@kumwe/studio-core 0.1.0-alpha.7 → 0.1.0-alpha.8

package/dist/schema-profile.js

@@ -1,34 +1,62 @@
+import { canonicalStringify } from './canonical.js';
 import { compileProfileSchema } from './profile-validator.js';
 const DRAFT_2020_12 = 'https://json-schema.org/draft/2020-12/schema';
 const MAX_ALTERNATIVES = 64;
+const MAX_DESCRIPTION_LENGTH = 10_000;
 const MAX_ENUM_MEMBERS = 1_024;
+const MAX_EXAMPLES = 100;
 const MAX_JSON_DEPTH = 64;
 const MAX_JSON_ITEMS = 10_000;
 const MAX_JSON_PROPERTIES = 1_000;
 const MAX_REFERENCES = 128;
+const MAX_REFERENCE_LENGTH = 500;
 const MAX_SCHEMA_BYTES = 262_144;
 const MAX_SCHEMA_DEPTH = 32;
 const MAX_SCHEMA_MAP_PROPERTIES = 512;
 const MAX_SCHEMA_NODES = 1_024;
 const MAX_OBJECT_KEY_LENGTH = 200;
-/**
- * The published complexity limits of the Studio Schema Profile. The
- * machine-readable meta-schema (`schema-profile.schema.json`) carries the
- * same values; a parity test keeps the two from drifting.
- */
+const MAX_PROPERTY_NAMES = 512;
+const MAX_TITLE_LENGTH = 1_000;
+/** Published complexity limits, pinned to `$defs/limits` in the meta-schema. */
 export const STUDIO_SCHEMA_PROFILE_LIMITS = Object.freeze({
     maxAlternatives: MAX_ALTERNATIVES,
+    maxDescriptionLength: MAX_DESCRIPTION_LENGTH,
     maxEnumMembers: MAX_ENUM_MEMBERS,
+    maxExamples: MAX_EXAMPLES,
     maxJsonDepth: MAX_JSON_DEPTH,
     maxJsonItems: MAX_JSON_ITEMS,
     maxJsonProperties: MAX_JSON_PROPERTIES,
     maxObjectKeyLength: MAX_OBJECT_KEY_LENGTH,
+    maxPropertyNames: MAX_PROPERTY_NAMES,
+    maxReferenceLength: MAX_REFERENCE_LENGTH,
     maxReferences: MAX_REFERENCES,
     maxSchemaBytes: MAX_SCHEMA_BYTES,
     maxSchemaDepth: MAX_SCHEMA_DEPTH,
     maxSchemaMapProperties: MAX_SCHEMA_MAP_PROPERTIES,
     maxSchemaNodes: MAX_SCHEMA_NODES,
+    maxTitleLength: MAX_TITLE_LENGTH,
 });
+export const STUDIO_SCHEMA_PROFILE_ERROR_CODES = Object.freeze([
+    'invalid-root',
+    'unsupported-keyword',
+    'invalid-keyword-value',
+    'unsafe-member',
+    'limit-exceeded',
+    'invalid-reference',
+    'recursive-schema',
+]);
+/** A deterministic admission failure suitable for cross-runtime corpus comparison. */
+export class StudioSchemaProfileError extends TypeError {
+    code;
+    /** JSON Pointer to the rejected schema location; the empty string is the root. */
+    schemaPath;
+    constructor(code, schemaPath, message, options) {
+        super(message, options);
+        this.name = 'StudioSchemaProfileError';
+        this.code = code;
+        this.schemaPath = schemaPath;
+    }
+}
 const allowedKeywords = new Set([
     '$defs',
     '$ref',
@@ -69,55 +97,83 @@ const allowedKeywords = new Set([
     'uniqueItems',
     'writeOnly',
 ]);
-export function assertStudioPropertySchema(schema) {
-    const state = { references: 0, schemaNodes: 0, seen: new WeakSet() };
-    visitSchema(schema, '$', 1, state);
-    assertNonRecursiveSchema(schema);
-    let serialized;
+const typeNames = new Set(['array', 'boolean', 'integer', 'null', 'number', 'object', 'string']);
+class SchemaByteLimitError extends RangeError {
+}
+class SchemaBytePreflightDeferred extends TypeError {
+}
+/**
+ * Admit and compile one contributed block property schema. The alpha profile
+ * is deliberately object-rooted, closed, local-reference-only, non-recursive,
+ * and format-free. The returned interpreter performs no code generation.
+ */
+export function compileStudioPropertySchema(schema) {
+    if (!isRecord(schema)) {
+        reject('invalid-root', '', 'Studio property schema root must be a JSON Schema object.');
+    }
+    // Measure before sorting or recursively interpreting attacker-controlled
+    // maps. Canonical member order does not affect encoded length, so this
+    // bounded, iterative pass can fail oversized inputs without first
+    // allocating the canonical document or doing O(n log n) work.
     try {
-        serialized = JSON.stringify(schema);
+        assertCanonicalSchemaByteBudget(schema);
     }
     catch (error) {
-        throw new TypeError('Studio property schema must be an acyclic JSON document.', {
-            cause: error,
-        });
+        if (error instanceof SchemaByteLimitError) {
+            reject('limit-exceeded', '', `Studio property schema exceeds ${MAX_SCHEMA_BYTES} canonical UTF-8 bytes.`);
+        }
+        if (error instanceof SchemaBytePreflightDeferred) {
+            // Precise structural admission below owns diagnostics for JavaScript
+            // values that cannot have come from decoded JSON (cycles, aliases,
+            // sparse arrays, undefined, or exotic prototypes).
