@orpc/json-schema 2.0.0-beta.42 → 2.0.0-beta.44

package/README.md

@@ -17,7 +17,7 @@
     <img alt="Discord" src="https://img.shields.io/discord/1308966753044398161?color=7389D8&label&logo=discord&logoColor=ffffff" />
   </a>
   <a href="https://deepwiki.com/middleapi/orpc">
-    <img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki">
+    <img alt="Ask DeepWiki" src="https://img.shields.io/badge/Ask-DeepWiki-blue" />
   </a>
 </div>
 
@@ -95,14 +95,6 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
   </tr>
 </table>
 
-### Special Sponsors
-
-<table>
-  <tr>
-   <td align="center"><a href="http://twitter.com/rauchg?ref=middleapi&amp;utm_source=middleapi&amp;utm_medium=sponsor" target="_blank" rel="noopener sponsored" title="Guillermo Rauch"><img src="https://avatars.githubusercontent.com/u/13041?u=1ee8d111657cdd02ff6d253df00978d17ee6d722&amp;v=4" width="279" alt="Guillermo Rauch"/><br />Guillermo Rauch</a></td>
-  </tr>
-</table>
-
 ### Premium Sponsors
 
 <table>
@@ -178,7 +170,7 @@ Like what we build over at [middleapi](https://github.com/middleapi)? You can he
   </tr>
 </table>
 
-With thanks to [38 past sponsors](https://orpc.dev/sponsors#past-sponsors) who helped get oRPC here.
+With thanks to [39 past sponsors](https://orpc.dev/sponsors#past-sponsors) who helped get oRPC here.
 
 ## References
 

package/dist/index.d.mts

@@ -60,9 +60,33 @@ declare enum JsonSchemaXNativeType {
     Map = "map"
 }
 
+interface JsonSchemaCoercerOptions {
+    /**
+     * Maximum digits, excluding a leading `-`, of a string coerced to `bigint`. Longer strings are left unchanged.
+     * `Number.POSITIVE_INFINITY` disables it.
+     *
+     * @default 4300
+     */
+    maxBigIntDigits?: number | undefined;
+    /**
+     * Maximum coercion steps per input value, where a step applies one schema to one value.
+     * Inputs with fewer than 100 values are budgeted as 100. Past the budget the whole input is left uncoerced,
+     * so validation still runs and reports any mismatch.
+     *
+     * @default 1000
+     */
+    maxStepsPerValue?: number | undefined;
+}
 declare class JsonSchemaCoercer {
+    private readonly nativeCoerceOptions;
+    private readonly maxStepsPerValue;
+    /** Reused between calls, since building a context is slow until V8 warms up. */
+    private idleContext;
+    constructor(options?: JsonSchemaCoercerOptions);
     coerce([schema, optional]: [schema: JsonSchema, optional: boolean], value: unknown): unknown;
     private coerceInternal;
+    private coerceRef;
+    private extendBudget;
 }
 
 /**
@@ -203,7 +227,7 @@ declare function hoistRecursiveRefToDef(schema: JsonSchema): JsonSchema;
  */
 declare function resolveJsonSchemaRootLocalRef(schema: JsonSchema, $defs?: Exclude<JsonSchema, boolean>['$defs']): JsonSchema;
 
-interface SmartCoercionHandlerPluginOptions {
+interface SmartCoercionHandlerPluginOptions extends JsonSchemaCoercerOptions {
     converters?: undefined | JsonSchemaConverter[];
 }
 /**
@@ -222,7 +246,7 @@ declare class SmartCoercionHandlerPlugin<T extends Context> implements StandardH
     private coerceValue;
 }
 
-interface SmartCoercionLinkPluginOptions {
+interface SmartCoercionLinkPluginOptions extends JsonSchemaCoercerOptions {
     converters?: undefined | JsonSchemaConverter[];
 }
 /**
@@ -260,4 +284,4 @@ declare class StandardJsonSchemaConverter implements JsonSchemaConverter {
 }
 
