@assistant-ui/react-generative-ui 0.0.15 → 0.0.16

package/src/slack/toSlackBlocks.ts

@@ -1,3 +1,11 @@
+import {
+  MAX_TRAVERSAL_DEPTH,
+  boundSpec,
+  clampReasonDetail,
+} from "../convert/boundSpec";
+import { copyBounded } from "../convert/copyBounded";
+import { isElement } from "../convert/isElement";
+import { takeRun } from "../convert/takeRun";
 import {
   normalizeSpec,
   type NormalizedUIElement,
@@ -14,7 +22,6 @@ import {
   CARD_TITLE_CAP,
   CAROUSEL_CARD_CAP,
   CAROUSEL_CARD_MIN,
-  CHILDREN_CAP,
   CONTEXT_ELEMENT_CAP,
   CONTEXT_TEXT_CAP,
   DATA_TABLE_CHAR_BUDGET,
@@ -26,11 +33,8 @@ import {
   INPUT_LABEL_CAP,
   INTERACTIVE_TEXT_CAP,
   MARKDOWN_TEXT_BUDGET,
-  MAX_ELEMENT_DEPTH,
-  MAX_TRAVERSAL_DEPTH,
   MESSAGE_BLOCK_CAP,
   MODAL_BLOCK_CAP,
-  NODE_BUDGET,
   PLACEHOLDER_TEXT_CAP,
   RADIO_OPTION_CAP,
   SECTION_TEXT_CAP,
@@ -87,9 +91,6 @@ const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   typeof value === "object" && value !== null && !Array.isArray(value);
 
-const isElement = (node: NormalizedUINode): node is NormalizedUIElement =>
-  isRecord(node);
-
 const asString = (value: unknown): string =>
   typeof value === "string" ? value : "";
 
@@ -244,7 +245,11 @@ const toActionElement = (
       const rawOptions = Array.isArray(props["options"])
         ? props["options"]
         : [];
-      if (rawOptions.length > SELECT_OPTION_CAP) {
+      const { items: takenOptions, truncated } = copyBounded(
+        rawOptions,
+        SELECT_OPTION_CAP,
+      );
+      if (truncated) {
         warn(
           context,
           "clamped",
@@ -252,7 +257,6 @@ const toActionElement = (
           `options were clamped to ${SELECT_OPTION_CAP} entries.`,
         );
       }
-      const takenOptions = rawOptions.slice(0, SELECT_OPTION_CAP);
       const options = takenOptions
         .map((option) => optionFrom(option, "Select", context))
         .filter((option): option is SlackOption => option !== undefined);
@@ -319,7 +323,11 @@ const toActionElement = (
       const rawOptions = Array.isArray(props["options"])
         ? props["options"]
         : [];
-      if (rawOptions.length > RADIO_OPTION_CAP) {
+      const { items: takenOptions, truncated } = copyBounded(
+        rawOptions,
+        RADIO_OPTION_CAP,
+      );
+      if (truncated) {
         warn(
           context,
           "clamped",
@@ -327,7 +335,6 @@ const toActionElement = (
           `options were clamped to ${RADIO_OPTION_CAP} entries.`,
         );
       }
-      const takenOptions = rawOptions.slice(0, RADIO_OPTION_CAP);
       const options = takenOptions
         .map((option) => optionFrom(option, "RadioGroup", context))
         .filter((option): option is SlackOption => option !== undefined);
@@ -548,7 +555,11 @@ const assembleCleanCard = (
           ),
         }
       : undefined;
-  if (buttons.length > CARD_ACTIONS_CAP) {
+  const { items: boundedButtons, truncated } = copyBounded(
+    buttons,
+    CARD_ACTIONS_CAP,
+  );
+  if (truncated) {
     warn(
       context,
       "clamped",
@@ -563,9 +574,7 @@ const assembleCleanCard = (
       : {}),
     ...(body !== undefined ? { body } : {}),
     ...(subtext !== undefined ? { subtext } : {}),
-    ...(buttons.length > 0
-      ? { actions: buttons.slice(0, CARD_ACTIONS_CAP) }
-      : {}),
+    ...(boundedButtons.length > 0 ? { actions: boundedButtons } : {}),
   });
 };
 
