@assistant-ui/react-generative-ui 0.0.16 → 0.0.18

package/dist/vocabulary/text.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"text.d.ts","names":[],"sources":["../../src/vocabulary/text.tsx"],"mappings":";;cAIa"}
+{"version":3,"file":"text.d.ts","names":[],"sources":["../../src/vocabulary/text.tsx"],"mappings":";;cAKa"}

package/dist/vocabulary/text.js

@@ -1,4 +1,5 @@
 import { COLORS, TEXT_SIZES, WEIGHTS } from "../ir.js";
+import { toTextContent } from "./toTextContent.js";
 import { jsxs } from "react/jsx-runtime";
 import { z } from "zod";
 //#region src/vocabulary/text.tsx
@@ -12,7 +13,7 @@ const textVocabulary = {
 		render: ({ text, size, children }) => /* @__PURE__ */ jsxs("h2", {
 			"data-aui": "header",
 			"data-aui-size": size ?? "lg",
-			children: [text, children]
+			children: [toTextContent(text), children]
 		})
 	},
 	Text: {
@@ -29,7 +30,7 @@ const textVocabulary = {
 			"data-aui-size": size ?? "md",
 			"data-aui-weight": weight,
 			"data-aui-color": color,
-			children: [value, children]
+			children: [toTextContent(value), children]
 		})
 	},
 	Caption: {
@@ -38,7 +39,7 @@ const textVocabulary = {
 		streamProperties: true,
 		render: ({ value, children }) => /* @__PURE__ */ jsxs("p", {
 			"data-aui": "caption",
-			children: [value, children]
+			children: [toTextContent(value), children]
 		})
 	}
 };