 export { DelegatingJsonSchemaConverter, JsonSchemaCoercer, JsonSchemaFormat, JsonSchemaType, JsonSchemaXNativeType, SmartCoercionHandlerPlugin, SmartCoercionLinkPlugin, StandardJsonSchemaConverter, combineJsonObjectSchemaEntries, combineJsonSchemasWithComposition, decodeJsonPointerSegment, deduplicateJsonSchemas, encodeJsonPointerSegment, ensureJsonSchemaObject, extractJsonObjectSchemaEntries, flattenJsonUnionSchema, hoistRecursiveRefToDef, isJsonArraySchema, isJsonFileSchema, isJsonObjectSchema, isJsonPrimitiveSchema, isStandardSchemaOptional, isUnconstrainedSchema, mapJsonSchemaRefs, matchArrayableJsonSchema, resolveJsonSchemaRootLocalRef, visitJsonSchemaRefs };
-export type { JsonArraySchema, JsonFileSchema, JsonObjectSchema, JsonObjectSchemaEntry, JsonSchema, JsonSchemaConverter, JsonSchemaConverterDirection, JsonSchemaKeywords, SmartCoercionHandlerPluginOptions, SmartCoercionLinkPluginOptions };
+export type { JsonArraySchema, JsonFileSchema, JsonObjectSchema, JsonObjectSchemaEntry, JsonSchema, JsonSchemaCoercerOptions, JsonSchemaConverter, JsonSchemaConverterDirection, JsonSchemaKeywords, SmartCoercionHandlerPluginOptions, SmartCoercionLinkPluginOptions };

package/dist/index.d.ts

@@ -60,9 +60,33 @@ declare enum JsonSchemaXNativeType {
     Map = "map"
 }
 
+interface JsonSchemaCoercerOptions {
+    /**
+     * Maximum digits, excluding a leading `-`, of a string coerced to `bigint`. Longer strings are left unchanged.
+     * `Number.POSITIVE_INFINITY` disables it.
+     *
+     * @default 4300
+     */
+    maxBigIntDigits?: number | undefined;
+    /**
+     * Maximum coercion steps per input value, where a step applies one schema to one value.
+     * Inputs with fewer than 100 values are budgeted as 100. Past the budget the whole input is left uncoerced,
+     * so validation still runs and reports any mismatch.
+     *
+     * @default 1000
+     */
+    maxStepsPerValue?: number | undefined;
+}
 declare class JsonSchemaCoercer {
+    private readonly nativeCoerceOptions;
+    private readonly maxStepsPerValue;
+    /** Reused between calls, since building a context is slow until V8 warms up. */
+    private idleContext;
+    constructor(options?: JsonSchemaCoercerOptions);
     coerce([schema, optional]: [schema: JsonSchema, optional: boolean], value: unknown): unknown;
     private coerceInternal;
+    private coerceRef;
+    private extendBudget;
 }
 
 /**
@@ -203,7 +227,7 @@ declare function hoistRecursiveRefToDef(schema: JsonSchema): JsonSchema;
  */
 declare function resolveJsonSchemaRootLocalRef(schema: JsonSchema, $defs?: Exclude<JsonSchema, boolean>['$defs']): JsonSchema;
 
-interface SmartCoercionHandlerPluginOptions {
+interface SmartCoercionHandlerPluginOptions extends JsonSchemaCoercerOptions {
     converters?: undefined | JsonSchemaConverter[];
 }
 /**
@@ -222,7 +246,7 @@ declare class SmartCoercionHandlerPlugin<T extends Context> implements StandardH
     private coerceValue;
 }
 
-interface SmartCoercionLinkPluginOptions {
+interface SmartCoercionLinkPluginOptions extends JsonSchemaCoercerOptions {
     converters?: undefined | JsonSchemaConverter[];
 }
 /**
@@ -260,4 +284,4 @@ declare class StandardJsonSchemaConverter implements JsonSchemaConverter {
 }
 
 export { DelegatingJsonSchemaConverter, JsonSchemaCoercer, JsonSchemaFormat, JsonSchemaType, JsonSchemaXNativeType, SmartCoercionHandlerPlugin, SmartCoercionLinkPlugin, StandardJsonSchemaConverter, combineJsonObjectSchemaEntries, combineJsonSchemasWithComposition, decodeJsonPointerSegment, deduplicateJsonSchemas, encodeJsonPointerSegment, ensureJsonSchemaObject, extractJsonObjectSchemaEntries, flattenJsonUnionSchema, hoistRecursiveRefToDef, isJsonArraySchema, isJsonFileSchema, isJsonObjectSchema, isJsonPrimitiveSchema, isStandardSchemaOptional, isUnconstrainedSchema, mapJsonSchemaRefs, matchArrayableJsonSchema, resolveJsonSchemaRootLocalRef, visitJsonSchemaRefs };
-export type { JsonArraySchema, JsonFileSchema, JsonObjectSchema, JsonObjectSchemaEntry, JsonSchema, JsonSchemaConverter, JsonSchemaConverterDirection, JsonSchemaKeywords, SmartCoercionHandlerPluginOptions, SmartCoercionLinkPluginOptions };
+export type { JsonArraySchema, JsonFileSchema, JsonObjectSchema, JsonObjectSchemaEntry, JsonSchema, JsonSchemaCoercerOptions, JsonSchemaConverter, JsonSchemaConverterDirection, JsonSchemaKeywords, SmartCoercionHandlerPluginOptions, SmartCoercionLinkPluginOptions };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { setOwn, get, isPlainObject, tryOrUndefined, getOwn, toArray, isDeepEqual, omit, isTypescriptObject } from '@orpc/shared';
+import { setOwn, get, DEFAULT_MAX_BIGINT_DIGITS, isPlainObject, tryOrUndefined, getOwn, toArray, isTypescriptObject, parseBigIntString, isDeepEqual, omit } from '@orpc/shared';
 import { ORPCError, cloneORPCError } from '@orpc/client';
 import { getProcedureContractOrThrow } from '@orpc/contract';
 
