schema-components 1.19.0 → 1.20.0

package/dist/core/walker.mjs

@@ -3,6 +3,7 @@ import { appendPointer, emitDiagnostic } from "./diagnostics.mjs";
 import { countDistinctRefs, resolveRef } from "./ref.mjs";
 import { extractArrayConstraints, extractObjectConstraints, stripInapplicableConstraints } from "./constraints.mjs";
 import { ANNOTATION_SIBLINGS, detectDiscriminated, mergeAllOf, mergeRefSiblings, normaliseAnyOf } from "./merge.mjs";
+import { isPrototypePollutingKey } from "./uri.mjs";
 import { buildBase, buildBooleanField, buildFileField, buildNullField, buildNumberField, buildStringField, buildUnknownField, extractChildOverride, extractSchemaMetaFields, getArray, getObject, getString, isPrimitive, walkDependentRequiredMap, walkSubSchemaMap, withoutKeys } from "./walkBuilders.mjs";
 //#region src/core/walker.ts
 /**
@@ -236,11 +237,28 @@ function walkBoolean(schema, ctx) {
 	return buildBooleanField(schema, ctx);
 }
 function walkEnum(schema, enumValues, ctx) {
+	const accepted = [];
+	for (let i = 0; i < enumValues.length; i++) {
+		const v = enumValues[i];
+		if (isPrimitive(v)) {
+			accepted.push(v);
+			continue;
+		}
+		emitDiagnostic(ctx.diagnostics, {
+			code: "enum-value-filtered",
+			message: `enum value at index ${String(i)} is not a primitive (${v === void 0 ? "undefined" : typeof v}); dropping the entry`,
+			pointer: appendPointer(ctx.pointer, `enum/${String(i)}`),
+			detail: {
+				index: i,
+				value: v
+			}
+		});
+	}
 	return {
 		...buildBase(schema, ctx),
 		type: "enum",
 		constraints: {},
-		enumValues: enumValues.filter((v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean" || v === null)
+		enumValues: accepted
 	};
 }
 function walkLiteral(schema, ctx) {
@@ -254,9 +272,35 @@ function walkLiteral(schema, ctx) {
 	};
 }
 function walkObject(schema, properties, ctx) {
-	const requiredFields = getArray(schema, "required")?.filter((r) => typeof r === "string") ?? [];
+	const required = getArray(schema, "required");
+	const requiredFields = [];
+	if (required !== void 0) for (let i = 0; i < required.length; i++) {
+		const r = required[i];
+		if (typeof r === "string") {
+			requiredFields.push(r);
+			continue;
+		}
+		emitDiagnostic(ctx.diagnostics, {
+			code: "required-non-string",
+			message: `required[${String(i)}] is not a string (${r === null ? "null" : typeof r}); dropping the entry`,
+			pointer: appendPointer(ctx.pointer, `required/${String(i)}`),
+			detail: {
+				index: i,
+				value: r
+			}
+		});
+	}
 	const fields = {};
 	for (const [key, propSchema] of Object.entries(properties)) {
+		if (isPrototypePollutingKey(key)) {
+			emitDiagnostic(ctx.diagnostics, {
+				code: "prototype-polluting-property",
+				message: `Refusing to register prototype-polluting property name: ${key}`,
+				pointer: appendPointer(ctx.pointer, key),
+				detail: { propertyName: key }
+			});
+			continue;
+		}
 		const childOverride = extractChildOverride(ctx.fieldOverrides, key);
 		const isRequired = requiredFields.includes(key);
 		const childCtx = {
@@ -343,11 +387,14 @@ function walkArray(schema, ctx) {
 	const prefixItems = getArray(schema, "prefixItems");
 	if (prefixItems !== void 0) {
 		const walkedItems = prefixItems.filter(isObject).map((item) => walkNode(item, ctx));
+		const restSchema = getObject(schema, "items");
+		const restItems = restSchema !== void 0 ? walkNode(restSchema, ctx) : void 0;
 		return {
 			...buildBase(schema, ctx),
 			type: "tuple",
 			constraints: extractArrayConstraints(schema),
-			prefixItems: walkedItems
+			prefixItems: walkedItems,
+			...restItems !== void 0 ? { restItems } : {}
 		};
 	}
 	const unevaluatedItemsSchema = getObject(schema, "unevaluatedItems");

