@burdenoff/microfe-movethewheels 2026.1010.2 → 2026.1011.2

package/dist/pages/TrackingEventQualityPage.js

@@ -0,0 +1,224 @@
+import { RadioTower as e } from "../node_modules/lucide-react/dist/esm/icons/radio-tower.js";
+import { useMoveTheWheels as t } from "../providers/MoveTheWheelsProvider.js";
+import { Button as n } from "../components/ui.js";
+import { PageLayout as r } from "../components/PageLayout.js";
+import { useConditionQuery as i } from "../hooks/useContainerCondition.js";
+import { ReuseState as a, reuseCard as o, reuseSelect as s } from "../components/ReuseControls.js";
+import { TrackingQualityDeliveriesDocument as c, TrackingQualityIntegrationsDocument as l, TrackingQualityShipmentDocument as u } from "../src/generated/tracking-quality-operations.js";
+import { trackingOutcomes as d } from "../hooks/useTrackingEventQuality.js";
+import { useState as f } from "react";
+import { Fragment as p, jsx as m, jsxs as h } from "react/jsx-runtime";
+//#region src/movethewheels/pages/TrackingEventQualityPage.tsx
+var g = 20;
+function _({ offset: e, length: t, busy: r, onChange: i }) {
+	return /* @__PURE__ */ h("div", {
+		className: "flex flex-wrap items-center gap-3",
+		children: [
+			/* @__PURE__ */ m(n, {
+				variant: "outline",
+				disabled: r || e === 0,
+				onClick: () => i(Math.max(0, e - g)),
+				children: "Previous page"
+			}),
+			/* @__PURE__ */ m("span", { children: t === void 0 ? "Page unavailable" : `${t} records on this page` }),
+			/* @__PURE__ */ m(n, {
+				variant: "outline",
+				disabled: r || t !== g || e >= 9980,
+				onClick: () => i(e + g),
+				children: "Next page"
+			})
+		]
+	});
+}
+function v() {
+	let { workspaceId: n, tenantId: i, currentUser: a, apiGatewayUrl: o } = t();
+	return /* @__PURE__ */ m(r, {
+		title: "Tracking event quality",
+		subtitle: "Review delivery results before investigating a shipment.",
+		icon: /* @__PURE__ */ m(e, { "aria-hidden": "true" }),
+		children: /* @__PURE__ */ m(y, {}, `${n}:${i}:${a?.id}:${o}`)
+	});
+}
+function y() {
+	let [e, t] = f(0), [r, u] = f(""), [p, v] = f(0), [y, x] = f(0), [S, C] = f(null), w = i(l, { pagination: {
+		limit: g,
+		offset: e
+	} }, y), T = i(c, r ? {
+		id: r,
+		pagination: {
+			limit: g,
+			offset: p
+		}
+	} : null, y), E = w.data?.integrations, D = T.data?.integration?.events;
+	return /* @__PURE__ */ h("div", {
+		className: "space-y-6",
+		children: [
+			/* @__PURE__ */ m("p", { children: "Matching event keys and payloads create no additional tracking event. A changed payload with the same key is a conflict. Updates without a key can create new events." }),
+			/* @__PURE__ */ m("p", { children: "Each delivery admits at most five updates. An oversized or malformed delivery is rejected before updates are recorded. Delivery history can include older records without item results." }),
+			/* @__PURE__ */ h("section", {
+				className: o,
+				"aria-label": "Integration selection",
+				children: [
+					/* @__PURE__ */ m(a, {
+						loading: w.loading,
+						error: w.error
+					}),
+					E?.length === 0 && /* @__PURE__ */ m("p", { children: "No integrations on this page." }),
+					/* @__PURE__ */ h("label", {
+						className: "block",
+						children: ["Integration", /* @__PURE__ */ h("select", {
+							className: s,
+							value: r,
+							disabled: !E || w.loading,
+							onChange: (e) => {
+								u(e.target.value), v(0), C(null);
+							},
+							children: [/* @__PURE__ */ m("option", {
+								value: "",
+								children: "Choose an integration"
+							}), E?.map((e) => /* @__PURE__ */ h("option", {
+								value: e.id,
+								children: [
+									e.name,
+									" · ",
+									e.provider,
+									" · ",
+									e.status
+								]
+							}, e.id))]
+						})]
+					}),
+					/* @__PURE__ */ m(_, {
+						offset: e,
+						length: E?.length,
+						busy: w.loading,
+						onChange: (e) => {
+							t(e), u(""), v(0), C(null);
+						}
+					})
+				]
+			}),
+			r && /* @__PURE__ */ h("section", {
+				className: "space-y-4 rounded-xl border bg-bg-surface p-5",
+				"aria-label": "Tracking delivery history",
+				children: [
+					/* @__PURE__ */ h("div", {
+						className: "flex flex-wrap items-center justify-between gap-3",
+						children: [/* @__PURE__ */ m("h2", {
+							className: "text-lg font-semibold",
+							children: "Delivery history"
+						}), /* @__PURE__ */ m(n, {
+							variant: "outline",
+							disabled: T.loading,
+							onClick: () => x((e) => e + 1),
