schema-components 1.21.0 → 1.22.0

package/README.md

@@ -16,7 +16,7 @@ Peer dependencies: `zod@^4.0.0`, `react@^18.0.0 || ^19.0.0`.
 
 ### Zod version requirement
 
-schema-components requires **Zod 4**. If you are on Zod 3, see the [Zod 4 migration guide](https://zod.dev/v4/migration). The library detects Zod 3 inputs and throws a descriptive error rather than silently misbehaving.
+schema-components requires **Zod 4**. If you are on Zod 3, see the [Zod 4 migration guide](https://zod.dev/v4/migration). If a Zod 3 schema is passed (detected via `_def.typeName`), a descriptive `SchemaNormalisationError` is raised pointing at the Zod 4 migration guide. Schemas from other Standard Schema libraries are not currently supported.
 
 ## `SchemaComponent`
 

package/dist/core/adapter.d.mts

@@ -1,9 +1,26 @@
-import { T as SchemaMeta, m as JsonObject } from "../types-BnxPEElk.mjs";
-import { i as DiagnosticsOptions } from "../diagnostics-CbBPsxSt.mjs";
+import { m as JsonObject, w as SchemaMeta } from "../types-BrRMV0en.mjs";
+import { i as DiagnosticsOptions } from "../diagnostics-D0QCYGv0.mjs";
 
 //#region src/core/adapter.d.ts
 type SchemaInput = Record<string, unknown>;
-type SchemaKind = "zod4" | "zod3" | "jsonSchema" | "openapi";
+type SchemaKind = "zod4" | "zod3" | "jsonSchema" | "openapi" | "unsupported-schema-lib";
+/**
+ * Classify the input schema by its structural markers.
+ *
+ * - `zod4` — has a `_zod` marker (further validation that `_zod.def` is a
+ *   non-null object happens inside `normaliseZod4`).
+ * - `zod3` — has `_def` and no `_zod`. The `typeName` field is no longer
+ *   required: any `_def` without `_zod` is treated as a probable Zod 3
+ *   schema. Third-party libraries that expose `_def` without `_zod` are
+ *   nearly always Zod 3 forks; surfacing the migration message is the
+ *   correct response.
+ * - `openapi` — has `openapi` or `swagger` at the root.
+ * - `unsupported-schema-lib` — has `parse` and `safeParse` callables but
+ *   no `_zod` and no `_def` marker. This catches Standard Schema
+ *   implementations (valibot, arktype, etc.) that would otherwise flow
+ *   through as "malformed JSON Schema".
+ * - `jsonSchema` — fallback for anything that does not match the above.
+ */
 declare function detectSchemaKind(input: unknown): SchemaKind;
 /**
  * Exposed for unit testing — lets the contract test enumerate every rule's