package/dist/{diagnostics-VgEKI_Ct.d.mts → diagnostics-CbBPsxSt.d.mts}

@@ -16,7 +16,7 @@
  * Machine-readable codes identifying each class of diagnostic.
  * Stable across releases — consumers can pattern-match on these.
  */
-type DiagnosticCode = "unresolved-ref" | "unknown-keyword" | "unknown-format" | "invalid-const" | "unsupported-type" | "dropped-swagger-feature" | "external-ref" | "type-negation-fallback" | "conditional-fallback" | "assumed-draft" | "depth-exceeded" | "allof-conflict" | "discriminator-inconsistent" | "divisible-by-conflict" | "legacy-dependencies-split" | "dependent-required-invalid";
+type DiagnosticCode = "unresolved-ref" | "unknown-keyword" | "unknown-format" | "invalid-const" | "unsupported-type" | "dropped-swagger-feature" | "external-ref" | "type-negation-fallback" | "conditional-fallback" | "assumed-draft" | "depth-exceeded" | "allof-conflict" | "discriminator-inconsistent" | "divisible-by-conflict" | "legacy-dependencies-split" | "dependent-required-invalid" | "unknown-json-schema-dialect" | "relative-ref-resolved" | "bare-exclusive-bound" | "enum-value-filtered" | "required-non-string" | "pattern-invalid" | "duplicate-body-parameter" | "prototype-polluting-property";
 /**
  * A single diagnostic emitted during schema processing.
  */

package/dist/{errors-CnGjT1cg.d.mts → errors-C2iABcn9.d.mts}

@@ -33,7 +33,14 @@ declare class SchemaNormalisationError extends SchemaError {
    * (e.g. "bigint", "date", "map", "set"). `undefined` for other kinds.
    */
   readonly zodType: string | undefined;
-  constructor(message: string, schema: unknown, kind: SchemaNormalisationError["kind"], zodType?: string);
+  /**
+   * The original underlying error, when this normalisation error wraps
+   * another exception (typically the error thrown by `z.toJSONSchema()`).
+   * Preserves the source stack trace so the root cause is not lost when
+   * the classifier translates the message.
+   */
+  readonly cause: unknown;
+  constructor(message: string, schema: unknown, kind: SchemaNormalisationError["kind"], zodType?: string, cause?: unknown);
 }
 /**
  * A theme adapter's render function threw during rendering.

package/dist/html/a11y.d.mts

@@ -1,5 +1,5 @@
-import { M as WalkedField } from "../types-D_5ST7SS.mjs";
-import { t as AllConstraints } from "../renderer-BQqiXUYP.mjs";
+import { M as WalkedField } from "../types-C9zw9wbX.mjs";
+import { t as AllConstraints } from "../renderer-SOIbJBtk.mjs";
 import { HtmlAttributes, HtmlNode } from "./html.mjs";
 
 //#region src/html/a11y.d.ts

package/dist/html/renderToHtml.d.mts

@@ -1,5 +1,5 @@
-import { T as SchemaMeta } from "../types-D_5ST7SS.mjs";
-import { o as HtmlResolver } from "../renderer-BQqiXUYP.mjs";
+import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
+import { o as HtmlResolver } from "../renderer-SOIbJBtk.mjs";
 
 //#region src/html/renderToHtml.d.ts
 interface RenderToHtmlOptions {

package/dist/html/renderToHtmlStream.d.mts

@@ -1,5 +1,5 @@
-import { T as SchemaMeta } from "../types-D_5ST7SS.mjs";
-import { o as HtmlResolver } from "../renderer-BQqiXUYP.mjs";
+import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
+import { o as HtmlResolver } from "../renderer-SOIbJBtk.mjs";
 
 //#region src/html/renderToHtmlStream.d.ts
 interface StreamRenderOptions {

package/dist/html/renderers.d.mts

@@ -1,5 +1,5 @@
-import { M as WalkedField } from "../types-D_5ST7SS.mjs";
-import { o as HtmlResolver } from "../renderer-BQqiXUYP.mjs";
+import { M as WalkedField } from "../types-C9zw9wbX.mjs";
+import { o as HtmlResolver } from "../renderer-SOIbJBtk.mjs";
 
