@akinon/pz-theme 2.0.31-beta.0 → 2.0.31

package/src/utils/iterator-utils.ts

@@ -1,4 +1,5 @@
 import { Block } from '../theme-block';
+import { devWarn } from './dev-warn';
 
 interface BindingContext {
   sectionDataSource?: any;
@@ -460,9 +461,20 @@ const getIteratorItems = ({
 
   if (dataPath) {
     const resolvedValue = getValueAtPath(bindingRoot, dataPath);
-    return Array.isArray(resolvedValue)
-      ? (resolvedValue as Record<string, unknown>[])
-      : [];
+    if (Array.isArray(resolvedValue)) {
+      return resolvedValue as Record<string, unknown>[];
+    }
+    // A defined-but-non-array result means iteratorDataPath points at the wrong
+    // shape (e.g. a scalar/object instead of a list). Surface it in dev so
+    // authors catch binding typos; an unresolved (undefined) path is left
+    // silent because it is ambiguous with data that has not loaded yet.
+    if (resolvedValue !== undefined) {
+      devWarn(
+        'iterator',
+        `iteratorDataPath "${dataPath}" resolved to a non-array value; rendering no items`
+      );
+    }
+    return [];
   }
 
   if (Array.isArray((bindingRoot as any).items)) {

package/src/utils/safe-clone.ts

@@ -0,0 +1,25 @@
+/**
+ * Deep-clone that never throws during render.
+ *
+ * Uses the existing JSON round-trip for the normal (serializable) case so the
+ * cloned output is byte-identical to the previous behavior, then falls back to
+ * structuredClone (which handles circular references) and finally to the
+ * original reference if the value cannot be cloned at all. This is strictly
+ * better than a bare JSON.parse(JSON.stringify(...)), which throws on
+ * non-serializable values (circular refs, BigInt) and — with no error boundary
+ * around it — used to crash the entire placeholder.
+ */
+export const safeDeepClone = <T>(value: T): T => {
+  try {
+    return JSON.parse(JSON.stringify(value));
+  } catch {
+    if (typeof structuredClone === 'function') {
+      try {
+        return structuredClone(value);
+      } catch {
+        return value;
+      }
+    }
+    return value;
+  }
+};

package/src/utils/visibility-rules.test.ts

@@ -1,7 +1,9 @@
 import {
   evaluateVisibilityRules,
+  normalizeVisibilityRules,
   VisibilityRuleContext
 } from './visibility-rules';
+import { resetDevWarnCacheForTests } from './dev-warn';
 
 const makeContext = (
   overrides: Partial<VisibilityRuleContext> = {}
@@ -153,3 +155,37 @@ describe('evaluateVisibilityRules', () => {
     });
   });
 });
+
+describe('normalizeVisibilityRules — malformed input', () => {
+  let warnSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    resetDevWarnCacheForTests();
+    warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => undefined);
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  it('dev-warns for a truthy-but-non-object value (still fails open)', () => {
+    const rules = normalizeVisibilityRules('oops' as unknown);
+    expect(rules.enabled).toBe(false);
+    expect(warnSpy).toHaveBeenCalledWith(
+      '[pz-theme:visibilityRules] Expected a rules object but received string; ignoring rules (content stays visible)'
+    );
+  });
+
+  it('dev-warns for an array value (reports "an array")', () => {
+    normalizeVisibilityRules([1, 2, 3] as unknown);
+    expect(warnSpy).toHaveBeenCalledWith(
+      '[pz-theme:visibilityRules] Expected a rules object but received an array; ignoring rules (content stays visible)'
+    );
+  });
+
+  it('stays silent for the legitimate "no rules" case (undefined / null)', () => {
+    normalizeVisibilityRules(undefined);
+    normalizeVisibilityRules(null as unknown);
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+});

package/src/utils/visibility-rules.ts

@@ -1,5 +1,6 @@
 import { Block } from '../theme-block';
 import { Section } from '../theme-section';
+import { devWarn } from './dev-warn';
 
 export type VisibilityAuthState = 'all' | 'authenticated' | 'guest';
 export type VisibilityPathMatchType =
@@ -40,6 +41,17 @@ const normalizeStringArray = (value: unknown): string[] => {
 
 export const normalizeVisibilityRules = (value: unknown): VisibilityRules => {
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    // A truthy-but-non-object value (string, number, array) is a malformed
+    // rules config; it fails open (content stays visible). undefined/null is
+    // the legitimate "no rules" case and stays silent.
+    if (value) {
+      devWarn(
+        'visibilityRules',
+        `Expected a rules object but received ${
+          Array.isArray(value) ? 'an array' : typeof value
+        }; ignoring rules (content stays visible)`
+      );
+    }
     return {
       enabled: false,
       authState: 'all',