+							children: "Refresh results"
+						})]
+					}),
+					/* @__PURE__ */ m(a, {
+						loading: T.loading,
+						error: T.error
+					}),
+					T.data?.integration === null && /* @__PURE__ */ m("p", {
+						role: "status",
+						children: "Integration unavailable in this workspace."
+					}),
+					D?.length === 0 && /* @__PURE__ */ m("p", { children: "No deliveries on this page." }),
+					D?.map((e) => {
+						let t = d(e.outcomes);
+						return /* @__PURE__ */ h("article", {
+							className: "space-y-3 rounded-lg border p-4",
+							children: [/* @__PURE__ */ h("h3", {
+								className: "font-semibold",
+								children: [
+									e.status,
+									" · ",
+									new Date(e.receivedAt).toLocaleString()
+								]
+							}), t === null ? /* @__PURE__ */ m("p", { children: "Per-update results unavailable for this delivery." }) : t.length === 0 ? /* @__PURE__ */ m("p", { children: "No normalized updates were attempted. This is not a count of raw sender items." }) : /* @__PURE__ */ m("ol", {
+								className: "space-y-3",
+								children: t.map((e) => /* @__PURE__ */ h("li", {
+									className: "break-words rounded-md bg-bg-surface p-3",
+									children: [
+										/* @__PURE__ */ h("p", { children: [
+											"Update ",
+											e.index + 1,
+											": ",
+											/* @__PURE__ */ m("strong", { children: e.status })
+										] }),
+										/* @__PURE__ */ h("p", { children: ["Event key: ", e.externalEventId ?? "Missing — not deduplicated"] }),
+										/* @__PURE__ */ h("p", { children: ["Shipment reference: ", e.shipmentReference || "Not recorded"] }),
+										e.errorCode && /* @__PURE__ */ h("p", { children: ["Reason: ", e.errorCode.replaceAll("_", " ").toLowerCase()] }),
+										(e.status === "ACCEPTED" || e.status === "DUPLICATE") && /* @__PURE__ */ h("p", { children: [
+											"Status decision:",
+											" ",
+											e.projection?.status === "APPLIED" ? "Applied to the recorded shipment status" : e.projection?.status === "HELD" ? `Held — ${e.projection.heldReason?.replaceAll("_", " ").toLowerCase()}` : "No status decision recorded in this legacy result"
+										] }),
+										e.status === "CONFLICT" && /* @__PURE__ */ m("p", { children: "The earlier receipt stays unchanged; this update adds no event." }),
+										e.shipmentId && /* @__PURE__ */ m(n, {
+											variant: "outline",
+											onClick: () => C(e.shipmentId),
+											children: "View shipment"
+										})
+									]
+								}, e.index))
+							})]
+						}, e.id);
+					}),
+					/* @__PURE__ */ m(_, {
+						offset: p,
+						length: D?.length,
+						busy: T.loading,
+						onChange: v
+					})
+				]
+			}),
+			S && /* @__PURE__ */ m(b, {
+				id: S,
+				onClose: () => C(null)
+			}, S),
+			/* @__PURE__ */ m("p", {
+				className: "text-sm text-text-secondary",
+				children: "These results describe recorded ingestion, not physical shipment truth. The chosen-source clock policy and manual corrections control recorded shipment status. Provider corrections and replay need separate reviewed policies."
+			})
+		]
+	});
+}
+function b({ id: e, onClose: t }) {
+	let r = i(u, { id: e });
+	return /* @__PURE__ */ h("section", {
+		className: o,
+		"aria-label": "Shipment tracking summary",
+		children: [
+			/* @__PURE__ */ m("h2", {
+				className: "text-lg font-semibold",
+				children: "Shipment tracking summary"
+			}),
+			/* @__PURE__ */ m(n, {
+				variant: "outline",
+				onClick: t,
+				children: "Close shipment summary"
+			}),
+			/* @__PURE__ */ m(a, {
+				loading: r.loading,
+				error: r.error
+			}),
+			r.data?.shipment === null && /* @__PURE__ */ m("p", { children: "Shipment unavailable in this workspace." }),
+			r.data?.shipment && /* @__PURE__ */ h(p, { children: [
+				/* @__PURE__ */ h("p", { children: [
+					r.data.shipment.shipmentNumber,
+					" · ",
+					r.data.shipment.status
+				] }),
+				/* @__PURE__ */ h("p", { children: ["Tracking number: ", r.data.shipment.trackingNumber ?? "Not recorded"] }),
+				/* @__PURE__ */ h("p", { children: [r.data.shipment.trackingEvents.length, " tracking events on the first page (up to 20)."] }),
+				/* @__PURE__ */ m("ul", { children: r.data.shipment.trackingEvents.map((e) => /* @__PURE__ */ h("li", { children: [
+					e.eventType,
+					" · ",
+					new Date(e.timestamp).toLocaleString()
+				] }, e.id)) })
+			] })
+		]
+	});
+}
+//#endregion
+export { v as default };