@@ -215,7 +215,7 @@ const NATIVE_TYPES = /* @__PURE__ */ new Map([
   [JsonSchemaXNativeType.BigInt, {
     types: ["string", "integer", "number"],
     is: (value) => typeof value === "bigint",
-    coerce: (value) => typeof value === "string" ? stringToBigInt(value) : typeof value === "number" ? numberToBigInt(value) : value
+    coerce: (value, { maxBigIntDigits }) => typeof value === "string" ? stringToBigInt(value, maxBigIntDigits) : typeof value === "number" ? numberToBigInt(value) : value
   }],
   [JsonSchemaXNativeType.Url, {
     types: ["string"],
@@ -238,21 +238,58 @@ const NATIVE_TYPES = /* @__PURE__ */ new Map([
 function minSatisfaction(a, b) {
   return a < b ? a : b;
 }
+const MIN_BUDGETED_VALUES = 100;
+function createContext() {
+  return { rootSchema: true, memo: void 0, memoize: false, steps: 0, maxSteps: 0, input: void 0 };
+}
+class CoercionBudgetExceededError extends Error {
+}
 class JsonSchemaCoercer {
+  nativeCoerceOptions;
+  maxStepsPerValue;
+  /** Reused between calls, since building a context is slow until V8 warms up. */
+  idleContext = createContext();
+  constructor(options = {}) {
+    this.nativeCoerceOptions = {
+      maxBigIntDigits: options.maxBigIntDigits ?? DEFAULT_MAX_BIGINT_DIGITS
+    };
+    this.maxStepsPerValue = options.maxStepsPerValue ?? 1e3;
+  }
   coerce([schema, optional], value) {
     if (optional && value === void 0) {
       return value;
     }
-    const [, coerced] = this.coerceInternal(schema, schema, value);
-    return coerced;
+    const context = this.idleContext ?? createContext();
+    this.idleContext = void 0;
+    context.rootSchema = schema;
+    context.memoize = false;
+    context.steps = 0;
+    context.maxSteps = this.maxStepsPerValue * MIN_BUDGETED_VALUES;
+    context.input = value;
+    try {
+      const [, coerced] = this.coerceInternal(context, schema, value);
+      return coerced;
+    } catch (error) {
+      if (error instanceof CoercionBudgetExceededError) {
+        return value;
+      }
+      throw error;
+    } finally {
+      context.memo = void 0;
+      context.input = void 0;
+      this.idleContext = context;
+    }
   }
-  coerceInternal(rootSchema, schema, value, appliedRefs) {
+  coerceInternal(context, schema, value, appliedRefs) {
+    if (++context.steps > context.maxSteps) {
+      this.extendBudget(context);
+    }
     if (typeof schema === "boolean") {
       return [schema ? SATISFIED : UNSATISFIED, value];
     }
     if (Array.isArray(schema.type)) {
       return this.coerceInternal(
-        rootSchema,
+        context,
         { anyOf: schema.type.map((type) => ({ ...schema, type })) },
         value,
         appliedRefs
@@ -261,12 +298,12 @@ class JsonSchemaCoercer {
     let coerced = value;
     let satisfied = SATISFIED;
     if (typeof schema.$ref === "string") {
-      const resolved = schema.$ref.startsWith("#/") ? get(rootSchema, schema.$ref.slice("#/".length).split("/").map(decodeJsonPointerSegment)) : schema.$ref === "#" ? rootSchema : void 0;
+      const resolved = schema.$ref.startsWith("#/") ? get(context.rootSchema, schema.$ref.slice("#/".length).split("/").map(decodeJsonPointerSegment)) : schema.$ref === "#" ? context.rootSchema : void 0;
       if (resolved !== void 0 && !appliedRefs?.has(resolved)) {
-        appliedRefs ??= /* @__PURE__ */ new Set();
-        appliedRefs.add(resolved);
-        const [subSatisfied, subCoerced] = this.coerceInternal(rootSchema, resolved, coerced, appliedRefs);
-        appliedRefs.delete(resolved);
+        if (schema.type === "object" || schema.type === "array") {
+          context.memoize = true;
+        }
