@object-ui/sdui-parser 11.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 ObjectQL
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/codegen.d.ts

@@ -0,0 +1,23 @@
+/**
+ * ObjectUI — codegen the JSX type surface from the registry manifest (ADR-0080 §3)
+ *
+ * Emits a `.d.ts` that augments `JSX.IntrinsicElements` so a constrained
+ * JSX-source page type-checks in `.tsx`: tag name === registry `type` key,
+ * attributes === the component's manifest `inputs`. This is a TYPE-CHECKING
+ * fiction — no real React intrinsic named `flex` exists; the interpreter
+ * fulfills it via the registry at render time.
+ */
+import type { Manifest } from './types.js';
+export interface CodegenOptions {
+    /** include a self-contained minimal JSX namespace so the d.ts type-checks
+     *  standalone (no React types needed). Default true. */
+    standaloneJsx?: boolean;
+}
+export declare function generateDts(manifest: Manifest, options?: CodegenOptions): string;
+/** 'object-grid' -> 'ObjectGrid', 'record:details' -> 'RecordDetails' */
+export declare function propsName(type: string): string;
+/**
+ * Generate the human-facing PUBLIC block list (the curated "清单") from a
+ * manifest — a Markdown table. Derived, never hand-maintained (ADR-0046).
+ */
+export declare function generateBlockList(manifest: Manifest): string;

package/dist/codegen.js

@@ -0,0 +1,120 @@
+/**
+ * ObjectUI — codegen the JSX type surface from the registry manifest (ADR-0080 §3)
+ *
+ * Emits a `.d.ts` that augments `JSX.IntrinsicElements` so a constrained
+ * JSX-source page type-checks in `.tsx`: tag name === registry `type` key,
+ * attributes === the component's manifest `inputs`. This is a TYPE-CHECKING
+ * fiction — no real React intrinsic named `flex` exists; the interpreter
+ * fulfills it via the registry at render time.
+ */
+export function generateDts(manifest, options = {}) {
+    const { standaloneJsx = true } = options;
+    const comps = Object.values(manifest.components).sort((a, b) => a.type.localeCompare(b.type));
+    const interfaces = comps.map(emitInterface).join('\n\n');
+    const intrinsics = comps
+        .map((c) => `      ${JSON.stringify(c.type)}: ${propsName(c.type)};`)
+        .join('\n');
+    const baseElement = standaloneJsx
+        ? `
+    // minimal, so the surface type-checks without pulling React types
+    type Element = unknown;
+    interface ElementClass {}
+    interface ElementAttributesProperty {}
+    interface ElementChildrenAttribute { children: object; }`
+        : '';
+    return `// AUTO-GENERATED by @object-ui/sdui-parser — DO NOT EDIT.
+// Source of truth: ComponentRegistry inputs (ADR-0080 §3). Regenerate via codegen.
+/* eslint-disable */
+
+export interface SduiBaseProps {
+  id?: string;
+  className?: string;
+  style?: Record<string, unknown>;
+  visible?: boolean;
+  visibleOn?: string;
+  disabled?: boolean;
+  disabledOn?: string;
+  children?: unknown;
+}
+
+${interfaces}
+
+declare global {
+  namespace JSX {
+    interface IntrinsicElements {
+${intrinsics}
+    }${baseElement}
+  }
+}
+
+export {};
+`;
+}
+function emitInterface(comp) {
+    const lines = comp.inputs
+        .filter((i) => i.type !== 'slot')
+        .map((i) => `  ${propLine(i)}`)
+        .join('\n');
+    return `export interface ${propsName(comp.type)} extends SduiBaseProps {\n${lines}\n}`;
+}
+function propLine(input) {
+    const opt = input.required ? '' : '?';
+    return `${quoteKeyIfNeeded(input.name)}${opt}: ${tsType(input)};`;
+}
+function tsType(input) {
+    switch (input.type) {
+        case 'number':
+            return 'number';
+        case 'boolean':
+            return 'boolean';
+        case 'array':
+            return 'unknown[]';
+        case 'object':
+            return 'Record<string, unknown>';
+        case 'enum': {
+            const vals = (input.enum ?? []).map((e) => (typeof e === 'object' ? e.value : e));
+            return vals.length ? vals.map((v) => JSON.stringify(v)).join(' | ') : 'string';
+        }
+        case 'string':
+        case 'color':
+        case 'date':
+        case 'code':
+        case 'file':
+        default:
+            return 'string';
+    }
+}
+const IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const quoteKeyIfNeeded = (name) => (IDENT.test(name) ? name : JSON.stringify(name));
+/** 'object-grid' -> 'ObjectGrid', 'record:details' -> 'RecordDetails' */
+export function propsName(type) {
+    const pascal = type
+        .split(/[^A-Za-z0-9]+/)
+        .filter(Boolean)
+        .map((s) => s[0].toUpperCase() + s.slice(1))
+        .join('');
+    return `${pascal}Props`;
+}
+/**
+ * Generate the human-facing PUBLIC block list (the curated "清单") from a
+ * manifest — a Markdown table. Derived, never hand-maintained (ADR-0046).
+ */
+export function generateBlockList(manifest) {
+    const rows = Object.values(manifest.components)
+        .sort((a, b) => a.type.localeCompare(b.type))
+        .map((c) => {
+        const req = c.inputs.filter((i) => i.required).map((i) => i.name);
+        const binds = c.inputs.filter((i) => i.binding).map((i) => `${i.name}:${i.binding}`);
+        return `| \`${c.type}\` | ${c.namespace ?? '—'} | ${c.isContainer ? '✓' : ''} | ${req.join(', ') || '—'} | ${binds.join(', ') || '—'} |`;
+    });
+    return [
+        `# SDUI public blocks (${Object.keys(manifest.components).length})`,
+        '',
+        '> Auto-generated from the registry `tier:\'public\'` set (ADR-0080). Do not edit by hand.',
+        '',
+        '| block | plugin | container | required props | bindings |',
+        '|---|---|---|---|---|',
+        ...rows,
+        '',
+    ].join('\n');
+}