+        }
+        else {
+            reject('invalid-root', '', 'Studio property schema must be a bounded canonical JSON document.', error);
+        }
     }
-    if (utf8ByteLength(serialized) > MAX_SCHEMA_BYTES) {
-        throw new RangeError(`Studio property schema exceeds ${MAX_SCHEMA_BYTES} bytes.`);
+    const state = {
+        references: 0,
+        schemaNodes: 0,
+        seen: new WeakSet(),
+    };
+    const admissionFailures = [];
+    captureAdmissionFailure(() => visitSchema(schema, '', 1, state), admissionFailures);
+    captureAdmissionFailure(() => assertNonRecursiveSchema(schema), admissionFailures);
+    captureAdmissionFailure(() => assertClosedObjectRoot(schema), admissionFailures);
+    const admissionFailure = firstAdmissionFailure(schema, admissionFailures);
+    if (admissionFailure !== undefined) {
+        throw admissionFailure;
     }
     try {
-        // The eval-free interpreter is the reference implementation: it validates
-        // keyword operands, compiles bounded lexical patterns, and resolves local
-        // references, so a schema that fails to compile is rejected atomically.
-        compileProfileSchema(schema);
+        return compileProfileSchema(schema);
     }
     catch (error) {
-        throw new TypeError('Studio property schema does not compile under the strict profile.', {
-            cause: error,
-        });
+        // All public operand checks run above. Reaching this branch means the
+        // interpreter found an inconsistency, so fail closed without exposing an
+        // implementation-specific error taxonomy.
+        reject('invalid-keyword-value', '', 'Studio property schema does not compile under the strict profile.', error);
     }
 }
+/** Assert that a value is an admitted Studio property schema. */
+export function assertStudioPropertySchema(schema) {
+    compileStudioPropertySchema(schema);
+}
 function visitSchema(value, path, depth, state) {
     if (!isRecord(value)) {
-        throw new TypeError(`${path} must be a JSON Schema object.`);
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a JSON Schema object.`);
     }
     trackObject(value, path, state);
-    if (depth > MAX_SCHEMA_DEPTH) {
-        throw new RangeError(`${path} exceeds the Studio Schema Profile depth limit.`);
-    }
-    state.schemaNodes += 1;
-    if (state.schemaNodes > MAX_SCHEMA_NODES) {
-        throw new RangeError(`Studio property schema exceeds ${MAX_SCHEMA_NODES} schema nodes.`);
-    }
-    for (const [keyword, keywordValue] of Object.entries(value)) {
+    trackSchemaNode(path, depth, state);
+    for (const [keyword, operand] of boundedSchemaEntries(value)) {
+        const keywordPath = appendPointer(path, keyword);
         assertSafeObjectKey(keyword, path);
         if (!allowedKeywords.has(keyword)) {
-            throw new TypeError(`${path}.${keyword} is not allowed by the Studio Schema Profile.`);
+            reject('unsupported-keyword', keywordPath, `${displayPath(keywordPath)} uses keyword ${JSON.stringify(keyword)}, which is not allowed by the Studio Schema Profile.`);
         }
         switch (keyword) {
             case '$defs':
             case 'properties':
-                visitSchemaMap(keywordValue, `${path}.${keyword}`, depth + 1, state);
+                visitSchemaMap(operand, keywordPath, depth + 1, state);
                 break;
             case 'additionalProperties':
             case 'else':
@@ -126,72 +182,235 @@ function visitSchema(value, path, depth, state) {
             case 'not':
             case 'propertyNames':
             case 'then':
-                visitSubschema(keywordValue, `${path}.${keyword}`, depth + 1, state);
+                visitSubschema(operand, keywordPath, depth + 1, state);
                 break;
             case 'allOf':
             case 'anyOf':
             case 'oneOf':
             case 'prefixItems':
-                visitSchemaArray(keywordValue, `${path}.${keyword}`, depth + 1, state);
+                visitSchemaArray(operand, keywordPath, depth + 1, state);
                 break;
             case '$ref':
-                visitReference(keywordValue, `${path}.${keyword}`, state);
+                visitReference(operand, keywordPath, state);
                 break;
             case '$schema':
-                if (keywordValue !== DRAFT_2020_12) {
-                    throw new TypeError(`${path} must declare JSON Schema Draft 2020-12.`);
+                if (operand !== DRAFT_2020_12) {
+                    reject('invalid-keyword-value', keywordPath, `${displayPath(keywordPath)} must declare JSON Schema Draft 2020-12.`);
                 }
                 break;
             case 'enum':
-                if (!Array.isArray(keywordValue) || keywordValue.length > MAX_ENUM_MEMBERS) {
-                    throw new RangeError(`${path}.enum exceeds ${MAX_ENUM_MEMBERS} members.`);
+                visitEnum(operand, keywordPath, 1, state);
+                break;
+            case 'examples':
+                visitExamples(operand, keywordPath, 1, state);
+                break;
+            case 'dependentRequired':
+                visitDependentRequired(operand, keywordPath, state);
+                break;
+            case 'required':
+                visitNameArray(operand, keywordPath, MAX_PROPERTY_NAMES, state);
+                break;
+            case 'type':
+                visitType(operand, keywordPath, state);
+                break;
+            case 'description':
+                visitBoundedString(operand, keywordPath, MAX_DESCRIPTION_LENGTH);
+                break;
+            case 'title':
+                visitBoundedString(operand, keywordPath, MAX_TITLE_LENGTH);
+                break;
+            case 'maxItems':
+            case 'maxLength':
