12 lines
2.7 KiB
Markdown
12 lines
2.7 KiB
Markdown
# Architecture
|
|
|
|
Schema Tools is a static React/Vite application inside the shared Toolbox shell. `src/schema/model.ts` is the bounded trust boundary: it normalizes workspace names, parses JSON/YAML/XML, inventories language structures and references, performs eligible JSON instance validation, generates samples, and produces conservative comparison signals. React renders only text and native controls; no schema content is inserted as HTML.
|
|
|
|
JSON and YAML values are converted into an acyclic, prototype-safe JSON model with limits on source length, node count, depth, and collection width. JSON Schema instance validation is a CSP-safe interpreter selected for Draft 6, Draft 7, 2019-09, or 2020-12 behavior; it never generates or evaluates code. The focused subset covers boolean schemas, local `$ref` with JSON Pointer fragments, `type`, `enum`, `const`, numeric bounds and `multipleOf`, string lengths, object properties/required/additional properties/property names/dependencies, array items/tuples/contains/uniqueness and size, combiners, negation, and draft-appropriate conditionals. Validation has a 250,000-step and 1,000-diagnostic ceiling.
|
|
|
|
Every reference is classified before validation. Only fragments and relative filenames supplied in the current workspace are eligible. Root `$id`/legacy `id` values are deliberately ignored so relative references remain anchored to workspace filenames; nested identifier scopes, named anchors, dynamic/recursive references, and unevaluated keywords are outside the subset and cause a visible refusal. All participating JSON Schema files must use one declared draft. Formats and unknown extension keywords are annotations. Schemas containing `pattern` or `patternProperties` are refused because JavaScript regular-expression execution cannot be reliably time-bounded; they remain inspectable. Decimal arithmetic uses JavaScript numbers, so `multipleOf` applies a small floating-point tolerance.
|
|
|
|
OpenAPI JSON/YAML receives focused document, operation, response, reference, sample, and comparison logic. It does not run requests and does not claim full OpenAPI conformance. XML uses the browser's inert `DOMParser` only after rejecting DTD and entity declarations. XSD, Relax NG XML syntax, and Schematron are checked for well-formedness and structurally inventoried. Schematron XPath and extensions are retained as text and never executed. XSD and Relax NG sample generation deliberately follows a bounded first branch and is labelled heuristic.
|
|
|
|
The PWA uses only relative URLs, so the same build works standalone or below a nested portal route. Its service worker caches same-origin files from its own scope. No worker, storage database, server API, telemetry path, or remote schema resolver exists in v0.1.0.
|