package/dist/core/adapter.mjs

@@ -1,9 +1,10 @@
 import { getProperty, hasProperty, isObject } from "./guards.mjs";
+import "./limits.mjs";
 import { SchemaNormalisationError } from "./errors.mjs";
 import { emitDiagnostic } from "./diagnostics.mjs";
 import { dereference } from "./ref.mjs";
 import { detectOpenApiVersion, inferJsonSchemaDraftWithReason, isSwagger2, matchJsonSchemaDraftUri } from "./version.mjs";
-import { a as normaliseOpenApiSchemas, i as normaliseJsonSchema$1 } from "../normalise-DaSrnr8g.mjs";
+import { a as normaliseOpenApiSchemas, i as normaliseJsonSchema$1 } from "../normalise-DVEJQmF7.mjs";
 import { z } from "zod";
 //#region src/core/adapter.ts
 /**
@@ -18,13 +19,46 @@ import { z } from "zod";
 * All narrowing uses type guards — no type assertions.
 */
 const schemaCache = /* @__PURE__ */ new WeakMap();
+/**
+* Classify the input schema by its structural markers.
+*
+* - `zod4` — has a `_zod` marker (further validation that `_zod.def` is a
+*   non-null object happens inside `normaliseZod4`).
+* - `zod3` — has `_def` and no `_zod`. The `typeName` field is no longer
+*   required: any `_def` without `_zod` is treated as a probable Zod 3
+*   schema. Third-party libraries that expose `_def` without `_zod` are
+*   nearly always Zod 3 forks; surfacing the migration message is the
+*   correct response.
+* - `openapi` — has `openapi` or `swagger` at the root.
+* - `unsupported-schema-lib` — has `parse` and `safeParse` callables but
+*   no `_zod` and no `_def` marker. This catches Standard Schema
+*   implementations (valibot, arktype, etc.) that would otherwise flow
+*   through as "malformed JSON Schema".
+* - `jsonSchema` — fallback for anything that does not match the above.
+*/
 function detectSchemaKind(input) {
 	if (hasProperty(input, "_zod")) return "zod4";
 	if (hasProperty(input, "_def") && !hasProperty(input, "_zod")) return "zod3";
 	if (hasProperty(input, "openapi") || hasProperty(input, "swagger")) return "openapi";
+	if (isLikelyOtherSchemaLib(input)) return "unsupported-schema-lib";
 	return "jsonSchema";
 }
 /**
+* Heuristic: a non-Zod object exposing both `.parse` and `.safeParse` as
+* callables is almost certainly an instance of a competing schema library
+* (Standard Schema, valibot, arktype, etc.). schema-components requires
+* Zod 4 throughout — surfacing the unsupported library by name beats
+* letting the input drop through to the JSON Schema branch where it
+* would fail as "malformed JSON Schema" without explanation.
+*/
+function isLikelyOtherSchemaLib(input) {
+	if (!isObject(input)) return false;
+	if (hasProperty(input, "_zod") || hasProperty(input, "_def")) return false;
+	const parse = input.parse;
+	const safeParse = input.safeParse;
+	return typeof parse === "function" && typeof safeParse === "function";
+}
+/**
 * Wraps z.toJSONSchema() for a runtime-validated Zod schema.
 *
 * The _zod guard in normaliseZod4 has confirmed this is a valid Zod schema,
@@ -32,6 +66,28 @@ function detectSchemaKind(input) {
 * that z.toJSONSchema expects. This is the library boundary equivalent of
 * object → Record<string, unknown> — the type mismatch is genuinely unavoidable.
 *
+* # Options
+*
+* `z.toJSONSchema` is invoked with an explicit options object rather than
+* Zod's defaults so the conversion contract is pinned and stable:
+*
+* - `target: "draft-2020-12"` — matches the walker's draft target.
+* - `unrepresentable: "throw"` — keeps the unrepresentable-type rules in
+*   the classifier table firing instead of silently emitting `{}`.
+* - `cycles: "ref"` — converts cyclic graphs into $ref pairs rather than
+*   throwing. Cycles in user schemas surface through the walker's $ref
+*   resolution rather than the adapter.
+* - `io: "output"` — convert the OUTPUT side of every transform / pipe /
+*   codec. The input side is invisible to the converted schema, even
+*   though `safeParse` on the same Zod schema consumes the input shape.
+*   For transforms this divergence is fatal and the call throws via
+*   `Transforms cannot be represented`; for `z.codec(...)` the call
+*   succeeds but only the output side is rendered. Consumers receive a
+*   `zod-codec-output-only` diagnostic in the codec case so the
+*   asymmetry is visible — see `screenPreConversion`.
+*
+* # Error classification
+*
 * Any exception thrown by z.toJSONSchema is classified into a
 * SchemaNormalisationError so the caller does not have to re-parse error
 * message strings. The classification covers:
@@ -69,12 +125,76 @@ function detectSchemaKind(input) {
 */
 function callToJsonSchema(schema) {
 	try {
-		return z.toJSONSchema(schema);
+		return z.toJSONSchema(schema, {
+			target: "draft-2020-12",
+			unrepresentable: "throw",
+			cycles: "ref",
+			io: "output"
+		});
 	} catch (err) {
 		throw classifyZodConversionError(err, schema);
 	}
 }
 /**
+* Zod `def.type` tags that have no useful JSON Schema representation but
+* do NOT throw when passed through `z.toJSONSchema`. Each tag is handled