+            case 'maxProperties':
+            case 'minItems':
+            case 'minLength':
+            case 'minProperties':
+                visitNonNegativeInteger(operand, keywordPath);
+                break;
+            case 'exclusiveMaximum':
+            case 'exclusiveMinimum':
+            case 'maximum':
+            case 'minimum':
+                visitFiniteNumber(operand, keywordPath);
+                break;
+            case 'multipleOf':
+                visitFiniteNumber(operand, keywordPath);
+                if (operand <= 0) {
+                    reject('invalid-keyword-value', keywordPath, `${displayPath(keywordPath)} must be greater than zero.`);
                 }
-                visitJsonValue(keywordValue, `${path}.enum`, depth + 1, state);
                 break;
-            default:
-                visitJsonValue(keywordValue, `${path}.${keyword}`, depth + 1, state);
+            case 'readOnly':
+            case 'uniqueItems':
+            case 'writeOnly':
+                if (typeof operand !== 'boolean') {
+                    reject('invalid-keyword-value', keywordPath, `${displayPath(keywordPath)} must be a boolean.`);
+                }
+                break;
+            case 'const':
+            case 'default':
+                visitJsonValue(operand, keywordPath, 1, state);
+                break;
         }
     }
 }
 function visitSchemaMap(value, path, depth, state) {
     if (!isRecord(value)) {
-        throw new TypeError(`${path} must be an object of schemas.`);
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be an object of schemas.`);
     }
     trackObject(value, path, state);
-    const entries = Object.entries(value);
-    if (entries.length > MAX_SCHEMA_MAP_PROPERTIES) {
-        throw new RangeError(`${path} exceeds ${MAX_SCHEMA_MAP_PROPERTIES} schema entries.`);
+    const keys = Object.keys(value);
+    if (keys.length > MAX_SCHEMA_MAP_PROPERTIES) {
+        reject('limit-exceeded', path, `${displayPath(path)} exceeds ${MAX_SCHEMA_MAP_PROPERTIES} schema entries.`);
     }
-    for (const [name, schema] of entries) {
+    for (const name of keys.sort(compareCodeUnits)) {
         assertSafeObjectKey(name, path);
-        visitSchema(schema, `${path}.${name}`, depth, state);
+        visitSchema(value[name], appendPointer(path, name), depth, state);
     }
 }
 function visitSchemaArray(value, path, depth, state) {
-    if (!Array.isArray(value) || value.length > MAX_ALTERNATIVES) {
-        throw new RangeError(`${path} must contain at most ${MAX_ALTERNATIVES} schemas.`);
+    if (!Array.isArray(value) || !isDenseArray(value)) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a dense JSON array of schemas.`);
+    }
+    if (value.length === 0) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must contain at least one schema.`);
+    }
+    if (value.length > MAX_ALTERNATIVES) {
+        reject('limit-exceeded', path, `${displayPath(path)} must contain at most ${MAX_ALTERNATIVES} schemas.`);
     }
     trackObject(value, path, state);
-    assertDenseArray(value, path);
     for (const [index, schema] of value.entries()) {
-        visitSubschema(schema, `${path}[${index}]`, depth, state);
+        visitSubschema(schema, appendPointer(path, String(index)), depth, state);
     }
 }
 function visitSubschema(value, path, depth, state) {
     if (typeof value === 'boolean') {
+        trackSchemaNode(path, depth, state);
         return;
     }
     visitSchema(value, path, depth, state);
 }
+function trackSchemaNode(path, depth, state) {
+    if (depth > MAX_SCHEMA_DEPTH) {
+        reject('limit-exceeded', path, `${displayPath(path)} exceeds the Studio Schema Profile depth limit.`);
+    }
+    state.schemaNodes += 1;
+    if (state.schemaNodes > MAX_SCHEMA_NODES) {
+        reject('limit-exceeded', path, `Studio property schema exceeds ${MAX_SCHEMA_NODES} schema nodes.`);
+    }
+}
 function visitReference(value, path, state) {
-    if (typeof value !== 'string' ||
-        (value !== '#' && !value.startsWith('#/')) ||
-        value.length > 500) {
-        throw new TypeError(`${path} must be a bounded local JSON Pointer reference.`);
+    if (!isPortableLocalReference(value)) {
+        reject('invalid-reference', path, `${displayPath(path)} must be a bounded local JSON Pointer reference.`);
     }
     state.references += 1;
     if (state.references > MAX_REFERENCES) {
-        throw new RangeError(`Studio property schema exceeds ${MAX_REFERENCES} references.`);
+        reject('limit-exceeded', path, `Studio property schema exceeds ${MAX_REFERENCES} references.`);
+    }
+}
+function visitEnum(value, path, depth, state) {
+    if (!Array.isArray(value) || !isDenseArray(value)) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a dense JSON array.`);
+    }
+    if (value.length === 0) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must contain at least one value.`);
+    }
+    if (value.length > MAX_ENUM_MEMBERS) {
+        reject('limit-exceeded', path, `${displayPath(path)} exceeds ${MAX_ENUM_MEMBERS} members.`);
+    }
+    trackObject(value, path, state);
+    const members = new Set();
+    for (const [index, member] of value.entries()) {
+        visitJsonValue(member, appendPointer(path, String(index)), depth, state);
+        const canonical = canonicalStringify(member, {
+            maximumDepth: MAX_JSON_DEPTH + 1,
+        });
+        if (members.has(canonical)) {
+            reject('invalid-keyword-value', appendPointer(path, String(index)), `${displayPath(path)} must contain unique JSON values.`);
+        }
+        members.add(canonical);
+    }
+}
+function visitExamples(value, path, depth, state) {
+    if (!Array.isArray(value) || !isDenseArray(value)) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a dense JSON array.`);
