schema-components 1.20.0 → 1.22.0

package/dist/html/streamRenderers.mjs

@@ -1,7 +1,10 @@
 import { isObject } from "../core/guards.mjs";
+import "../core/limits.mjs";
+import { emitDiagnostic } from "../core/diagnostics.mjs";
 import { getHtmlRenderFn } from "../core/renderer.mjs";
 import { VOID_ELEMENTS, h, raw, serialize, serializeAttributes } from "./html.mjs";
-import { ariaLabelAttrs, buildHintElement, buildInputId, requiredIndicator } from "./a11y.mjs";
+import { ariaLabelAttrs, buildHintElement, buildInputId, joinPath, requiredIndicator } from "./a11y.mjs";
+import { recursionSentinelHtml } from "./renderToHtml.mjs";
 //#region src/html/streamRenderers.ts
 function yieldOpen(el) {
 	const attrStr = serializeAttributes(el.attributes);
@@ -27,8 +30,8 @@ function renderLeaf(tree, value, mergedResolver, path) {
 	if (value === void 0 || value === null) return serialize(h("span", { class: "sc-value sc-value--empty" }, "—"));
 	return serialize(h("span", { class: "sc-value" }, typeof value === "string" ? value : JSON.stringify(value)));
 }
-function renderFieldSync(tree, value, mergedResolver, path, rawResolver) {
-	return [...streamField(tree, value, mergedResolver, path, rawResolver)].join("");
+function renderFieldSync(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics) {
+	return [...streamField(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics)].join("");
 }
 function matchUnionOption(options, value) {
 	if (typeof value === "string") return options.find((o) => o.type === "string" || o.type === "enum");
@@ -37,7 +40,26 @@ function matchUnionOption(options, value) {
 	if (Array.isArray(value)) return options.find((o) => o.type === "array");
 	if (typeof value === "object" && value !== null) return options.find((o) => o.type === "object");
 }
-function* streamField(tree, value, mergedResolver, path, rawResolver) {
+/**
+* Build a visible placeholder element used when a value does not match
+* the shape implied by its field type. The expected-shape label is
+* passed verbatim into `h()` so the serialiser escapes it.
+*
+* Streaming must keep producing output, so we never throw here — the
+* diagnostic surfaces the problem to the caller (when a sink is wired)
+* while the rendered output remains structurally valid.
+*/
+function typeMismatchPlaceholder(expectedShape) {
+	return serialize(h("span", {
+		class: "sc-value sc-value--invalid",
+		role: "alert"
+	}, `invalid value (expected ${expectedShape})`));
+}
+function* streamField(tree, value, mergedResolver, path, rawResolver, currentDepth = 0, diagnostics) {
+	if (currentDepth >= 10) {
+		yield recursionSentinelHtml(typeof tree.meta.description === "string" ? tree.meta.description : "schema");
+		return;
+	}
 	const effectiveValue = value ?? tree.defaultValue;
 	const type = tree.type;
 	if (type === "string" || type === "number" || type === "boolean" || type === "enum" || type === "literal" || type === "file" || type === "unknown") {
@@ -45,30 +67,44 @@ function* streamField(tree, value, mergedResolver, path, rawResolver) {
 		return;
 	}
 	if (type === "union") {
-		yield* streamUnion(tree, effectiveValue, mergedResolver, path, rawResolver);
+		yield* streamUnion(tree, effectiveValue, mergedResolver, path, rawResolver, currentDepth, diagnostics);
 		return;
 	}
 	if (type === "discriminatedUnion") {
-		yield* streamDiscriminatedUnion(tree, value, mergedResolver, path, rawResolver);
+		yield* streamDiscriminatedUnion(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics);
 		return;
 	}
 	if (type === "object") {
-		yield* streamObject(tree, value, mergedResolver, path, rawResolver);
+		yield* streamObject(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics);
