ng-form-foundry-transformers 0.5.0 → 0.5.1

package/README.md

@@ -155,6 +155,15 @@ enabled, so the output validates against the source schema (opt out with
 `schemaOptions: { optionalPresence: false }`); a required property mapping to a
 choice is marked `mandatory`.
 
+**The schema may cover any slice of the document.** Keys it does not mention
+are governed by `unknownKeys` (YAML, JSON, and libconfig alike):
+`'preserve'` (default) keeps them verbatim on save — a partial schema edits
+its fields without erasing the rest of a real-world config; `'drop'` deletes
+them — for an intentionally complete schema (sanitizing, template
+enforcement); `'edit'` surfaces them as editable fields typed by the
+document's own values, merged under the JSON Schema in document order, so
+nothing in the file is invisible.
+
 ## JSON transformer
 
 Same as YAML, for **JSON config files** — `jsonTransformer.toSchema(json, { schema? })`
@@ -292,6 +301,14 @@ npm test        # node:test on the compiled output (no Python needed)
 
 ## Status
 
+`0.5.1` — **partial JSON Schemas edit safely**: the new `unknownKeys` option
+(YAML, JSON, libconfig) governs keys the schema does not cover — `'preserve'`
+(default) keeps them verbatim on save, `'drop'` deletes them for
+intentionally complete schemas, `'edit'` surfaces them as editable fields
+typed by the document's own values. The YAML binding is now
+`YamlBinding { doc, schema? }` instead of the bare parsed document (bindings
+are opaque; code that hands them straight back to `toSource` is unaffected).
+
 `0.5.0` — the **libconfig transformer is stable**: the one-time beta warning
 is gone (and with it the `resetLibconfigBetaWarning` helper), and the format's
 guarantees and known limitations are documented in the transformers guide.

package/dist/core/infer.d.ts

@@ -1,7 +1,8 @@
 import type { NodeGroup } from './schema';
 /**
- * Infer a root {@link NodeGroup} from a parsed data object when no schema is
- * given. Structure and types come from the values themselves:
+ * Infer a root {@link NodeGroup} from a parsed data object — the whole form
+ * when no JSON Schema is given, and the layer `mergeInferred` overlays under
+ * `unknownKeys: 'edit'`. Structure and types come from the values themselves:
  *
  *   - object            → nodeGroup (recursed)
  *   - array of objects  → nodeGroupList (item schema = union of the items' keys)

package/dist/core/infer.js

@@ -3,8 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.inferNodeGroup = inferNodeGroup;
 const ROOT = '__root__';
 /**
- * Infer a root {@link NodeGroup} from a parsed data object when no schema is
- * given. Structure and types come from the values themselves:
+ * Infer a root {@link NodeGroup} from a parsed data object — the whole form
+ * when no JSON Schema is given, and the layer `mergeInferred` overlays under
+ * `unknownKeys: 'edit'`. Structure and types come from the values themselves:
  *
  *   - object            → nodeGroup (recursed)
  *   - array of objects  → nodeGroupList (item schema = union of the items' keys)
@@ -21,7 +22,9 @@ function inferNodeGroup(data, name = ROOT) {
     return group;
 }
 function objectToNodeGroup(data, name) {
-    const children = {};
+    // Null prototype: data keys are arbitrary, and assigning a `__proto__` key
+    // onto a plain object would silently set the record's prototype instead.
+    const children = Object.create(null);
     for (const [key, value] of Object.entries(data)) {
         children[key] = inferNode(key, value);
     }
@@ -45,7 +48,7 @@ function inferArray(name, items) {
 }
 /** A representative object with every key seen across `items`, each mapped to the first non-null sample. */
 function unionKeys(items) {
-    const merged = {};
+    const merged = Object.create(null);
     for (const item of items) {
         for (const [key, value] of Object.entries(item)) {
             if (!(key in merged) || (merged[key] == null && value != null))

package/dist/core/merge-inferred.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Schema union for `unknownKeys: 'edit'`: overlay a user-supplied JSON
+ * Schema's {@link NodeGroup} onto the schema *inferred from the document
+ * itself*, so covered keys keep their typed, validated, labeled nodes while
+ * every key the JSON Schema does not mention still renders — editable, typed
+ * by inference (see `core/infer.ts` and the per-format inference in the
+ * transformers). Counterpart of `core/schema-keys.ts`, which handles the
+ * *preserve-invisibly* answer to the same question.
+ */
+import type { NodeGroup } from './schema';
+/**
+ * Merge per key, recursively. Document order wins for placement: the
+ * inferred children mirror the source document, so present keys render in
+ * file order with schema-only keys (e.g. presence-able additions) appended
+ * after, in schema order. Where both sides describe a key, the schema wins —
+ * except that groups and group-lists merge structurally, so a partially
+ * covered subtree keeps its uncovered fields at any depth. Group metadata
+ * (name, label, presence, bounds) comes from the schema side.
+ */
+export declare function mergeInferred(schema: NodeGroup, inferred: NodeGroup): NodeGroup;

package/dist/core/merge-inferred.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeInferred = mergeInferred;
+/**
+ * Merge per key, recursively. Document order wins for placement: the
+ * inferred children mirror the source document, so present keys render in
+ * file order with schema-only keys (e.g. presence-able additions) appended
+ * after, in schema order. Where both sides describe a key, the schema wins —
+ * except that groups and group-lists merge structurally, so a partially
+ * covered subtree keeps its uncovered fields at any depth. Group metadata
+ * (name, label, presence, bounds) comes from the schema side.
+ */
+function mergeInferred(schema, inferred) {
+    const children = Object.create(null);
+    for (const [name, inferredChild] of Object.entries(inferred.children)) {
+        const schemaChild = schema.children[name];
+        children[name] = schemaChild ? mergeNode(schemaChild, inferredChild) : inferredChild;
+    }
+    for (const [name, schemaChild] of Object.entries(schema.children)) {
+        if (!(name in children))
+            children[name] = schemaChild;
+    }
+    return { ...schema, children };
+}
+/**
+ * One key described by both sides: groups and group-lists merge recursively;
+ * everything else — leaves, choices, maps, and shape disagreements — takes
+ * the schema node, which is authoritative wherever it speaks. One inferred
+ * fact does carry over: a leaf's `radix` display hint, which only the
+ * document knows (JSON Schema has no radix vocabulary).
+ */
+function mergeNode(schema, inferred) {
+    if (schema.kind === 'nodeGroup' && inferred.kind === 'nodeGroup') {
+        return mergeInferred(schema, inferred);
+    }
+    if (schema.kind === 'nodeGroupList' && inferred.kind === 'nodeGroupList') {
+        return { ...schema, type: mergeInferred(schema.type, inferred.type) };
+    }
+    if ((schema.kind === 'leaf' || schema.kind === 'leafList') &&
+        schema.kind === inferred.kind &&
+        inferred.radix &&
+        !schema.radix) {
+        return { ...schema, radix: inferred.radix };
+    }
+    return schema;
+}