+    }
+    if (value.length > MAX_EXAMPLES) {
+        reject('limit-exceeded', path, `${displayPath(path)} exceeds ${MAX_EXAMPLES} examples.`);
+    }
+    trackObject(value, path, state);
+    for (const [index, example] of value.entries()) {
+        visitJsonValue(example, appendPointer(path, String(index)), depth, state);
+    }
+}
+function visitDependentRequired(value, path, state) {
+    if (!isRecord(value)) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be an object of property-name arrays.`);
+    }
+    trackObject(value, path, state);
+    const keys = Object.keys(value);
+    if (keys.length > MAX_SCHEMA_MAP_PROPERTIES) {
+        reject('limit-exceeded', path, `${displayPath(path)} exceeds ${MAX_SCHEMA_MAP_PROPERTIES} dependency entries.`);
+    }
+    for (const name of keys.sort(compareCodeUnits)) {
+        assertSafeObjectKey(name, path);
+        visitNameArray(value[name], appendPointer(path, name), MAX_PROPERTY_NAMES, state);
+    }
+}
+function visitNameArray(value, path, maximum, state) {
+    if (!Array.isArray(value) || !isDenseArray(value)) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a dense array of property names.`);
+    }
+    if (value.length > maximum) {
+        reject('limit-exceeded', path, `${displayPath(path)} exceeds ${maximum} property names.`);
+    }
+    trackObject(value, path, state);
+    const names = new Set();
+    for (const [index, name] of value.entries()) {
+        if (typeof name !== 'string') {
+            reject('invalid-keyword-value', appendPointer(path, String(index)), `${displayPath(path)} must contain only property-name strings.`);
+        }
+        assertSafeObjectKey(name, path, appendPointer(path, String(index)));
+        if (names.has(name)) {
+            reject('invalid-keyword-value', appendPointer(path, String(index)), `${displayPath(path)} must list unique property names.`);
+        }
+        names.add(name);
+    }
+}
+function visitType(value, path, state) {
+    if (typeof value === 'string') {
+        if (!typeNames.has(value)) {
+            reject('invalid-keyword-value', path, `${displayPath(path)} names an unknown JSON Schema type.`);
+        }
+        return;
+    }
+    if (!Array.isArray(value) || !isDenseArray(value) || value.length === 0 || value.length > 7) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a type name or a non-empty array of at most seven names.`);
+    }
+    trackObject(value, path, state);
+    const names = new Set();
+    for (const [index, name] of value.entries()) {
+        if (typeof name !== 'string' || !typeNames.has(name) || names.has(name)) {
+            reject('invalid-keyword-value', appendPointer(path, String(index)), `${displayPath(path)} must list unique, known JSON Schema type names.`);
+        }
+        names.add(name);
+    }
+}
+function visitBoundedString(value, path, maximum) {
+    if (typeof value !== 'string') {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a string.`);
+    }
+    if (codePointLength(value) > maximum) {
+        reject('limit-exceeded', path, `${displayPath(path)} exceeds ${maximum} characters.`);
+    }
+}
+function visitNonNegativeInteger(value, path) {
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a non-negative integer.`);
+    }
+}
+function visitFiniteNumber(value, path) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        reject('invalid-keyword-value', path, `${displayPath(path)} must be a finite number.`);
     }
 }
 function visitJsonValue(value, path, depth, state) {
@@ -202,136 +421,398 @@ function visitJsonValue(value, path, depth, state) {
         return;
     }
     if (depth > MAX_JSON_DEPTH) {
-        throw new RangeError(`${path} exceeds the Studio Schema Profile JSON depth limit.`);
+        reject('limit-exceeded', path, `${displayPath(path)} exceeds the Studio Schema Profile JSON depth limit.`);
     }
     if (Array.isArray(value)) {
+        if (!isDenseArray(value)) {
+            reject('invalid-keyword-value', path, `${displayPath(path)} must be a dense JSON array.`);
+        }
         trackObject(value, path, state);
-        assertDenseArray(value, path);
         if (value.length > MAX_JSON_ITEMS) {
-            throw new RangeError(`${path} exceeds ${MAX_JSON_ITEMS} JSON items.`);
+            reject('limit-exceeded', path, `${displayPath(path)} exceeds ${MAX_JSON_ITEMS} JSON items.`);
         }
         for (const [index, entry] of value.entries()) {
-            visitJsonValue(entry, `${path}[${index}]`, depth + 1, state);
+            visitJsonValue(entry, appendPointer(path, String(index)), depth + 1, state);
         }
         return;
     }
     if (isRecord(value)) {
         trackObject(value, path, state);
-        const entries = Object.entries(value);
-        if (entries.length > MAX_JSON_PROPERTIES) {
-            throw new RangeError(`${path} exceeds ${MAX_JSON_PROPERTIES} JSON properties.`);
+        const keys = Object.keys(value);
+        if (keys.length > MAX_JSON_PROPERTIES) {
+            reject('limit-exceeded', path, `${displayPath(path)} exceeds ${MAX_JSON_PROPERTIES} JSON properties.`);
         }
-        for (const [key, entry] of entries) {
+        for (const key of keys.sort(compareCodeUnits)) {
             assertSafeObjectKey(key, path);
-            visitJsonValue(entry, `${path}.${key}`, depth + 1, state);
+            visitJsonValue(value[key], appendPointer(path, key), depth + 1, state);
         }
         return;
     }
-    throw new TypeError(`${path} is not JSON-compatible.`);
+    reject('invalid-keyword-value', path, `${displayPath(path)} is not JSON-compatible.`);
+}
+function assertClosedObjectRoot(schema) {
+    // Root invariants follow the same UTF-16 member precedence as the general
+    // admission walk: additionalProperties sorts before type.
