2.9 KiB
Architecture
Schema Tools is a static React/Vite application inside the shared Toolbox shell. src/schema/model.ts is the bounded trust boundary: it normalizes workspace names, parses JSON/YAML/XML, inventories language structures and references, performs eligible JSON instance validation, generates samples, and produces conservative comparison signals. React renders only text and native controls; no schema content is inserted as HTML.
JSON and YAML values are converted into an acyclic, prototype-safe JSON model with limits on source length, node count, depth, and collection width. JSON Schema instance validation is a CSP-safe interpreter selected for Draft 6, Draft 7, 2019-09, or 2020-12 behavior; it never generates or evaluates code. The focused subset covers boolean schemas, local $ref with JSON Pointer fragments, type, enum, const, numeric bounds and multipleOf, string lengths, object properties/required/additional properties/property names/dependencies, array items/tuples/contains/uniqueness and size, combiners, negation, and draft-appropriate conditionals. Validation has a 250,000-step and 1,000-diagnostic ceiling.
Every reference is classified before validation. Only fragments and relative filenames supplied in the current workspace are eligible. Root $id/legacy id values are deliberately ignored so relative references remain anchored to workspace filenames; nested identifier scopes, named anchors, dynamic/recursive references, and unevaluated keywords are outside the subset and cause a visible refusal. All participating JSON Schema files must use one declared draft. Formats and unknown extension keywords are annotations. Schemas containing pattern or patternProperties are refused because JavaScript regular-expression execution cannot be reliably time-bounded; they remain inspectable. Decimal arithmetic uses JavaScript numbers, so multipleOf applies a small floating-point tolerance.
OpenAPI JSON/YAML receives focused document, operation, response, reference, sample, and comparison logic. It does not run requests and does not claim full OpenAPI conformance. XML uses the browser's inert DOMParser only after rejecting DTD and entity declarations. XSD, Relax NG XML syntax, and Schematron are checked for well-formedness and structurally inventoried. Schematron XPath and extensions are retained as text and never executed. XSD and Relax NG sample generation deliberately follows a bounded first branch and is labelled heuristic. Across languages, sample generation copies literals rather than retaining source objects, caps individual derived values and names, limits aggregate retained text and nodes, and rejects serialized output above 2 MiB.
The PWA uses only relative URLs, so the same build works standalone or below a nested portal route. Its service worker caches same-origin files from its own scope. No worker, storage database, server API, telemetry path, or remote schema resolver exists in v0.1.1.