+        const [subSatisfied, subCoerced] = this.coerceRef(context, resolved, coerced, appliedRefs);
         coerced = subCoerced;
         satisfied = minSatisfaction(satisfied, subSatisfied);
       }
@@ -292,7 +329,7 @@ class JsonSchemaCoercer {
     const declaredNativeType = NATIVE_TYPES.get(schema["x-native-type"]);
     const nativeType = schema.type === void 0 || declaredNativeType?.types.includes(schema.type) ? declaredNativeType : void 0;
     if (nativeType && !nativeType.afterTypeCheck) {
-      coerced = nativeType.coerce(coerced);
+      coerced = nativeType.coerce(coerced, this.nativeCoerceOptions);
     }
     if (schema.type && !nativeType?.is(coerced)) {
       switch (schema.type) {
@@ -346,7 +383,7 @@ class JsonSchemaCoercer {
                 satisfied = minSatisfaction(satisfied, LOOSELY_SATISFIED);
                 return item;
               }
-              const [subSatisfied, subCoerced] = this.coerceInternal(rootSchema, subSchema, item);
+              const [subSatisfied, subCoerced] = this.coerceInternal(context, subSchema, item);
               satisfied = minSatisfaction(satisfied, subSatisfied);
               if (subCoerced !== item) {
                 shouldUseCoercedItems = true;
@@ -383,7 +420,7 @@ class JsonSchemaCoercer {
                 if (subSchema === void 0) {
                   satisfied = minSatisfaction(satisfied, LOOSELY_SATISFIED);
                 } else {
-                  const [subSatisfied, subCoerced] = this.coerceInternal(rootSchema, subSchema, value2);
+                  const [subSatisfied, subCoerced] = this.coerceInternal(context, subSchema, value2);
                   coercedItems[key] = subCoerced;
                   satisfied = minSatisfaction(satisfied, subSatisfied);
                   if (subCoerced !== value2) {
@@ -407,24 +444,26 @@ class JsonSchemaCoercer {
     }
     if (nativeType) {
       if (nativeType.afterTypeCheck) {
-        coerced = nativeType.coerce(coerced);
+        coerced = nativeType.coerce(coerced, this.nativeCoerceOptions);
       }
       if (!nativeType.is(coerced)) {
         satisfied = UNSATISFIED;
       }
     }
     if (schema.allOf) {
+      context.memoize = true;
       for (const subSchema of schema.allOf) {
-        const [subSatisfied, subCoerced] = this.coerceInternal(rootSchema, subSchema, coerced, appliedRefs);
+        const [subSatisfied, subCoerced] = this.coerceInternal(context, subSchema, coerced, appliedRefs);
         coerced = subCoerced;
         satisfied = minSatisfaction(satisfied, subSatisfied);
       }
     }
     for (const key of ["anyOf", "oneOf"]) {
       if (schema[key]) {
+        context.memoize = true;
         let best;
         for (const subSchema of schema[key]) {
-          const [subSatisfied, subCoerced] = this.coerceInternal(rootSchema, subSchema, coerced, appliedRefs);
+          const [subSatisfied, subCoerced] = this.coerceInternal(context, subSchema, coerced, appliedRefs);
           if (subSatisfied === UNSATISFIED) {
             continue;
           }
@@ -445,13 +484,64 @@ class JsonSchemaCoercer {
       }
     }
     if (typeof schema.not !== "undefined") {
-      const [notSatisfied] = this.coerceInternal(rootSchema, schema.not, coerced, appliedRefs);
+      context.memoize = true;
+      const [notSatisfied] = this.coerceInternal(context, schema.not, coerced, appliedRefs);
       if (notSatisfied !== UNSATISFIED) {
         satisfied = UNSATISFIED;
       }
     }
     return [satisfied, coerced];
   }
+  coerceRef(context, resolved, value, appliedRefs) {
+    let memo;
+    if (context.memoize && !appliedRefs?.size && isTypescriptObject(value)) {
+      context.memo ??= /* @__PURE__ */ new Map();
+      memo = context.memo.get(resolved);