+    if (schema.additionalProperties !== false) {
+        reject('invalid-root', '/additionalProperties', 'Studio property schema root must declare additionalProperties: false.');
+    }
+    if (schema.type !== 'object') {
+        reject('invalid-root', '/type', 'Studio property schema root must declare exactly type "object".');
+    }
 }
-function assertSafeObjectKey(key, path) {
+function captureAdmissionFailure(action, failures) {
+    try {
+        action();
+    }
+    catch (error) {
+        if (error instanceof StudioSchemaProfileError) {
+            failures.push(error);
+            return;
+        }
+        throw error;
+    }
+}
+function firstAdmissionFailure(root, failures) {
+    let first;
+    for (const failure of failures) {
+        if (first === undefined ||
+            compareAdmissionPaths(root, failure.schemaPath, first.schemaPath) < 0) {
+            first = failure;
+        }
+    }
+    return first;
+}
+/**
+ * Compare two diagnostic locations in the same order the admission grammar
+ * visits them: object members by UTF-16 code unit, array members by numeric
+ * index, and a container before any descendant. Missing root invariants are
+ * virtual object members, so they participate without a special-case pass
+ * precedence.
+ */
+function compareAdmissionPaths(root, left, right) {
+    const leftTokens = pointerTokens(left);
+    const rightTokens = pointerTokens(right);
+    let parent = root;
+    const sharedLength = Math.min(leftTokens.length, rightTokens.length);
+    for (let index = 0; index < sharedLength; index += 1) {
+        const leftToken = leftTokens[index];
+        const rightToken = rightTokens[index];
+        if (leftToken === undefined || rightToken === undefined) {
+            break;
+        }
+        if (leftToken !== rightToken) {
+            if (Array.isArray(parent)) {
+                const leftIndex = Number(leftToken);
+                const rightIndex = Number(rightToken);
+                if (Number.isSafeInteger(leftIndex) && Number.isSafeInteger(rightIndex)) {
+                    return leftIndex - rightIndex;
+                }
+            }
+            return compareCodeUnits(leftToken, rightToken);
+        }
+        if ((isRecord(parent) || Array.isArray(parent)) && Object.hasOwn(parent, leftToken)) {
+            parent = parent[leftToken];
+        }
+        else {
+            parent = undefined;
+        }
+    }
+    return leftTokens.length - rightTokens.length;
+}
+function pointerTokens(pointer) {
+    if (pointer === '') {
+        return [];
+    }
+    return pointer
+        .slice(1)
+        .split('/')
+        .map((token) => token.replaceAll('~1', '/').replaceAll('~0', '~'));
+}
+function assertSafeObjectKey(key, path, rejectionPath = appendPointer(path, key)) {
+    if (codePointLength(key) > MAX_OBJECT_KEY_LENGTH) {
+        reject('limit-exceeded', rejectionPath, `${displayPath(path)} contains an object member name longer than ${MAX_OBJECT_KEY_LENGTH} characters.`);
+    }
     if (key.length === 0 ||
-        key.length > MAX_OBJECT_KEY_LENGTH ||
         key === '__proto__' ||
         key === 'constructor' ||
         key === 'prototype' ||
         containsControlCharacter(key)) {
-        throw new TypeError(`${path} contains forbidden object member name ${JSON.stringify(key)}.`);
+        reject('unsafe-member', rejectionPath, `${displayPath(path)} contains forbidden object member name ${JSON.stringify(key)}.`);
     }
 }
 function assertNonRecursiveSchema(root) {
-    const active = new WeakSet();
-    const finished = new WeakSet();
-    const stack = [{ entered: false, node: root }];
+    const failures = [];
+    const indexes = new Map();
+    const adjacency = [];
+    const reverseAdjacency = [];
+    const referenceSites = [];
+    const expanded = new WeakSet();
+    let eligibleReferences = 0;
+    const appendGraphPath = (parent, token) => ({
+        parent,
+        token,
+    });
+    const graphPathPointer = (path) => {
+        const tokens = [];
+        let current = path;
+        while (current !== undefined) {
+            tokens.push(current.token);
+            current = current.parent;
+        }
+        let pointer = '';
+        for (let index = tokens.length - 1; index >= 0; index -= 1) {
+            const token = tokens[index];
+            if (token !== undefined) {
+                pointer = appendPointer(pointer, token);
+            }
+        }
+        return pointer;
+    };
+    const ensureNode = (node) => {
+        const existing = indexes.get(node);
+        if (existing !== undefined) {
+            return existing;
+        }
+        const index = adjacency.length;
+        indexes.set(node, index);
+        adjacency.push([]);
+        reverseAdjacency.push([]);
+        return index;
+    };
+    const connect = (source, target) => {
+        adjacency[source]?.push(target);
+        reverseAdjacency[target]?.push(source);
+    };
+    ensureNode(root);
+    const stack = [
+        { depth: 1, diagnosticsEligible: true, node: root, path: undefined },
+    ];
     while (stack.length > 0) {
         const frame = stack.pop();
-        if (frame === undefined || finished.has(frame.node)) {
-            continue;
-        }
-        if (frame.entered) {
-            active.delete(frame.node);
-            finished.add(frame.node);
+        if (frame === undefined || expanded.has(frame.node)) {
             continue;
         }
-        if (active.has(frame.node)) {
-            throw new TypeError('Recursive contributed schemas are not admitted by the alpha profile.');
-        }
-        active.add(frame.node);
-        stack.push({ entered: true, node: frame.node });
-        const dependencies = schemaDependencies(frame.node, root);
-        for (let index = dependencies.length - 1; index >= 0; index -= 1) {
-            const dependency = dependencies[index];
-            if (dependency === undefined || finished.has(dependency)) {
-                continue;
+        expanded.add(frame.node);
+        const source = ensureNode(frame.node);
+        const children = [];
+        const addChild = (value, path, diagnosticsEligible = frame.diagnosticsEligible) => {
+            if (!isRecord(value)) {
+                return;
             }
-            if (active.has(dependency)) {
