schema-components 1.19.0 → 1.21.0

package/dist/openapi/resolve.mjs

@@ -1,6 +1,7 @@
-import { isObject } from "../core/guards.mjs";
+import { getProperty, isObject } from "../core/guards.mjs";
+import { isPrototypePollutingKey } from "../core/uri.mjs";
 import { detectOpenApiVersion } from "../core/version.mjs";
-import { a as normaliseOpenApiSchemas } from "../normalise-C0ofw3W6.mjs";
+import { a as normaliseOpenApiSchemas } from "../normalise-DaSrnr8g.mjs";
 import { getParameters, getRequestBody, getResponses, listOperations, parseOpenApiDocument } from "./parser.mjs";
 //#region src/openapi/resolve.ts
 /**
@@ -24,17 +25,30 @@ const docCache = /* @__PURE__ */ new WeakMap();
 * same form `<SchemaComponent>` does, keeping the OpenAPI components on
 * the same pipeline as the top-level adapter.
 *
-* The cache is keyed by the caller-supplied document so subsequent calls
-* with the same input bypass both normalisation and parsing.
+* When `diagnostics` is supplied, normalisation events
+* (`duplicate-body-parameter`, `dropped-swagger-feature`,
+* `unknown-json-schema-dialect`, `divisible-by-conflict`,
+* `relative-ref-resolved`, etc.) are forwarded to the sink. Passing
+* diagnostics also bypasses the cache so each call observes the
+* normalisation pipeline running against the supplied sink — caching
+* would silently swallow every emission after the first.
+*
+* The cache is keyed by the caller-supplied document so subsequent
+* cache-eligible calls with the same input bypass both normalisation
+* and parsing.
 */
-function getParsed(doc) {
-	const cached = docCache.get(doc);
-	if (cached !== void 0) return cached;
+function getParsed(doc, diagnostics) {
+	if (diagnostics === void 0) {
+		const cached = docCache.get(doc);
+		if (cached !== void 0) return cached;
+	}
 	const version = detectOpenApiVersion(doc);
-	const normalisedDoc = version !== void 0 ? normaliseOpenApiSchemas(doc, version) : doc;
+	const normalisedDoc = version !== void 0 ? normaliseOpenApiSchemas(doc, version, diagnostics) : doc;
 	const parsed = parseOpenApiDocument(normalisedDoc);
-	docCache.set(doc, parsed);
-	if (normalisedDoc !== doc) docCache.set(normalisedDoc, parsed);
+	if (diagnostics === void 0) {
+		docCache.set(doc, parsed);
+		if (normalisedDoc !== doc) docCache.set(normalisedDoc, parsed);
+	}
 	return parsed;
 }
 /**
@@ -45,45 +59,131 @@ function toDoc(value) {
 	return isObject(value) ? value : {};
 }
 /**
-* Resolve an operation from an OpenAPI document by path and method.
-* Throws if the operation is not found.
+* Look up a Path Item Object on the (already-normalised) parsed document,
+* following a single `$ref` hop into `components/pathItems` (OpenAPI 3.1)
+* if present. Returns `undefined` when the path is not present or the
+* value is not an object.
+*
+* Implemented inside `resolve.ts` to avoid touching `parser.ts` while
+* still surfacing path-item-level metadata to the React layer.
 */
-function resolveOperation(doc, path, method) {
-	const parsed = getParsed(doc);
+function lookupPathItemNode(parsed, path) {
+	return resolvePathItemNode(parsed, getProperty(getProperty(parsed.doc, "paths"), path));
+}
+function resolvePathItemNode(parsed, pathItem) {
+	if (!isObject(pathItem)) return void 0;
+	const ref = getProperty(pathItem, "$ref");
+	if (typeof ref !== "string") return pathItem;
+	if (!ref.startsWith("#/")) return pathItem;
+	const parts = ref.slice(2).split("/");
+	let current = parsed.doc;
+	for (const part of parts) {
+		if (!isObject(current)) return void 0;
+		const decoded = part.replace(/~1/g, "/").replace(/~0/g, "~");
+		if (isPrototypePollutingKey(decoded)) return void 0;
+		current = current[decoded];
+	}
+	return isObject(current) ? current : pathItem;
+}
+function extractPathItemInfo(pathItem) {
+	const summary = pathItem.summary;
+	const description = pathItem.description;
+	return {
+		summary: typeof summary === "string" ? summary : void 0,
+		description: typeof description === "string" ? description : void 0
+	};
+}
+/**
+* Resolve an operation against an already-parsed document. Throws if
+* the operation is not found.
+*
+* Used by callers that have already obtained a parsed document via
+* {@link getParsed} — most importantly the React components, which