 //#region src/html/renderers.d.ts
 declare function dateInputType(format: string | undefined): string | undefined;

package/dist/html/renderers.mjs

@@ -1,4 +1,5 @@
 import { sortFieldsByOrder } from "../core/fieldOrder.mjs";
+import { isSafeHyperlink, isSafeMailtoAddress } from "../core/uri.mjs";
 import { h, raw, serialize } from "./html.mjs";
 import { ariaDescribedByAttrs, ariaLabelAttrs, ariaReadonlyAttrs, ariaRequiredAttrs, buildHintElement, buildInputId, requiredIndicator } from "./a11y.mjs";
 //#region src/html/renderers.ts
@@ -26,12 +27,12 @@ function renderStringReadOnly(props) {
 		...ariaReadonlyAttrs()
 	}, "—");
 	const format = props.constraints.format;
-	if (format === "email") return h("a", {
+	if (format === "email" && isSafeMailtoAddress(strValue)) return h("a", {
 		class: "sc-value",
 		href: `mailto:${strValue}`,
 		...ariaReadonlyAttrs()
 	}, strValue);
-	if (format === "uri" || format === "url") return h("a", {
+	if ((format === "uri" || format === "url") && isSafeHyperlink(strValue)) return h("a", {
 		class: "sc-value",
 		href: strValue,
 		...ariaReadonlyAttrs()
@@ -356,6 +357,7 @@ function renderTupleHtml(props) {
 	if (props.tree.type !== "tuple") return renderUnknownHtml(props);
 	const arr = Array.isArray(props.value) ? props.value : [];
 	const prefixItems = props.tree.prefixItems;
+	const restItems = props.tree.restItems;
 	const children = [];
 	for (let i = 0; i < prefixItems.length; i++) {
 		const itemValue = arr[i];
@@ -364,6 +366,11 @@ function renderTupleHtml(props) {
 		const childHtml = props.renderChild(element, itemValue, `[${String(i)}]`);
 		children.push(h("div", { class: "sc-tuple-item" }, h("span", { class: "sc-tuple-index" }, String(i)), raw(childHtml)));
 	}
+	if (restItems !== void 0) for (let i = prefixItems.length; i < arr.length; i++) {
+		const itemValue = arr[i];
+		const childHtml = props.renderChild(restItems, itemValue, `[${String(i)}]`);
+		children.push(h("div", { class: "sc-tuple-item sc-tuple-rest" }, h("span", { class: "sc-tuple-index" }, String(i)), raw(childHtml)));
+	}
 	return serialize(h("div", { class: "sc-tuple" }, ...children));
 }
 function renderConditionalHtml(props) {

package/dist/html/streamRenderers.d.mts

@@ -1,5 +1,5 @@
-import { M as WalkedField } from "../types-D_5ST7SS.mjs";
-import { o as HtmlResolver } from "../renderer-BQqiXUYP.mjs";
+import { M as WalkedField } from "../types-C9zw9wbX.mjs";
+import { o as HtmlResolver } from "../renderer-SOIbJBtk.mjs";
 import { HtmlElement } from "./html.mjs";
 