-                throw new TypeError('Recursive contributed schemas are not admitted by the alpha profile.');
+            const target = ensureNode(value);
+            connect(source, target);
+            const depth = frame.depth + 1;
+            children.push({
+                depth,
+                diagnosticsEligible: diagnosticsEligible && depth <= MAX_SCHEMA_DEPTH,
+                node: value,
+                path,
+            });
+        };
+        for (const [keyword, operand] of boundedSchemaEntries(frame.node)) {
+            const keywordPath = appendGraphPath(frame.path, keyword);
+            switch (keyword) {
+                case '$defs':
+                case 'properties':
+                    if (isRecord(operand)) {
+                        const names = Object.keys(operand);
+                        const childrenEligible = names.length <= MAX_SCHEMA_MAP_PROPERTIES;
+                        if (childrenEligible) {
+                            names.sort(compareCodeUnits);
+                        }
+                        for (const name of names) {
+                            addChild(operand[name], appendGraphPath(keywordPath, name), frame.diagnosticsEligible && childrenEligible);
+                        }
+                    }
+                    break;
+                case '$ref':
+                    if (isPortableLocalReference(operand)) {
+                        const reportsDiagnostic = frame.diagnosticsEligible && (eligibleReferences += 1) <= MAX_REFERENCES;
+                        const referencePath = reportsDiagnostic ? graphPathPointer(keywordPath) : '';
+                        try {
+                            const target = resolveLocalReference(root, operand, referencePath);
+                            if (!target.schemaPosition) {
+                                if (reportsDiagnostic) {
+                                    failures.push(new StudioSchemaProfileError('invalid-reference', referencePath, `Local schema reference ${operand} does not resolve to a schema position.`));
+                                }
+                            }
+                            else if (isRecord(target.value)) {
+                                const targetIndex = ensureNode(target.value);
+                                connect(source, targetIndex);
+                                if (reportsDiagnostic) {
+                                    referenceSites.push({ path: referencePath, source, target: targetIndex });
+                                }
+                            }
+                        }
+                        catch (error) {
+                            if (error instanceof StudioSchemaProfileError) {
+                                if (reportsDiagnostic) {
+                                    failures.push(error);
+                                }
+                            }
+                            else {
+                                throw error;
+                            }
+                        }
+                    }
+                    break;
+                case 'additionalProperties':
+                case 'else':
+                case 'if':
+                case 'items':
+                case 'not':
+                case 'propertyNames':
+                case 'then':
+                    addChild(operand, keywordPath);
+                    break;
+                case 'allOf':
+                case 'anyOf':
+                case 'oneOf':
+                case 'prefixItems':
+                    if (Array.isArray(operand)) {
+                        const childrenEligible = operand.length > 0 && operand.length <= MAX_ALTERNATIVES && isDenseArray(operand);
+                        for (let index = 0; index < operand.length; index += 1) {
+                            if (Object.hasOwn(operand, index)) {
+                                addChild(operand[index], appendGraphPath(keywordPath, String(index)), frame.diagnosticsEligible && childrenEligible);
+                            }
+                        }
+                    }
+                    break;
             }
-            stack.push({ entered: false, node: dependency });
-        }
-    }
-}
-function schemaDependencies(schema, root) {
-    const dependencies = [];
-    for (const keyword of [
-        'additionalProperties',
-        'else',
-        'if',
-        'items',
-        'not',
-        'propertyNames',
-        'then',
-    ]) {
-        appendSchemaDependency(dependencies, schema[keyword]);
-    }
-    for (const keyword of ['allOf', 'anyOf', 'oneOf', 'prefixItems']) {
-        const candidates = schema[keyword];
-        if (Array.isArray(candidates)) {
-            for (const candidate of candidates) {
-                appendSchemaDependency(dependencies, candidate);
+        }
+        for (let index = children.length - 1; index >= 0; index -= 1) {
+            const child = children[index];
+            if (child !== undefined) {
+                stack.push(child);
             }
         }
     }
-    for (const keyword of ['$defs', 'properties']) {
-        const schemaMap = schema[keyword];
-        if (isRecord(schemaMap)) {
-            for (const candidate of Object.values(schemaMap)) {
-                appendSchemaDependency(dependencies, candidate);
-            }
+    const components = stronglyConnectedComponents(adjacency, reverseAdjacency);
+    for (const site of referenceSites) {
+        if (components[site.source] === components[site.target]) {
+            failures.push(new StudioSchemaProfileError('recursive-schema', site.path, 'Recursive contributed schemas are not admitted by the alpha profile.'));
         }
     }
-    if (typeof schema.$ref === 'string') {
-        appendSchemaDependency(dependencies, resolveLocalReference(root, schema.$ref));
+    const failure = firstAdmissionFailure(root, failures);
+    if (failure !== undefined) {
+        throw failure;
     }
-    return dependencies;
 }
-function appendSchemaDependency(dependencies, value) {
-    if (isRecord(value)) {
-        dependencies.push(value);
+function stronglyConnectedComponents(adjacency, reverseAdjacency) {
+    const visited = new Uint8Array(adjacency.length);
+    const finishOrder = [];
+    for (let start = 0; start < adjacency.length; start += 1) {
+        if (visited[start] !== 0) {
+            continue;