 		return;
 	}
 	if (type === "array") {
-		yield* streamArray(tree, value, mergedResolver, path, rawResolver);
+		yield* streamArray(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics);
 		return;
 	}
 	if (type === "record") {
-		yield* streamRecord(tree, value, mergedResolver, path, rawResolver);
+		yield* streamRecord(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics);
 		return;
 	}
 	yield renderLeaf(tree, value, mergedResolver, path);
 }
-function* streamObject(tree, value, mergedResolver, path, rawResolver) {
+function* streamObject(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics) {
 	if (tree.type !== "object") return;
 	const fields = tree.fields;
+	if (value !== void 0 && value !== null && !isObject(value)) {
+		emitDiagnostic(diagnostics, {
+			code: "type-mismatch",
+			message: "Object schema received non-object value during streaming render",
+			pointer: path === "" ? "/" : `/${path}`,
+			detail: {
+				expected: "object",
+				actualType: typeof value,
+				path
+			}
+		});
+		yield typeMismatchPlaceholder("object");
+		return;
+	}
 	const obj = isObject(value) ? value : {};
 	const readOnly = tree.editability === "presentation";
 	const descriptionText = typeof tree.meta.description === "string" ? tree.meta.description : void 0;
@@ -82,7 +118,7 @@ function* streamObject(tree, value, mergedResolver, path, rawResolver) {
 		for (const [key, field] of Object.entries(fields)) {
 			const label = typeof field.meta.description === "string" ? field.meta.description : key;
 			const childValue = obj[key];
-			const childHtml = renderFieldSync(field, childValue, mergedResolver, key, rawResolver);
+			const childHtml = renderFieldSync(field, childValue, mergedResolver, joinPath(path, key), rawResolver, currentDepth + 1, diagnostics);
 			yield `${serialize(h("dt", { class: "sc-label" }, label))}${serialize(h("dd", { class: "sc-value" }, raw(childHtml)))}`;
 		}
 		yield yieldClose(dl);
@@ -96,7 +132,7 @@ function* streamObject(tree, value, mergedResolver, path, rawResolver) {
 			const label = typeof field.meta.description === "string" ? field.meta.description : key;
 			const fieldId = buildInputId(path, key);
 			const childValue = obj[key];
-			const childChunks = [...streamField(field, childValue, mergedResolver, key, rawResolver)].join("");
+			const childChunks = [...streamField(field, childValue, mergedResolver, joinPath(path, key), rawResolver, currentDepth + 1, diagnostics)].join("");
 			const required = requiredIndicator(field);
 			const labelContent = [label];
 			if (required !== void 0) labelContent.push(required);
@@ -111,29 +147,55 @@ function* streamObject(tree, value, mergedResolver, path, rawResolver) {
 		yield yieldClose(fieldset);
 	}
 }
-function* streamArray(tree, value, mergedResolver, path, rawResolver) {
-	const arr = Array.isArray(value) ? value : [];
+function* streamArray(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics) {
 	if (tree.type !== "array") return;
 	const element = tree.element;
 	if (element === void 0) return;
-	const readOnly = tree.editability === "presentation";
-	const elementPath = typeof element.meta.description === "string" ? element.meta.description : "";
-	if (readOnly) {
+	if (value !== void 0 && value !== null && !Array.isArray(value)) {
+		emitDiagnostic(diagnostics, {
+			code: "type-mismatch",
+			message: "Array schema received non-array value during streaming render",
+			pointer: path === "" ? "/" : `/${path}`,
+			detail: {
+				expected: "array",
+				actualType: typeof value,
+				path
+			}
+		});
+		yield typeMismatchPlaceholder("array");
+		return;
+	}