+* by Zod with a processor that silently rewrites the output:
+*
+* - `promise` — `promiseProcessor` unwraps the inner type, dropping the
+*   `Promise<...>` wrapper without any error. (`json-schema-processors.ts`,
+*   the body of `promiseProcessor` calls `process(def.innerType, ...)`.)
+*   schema-components considers this a silent shape mismatch — the input
+*   tree advertised a `Promise<T>` and the consumer would render `T`
+*   without ever being told the wrapping was lost.
+*
+* Detection happens BEFORE the call to `z.toJSONSchema` so the response is
+* an immediate `SchemaNormalisationError` with `kind:
+* "zod-type-unrepresentable"`, matching the philosophy of
+* `UnrepresentableZodType` in `typeInference.ts` — these types are
+* rejected, not coerced.
+*/
+const PRECONVERSION_UNREPRESENTABLE_TAGS = new Map([["promise", "z.promise(T) cannot be represented in JSON Schema. Zod silently unwraps it to the inner type, which would leave the rendered schema out of sync with the source. Resolve the promise at the data boundary before passing the value to the component."]]);
+/**
+* Pre-conversion screening. Inspects the root `_zod.def.type` tag for
+* known-problematic types that either silently misrender (handled via
+* {@link PRECONVERSION_UNREPRESENTABLE_TAGS}, raising a
+* `SchemaNormalisationError`) or render correctly but with consumer-visible
+* caveats (codecs, raising a `zod-codec-output-only` diagnostic).
+*
+* Design choice: `z.never()` is NOT classified here. The Zod processor for
+* `never` already produces `{ not: {} }`, which the walker understands via
+* its `walkBooleanSchema(false)` branch (`walker.ts` boolean-schema
+* handling). Throwing a `zod-type-unrepresentable` for `never` would break
+* the legitimate "this field cannot hold any value" use case that the
+* walker already supports. Documented for posterity so future passes do
+* not "fix" it.
+*/
+function screenPreConversion(input, def, diagnostics) {
+	const tag = def.type;
+	if (typeof tag !== "string") return;
+	const unrepresentableMessage = PRECONVERSION_UNREPRESENTABLE_TAGS.get(tag);
+	if (unrepresentableMessage !== void 0) throw new SchemaNormalisationError(unrepresentableMessage, input, "zod-type-unrepresentable", tag);
+	if (tag === "pipe" && isCodecSchema(input)) emitDiagnostic(diagnostics, {
+		code: "zod-codec-output-only",
+		message: "z.codec(...) was passed at the schema root. Only the OUTPUT side is rendered by schema-components; the input side may differ. If you intend to render the input side instead, restructure the codec so the input type is the rendered shape.",
+		pointer: "",
+		detail: { zodType: "codec" }
+	});
+}
+/**
+* True when `input` is a `z.codec(...)` instance. Detection looks for the
+* `$ZodCodec` entry in `_zod.traits` — the same marker `z.toJSONSchema`'s
+* own `isTransforming` helper uses to distinguish codecs from generic
+* pipes.
+*/
+function isCodecSchema(input) {
+	const zod = getProperty(input, "_zod");
+	if (!isObject(zod)) return false;
+	const traits = zod.traits;
+	if (traits instanceof Set) return traits.has("$ZodCodec");
+	return false;
+}
+/**
 * Escape a string for inclusion in a `RegExp`. Required because Zod
 * messages contain `[`, `]`, `.`, `(`, and `)` characters which have regex
 * meaning. The set covers every character with special meaning in a
@@ -106,14 +226,27 @@ function unrepresentableMessage(typeName, fullMessage) {
 * test suite asserts no two `prefix` values are prefixes of each other —
 * any future rule that breaks the invariant fails the build.
 *
-* Verbatim sources (kept aligned with `tests/zod-error-wording-contract.unit.test.ts`):
-* - zod/src/v4/core/json-schema-processors.ts L104 (bigint), L110 (symbol),
-*   L126 (undefined), L132 (void), L150 (date), L169 (literal-undefined),
-*   L175 (literal-bigint), L204 (NaN), L246 (custom), L252 (function),
-*   L258 (transforms), L264 (map), L270 (set), L521 (dynamic catch).
-* - zod/src/v4/core/to-json-schema.ts L182 (non-representable type fallback),
-*   L225 + L364 (unprocessed schema), L235 (duplicate id), L307 (cycle),
-*   L522 (error converting).
+* Verbatim sources (kept aligned with `tests/zod-error-wording-contract.unit.test.ts`).
+* Source files are referenced by message-content anchors rather than line
+* numbers — line numbers drift across Zod patch releases but the message
+* strings themselves are stable and protected by the contract test suite:
+*
+* - `zod/src/v4/core/json-schema-processors.ts` — emits `BigInt cannot be
+*   represented`, `Symbols cannot be represented`, `Undefined cannot be
+*   represented`, `Void cannot be represented`, `Date cannot be
+*   represented`, `Literal \`undefined\` cannot be represented`,
+*   `BigInt literals cannot be represented`, `NaN cannot be represented`,
+*   `Custom types cannot be represented`, `Function types cannot be
+*   represented`, `Transforms cannot be represented`, `Map cannot be
+*   represented`, `Set cannot be represented`, `Dynamic catch values are
+*   not supported`.