+* supply `diagnostics` to `getParsed` and must avoid re-running the
+* normalisation pipeline (every re-run would emit each diagnostic
+* again into the sink).
+*/
+function resolveOperationFromParsed(parsed, path, method) {
 	const operation = listOperations(parsed).find((op) => op.path === path && op.method === method);
 	if (operation === void 0) throw new Error(`Operation not found: ${method.toUpperCase()} ${path}`);
+	const pathItemNode = lookupPathItemNode(parsed, path);
+	if (pathItemNode === void 0) throw new Error(`Path item missing for ${method.toUpperCase()} ${path}`);
 	return {
 		operation,
+		pathItem: extractPathItemInfo(pathItemNode),
 		parameters: getParameters(parsed, path, method),
 		requestBody: getRequestBody(parsed, path, method),
 		responses: getResponses(parsed, path, method)
 	};
 }
 /**
+* Resolve an operation from an OpenAPI document by path and method.
+* Throws if the operation is not found.
+*
+* `diagnostics` is forwarded to {@link getParsed} so normalisation
+* events surface to the caller's sink.
+*/
+function resolveOperation(doc, path, method, diagnostics) {
+	return resolveOperationFromParsed(getParsed(doc, diagnostics), path, method);
+}
+/**
+* Resolve parameters against an already-parsed document. See
+* {@link resolveOperationFromParsed} for the rationale.
+*/
+function resolveParametersFromParsed(parsed, path, method) {
+	return getParameters(parsed, path, method);
+}
+/**
 * Resolve parameters for an operation. Returns empty array if none.
+*
+* `diagnostics` is forwarded to {@link getParsed} so normalisation
+* events surface to the caller's sink.
+*/
+function resolveParameters(doc, path, method, diagnostics) {
+	return resolveParametersFromParsed(getParsed(doc, diagnostics), path, method);
+}
+/**
+* Resolve a request body against an already-parsed document. See
+* {@link resolveOperationFromParsed} for the rationale.
 */
-function resolveParameters(doc, path, method) {
-	return getParameters(getParsed(doc), path, method);
+function resolveRequestBodyFromParsed(parsed, path, method) {
+	return getRequestBody(parsed, path, method);
 }
 /**
 * Resolve request body for an operation. Returns undefined if none.
+*
+* `diagnostics` is forwarded to {@link getParsed} so normalisation
+* events surface to the caller's sink.
 */
-function resolveRequestBody(doc, path, method) {
-	return getRequestBody(getParsed(doc), path, method);
+function resolveRequestBody(doc, path, method, diagnostics) {
+	return resolveRequestBodyFromParsed(getParsed(doc, diagnostics), path, method);
 }
 /**
-* Resolve a specific response by status code. Throws if not found.
+* Resolve a specific response against an already-parsed document. See
+* {@link resolveOperationFromParsed} for the rationale.
 */
-function resolveResponse(doc, path, method, statusCode) {
-	const response = getResponses(getParsed(doc), path, method).find((r) => r.statusCode === statusCode);
+function resolveResponseFromParsed(parsed, path, method, statusCode) {
+	const response = getResponses(parsed, path, method).find((r) => r.statusCode === statusCode);
 	if (response === void 0) throw new Error(`Response not found: ${statusCode}`);
 	return response;
 }
 /**
+* Resolve a specific response by status code. Throws if not found.
+*
+* `diagnostics` is forwarded to {@link getParsed} so normalisation
+* events surface to the caller's sink.
+*/
+function resolveResponse(doc, path, method, statusCode, diagnostics) {
+	return resolveResponseFromParsed(getParsed(doc, diagnostics), path, method, statusCode);
+}
+/**
 * Resolve all responses for an operation.
+*
+* `diagnostics` is forwarded to {@link getParsed} so normalisation
+* events surface to the caller's sink.
 */
-function resolveResponses(doc, path, method) {
-	return getResponses(getParsed(doc), path, method);
+function resolveResponses(doc, path, method, diagnostics) {
+	return getResponses(getParsed(doc, diagnostics), path, method);
 }
 //#endregion
-export { getParsed, resolveOperation, resolveParameters, resolveRequestBody, resolveResponse, resolveResponses, toDoc };
+export { getParsed, resolveOperation, resolveOperationFromParsed, resolveParameters, resolveParametersFromParsed, resolveRequestBody, resolveRequestBodyFromParsed, resolveResponse, resolveResponseFromParsed, resolveResponses, toDoc };