@@ -758,7 +767,11 @@ const contextRow = (
   if (allChildren.length === 0 || children.length !== allChildren.length) {
     return undefined;
   }
-  if (children.length > CONTEXT_ELEMENT_CAP) {
+  const { items: boundedChildren, truncated } = copyBounded(
+    children,
+    CONTEXT_ELEMENT_CAP,
+  );
+  if (truncated) {
     warn(
       context,
       "clamped",
@@ -769,7 +782,7 @@ const contextRow = (
   return [
     {
       type: "context",
-      elements: children.slice(0, CONTEXT_ELEMENT_CAP).map((child) => ({
+      elements: boundedChildren.map((child) => ({
         type: "mrkdwn",
         text: clampText(
           asString(child.props["value"]),
@@ -874,7 +887,11 @@ const convertCarousel = (
       `${droppedCards} non-card ${droppedCards === 1 ? "child was" : "children were"} dropped.`,
     );
   }
-  if (cardChildren.length > CAROUSEL_CARD_CAP) {
+  const { items: boundedCards, truncated } = copyBounded(
+    cardChildren,
+    CAROUSEL_CARD_CAP,
+  );
+  if (truncated) {
     warn(
       context,
       "clamped",
@@ -882,8 +899,7 @@ const convertCarousel = (
       `cards were clamped to ${CAROUSEL_CARD_CAP} entries.`,
     );
   }
-  const cards = cardChildren
-    .slice(0, CAROUSEL_CARD_CAP)
+  const cards = boundedCards
     .map((card) => convertCarouselCard(card, context, depth + 1))
     .filter((card): card is SlackCardBlock => card !== undefined);
   if (cards.length < CAROUSEL_CARD_MIN) {
@@ -921,7 +937,15 @@ const convertTable = (
   const rawRows = Array.isArray(element.props["rows"])
     ? element.props["rows"]
     : [];
-  if (rawColumns.length > DATA_TABLE_COLUMN_CAP) {
+  const { items: takenColumns, truncated: columnsTruncated } = copyBounded(
+    rawColumns,
+    DATA_TABLE_COLUMN_CAP,
+  );
+  const { items: takenRows, truncated: rowsTruncated } = copyBounded(
+    rawRows,
+    DATA_TABLE_ROW_CAP,
+  );
+  if (columnsTruncated) {
     warn(
       context,
       "clamped",
@@ -929,7 +953,7 @@ const convertTable = (
       `columns were clamped to ${DATA_TABLE_COLUMN_CAP} entries.`,
     );
   }
-  if (rawRows.length > DATA_TABLE_ROW_CAP) {
+  if (rowsTruncated) {
     warn(
       context,
       "clamped",
@@ -938,7 +962,6 @@ const convertTable = (
     );
   }
 