+* - `zod/src/v4/core/to-json-schema.ts` — emits `[toJSONSchema]:
+*   Non-representable type encountered: ${def.type}` (the catch-all
+*   fallback), `Unprocessed schema. This is a bug in Zod.` (the
+*   internal-bug branch), `Duplicate schema id "${id}" detected during
+*   JSON Schema conversion.` (the duplicate-id branch), `Cycle detected:
+*   ` (the cycle-throw branch), and `Error converting schema to JSON.`
+*   (the Standard Schema boundary wrapper).
 */
 const CLASSIFIER_RULES = [
 	{
@@ -212,7 +345,7 @@ const CLASSIFIER_RULES = [
 		prefix: "Cycle detected: ",
 		kind: "zod-cycle-detected",
 		build: (match, cause, schema, full) => {
-			return new SchemaNormalisationError(`Zod detected a cycle in the schema graph at ${(match[1] ?? "").split(/\s+/)[0] ?? ""}. Cycles can only be converted when z.toJSONSchema is called with { cycles: "ref" } — schema-components calls it without options for cache safety, so the cycle surfaces as an error. Restructure the schema to break the cycle, or use a $ref-based definition. Original message: ${full}`, schema, "zod-cycle-detected", void 0, cause);
+			return new SchemaNormalisationError(`Zod detected a cycle in the schema graph at ${(match[1] ?? "").split(/\s+/)[0] ?? ""}. schema-components calls z.toJSONSchema with { cycles: "ref" } so legitimate cyclic graphs convert to $ref pairs; this error surfaces only when Zod is unable to break the cycle even under the "ref" policy. Restructure the schema to break the cycle, or use an explicit $ref-based definition. Original message: ${full}`, schema, "zod-cycle-detected", void 0, cause);
 		}
 	},
 	{
@@ -244,33 +377,57 @@ const COMPILED_CLASSIFIER_RULES = CLASSIFIER_RULES.map((rule) => ({
 	pattern: anchored(rule.prefix)
 }));
 /**
-* Walk an arbitrary value looking for Zod 3 markers (`_def.typeName`).
-* Zod 4 schemas always carry a `_zod.def`; Zod 3 schemas carry `_def`
-* with a `typeName` field. Presence of the latter anywhere in the tree
-* means a Zod 3 schema was nested inside a Zod 4 input, which is what
-* trips the V8 `"Cannot read properties of undefined"` failure.
+* Maximum recursion depth for {@link containsNestedZod3}. Reuses the
+* shared {@link MAX_REF_DEPTH} so the runtime walk and the compile-time
+* `DEFAULT_MAX_DEPTH` (type-aliased to the same value) stay in lockstep.
+*/
+/**
+* Walk an arbitrary value looking for Zod 3 markers (`_def` without
+* `_zod`). Zod 4 schemas always carry `_zod.def`; Zod 3 schemas carry
+* `_def` (with or without a `typeName` field — third-party Zod-3-style
+* libraries occasionally omit `typeName`). Presence of `_def` without
+* `_zod` anywhere in the tree means a Zod 3 (or Zod-3-like) schema was
+* nested inside a Zod 4 input, which is what trips the V8
+* `"Cannot read properties of undefined"` failure.
 *
 * Engine-agnostic by construction — the detector inspects schema shape
 * instead of pattern-matching against the runtime's TypeError message,
 * so it works equivalently under V8, JavaScriptCore (Bun/Safari), and
 * SpiderMonkey (Firefox) — none of which agree on the wording.
 *
-* The walk is bounded by an explicit `visited` set so cyclical references
-* cannot cause stack overflow. The recursion follows both array elements
-* and own enumerable properties of every object encountered.
+* Performance shortcuts:
+*
+* - **Targeted descent into Zod 4 nodes.** Once a node is identified as a
+*   Zod 4 schema (`_zod.def` is an object), the only branch that can
+*   carry user-supplied sub-schemas is `_zod.def` itself. Zod's other
+*   internal members (`_zod.traits`, `_zod.parse`, `_zod.bag`, etc.) are
+*   implementation surface and never contain user schemas, so walking
+*   them on every conversion failure is wasted work. Switching to a
+*   targeted descent (only `_zod.def` plus the schema root's `_def`
+*   field) trims the walk dramatically.
+* - **Depth cap.** Recursion is bounded by {@link MAX_REF_DEPTH}
+*   so a pathological schema graph cannot cause stack overflow. The
+*   `visited` set still defends against cyclic references; the depth
+*   cap defends against deep-but-acyclic trees.
 */
 function containsNestedZod3(value, visited) {
+	return containsNestedZod3Inner(value, visited, 0);
+}
+function containsNestedZod3Inner(value, visited, depth) {
+	if (depth >= 64) return false;
 	if (value === null || typeof value !== "object") return false;
 	if (visited.has(value)) return false;
 	visited.add(value);
 	if (Array.isArray(value)) {
-		for (const item of value) if (containsNestedZod3(item, visited)) return true;
+		for (const item of value) if (containsNestedZod3Inner(item, visited, depth + 1)) return true;
 		return false;
 	}
 	if (!isObject(value)) return false;
 	const def = value._def;
-	if (value._zod === void 0 && isObject(def) && typeof def.typeName === "string") return true;
-	for (const key of Object.keys(value)) if (containsNestedZod3(value[key], visited)) return true;
+	const zod = value._zod;
+	if (zod === void 0 && isObject(def)) return true;