package/dist/src/generated/shipment-status-authority-operations.js

@@ -0,0 +1,86 @@
+import { gql as e } from "@apollo/client";
+//#region src/generated/shipment-status-authority-operations.ts
+var t = e`
+    fragment ShipmentStatusAuthorityFields on MtwShipment {
+  id
+  shipmentNumber
+  status
+  statusRevision
+  statusAuthority
+  statusAuthorityEpoch
+  designatedIntegrationId
+  statusBasisEventId
+  statusBasisSourceTime
+  maxSourceAgeSeconds
+  maxFutureSkewSeconds
+}
+    `, n = e`
+    query StatusAuthorityShipments($filter: ShipmentFilterInput, $pagination: PaginationInput!) {
+  shipments(filter: $filter, pagination: $pagination) {
+    ...ShipmentStatusAuthorityFields
+  }
+}
+    ${t}`, r = e`
+    query StatusAuthorityDetail($id: ID!, $pagination: PaginationInput!, $evidencePagination: PaginationInput!) {
+  shipment(id: $id) {
+    ...ShipmentStatusAuthorityFields
+    trackingEvents(pagination: $evidencePagination) {
+      id
+      eventType
+      sourceIntegrationId
+      sourceTimestampProvenance
+      providerEventTime
+      serverReceivedAt
+      timestamp
+    }
+  }
+  shipmentStatusDecisions(shipmentId: $id, pagination: $pagination) {
+    id
+    origin
+    outcome
+    heldReason
+    observedRevision
+    resultRevision
+    priorStatus
+    resultStatus
+    trackingEventId
+    proofId
+    reason
+    recordedAt
+    configuredIntegrationId
+    configuredMaxSourceAgeSeconds
+    configuredMaxFutureSkewSeconds
+  }
+}
+    ${t}`, i = e`
+    query StatusAuthoritySources($pagination: PaginationInput!) {
+  integrations(pagination: $pagination) {
+    id
+    name
+    provider
+    status
+  }
+}
+    `, a = e`
+    mutation StatusAuthorityConfigure($id: ID!, $input: ConfigureShipmentStatusSourceInput!) {
+  configureShipmentStatusSource(id: $id, input: $input) {
+    ...ShipmentStatusAuthorityFields
+  }
+}
+    ${t}`, o = e`
+    mutation StatusAuthorityManual($id: ID!, $input: UpdateShipmentInput!) {
+  updateShipment(id: $id, input: $input) {
+    ...ShipmentStatusAuthorityFields
+  }
+}
+    ${t}`, s = e`
+    query StatusAuthorityOwnedDelivery($deliveryJobId: ID!) {
+  myEpodShipmentStatus(deliveryJobId: $deliveryJobId) {
+    id
+    status
+    statusRevision
+  }
+}
+    `;
+//#endregion
+export { a as StatusAuthorityConfigureDocument, r as StatusAuthorityDetailDocument, o as StatusAuthorityManualDocument, s as StatusAuthorityOwnedDeliveryDocument, n as StatusAuthorityShipmentsDocument, i as StatusAuthoritySourcesDocument };