package/dist/vocabulary/text.js.map

@@ -1 +1 @@
-{"version":3,"file":"text.js","names":[],"sources":["../../src/vocabulary/text.tsx"],"sourcesContent":["import { z } from \"zod\";\nimport type { GenerativeUILibrary } from \"../types\";\nimport { COLORS, TEXT_SIZES, WEIGHTS } from \"../ir\";\n\nexport const textVocabulary = {\n  Header: {\n    description: \"A section heading. Renders as a bold title.\",\n    properties: z.object({\n      text: z.string().describe(\"The heading text.\"),\n      size: z\n        .enum(TEXT_SIZES)\n        .optional()\n        .describe(\"Heading size; defaults to `lg`.\"),\n    }),\n    render: ({ text, size, children }) => (\n      <h2 data-aui=\"header\" data-aui-size={size ?? \"lg\"}>\n        {text}\n        {children}\n      </h2>\n    ),\n  },\n  Text: {\n    description: \"A run of text. Use for paragraphs, labels, or inline copy.\",\n    properties: z.object({\n      value: z.string().describe(\"The text content.\"),\n      size: z\n        .enum(TEXT_SIZES)\n        .optional()\n        .describe(\"Text size; defaults to `md`.\"),\n      weight: z.enum(WEIGHTS).optional().describe(\"Font weight.\"),\n      color: z.enum(COLORS).optional().describe(\"Foreground color token.\"),\n    }),\n    streamProperties: true,\n    render: ({ value, size, weight, color, children }) => (\n      <span\n        data-aui=\"text\"\n        data-aui-size={size ?? \"md\"}\n        data-aui-weight={weight}\n        data-aui-color={color}\n      >\n        {value}\n        {children}\n      </span>\n    ),\n  },\n  Caption: {\n    description: \"Secondary, de-emphasized text under a primary element.\",\n    properties: z.object({\n      value: z.string().describe(\"The caption text.\"),\n    }),\n    streamProperties: true,\n    render: ({ value, children }) => (\n      <p data-aui=\"caption\">\n        {value}\n        {children}\n      </p>\n    ),\n  },\n} satisfies GenerativeUILibrary;\n"],"mappings":";;;;AAIA,MAAa,iBAAiB;CAC5B,QAAQ;EACN,aAAa;EACb,YAAY,EAAE,OAAO;GACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,mBAAmB;GAC7C,MAAM,EACH,KAAK,UAAU,CAAC,CAChB,SAAS,CAAC,CACV,SAAS,iCAAiC;EAC/C,CAAC;EACD,SAAS,EAAE,MAAM,MAAM,eACrB,qBAAC,MAAD;GAAI,YAAS;GAAS,iBAAe,QAAQ;GAA7C,UAAA,CACG,MACA,QACC;;CAER;CACA,MAAM;EACJ,aAAa;EACb,YAAY,EAAE,OAAO;GACnB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,mBAAmB;GAC9C,MAAM,EACH,KAAK,UAAU,CAAC,CAChB,SAAS,CAAC,CACV,SAAS,8BAA8B;GAC1C,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,cAAc;GAC1D,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,yBAAyB;EACrE,CAAC;EACD,kBAAkB;EAClB,SAAS,EAAE,OAAO,MAAM,QAAQ,OAAO,eACrC,qBAAC,QAAD;GACE,YAAS;GACT,iBAAe,QAAQ;GACvB,mBAAiB;GACjB,kBAAgB;GAJlB,UAAA,CAMG,OACA,QACG;;CAEV;CACA,SAAS;EACP,aAAa;EACb,YAAY,EAAE,OAAO,EACnB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,mBAAmB,EAChD,CAAC;EACD,kBAAkB;EAClB,SAAS,EAAE,OAAO,eAChB,qBAAC,KAAD;GAAG,YAAS;GAAZ,UAAA,CACG,OACA,QACA;;CAEP;AACF"}
+{"version":3,"file":"text.js","names":[],"sources":["../../src/vocabulary/text.tsx"],"sourcesContent":["import { z } from \"zod\";\nimport type { GenerativeUILibrary } from \"../types\";\nimport { COLORS, TEXT_SIZES, WEIGHTS } from \"../ir\";\nimport { toTextContent } from \"./toTextContent\";\n\nexport const textVocabulary = {\n  Header: {\n    description: \"A section heading. Renders as a bold title.\",\n    properties: z.object({\n      text: z.string().describe(\"The heading text.\"),\n      size: z\n        .enum(TEXT_SIZES)\n        .optional()\n        .describe(\"Heading size; defaults to `lg`.\"),\n    }),\n    render: ({ text, size, children }) => (\n      <h2 data-aui=\"header\" data-aui-size={size ?? \"lg\"}>\n        {toTextContent(text)}\n        {children}\n      </h2>\n    ),\n  },\n  Text: {\n    description: \"A run of text. Use for paragraphs, labels, or inline copy.\",\n    properties: z.object({\n      value: z.string().describe(\"The text content.\"),\n      size: z\n        .enum(TEXT_SIZES)\n        .optional()\n        .describe(\"Text size; defaults to `md`.\"),\n      weight: z.enum(WEIGHTS).optional().describe(\"Font weight.\"),\n      color: z.enum(COLORS).optional().describe(\"Foreground color token.\"),\n    }),\n    streamProperties: true,\n    render: ({ value, size, weight, color, children }) => (\n      <span\n        data-aui=\"text\"\n        data-aui-size={size ?? \"md\"}\n        data-aui-weight={weight}\n        data-aui-color={color}\n      >\n        {toTextContent(value)}\n        {children}\n      </span>\n    ),\n  },\n  Caption: {\n    description: \"Secondary, de-emphasized text under a primary element.\",\n    properties: z.object({\n      value: z.string().describe(\"The caption text.\"),\n    }),\n    streamProperties: true,\n    render: ({ value, children }) => (\n      <p data-aui=\"caption\">\n        {toTextContent(value)}\n        {children}\n      </p>\n    ),\n  },\n} satisfies GenerativeUILibrary;\n"],"mappings":";;;;;AAKA,MAAa,iBAAiB;CAC5B,QAAQ;EACN,aAAa;EACb,YAAY,EAAE,OAAO;GACnB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,mBAAmB;GAC7C,MAAM,EACH,KAAK,UAAU,CAAC,CAChB,SAAS,CAAC,CACV,SAAS,iCAAiC;EAC/C,CAAC;EACD,SAAS,EAAE,MAAM,MAAM,eACrB,qBAAC,MAAD;GAAI,YAAS;GAAS,iBAAe,QAAQ;GAA7C,UAAA,CACG,cAAc,IAAI,GAClB,QACC;;CAER;CACA,MAAM;EACJ,aAAa;EACb,YAAY,EAAE,OAAO;GACnB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,mBAAmB;GAC9C,MAAM,EACH,KAAK,UAAU,CAAC,CAChB,SAAS,CAAC,CACV,SAAS,8BAA8B;GAC1C,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,cAAc;GAC1D,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,yBAAyB;EACrE,CAAC;EACD,kBAAkB;EAClB,SAAS,EAAE,OAAO,MAAM,QAAQ,OAAO,eACrC,qBAAC,QAAD;GACE,YAAS;GACT,iBAAe,QAAQ;GACvB,mBAAiB;GACjB,kBAAgB;GAJlB,UAAA,CAMG,cAAc,KAAK,GACnB,QACG;;CAEV;CACA,SAAS;EACP,aAAa;EACb,YAAY,EAAE,OAAO,EACnB,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,mBAAmB,EAChD,CAAC;EACD,kBAAkB;EAClB,SAAS,EAAE,OAAO,eAChB,qBAAC,KAAD;GAAG,YAAS;GAAZ,UAAA,CACG,cAAc,KAAK,GACnB,QACA;;CAEP;AACF"}

