@lupinum/board-core 1.0.0-beta.1 → 1.0.0-beta.2

package/dist/{chunk-45V474TA.js → chunk-A7SXOVDB.js}

@@ -124,7 +124,29 @@ var BoardDestroyedError = class extends BoardError {
 };
 
 // src/helpers/json.ts
-function freezeJsonValue(value, path, ancestors = /* @__PURE__ */ new Set()) {
+var DEFAULT_MAX_JSON_DEPTH = 64;
+var DEFAULT_MAX_JSON_VALUES = 25e4;
+var DEFAULT_MAX_JSON_STRING_CHARACTERS = 8e6;
+function createJsonValueBudget() {
+  return {
+    remainingValues: DEFAULT_MAX_JSON_VALUES,
+    remainingStringCharacters: DEFAULT_MAX_JSON_STRING_CHARACTERS
+  };
+}
+function consumeBudget(budget, path, stringCharacters = 0) {
+  budget.remainingValues -= 1;
+  budget.remainingStringCharacters -= stringCharacters;
+  if (budget.remainingValues < 0 || budget.remainingStringCharacters < 0) {
+    throw new BoardInputError(`${path} exceeds the supported JSON size.`);
+  }
+}
+function freezeJsonValue(value, path, ancestors = /* @__PURE__ */ new Set(), budget = createJsonValueBudget(), depth = 0) {
+  if (depth > DEFAULT_MAX_JSON_DEPTH) {
+    throw new BoardInputError(
+      `${path} exceeds the supported JSON nesting depth.`
+    );
+  }
+  consumeBudget(budget, path, typeof value === "string" ? value.length : 0);
   if (value === null || typeof value === "string" || typeof value === "boolean") {
     return value;
   }
@@ -161,7 +183,13 @@ function freezeJsonValue(value, path, ancestors = /* @__PURE__ */ new Set()) {
           );
         }
         entries2.push(
-          freezeJsonValue(descriptor.value, `${path}[${index}]`, ancestors)
+          freezeJsonValue(
+            descriptor.value,
+            `${path}[${index}]`,
+            ancestors,
+            budget,
+            depth + 1
+          )
         );
       }
       return Object.freeze(entries2);
@@ -181,9 +209,19 @@ function freezeJsonValue(value, path, ancestors = /* @__PURE__ */ new Set()) {
           `${path}.${key} must be an enumerable data property.`
         );
       }
+      budget.remainingStringCharacters -= key.length;
+      if (budget.remainingStringCharacters < 0) {
+        throw new BoardInputError(`${path} exceeds the supported JSON size.`);
+      }
       entries.push([
         key,
-        freezeJsonValue(descriptor.value, `${path}.${key}`, ancestors)
+        freezeJsonValue(
+          descriptor.value,
+          `${path}.${key}`,
+          ancestors,
+          budget,
+          depth + 1
+        )
       ]);
     }
     return Object.freeze(Object.fromEntries(entries));
@@ -191,17 +229,20 @@ function freezeJsonValue(value, path, ancestors = /* @__PURE__ */ new Set()) {
     ancestors.delete(value);
   }
 }
-function freezeJsonObject(value, path) {
-  const cloned = freezeJsonValue(value, path);
+function freezeJsonObject(value, path, budget = createJsonValueBudget()) {
+  const cloned = freezeJsonValue(value, path, /* @__PURE__ */ new Set(), budget);
   if (Array.isArray(cloned) || cloned === null || typeof cloned !== "object") {
     throw new BoardInputError(`${path} must be a JSON object.`);
   }
   return cloned;
 }
-function collectJsonObjectExtras(value, knownKeys, path = "JSON object") {
+function collectJsonObjectExtras(value, knownKeys, path = "JSON object", budget = createJsonValueBudget()) {
   return Object.freeze(
     Object.fromEntries(
-      Object.entries(value).filter(([key]) => !knownKeys.has(key)).map(([key, entry]) => [key, freezeJsonValue(entry, `${path}.${key}`)])
+      Object.entries(value).filter(([key]) => !knownKeys.has(key)).map(([key, entry]) => [
+        key,
+        freezeJsonValue(entry, `${path}.${key}`, /* @__PURE__ */ new Set(), budget)
+      ])
     )
   );
 }
@@ -289,6 +330,7 @@ export {
   BoardNotFoundError,
   BoardConflictError,
   BoardDestroyedError,
+  createJsonValueBudget,
   freezeJsonValue,
   freezeJsonObject,
   collectJsonObjectExtras,