 //#region src/html/streamRenderers.d.ts

package/dist/{normalise-C0ofw3W6.mjs → normalise-CMMEl4cd.mjs}

@@ -1,6 +1,6 @@
 import { isObject } from "./core/guards.mjs";
 import { appendPointer, emitDiagnostic } from "./core/diagnostics.mjs";
-import { isOpenApi30, isSwagger2 } from "./core/version.mjs";
+import { isOpenApi30, isOpenApi31, isSwagger2, readJsonSchemaDialect } from "./core/version.mjs";
 //#region src/core/openapi30.ts
 /**
 * OpenAPI 3.0.x schema normalisation.
@@ -278,7 +278,7 @@ function normaliseContentMap(content, normaliseSchema) {
 		const encoding = mediaObj.encoding;
 		if (isObject(encoding)) normalised.encoding = mapObjectValues(encoding, (enc) => isObject(enc) ? normaliseEncoding(enc, normaliseSchema) : enc);
 		if ("example" in normalised && !("examples" in normalised)) {
-			normalised.examples = { value: normalised.example };
+			normalised.examples = { default: { value: normalised.example } };
 			delete normalised.example;
 		} else if ("example" in normalised) delete normalised.example;
 		result[mediaType] = normalised;
@@ -332,7 +332,7 @@ function normaliseSwagger2Document(doc, deepNormalise, normaliseDraft04Node, dia
 		result.servers = [{ url: `${typeof schemes[0] === "string" ? schemes[0] : "https"}://${host}${basePath}` }];
 	}
 	const paths = doc.paths;
-	if (isObject(paths)) result.paths = normaliseSwaggerPaths(paths, doc);
+	if (isObject(paths)) result.paths = normaliseSwaggerPaths(paths, doc, diagnostics);
 	const components = {};
 	const definitions = doc.definitions;
 	if (isObject(definitions)) {
@@ -353,7 +353,7 @@ function normaliseSwagger2Document(doc, deepNormalise, normaliseDraft04Node, dia
 			const resolved = resolveSwaggerParameter(param, doc);
 			const location = resolved.in;
 			if (location === "body") requestBodies[name] = buildRequestBody(resolved, globalConsumes);
-			else if (location === "formData") requestBodies[name] = buildRequestBody(buildFormDataBody(resolved, [resolved]), ["multipart/form-data"]);
+			else if (location === "formData") requestBodies[name] = buildRequestBody(buildFormDataBody(resolved, [resolved]), formDataContentTypes(globalConsumes));
 			else convertedParameters[name] = normaliseSwaggerParameter(resolved, doc);
 		}
 		if (Object.keys(convertedParameters).length > 0) components.parameters = convertedParameters;
@@ -381,7 +381,7 @@ function normaliseSwagger2Document(doc, deepNormalise, normaliseDraft04Node, dia
 	});
 	return result;
 }
-function normaliseSwaggerPaths(paths, doc) {
+function normaliseSwaggerPaths(paths, doc, diagnostics) {
 	const result = {};
 	const METHODS = [
 		"get",
@@ -401,7 +401,7 @@ function normaliseSwaggerPaths(paths, doc) {
 		for (const method of METHODS) {
 			const operation = pathItem[method];
 			if (!isObject(operation)) continue;
-			normalisedPath[method] = normaliseSwaggerOperation(operation, doc);
+			normalisedPath[method] = normaliseSwaggerOperation(operation, doc, path, method, diagnostics);
 		}
 		const pathParams = pathItem.parameters;
 		if (Array.isArray(pathParams)) normalisedPath.parameters = pathParams.map((p) => isObject(p) ? normaliseSwaggerParameter(p, doc) : p);
@@ -409,7 +409,7 @@ function normaliseSwaggerPaths(paths, doc) {
 	}
 	return result;
 }
-function normaliseSwaggerOperation(operation, doc) {
+function normaliseSwaggerOperation(operation, doc, path, method, diagnostics) {
 	const result = {};
 	const globalProduces = Array.isArray(doc.produces) ? doc.produces : ["application/json"];
 	const globalConsumes = Array.isArray(doc.consumes) ? doc.consumes : ["application/json"];
@@ -420,28 +420,61 @@ function normaliseSwaggerOperation(operation, doc) {
 	if (Array.isArray(params)) {
 		const nonBodyParams = [];
 		let bodyParam;
+		let firstBodyName;
 		let usesFormData = false;
-		for (const param of params) {
+		for (const [index, param] of params.entries()) {
 			if (!isObject(param)) {
 				nonBodyParams.push(param);
 				continue;
 			}
 			const resolvedParam = resolveSwaggerParameter(param, doc);
 			const location = resolvedParam.in;
-			if (location === "body") bodyParam = resolvedParam;
-			else if (location === "formData") {
-				bodyParam = buildFormDataBody(resolvedParam, params);
-				usesFormData = true;
+			if (location === "body") {
+				if (bodyParam !== void 0) {
