@aiwg/cli 2026.9.17 → 2026.9.18

package/dist/src/dataset/adapters.d.ts

@@ -45,7 +45,7 @@ declare abstract class LineAdapter<T extends FileConfig> extends LocalAdapter<T>
     protected lineDiscovery(kind: string, config: T, request: AdapterRequest<T>, schema: Record<string, unknown>): Promise<AdapterDiscovery>;
     protected lines(config: T, request: AdapterRequest<T> & {
         checkpoint?: AdapterCheckpoint;
-    }, parse: (line: string, ordinal: number) => unknown): AsyncIterable<AdapterRecord>;
+    }, parse: (line: string, ordinal: number, maxDepth: number) => unknown): AsyncIterable<AdapterRecord>;
 }
 export declare class JsonlAdapter extends LineAdapter<FileConfig> {
     #private;

package/dist/src/dataset/adapters.js

@@ -108,6 +108,21 @@ function record(value, ordinal, sourceLocator) {
     const serialized = typeof value === 'string' ? value : JSON.stringify(value);
     return { logicalId: `sha256:${sha256Digest(`${sourceLocator}\0${ordinal}\0${serialized}`).value}`, ordinal, value, sourceLocator, contentDigest: sha256Digest(serialized) };
 }
+function valueDepth(value) {
+    let maximum = 0;
+    const pending = [{ value, depth: 0 }];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current.value === null || typeof current.value !== 'object')
+            continue;
+        const depth = current.depth + 1;
+        maximum = Math.max(maximum, depth);
+        const children = Array.isArray(current.value) ? current.value : Object.values(current.value);
+        for (const child of children)
+            pending.push({ value: child, depth });
+    }
+    return maximum;
+}
 function checkpoint(manifestValue, sourceIdentity, cursor) {
     return {
         contractVersion: DATASET_ADAPTER_CONTRACT_VERSION, kind: 'AdapterCheckpoint', adapter: { id: manifestValue.id, version: manifestValue.version },
@@ -227,7 +242,7 @@ class LineAdapter extends LocalAdapter {
                 if (Buffer.byteLength(line) > limits.maxRecordBytes || ordinal >= limits.maxRecords)
                     throw new AdapterFailure(diagnostic(operation, 'ADAPTER_RESOURCE_LIMIT', 'The record or record count exceeds configured limits.'));
                 if (line.trim() !== '')
-                    yield record(parse(line, ordinal), ordinal, config.path);
+                    yield record(parse(line, ordinal, limits.maxDepth), ordinal, config.path);
                 ordinal += 1;
             }
         }
@@ -243,12 +258,19 @@ export class JsonlAdapter extends LineAdapter {
     valid(value) { return isFileConfig(value); }
     discoverPath(config, request) { return this.lineDiscovery('jsonl', config, request, {}); }
     records(config, request) {
-        return this.lines(config, request, (line, ordinal) => { try {
-            return JSON.parse(line);
-        }
-        catch {
-            throw new AdapterFailure(diagnostic(request.checkpoint ? 'read' : 'preview', 'ADAPTER_SCHEMA_DRIFT', `Malformed JSONL record at ordinal ${ordinal}.`));
-        } });
+        return this.lines(config, request, (line, ordinal, maxDepth) => {
+            try {
+                const value = JSON.parse(line);
+                if (valueDepth(value) > maxDepth)
+                    throw new AdapterFailure(diagnostic(request.checkpoint ? 'read' : 'preview', 'ADAPTER_RESOURCE_LIMIT', `JSONL record at ordinal ${ordinal} exceeds the configured nesting limit.`));
+                return value;
+            }
+            catch (error) {
+                if (error instanceof AdapterFailure)
+                    throw error;
+                throw new AdapterFailure(diagnostic(request.checkpoint ? 'read' : 'preview', 'ADAPTER_SCHEMA_DRIFT', `Malformed JSONL record at ordinal ${ordinal}.`));
+            }
+        });
     }
 }
 function parseCsvLine(line) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.9.17",
+  "version": "2026.9.18",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",