package/dist/react/SchemaComponent.d.mts

@@ -1,8 +1,8 @@
-import { M as WalkedField, T as SchemaMeta, d as FieldOverrides, u as FieldOverride } from "../types-D_5ST7SS.mjs";
-import { t as Diagnostic } from "../diagnostics-VgEKI_Ct.mjs";
-import { t as SchemaError } from "../errors-CnGjT1cg.mjs";
-import { l as RenderProps, r as ComponentResolver } from "../renderer-BQqiXUYP.mjs";
-import { c as PathOfType, l as ResolveOpenAPIRef, n as FromJSONSchema } from "../typeInference-5JiqIZ8t.mjs";
+import { M as WalkedField, T as SchemaMeta, d as FieldOverrides, u as FieldOverride } from "../types-BnxPEElk.mjs";
+import { t as Diagnostic } from "../diagnostics-CbBPsxSt.mjs";
+import { t as SchemaError } from "../errors-QEwOtQAA.mjs";
+import { l as RenderProps, r as ComponentResolver } from "../renderer-DI6ZYf7a.mjs";
+import { c as PathOfType, l as RejectUnrepresentableZod, n as FromJSONSchema, u as ResolveOpenAPIRef } from "../typeInference-Bxw3NOG1.mjs";
 import { z } from "zod";
 import * as _$react_jsx_runtime0 from "react/jsx-runtime";
 import { ReactNode } from "react";
@@ -40,8 +40,17 @@ type InferFields<T, Ref extends string | undefined> = T extends z.ZodType ? Fiel
   openapi: unknown;
 } ? Ref extends string ? FieldOverrides<ResolveOpenAPIRef<T & Record<string, unknown>, Ref>> : Record<string, FieldOverride> : T extends object ? unknown extends FromJSONSchema<T> ? Record<string, FieldOverride> : FieldOverrides<FromJSONSchema<T>> : Record<string, FieldOverride>;
 interface SchemaComponentProps<T = unknown, Ref extends string | undefined = undefined> {
-  /** Zod schema, JSON Schema object, or OpenAPI document. */
-  schema: T;
+  /**
+   * Zod schema, JSON Schema object, or OpenAPI document.
+   *
+   * Zod 4 types that cannot round-trip through `z.toJSONSchema()`
+   * (bigint, date, map, set, symbol, function, undefined, void, nan,
+   * codec) are rejected at the type level via
+   * {@link RejectUnrepresentableZod}. Runtime conversion would throw
+   * `SchemaNormalisationError` with kind `zod-type-unrepresentable`
+   * — the static rejection surfaces the same failure at compile time.
+   */
+  schema: RejectUnrepresentableZod<T>;
   /** For OpenAPI: a ref string like "#/components/schemas/User" or "/users/post". */
   ref?: Ref;
   /** Current value to render. */
@@ -128,8 +137,11 @@ interface SchemaFieldProps<T = unknown, Ref extends string | undefined = undefin
    * paths are accepted. Falls back to `string` for runtime schemas.
    */
   path: P;
-  /** The schema to extract the field from. */
-  schema: T;
+  /**
+   * The schema to extract the field from. Subject to the same
+   * unrepresentable-Zod rejection as {@link SchemaComponentProps.schema}.
+   */
+  schema: RejectUnrepresentableZod<T>;
   /** For OpenAPI: a ref string. */
   ref?: Ref;
   /** Current value of the field at the given path. */