package/dist/helpers/json.d.ts

@@ -1,7 +1,13 @@
 import type { JsonObject, JsonValue } from '../types.js';
+export interface JsonValueBudget {
+    remainingValues: number;
+    remainingStringCharacters: number;
+}
+/** Create one shared resource budget for an untrusted JSON input boundary. */
+export declare function createJsonValueBudget(): JsonValueBudget;
 /** Clone, validate, and freeze a JSON-compatible value at an input boundary. */
-export declare function freezeJsonValue(value: unknown, path: string, ancestors?: Set<object>): JsonValue;
+export declare function freezeJsonValue(value: unknown, path: string, ancestors?: Set<object>, budget?: JsonValueBudget, depth?: number): JsonValue;
 /** Clone, validate, and freeze a JSON object at an input boundary. */
-export declare function freezeJsonObject(value: unknown, path: string): JsonObject;
+export declare function freezeJsonObject(value: unknown, path: string, budget?: JsonValueBudget): JsonObject;
 /** Retain unrecognized JSON fields without allowing them to override known fields. */
-export declare function collectJsonObjectExtras(value: Readonly<Record<string, unknown>>, knownKeys: ReadonlySet<string>, path?: string): JsonObject;
+export declare function collectJsonObjectExtras(value: Readonly<Record<string, unknown>>, knownKeys: ReadonlySet<string>, path?: string, budget?: JsonValueBudget): JsonObject;

package/dist/index.js

@@ -6,13 +6,14 @@ import {
   BoardNotFoundError,
   assertInternalBoardPlugin,
   collectJsonObjectExtras,
+  createJsonValueBudget,
   freezeClone,
   freezeJsonObject,
   readonlyMapView,
   readonlySetView,
   registerBoardInteractionAdapter,
   sameArray
-} from "./chunk-45V474TA.js";
+} from "./chunk-A7SXOVDB.js";
 
 // src/math.ts
 function clamp(value, min, max) {
@@ -699,6 +700,7 @@ function validateState(state, grid, context) {
     }
     zIndexes.add(node.zIndex);
   }
+  validateParentCycles(state, push);
   for (const id of state.selection.values()) {
     if (!state.nodes.has(id)) {
       push("selection.exists", `Selected node ${id} does not exist.`);
@@ -755,28 +757,26 @@ function validateNodeParent(node, state, push) {
       `Node ${node.id} parent must be type "group", got "${parent.type}".`
     );
   }
-  let walk = parent;
-  const seen = /* @__PURE__ */ new Set();
-  while (walk) {
-    if (seen.has(walk.id)) {
-      push(
-        "node.parentId",
-        `Cycle detected in parent chain for node ${node.id}.`
-      );
-      return;
-    }
-    seen.add(walk.id);
-    if (walk.id === node.id) {
-      push(
-        "node.parentId",
-        `Node ${node.id} would create a cycle in the parent chain.`
-      );
-      return;
-    }
-    if (!walk.parentId) {
-      break;
+}
+function validateParentCycles(state, push) {
+  const complete = /* @__PURE__ */ new Set();
+  for (const start of state.nodes.keys()) {
+    if (complete.has(start)) continue;
+    const path = [];
+    const pathIndexes = /* @__PURE__ */ new Map();
+    let current = start;
+    while (current !== void 0 && !complete.has(current)) {
+      const cycleStart = pathIndexes.get(current);
+      if (cycleStart !== void 0) {
+        const cycle = [...path.slice(cycleStart), current].join(" -> ");
+        push("node.parentId", `Cycle detected in parent chain: ${cycle}.`);
+        break;
+      }
+      pathIndexes.set(current, path.length);
+      path.push(current);
+      current = state.nodes.get(current)?.parentId;
     }
-    walk = state.nodes.get(walk.parentId);
+    for (const id of path) complete.add(id);
   }
 }
 