package/dist/src/generated/tracking-quality-operations.js

@@ -0,0 +1,44 @@
+import { gql as e } from "@apollo/client";
+//#region src/generated/tracking-quality-operations.ts
+var t = e`
+    query TrackingQualityIntegrations($pagination: PaginationInput!) {
+  integrations(pagination: $pagination) {
+    id
+    name
+    provider
+    status
+  }
+}
+    `, n = e`
+    query TrackingQualityDeliveries($id: ID!, $pagination: PaginationInput!) {
+  integration(id: $id) {
+    id
+    name
+    provider
+    status
+    events(pagination: $pagination) {
+      id
+      status
+      receivedAt
+      processedAt
+      outcomes
+    }
+  }
+}
+    `, r = e`
+    query TrackingQualityShipment($id: ID!) {
+  shipment(id: $id) {
+    id
+    shipmentNumber
+    status
+    trackingNumber
+    trackingEvents(pagination: {limit: 20, offset: 0}) {
+      id
+      eventType
+      timestamp
+    }
+  }
+}
+    `;
+//#endregion
+export { n as TrackingQualityDeliveriesDocument, t as TrackingQualityIntegrationsDocument, r as TrackingQualityShipmentDocument };

package/dist/utils/shipmentStatusDraft.js

@@ -0,0 +1,41 @@
+//#region src/movethewheels/utils/shipmentStatusDraft.ts
+function e(e) {
+	let t = e.trim();
+	if (!t || t.length > 1e3) throw Error("Enter a reason of 1–1000 characters.");
+	return t;
+}
+function t(e, t, n, r) {
+	if (!/^\d+$/.test(e.trim())) throw Error(`${r} must be an explicit whole number of seconds.`);
+	let i = Number(e.trim());
+	if (!Number.isSafeInteger(i) || i < t || i > n) throw Error(`${r} must be between ${t} and ${n} seconds.`);
+	return i;
+}
+function n(n, r) {
+	if (!n.integrationId || !n.basisTrackingEventId) throw Error("Choose one integration and one recorded basis event.");
+	return {
+		expectedStatusRevision: r,
+		integrationId: n.integrationId,
+		basisTrackingEventId: n.basisTrackingEventId,
+		maxSourceAgeSeconds: t(n.maxSourceAgeSeconds, 1, 2592e3, "Maximum source age"),
+		maxFutureSkewSeconds: t(n.maxFutureSkewSeconds, 0, 86400, "Allowed future skew"),
+		reason: e(n.reason)
+	};
+}
+function r(e, t) {
+	let n = {
+		PICKED_UP: "PICKED_UP",
+		IN_TRANSIT: "IN_TRANSIT",
+		ARRIVED: "IN_TRANSIT",
+		DEPARTED: "IN_TRANSIT",
+		OUT_FOR_DELIVERY: "IN_TRANSIT",
+		DELIVERED: "DELIVERED",
+		FAILED: "FAILED",
+		RETURNED: "RETURNED"
+	}, r = t.basis, i = r?.providerEventTime ? Date.parse(r.providerEventTime) : NaN;
+	return !!e && !!r && Number.isFinite(i) && e.id === t.id && e.statusRevision === t.input.expectedStatusRevision + 1 && e.statusAuthority === "INTEGRATION_EVENT_TIME" && e.statusAuthorityEpoch === t.epoch + 1 && e.designatedIntegrationId === t.input.integrationId && e.statusBasisEventId === r.id && r.id === t.input.basisTrackingEventId && typeof e.statusBasisSourceTime == "string" && Date.parse(e.statusBasisSourceTime) === i && e.maxSourceAgeSeconds === t.input.maxSourceAgeSeconds && e.maxFutureSkewSeconds === t.input.maxFutureSkewSeconds && typeof n[r.eventType] == "string" && e.status === n[r.eventType];
+}
+function i(e, t) {
+	return !!e && e.id === t.id && e.statusRevision === t.revision + 1 && e.status === t.status && e.statusAuthority === "MANUAL_HOLD" && e.statusAuthorityEpoch === t.epoch + 1 && e.designatedIntegrationId === null && e.statusBasisEventId === null && e.statusBasisSourceTime === null && e.maxSourceAgeSeconds === null && e.maxFutureSkewSeconds === null;
+}
+//#endregion
+export { i as manualStatusAcknowledged, n as shipmentSourceInput, r as sourceStatusAcknowledged, e as statusDecisionReason };