+        }
+        visited[start] = 1;
+        const stack = [{ edge: 0, node: start }];
+        while (stack.length > 0) {
+            const frame = stack[stack.length - 1];
+            if (frame === undefined) {
+                break;
+            }
+            const edges = adjacency[frame.node] ?? [];
+            const target = edges[frame.edge];
+            if (target !== undefined) {
+                frame.edge += 1;
+                if (visited[target] === 0) {
+                    visited[target] = 1;
+                    stack.push({ edge: 0, node: target });
+                }
+            }
+            else {
+                finishOrder.push(frame.node);
+                stack.pop();
+            }
+        }
     }
+    const components = new Int32Array(adjacency.length);
+    components.fill(-1);
+    let component = 0;
+    for (let order = finishOrder.length - 1; order >= 0; order -= 1) {
+        const start = finishOrder[order];
+        if (start === undefined || components[start] !== -1) {
+            continue;
+        }
+        components[start] = component;
+        const stack = [start];
+        while (stack.length > 0) {
+            const node = stack.pop();
+            if (node === undefined) {
+                continue;
+            }
+            for (const source of reverseAdjacency[node] ?? []) {
+                if (components[source] === -1) {
+                    components[source] = component;
+                    stack.push(source);
+                }
+            }
+        }
+        component += 1;
+    }
+    return components;
 }
-function resolveLocalReference(root, reference) {
+function resolveLocalReference(root, reference, path) {
     if (reference === '#') {
-        return root;
+        return { schemaPosition: true, value: root };
     }
     let current = root;
+    let position = 'schema';
     for (const encodedToken of reference.slice(2).split('/')) {
-        if (/(?:~[^01]|~$)/u.test(encodedToken)) {
-            throw new TypeError(`Local schema reference ${reference} is not a valid JSON Pointer.`);
-        }
         const token = encodedToken.replaceAll('~1', '/').replaceAll('~0', '~');
+        let nextPosition = 'other';
+        if (position === 'schema' && isRecord(current)) {
+            switch (token) {
+                case '$defs':
+                case 'properties':
+                    nextPosition = 'schema-map';
+                    break;
+                case 'additionalProperties':
+                case 'else':
+                case 'if':
+                case 'items':
+                case 'not':
+                case 'propertyNames':
+                case 'then':
+                    nextPosition = 'schema';
+                    break;
+                case 'allOf':
+                case 'anyOf':
+                case 'oneOf':
+                case 'prefixItems':
+                    nextPosition = 'schema-array';
+                    break;
+            }
+        }
+        else if (position === 'schema-map' && isRecord(current)) {
+            nextPosition = 'schema';
+        }
+        else if (position === 'schema-array' && Array.isArray(current)) {
+            nextPosition = 'schema';
+        }
         if (!isRecord(current) && !Array.isArray(current)) {
-            throw new TypeError(`Local schema reference ${reference} does not resolve to a schema.`);
+            reject('invalid-reference', path, `Local schema reference ${reference} does not resolve to a schema.`);
         }
         if (!Object.hasOwn(current, token)) {
-            throw new TypeError(`Local schema reference ${reference} does not resolve to a schema.`);
+            reject('invalid-reference', path, `Local schema reference ${reference} does not resolve to a schema.`);
         }
         current = current[token];
+        position = nextPosition;
     }
     if (typeof current !== 'boolean' && !isRecord(current)) {
-        throw new TypeError(`Local schema reference ${reference} does not resolve to a schema.`);
+        reject('invalid-reference', path, `Local schema reference ${reference} does not resolve to a schema.`);
     }
-    return current;
+    return { schemaPosition: position === 'schema', value: current };
+}
+function reject(code, schemaPath, message, cause) {
+    throw new StudioSchemaProfileError(code, schemaPath, message, cause === undefined ? undefined : { cause });
+}
+function appendPointer(pointer, token) {
+    return `${pointer}/${token.replaceAll('~', '~0').replaceAll('/', '~1')}`;
+}
+function displayPath(path) {
+    return path === '' ? 'schema root' : path;
 }
 function containsControlCharacter(value) {
     for (let index = 0; index < value.length; index += 1) {
@@ -342,49 +823,193 @@ function containsControlCharacter(value) {
     }
     return false;
 }
-function assertDenseArray(value, path) {
-    const keys = Object.keys(value);
-    if (keys.length !== value.length || keys.some((key, index) => key !== String(index))) {
-        throw new TypeError(`${path} must be a dense JSON array without extra properties.`);
-    }
+function isPortableLocalReference(value) {
+    return (typeof value === 'string' &&
+        codePointLength(value) <= MAX_REFERENCE_LENGTH &&
+        !containsControlCharacter(value) &&
+        /^#(?:\/(?:[A-Za-z0-9._!$&'()*+,;=:@-]|~[01])*)*$/u.test(value));
 }
-function trackObject(value, path, state) {
-    if (state.seen.has(value)) {
-        throw new TypeError(`${path} reuses or cycles a JSON object.`);
+function codePointLength(value) {
+    let length = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        length += 1;
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff && index + 1 < value.length) {
+            const next = value.charCodeAt(index + 1);
+            if ((next & 0xfc00) === 0xdc00) {
+                index += 1;
+            }
+        }
     }
-    state.seen.add(value);
+    return length;
 }
-function isRecord(value) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        return false;
+/**
+ * Enforce the canonical byte ceiling without materialising or sorting the
+ * canonical document. Object order cannot change encoded length. This pass
+ * is iterative so an over-deep untrusted value cannot exhaust the JavaScript
+ * call stack before the published schema/JSON depth checks run.