+					const duplicateName = typeof resolvedParam.name === "string" ? resolvedParam.name : `parameters[${String(index)}]`;
+					emitDiagnostic(diagnostics, {
+						code: "duplicate-body-parameter",
+						message: `Operation defines more than one "in: body" parameter; keeping the first ("${firstBodyName ?? "(unnamed)"}") and discarding "${duplicateName}"`,
+						pointer: appendPointer(appendPointer(appendPointer(appendPointer("", "paths"), path), method), "parameters"),
+						detail: {
+							kept: firstBodyName,
+							discarded: duplicateName,
+							location: "operation"
+						}
+					});
+					continue;
+				}
+				bodyParam = resolvedParam;
+				firstBodyName = typeof resolvedParam.name === "string" ? resolvedParam.name : void 0;
+			} else if (location === "formData") {
+				if (!usesFormData) {
+					bodyParam = buildFormDataBody(resolvedParam, params);
+					usesFormData = true;
+				}
 			} else nonBodyParams.push(normaliseSwaggerParameter(resolvedParam, doc));
 		}
 		if (nonBodyParams.length > 0) result.parameters = nonBodyParams;
-		if (bodyParam !== void 0) result.requestBody = buildRequestBody(bodyParam, usesFormData ? ["multipart/form-data"] : consumes);
+		if (bodyParam !== void 0) result.requestBody = buildRequestBody(bodyParam, usesFormData ? formDataContentTypes(consumes) : consumes);
 	}
 	const responses = operation.responses;
 	if (isObject(responses)) result.responses = normaliseSwaggerResponses(responses, doc, produces);
 	return result;
 }
 /**
+* Determine the request body media type for a Swagger 2.0 formData operation.
+*
+* Per the OAS 3 conversion rules, `application/x-www-form-urlencoded` is
+* preferred when the operation- or document-level `consumes` includes it;
+* otherwise `multipart/form-data` is the default. File uploads (Swagger 2.0
+* `type: file`) still require `multipart/form-data`, but the formData body
+* schema-builder normalises them to `string` + `format: binary` either way
+* and the choice of media type is left to the source document.
+*/
+function formDataContentTypes(consumes) {
+	if (consumes.includes("application/x-www-form-urlencoded")) return ["application/x-www-form-urlencoded"];
+	return ["multipart/form-data"];
+}
+/**
 * Resolve a Swagger parameter that may be a `$ref`.
 */
 function resolveSwaggerParameter(param, doc, visited = /* @__PURE__ */ new Set()) {
@@ -596,7 +629,7 @@ function normaliseSwaggerResponses(responses, doc, produces) {
 function normaliseSwaggerSingleResponse(response, doc, produces) {
 	const resolved = resolveSwaggerResponse(response, doc);
 	const normalised = {};
-	for (const [key, value] of Object.entries(resolved)) if (key !== "schema") normalised[key] = value;
+	for (const [key, value] of Object.entries(resolved)) if (key !== "schema" && key !== "headers") normalised[key] = value;
 	const schema = resolved.schema;
 	if (isObject(schema)) {
 		const content = {};
@@ -604,9 +637,64 @@ function normaliseSwaggerSingleResponse(response, doc, produces) {
 		for (const ct of contentTypes) if (typeof ct === "string") content[ct] = { schema };
 		normalised.content = content;
 	}
+	const headers = resolved.headers;
+	if (isObject(headers)) {
+		const convertedHeaders = {};
+		for (const [name, header] of Object.entries(headers)) convertedHeaders[name] = isObject(header) ? normaliseSwaggerHeader(header) : header;
+		normalised.headers = convertedHeaders;
+	}
 	return normalised;
 }
 /**
+* Normalise a single Swagger 2.0 response header to OpenAPI 3.x form.
+*
+* Swagger 2.0 headers mirror parameter shape: `type`/`format`/
+* `collectionFormat` live at the root. OpenAPI 3.x requires the type
+* descriptor under `schema`, with collection serialisation expressed via
+* `style`/`explode`. Headers do not carry `name` or `in` — those are not
+* part of either spec at this level — so this is a thin sibling to
+* `normaliseSwaggerParameter` rather than a full reuse. The OpenAPI 3.x
+* default header style is `simple`, so CSV-encoded headers map to
+* `simple`/`explode: false` rather than the `form` style used for query
+* parameters.
+*/
+function normaliseSwaggerHeader(header) {
+	const result = {};
+	for (const [key, value] of Object.entries(header)) {
+		if (key === "type" || key === "format" || key === "collectionFormat") continue;
+		result[key] = value;
+	}