package/dist/react/SchemaComponent.mjs

@@ -87,7 +87,7 @@ function SchemaComponent({ schema: schemaInput, ref: refInput, value, onChange,
 	}
 	const handleChange = useCallback((nextValue) => {
 		if (validate) {
-			const error = runValidation(zodSchema, jsonSchema, nextValue);
+			const error = runValidation(zodSchema, jsonSchema, nextValue, onDiagnostic);
 			if (error !== void 0) {
 				onValidationError?.(error);
 				dispatchFieldErrors(fields, error);
@@ -100,7 +100,8 @@ function SchemaComponent({ schema: schemaInput, ref: refInput, value, onChange,
 		jsonSchema,
 		onChange,
 		onValidationError,
-		fields
+		fields,
+		onDiagnostic
 	]);
 	const walkOptions = {
 		componentMeta: mergedMeta,
@@ -145,7 +146,7 @@ function sanitisePrefix(value) {
 	if (sanitised.length === 0) throw new Error(`Cannot derive a DOM-safe id prefix from "${value}". Pass an explicit idPrefix prop.`);
 	return sanitised;
 }
-function runValidation(zodSchema, jsonSchema, value) {
+function runValidation(zodSchema, jsonSchema, value, onDiagnostic) {
 	if (zodSchema !== void 0 && isObject(zodSchema)) {
 		const safeParseFn = zodSchema.safeParse;
 		if (isCallable(safeParseFn)) {
@@ -154,7 +155,13 @@ function runValidation(zodSchema, jsonSchema, value) {
 			return;
 		}
 	}
-	const parsed = z.fromJSONSchema(jsonSchema);
+	let parsed;
+	try {
+		parsed = z.fromJSONSchema(jsonSchema);
+	} catch (err) {
+		emitFromJsonSchemaDiagnostic(err, onDiagnostic);
+		return;
+	}
 	if (isObject(parsed)) {
 		const safeParseFn = parsed.safeParse;
 		if (isCallable(safeParseFn)) {
@@ -163,6 +170,27 @@ function runValidation(zodSchema, jsonSchema, value) {
 		}
 	}
 }
+/**
+* Emit a diagnostic when `z.fromJSONSchema` refuses to round-trip the
+* already-normalised JSON Schema. The diagnostic reuses the existing
+* `unsupported-type` code because the failure mode is the same — a
+* keyword/structure Zod cannot represent — and the consumer should be
+* able to opt in to noticing it via the existing diagnostics channel.
+*
+* Best-effort: when no `onDiagnostic` sink is configured we still swallow
+* the throw (the alternative would crash the React render for a
+* non-essential validation step), matching the silent-fallback contract
+* the rest of the diagnostics system uses.
+*/
+function emitFromJsonSchemaDiagnostic(err, onDiagnostic) {
+	if (onDiagnostic === void 0) return;
+	onDiagnostic({
+		code: "unsupported-type",
+		message: `Skipping fallback validation: z.fromJSONSchema could not round-trip the normalised JSON Schema. Original message: ${err instanceof Error ? err.message : "z.fromJSONSchema threw a non-Error value"}`,
+		pointer: "",
+		detail: { source: "z.fromJSONSchema" }
+	});
+}
 /** Maximum rendering depth before treating a field as recursive. */
 const MAX_RENDER_DEPTH = 10;
 function renderField(tree, value, onChange, userResolver, renderChild, path, instanceWidgets, contextWidgets, depth = 0) {