package/dist/core/schema-keys.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Schema-born key resolution for partial-schema reverts.
+ *
+ * A transformer given a JSON Schema builds its form from the produced
+ * {@link NodeGroup} — so `serializeForm` can only ever emit keys that schema
+ * describes. When the edited value is written back onto the original
+ * document, the value is authoritative for those **schema-born** paths only;
+ * every other key was never carried by the form and must be preserved.
+ * These helpers answer "which keys can the value legitimately speak for?" at
+ * each document level, mirroring the wire encoding of
+ * ng-form-foundry's `serializeForm`/`toWireValue`.
+ */
+import type { NodeGroup, NodeType } from './schema';
+/**
+ * The schema-born key set of one document level, as `name → child schema`
+ * for recursion. `undefined` means "no schema in play": every key is
+ * value-authoritative. A key absent from a defined map is not schema-born
+ * and must be preserved verbatim.
+ */
+export type SchemaKeys = Map<string, NodeType | undefined> | undefined;
+/**
+ * The keys `serializeForm` can emit for a schema node standing at a document
+ * object/group, with each key's schema for recursion. A nodeGroup
+ * contributes its children by key — a choice child included, since the wire
+ * value keeps a choice at its own key (`toWireValue` strips only the case
+ * discriminator). Standing at a choice, the keys are the union of every
+ * case's fields: the form only emits the active case, so the other cases'
+ * keys behave like any non-emitted schema key. A map is open-keyed — every
+ * key is schema-born and entries recurse with the map's value schema.
+ */
+export declare function childrenOf(node: NodeType): SchemaKeys;
+/** The per-item schema when `node` describes a list of groups, else undefined. */
+export declare function itemSchemaOf(node: NodeType | undefined): NodeGroup | undefined;

package/dist/core/schema-keys.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.childrenOf = childrenOf;
+exports.itemSchemaOf = itemSchemaOf;
+/**
+ * The keys `serializeForm` can emit for a schema node standing at a document
+ * object/group, with each key's schema for recursion. A nodeGroup
+ * contributes its children by key — a choice child included, since the wire
+ * value keeps a choice at its own key (`toWireValue` strips only the case
+ * discriminator). Standing at a choice, the keys are the union of every
+ * case's fields: the form only emits the active case, so the other cases'
+ * keys behave like any non-emitted schema key. A map is open-keyed — every
+ * key is schema-born and entries recurse with the map's value schema.
+ */
+function childrenOf(node) {
+    switch (node.kind) {
+        case 'nodeGroup':
+            return new Map(Object.entries(node.children));
+        case 'choice': {
+            const out = new Map();
+            for (const [name, field] of caseEntries(node))
+                out.set(name, field);
+            return out;
+        }
+        case 'map':
+            return new OpenKeys(node.value);
+        default:
+            return undefined; // leaf/leafList/list shapes carry no key semantics
+    }
+}
+/** The per-item schema when `node` describes a list of groups, else undefined. */
+function itemSchemaOf(node) {
+    return node?.kind === 'nodeGroupList' ? node.type : undefined;
+}
+/** Field name → schema across every case of a choice (leaf-bodied cases too). */
+function* caseEntries(choice) {
+    for (const body of Object.values(choice.cases)) {
+        if ('kind' in body)
+            yield [body.name, body];
+        else
+            for (const [name, field] of Object.entries(body))
+                yield [name, field];
+    }
+}
+/** A `SchemaKeys` map matching every key — a map node's open dictionary. */
+class OpenKeys extends Map {
+    constructor(valueSchema) {
+        super();
+        this.valueSchema = valueSchema;
+    }
+    has(_key) {
+        return true;
+    }
+    get(_key) {
+        return this.valueSchema;
+    }
+}

package/dist/transformers/json/json-transformer.d.ts

@@ -1,4 +1,4 @@
-import type { FormValue, Thesaurus } from '../../core/schema';
+import type { FormValue, NodeGroup, Thesaurus } from '../../core/schema';
 import type { TransformResult } from '../../core/transformer';
 import { type JsonSchema, type JsonSchemaOptions } from '../../core/json-schema';
 /** Options for {@link jsonTransformer}'s `toSchema`. */
@@ -19,6 +19,18 @@ export interface JsonOptions {
      * case-insensitively; never paths.
      */
     thesaurus?: Thesaurus;
+    /**
+     * Schema-driven mode only: what happens to keys the JSON Schema does not
+     * cover. `'preserve'` (default) keeps them — the form never carried them,
+     * so a partial schema edits its slice without erasing the rest. `'drop'`
+     * makes the edited value authoritative for the whole document, deleting
+     * uncovered keys — for consumers whose schema is intentionally complete.
+     * `'edit'` surfaces them instead: uncovered keys render as editable fields
+     * typed by the data (the inferred schema merged under the JSON Schema), so
+     * nothing is invisible and the value covers the whole document. Ignored
+     * without a `schema`.
+     */
+    unknownKeys?: 'preserve' | 'drop' | 'edit';
 }
 /** How the source was formatted, so `toSource` re-emits it the same way. */
 export interface JsonFormat {
@@ -32,6 +44,19 @@ export interface JsonFormat {
      * them back as unquoted numbers so precision survives the round-trip.
      */
     bigInts: string[];
+    /**
+     * Present in schema-driven mode with `unknownKeys: 'preserve'` (the
+     * default) or `'edit'`: the original parsed data and the NodeGroup the
+     * form was built from (the JSON Schema's own under `'preserve'`, the
+     * inferred-merged one under `'edit'`). `toSource` then treats the value as
+     * authoritative for schema-born paths only and merges it over the
+     * original, so uncovered keys survive in their original key order — under
+     * `'edit'` that protection is left covering only the keys no form field
+     * can carry (e.g. a key inside a covered choice's object that no case
+     * names).
+     */
+    original?: FormValue;
+    schema?: NodeGroup;
 }
 /**
  * A JSON {@link Transformer}: turn a JSON config document into a form and write
@@ -39,12 +64,15 @@ export interface JsonFormat {
  * `core` builders the YAML transformer uses — only parsing (`JSON.parse`) and
  * serialization (`JSON.stringify`) are JSON-specific.
  *
- * Standard JSON has no comments, so revert re-serializes the edited value,
- * preserving the source's indent width and trailing newline. Key order follows
- * the form value (which follows the schema, derived from the original), so it is
- * preserved for untouched keys. For JSON **with comments** (JSONC), parse and
- * edit it as YAML with {@link import('../yaml/yaml-transformer').yamlTransformer}
- * instead — `JSON.parse` rejects comments.
+ * Standard JSON has no comments, so revert re-serializes, preserving the
+ * source's indent width and trailing newline. In schema-driven mode with
+ * `unknownKeys: 'preserve'` or `'edit'` the value is merged over the original
+ * data at schema-born paths ({@link mergeSchemaBorn}), so uncovered keys and
+ * the original key order survive; otherwise the edited value is serialized
+ * as-is, key order following the form value. For JSON **with comments**
+ * (JSONC), parse and edit it as YAML with
+ * {@link import('../yaml/yaml-transformer').yamlTransformer} instead —
+ * `JSON.parse` rejects comments.
  *
  * Integers beyond 2^53 can't survive a `number` round-trip, so they are carried
  * as strings in the form value and re-emitted verbatim as unquoted numbers (the