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@burdenoff/microfe-movethewheels",
-  "version": "2026.1010.2",
+  "version": "2026.1011.2",
   "description": "Burdenoff MoveTheWheels Microfrontend - Logistics & Supply Chain Management Platform",
   "type": "module",
   "files": [
     "src",
     "dist",
-    "package.json"
+    "package.json",
+    "patches"
   ],
   "imports": {
     "#src/*": "./src/*",
@@ -34,7 +35,7 @@
     "format": "prettier --write \"src/**/*.{ts,tsx}\"",
     "type:check": "bash scripts/build-limits.sh tsc --noEmit",
     "validate:schema-drift": "graphql-schema-drift",
-    "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run codegen && bun run validate:schema-drift && bun run lint:sanity && bun run format && bun run type:check && bun run verify:live-logistics-contract && bun run verify:empty-reuse-retry && bun run verify:empty-reuse-recovery && bun run verify:trip-utilization-input && bun run verify:trip-draft-context && bun run verify:stock-binding-input && bun run verify:stock-observation-input && bun run verify:pending-pick-input && bun run verify:freight-input && bun run verify:freight-recovery && bun run verify:procedure-input && bun run verify:consolidation && bun run verify:multimodal-single-attempt && bun run build && bun run build-storybook'",
+    "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run codegen && bun run validate:schema-drift && bun run lint:sanity && bun run format && bun run type:check && bun run verify:live-logistics-contract && bun run verify:empty-reuse-retry && bun run verify:empty-reuse-recovery && bun run verify:trip-utilization-input && bun run verify:trip-draft-context && bun run verify:stock-binding-input && bun run verify:stock-observation-input && bun run verify:pending-pick-input && bun run verify:freight-input && bun run verify:freight-recovery && bun run verify:procedure-input && bun run verify:consolidation && bun run verify:multimodal-single-attempt && bun run verify:tracking-quality-outcomes && bun run verify:shipment-status-authority && bun run verify:braces-depth && bun run build && bun run build-storybook'",
     "storybook": "storybook dev -p 6006",
     "build-storybook": "storybook build",
     "test:storybook": "test-storybook",
@@ -42,7 +43,7 @@
     "schema:pull:introspect": "bash scripts/schema-pull.sh --mode introspect",
     "schema:check": "bash scripts/schema-pull.sh --check",
     "verify:stock-binding-input": "bun scripts/verify-stock-binding-input.mjs",
-    "codegen": "graphql-codegen --project wspace && graphql-codegen --project container-foundation && graphql-codegen --project container-condition && graphql-codegen --project free-time && graphql-codegen --project empty-reuse && graphql-codegen --project trip-utilization && graphql-codegen --project stock-binding && graphql-codegen --project stock-observation && graphql-codegen --project pending-pick && graphql-codegen --project freight-cost && graphql-codegen --project logistics-procedure && graphql-codegen --project consolidation",
+    "codegen": "graphql-codegen --project wspace && graphql-codegen --project container-foundation && graphql-codegen --project container-condition && graphql-codegen --project free-time && graphql-codegen --project empty-reuse && graphql-codegen --project trip-utilization && graphql-codegen --project stock-binding && graphql-codegen --project stock-observation && graphql-codegen --project pending-pick && graphql-codegen --project freight-cost && graphql-codegen --project logistics-procedure && graphql-codegen --project consolidation && graphql-codegen --project tracking-quality && graphql-codegen --project shipment-status-authority",
     "codegen:all": "bun run schema:pull && bun run codegen",
     "switch:status": "bun scripts/deps-mode.ts status",
     "switch:remote": "bun scripts/deps-mode.ts remote",
@@ -59,7 +60,10 @@
     "verify:freight-input": "bun scripts/verify-freight-input.mjs",
     "verify:freight-recovery": "bun scripts/verify-freight-recovery-hook.mjs",
     "verify:procedure-input": "bun scripts/verify-procedure-input.mjs && bun scripts/verify-procedure-recovery-hook.mjs",
-    "verify:consolidation": "bun scripts/verify-consolidation-input.mjs && bun scripts/verify-consolidation-recovery-hook.mjs && bun scripts/verify-consolidation-mounted-hook.mjs"
+    "verify:consolidation": "bun scripts/verify-consolidation-input.mjs && bun scripts/verify-consolidation-recovery-hook.mjs && bun scripts/verify-consolidation-mounted-hook.mjs",
+    "verify:tracking-quality-outcomes": "bun test scripts/verify-tracking-quality-outcomes.test.ts",
+    "verify:braces-depth": "bun test scripts/braces-depth-patch.test.ts",
+    "verify:shipment-status-authority": "bun scripts/verify-shipment-status-command.mjs"
   },
   "dependencies": {
     "@apollo/client": "^4.0.11",
@@ -114,7 +118,8 @@
     "typescript": "^5.9.0",
     "typescript-eslint": "^8.54.0",
     "vite": "8.0.16",
-    "vite-plugin-dts": "3.9.1"
+    "vite-plugin-dts": "3.9.1",
+    "braces": "3.0.3"
   },
   "peerDependencies": {
     "@apollo/client": "^4.0.11",
@@ -140,6 +145,10 @@
     "yaml": ">=2.8.3",
     "picomatch": ">=2.3.2",
     "immutable": ">=3.8.3",
-    "minimatch": ">=3.1.3"
+    "minimatch": ">=3.1.3",
+    "@graphql-tools/utils": "12.0.3"
+  },
+  "patchedDependencies": {
+    "braces@3.0.3": "patches/braces@3.0.3.patch"
   }
 }