+	if (isObject(zod) && isObject(zod.def)) return containsNestedZod3Inner(zod.def, visited, depth + 1);
+	for (const key of Object.keys(value)) if (containsNestedZod3Inner(value[key], visited, depth + 1)) return true;
 	return false;
 }
 function classifyZodConversionError(err, schema) {
@@ -288,7 +445,9 @@ function classifyZodConversionError(err, schema) {
 */
 const __CLASSIFIER_RULES_FOR_TEST = CLASSIFIER_RULES;
 function normaliseSchema(input, ref, options) {
-	if (ref === void 0 && isObject(input)) {
+	const usesDiagnostics = options?.diagnostics !== void 0;
+	const cacheEligible = ref === void 0 && isObject(input) && !usesDiagnostics;
+	if (cacheEligible) {
 		const cached = schemaCache.get(input);
 		if (cached !== void 0) return cached;
 	}
@@ -296,11 +455,12 @@ function normaliseSchema(input, ref, options) {
 	let result;
 	switch (kind) {
 		case "zod4":
-			result = normaliseZod4(input);
+			result = normaliseZod4(input, options?.diagnostics);
 			break;
 		case "zod3":
 			result = normaliseZod3(input);
 			break;
+		case "unsupported-schema-lib": throw new SchemaNormalisationError("Input looks like a schema from a non-Zod library — it exposes `parse` and `safeParse` but carries no Zod 4 (`_zod`) or Zod 3 (`_def`) marker. schema-components requires a Zod 4 schema. Convert the schema with the equivalent Zod 4 builder, or feed schema-components a JSON Schema / OpenAPI document instead. See the Zod 4 contract at https://zod.dev/v4 or run: pnpm add zod@^4", input, "unsupported-schema");
 		case "openapi":
 			if (!isObject(input)) throw new SchemaNormalisationError("Invalid OpenAPI document", input, "openapi-invalid");
 			result = normaliseOpenApi(input, ref, options);
@@ -310,13 +470,15 @@ function normaliseSchema(input, ref, options) {
 			result = normaliseJsonSchema(input, options?.diagnostics);
 			break;
 	}
-	if (ref === void 0 && isObject(input)) schemaCache.set(input, result);
+	if (cacheEligible) schemaCache.set(input, result);
 	return result;
 }
-function normaliseZod4(input) {
+function normaliseZod4(input, diagnostics) {
 	const zod = getProperty(input, "_zod");
-	if (!isObject(zod)) throw new SchemaNormalisationError("Invalid Zod 4 schema: missing _zod property", input, "invalid-zod");
-	if (!("def" in zod)) throw new SchemaNormalisationError("Invalid Zod 4 schema: missing _zod.def", input, "invalid-zod");
+	if (!isObject(zod)) throw new SchemaNormalisationError("Input is not a valid Zod 4 schema: `_zod` is present but is not an object. schema-components expected a Zod 4 schema produced by the `zod` package version 4 or later. See the Zod 4 migration guide at https://zod.dev/v4/migration or run: pnpm add zod@^4", input, "unsupported-schema");
+	const def = getProperty(zod, "def");
+	if (!isObject(def)) throw new SchemaNormalisationError("Input is not a valid Zod 4 schema: `_zod.def` is missing or not an object. schema-components expected a Zod 4 schema produced by the `zod` package version 4 or later. See the Zod 4 migration guide at https://zod.dev/v4/migration or run: pnpm add zod@^4", input, "unsupported-schema");
+	screenPreConversion(input, def, diagnostics);
 	const jsonSchema = callToJsonSchema(input);
 	if (!isObject(jsonSchema)) throw new SchemaNormalisationError("z.toJSONSchema() did not produce an object", input, "invalid-zod");
 	return {
@@ -440,6 +602,23 @@ function resolveOpenApiRef(doc, ref) {
 	}
 	throw new Error(`Unsupported OpenAPI ref format: ${ref}`);
 }
+/**
+* Surface root-level metadata from the JSON Schema into the `rootMeta`
+* shape consumed by the walker. Pulls `readOnly`, `writeOnly`,
+* `description`, `title`, `deprecated`, `examples`, and `default`
+* directly from the schema root.
+*
+* `examples` is forwarded only when present as an array (per JSON Schema
+* Draft 2020-12 — Draft 04's `example` singular is normalised upstream).
+* `default` is forwarded for any value the schema declares (any JSON
+* value, including `null` and `false`); the presence check uses `in`
+* so a literal `false` or `null` default is preserved.
+*
+* `examples` and `default` ride on the `[key: string]: unknown` index
+* signature of {@link SchemaMeta}. They are not declared as named fields
+* on `SchemaMeta` because that type lives in `types.ts` and is shared
+* with the walker; the index signature is the agreed extension point.
+*/
 function extractRootMetaFromJson(jsonSchema) {
 	const meta = {};
 	if (jsonSchema.readOnly === true) meta.readOnly = true;
@@ -447,6 +626,8 @@ function extractRootMetaFromJson(jsonSchema) {
 	if (typeof jsonSchema.description === "string") meta.description = jsonSchema.description;
 	if (typeof jsonSchema.title === "string") meta.title = jsonSchema.title;
 	if (typeof jsonSchema.deprecated === "boolean") meta.deprecated = jsonSchema.deprecated;
+	if (Array.isArray(jsonSchema.examples)) meta.examples = jsonSchema.examples;
+	if ("default" in jsonSchema) meta.default = jsonSchema.default;
 	return Object.keys(meta).length > 0 ? meta : void 0;
 }
 //#endregion