+	if (typeof header.type === "string") {
+		const schema = { type: header.type };
+		if (typeof header.format === "string") schema.format = header.format;
+		if (header.enum !== void 0) schema.enum = header.enum;
+		if (header.default !== void 0) schema.default = header.default;
+		if (header.minimum !== void 0) schema.minimum = header.minimum;
+		if (header.maximum !== void 0) schema.maximum = header.maximum;
+		result.schema = schema;
+	}
+	const cf = header.collectionFormat;
+	if (typeof cf === "string") switch (cf) {
+		case "csv":
+			result.style = "simple";
+			result.explode = false;
+			break;
+		case "ssv":
+			result.style = "spaceDelimited";
+			result.explode = false;
+			break;
+		case "tsv":
+			result.style = "tabDelimited";
+			result.explode = false;
+			break;
+		case "pipes":
+			result.style = "pipeDelimited";
+			result.explode = false;
+			break;
+	}
+	return result;
+}
+/**
 * Mapping of Swagger 2.0 $ref prefixes to OpenAPI 3.x equivalents.
 * Applied after document restructuring so all $ref strings point
 * to the correct locations in the normalised document.
@@ -906,10 +994,28 @@ function applyDraft04Translations(node, ctx) {
 		node.exclusiveMinimum = node.minimum;
 		delete node.minimum;
 	} else if (node.exclusiveMinimum === false) delete node.exclusiveMinimum;
+	else if (node.exclusiveMinimum === true) {
+		if (ctx !== void 0) emitDiagnostic(ctx.diagnostics, {
+			code: "bare-exclusive-bound",
+			message: "`exclusiveMinimum: true` requires a sibling numeric `minimum` in Draft 04; dropping the keyword",
+			pointer: appendPointer(ctx.pointer, "exclusiveMinimum"),
+			detail: { keyword: "exclusiveMinimum" }
+		});
+		delete node.exclusiveMinimum;
+	}
 	if (node.exclusiveMaximum === true && typeof node.maximum === "number") {
 		node.exclusiveMaximum = node.maximum;
 		delete node.maximum;
 	} else if (node.exclusiveMaximum === false) delete node.exclusiveMaximum;
+	else if (node.exclusiveMaximum === true) {
+		if (ctx !== void 0) emitDiagnostic(ctx.diagnostics, {
+			code: "bare-exclusive-bound",
+			message: "`exclusiveMaximum: true` requires a sibling numeric `maximum` in Draft 04; dropping the keyword",
+			pointer: appendPointer(ctx.pointer, "exclusiveMaximum"),
+			detail: { keyword: "exclusiveMaximum" }
+		});
+		delete node.exclusiveMaximum;
+	}
 	const divisibleBy = node.divisibleBy;
 	if (typeof divisibleBy === "number") {
 		const multipleOf = node.multipleOf;
@@ -1045,13 +1151,135 @@ function normaliseJsonSchema(schema, draft, diagnostics) {
 		diagnostics,
 		pointer: ""
 	};
+	let normalised;
 	switch (draft) {
-		case "draft-04": return deepNormaliseWithContext(schema, normaliseDraft04NodeWithContext, ctx);
-		case "draft-2019-09": return deepNormaliseWithContext(schema, normaliseDraft201909NodeWithContext, ctx);
-		case "draft-2020-12": return deepNormaliseWithContext(schema, normaliseDynamicRefNodeWithContext, ctx);
+		case "draft-04":
+			normalised = deepNormaliseWithContext(schema, normaliseDraft04NodeWithContext, ctx);
+			break;
+		case "draft-2019-09":
+			normalised = deepNormaliseWithContext(schema, normaliseDraft201909NodeWithContext, ctx);
+			break;
+		case "draft-2020-12":
+			normalised = deepNormaliseWithContext(schema, normaliseDynamicRefNodeWithContext, ctx);
+			break;
 		case "draft-06":
-		case "draft-07": return deepNormaliseWithContext(schema, normaliseDraft06Or07NodeWithContext, ctx);
+		case "draft-07":
+			normalised = deepNormaliseWithContext(schema, normaliseDraft06Or07NodeWithContext, ctx);
+			break;
+	}
+	return resolveRelativeRefs(normalised, diagnostics);
+}
+/**
+* Parse a string as an absolute URI, returning `undefined` when it has
+* no scheme. Used to detect whether an `$id` value defines a base URI.
+*/
+function parseAbsoluteUri(value) {
+	if (typeof value !== "string" || value.length === 0) return void 0;
+	try {
+		const url = new URL(value);
+		if (url.protocol.length === 0) return void 0;
+		return url;
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve a relative reference against a base URI. Returns `undefined`
+* when the reference cannot be resolved (e.g. malformed input).
+*/
+function resolveAgainst(ref, base) {
+	try {
+		return new URL(ref, base);
+	} catch {
+		return;
+	}
+}
+/**
+* Strip the fragment portion from a URL, returning the canonical