package/dist/vocabulary/toTextContent.d.ts

@@ -0,0 +1,5 @@
+//#region src/vocabulary/toTextContent.d.ts
+declare const toTextContent: (value: unknown) => string | number | null;
+//#endregion
+export { toTextContent };
+//# sourceMappingURL=toTextContent.d.ts.map

package/dist/vocabulary/toTextContent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toTextContent.d.ts","names":[],"sources":["../../src/vocabulary/toTextContent.ts"],"mappings":";cAAa,gBAAiB"}

package/dist/vocabulary/toTextContent.js

@@ -0,0 +1,6 @@
+//#region src/vocabulary/toTextContent.ts
+const toTextContent = (value) => typeof value === "string" || typeof value === "number" ? value : null;
+//#endregion
+export { toTextContent };
+
+//# sourceMappingURL=toTextContent.js.map

package/dist/vocabulary/toTextContent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toTextContent.js","names":[],"sources":["../../src/vocabulary/toTextContent.ts"],"sourcesContent":["export const toTextContent = (value: unknown): string | number | null =>\n  typeof value === \"string\" || typeof value === \"number\" ? value : null;\n"],"mappings":";AAAA,MAAa,iBAAiB,UAC5B,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW,QAAQ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assistant-ui/react-generative-ui",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "description": "Generative UI components for assistant-ui",
   "keywords": [
     "generative-ui",
@@ -50,7 +50,7 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "assistant-stream": "^0.3.40"
+    "assistant-stream": "^0.3.42"
   },
   "peerDependencies": {
     "@assistant-ui/react": "^0.15.0",
@@ -64,14 +64,14 @@
     }
   },
   "devDependencies": {
-    "@assistant-ui/react": "0.15.17",
-    "@assistant-ui/x-buildutils": "0.0.24",
+    "@assistant-ui/react": "0.15.19",
+    "@assistant-ui/x-buildutils": "0.0.26",
     "@types/json-schema": "^7.0.15",
     "@types/react": "^19.2.18",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "vitest": "^4.1.11",
-    "zod": "^4.4.3"
+    "zod": "^4.5.4"
   },
   "publishConfig": {
     "access": "public",

package/src/a2ui/convert.test.ts

@@ -201,6 +201,42 @@ describe("convertSurfaceToUISpec", () => {
     });
   });
 
+  it("preserves prototype-named action context fields", () => {
+    const context = JSON.parse(
+      '{"__proto__":{"admin":true},"literal":"kept"}',
+    ) as Record<string, unknown>;
+    const surface = surfaceFrom([
+      {
+        id: "root",
+        component: "Button",
+        label: "Run",
+        action: { name: "run", context },
+      },
+    ]);
+
+    const result = convertSurfaceToUISpec(surface);
+    const convertedContext = (result.spec as UIElement).$action
+      ?.context as Record<string, unknown>;
+
+    expect(Object.getPrototypeOf(convertedContext)).toBe(Object.prototype);
+    expect(Object.hasOwn(convertedContext, "__proto__")).toBe(true);
+    expect(convertedContext["__proto__"]).toEqual({ admin: true });
+    expect(JSON.stringify(convertedContext)).toBe(
+      '{"__proto__":{"admin":true},"literal":"kept"}',
+    );
+  });
+
+  it("does not read component fields through a prototype-named prop", () => {
+    const component = JSON.parse(
+      '{"id":"root","component":"Text","__proto__":{"text":"injected"}}',
+    ) as Record<string, unknown>;
+
+    expect(convertSurfaceToUISpec(surfaceFrom([component]))).toEqual({
+      spec: { $type: "Markdown" },
+      warnings: [],
+    });
+  });
+
   it("expands template children relative to each bound item", () => {
     const surface = surfaceFrom(
       [