package/dist/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @object-ui/sdui-parser — constrained JSX-source → SDUI SchemaNode tree (ADR-0080)
+ *
+ * Isomorphic, zero React. Run server-side as the authoritative save-time gate;
+ * may also run client-side for live edit preview (re-validated on the server —
+ * never the trust boundary). It PARSES; it never executes.
+ */
+export * from './types.js';
+export { parseJsx, interpretBrace } from './parse.js';
+export { validateTree } from './validate.js';
+export { generateDts, propsName, generateBlockList } from './codegen.js';
+export type { CodegenOptions } from './codegen.js';
+import type { Diagnostic, Manifest, SchemaElement, ValidationResult } from './types.js';
+export interface CompileResult {
+    tree: SchemaElement | null;
+    diagnostics: Diagnostic[];
+    requires: string[];
+    bindings: ValidationResult['bindings'];
+    /** true when there are no error-severity diagnostics — the save gate's pass/fail */
+    ok: boolean;
+}
+/**
+ * The authoritative pipeline: parse (with the manifest's tags as the whitelist)
+ * → validate against the manifest → derive `requires` + binding sites.
+ */
+export declare function compile(source: string, manifest: Manifest): CompileResult;
+export interface RegistryConfigLike {
+    type: string;
+    namespace?: string;
+    isContainer?: boolean;
+    /** ADR-0080 contract tier — only 'public' configs form the AI/contract surface. */
+    tier?: 'public' | 'internal';
+    label?: string;
+    category?: string;
+    inputs?: Array<{
+        name: string;
+        type: string;
+        required?: boolean;
+        enum?: Array<string | {
+            value: unknown;
+            label?: string;
+        }>;
+        binding?: 'object' | 'field';
+        description?: string;
+    }>;
+}
+export declare function manifestFromConfigs(configs: RegistryConfigLike[], opts?: {
+    only?: Set<string>;
+    publicOnly?: boolean;
+}): Manifest;