package/dist/core/constraints.d.mts

@@ -1,5 +1,5 @@
-import { D as StringConstraints, f as FileConstraints, t as ArrayConstraints, x as ObjectConstraints, y as NumberConstraints } from "../types-BnxPEElk.mjs";
-import { i as DiagnosticsOptions } from "../diagnostics-CbBPsxSt.mjs";
+import { E as StringConstraints, f as FileConstraints, t as ArrayConstraints, x as ObjectConstraints, y as NumberConstraints } from "../types-BrRMV0en.mjs";
+import { i as DiagnosticsOptions } from "../diagnostics-D0QCYGv0.mjs";
 
 //#region src/core/constraints.d.ts
 declare function extractStringConstraints(schema: Record<string, unknown>, diagnostics?: DiagnosticsOptions, pointer?: string): StringConstraints;

package/dist/core/diagnostics.d.mts

@@ -1,2 +1,2 @@
-import { a as appendPointer, i as DiagnosticsOptions, n as DiagnosticCode, o as emitDiagnostic, r as DiagnosticSink, t as Diagnostic } from "../diagnostics-CbBPsxSt.mjs";
+import { a as appendPointer, i as DiagnosticsOptions, n as DiagnosticCode, o as emitDiagnostic, r as DiagnosticSink, t as Diagnostic } from "../diagnostics-D0QCYGv0.mjs";
 export { Diagnostic, DiagnosticCode, DiagnosticSink, DiagnosticsOptions, appendPointer, emitDiagnostic };

package/dist/core/errors.d.mts

@@ -1,2 +1,2 @@
-import { i as SchemaRenderError, n as SchemaFieldError, r as SchemaNormalisationError, t as SchemaError } from "../errors-QEwOtQAA.mjs";
+import { i as SchemaRenderError, n as SchemaFieldError, r as SchemaNormalisationError, t as SchemaError } from "../errors-DpFwqs5C.mjs";
 export { SchemaError, SchemaFieldError, SchemaNormalisationError, SchemaRenderError };

package/dist/core/fieldOrder.d.mts

@@ -1,4 +1,4 @@
-import { M as WalkedField } from "../types-BnxPEElk.mjs";
+import { j as WalkedField } from "../types-BrRMV0en.mjs";
 
 //#region src/core/fieldOrder.d.ts
 /**

package/dist/core/formats.d.mts

@@ -1,4 +1,4 @@
-import { i as DiagnosticsOptions } from "../diagnostics-CbBPsxSt.mjs";
+import { i as DiagnosticsOptions } from "../diagnostics-D0QCYGv0.mjs";
 
 //#region src/core/formats.d.ts
 /**
@@ -16,6 +16,27 @@ type FormatValidator = RegExp | ((value: string) => boolean);
 /**
  * Recognised JSON Schema formats with their validation patterns.
  * Unknown formats emit an `unknown-format` diagnostic and skip derivation.
+ *
+ * Draft origin reference — formats first standardised by each draft:
+ *
+ * - Draft 04: `date-time`, `email`, `hostname`, `ipv4`, `ipv6`, `uri`
+ * - Draft 06: `uri-reference`, `uri-template`, `json-pointer`
+ * - Draft 07: `date`, `time`, `idn-email`, `idn-hostname`, `iri`,
+ *   `iri-reference`, `regex`, `relative-json-pointer`
+ * - Draft 2019-09: `duration`, `uuid`
+ * - Vocabulary extensions / non-standard: `binary` (OpenAPI), and the
+ *   Zod-emitted formats `cuid`, `cuid2`, `nanoid`, `cidrv4`, `cidrv6`,
+ *   `base64`, `base64url`, `e164`, `emoji`, `ulid`, `xid`, `ksuid`,
+ *   `lowercase`, `uppercase`, `jwt`, `json-string`
+ *
+ * Policy: schema-components accepts ALL formats in ALL drafts. We do
+ * not reject (e.g.) `uri-reference` on a Draft 04 schema or `uuid` on
+ * a Draft 06 schema, even though the spec did not standardise those
+ * names until a later draft. This matches the behaviour of every
+ * mainstream JSON Schema validator (Ajv, jsonschema, etc.) and avoids
+ * spurious failures on legitimate real-world schemas that pre-date or
+ * post-date the dialect they declare. Authors who want strict draft-
+ * locked behaviour should validate with a dedicated meta-schema tool.
  */
 /**
  * Email format pattern, exported as a named const so callers that need a

package/dist/core/formats.mjs

@@ -11,6 +11,27 @@ const MAX_REGEX_PATTERN_LENGTH = 500;
 /**
 * Recognised JSON Schema formats with their validation patterns.
 * Unknown formats emit an `unknown-format` diagnostic and skip derivation.
+*
+* Draft origin reference — formats first standardised by each draft:
+*
+* - Draft 04: `date-time`, `email`, `hostname`, `ipv4`, `ipv6`, `uri`
+* - Draft 06: `uri-reference`, `uri-template`, `json-pointer`
+* - Draft 07: `date`, `time`, `idn-email`, `idn-hostname`, `iri`,
+*   `iri-reference`, `regex`, `relative-json-pointer`
+* - Draft 2019-09: `duration`, `uuid`
+* - Vocabulary extensions / non-standard: `binary` (OpenAPI), and the
+*   Zod-emitted formats `cuid`, `cuid2`, `nanoid`, `cidrv4`, `cidrv6`,
+*   `base64`, `base64url`, `e164`, `emoji`, `ulid`, `xid`, `ksuid`,
+*   `lowercase`, `uppercase`, `jwt`, `json-string`
+*
+* Policy: schema-components accepts ALL formats in ALL drafts. We do
+* not reject (e.g.) `uri-reference` on a Draft 04 schema or `uuid` on
+* a Draft 06 schema, even though the spec did not standardise those
+* names until a later draft. This matches the behaviour of every
+* mainstream JSON Schema validator (Ajv, jsonschema, etc.) and avoids
+* spurious failures on legitimate real-world schemas that pre-date or
+* post-date the dialect they declare. Authors who want strict draft-
+* locked behaviour should validate with a dedicated meta-schema tool.
 */
 /**
 * Email format pattern, exported as a named const so callers that need a

package/dist/core/limits.d.mts

@@ -0,0 +1,2 @@
+import { i as MaxRefDepth, n as MAX_REF_DEPTH, r as MAX_RENDER_DEPTH, t as MAX_PATH_ITEM_REF_HOPS } from "../limits-Cw5QZND8.mjs";
+export { MAX_PATH_ITEM_REF_HOPS, MAX_REF_DEPTH, MAX_RENDER_DEPTH, MaxRefDepth };