package/src/a2ui/convert.ts

@@ -30,6 +30,23 @@ const isPlainObject = (value: unknown): value is Record<string, unknown> => {
   return prototype === Object.prototype || prototype === null;
 };
 
+const setOwnProperty = (
+  target: Record<string, unknown>,
+  key: string,
+  value: unknown,
+) => {
+  if (key === "__proto__") {
+    Object.defineProperty(target, key, {
+      value,
+      enumerable: true,
+      configurable: true,
+      writable: true,
+    });
+  } else {
+    target[key] = value;
+  }
+};
+
 const isBinding = (value: unknown): value is { readonly path: string } =>
   isPlainObject(value) &&
   Object.keys(value).length === 1 &&
@@ -90,7 +107,9 @@ const materialize = (value: unknown, source: unknown): unknown => {
   const result: Record<string, unknown> = {};
   for (const [key, entry] of Object.entries(value)) {
     const resolved = materialize(entry, source);
-    if (resolved !== undefined) result[key] = resolved;
+    if (resolved !== undefined) {
+      setOwnProperty(result, key, resolved);
+    }
   }
   return result;
 };
@@ -419,7 +438,7 @@ function convertComponent(
     for (const [key, value] of Object.entries(node)) {
       if (key === "id" || key === "component" || key === "children") continue;
       const resolved = materialize(value, dataSource);
-      if (resolved !== undefined) props[key] = resolved;
+      if (resolved !== undefined) setOwnProperty(props, key, resolved);
     }
     const mapped = mappedProps(node, props, dataSource, context);
     if (!mapped) return null;

package/src/a2ui/reducer.test.ts

@@ -82,6 +82,229 @@ describe("applyA2uiOperations", () => {
     });
   });
 