package/dist/index.js

@@ -0,0 +1,66 @@
+/**
+ * @object-ui/sdui-parser — constrained JSX-source → SDUI SchemaNode tree (ADR-0080)
+ *
+ * Isomorphic, zero React. Run server-side as the authoritative save-time gate;
+ * may also run client-side for live edit preview (re-validated on the server —
+ * never the trust boundary). It PARSES; it never executes.
+ */
+export * from './types.js';
+export { parseJsx, interpretBrace } from './parse.js';
+export { validateTree } from './validate.js';
+export { generateDts, propsName, generateBlockList } from './codegen.js';
+import { parseJsx } from './parse.js';
+import { validateTree } from './validate.js';
+/**
+ * The authoritative pipeline: parse (with the manifest's tags as the whitelist)
+ * → validate against the manifest → derive `requires` + binding sites.
+ */
+export function compile(source, manifest) {
+    const allowedTags = new Set(Object.keys(manifest.components));
+    const parsed = parseJsx(source, { allowedTags });
+    const validated = validateTree(parsed.tree, manifest);
+    const diagnostics = [...parsed.diagnostics, ...validated.diagnostics];
+    return {
+        tree: parsed.tree,
+        diagnostics,
+        requires: validated.requires,
+        bindings: validated.bindings,
+        ok: !diagnostics.some((d) => d.severity === 'error'),
+    };
+}
+const INPUT_TYPES = new Set([
+    'string',
+    'number',
+    'boolean',
+    'enum',
+    'array',
+    'object',
+    'color',
+    'date',
+    'code',
+    'file',
+    'slot',
+]);
+export function manifestFromConfigs(configs, opts = {}) {
+    const components = {};
+    for (const c of configs) {
+        if (opts.only && !opts.only.has(c.type))
+            continue;
+        if (opts.publicOnly && c.tier !== 'public')
+            continue;
+        components[c.type] = {
+            type: c.type,
+            namespace: c.namespace,
+            isContainer: c.isContainer,
+            inputs: (c.inputs ?? []).map((i) => ({
+                name: i.name,
+                type: (INPUT_TYPES.has(i.type) ? i.type : 'string'),
+                required: i.required,
+                enum: i.enum,
+                binding: i.binding,
+                description: i.description,
+            })),
+        };
+    }
+    return { components };
+}

package/dist/parse.d.ts

@@ -0,0 +1,24 @@
+/**
+ * ObjectUI — SDUI JSX-source parser (ADR-0080)
+ *
+ * A small recursive-descent parser for a CONSTRAINED JSX subset. It is
+ * deliberately not a full JS/JSX parser: a bounded grammar is the point
+ * (Markdoc model) — it shrinks the attack surface and the expressible-but-wrong
+ * space. Output is the existing SDUI `SchemaNode` tree. Nothing is executed.
+ *
+ * Grammar (informal):
+ *   document := element                       (exactly one root)
+ *   element  := openTag child-star closeTag, or a self-closing tag
+ *   attr     := name '=' (string | braced), or a bare name meaning true
+ *   child    := element | text | jsx-block-comment
+ *   tag      := [A-Za-z][A-Za-z0-9:_-]star      (matches registry keys)
+ */
+import type { ParseOptions, ParseResult } from './types.js';
+export declare function parseJsx(source: string, options?: ParseOptions): ParseResult;
+/**
+ * Interpret a braced attribute value `{...}`.
+ * JSON-literal values (numbers, booleans, null, strings, arrays, objects with
+ * quoted keys) are materialized. Anything else is kept as a deferred expression
+ * marker `{ $expr }` — typed and validated later, NEVER evaluated here.
+ */
+export declare function interpretBrace(raw: string): unknown;