+ */
+function assertCanonicalSchemaByteBudget(root) {
+    const stack = [root];
+    const seen = new WeakSet();
+    let bytes = 0;
+    const consume = (amount) => {
+        bytes += amount;
+        if (bytes > MAX_SCHEMA_BYTES) {
+            throw new SchemaByteLimitError();
+        }
+    };
+    while (stack.length > 0) {
+        const value = stack.pop();
+        if (value === null) {
+            consume(4);
+            continue;
+        }
+        switch (typeof value) {
+            case 'boolean':
+                consume(value ? 4 : 5);
+                continue;
+            case 'number': {
+                if (!Number.isFinite(value)) {
+                    throw new SchemaBytePreflightDeferred();
+                }
+                const encoded = JSON.stringify(Object.is(value, -0) ? 0 : value);
+                consume(encoded.length);
+                continue;
+            }
+            case 'string':
+                consumeCanonicalJsonString(value, consume);
+                continue;
+            case 'object':
+                break;
+            default:
+                throw new SchemaBytePreflightDeferred();
+        }
+        if (seen.has(value)) {
+            throw new SchemaBytePreflightDeferred();
+        }
+        seen.add(value);
+        if (Array.isArray(value)) {
+            const members = value;
+            // Length alone accounts for brackets and separators. Reject an
+            // obviously oversized array before Object.keys allocates an entry for
+            // every member while checking density.
+            consume(2 + Math.max(0, members.length - 1));
+            if (!isDenseArray(members)) {
+                throw new SchemaBytePreflightDeferred();
+            }
+            for (let index = members.length - 1; index >= 0; index -= 1) {
+                const member = members[index];
+                if (member === undefined) {
+                    throw new SchemaBytePreflightDeferred();
+                }
+                stack.push(member);
+            }
+            continue;
+        }
+        if (!isRecord(value)) {
+            throw new SchemaBytePreflightDeferred();
+        }
+        const keys = Object.keys(value);
+        consume(2 + Math.max(0, keys.length - 1));
+        for (let index = keys.length - 1; index >= 0; index -= 1) {
+            const key = keys[index];
+            if (key === undefined) {
+                continue;
+            }
+            const member = value[key];
+            if (member === undefined) {
+                throw new SchemaBytePreflightDeferred();
+            }
+            consumeCanonicalJsonString(key, consume);
+            consume(1);
+            stack.push(member);
+        }
     }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
 }
-function utf8ByteLength(value) {
-    let bytes = 0;
+function consumeCanonicalJsonString(value, consume) {
+    consume(2); // opening and closing quotes
     for (let index = 0; index < value.length; index += 1) {
         const code = value.charCodeAt(index);
-        if (code <= 0x7f) {
-            bytes += 1;
+        if (code === 0x22 ||
+            code === 0x5c ||
+            code === 0x08 ||
+            code === 0x09 ||
+            code === 0x0a ||
+            code === 0x0c ||
+            code === 0x0d) {
+            consume(2);
+        }
+        else if (code <= 0x1f) {
+            consume(6);
+        }
+        else if (code <= 0x7f) {
+            consume(1);
         }
         else if (code <= 0x7ff) {
-            bytes += 2;
+            consume(2);
         }
         else if (code >= 0xd800 && code <= 0xdbff) {
             const next = value.charCodeAt(index + 1);
-            if (next >= 0xdc00 && next <= 0xdfff) {
-                bytes += 4;
+            if (index + 1 < value.length && (next & 0xfc00) === 0xdc00) {
+                consume(4);
                 index += 1;
             }
             else {
-                bytes += 3;
+                consume(6);
             }
         }
+        else if (code >= 0xdc00 && code <= 0xdfff) {
+            consume(6);
+        }
         else {
-            bytes += 3;
+            consume(3);
+        }
+    }
+}
+/**
+ * Sort at most the closed keyword set plus the first invalid member. This
+ * preserves deterministic first-error precedence without sorting an
+ * arbitrarily large attacker-controlled schema object.
+ */
+function boundedSchemaEntries(value) {
+    const keys = Object.keys(value);
+    if (keys.length <= allowedKeywords.size) {
+        return keys.sort(compareCodeUnits).map((key) => [key, value[key]]);
+    }
+    const candidates = [];
+    let firstInvalid;
+    for (const key of keys) {
+        if (allowedKeywords.has(key)) {
+            candidates.push(key);
+        }
+        else if (firstInvalid === undefined || compareCodeUnits(key, firstInvalid) < 0) {
+            firstInvalid = key;
         }
     }
-    return bytes;
+    if (firstInvalid !== undefined) {
+        candidates.push(firstInvalid);
+    }
+    return candidates.sort(compareCodeUnits).map((key) => [key, value[key]]);
+}
+function isDenseArray(value) {
+    const keys = Object.keys(value);
+    return keys.length === value.length && keys.every((key, index) => key === String(index));
+}
+function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function trackObject(value, path, state) {
+    if (state.seen.has(value)) {
+        reject('invalid-root', path, `${displayPath(path)} reuses or cycles a JSON object.`);
+    }
+    state.seen.add(value);
+}
+function isRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
 }
 //# sourceMappingURL=schema-profile.js.map