+      if (!memo) {
+        memo = /* @__PURE__ */ new Map();
+        context.memo.set(resolved, memo);
+      }
+      const cached = memo.get(value);
+      if (cached) {
+        return cached;
+      }
+    }
+    appliedRefs ??= /* @__PURE__ */ new Set();
+    appliedRefs.add(resolved);
+    const result = this.coerceInternal(context, resolved, value, appliedRefs);
+    appliedRefs.delete(resolved);
+    memo?.set(value, result);
+    return result;
+  }
+  extendBudget(context) {
+    const limit = 2 * context.steps / this.maxStepsPerValue;
+    context.maxSteps = this.maxStepsPerValue * Math.max(countValues(context.input, limit), MIN_BUDGETED_VALUES);
+    if (context.steps > context.maxSteps) {
+      throw new CoercionBudgetExceededError();
+    }
+  }
+}
+function countValues(input, limit) {
+  const walked = /* @__PURE__ */ new Set();
+  const stack = [input];
+  let count = 1;
+  while (stack.length) {
+    const value = stack.pop();
+    if ((Array.isArray(value) || isPlainObject(value)) && !walked.has(value)) {
+      walked.add(value);
+      const items = Array.isArray(value) ? value : Object.values(value);
+      for (let i = 0; i < items.length; i++) {
+        if (++count >= limit) {
+          return count;
+        }
+        const item = items[i];
+        if (isTypescriptObject(item)) {
+          stack.push(item);
+        }
+      }
+    }
+  }
+  return count;
 }
 const NUMBER_PATTERN = /^-?(?:0|[1-9]\d*)(?:\.\d+)?$/;
 function stringToNumber(value) {
@@ -475,11 +565,8 @@ function stringToInteger(value) {
   }
   return num;
 }
-function stringToBigInt(value) {
-  if (!INTEGER_PATTERN.test(value)) {
-    return value;
-  }
-  return BigInt(value);
+function stringToBigInt(value, maxDigits) {
+  return parseBigIntString(value, maxDigits) ?? value;
 }
 function numberToBigInt(value) {
   if (!Number.isInteger(value)) {
@@ -497,7 +584,7 @@ function stringToBoolean(value) {
   }
   return value;
 }
-const DATE_TIME_PATTERN = /^(?!-0{6})(?:[+-]\d{2})?\d{4}-\d{2}-\d{2}(?:[T ].*)?$/;
+const DATE_TIME_PATTERN = /^(?!-0{6})(?:[+-]\d{2})?\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
 const DAYS_IN_MONTH = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
 function stringToDate(value) {
   if (!DATE_TIME_PATTERN.test(value)) {
@@ -902,7 +989,7 @@ class SmartCoercionHandlerPlugin {
       ...toArray(options.converters),
       new StandardJsonSchemaConverter()
     ]);
-    this.coercer = new JsonSchemaCoercer();
+    this.coercer = new JsonSchemaCoercer(options);
   }
   init(options) {
     return {
@@ -940,7 +1027,7 @@ class SmartCoercionLinkPlugin {
       ...toArray(options.converters),
       new StandardJsonSchemaConverter()
     ]);
-    this.coercer = new JsonSchemaCoercer();
+    this.coercer = new JsonSchemaCoercer(options);
   }
   name = "~smart-coercion";
   /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@orpc/json-schema",
   "type": "module",
-  "version": "2.0.0-beta.42",
+  "version": "2.0.0-beta.44",
   "description": "JSON Schema conversion and smart request coercion for oRPC and OpenAPI",
   "license": "MIT",
   "funding": [
@@ -36,14 +36,14 @@
   ],
   "dependencies": {
     "@openapi-spec/types": "~0.3.0",
-    "@orpc/client": "2.0.0-beta.42",
-    "@orpc/contract": "2.0.0-beta.42",
-    "@orpc/server": "2.0.0-beta.42",
-    "@orpc/shared": "2.0.0-beta.42",
+    "@orpc/client": "2.0.0-beta.44",
+    "@orpc/contract": "2.0.0-beta.44",
+    "@orpc/server": "2.0.0-beta.44",
+    "@orpc/shared": "2.0.0-beta.44",
     "@standard-schema/spec": "^1.1.0"
   },
   "devDependencies": {
-    "zod": "^4.5.4"
+    "zod": "^4.6.5"
   },
   "scripts": {
     "type:check": "tsc -b"