package/dist/parse.js

@@ -0,0 +1,286 @@
+/**
+ * ObjectUI — SDUI JSX-source parser (ADR-0080)
+ *
+ * A small recursive-descent parser for a CONSTRAINED JSX subset. It is
+ * deliberately not a full JS/JSX parser: a bounded grammar is the point
+ * (Markdoc model) — it shrinks the attack surface and the expressible-but-wrong
+ * space. Output is the existing SDUI `SchemaNode` tree. Nothing is executed.
+ *
+ * Grammar (informal):
+ *   document := element                       (exactly one root)
+ *   element  := openTag child-star closeTag, or a self-closing tag
+ *   attr     := name '=' (string | braced), or a bare name meaning true
+ *   child    := element | text | jsx-block-comment
+ *   tag      := [A-Za-z][A-Za-z0-9:_-]star      (matches registry keys)
+ */
+/** Event handlers and raw-HTML injection are never allowed (parse ≠ execute). */
+const EVENT_ATTR = /^on[A-Z]/;
+const FORBIDDEN_ATTRS = new Set(['dangerouslySetInnerHTML', 'ref', 'key']);
+export function parseJsx(source, options = {}) {
+    return new Parser(source, options).parseDocument();
+}
+const isNameStart = (c) => /[A-Za-z]/.test(c);
+const isNameChar = (c) => /[A-Za-z0-9:_-]/.test(c);
+class Parser {
+    constructor(src, opts) {
+        Object.defineProperty(this, "src", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: src
+        });
+        Object.defineProperty(this, "opts", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: opts
+        });
+        Object.defineProperty(this, "pos", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
+        Object.defineProperty(this, "diagnostics", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: []
+        });
+    }
+    parseDocument() {
+        this.skipTrivia();
+        if (this.peek() !== '<') {
+            this.error('no-root', 'Expected a single root element');
+            return { tree: null, diagnostics: this.diagnostics };
+        }
+        const tree = this.parseElement();
+        this.skipTrivia();
+        if (tree && this.pos < this.src.length) {
+            this.error('multiple-roots', 'A page must have exactly one root element', this.pos);
+        }
+        return { tree, diagnostics: this.diagnostics };
+    }
+    parseElement() {
+        const start = this.pos;
+        if (!this.eat('<')) {
+            this.error('expected-element', 'Expected "<"', start);
+            return null;
+        }
+        const tag = this.readName();
+        if (!tag) {
+            this.error('bad-tag', 'Expected a tag name after "<"', start);
+            return null;
+        }
+        if (this.opts.allowedTags && !this.opts.allowedTags.has(tag)) {
+            this.error('forbidden-tag', `<${tag}> is not an allowed component`, start, tag);
+        }
+        const props = {};
+        for (;;) {
+            this.skipWs();
+            const c = this.peek();
+            if (c === '' || c === '>' || c === '/')
+                break;
+            const attr = this.parseAttr(start, tag);
+            if (!attr)
+                break;
+            props[attr.name] = attr.value;
+        }
+        this.skipWs();
+        let children;
+        if (this.eat('/')) {
+            if (!this.eat('>'))
+                this.error('bad-self-close', `Malformed self-closing <${tag}>`, this.pos, tag);
+        }
+        else if (this.eat('>')) {
+            children = this.parseChildren(tag);
+        }
+        else {
+            this.error('unterminated-open-tag', `Unterminated <${tag}> open tag`, start, tag);
+        }
+        const node = { type: tag, ...props };
+        if (children && children.length)
+            node.children = children;
+        return node;
+    }
+    parseAttr(elStart, tag) {
+        const name = this.readName();
+        if (!name) {
+            this.error('bad-attr', `Malformed attribute on <${tag}>`, this.pos, tag);
+            // skip one char to avoid an infinite loop on garbage
+            this.pos++;
+            return null;
+        }
+        this.skipWs();
+        let value = true; // bare attribute => boolean true
+        if (this.eat('=')) {
+            this.skipWs();
+            value = this.parseAttrValue(tag);
+        }
+        if (EVENT_ATTR.test(name) || FORBIDDEN_ATTRS.has(name)) {
+            this.error('forbidden-attr', `Attribute "${name}" is not allowed on <${tag}>`, elStart, tag);
+            return { name: `__forbidden_${name}`, value: undefined };
+        }
+        return { name, value };
+    }
+    parseAttrValue(tag) {
+        const c = this.peek();
+        if (c === '"' || c === "'")
+            return this.readString(c);
+        if (c === '{')
+            return interpretBrace(this.readBraced());
+        this.error('bad-attr-value', `Expected an attribute value on <${tag}>`, this.pos, tag);
+        return undefined;
+    }
+    parseChildren(parentTag) {
+        const children = [];
+        for (;;) {
+            if (this.pos >= this.src.length) {
+                this.error('unclosed-element', `Unclosed <${parentTag}>`, this.pos, parentTag);
+                break;
+            }
+            // closing tag