package/patches/README.md

@@ -0,0 +1,25 @@
+# Reviewed build dependency mitigation
+
+BOFF-9129 tracks the MoveTheWheels build dependency fixes. The canonical frozen
+Bun installation applies `braces@3.0.3.patch` using `patchedDependencies`.
+
+The upstream advisory [GHSA-vfj7-8cjw-p6xm](https://github.com/advisories/GHSA-vfj7-8cjw-p6xm)
+currently lists no fixed release. This local patch adds iterative validation before
+recursive parse cleanup, compile, stringify and expand processing: nesting is bounded
+to 128 and AST visits to 65,536, with malformed child and parent cycles rejected.
+It preserves the tested ordinary escaped, quoted, range and nested glob patterns.
+
+The version remains 3.0.3. Version-based dependency audits still report this HIGH
+advisory; that result must remain visible with the pinned patch and regression evidence.
+This is a reviewed nesting mitigation, not an upstream fixed-version or clean-audit claim.
+It does not establish general limits on Cartesian expansion or every resource-exhaustion
+pattern. npm installations do not apply Bun patches and must not claim this mitigation.
+
+`bun run verify:braces-depth` exercises deeply nested balanced/unbalanced brace and
+parenthesis strings, direct deep/cyclic/oversized ASTs and ordinary pattern semantics.
+Normal `bun run sanity` includes those checks. The exact patch is shared with the
+workspace public gateway (BOFF-9127); independent review covers its installed source.
+
+The separate `@graphql-tools/utils` override uses published version 12.0.1 to remove
+GHSA-7mx3-vvmw-hjmv from the actual Bun audit. Other inherited moderate findings remain
+tracked under BOFF-8590. Keep all limitations attached to release evidence.