+* `scheme://authority/path?query` form. Used to compare a resolved
+* `$ref` URI against the document's `$id` base.
+*/
+function stripFragment(url) {
+	const clone = new URL(url.toString());
+	clone.hash = "";
+	return clone.toString();
+}
+/**
+* Recursively rewrite relative `$ref`s in a schema so they resolve
+* correctly under the JSON Schema base-URI rules (RFC 3986 + JSON
+* Schema §8.2). Refs that resolve to the document's own `$id` are
+* rewritten to fragment-only form so the existing dereferencer can
+* handle them; refs that resolve outside the document are left as
+* absolute URIs (handled by the external resolver path).
+*
+* Returns the input unchanged when the document has no base URI or
+* no relative refs.
+*/
+function resolveRelativeRefs(schema, diagnostics) {
+	const docBaseUrl = parseAbsoluteUri(schema.$id);
+	if (docBaseUrl === void 0) return schema;
+	const docBase = stripFragment(docBaseUrl);
+	return rewriteRelativeRefsNode(schema, docBase, docBase, "", diagnostics);
+}
+function rewriteRelativeRefsNode(node, currentBase, docBase, pointer, diagnostics) {
+	let nextBase = currentBase;
+	const nodeId = node.$id;
+	if (typeof nodeId === "string" && nodeId.length > 0) {
+		const resolved = resolveAgainst(nodeId, currentBase);
+		if (resolved !== void 0) nextBase = stripFragment(resolved);
+	}
+	const result = {};
+	for (const [key, value] of Object.entries(node)) {
+		if (key === "$ref" && typeof value === "string") {
+			result[key] = rewriteRef(value, nextBase, docBase, appendPointer(pointer, key), diagnostics);
+			continue;
+		}
+		result[key] = rewriteRelativeRefsValue(value, key, nextBase, docBase, appendPointer(pointer, key), diagnostics);
 	}
+	return result;
+}
+function rewriteRelativeRefsValue(value, parentKey, currentBase, docBase, pointer, diagnostics) {
+	if (Array.isArray(value)) return value.map((item, i) => rewriteRelativeRefsValue(item, parentKey, currentBase, docBase, appendPointer(pointer, String(i)), diagnostics));
+	if (isObject(value)) return rewriteRelativeRefsNode(value, currentBase, docBase, pointer, diagnostics);
+	return value;
+}
+/**
+* Rewrite a single `$ref` string. Fragment-only refs and refs that
+* already include a scheme are returned unchanged. Relative refs are
+* resolved against `currentBase`; if the result lives in the same
+* document as `docBase`, the ref is rewritten to fragment form.
+*/
+function rewriteRef(ref, currentBase, docBase, pointer, diagnostics) {
+	if (ref.startsWith("#")) return ref;
+	if (/^[a-z][a-z0-9+\-.]*:/i.test(ref)) return ref;
+	const resolved = resolveAgainst(ref, currentBase);
+	if (resolved === void 0) return ref;
+	if (stripFragment(resolved) === docBase) {
+		const fragment = resolved.hash === "" ? "#" : resolved.hash;
+		emitDiagnostic(diagnostics, {
+			code: "relative-ref-resolved",
+			message: `Relative $ref "${ref}" resolved to "${fragment}" against base "${currentBase}"`,
+			pointer,
+			detail: {
+				ref,
+				base: currentBase,
+				resolved: fragment
+			}
+		});
+		return fragment;
+	}
+	const absolute = resolved.toString();
+	emitDiagnostic(diagnostics, {
+		code: "relative-ref-resolved",
+		message: `Relative $ref "${ref}" resolved to "${absolute}" against base "${currentBase}"`,
+		pointer,
+		detail: {
+			ref,
+			base: currentBase,
+			resolved: absolute
+		}
+	});
+	return absolute;
 }
 /**
 * Normalise an OpenAPI document's schemas for walker consumption.
@@ -1063,6 +1291,15 @@ function normaliseJsonSchema(schema, draft, diagnostics) {
 function normaliseOpenApiSchemas(doc, version, diagnostics) {
 	if (isSwagger2(version)) return normaliseSwagger2Document(doc, deepNormalise, normaliseDraft04Node, diagnostics);
 	if (isOpenApi30(version)) return deepNormaliseOpenApi30Doc(doc, deepNormalise);
+	if (isOpenApi31(version)) {
+		const dialect = readJsonSchemaDialect(doc);
+		if (dialect.kind === "unknown") emitDiagnostic(diagnostics, {
+			code: "unknown-json-schema-dialect",
+			message: `OpenAPI 3.1 \`jsonSchemaDialect\` URI "${dialect.uri}" does not match a supported JSON Schema draft; falling back to Draft 2020-12`,
+			pointer: "/jsonSchemaDialect",
+			detail: { uri: dialect.uri }
+		});
+	}
 	return deepNormaliseOpenApiDoc(doc, (schema) => deepNormalise(schema, normaliseOpenApi30Discriminator));
 }
 //#endregion