-  const takenColumns = rawColumns.slice(0, DATA_TABLE_COLUMN_CAP);
   const unlabeled = takenColumns.filter(
     (column) => !isRecord(column) || typeof column["label"] !== "string",
   ).length;
@@ -954,16 +977,15 @@ const convertTable = (
     type: "raw_text" as const,
     text: isRecord(column) ? asString(column["label"]) : "",
   }));
-  const dataRows: SlackDataTableCell[][] = rawRows
-    .slice(0, DATA_TABLE_ROW_CAP)
-    .map((row) =>
-      (Array.isArray(row) ? row : [])
-        .slice(0, DATA_TABLE_COLUMN_CAP)
-        .map(
-          (value) =>
-            toDataTableCell(value) ?? { type: "raw_text" as const, text: "" },
-        ),
-    );
+  const dataRows: SlackDataTableCell[][] = takenRows.map((row) =>
+    (Array.isArray(row)
+      ? copyBounded(row, DATA_TABLE_COLUMN_CAP).items
+      : []
+    ).map(
+      (value) =>
+        toDataTableCell(value) ?? { type: "raw_text" as const, text: "" },
+    ),
+  );
   const width = Math.max(
     columnHeaderRow.length,
     0,
@@ -1265,32 +1287,20 @@ function convertSequence(
       continue;
     }
     if (isElement(current) && current.type === "Fact") {
-      const facts: NormalizedUIElement[] = [];
-      while (index < nodes.length) {
-        const candidate = nodes[index];
-        if (!candidate || !isElement(candidate) || candidate.type !== "Fact") {
-          break;
-        }
-        facts.push(candidate);
-        index += 1;
-      }
+      const { run: facts, next } = takeRun(
+        nodes,
+        index,
+        (candidate) => candidate.type === "Fact",
+      );
+      index = next;
       blocks.push(...convertFacts(facts, context));
       continue;
     }
     if (isElement(current) && INTERACTIVE_TYPES.has(current.type)) {
-      const controls: NormalizedUIElement[] = [];
-      while (index < nodes.length) {
-        const candidate = nodes[index];
-        if (
-          !candidate ||
-          !isElement(candidate) ||
-          !INTERACTIVE_TYPES.has(candidate.type)
-        ) {
-          break;
-        }
-        controls.push(candidate);
-        index += 1;
-      }
+      const { run: controls, next } = takeRun(nodes, index, (candidate) =>
+        INTERACTIVE_TYPES.has(candidate.type),
+      );
+      index = next;
       blocks.push(...convertActions(controls, context));
       continue;
     }
@@ -1320,104 +1330,6 @@ function convertSequence(
   return blocks;
 }
 
-interface BoundState {
-  remaining: number;
-  exhausted: boolean;
-}
-
-type ClampReason = "children" | "budget" | "cycle" | "depth";
-
-function boundNode(
-  value: unknown,
-  depth: number,
-  onClamp: (reason: ClampReason) => void,
-  state: BoundState,
-  ancestors: WeakSet<object>,
-): unknown {
-  if (state.remaining <= 0) {
-    if (!state.exhausted) {
-      state.exhausted = true;
-      onClamp("budget");
-    }
-    return null;
-  }
-  state.remaining -= 1;
-  if (depth > MAX_TRAVERSAL_DEPTH) {
-    onClamp("depth");
-    return null;
-  }
-  if (Array.isArray(value)) {
-    if (ancestors.has(value)) {
-      onClamp("cycle");
-      return null;
-    }
-    ancestors.add(value);
-    const bounded = Array.prototype.slice.call(
-      value,
-      0,
-      CHILDREN_CAP,
-    ) as unknown[];
-    if (value.length > CHILDREN_CAP) onClamp("children");
-    const result = bounded.map((item) =>
-      boundNode(item, depth + 1, onClamp, state, ancestors),
-    );
-    ancestors.delete(value);
-    return result;
-  }
-  if (
-    value !== null &&
-    typeof value === "object" &&
-    "children" in (value as Record<string, unknown>)
-  ) {
-    if (ancestors.has(value)) {
-      onClamp("cycle");
-      return null;
-    }
-    ancestors.add(value);
-    const record = value as Record<string, unknown>;
-    const result = {
-      ...record,
-      children: boundNode(
-        record["children"],
-        depth + 1,
-        onClamp,
-        state,
-        ancestors,
-      ),
-    };
-    ancestors.delete(value);
-    return result;
-  }
-  return value;
-}
-
-/**
- * Produces a bounded plain copy of a raw generative-ui spec before it
- * reaches `normalizeSpec`, whose own traversal of the root array or any
- * `children` array walks the full reported length of a hostile proxied
- * array before any per-field cap downstream ever applies. Every array
- * (root, or `children` at any depth) is capped to {@link CHILDREN_CAP}
- * entries via `Array.prototype.slice`, which bounds even a proxy with a
- * fabricated `length`; recursion itself is capped at
- * {@link MAX_TRAVERSAL_DEPTH}. `onClamp` fires once per level that was
- * truncated, receiving the reason for that truncation: `"children"`,
- * `"depth"`, `"budget"`, or `"cycle"`. The walk also spends a total budget of
- * {@link NODE_BUDGET} nodes, so shared references cannot multiply work
- * exponentially, and a node that is its own ancestor is cut to `null`.
- */
-function boundSpec(
-  spec: unknown,
-  onClamp: (reason: ClampReason) => void,
-): unknown {
-  return boundNode(
-    spec,
-    0,
-    onClamp,
-    { remaining: NODE_BUDGET, exhausted: false },
-    new WeakSet(),
-  );
-}
-
 /** Converts a generative-UI tree into Slack Block Kit JSON and downgrade warnings. */
 export function toSlackBlocks(
   node: unknown,
@@ -1433,17 +1345,9 @@ export function toSlackBlocks(
     dataTableCharacters: 0,
   };
   try {
-    const bounded = boundSpec(node, (reason) => {
-      const detail =
-        reason === "budget"
-          ? `the tree was truncated after ${NODE_BUDGET} nodes.`
-          : reason === "cycle"
-            ? "a self-referencing node was dropped."
-            : reason === "depth"
-              ? `nodes deeper than ${MAX_ELEMENT_DEPTH} levels were dropped.`
-              : `children were clamped to ${CHILDREN_CAP} entries.`;
-      warn(context, "clamped", "Root", detail);
-    });
+    const bounded = boundSpec(node, (reason) =>
+      warn(context, "clamped", "Root", clampReasonDetail(reason)),
+    );
     const { root } = normalizeSpec(bounded as never);
     const converted = convertSequence(root, context, 0);
     if (converted.length <= context.blockCap) {