package/dist/transformers/json/json-transformer.js

@@ -5,18 +5,23 @@ const thesaurus_1 = require("../../core/thesaurus");
 const infer_1 = require("../../core/infer");
 const json_schema_1 = require("../../core/json-schema");
 const bigint_1 = require("../../core/bigint");
+const schema_keys_1 = require("../../core/schema-keys");
+const merge_inferred_1 = require("../../core/merge-inferred");
 /**
  * A JSON {@link Transformer}: turn a JSON config document into a form and write
  * the edited value back to JSON. The form is built by the same format-agnostic
  * `core` builders the YAML transformer uses — only parsing (`JSON.parse`) and
  * serialization (`JSON.stringify`) are JSON-specific.
  *
- * Standard JSON has no comments, so revert re-serializes the edited value,
- * preserving the source's indent width and trailing newline. Key order follows
- * the form value (which follows the schema, derived from the original), so it is
- * preserved for untouched keys. For JSON **with comments** (JSONC), parse and
- * edit it as YAML with {@link import('../yaml/yaml-transformer').yamlTransformer}
- * instead — `JSON.parse` rejects comments.
+ * Standard JSON has no comments, so revert re-serializes, preserving the
+ * source's indent width and trailing newline. In schema-driven mode with
+ * `unknownKeys: 'preserve'` or `'edit'` the value is merged over the original
+ * data at schema-born paths ({@link mergeSchemaBorn}), so uncovered keys and
+ * the original key order survive; otherwise the edited value is serialized
+ * as-is, key order following the form value. For JSON **with comments**
+ * (JSONC), parse and edit it as YAML with
+ * {@link import('../yaml/yaml-transformer').yamlTransformer} instead —
+ * `JSON.parse` rejects comments.
  *
  * Integers beyond 2^53 can't survive a `number` round-trip, so they are carried
  * as strings in the form value and re-emitted verbatim as unquoted numbers (the
@@ -28,26 +33,80 @@ exports.jsonTransformer = {
         const bigInts = [];
         const parsed = JSON.parse(source, bigIntReviver);
         const data = collectBigInts(parsed ?? {}, [], bigInts);
-        const schema = options?.schema
+        const unknownKeys = options?.unknownKeys ?? 'preserve';
+        const fromJsonSchema = options?.schema
             ? (0, json_schema_1.jsonSchemaToNodeGroup)(options.schema, options.rootName, options.schemaOptions)
-            : (0, infer_1.inferNodeGroup)(data, options?.rootName);
+            : undefined;
+        const schema = fromJsonSchema && unknownKeys === 'edit'
+            ? (0, merge_inferred_1.mergeInferred)(fromJsonSchema, (0, infer_1.inferNodeGroup)(data, options?.rootName))
+            : fromJsonSchema ?? (0, infer_1.inferNodeGroup)(data, options?.rootName);
         const labeled = options?.thesaurus ? (0, thesaurus_1.applyThesaurus)(schema, options.thesaurus) : schema;
+        // 'preserve' gates the revert on the JSON Schema's NodeGroup; 'edit' on
+        // the merged one (schema-born ≈ everything, but keys no form field can
+        // carry stay protected); 'drop' and inferred mode leave the value
+        // authoritative for the whole document.
+        const preserveUnknown = fromJsonSchema != null && unknownKeys !== 'drop';
         const binding = {
             indent: detectIndent(source),
             trailingNewline: source.endsWith('\n'),
             bigInts,
+            original: preserveUnknown ? data : undefined,
+            schema: preserveUnknown ? schema : undefined,
         };
         return { schema: labeled, binding, initialValue: data };
     },
     toSource(value, binding) {
+        const merged = binding.schema && binding.original !== undefined
+            ? mergeSchemaBorn(binding.original, value, (0, schema_keys_1.childrenOf)(binding.schema))
+            : value;
         const paths = new Set(binding.bigInts);
-        const prepared = paths.size ? markBigInts(value, [], paths) : value;
+        const prepared = paths.size ? markBigInts(merged, [], paths) : merged;
         let text = JSON.stringify(prepared, null, binding.indent);
         if (paths.size)
             text = text.replace(BIGINT_MARK_RE, '$1');
         return binding.trailingNewline ? text + '\n' : text;
     },
 };
+/**
+ * Merge the edited value over the original data, value-authoritative for
+ * schema-born keys only: an uncovered key keeps its original value and its
+ * position in the key order; a covered key takes the edited value (recursing
+ * where both sides are objects, and per index into arrays of groups); a
+ * covered key absent from the value is omitted (a presence toggle off);
+ * covered keys new to the document append after the originals.
+ */
+function mergeSchemaBorn(original, value, schema) {
+    if (!isPlainObject(original) || !isPlainObject(value) || !schema)
+        return value;
+    // Null-prototype output and own-key checks: document keys are arbitrary, so
+    // `__proto__` must stay a data key and `toString`/`constructor` must not
+    // resolve through the prototype chain (which would drop or fabricate keys).
+    const out = Object.create(null);
+    for (const key of Object.keys(original)) {
+        if (!schema.has(key)) {
+            out[key] = original[key]; // not schema-born: verbatim, in place
+        }
+        else if (hasOwn(value, key)) {
+            out[key] = mergeChild(original[key], value[key], schema.get(key));
+        } // covered + absent: deleted
+    }
+    for (const key of Object.keys(value)) {
+        if (!(key in out) && !hasOwn(original, key) && schema.has(key))
+            out[key] = value[key];
+    }
+    return out;
+}
+/** Per-key recursion: objects merge by their child schema, group arrays per index. */
+function mergeChild(original, value, schema) {
+    if (schema && isPlainObject(original) && isPlainObject(value)) {
+        return mergeSchemaBorn(original, value, (0, schema_keys_1.childrenOf)(schema));
+    }
+    const itemSchema = (0, schema_keys_1.itemSchemaOf)(schema);
+    if (itemSchema && Array.isArray(original) && Array.isArray(value)) {
+        return value.map((item, i) => i < original.length ? mergeChild(original[i], item, itemSchema) : item);
+    }
+    return value;
+}
 /** Indent width (in spaces) of the first indented line, or 2 if none/tabs. */
 function detectIndent(source) {
     const match = source.match(/\n( +)\S/);
@@ -102,7 +161,8 @@ function collectBigInts(node, path, out) {
     if (Array.isArray(node))
         return node.map((v, i) => collectBigInts(v, [...path, i], out));
     if (isPlainObject(node)) {
-        const res = {};
+        // Null prototype: a `__proto__` document key must stay a data key.
+        const res = Object.create(null);
         for (const key of Object.keys(node))
             res[key] = collectBigInts(node[key], [...path, key], out);
         return res;
@@ -121,7 +181,7 @@ function markBigInts(node, path, paths) {
     if (Array.isArray(node))
         return node.map((v, i) => markBigInts(v, [...path, i], paths));
     if (isPlainObject(node)) {
-        const res = {};
+        const res = Object.create(null);
         for (const key of Object.keys(node))
             res[key] = markBigInts(node[key], [...path, key], paths);
         return res;
@@ -131,3 +191,7 @@ function markBigInts(node, path, paths) {
 function isPlainObject(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);
 }
+/** Own-key membership, immune to `Object.prototype` members and null-prototype objects. */
+function hasOwn(obj, key) {
+    return Object.prototype.hasOwnProperty.call(obj, key);
+}

