen,
+// die keine derive-fn hat.
+function projectDerivedField(derivedDef) {
+    return { valueType: derivedDef.valueType };
+}
+// Per-field whitelist. Every forwarded value must be JSON-safe (literal, or
+// an array/plain-object built only from JSON-safe values) — even though the
+// FieldDefinition types only type `default` as a literal, the sample-authoring
+// pattern `as unknown as EntityDefinition` has already let function-valued
+// defaults slip through. This whitelist is defense-in-depth that catches them
+// BEFORE JSON.stringify silently drops them in the browser-injection pipeline.
+// The same check gates the structured properties below (`multiline`,
+// `derived`, `totals`, `totalsMatch`) — a top-level `Array.isArray`/plain-
+// object check alone would let a function survive one level deep.
+//
+// Cast at the exit `as FieldDefinition`: type-system-wise our out-map only
+// satisfies the discriminated union with an unnarrowed `type` string — the
+// cast bridges the variant inference TS can't recompute from a generic
+// Record.
+// kumiko-lint-ignore complexity-budget flat per-property whitelist walk, one independent `if` per FieldDefinition property — same shape as schema-builder.ts's field→zod switch
+function projectField(fieldDef) {
+    const def = fieldDef; // @cast-boundary schema-walk
+    const out = {};
+    if (typeof def["type"] === "string")
+        out["type"] = def["type"];
+    if (typeof def["required"] === "boolean")
+        out["required"] = def["required"];
+    if (typeof def["sortable"] === "boolean")
+        out["sortable"] = def["sortable"];
+    // filterable steuert die Faceted-Filter-Dropdowns im Renderer (select/
+    // boolean) — muss daher ins Client-Schema.
+    if (typeof def["filterable"] === "boolean")
+        out["filterable"] = def["filterable"];
+    if (typeof def["searchable"] === "boolean")
+        out["searchable"] = def["searchable"];
+    if (isJsonSafeValue(def["default"]))
+        out["default"] = def["default"];
+    // Select: options-Liste ist plain JSON, durchschicken.
+    if (Array.isArray(def["options"]))
+        out["options"] = def["options"];
+    if (isPlainObject(def["optionTones"]) && isJsonSafeValue(def["optionTones"]))
+        out["optionTones"] = def["optionTones"];
+    // Reference: entity-Target + labelField + multiple müssen zum Renderer.
+    // Der ReferenceInput baut die Options-Query aus refEntity/refFeature und
+    // resolved das Label über labelField — ohne diese Properties fällt das
+    // Dropdown leer aus (QN wird `<feature>:query::list` → 404).
+    if (typeof def["entity"] === "string")
+        out["entity"] = def["entity"];
+    if (typeof def["labelField"] === "string")
+        out["labelField"] = def["labelField"];
+    if (typeof def["multiple"] === "boolean")
+        out["multiple"] = def["multiple"];
+    // MultiSelect: display picks checkboxes vs. combobox in the renderer,
+    // columns/maxRows size the checkbox grid — without these the renderer
+    // always falls back to the combobox (fw#2494).
+    if (typeof def["display"] === "string")
+        out["display"] = def["display"];
+    if (typeof def["columns"] === "number")
+        out["columns"] = def["columns"];
+    if (typeof def["maxRows"] === "number")
+        out["maxRows"] = def["maxRows"];
+    // text/longText: textarea row count — DefaultInput renders a single-line
+    // input otherwise (fw#2497).
+    if (typeof def["multiline"] === "boolean" ||
+        (isPlainObject(def["multiline"]) && isJsonSafeValue(def["multiline"])))
+        out["multiline"] = def["multiline"];
+    // number: Zod write-boundary bounds. date/timestamp/locatedTimestamp:
+    // ISO-string picker bounds — same keys, different literal type (fw#2497).
+    if (typeof def["min"] === "number" || typeof def["min"] === "string")
+        out["min"] = def["min"];
+    if (typeof def["max"] === "number" || typeof def["max"] === "string")
+        out["max"] = def["max"];
+    // date/timestamp/locatedTimestamp: display/parsing locale override (fw#2497).
+    if (typeof def["locale"] === "string")
+        out["locale"] = def["locale"];
+    // image: which camera a mobile capture opens (fw#2497).
+    if (typeof def["capture"] === "string")
+        out["capture"] = def["capture"];
+    // number: display-only suffix, static or read from a sibling field of the row.