+	const arr = Array.isArray(value) ? value : [];
+	if (tree.editability === "presentation") {
 		const ul = h("ul", { class: "sc-array" });
 		yield yieldOpen(ul);
-		for (const item of arr) yield serialize(h("li", { class: "sc-item" }, raw(renderFieldSync(element, item, mergedResolver, elementPath, rawResolver))));
+		for (const [i, item] of arr.entries()) yield serialize(h("li", { class: "sc-item" }, raw(renderFieldSync(element, item, mergedResolver, joinPath(path, `[${String(i)}]`), rawResolver, currentDepth + 1, diagnostics))));
 		yield yieldClose(ul);
 	} else {
 		const div = h("div", { class: "sc-array" });
 		yield yieldOpen(div);
-		for (const item of arr) yield serialize(h("div", {}, raw(renderFieldSync(element, item, mergedResolver, elementPath, rawResolver))));
+		for (const [i, item] of arr.entries()) yield serialize(h("div", {}, raw(renderFieldSync(element, item, mergedResolver, joinPath(path, `[${String(i)}]`), rawResolver, currentDepth + 1, diagnostics))));
 		yield yieldClose(div);
 	}
 }
-function* streamRecord(tree, value, mergedResolver, path, rawResolver) {
-	const obj = isObject(value) ? value : {};
+function* streamRecord(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics) {
 	if (tree.type !== "record") return;
 	const valueType = tree.valueType;
+	if (value !== void 0 && value !== null && !isObject(value)) {
+		emitDiagnostic(diagnostics, {
+			code: "type-mismatch",
+			message: "Record schema received non-object value during streaming render",
+			pointer: path === "" ? "/" : `/${path}`,
+			detail: {
+				expected: "object",
+				actualType: typeof value,
+				path
+			}
+		});
+		yield typeMismatchPlaceholder("object");
+		return;
+	}
+	const obj = isObject(value) ? value : {};
 	const readOnly = tree.editability === "presentation";
 	const attrs = {
 		class: "sc-record",
@@ -143,7 +205,7 @@ function* streamRecord(tree, value, mergedResolver, path, rawResolver) {
 		const dl = h("dl", attrs);
 		yield yieldOpen(dl);
 		for (const [key, val] of Object.entries(obj)) {
-			const childHtml = renderFieldSync(valueType, val, mergedResolver, key, rawResolver);
+			const childHtml = renderFieldSync(valueType, val, mergedResolver, joinPath(path, key), rawResolver, currentDepth + 1, diagnostics);
 			yield `${serialize(h("dt", { class: "sc-label" }, key))}${serialize(h("dd", { class: "sc-value" }, raw(childHtml)))}`;
 		}
 		yield yieldClose(dl);
@@ -151,13 +213,13 @@ function* streamRecord(tree, value, mergedResolver, path, rawResolver) {
 		const container = h("div", attrs);
 		yield yieldOpen(container);
 		for (const [key, val] of Object.entries(obj)) {
-			const childHtml = renderFieldSync(valueType, val, mergedResolver, key, rawResolver);
+			const childHtml = renderFieldSync(valueType, val, mergedResolver, joinPath(path, key), rawResolver, currentDepth + 1, diagnostics);
 			yield serialize(h("div", { class: "sc-field" }, h("label", { class: "sc-label" }, key), raw(childHtml)));
 		}
 		yield yieldClose(container);
 	}
 }
-function* streamUnion(tree, value, mergedResolver, path, rawResolver) {
+function* streamUnion(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics) {
 	const options = tree.type === "union" ? tree.options : void 0;
 	if (options === void 0 || options.length === 0) {
 		if (value === void 0 || value === null) yield serialize(h("span", { class: "sc-value sc-value--empty" }, "—"));
@@ -165,10 +227,10 @@ function* streamUnion(tree, value, mergedResolver, path, rawResolver) {
 		return;
 	}
 	const target = matchUnionOption(options, value) ?? options[0];
-	if (target !== void 0) yield* streamField(target, value, mergedResolver, typeof target.meta.description === "string" ? target.meta.description : "", rawResolver);