+  it.each(["10001", "4294967294"])(
+    "rejects array pointer index %s beyond the auto-vivification limit",
+    (index) => {
+      const dataModel = { items: [] };
+      const state: A2uiState = new Map([
+        ["main", { components: new Map(), dataModel }],
+      ]);
+
+      const result = applyA2uiOperations(state, [
+        {
+          version: "v1.0",
+          updateDataModel: {
+            surfaceId: "main",
+            path: `/items/${index}`,
+            value: "unsafe",
+          },
+        },
+      ]);
+
+      expect(result.warnings).toEqual([
+        "Operation at index 0 has an invalid JSON Pointer path.",
+      ]);
+      expect(result.state.get("main")?.dataModel).toBe(dataModel);
+      expect(dataModel.items).toHaveLength(0);
+    },
+  );
+
+  it("allows bounded expansion, existing large indices, and appends", () => {
+    const items = new Array<string | undefined>(10_002);
+    items[10_001] = "existing";
+    const state: A2uiState = new Map([
+      ["main", { components: new Map(), dataModel: { bounded: [], items } }],
+    ]);
+
+    const result = applyA2uiOperations(state, [
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/bounded/10000",
+          value: "limit",
+        },
+      },
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/items/10001",
+          value: "updated",
+        },
+      },
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/items/-",
+          value: "appended",
+        },
+      },
+    ]);
+
+    const resultModel = result.state.get("main")!.dataModel as {
+      bounded: string[];
+      items: string[];
+    };
+    expect(result.warnings).toEqual([]);
+    expect(resultModel.bounded).toHaveLength(10_001);
+    expect(resultModel.bounded[10_000]).toBe("limit");
+    expect(resultModel.items).toHaveLength(10_003);
+    expect(resultModel.items[10_001]).toBe("updated");
+    expect(resultModel.items[10_002]).toBe("appended");
+  });
+
+  it("stores prototype-named JSON Pointer segments as own properties", () => {
+    const state: A2uiState = new Map([
+      ["main", { components: new Map(), dataModel: {} }],
+    ]);
+
+    const result = applyA2uiOperations(state, [
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/__proto__/admin",
+          value: true,
+        },
+      },
+    ]);
+
+    const resultModel = result.state.get("main")?.dataModel as Record<
+      string,
+      unknown
+    >;
+    expect(result.warnings).toEqual([]);
+    expect(Object.getPrototypeOf(resultModel)).toBe(Object.prototype);
+    expect(Object.hasOwn(resultModel, "__proto__")).toBe(true);
+    expect(resultModel["__proto__"]).toEqual({ admin: true });
+    expect(JSON.stringify(resultModel)).toBe('{"__proto__":{"admin":true}}');
+  });
+
+  it("deletes object properties updated to null", () => {
+    const dataModel = {
+      profile: { name: "Ada", role: "admin" },
+      tags: ["first", "second"],
+    };
+    const state: A2uiState = new Map([
+      ["main", { components: new Map(), dataModel }],
+    ]);
+
+    const result = applyA2uiOperations(state, [
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/profile/name",
+          value: null,
+        },
+      },
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/tags/1",
+          value: null,
+        },
+      },
+    ]);
+
+    expect(result.warnings).toEqual([]);
+    const resultModel = result.state.get("main")?.dataModel as typeof dataModel;
+    expect(resultModel.profile).toEqual({ role: "admin" });
+    expect(resultModel.tags).toHaveLength(2);
+    expect(resultModel.tags[0]).toBe("first");
+    expect(Object.prototype.hasOwnProperty.call(resultModel.tags, 1)).toBe(
+      false,
+    );
+    expect(dataModel).toEqual({
+      profile: { name: "Ada", role: "admin" },
+      tags: ["first", "second"],
+    });
+  });
+
+  it("preserves null values in v0.9 data model updates", () => {
+    const state: A2uiState = new Map([
+      [
+        "main",
+        { components: new Map(), dataModel: { profile: { name: "Ada" } } },
+      ],
+    ]);
+
+    const result = applyA2uiOperations(state, [
+      {
+        version: "v0.9",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/profile/name",
+          value: null,
+        },
+      },
+    ]);
+
+    expect(result.warnings).toEqual([]);
+    expect(result.state.get("main")?.dataModel).toEqual({
+      profile: { name: null },
+    });
+  });
+
+  it("does not create missing paths for null updates", () => {
+    const dataModel = { profile: { name: "Ada" }, tags: ["first", "second"] };
+    const state: A2uiState = new Map([
+      ["main", { components: new Map(), dataModel }],
+    ]);
+
+    const result = applyA2uiOperations(state, [
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/missing/value",
+          value: null,
+        },
+      },
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/tags/-",
+          value: null,
+        },
+      },
+      {
+        version: "v1.0",
+        updateDataModel: {
+          surfaceId: "main",
+          path: "/tags/7",
+          value: null,
+        },
+      },
+    ]);
+
+    expect(result.warnings).toEqual([]);
+    expect(result.state.get("main")?.dataModel).toBe(dataModel);
+  });
+
+  it("allows null to replace the data model root", () => {
+    const state: A2uiState = new Map([
+      [
+        "main",
+        { components: new Map(), dataModel: { profile: { name: "Ada" } } },
+      ],
+    ]);
+
+    const result = applyA2uiOperations(state, [
+      {
+        version: "v1.0",
+        updateDataModel: { surfaceId: "main", value: null },
+      },
+    ]);
+
+    expect(result.warnings).toEqual([]);
+    expect(result.state.get("main")?.dataModel).toBeNull();
+  });
+
   it("clones the touched surface and component map", () => {
     const components = new Map<string, Record<string, unknown>>([
       ["root", { id: "root", component: "Divider" }],

package/src/a2ui/reducer.ts

@@ -11,6 +11,9 @@ const OPERATION_KEYS = new Set([
   "updateDataModel",
   "deleteSurface",
 ]);
+// This defensive ceiling is well above the renderer's displayed-item limit.
+const MAX_AUTO_VIVIFY_ARRAY_INDEX = 10_000;
+const INVALID_POINTER = Symbol("invalidPointer");
 