package/dist/react/SchemaView.d.mts

@@ -1,6 +1,6 @@
-import { T as SchemaMeta } from "../types-D_5ST7SS.mjs";
-import { t as Diagnostic } from "../diagnostics-VgEKI_Ct.mjs";
-import { r as ComponentResolver } from "../renderer-BQqiXUYP.mjs";
+import { T as SchemaMeta } from "../types-BnxPEElk.mjs";
+import { t as Diagnostic } from "../diagnostics-CbBPsxSt.mjs";
+import { r as ComponentResolver } from "../renderer-DI6ZYf7a.mjs";
 import { WidgetMap } from "./SchemaComponent.mjs";
 import { ReactNode } from "react";
 

package/dist/react/fieldPath.d.mts

@@ -1,4 +1,4 @@
-import { M as WalkedField } from "../types-D_5ST7SS.mjs";
+import { M as WalkedField } from "../types-BnxPEElk.mjs";
 
 //#region src/react/fieldPath.d.ts
 /**

package/dist/react/headless.d.mts

@@ -1,4 +1,4 @@
-import { r as ComponentResolver } from "../renderer-BQqiXUYP.mjs";
+import { r as ComponentResolver } from "../renderer-DI6ZYf7a.mjs";
 
 //#region src/react/headless.d.ts
 /**

package/dist/react/headlessRenderers.d.mts

@@ -1,5 +1,5 @@
-import { M as WalkedField } from "../types-D_5ST7SS.mjs";
-import { l as RenderProps } from "../renderer-BQqiXUYP.mjs";
+import { M as WalkedField } from "../types-BnxPEElk.mjs";
+import { l as RenderProps } from "../renderer-DI6ZYf7a.mjs";
 import { ReactNode } from "react";
 
 //#region src/react/headlessRenderers.d.ts

package/dist/react/headlessRenderers.mjs

@@ -1,4 +1,5 @@
 import { isObject } from "../core/guards.mjs";
+import { isSafeHyperlink, isSafeMailtoAddress } from "../core/uri.mjs";
 import { sortFieldsByOrder } from "../core/fieldOrder.mjs";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { isValidElement, useCallback, useEffect, useRef } from "react";
@@ -83,13 +84,13 @@ function renderString(props) {
 			children: "—"
 		});
 		const format = props.constraints.format;
-		if (format === "email") return /* @__PURE__ */ jsx("a", {
+		if (format === "email" && isSafeMailtoAddress(strValue)) return /* @__PURE__ */ jsx("a", {
 			href: `mailto:${strValue}`,
 			id,
 			"aria-readonly": "true",
 			children: strValue
 		});
-		if (format === "uri" || format === "url") return /* @__PURE__ */ jsx("a", {
+		if ((format === "uri" || format === "url") && isSafeHyperlink(strValue)) return /* @__PURE__ */ jsx("a", {
 			href: strValue,
 			id,
 			"aria-readonly": "true",
@@ -658,12 +659,14 @@ function renderNever(props) {
 function renderTuple(props) {
 	if (props.tree.type !== "tuple") return null;
 	const prefixItems = props.tree.prefixItems;
-	if (prefixItems.length === 0) return null;
+	const restItems = props.tree.restItems;
 	const arr = Array.isArray(props.value) ? props.value : [];
-	return /* @__PURE__ */ jsx("div", {
+	if (prefixItems.length === 0 && restItems === void 0 && arr.length === 0) return null;
+	const restCount = restItems !== void 0 ? Math.max(arr.length - prefixItems.length, 0) : 0;
+	return /* @__PURE__ */ jsxs("div", {
 		role: "group",
 		"aria-label": props.meta.description ?? void 0,
-		children: prefixItems.map((element, i) => {
+		children: [prefixItems.map((element, i) => {
 			const itemValue = arr[i];
 			const childOnChange = (v) => {
 				const next = arr.slice();
@@ -671,7 +674,16 @@ function renderTuple(props) {
 				props.onChange(next);
 			};
 			return /* @__PURE__ */ jsx("div", { children: toReactNode(props.renderChild(element, itemValue, childOnChange, `[${String(i)}]`)) }, String(i));
-		})
+		}), restItems !== void 0 && Array.from({ length: restCount }, (_, j) => {
+			const i = prefixItems.length + j;
+			const itemValue = arr[i];
+			const childOnChange = (v) => {
+				const next = arr.slice();
+				next[i] = v;
+				props.onChange(next);
+			};
+			return /* @__PURE__ */ jsx("div", { children: toReactNode(props.renderChild(restItems, itemValue, childOnChange, `[${String(i)}]`)) }, `rest-${String(i)}`);
+		})]
 	});
 }
 /**