package/dist/transformers/libconfig/libconfig-transformer.d.ts

@@ -12,7 +12,7 @@
  * are then shown read-only. A JSON Schema in the options unlocks typed empty
  * collections, presence toggles for optional settings, enums, and ranges.
  */
-import type { FormValue, Thesaurus } from '../../core/schema';
+import type { FormValue, NodeGroup, Thesaurus } from '../../core/schema';
 import type { TransformResult } from '../../core/transformer';
 import { type JsonSchema, type JsonSchemaOptions } from '../../core/json-schema';
 import { type CfgGroup } from './parser';
@@ -34,6 +34,20 @@ export interface LibconfigOptions {
      * line verbatim and edits only this file's own settings.
      */
     includes?: 'reject' | 'opaque';
+    /**
+     * Schema-driven mode only: what happens to settings the JSON Schema does
+     * not cover. `'preserve'` (default) keeps them byte-verbatim in place —
+     * the form never carried them, so a partial schema edits its slice without
+     * erasing the rest. `'drop'` makes the edited value authoritative for the
+     * whole document, deleting uncovered settings — for consumers whose schema
+     * is intentionally complete (sanitizing a config, enforcing a strict
+     * template). `'edit'` surfaces them instead: uncovered settings render as
+     * editable fields typed by the document's own literals (the inferred
+     * schema merged under the JSON Schema — see `mergeInferred`), so nothing
+     * is invisible and the value covers the whole document. Ignored without a
+     * `schema`, where the inferred value covers every setting anyway.
+     */
+    unknownKeys?: 'preserve' | 'drop' | 'edit';
     /**
      * Display metadata (`label`/`description`/choice `caseLabels`) injected into
      * the produced schema, schema-driven or inferred alike — see
@@ -42,10 +56,22 @@ export interface LibconfigOptions {
      */
     thesaurus?: Thesaurus;
 }
-/** The revert context: the original text and its positioned AST. */
+/**
+ * The revert context: the original text, its positioned AST, and — in
+ * schema-driven mode with `unknownKeys: 'preserve'` or `'edit'` — the
+ * NodeGroup the form was built from (the JSON Schema's own under
+ * `'preserve'`, the inferred-merged one under `'edit'`), so `toSource` knows
+ * which paths are schema-born. Settings outside those paths were never
+ * carried by the form and survive verbatim; under `'edit'` that is only the
+ * keys no form field can carry (e.g. a key inside a covered choice's group
+ * that no case names). Absent `schema` (inferred mode, or
+ * `unknownKeys: 'drop'`), the value covers the whole document and is
+ * authoritative everywhere.
+ */
 export interface LibconfigBinding {
     source: string;
     root: CfgGroup;
+    schema?: NodeGroup;
 }
 export declare const libconfigTransformer: {
     id: string;