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   typeof value === "object" && value !== null && !Array.isArray(value);
@@ -104,30 +107,82 @@ const setAtPointer = (
   model: unknown,
   path: string,
   value: unknown,
+  nullDeletes: boolean,
 ): { readonly ok: boolean; readonly value: unknown } => {
   const segments = decodePointer(path);
   if (!segments) return { ok: false, value: model };
   if (segments.length === 0) return { ok: true, value };
 
+  const remove = (current: unknown, index: number): unknown => {
+    const segment = segments[index]!;
+    const isLast = index === segments.length - 1;
+
+    if (Array.isArray(current)) {
+      if (segment !== "-" && !isArrayIndex(segment)) return current;
+      const targetIndex = segment === "-" ? current.length : Number(segment);
+      if (isLast) {
+        if (
+          segment === "-" ||
+          !Object.prototype.hasOwnProperty.call(current, targetIndex)
+        ) {
+          return current;
+        }
+        const clone = current.slice();
+        // Preserve indices referenced by other JSON Pointers.
+        delete clone[targetIndex];
+        return clone;
+      }
+      const child = current[targetIndex];
+      if (!Array.isArray(child) && !isRecord(child)) return current;
+      const next = remove(child, index + 1);
+      if (next === child) return current;
+      const clone = current.slice();
+      clone[targetIndex] = next;
+      return clone;
+    }
+
+    if (!isRecord(current)) return current;
+    if (!Object.prototype.hasOwnProperty.call(current, segment)) return current;
+    if (isLast) {
+      const clone = { ...current };
+      delete clone[segment];
+      return clone;
+    }
+    const child = current[segment];
+    if (!Array.isArray(child) && !isRecord(child)) return current;
+    const next = remove(child, index + 1);
+    if (next === child) return current;
+    return { ...current, [segment]: next };
+  };
+
+  if (nullDeletes && value === null) {
+    return { ok: true, value: remove(model, 0) };
+  }
+
   const update = (current: unknown, index: number): unknown => {
     const segment = segments[index]!;
     const isLast = index === segments.length - 1;
 
     if (Array.isArray(current)) {
       if (segment !== "-" && !isArrayIndex(segment)) return current;
+      const targetIndex = segment === "-" ? current.length : Number(segment);
+      if (
+        segment !== "-" &&
+        targetIndex >= current.length &&
+        targetIndex > MAX_AUTO_VIVIFY_ARRAY_INDEX
+      ) {
+        return INVALID_POINTER;
+      }
+      const next = isLast ? value : update(current[targetIndex], index + 1);
+      if (next === INVALID_POINTER) return INVALID_POINTER;
       const clone = current.slice();
-      const targetIndex = segment === "-" ? clone.length : Number(segment);
-      clone[targetIndex] = isLast
-        ? value
-        : update(clone[targetIndex], index + 1);
+      clone[targetIndex] = next;
       return clone;
     }
 
-    const clone: Record<string, unknown> = isRecord(current)
-      ? { ...current }
-      : {};
-    const child = clone[segment];
-    clone[segment] = isLast
+    const record: Record<string, unknown> = isRecord(current) ? current : {};
+    const child = Object.hasOwn(record, segment) ? record[segment] : undefined;
+    const next = isLast
       ? value
       : update(
           child ??
@@ -137,10 +192,14 @@ const setAtPointer = (
               : {}),
           index + 1,
         );
-    return clone;
+    if (next === INVALID_POINTER) return INVALID_POINTER;
+    return { ...record, [segment]: next };
   };
 