package/src/teams/constants.ts

@@ -17,48 +17,6 @@ export const ADAPTIVE_CARD_SCHEMA =
 export const ATTACHMENT_CONTENT_TYPE =
   "application/vnd.microsoft.card.adaptive";
 
-/** The maximum traversal depth, counted in visited values, not tree levels. */
-export const MAX_TRAVERSAL_DEPTH = 64;
-
-/**
- * The element-nesting ceiling a caller observes. `boundNode` visits an element
- * and its `children` array separately, so one level of nesting spends two of
- * {@link MAX_TRAVERSAL_DEPTH}; it runs before the conversion walk and is never
- * the looser of the two. A root array costs one more level than a root object.
- */
-export const MAX_ELEMENT_DEPTH = MAX_TRAVERSAL_DEPTH / 2;
-
-/**
- * The maximum number of entries kept at any single level (root, or a
- * `children` array at any depth) of the raw spec, before it ever reaches
- * `normalizeSpec`. Bounds a hostile array's reported `length` so the pre-pass
- * can never be made to walk further than this regardless of what the array
- * claims about itself.
- */
-export const CHILDREN_CAP = 200;
-
-/**
- * The total number of nodes {@link boundSpec} will visit across one walk,
- * regardless of how many times a shared reference recurs. Bounds the
- * combinatorial work a DAG of shared or self-referential nodes would
- * otherwise force even though each individual array stays within
- * {@link CHILDREN_CAP}.
- */
-export const NODE_BUDGET = 5000;
-
-export type ClampReason = "children" | "budget" | "cycle" | "depth";
-
-export function clampReasonDetail(reason: ClampReason): string {
-  if (reason === "budget") {
-    return `the tree was truncated after ${NODE_BUDGET} nodes.`;
-  }
-  if (reason === "cycle") return "a self-referencing node was dropped.";
-  if (reason === "depth") {
-    return `nodes deeper than ${MAX_ELEMENT_DEPTH} levels were dropped.`;
-  }
-  return `children were clamped to ${CHILDREN_CAP} entries.`;
-}
-
 /** The maximum number of attachments produced from a root-level Carousel. */
 export const CAROUSEL_ATTACHMENT_CAP = 10;
 

package/src/teams/toAdaptiveCard.test.ts

@@ -1,10 +1,10 @@
 import { describe, expect, it } from "vitest";
+import { CHILDREN_CAP, NODE_BUDGET } from "../convert/boundSpec";
 import { toAdaptiveCard } from "./toAdaptiveCard";
 import { toTeamsAttachments } from "./toTeamsAttachments";
 import {
   CAROUSEL_ATTACHMENT_CAP,
-  CHILDREN_CAP,
-  NODE_BUDGET,
+  CHOICE_OPTION_CAP,
   PAYLOAD_SOFT_CAP,
   PRIMARY_ACTION_CAP,
   TABLE_COLUMN_CAP,
@@ -25,6 +25,32 @@ import type {
   TeamsTextBlock,
 } from "./types";
 