+            if (this.src.startsWith('</', this.pos)) {
+                this.pos += 2;
+                this.skipWs();
+                const close = this.readName();
+                this.skipWs();
+                this.eat('>');
+                if (close !== parentTag) {
+                    this.error('mismatched-tag', `Expected </${parentTag}> but found </${close}>`, this.pos, parentTag);
+                }
+                break;
+            }
+            // JSX comment {/* ... */}
+            if (this.src.startsWith('{/*', this.pos)) {
+                const end = this.src.indexOf('*/}', this.pos);
+                if (end === -1) {
+                    this.error('unclosed-comment', 'Unclosed comment', this.pos);
+                    this.pos = this.src.length;
+                }
+                else {
+                    this.pos = end + 3;
+                }
+                continue;
+            }
+            // nested element
+            if (this.peek() === '<') {
+                const el = this.parseElement();
+                if (el)
+                    children.push(el);
+                continue;
+            }
+            // expression child {expr} — out of grammar for v1: skip with a warning
+            if (this.peek() === '{') {
+                const start = this.pos;
+                this.readBraced();
+                this.error('expression-child', 'Inline {expression} children are not supported yet — bind via a component prop', start);
+                continue;
+            }
+            // text
+            const text = this.readTextRun();
+            const trimmed = text.replace(/\s+/g, ' ').trim();
+            if (trimmed)
+                children.push(trimmed);
+        }
+        return children;
+    }
+    /* ----------------------------- lexing ----------------------------- */
+    peek() {
+        return this.pos < this.src.length ? this.src[this.pos] : '';
+    }
+    eat(ch) {
+        if (this.src[this.pos] === ch) {
+            this.pos++;
+            return true;
+        }
+        return false;
+    }
+    readName() {
+        if (!isNameStart(this.peek()))
+            return '';
+        const start = this.pos;
+        this.pos++;
+        while (this.pos < this.src.length && isNameChar(this.src[this.pos]))
+            this.pos++;
+        return this.src.slice(start, this.pos);
+    }
+    readString(quote) {
+        this.pos++; // opening quote
+        const start = this.pos;
+        while (this.pos < this.src.length && this.src[this.pos] !== quote)
+            this.pos++;
+        const value = this.src.slice(start, this.pos);
+        if (!this.eat(quote))
+            this.error('unterminated-string', 'Unterminated string literal', start);
+        return value;
+    }
+    /** Reads a balanced `{ ... }` run and returns the inner text (no outer braces). */
+    readBraced() {
+        const start = this.pos;
+        let depth = 0;
+        let inStr = null;
+        for (; this.pos < this.src.length; this.pos++) {
+            const ch = this.src[this.pos];
+            if (inStr) {
+                if (ch === inStr && this.src[this.pos - 1] !== '\\')
+                    inStr = null;
+                continue;
+            }
+            if (ch === '"' || ch === "'")
+                inStr = ch;
+            else if (ch === '{')
+                depth++;
+            else if (ch === '}') {
+                depth--;
+                if (depth === 0) {
+                    const inner = this.src.slice(start + 1, this.pos);
+                    this.pos++; // consume closing brace
+                    return inner;
+                }
+            }
+        }
+        this.error('unterminated-brace', 'Unterminated "{"', start);
+        return this.src.slice(start + 1);
+    }
+    readTextRun() {
+        const start = this.pos;
+        while (this.pos < this.src.length && this.src[this.pos] !== '<' && this.src[this.pos] !== '{')
+            this.pos++;
+        return this.src.slice(start, this.pos);
+    }
+    skipWs() {
+        while (this.pos < this.src.length && /\s/.test(this.src[this.pos]))
+            this.pos++;
+    }
+    /** whitespace + top-level JSX comments */
+    skipTrivia() {
+        for (;;) {
+            this.skipWs();
+            if (this.src.startsWith('{/*', this.pos)) {
+                const end = this.src.indexOf('*/}', this.pos);
+                this.pos = end === -1 ? this.src.length : end + 3;
+                continue;
+            }
+            break;
+        }
+    }
+    error(code, message, start, tag) {
+        this.diagnostics.push({ severity: 'error', code, message, start: start ?? this.pos, tag });
+    }
+}
+/**
+ * Interpret a braced attribute value `{...}`.
+ * JSON-literal values (numbers, booleans, null, strings, arrays, objects with
+ * quoted keys) are materialized. Anything else is kept as a deferred expression
+ * marker `{ $expr }` — typed and validated later, NEVER evaluated here.
+ */
+export function interpretBrace(raw) {
+    const trimmed = raw.trim();
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return { $expr: trimmed };
+    }
+}