-  return { ok: true, value: update(model, 0) };
+  const result = update(model, 0);
+  return result === INVALID_POINTER
+    ? { ok: false, value: model }
+    : { ok: true, value: result };
 };
 
 const dataModelValue = (
@@ -264,7 +323,12 @@ export function applyA2uiOperations(
         );
         continue;
       }
-      const result = setAtPointer(surface.dataModel, path, update.value);
+      const result = setAtPointer(
+        surface.dataModel,
+        path,
+        update.value,
+        version === "v1.0",
+      );
       if (!result.ok) {
         warnings.push(
           `Operation at index ${index} has an invalid JSON Pointer path.`,

package/src/buildPresentParameters.ts

@@ -29,7 +29,7 @@ export function buildPresentParameters(
   // `children` are framework-reserved (see ir.ts), so drop any author-declared
   // copies. On a name clash the first component's schema wins — props are an
   // advisory hint here, not a strict per-component contract.
-  const props: Record<string, JSONSchema7Definition> = {};
+  const props = new Map<string, JSONSchema7Definition>();
   const propOwners = new Map<string, string[]>();
   for (const name of names) {
     const propsSchema = toJSONSchema(library[name]!.properties);
@@ -41,8 +41,11 @@ export function buildPresentParameters(
     }
     for (const [key, schema] of Object.entries(propsSchema.properties ?? {})) {
       if (key.startsWith("$") || key === "children") continue;
-      if (!(key in props)) {
-        props[key] = schema;
+      // secure-json-parse rejects the whole tool-argument payload on this key,
+      // so advertising it would cost the model the node rather than one prop.
+      if (key === "__proto__") continue;
+      if (!props.has(key)) {
+        props.set(key, schema);
       }
       propOwners.set(key, [...(propOwners.get(key) ?? []), name]);
     }
@@ -78,7 +81,7 @@ export function buildPresentParameters(
           "Stable identity for this UI node. Use it for list items that may reorder.",
         anyOf: [{ type: "string" }, { type: "number" }],
       },
-      ...props,
+      ...Object.fromEntries(props),
       children: { $ref: "#/$defs/children" },
     },
     required: [TYPE_KEY],

package/src/convert/boundSpec.test.ts

@@ -20,10 +20,12 @@ const nest = (levels: number): unknown =>
     : { type: "Box", children: [nest(levels - 1)] };
 
 describe("boundSpec", () => {
-  it("returns a value without children as-is", () => {
+  it("copies an object without children and passes primitives through", () => {
     const leaf = { type: "Text", props: { value: "hi" } };
+    const { reasons, result } = walk(leaf);
 
-    expect(walk(leaf)).toEqual({ reasons: [], result: leaf });
+    expect({ reasons, result }).toEqual({ reasons: [], result: leaf });
+    expect(result).not.toBe(leaf);
     expect(walk("text").result).toBe("text");
     expect(walk(null).result).toBe(null);
   });
@@ -86,6 +88,49 @@ describe("boundSpec", () => {
     expect(result).toEqual([{ type: "Text" }, { type: "Text" }]);
   });
 
+  it("bounds a record that hides its children behind a has trap", () => {
+    const hostileChildren = new Proxy([{ type: "Text" }], {
+      get: (target, prop, receiver) =>
+        prop === "length"
+          ? Number.MAX_SAFE_INTEGER
+          : Reflect.get(target, prop, receiver),
+    });
+    const hostile = new Proxy(
+      { type: "Box", children: hostileChildren } as Record<string, unknown>,
+      {
+        has: (target, prop) => prop !== "children" && Reflect.has(target, prop),
+      },
+    );
+
+    const { reasons, result } = walk(hostile);
+
+    expect(reasons).toEqual(["children"]);
+    expect((result as { children: unknown[] }).children).toHaveLength(
+      CHILDREN_CAP,
+    );
+  });
+
+  it("bounds a record that answers a later read of children differently", () => {
+    let reads = 0;
+    const hostile = new Proxy(
+      { type: "Box", children: undefined } as Record<string, unknown>,
+      {
+        get: (target, prop, receiver) => {
+          if (prop !== "children") return Reflect.get(target, prop, receiver);
+          reads += 1;
+          return reads === 1
+            ? undefined
+            : Array(CHILDREN_CAP * 2).fill({ type: "Text" });
+        },
+      },
+    );
+
+    const { reasons, result } = walk(hostile);
+
+    expect(reasons).toEqual([]);
+    expect((result as { children: unknown }).children).toBeUndefined();
+  });
+
   it("accepts nesting exactly at the element-depth ceiling", () => {
     expect(walk(nest(MAX_ELEMENT_DEPTH)).reasons).toEqual([]);
   });