+const hostileSpecies = <T>(
+  source: T[],
+  injected: unknown[],
+  onDispatch: () => void,
+): T[] => {
+  function HostileCtor() {
+    return {
+      map: () => {
+        onDispatch();
+        return injected;
+      },
+      [Symbol.iterator]: function* () {
+        onDispatch();
+        yield* injected;
+      },
+    };
+  }
+  const constructor = { [Symbol.species]: HostileCtor };
+  return new Proxy(source, {
+    get: (target, prop, receiver) =>
+      prop === "constructor"
+        ? constructor
+        : Reflect.get(target, prop, receiver),
+  });
+};
+
 describe("toAdaptiveCard", () => {
   describe("Header", () => {
     it("renders a heading TextBlock", () => {
@@ -455,6 +481,29 @@ describe("toAdaptiveCard", () => {
       expect((card.body[0] as TeamsInputChoiceSet).id).toBe("select");
     });
 
+    it("does not dispatch a prop array through Symbol.species", () => {
+      let dispatches = 0;
+      const injected = Array.from(
+        { length: CHOICE_OPTION_CAP + 1 },
+        (_, i) => ({ label: `injected-${i}`, value: `injected-${i}` }),
+      );
+      const { card, warnings } = toAdaptiveCard({
+        $type: "Select",
+        options: hostileSpecies(
+          [{ label: "Kept", value: "kept" }],
+          injected,
+          () => {
+            dispatches += 1;
+          },
+        ),
+      });
+      expect((card.body[0] as TeamsInputChoiceSet).choices).toEqual([
+        { title: "Kept", value: "kept" },
+      ]);
+      expect(dispatches).toBe(0);
+      expect(warnings).toEqual([]);
+    });
+
     it("appends a companion submit ActionSet with a fallback warning when $action is present", () => {
       const { card, warnings } = toAdaptiveCard({
         $type: "Select",
@@ -1154,6 +1203,29 @@ describe("toAdaptiveCard", () => {
         detail: `rows were clamped to ${TABLE_ROW_CAP} entries.`,
       });
     });
+
+    it("does not dispatch a row array through Symbol.species", () => {
+      let dispatches = 0;
+      const row = hostileSpecies(
+        ["kept"],
+        ["injected", "also-injected"],
+        () => {
+          dispatches += 1;
+        },
+      );
+      const { card } = toAdaptiveCard({
+        $type: "Table",
+        columns: [{ label: "A" }],
+        rows: [row],
+      });
+      const table = card.body[0] as TeamsTable;
+      expect(table.rows).toHaveLength(2);
+      expect(table.rows[1]?.cells).toHaveLength(1);
+      expect(table.rows[1]?.cells[0]?.items).toEqual([
+        { type: "TextBlock", text: "kept", wrap: true },
+      ]);
+      expect(dispatches).toBe(0);
+    });
   });
 
   describe("Alert", () => {

package/src/teams/toAdaptiveCard.ts

@@ -1,19 +1,24 @@
+import {
+  MAX_TRAVERSAL_DEPTH,
+  boundSpec,
+  clampReasonDetail,
+} from "../convert/boundSpec";
+import { copyBounded } from "../convert/copyBounded";
+import { isElement } from "../convert/isElement";
+import { takeRun } from "../convert/takeRun";
 import {
   normalizeSpec,
   type NormalizedUIElement,
   type NormalizedUINode,
 } from "../ir";
-import { boundSpec } from "./boundSpec";
 import {
   CHOICE_OPTION_CAP,
-  MAX_TRAVERSAL_DEPTH,
   PAYLOAD_SOFT_CAP,
   PRIMARY_ACTION_CAP,
   TABLE_COLUMN_CAP,
   TABLE_ROW_CAP,
   buildCard,
   buildSubmitAction,
-  clampReasonDetail,
   utf8ByteLength,
 } from "./constants";
 import type {
@@ -44,9 +49,6 @@ export interface ConversionContext {
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   typeof value === "object" && value !== null && !Array.isArray(value);
 