package/dist/types.d.ts

@@ -0,0 +1,76 @@
+/**
+ * ObjectUI — SDUI JSX-source parser (ADR-0080)
+ *
+ * Types shared by the constrained JSX-source compiler. The parser turns a
+ * constrained JSX/HTML+Tailwind *text* into the existing SDUI `SchemaNode`
+ * tree. It PARSES — it never executes. No `import`, no `eval`, no JS.
+ */
+/** A node in the compiled SDUI tree. Mirrors `@object-ui/types` BaseSchema. */
+export type SchemaNode = SchemaElement | string;
+export interface SchemaElement {
+    type: string;
+    children?: SchemaNode[];
+    [prop: string]: unknown;
+}
+export type Severity = 'error' | 'warning';
+export interface Diagnostic {
+    severity: Severity;
+    /** stable machine code, e.g. 'forbidden-tag' */
+    code: string;
+    message: string;
+    /** byte offset into the source where the issue starts */
+    start?: number;
+    /** the tag/component involved, when relevant */
+    tag?: string;
+}
+export interface ParseOptions {
+    /**
+     * Whitelist of allowed tag names (= registry `type` set, from the manifest).
+     * When provided, any tag outside it is a `forbidden-tag` error — this is the
+     * sanitization boundary. When omitted, all tags are accepted (lexing only).
+     */
+    allowedTags?: Set<string>;
+}
+export interface ParseResult {
+    /** the compiled tree, or null when the source has no valid root */
+    tree: SchemaElement | null;
+    diagnostics: Diagnostic[];
+}
+export type ManifestInputType = 'string' | 'number' | 'boolean' | 'enum' | 'array' | 'object' | 'color' | 'date' | 'code' | 'file' | 'slot';
+export interface ManifestInput {
+    name: string;
+    type: ManifestInputType;
+    required?: boolean;
+    /** allowed values for `enum` inputs */
+    enum?: Array<string | {
+        value: unknown;
+        label?: string;
+    }>;
+    /** marks a data-binding input the server must resolve (ADR-0080 §6.3) */
+    binding?: 'object' | 'field';
+    description?: string;
+}
+export interface ManifestComponent {
+    type: string;
+    /** plugin namespace — provenance that drives `requires` */
+    namespace?: string;
+    inputs: ManifestInput[];
+    isContainer?: boolean;
+}
+export interface Manifest {
+    /** keyed by component `type` */
+    components: Record<string, ManifestComponent>;
+}
+/** Result of validating a compiled tree against the manifest. */
+export interface ValidationResult {
+    diagnostics: Diagnostic[];
+    /** unique plugin namespaces referenced — the page's `requires` */
+    requires: string[];
+    /** binding sites (object/field) the server must resolve against object schema */
+    bindings: Array<{
+        tag: string;
+        input: string;
+        kind: 'object' | 'field';
+        value: unknown;
+    }>;
+}

package/dist/types.js

@@ -0,0 +1,8 @@
+/**
+ * ObjectUI — SDUI JSX-source parser (ADR-0080)
+ *
+ * Types shared by the constrained JSX-source compiler. The parser turns a
+ * constrained JSX/HTML+Tailwind *text* into the existing SDUI `SchemaNode`
+ * tree. It PARSES — it never executes. No `import`, no `eval`, no JS.
+ */
+export {};

package/dist/validate.d.ts

@@ -0,0 +1,10 @@
+/**
+ * ObjectUI — SDUI tree validation against the registry manifest (ADR-0080 §3/§6)
+ *
+ * Shallow, author-time validation: unknown component, unknown/missing prop,
+ * wrong coarse type, illegal enum value. Collects `requires` (plugin provenance)
+ * and binding sites the SERVER must resolve against object schema (we cannot
+ * resolve objects/fields here — that check is framework-side by design).
+ */
+import type { Manifest, SchemaElement, ValidationResult } from './types.js';
+export declare function validateTree(tree: SchemaElement | null, manifest: Manifest): ValidationResult;