package/dist/transformers/libconfig/libconfig-transformer.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.libconfigTransformer = void 0;
 const thesaurus_1 = require("../../core/thesaurus");
 const json_schema_1 = require("../../core/json-schema");
+const merge_inferred_1 = require("../../core/merge-inferred");
+const schema_keys_1 = require("../../core/schema-keys");
 const parser_1 = require("./parser");
 const schema_1 = require("./schema");
 const revert_1 = require("./revert");
@@ -10,14 +12,35 @@ exports.libconfigTransformer = {
     id: 'libconfig',
     toSchema(source, options) {
         const root = (0, parser_1.parseLibconfig)(source, { includes: options?.includes });
-        const schema = options?.schema
+        const unknownKeys = options?.unknownKeys ?? 'preserve';
+        const fromJsonSchema = options?.schema
             ? (0, json_schema_1.jsonSchemaToNodeGroup)(options.schema, options.rootName, options.schemaOptions)
-            : (0, schema_1.libconfigToNodeGroup)(root, source, options?.rootName ?? '__root__');
+            : undefined;
+        const schema = fromJsonSchema && unknownKeys === 'edit'
+            ? (0, merge_inferred_1.mergeInferred)(fromJsonSchema, (0, schema_1.libconfigToNodeGroup)(root, source, options?.rootName ?? '__root__'))
+            : fromJsonSchema ?? (0, schema_1.libconfigToNodeGroup)(root, source, options?.rootName ?? '__root__');
         const labeled = options?.thesaurus ? (0, thesaurus_1.applyThesaurus)(schema, options.thesaurus) : schema;
         const initialValue = (0, schema_1.extractValue)(root, source, options?.schema != null);
-        return { schema: labeled, binding: { source, root }, initialValue };
+        if (fromJsonSchema && unknownKeys === 'edit') {
+            // Uncovered empty collections merged as read-only carries: their value
+            // must be the verbatim slice, not the typed [] the extraction produced.
+            (0, schema_1.carryUncoveredEmpties)(root, source, initialValue, (0, schema_keys_1.childrenOf)(fromJsonSchema));
+        }
+        return {
+            schema: labeled,
+            binding: {
+                source,
+                root,
+                // 'preserve' gates the revert on the JSON Schema's NodeGroup; 'edit'
+                // on the merged one (schema-born ≈ everything, but settings no form
+                // field can carry stay protected); 'drop' and inferred mode leave
+                // the value authoritative for the whole document.
+                schema: fromJsonSchema && unknownKeys !== 'drop' ? schema : undefined,
+            },
+            initialValue,
+        };
     },
     toSource(value, binding) {
-        return (0, revert_1.applyValueToSource)(binding.source, binding.root, value);
+        return (0, revert_1.applyValueToSource)(binding.source, binding.root, value, binding.schema);
     },
 };

package/dist/transformers/libconfig/revert.d.ts

@@ -13,6 +13,18 @@
  * literal re-emits in hex at its original digit width, an int64 keeps its
  * `L`/`LL` suffix, and values beyond 2^53 travel as exact decimal strings.
  */
+import type { NodeGroup } from '../../core/schema';
 import type { CfgGroup } from './parser';
-/** Apply `value` onto the parsed `root` of `source`, returning the new text. */
-export declare function applyValueToSource(source: string, root: CfgGroup, value: Record<string, unknown>): string;
+/**
+ * Apply `value` onto the parsed `root` of `source`, returning the new text.
+ *
+ * Without `schema` (inferred mode) the value is authoritative for the whole
+ * document: it was extracted from every setting, so a key it lacks is a
+ * deletion. With `schema` (the NodeGroup the form was built from) the value
+ * is authoritative for **schema-born paths only** — the form never carried
+ * the other settings, so they survive byte-verbatim in their original
+ * positions. A partial schema thus edits its slice of an OAI/srsRAN config
+ * without erasing keys the schema does not enumerate; absence of a
+ * schema-born key still deletes (a presence toggle turned off).
+ */
+export declare function applyValueToSource(source: string, root: CfgGroup, value: Record<string, unknown>, schema?: NodeGroup): string;

package/dist/transformers/libconfig/revert.js

@@ -1,33 +1,50 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyValueToSource = applyValueToSource;
+const schema_keys_1 = require("../../core/schema-keys");
 const schema_1 = require("./schema");
-/** Apply `value` onto the parsed `root` of `source`, returning the new text. */
-function applyValueToSource(source, root, value) {
+/**
+ * Apply `value` onto the parsed `root` of `source`, returning the new text.
+ *
+ * Without `schema` (inferred mode) the value is authoritative for the whole
+ * document: it was extracted from every setting, so a key it lacks is a
+ * deletion. With `schema` (the NodeGroup the form was built from) the value
+ * is authoritative for **schema-born paths only** — the form never carried
+ * the other settings, so they survive byte-verbatim in their original
+ * positions. A partial schema thus edits its slice of an OAI/srsRAN config
+ * without erasing keys the schema does not enumerate; absence of a
+ * schema-born key still deletes (a presence toggle turned off).
+ */
+function applyValueToSource(source, root, value, schema) {
     const edits = [];
-    patchGroup(source, root, value, edits);
+    patchGroup(source, root, value, edits, schema && (0, schema_keys_1.childrenOf)(schema));
     edits.sort((a, b) => b.start - a.start);
     let out = source;
     for (const e of edits)
         out = out.slice(0, e.start) + e.text + out.slice(e.end);
     return out;
 }
-function patchGroup(src, group, value, edits) {
+function patchGroup(src, group, value, edits, schema) {
     for (const setting of group.settings) {
-        if (!value || !(setting.name in value)) {
+        if (schema && !schema.has(setting.name))
+            continue; // not schema-born: verbatim
+        // Own-key check: `in` would resolve setting names like `toString` through
+        // the prototype chain, making them undeletable (and their "value" a function).
+        if (!value || !Object.prototype.hasOwnProperty.call(value, setting.name)) {
             edits.push(deleteSetting(src, setting));
             continue;
         }
-        patchValue(src, setting.value, value[setting.name], edits);
+        patchValue(src, setting.value, value[setting.name], edits, schema?.get(setting.name));
     }
     const known = new Set(group.settings.map((s) => s.name));
-    // null/undefined means "absent", never a value: such keys are not added.
-    const added = Object.keys(value ?? {}).filter((k) => !known.has(k) && value[k] != null);
+    // null/undefined means "absent", never a value: such keys are not added —
+    // and under a schema, only schema-born keys may be added at all.
+    const added = Object.keys(value ?? {}).filter((k) => !known.has(k) && value[k] != null && (!schema || schema.has(k)));
     if (added.length) {
         edits.push(insertionEdit(src, group, added.map((k) => `${k} = ${serialize(value[k], '')};`)));
     }
 }
-function patchValue(src, node, value, edits) {
+function patchValue(src, node, value, edits, schema) {
     switch (node.kind) {
         case 'scalar': {
             if (node.value === value)
@@ -41,7 +58,7 @@ function patchValue(src, node, value, edits) {
         }
         case 'group': {
             if (isRecord(value))
-                return patchGroup(src, node, value, edits);
+                return patchGroup(src, node, value, edits, schema && (0, schema_keys_1.childrenOf)(schema));
             edits.push({ ...node.span, text: serialize(value, '') }); // shape change: regenerate
             return;
         }
@@ -61,7 +78,7 @@ function patchValue(src, node, value, edits) {
         case 'list': {
             const shape = (0, schema_1.listShape)(node);
             if (shape === 'groups' && Array.isArray(value)) {
-                return patchElements(src, node.elements, node, value, edits);
+                return patchElements(src, node.elements, node, value, edits, (0, schema_keys_1.itemSchemaOf)(schema));
             }
             if (shape === 'scalars' && Array.isArray(value)) {
                 return patchElements(src, node.elements, node, value, edits);
@@ -89,10 +106,10 @@ function patchValue(src, node, value, edits) {
     }
 }
 /** Element-wise patch of an array/list: edit in place, then grow or shrink. */
-function patchElements(src, elements, collection, value, edits) {
+function patchElements(src, elements, collection, value, edits, itemSchema) {
     const shared = Math.min(elements.length, value.length);
     for (let i = 0; i < shared; i++)
-        patchValue(src, elements[i], value[i], edits);
+        patchValue(src, elements[i], value[i], edits, itemSchema);
     if (value.length > elements.length) {
         const items = value.slice(elements.length).map((v) => serialize(v, ''));
         const at = elements.length ? elements[elements.length - 1].span.end : collection.innerSpan.start;