-const isElement = (node: NormalizedUINode): node is NormalizedUIElement =>
-  isRecord(node);
-
 const asString = (value: unknown): string =>
   typeof value === "string" ? value : "";
 
@@ -125,7 +127,7 @@ function reservedSafeId(
 }
 
 /**
- * The shared bounded-iteration primitive: slices `value` to `cap` entries
+ * The shared bounded-iteration primitive: copies `value` to `cap` entries
  * without ever reading past that many indices, so a hostile array (sparse or
  * proxied with a fabricated `length`) cannot stall the event loop.
  */
@@ -134,7 +136,7 @@ const clampArray = (
   cap: number,
 ): { readonly items: unknown[]; readonly truncated: boolean } => {
   if (!Array.isArray(value)) return { items: [], truncated: false };
-  return { items: value.slice(0, cap), truncated: value.length > cap };
+  return copyBounded(value, cap);
 };
 
 const normalizedList = (
@@ -337,12 +339,13 @@ function convertTable(
     : undefined;
   const dataRows: TeamsTableRow[] = rawRows.map((row) => ({
     type: "TableRow",
-    cells: (Array.isArray(row) ? row.slice(0, TABLE_COLUMN_CAP) : []).map(
-      (cell) => ({
-        type: "TableCell" as const,
-        items: [textBlock(stringifyCell(cell))],
-      }),
-    ),
+    cells: (Array.isArray(row)
+      ? copyBounded(row, TABLE_COLUMN_CAP).items
+      : []
+    ).map((cell) => ({
+      type: "TableCell" as const,
+      items: [textBlock(stringifyCell(cell))],
+    })),
   }));
 
   return {
@@ -729,32 +732,22 @@ export function convertSequence(
       continue;
     }
     if (isElement(current) && current.type === "Fact") {
-      const facts: NormalizedUIElement[] = [];
-      while (index < nodes.length) {
-        const candidate = nodes[index];
-        if (!candidate || !isElement(candidate) || candidate.type !== "Fact") {
-          break;
-        }
-        facts.push(candidate);
-        index += 1;
-      }
+      const { run: facts, next } = takeRun(
+        nodes,
+        index,
+        (candidate) => candidate.type === "Fact",
+      );
+      index = next;
       emit([convertFacts(facts)]);
       continue;
     }
     if (isElement(current) && current.type === "Button") {
-      const buttons: NormalizedUIElement[] = [];
-      while (index < nodes.length) {
-        const candidate = nodes[index];
-        if (
-          !candidate ||
-          !isElement(candidate) ||
-          candidate.type !== "Button"
-        ) {
-          break;
-        }
-        buttons.push(candidate);
-        index += 1;
-      }
+      const { run: buttons, next } = takeRun(
+        nodes,
+        index,
+        (candidate) => candidate.type === "Button",
+      );
+      index = next;
       emit([convertButtons(buttons, context)]);
       continue;
     }

package/src/teams/toTeamsAttachments.ts

@@ -1,14 +1,14 @@
+import { boundSpec, clampReasonDetail } from "../convert/boundSpec";
+import { isElement } from "../convert/isElement";
 import {
   normalizeSpec,
   type NormalizedUIElement,
   type NormalizedUINode,
 } from "../ir";
-import { boundSpec } from "./boundSpec";
 import {
   CAROUSEL_ATTACHMENT_CAP,
   PAYLOAD_SOFT_CAP,
   buildAttachment,
-  clampReasonDetail,
   utf8ByteLength,
 } from "./constants";
 import {
@@ -23,12 +23,6 @@ import type {
   ToAdaptiveCardOptions,
 } from "./types";
 
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === "object" && value !== null && !Array.isArray(value);
-
-const isElement = (node: NormalizedUINode): node is NormalizedUIElement =>
-  isRecord(node);
-
 const normalizedList = (
   node: NormalizedUINode | undefined,
 ): NormalizedUINode[] => {