package/dist/validate.js

@@ -0,0 +1,131 @@
+/**
+ * ObjectUI — SDUI tree validation against the registry manifest (ADR-0080 §3/§6)
+ *
+ * Shallow, author-time validation: unknown component, unknown/missing prop,
+ * wrong coarse type, illegal enum value. Collects `requires` (plugin provenance)
+ * and binding sites the SERVER must resolve against object schema (we cannot
+ * resolve objects/fields here — that check is framework-side by design).
+ */
+/** Base props every node may carry (mirrors BaseSchema) — never "unknown prop". */
+const BASE_PROPS = new Set([
+    'type',
+    'id',
+    'className',
+    'style',
+    'visible',
+    'visibleOn',
+    'disabled',
+    'disabledOn',
+    'children',
+]);
+const isExpr = (v) => typeof v === 'object' && v !== null && '$expr' in v;
+export function validateTree(tree, manifest) {
+    const diagnostics = [];
+    const requires = new Set();
+    const bindings = [];
+    const visit = (node) => {
+        if (typeof node === 'string')
+            return;
+        const comp = manifest.components[node.type];
+        if (!comp) {
+            diagnostics.push({
+                severity: 'error',
+                code: 'unknown-component',
+                message: `<${node.type}> is not a known component`,
+                tag: node.type,
+            });
+        }
+        else {
+            if (comp.namespace)
+                requires.add(comp.namespace);
+            const byName = new Map(comp.inputs.map((i) => [i.name, i]));
+            // required present?
+            for (const input of comp.inputs) {
+                if (input.required && !(input.name in node)) {
+                    diagnostics.push({
+                        severity: 'error',
+                        code: 'missing-required-prop',
+                        message: `<${node.type}> is missing required prop "${input.name}"`,
+                        tag: node.type,
+                    });
+                }
+            }
+            // each provided prop
+            for (const [key, value] of Object.entries(node)) {
+                if (BASE_PROPS.has(key))
+                    continue;
+                const input = byName.get(key);
+                if (!input) {
+                    diagnostics.push({
+                        severity: 'warning',
+                        code: 'unknown-prop',
+                        message: `<${node.type}> has no prop "${key}"`,
+                        tag: node.type,
+                    });
+                    continue;
+                }
+                if (input.binding) {
+                    bindings.push({ tag: node.type, input: key, kind: input.binding, value });
+                }
+                if (!isExpr(value)) {
+                    const typeDiag = checkType(node.type, input, value);
+                    if (typeDiag)
+                        diagnostics.push(typeDiag);
+                }
+            }
+            // containment
+            if (node.children?.length && !comp.isContainer) {
+                diagnostics.push({
+                    severity: 'warning',
+                    code: 'not-a-container',
+                    message: `<${node.type}> does not accept children`,
+                    tag: node.type,
+                });
+            }
+        }
+        if (node.children)
+            node.children.forEach(visit);
+    };
+    if (tree)
+        visit(tree);
+    return { diagnostics, requires: [...requires], bindings };
+}
+function checkType(tag, input, value) {
+    const mismatch = (expected) => ({
+        severity: 'warning',
+        code: 'type-mismatch',
+        message: `<${tag}> prop "${input.name}" expected ${expected}`,
+        tag,
+    });
+    switch (input.type) {
+        case 'number':
+            return typeof value === 'number' ? null : mismatch('a number');
+        case 'boolean':
+            return typeof value === 'boolean' ? null : mismatch('a boolean');
+        case 'string':
+        case 'color':
+        case 'date':
+        case 'code':
+        case 'file':
+            return typeof value === 'string' ? null : mismatch('a string');
+        case 'array':
+            return Array.isArray(value) ? null : mismatch('an array');
+        case 'object':
+            return typeof value === 'object' && value !== null && !Array.isArray(value)
+                ? null
+                : mismatch('an object');
+        case 'enum': {
+            const allowed = (input.enum ?? []).map((e) => (typeof e === 'object' ? e.value : e));
+            return allowed.includes(value)
+                ? null
+                : {
+                    severity: 'error',
+                    code: 'invalid-enum',
+                    message: `<${tag}> prop "${input.name}"=${JSON.stringify(value)} is not one of ${JSON.stringify(allowed)}`,
+                    tag,
+                };
+        }
+        default:
+            return null;
+    }
+}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@object-ui/sdui-parser",
+  "version": "11.2.0",
+  "type": "module",
+  "sideEffects": false,
+  "license": "MIT",
+  "description": "Constrained JSX-source → SDUI SchemaNode tree compiler (parse, never execute). Isomorphic, zero React. ADR-0080.",
+  "homepage": "https://www.objectui.org/docs/sdui-parser",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/objectstack-ai/objectui.git",
+    "directory": "packages/sdui-parser"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {},
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "type-check": "tsc --noEmit",
+    "lint": "eslint ."
+  }
+}