package/dist/core/limits.mjs

@@ -0,0 +1,23 @@
+//#region src/core/limits.ts
+/**
+* Shared depth caps and hop counts used to bound recursion across
+* schema-components. All numeric limits live here so the renderer, the
+* ref resolver, the OpenAPI parser, and the type-level inference engine
+* agree on the same constants.
+*/
+/**
+* Maximum recursion depth for the schema walker, the React renderers,
+* the streaming HTML renderer, and the server-side renderer. Beyond
+* this depth a recursion sentinel is emitted instead of further descent
+* — the only safe response to a cyclic walked-field graph.
+*/
+const MAX_RENDER_DEPTH = 10;
+const MAX_REF_DEPTH = 64;
+/**
+* Maximum number of `$ref` hops permitted when walking a chain of
+* OpenAPI Path Item Object references. Beyond this a
+* `path-item-ref-too-deep` diagnostic is emitted and resolution stops.
+*/
+const MAX_PATH_ITEM_REF_HOPS = 8;
+//#endregion
+export { MAX_PATH_ITEM_REF_HOPS, MAX_REF_DEPTH, MAX_RENDER_DEPTH };

package/dist/core/merge.d.mts

@@ -1,4 +1,4 @@
-import { i as DiagnosticsOptions } from "../diagnostics-CbBPsxSt.mjs";
+import { i as DiagnosticsOptions } from "../diagnostics-D0QCYGv0.mjs";
 
 //#region src/core/merge.d.ts
 /**

package/dist/core/normalise.d.mts

@@ -1,5 +1,5 @@
-import { i as DiagnosticsOptions } from "../diagnostics-CbBPsxSt.mjs";
-import { i as OpenApiVersionInfo, r as JsonSchemaDraft } from "../version-D-u7aMfy.mjs";
+import { i as DiagnosticsOptions } from "../diagnostics-D0QCYGv0.mjs";
+import { i as OpenApiVersionInfo, r as JsonSchemaDraft } from "../version-D2jfdX6E.mjs";
 
 //#region src/core/normalise.d.ts
 type NodeTransform = (node: Record<string, unknown>) => Record<string, unknown>;
@@ -20,10 +20,28 @@ declare function deepNormalise(schema: Record<string, unknown>, transform: NodeT
  * Carries the diagnostics sink and the JSON Pointer to the current
  * node so per-node transforms can emit pointer-accurate diagnostics
  * when they translate or reject legacy constructs.
+ *
+ * `documentHasDynamicAnchor` is set once at the entry point by scanning
+ * the input for any `$dynamicAnchor`/`$recursiveAnchor` keyword. Per-
+ * node transforms read it to decide whether a `$dynamicRef`/`$recursiveRef`
+ * rewrite needs a `dynamic-ref-degraded` diagnostic — a ref pointing at
+ * an anchor in the document body cannot be statically resolved without
+ * losing dynamic-scope semantics, while a document with no dynamic
+ * anchors at all has no semantics to lose.
+ *
+ * `documentHasRecursiveAnchor` is the same idea for Draft 2019-09's
+ * `$recursiveAnchor` keyword.
+ *
+ * `declaredDraft` carries the draft the normaliser is operating under
+ * (when known) so per-node transforms can emit `keyword-out-of-draft`
+ * diagnostics for keywords introduced in a later draft.
  */
 interface NodeContext {
   diagnostics: DiagnosticsOptions | undefined;
   pointer: string;
+  documentHasDynamicAnchor: boolean;
+  documentHasRecursiveAnchor: boolean;
+  declaredDraft: JsonSchemaDraft | undefined;
 }
 type NodeTransformWithContext = (node: Record<string, unknown>, ctx: NodeContext) => Record<string, unknown>;
 /**
@@ -58,6 +76,14 @@ declare function deepNormaliseWithContext(schema: Record<string, unknown>, trans
  * {@link deepNormaliseWithContext} to thread diagnostics.
  */
 declare function normaliseDraft04Node(node: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Pick the per-node transform that normalises a single Schema Object to
+ * canonical Draft 2020-12 form for the supplied draft. Exposed so the
+ * OpenAPI 3.1 path can honour a non-default `jsonSchemaDialect`
+ * declaration by routing each Schema Object through the matching
+ * transform without re-implementing the dispatch.
+ */
+declare function selectDraftTransform(draft: JsonSchemaDraft): NodeTransformWithContext;
 /**
  * Normalise a JSON Schema to canonical Draft 2020-12 form.
  * Deep-clones the input — the original is never mutated.
@@ -77,4 +103,4 @@ declare function normaliseJsonSchema(schema: Record<string, unknown>, draft: Jso
  */
 declare function normaliseOpenApiSchemas(doc: Record<string, unknown>, version: OpenApiVersionInfo, diagnostics?: DiagnosticsOptions): Record<string, unknown>;
 //#endregion
-export { NodeContext, NodeTransform, NodeTransformWithContext, deepNormalise, deepNormaliseWithContext, normaliseDraft04Node, normaliseJsonSchema, normaliseOpenApiSchemas };
+export { NodeContext, NodeTransform, NodeTransformWithContext, deepNormalise, deepNormaliseWithContext, normaliseDraft04Node, normaliseJsonSchema, normaliseOpenApiSchemas, selectDraftTransform };