package/patches/braces@3.0.3.patch

@@ -0,0 +1,87 @@
+diff --git a/lib/compile.js b/lib/compile.js
+--- a/lib/compile.js
++++ b/lib/compile.js
+@@ -1,0 +2,2 @@
++
++const validateAst = require('./validate-ast');
+@@ -6,0 +9 @@
++  validateAst(ast);
+diff --git a/lib/expand.js b/lib/expand.js
+--- a/lib/expand.js
++++ b/lib/expand.js
+@@ -1,0 +2,2 @@
++
++const validateAst = require('./validate-ast');
+@@ -33,0 +36 @@
++  validateAst(ast);
+diff --git a/lib/parse.js b/lib/parse.js
+--- a/lib/parse.js
++++ b/lib/parse.js
+@@ -1,0 +2,2 @@
++
++const validateAst = require('./validate-ast');
+@@ -146,0 +149 @@
++      if (stack.length >= 128) throw new RangeError('Braces nesting limit exceeded');
+@@ -212,0 +216 @@
++      if (stack.length >= 128) throw new RangeError('Braces nesting limit exceeded');
+@@ -327,0 +332 @@
++  validateAst(ast);
+diff --git a/lib/stringify.js b/lib/stringify.js
+--- a/lib/stringify.js
++++ b/lib/stringify.js
+@@ -1,0 +2,2 @@
++
++const validateAst = require('./validate-ast');
+@@ -5,0 +8 @@
++  validateAst(ast);
+diff --git a/lib/validate-ast.js b/lib/validate-ast.js
+new file mode 100644
+--- /dev/null
++++ b/lib/validate-ast.js
+@@ -0,0 +1,46 @@
++'use strict';
++
++// Local mitigation for GHSA-vfj7-8cjw-p6xm. Validate iteratively before any
++// recursive AST processing. Parent/prev links are metadata, not child edges.
++const MAX_DEPTH = 128;
++const MAX_NODES = 65536;
++
++module.exports = ast => {
++  const pending = [{ node: ast, depth: 0, exit: false }];
++  const active = new WeakSet();
++  let visits = 0;
++  while (pending.length > 0) {
++    const item = pending.pop();
++    const node = item.node;
++    if (item.exit) {
++      active.delete(node);
++      continue;
++    }
++    if (node === null || typeof node !== 'object') throw new TypeError('Invalid braces AST');
++    if (++visits > MAX_NODES) throw new RangeError('Braces AST node limit exceeded');
++    if (item.depth > MAX_DEPTH) throw new RangeError('Braces nesting limit exceeded');
++    if (active.has(node)) throw new RangeError('Cyclic braces AST');
++    // expand() also follows parent links. Reject malformed parent chains before
++    // its loop can hang; normal parser parents lead to the root.
++    let parent = node.parent;
++    const parents = new WeakSet();
++    let parentDepth = 0;
++    while (parent) {
++      if (typeof parent !== 'object' || parents.has(parent) || ++parentDepth > MAX_DEPTH) {
++        throw new RangeError('Invalid braces AST parent chain');
++      }
++      parents.add(parent);
++      parent = parent.parent;
++    }
++    if (node.nodes !== undefined) {
++      if (!Array.isArray(node.nodes)) throw new TypeError('Invalid braces AST children');
++      if (node.nodes.length > MAX_NODES - visits) throw new RangeError('Braces AST node limit exceeded');
++      active.add(node);
++      pending.push({ node, depth: item.depth, exit: true });
++      for (let index = node.nodes.length - 1; index >= 0; index--) {
++        pending.push({ node: node.nodes[index], depth: item.depth + 1, exit: false });
++      }
++      if (pending.length > 2 * MAX_NODES) throw new RangeError('Braces AST node limit exceeded');
++    }
++  }
++};