package/dist/transformers/libconfig/schema.d.ts

@@ -19,6 +19,7 @@
  *   empty collections editable.
  */
 import type { NodeGroup } from '../../core/schema';
+import { type SchemaKeys } from '../../core/schema-keys';
 import { type CfgGroup, type CfgList, type CfgValue } from './parser';
 /** Infer the root NodeGroup for a parsed document. */
 export declare function libconfigToNodeGroup(root: CfgGroup, source: string, name: string): NodeGroup;
@@ -36,4 +37,14 @@ type ListShape = 'groups' | 'scalars' | 'empty' | 'heterogeneous';
 export declare function listShape(list: CfgList): ListShape;
 /** The verbatim source slice of a node. */
 export declare function raw(value: CfgValue, source: string): string;
+/**
+ * `unknownKeys: 'edit'` extraction fixup. The whole-document extraction runs
+ * with `emptyAsArrays` (schema-covered empty collections are typed and
+ * editable), but collections the JSON Schema does **not** cover merge as
+ * read-only raw-carry leaves — their value must be the verbatim source
+ * slice, not `[]`. Walks the document alongside the original (pre-merge)
+ * schema coverage and restores the carry on every uncovered empty
+ * collection, at any depth.
+ */
+export declare function carryUncoveredEmpties(group: CfgGroup, source: string, value: unknown, keys: SchemaKeys): void;
 export {};

package/dist/transformers/libconfig/schema.js

@@ -4,6 +4,8 @@ exports.libconfigToNodeGroup = libconfigToNodeGroup;
 exports.extractValue = extractValue;
 exports.listShape = listShape;
 exports.raw = raw;
+exports.carryUncoveredEmpties = carryUncoveredEmpties;
+const schema_keys_1 = require("../../core/schema-keys");
 const parser_1 = require("./parser");
 /** Digits only — the constraint for int64 values carried as strings. */
 const INTEGER_STRING_PATTERN = '^[-+]?[0-9]+$';
@@ -184,3 +186,61 @@ function rawLeaf(name, why) {
 function raw(value, source) {
     return source.slice(value.span.start, value.span.end);
 }
+/**
+ * `unknownKeys: 'edit'` extraction fixup. The whole-document extraction runs
+ * with `emptyAsArrays` (schema-covered empty collections are typed and
+ * editable), but collections the JSON Schema does **not** cover merge as
+ * read-only raw-carry leaves — their value must be the verbatim source
+ * slice, not `[]`. Walks the document alongside the original (pre-merge)
+ * schema coverage and restores the carry on every uncovered empty
+ * collection, at any depth.
+ */
+function carryUncoveredEmpties(group, source, value, keys) {
+    if (!isRecord(value))
+        return;
+    for (const setting of group.settings) {
+        if (keys && !keys.has(setting.name)) {
+            restoreEmptyCarries(setting.value, source, value, setting.name);
+            continue;
+        }
+        const child = keys?.get(setting.name);
+        const v = value[setting.name];
+        if (setting.value.kind === 'group' && child) {
+            carryUncoveredEmpties(setting.value, source, v, (0, schema_keys_1.childrenOf)(child));
+        }
+        else if (setting.value.kind === 'list' && Array.isArray(v)) {
+            const itemSchema = (0, schema_keys_1.itemSchemaOf)(child);
+            if (!itemSchema)
+                continue;
+            const itemKeys = (0, schema_keys_1.childrenOf)(itemSchema);
+            setting.value.elements.forEach((el, i) => {
+                if (el.kind === 'group')
+                    carryUncoveredEmpties(el, source, v[i], itemKeys);
+            });
+        }
+    }
+}
+/** In a fully uncovered subtree, every empty collection reverts to its carry. */
+function restoreEmptyCarries(node, source, parent, key) {
+    if ((node.kind === 'array' || node.kind === 'list') && node.elements.length === 0) {
+        parent[key] = raw(node, source);
+        return;
+    }
+    if (node.kind === 'group') {
+        const v = parent[key];
+        if (!isRecord(v))
+            return;
+        for (const s of node.settings)
+            restoreEmptyCarries(s.value, source, v, s.name);
+        return;
+    }
+    if (node.kind === 'list') {
+        const v = parent[key];
+        if (!Array.isArray(v))
+            return;
+        node.elements.forEach((el, i) => restoreEmptyCarries(el, source, v, i));
+    }
+}
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}

package/dist/transformers/yaml/index.d.ts

@@ -7,5 +7,5 @@
  * `core` — they are format-agnostic and shared with the JSON transformer.
  */
 export { yamlTransformer } from './yaml-transformer';
-export type { YamlOptions } from './yaml-transformer';
+export type { YamlOptions, YamlBinding } from './yaml-transformer';
 export { applyValueToDocument } from './revert';

package/dist/transformers/yaml/revert.d.ts

@@ -1,4 +1,5 @@
 import { type Document } from 'yaml';
+import type { NodeGroup } from '../../core/schema';
 /**
  * Apply an edited form value onto a parsed YAML {@link Document} in place,
  * preserving comments and formatting on every node that survives the edit.
@@ -10,9 +11,15 @@ import { type Document } from 'yaml';
  * {@link import('./json-schema')}. Callers should clone the document first if the
  * original must be preserved.
  *
+ * With `schema` (the NodeGroup the form was built from) the
+ * value is authoritative for **schema-born paths only**: keys the schema does
+ * not cover — at any depth — are preserved verbatim, their comments included.
+ * Without it the value covers the whole document and a key it lacks is a
+ * deletion.
+ *
  * Map keys are matched by the *same string form* `doc.toJS()` produced when the
  * form value was built, so non-string keys (a `80:` port map, a `true:` flag)
  * reconcile against their original typed key nodes instead of being appended as
  * duplicate string-keyed pairs.
  */
-export declare function applyValueToDocument(doc: Document, value: unknown): void;
+export declare function applyValueToDocument(doc: Document, value: unknown, schema?: NodeGroup): void;