package/dist/openapi/ApiCallbacks.d.mts

@@ -1,4 +1,4 @@
-import { T as SchemaMeta } from "../types-D_5ST7SS.mjs";
+import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
 import { CallbackInfo } from "./parser.mjs";
 import { ReactNode } from "react";
 

package/dist/openapi/ApiLinks.d.mts

@@ -1,4 +1,4 @@
-import { T as SchemaMeta } from "../types-D_5ST7SS.mjs";
+import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
 import { LinkInfo } from "./parser.mjs";
 import { ReactNode } from "react";
 

package/dist/openapi/ApiResponseHeaders.d.mts

@@ -1,4 +1,4 @@
-import { T as SchemaMeta } from "../types-D_5ST7SS.mjs";
+import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
 import { HeaderInfo } from "./parser.mjs";
 import { ReactNode } from "react";
 

package/dist/openapi/ApiSecurity.d.mts

@@ -1,4 +1,4 @@
-import { T as SchemaMeta } from "../types-D_5ST7SS.mjs";
+import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
 import { SecurityRequirement, SecurityScheme } from "./parser.mjs";
 import { ReactNode } from "react";
 

package/dist/openapi/bundle.mjs

@@ -1,4 +1,5 @@
 import { isObject } from "../core/guards.mjs";
+import { isPrototypePollutingKey } from "../core/uri.mjs";
 //#region src/openapi/bundle.ts
 /**
 * OpenAPI document bundler — inlines external $ref files.
@@ -104,6 +105,7 @@ function resolveFragment(doc, fragment) {
 	for (const part of parts) {
 		if (!isObject(current)) return void 0;
 		const decoded = part.replace(/~1/g, "/").replace(/~0/g, "~");
+		if (isPrototypePollutingKey(decoded)) return void 0;
 		current = current[decoded];
 	}
 	return isObject(current) ? current : void 0;

package/dist/openapi/components.d.mts

@@ -1,5 +1,5 @@
-import { T as SchemaMeta, u as FieldOverride } from "../types-D_5ST7SS.mjs";
-import { a as InferResponseFields, d as UnsafeFields, i as InferRequestBodyFields, r as InferParameterOverrides } from "../typeInference-5JiqIZ8t.mjs";
+import { T as SchemaMeta, u as FieldOverride } from "../types-C9zw9wbX.mjs";
+import { a as InferResponseFields, i as InferRequestBodyFields, m as UnsafeFields, r as InferParameterOverrides } from "../typeInference-CDoD_LZ_.mjs";
 import { WidgetMap } from "../react/SchemaComponent.mjs";
 import { ReactNode } from "react";