@@ -1543,6 +1543,9 @@ var JSON_CANVAS_SIDES = /* @__PURE__ */ new Set([
 ]);
 var JSON_CANVAS_EDGE_ENDS = /* @__PURE__ */ new Set(["none", "arrow"]);
 var JSON_CANVAS_BACKGROUND_STYLES = /* @__PURE__ */ new Set(["cover", "ratio", "repeat"]);
+var MAX_DOCUMENT_NODES = 1e4;
+var MAX_DOCUMENT_EDGES = 2e4;
+var MAX_DOCUMENT_SELECTION = 1e4;
 var LEGACY_BOARD_METADATA_KEY = "x-vue-board";
 var DOCUMENT_FIELDS = /* @__PURE__ */ new Set([
   "nodes",
@@ -1855,12 +1858,6 @@ function validateDocumentMetadata(metadata) {
           `Invalid board document: metadata for edge "${id}" has invalid data.`
         );
       }
-      if (edge.data !== void 0) {
-        freezeJsonObject(
-          edge.data,
-          `Invalid board document: metadata for edge "${id}" data`
-        );
-      }
     }
   }
 }
@@ -1873,6 +1870,19 @@ function normalizeDocumentForImport(raw) {
   if (!Array.isArray(parsed.nodes)) {
     throw new BoardInputError("Invalid board document: missing nodes array.");
   }
+  if (parsed.nodes.length > MAX_DOCUMENT_NODES) {
+    throw new BoardInputError(
+      `Invalid board document: nodes exceed the supported limit of ${MAX_DOCUMENT_NODES}.`
+    );
+  }
+  if (parsed.edges !== void 0 && !Array.isArray(parsed.edges)) {
+    throw new BoardInputError("Invalid board document: edges must be an array.");
+  }
+  if (parsed.edges && parsed.edges.length > MAX_DOCUMENT_EDGES) {
+    throw new BoardInputError(
+      `Invalid board document: edges exceed the supported limit of ${MAX_DOCUMENT_EDGES}.`
+    );
+  }
   for (const key of [
     "camera",
     "grid",
@@ -1888,10 +1898,29 @@ function normalizeDocumentForImport(raw) {
     }
   }
   const rawMetadata = getDocumentMetadata(parsed);
+  if (isRecord(rawMetadata)) {
+    if (Array.isArray(rawMetadata.selection) && rawMetadata.selection.length > MAX_DOCUMENT_SELECTION) {
+      throw new BoardInputError(
+        `Invalid board document: selection exceeds the supported limit of ${MAX_DOCUMENT_SELECTION}.`
+      );
+    }
+    if (isRecord(rawMetadata.nodes) && Reflect.ownKeys(rawMetadata.nodes).length > MAX_DOCUMENT_NODES) {
+      throw new BoardInputError(
+        `Invalid board document: node metadata exceeds the supported limit of ${MAX_DOCUMENT_NODES}.`
+      );
+    }
+    if (isRecord(rawMetadata.edges) && Reflect.ownKeys(rawMetadata.edges).length > MAX_DOCUMENT_EDGES) {
+      throw new BoardInputError(
+        `Invalid board document: edge metadata exceeds the supported limit of ${MAX_DOCUMENT_EDGES}.`
+      );
+    }
+  }
   validateDocumentMetadata(rawMetadata);
+  const jsonBudget = createJsonValueBudget();
   const metadata = rawMetadata === void 0 ? void 0 : freezeJsonObject(
     rawMetadata,
-    "Invalid board document: board metadata"
+    "Invalid board document: board metadata",
+    jsonBudget
   );
   const seenNodes = /* @__PURE__ */ new Set();
   const nodes = parsed.nodes.map((node) => {
@@ -1917,7 +1946,8 @@ function normalizeDocumentForImport(raw) {
     }
     const normalized = freezeJsonObject(
       node,
-      `Invalid board document: node "${String(node.id ?? "?")}"`
+      `Invalid board document: node "${String(node.id ?? "?")}"`,
+      jsonBudget
     );
     validateJsonCanvasNodeFields(normalized);
     if (seenNodes.has(normalized.id)) {
@@ -1930,11 +1960,6 @@ function normalizeDocumentForImport(raw) {
   });
   let edges;
   if (parsed.edges !== void 0) {
-    if (!Array.isArray(parsed.edges)) {
-      throw new BoardInputError(
-        "Invalid board document: edges must be an array."
-      );
-    }
     const seenEdges = /* @__PURE__ */ new Set();
     edges = parsed.edges.map((edge) => {
       if (!isRecord(edge)) {
@@ -1988,7 +2013,8 @@ function normalizeDocumentForImport(raw) {
       }
       return freezeJsonObject(
         { ...edge, id, fromNode, toNode },
-        `Invalid board document: edge "${id}"`
+        `Invalid board document: edge "${id}"`,