+    const unit = def["unit"];
+    if (typeof unit === "string" || (isPlainObject(unit) && typeof unit["field"] === "string"))
+        out["unit"] = unit;
+    // text: "password" masks the input and blocks URL prefill in the renderer.
+    if (typeof def["format"] === "string")
+        out["format"] = def["format"];
+    // Write-response redaction stays server-side; the renderer needs the flag to
+    // refuse any prefill (URL or handoff) into the field.
+    if (def["sensitive"] === true)
+        out["sensitive"] = true;
+    // timestamp: the edit view-model derives its wall-clock input mode from this.
+    if (typeof def["locatedBy"] === "string")
+        out["locatedBy"] = def["locatedBy"];
+    // file/image/images: upload picker constraints; the first variant key picks
+    // the preview variant.
+    if (Array.isArray(def["accept"]) && isJsonSafeValue(def["accept"]))
+        out["accept"] = def["accept"];
+    if (typeof def["maxSize"] === "string")
+        out["maxSize"] = def["maxSize"];
+    if (isPlainObject(def["variants"]) && isJsonSafeValue(def["variants"]))
+        out["variants"] = def["variants"];
+    // decimal, incl. embedded sub-fields: rounding of derived embedded-list cells.
+    if (typeof def["scale"] === "number")
+        out["scale"] = def["scale"];
+    // money: declared currency source (MoneyCurrencySource, fw#2933) — without
+    // it the renderer can't tell a "currency: { kind: 'tenant' }" field apart
+    // from an undeclared one and always falls back to entity.defaultCurrency.
+    if (isPlainObject(def["currency"]) && isJsonSafeValue(def["currency"]))
+        out["currency"] = def["currency"];
+    // embedded lists: row-count bounds, computed cells, totals row, and the
+    // sibling-money-field totals check (fw#2497).
+    if (typeof def["minItems"] === "number")
+        out["minItems"] = def["minItems"];
+    if (typeof def["maxItems"] === "number")
+        out["maxItems"] = def["maxItems"];
+    if (isPlainObject(def["derived"]) && isJsonSafeValue(def["derived"]))
+        out["derived"] = def["derived"];
+    if (Array.isArray(def["totals"]) && isJsonSafeValue(def["totals"]))
+        out["totals"] = def["totals"];
+    if (isPlainObject(def["totalsMatch"]) && isJsonSafeValue(def["totalsMatch"]))
+        out["totalsMatch"] = def["totalsMatch"];
+    // embedded lists: the sub-field map itself — without it the client-side
+    // edit view-model iterates `undefined` and the screen crashes (fw#2507).
+    // Recursive per sub-field, NOT a blanket isJsonSafeValue gate: a single
+    // sub-field carrying a validator fn would otherwise drop the whole map,
+    // and a blanket copy would ship server internals.
+    if (isPlainObject(def["schema"])) {
+        out["schema"] = Object.fromEntries(Object.entries(def["schema"]).map(([k, v]) => [k, projectField(v)]));
+    }
+    return out; // @cast-boundary schema-walk
+}
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+function isJsonSafeValue(value) {
+    if (value === null)
+        return true;
+    const t = typeof value;
+    if (t === "string" || t === "number" || t === "boolean")
+        return true;
+    if (Array.isArray(value))
+        return value.every(isJsonSafeValue);
+    if (isPlainObject(value))
+        return Object.values(value).every(isJsonSafeValue);
+    return false;
+}

package/dist/engine/build-config-feature-schema.d.ts

@@ -0,0 +1,15 @@
+import type { WorkspaceSchema } from "../ui-types/index.js";
+import type { TranslationKeys } from "./types/config.js";
+import type { Registry } from "./types/feature.js";
+import type { NavDefinition } from "./types/nav.js";
+import type { ScreenDefinition } from "./types/screen.js";
+export declare const SETTINGS_HUB_FEATURE = "config";
+export declare const SETTINGS_HUB_WORKSPACE = "settings";
+export type ConfigFeatureSchema = {
+    readonly screens: readonly ScreenDefinition[];
+    readonly navs: readonly NavDefinition[];
+    readonly workspace?: WorkspaceSchema;
+    readonly translations?: TranslationKeys;
+};
+export declare const SETTINGS_HUB_AUDIENCE_NAV_QNS: readonly string[];
+export declare function buildConfigFeatureSchema(registry: Registry): ConfigFeatureSchema;