+	if (target !== void 0) yield* streamField(target, value, mergedResolver, path, rawResolver, currentDepth + 1, diagnostics);
 	else yield serialize(h("span", { class: "sc-value sc-value--empty" }, "—"));
 }
-function* streamDiscriminatedUnion(tree, value, mergedResolver, path, rawResolver) {
+function* streamDiscriminatedUnion(tree, value, mergedResolver, path, rawResolver, currentDepth, diagnostics) {
 	const options = tree.type === "discriminatedUnion" ? tree.options : void 0;
 	const discriminator = tree.type === "discriminatedUnion" ? tree.discriminator : void 0;
 	if (options === void 0 || options.length === 0) {
@@ -176,8 +238,7 @@ function* streamDiscriminatedUnion(tree, value, mergedResolver, path, rawResolve
 		else yield serialize(h("span", { class: "sc-value" }, JSON.stringify(value)));
 		return;
 	}
-	const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-	const obj = isRecord(value) ? value : {};
+	const obj = isObject(value) ? value : {};
 	const discKey = discriminator ?? "";
 	const currentDiscriminatorValue = typeof obj[discKey] === "string" ? obj[discKey] : void 0;
 	const optionLabels = options.map((opt) => {
@@ -197,7 +258,7 @@ function* streamDiscriminatedUnion(tree, value, mergedResolver, path, rawResolve
 	}
 	const activeOption = options[activeIndex];
 	if (tree.editability === "presentation") {
-		if (activeOption !== void 0) yield* streamField(activeOption, value, mergedResolver, typeof activeOption.meta.description === "string" ? activeOption.meta.description : "", rawResolver);
+		if (activeOption !== void 0) yield* streamField(activeOption, value, mergedResolver, path, rawResolver, currentDepth + 1, diagnostics);
 		return;
 	}
 	const panelId = `sc-${path}-panel`;
@@ -224,7 +285,7 @@ function* streamDiscriminatedUnion(tree, value, mergedResolver, path, rawResolve
 		"aria-labelledby": `sc-${path}-tab-${String(activeIndex)}`
 	});
 	yield yieldOpen(panelOpen);
-	if (activeOption !== void 0) yield* streamField(activeOption, value, mergedResolver, typeof activeOption.meta.description === "string" ? activeOption.meta.description : "", rawResolver);
+	if (activeOption !== void 0) yield* streamField(activeOption, value, mergedResolver, path, rawResolver, currentDepth + 1, diagnostics);
 	yield yieldClose(panelOpen);
 	yield yieldClose(wrapper);
 }

package/dist/limits-Cw5QZND8.d.mts

@@ -0,0 +1,29 @@
+//#region src/core/limits.d.ts
+/**
+ * Shared depth caps and hop counts used to bound recursion across
+ * schema-components. All numeric limits live here so the renderer, the
+ * ref resolver, the OpenAPI parser, and the type-level inference engine
+ * agree on the same constants.
+ */
+/**
+ * Maximum recursion depth for the schema walker, the React renderers,
+ * the streaming HTML renderer, and the server-side renderer. Beyond
+ * this depth a recursion sentinel is emitted instead of further descent
+ * — the only safe response to a cyclic walked-field graph.
+ */
+declare const MAX_RENDER_DEPTH = 10;
+/**
+ * Maximum depth for `$ref` resolution and Zod-tree walks. Mirrors the
+ * type-level `DEFAULT_MAX_DEPTH` ({@link MaxRefDepth}) so the runtime
+ * and compile-time bounds agree.
+ */
+type MaxRefDepth = 64;
+declare const MAX_REF_DEPTH: MaxRefDepth;
+/**
+ * Maximum number of `$ref` hops permitted when walking a chain of
+ * OpenAPI Path Item Object references. Beyond this a
+ * `path-item-ref-too-deep` diagnostic is emitted and resolution stops.
+ */
+declare const MAX_PATH_ITEM_REF_HOPS = 8;
+//#endregion
+export { MaxRefDepth as i, MAX_REF_DEPTH as n, MAX_RENDER_DEPTH as r, MAX_PATH_ITEM_REF_HOPS as t };