package/dist/core/normalise.mjs

@@ -1,2 +1,2 @@
-import { a as normaliseOpenApiSchemas, i as normaliseJsonSchema, n as deepNormaliseWithContext, r as normaliseDraft04Node, t as deepNormalise } from "../normalise-DaSrnr8g.mjs";
-export { deepNormalise, deepNormaliseWithContext, normaliseDraft04Node, normaliseJsonSchema, normaliseOpenApiSchemas };
+import { a as normaliseOpenApiSchemas, i as normaliseJsonSchema, n as deepNormaliseWithContext, o as selectDraftTransform, r as normaliseDraft04Node, t as deepNormalise } from "../normalise-DVEJQmF7.mjs";
+export { deepNormalise, deepNormaliseWithContext, normaliseDraft04Node, normaliseJsonSchema, normaliseOpenApiSchemas, selectDraftTransform };

package/dist/core/openapi30.mjs

@@ -1,2 +1,2 @@
-import { c as deepNormaliseOpenApi30Doc, d as normaliseOpenApi30Discriminator, f as normaliseOpenApi30Node, l as deepNormaliseOpenApiDoc, s as applyDiscriminatorAllOfPrepass, u as normaliseOpenApi30Combined } from "../normalise-DaSrnr8g.mjs";
+import { c as applyDiscriminatorAllOfPrepass, d as normaliseOpenApi30Combined, f as normaliseOpenApi30Discriminator, l as deepNormaliseOpenApi30Doc, p as normaliseOpenApi30Node, u as deepNormaliseOpenApiDoc } from "../normalise-DVEJQmF7.mjs";
 export { applyDiscriminatorAllOfPrepass, deepNormaliseOpenApi30Doc, deepNormaliseOpenApiDoc, normaliseOpenApi30Combined, normaliseOpenApi30Discriminator, normaliseOpenApi30Node };

package/dist/core/ref.d.mts

@@ -1,2 +1,2 @@
-import { a as findAnchor, i as dereference, n as RefOptions, o as resolveRef, r as countDistinctRefs, t as ExternalResolver } from "../ref-si8ViYun.mjs";
+import { a as findAnchor, i as dereference, n as RefOptions, o as resolveRef, r as countDistinctRefs, t as ExternalResolver } from "../ref-D-_JBZkF.mjs";
 export { ExternalResolver, RefOptions, countDistinctRefs, dereference, findAnchor, resolveRef };

package/dist/core/ref.mjs

@@ -1,4 +1,5 @@
 import { isObject } from "./guards.mjs";
+import "./limits.mjs";
 import { emitDiagnostic } from "./diagnostics.mjs";
 import { isPrototypePollutingKey } from "./uri.mjs";
 //#region src/core/ref.ts

package/dist/core/renderer.d.mts

@@ -1,2 +1,2 @@
-import { a as HtmlRenderProps, c as RenderFunction, d as getHtmlRenderFn, f as getRenderFunction, h as typeToKey, i as HtmlRenderFunction, l as RenderProps, m as mergeResolvers, n as BaseFieldProps, o as HtmlResolver, p as mergeHtmlResolvers, r as ComponentResolver, s as RESOLVER_KEYS, t as AllConstraints, u as buildRenderProps } from "../renderer-DI6ZYf7a.mjs";
+import { a as HtmlRenderProps, c as RenderFunction, d as getHtmlRenderFn, f as getRenderFunction, h as typeToKey, i as HtmlRenderFunction, l as RenderProps, m as mergeResolvers, n as BaseFieldProps, o as HtmlResolver, p as mergeHtmlResolvers, r as ComponentResolver, s as RESOLVER_KEYS, t as AllConstraints, u as buildRenderProps } from "../renderer-BaRlQIuN.mjs";
 export { AllConstraints, BaseFieldProps, ComponentResolver, HtmlRenderFunction, HtmlRenderProps, HtmlResolver, RESOLVER_KEYS, RenderFunction, RenderProps, buildRenderProps, getHtmlRenderFn, getRenderFunction, mergeHtmlResolvers, mergeResolvers, typeToKey };

package/dist/core/renderer.mjs

@@ -43,7 +43,6 @@ const RESOLVER_KEYS = [
 	"discriminatedUnion",
 	"conditional",
 	"negation",
-	"recursive",
 	"literal",
 	"file",
 	"never",
@@ -70,7 +69,6 @@ function typeToKey(type) {
 		case "discriminatedUnion":
 		case "conditional":
 		case "negation":
-		case "recursive":
 		case "literal":
 		case "file":
 		case "never":

package/dist/core/swagger2.d.mts

@@ -1,4 +1,4 @@
-import { i as DiagnosticsOptions } from "../diagnostics-CbBPsxSt.mjs";
+import { i as DiagnosticsOptions } from "../diagnostics-D0QCYGv0.mjs";
 import { NodeTransform } from "./normalise.mjs";
 
 //#region src/core/swagger2.d.ts