package/dist/transformers/yaml/revert.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyValueToDocument = applyValueToDocument;
 const yaml_1 = require("yaml");
 const bigint_1 = require("../../core/bigint");
+const schema_keys_1 = require("../../core/schema-keys");
 /**
  * Apply an edited form value onto a parsed YAML {@link Document} in place,
  * preserving comments and formatting on every node that survives the edit.
@@ -14,17 +15,23 @@ const bigint_1 = require("../../core/bigint");
  * {@link import('./json-schema')}. Callers should clone the document first if the
  * original must be preserved.
  *
+ * With `schema` (the NodeGroup the form was built from) the
+ * value is authoritative for **schema-born paths only**: keys the schema does
+ * not cover — at any depth — are preserved verbatim, their comments included.
+ * Without it the value covers the whole document and a key it lacks is a
+ * deletion.
+ *
  * Map keys are matched by the *same string form* `doc.toJS()` produced when the
  * form value was built, so non-string keys (a `80:` port map, a `true:` flag)
  * reconcile against their original typed key nodes instead of being appended as
  * duplicate string-keyed pairs.
  */
-function applyValueToDocument(doc, value) {
+function applyValueToDocument(doc, value, schema) {
     if (doc.contents == null) {
         doc.contents = doc.createNode(value);
         return;
     }
-    doc.contents = applyToNode(doc, doc.contents, value);
+    doc.contents = applyToNode(doc, doc.contents, value, schema);
 }
 /**
  * Reconcile the parsed `node` at one position with its edited `value`, returning
@@ -32,22 +39,27 @@ function applyValueToDocument(doc, value) {
  * a map/sequence is reconciled child-by-child; a shape change (or a brand-new
  * position) allocates a fresh node.
  */
-function applyToNode(doc, node, value) {
+function applyToNode(doc, node, value, schema) {
     if (isPlainObject(value)) {
         if (!(0, yaml_1.isMap)(node))
             return doc.createNode(value);
-        reconcileMap(doc, node, value);
+        reconcileMap(doc, node, value, schema && (0, schema_keys_1.childrenOf)(schema));
         return node;
     }
     if (Array.isArray(value)) {
         if (!(0, yaml_1.isSeq)(node))
             return doc.createNode(value);
-        reconcileSeq(doc, node, value);
+        reconcileSeq(doc, node, value, (0, schema_keys_1.itemSchemaOf)(schema));
         return node;
     }
     // scalar (string / number / boolean / null)
     if ((0, yaml_1.isScalar)(node)) {
-        node.value = coerceScalarValue(value, node.value);
+        const next = coerceScalarValue(value, node.value);
+        // An unchanged value keeps the node untouched — the parsed BigInt and the
+        // form's number compare by numeric value, so an identity pass never
+        // downgrades a BigInt-held integer to a lossy JS number.
+        if (!sameScalar(node.value, next))
+            node.value = next;
         return node;
     }
     return doc.createNode(value);
@@ -56,13 +68,24 @@ function applyToNode(doc, node, value) {
  * Update a map node against the value object: drop pairs whose key is gone,
  * recurse into the ones that remain (matched by their `toJS` key string, so
  * typed keys line up), and append a fresh pair for each genuinely new key.
+ * Under `schema`, keys that are not schema-born are exempt from all three —
+ * never dropped, never recursed into, never addable.
  */
-function reconcileMap(doc, node, value) {
-    node.items = node.items.filter((pair) => keyString(pair.key) in value);
+function reconcileMap(doc, node, value, schema) {
+    node.items = node.items.filter((pair) => {
+        const key = keyString(pair.key);
+        if (schema && !schema.has(key))
+            return true; // not schema-born: verbatim
+        // Own-key check: `in` would resolve doc keys like `toString` through the
+        // prototype chain and make them undeletable.
+        return Object.prototype.hasOwnProperty.call(value, key);
+    });
     for (const key of Object.keys(value)) {
+        if (schema && !schema.has(key))
+            continue; // not schema-born: never written
         const pair = node.items.find((p) => keyString(p.key) === key);
         if (pair) {
-            pair.value = applyToNode(doc, pair.value, value[key]);
+            pair.value = applyToNode(doc, pair.value, value[key], schema?.get(key));
         }
         else {
             node.items.push(doc.createPair(key, value[key]));
@@ -70,12 +93,12 @@ function reconcileMap(doc, node, value) {
     }
 }
 /** Update a sequence node: shrink/grow to the value's length, recurse per item. */
-function reconcileSeq(doc, node, value) {
+function reconcileSeq(doc, node, value, itemSchema) {
     while (node.items.length > value.length)
         node.items.pop();
     for (let i = 0; i < value.length; i++) {
         if (i < node.items.length) {
-            node.items[i] = applyToNode(doc, node.items[i], value[i]);
+            node.items[i] = applyToNode(doc, node.items[i], value[i], itemSchema);
         }
         else {
             node.items.push(doc.createNode(value[i]));
@@ -96,6 +119,15 @@ function coerceScalarValue(value, current) {
     }
     return value;
 }
+/** Numeric equality across the BigInt/number divide, `===` otherwise. */
+function sameScalar(current, next) {
+    if (current === next)
+        return true;
+    if (typeof current === 'bigint' && typeof next === 'number' && Number.isInteger(next)) {
+        return current === BigInt(next);
+    }
+    return false;
+}
 /**
  * The string a key node takes as a JS object key, matching `doc.toJS()`: the
  * scalar value stringified, with `null`/`undefined` collapsing to `''` (the