package/dist/{ref-Bb43ZURY.d.mts → ref-si8ViYun.d.mts}

@@ -1,4 +1,4 @@
-import { i as DiagnosticsOptions } from "./diagnostics-VgEKI_Ct.mjs";
+import { i as DiagnosticsOptions } from "./diagnostics-CbBPsxSt.mjs";
 
 //#region src/core/ref.d.ts
 /**
@@ -38,7 +38,12 @@ declare function dereference(ref: string, root: Record<string, unknown>): Record
 /**
  * Recursively scan a schema document for a `$anchor` matching the given name.
  * Returns the schema object containing the anchor, or undefined.
+ *
+ * The optional `visited` set guards against shared object references and
+ * cycles introduced by the OpenAPI bundler's `structuredClone`-based
+ * inlining of external refs. Without it a recursive document would stack
+ * overflow before reaching the matching anchor.
  */
-declare function findAnchor(node: unknown, anchorName: string): Record<string, unknown> | undefined;
+declare function findAnchor(node: unknown, anchorName: string, visited?: WeakSet<object>): Record<string, unknown> | undefined;
 //#endregion
 export { findAnchor as a, dereference as i, RefOptions as n, resolveRef as o, countDistinctRefs as r, ExternalResolver as t };

package/dist/{renderer-BQqiXUYP.d.mts → renderer-DI6ZYf7a.d.mts}

@@ -1,4 +1,4 @@
-import { D as StringConstraints, M as WalkedField, T as SchemaMeta, f as FileConstraints, t as ArrayConstraints, x as ObjectConstraints, y as NumberConstraints } from "./types-D_5ST7SS.mjs";
+import { D as StringConstraints, M as WalkedField, T as SchemaMeta, f as FileConstraints, t as ArrayConstraints, x as ObjectConstraints, y as NumberConstraints } from "./types-BnxPEElk.mjs";
 
 //#region src/core/renderer.d.ts
 /**

package/dist/themes/mantine.d.mts

@@ -1,4 +1,4 @@
-import { r as ComponentResolver } from "../renderer-BQqiXUYP.mjs";
+import { r as ComponentResolver } from "../renderer-DI6ZYf7a.mjs";
 
 //#region src/themes/mantine.d.ts
 /**

package/dist/themes/mui.d.mts

@@ -1,4 +1,4 @@
-import { r as ComponentResolver } from "../renderer-BQqiXUYP.mjs";
+import { r as ComponentResolver } from "../renderer-DI6ZYf7a.mjs";
 
 //#region src/themes/mui.d.ts
 /**

package/dist/themes/radix.d.mts

@@ -1,4 +1,4 @@
-import { r as ComponentResolver } from "../renderer-BQqiXUYP.mjs";
+import { r as ComponentResolver } from "../renderer-DI6ZYf7a.mjs";
 
 //#region src/themes/radix.d.ts
 /**

package/dist/themes/shadcn.d.mts

@@ -1,4 +1,4 @@
-import { r as ComponentResolver } from "../renderer-BQqiXUYP.mjs";
+import { r as ComponentResolver } from "../renderer-DI6ZYf7a.mjs";
 
 //#region src/themes/shadcn.d.ts
 declare const shadcnResolver: ComponentResolver;