+        jsonBudget
       );
     });
   }
@@ -1996,7 +2022,8 @@ function normalizeDocumentForImport(raw) {
     ...collectJsonObjectExtras(
       parsedRecord,
       DOCUMENT_FIELDS,
-      "Invalid board document"
+      "Invalid board document",
+      jsonBudget
     ),
     nodes,
     ...edges !== void 0 ? { edges } : {},
@@ -2033,12 +2060,13 @@ function documentToSnapshot(document) {
       jsonNodeToBoardNode(node, metadata?.nodes?.[node.id], index)
     )
   );
+  const nodeIds = new Set(nodes.map((node) => node.id));
   const gridSettings = {
     ...DEFAULT_GRID,
     ...metadata?.grid ?? {}
   };
   const selection = Array.isArray(metadata?.selection) ? metadata.selection.filter(
-    (id) => typeof id === "string" && nodes.some((node) => node.id === id)
+    (id) => typeof id === "string" && nodeIds.has(id)
   ).map((id) => id) : [];
   const nextZIndex = metadata?.nextZIndex ?? nodes.reduce((max, node) => Math.max(max, node.zIndex), 0) + 1;
   const camera = { ...DEFAULT_CAMERA, ...metadata?.camera ?? {} };
@@ -3002,11 +3030,23 @@ function createBoardEngine(options = {}) {
       notifySnapGuidesChanged();
       return idMap;
     }
+    const reservedIds = new Set(state.nodes.keys());
+    for (const rawNode of snapshotNodes) {
+      let id = rawNode.id;
+      while (reservedIds.has(id)) id = createNodeId();
+      reservedIds.add(id);
+      idMap.set(rawNode.id, id);
+    }
     for (const rawNode of snapshotNodes) {
       const node = normalizeExistingNode(rawNode);
-      const id = state.nodes.has(node.id) ? createNodeId() : node.id;
-      state.nodes.set(id, { ...node, id, zIndex: state.nextZIndex++ });
-      idMap.set(node.id, id);
+      const id = idMap.get(node.id);
+      const parentId = node.parentId ? idMap.get(node.parentId) ?? node.parentId : void 0;
+      state.nodes.set(id, {
+        ...node,
+        id,
+        parentId,
+        zIndex: state.nextZIndex++
+      });
     }
     state.jsonCanvas = mergeJsonCanvasExtras(
       state.jsonCanvas,
@@ -3677,13 +3717,27 @@ function createBoardEngine(options = {}) {
       return runCommand("pasteData", [payload, offset], () => {
         const inputs = options.clipboard?.deserialize(payload) ?? null;
         if (!inputs || inputs.length === 0) return null;
-        const created = inputs.map(
-          (input) => normalizeNode({
-            ...input,
-            x: input.x ?? offset.x,
-            y: input.y ?? offset.y
-          })
-        );
+        const stagedNodes = new Map(state.nodes);
+        let nextZIndex = state.nextZIndex;
+        const created = inputs.map((input) => {
+          const normalized = normalizeNodeInput(
+            {
+              ...input,
+              x: input.x ?? offset.x,
+              y: input.y ?? offset.y
+            },
+            {
+              nodes: stagedNodes,
+              grid,
+              constraints: nodeConstraints,
+              nextZIndex
+            }
+          );
+          nextZIndex = normalized.nextZIndex;
+          stagedNodes.set(normalized.node.id, normalized.node);
+          return normalized.node;
+        });
+        state.nextZIndex = nextZIndex;
         for (const node of created) {
           state.nodes.set(node.id, node);
           emit("node:created", materializeNode2(node));

package/dist/internal.js

@@ -15,7 +15,7 @@ import {
   isBoardInteractiveEventTarget,
   isEventOwnedByBoardRoot,
   readonlyMapView
-} from "./chunk-45V474TA.js";
+} from "./chunk-A7SXOVDB.js";
 export {
   BOARD_EDITOR_ATTRIBUTE,
   BOARD_INTERACTIVE_ATTRIBUTE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lupinum/board-core",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.2",
   "description": "Headless node-based board engine for spatial editors, diagramming tools, and whiteboard-style interfaces.",
   "license": "MIT",
   "author": "Lupinum OG <info@lupinum.com> (https://lupinum.com)",