package/dist/transformers/yaml/yaml-transformer.d.ts

@@ -1,5 +1,5 @@
 import { type Document } from 'yaml';
-import type { FormValue, Thesaurus } from '../../core/schema';
+import type { FormValue, NodeGroup, Thesaurus } from '../../core/schema';
 import type { TransformResult } from '../../core/transformer';
 import { type JsonSchema, type JsonSchemaOptions } from '../../core/json-schema';
 /** Options for {@link yamlTransformer}'s `toSchema`. */
@@ -21,6 +21,32 @@ export interface YamlOptions {
      * case-insensitively; never paths.
      */
     thesaurus?: Thesaurus;
+    /**
+     * Schema-driven mode only: what happens to keys the JSON Schema does not
+     * cover. `'preserve'` (default) keeps them verbatim — the form never
+     * carried them, so a partial schema edits its slice without erasing the
+     * rest. `'drop'` makes the edited value authoritative for the whole
+     * document, deleting uncovered keys — for consumers whose schema is
+     * intentionally complete. `'edit'` surfaces them instead: uncovered keys
+     * render as editable fields typed by the data (the inferred schema merged
+     * under the JSON Schema), so nothing is invisible and the value covers the
+     * whole document. Ignored without a `schema`.
+     */
+    unknownKeys?: 'preserve' | 'drop' | 'edit';
+}
+/**
+ * The revert context: the parsed {@link Document} and — in schema-driven
+ * mode with `unknownKeys: 'preserve'` or `'edit'` — the NodeGroup the form
+ * was built from (the JSON Schema's own under `'preserve'`, the
+ * inferred-merged one under `'edit'`), so `toSource` treats the value as
+ * authoritative for schema-born paths only. Under `'edit'` that is almost
+ * the whole document; the gate still protects the keys no form field can
+ * carry (e.g. a key inside a covered choice's object that no case names).
+ * Treat it as opaque: build it with `toSchema`, hand it back to `toSource`.
+ */
+export interface YamlBinding {
+    doc: Document;
+    schema?: NodeGroup;
 }
 /**
  * A YAML {@link Transformer}: turn a YAML config document into a form and write
@@ -28,14 +54,15 @@ export interface YamlOptions {
  * preserves comments, key order, and formatting by applying edits onto the parsed
  * document (see {@link applyValueToDocument}).
  *
- * The `binding` it round-trips is the parsed {@link Document}; `toSource` clones
- * it before applying, so a single `toSchema` result can serve many edits.
+ * The `binding` it round-trips is a {@link YamlBinding}; `toSource` clones the
+ * document inside it before applying, so a single `toSchema` result can serve
+ * many edits.
  *
  * With a JSON Schema in {@link YamlOptions}, the form is schema-driven; without
  * one it is inferred from the data.
  */
 export declare const yamlTransformer: {
     id: string;
-    toSchema(source: string, options?: YamlOptions): TransformResult<Document>;
-    toSource(value: FormValue, binding: Document): string;
+    toSchema(source: string, options?: YamlOptions): TransformResult<YamlBinding>;
+    toSource(value: FormValue, binding: YamlBinding): string;
 };

package/dist/transformers/yaml/yaml-transformer.js

@@ -5,6 +5,7 @@ const yaml_1 = require("yaml");
 const thesaurus_1 = require("../../core/thesaurus");
 const infer_1 = require("../../core/infer");
 const json_schema_1 = require("../../core/json-schema");
+const merge_inferred_1 = require("../../core/merge-inferred");
 const bigint_1 = require("../../core/bigint");
 const revert_1 = require("./revert");
 /**
@@ -13,8 +14,9 @@ const revert_1 = require("./revert");
  * preserves comments, key order, and formatting by applying edits onto the parsed
  * document (see {@link applyValueToDocument}).
  *
- * The `binding` it round-trips is the parsed {@link Document}; `toSource` clones
- * it before applying, so a single `toSchema` result can serve many edits.
+ * The `binding` it round-trips is a {@link YamlBinding}; `toSource` clones the
+ * document inside it before applying, so a single `toSchema` result can serve
+ * many edits.
  *
  * With a JSON Schema in {@link YamlOptions}, the form is schema-driven; without
  * one it is inferred from the data.
@@ -27,17 +29,31 @@ exports.yamlTransformer = {
         // out-of-range integers become strings there (safe ones become plain numbers).
         const doc = (0, yaml_1.parseDocument)(source, { intAsBigInt: true });
         const data = (normalizeBigInts(doc.toJS()) ?? {});
-        const schema = options?.schema
+        const unknownKeys = options?.unknownKeys ?? 'preserve';
+        const fromJsonSchema = options?.schema
             ? (0, json_schema_1.jsonSchemaToNodeGroup)(options.schema, options.rootName, options.schemaOptions)
-            : (0, infer_1.inferNodeGroup)(data, options?.rootName);
-        if (!options?.schema && doc.contents)
+            : undefined;
+        const schema = fromJsonSchema && unknownKeys === 'edit'
+            ? (0, merge_inferred_1.mergeInferred)(fromJsonSchema, (0, infer_1.inferNodeGroup)(data, options?.rootName))
+            : fromJsonSchema ?? (0, infer_1.inferNodeGroup)(data, options?.rootName);
+        // Inferred leaves (the whole schema, or the uncovered slice under 'edit')
+        // pick up the document's hex/octal presentation.
+        if ((!fromJsonSchema || unknownKeys === 'edit') && doc.contents)
             annotateRadix(doc.contents, schema);
         const labeled = options?.thesaurus ? (0, thesaurus_1.applyThesaurus)(schema, options.thesaurus) : schema;
-        return { schema: labeled, binding: doc, initialValue: data };
+        return {
+            schema: labeled,
+            // 'preserve' gates the revert on the JSON Schema's NodeGroup; 'edit' on
+            // the merged one (schema-born ≈ everything, but keys no form field can
+            // carry stay protected); 'drop' and inferred mode leave the value
+            // authoritative for the whole document.
+            binding: { doc, schema: fromJsonSchema && unknownKeys !== 'drop' ? schema : undefined },
+            initialValue: data,
+        };
     },
     toSource(value, binding) {
-        const doc = binding.clone();
-        (0, revert_1.applyValueToDocument)(doc, value);
+        const doc = binding.doc.clone();
+        (0, revert_1.applyValueToDocument)(doc, value, binding.schema);
         return String(doc);
     },
     // `satisfies` verifies conformance to the catalog contract while keeping the
@@ -115,7 +131,8 @@ function normalizeBigInts(value) {
     if (Array.isArray(value))
         return value.map(normalizeBigInts);
     if (value && typeof value === 'object') {
-        const out = {};
+        // Null prototype: a `__proto__` document key must stay a data key.
+        const out = Object.create(null);
         for (const key of Object.keys(value))
             out[key] = normalizeBigInts(value[key]);
         return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ng-form-foundry-transformers",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Framework-agnostic Node + TypeScript catalog of source-format transformers: turn a YANG model (and more) into an ng-form-foundry schema and revert the edited form value back to the source format.",
   "keywords": [
     "ng-form-foundry",