@c9up/rune 0.1.10 → 0.1.12

package/dist/native/generated.d.ts

@@ -0,0 +1,3 @@
+/** Validate data against a schema (JSON string). */
+export declare function validate(requestJson: string): string;
+//# sourceMappingURL=generated.d.ts.map

package/dist/native/generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../src/native/generated.ts"],"names":[],"mappings":"AAMA,oDAAoD;AAEpD,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC"}

package/dist/native/generated.js

@@ -0,0 +1,7 @@
+// GENERATED FROM THE RUST — do not edit.
+//
+// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def
+// output. Editing this file by hand puts it back where it started: a
+// description that can disagree with the code it describes.
+export {};
+//# sourceMappingURL=generated.js.map

package/dist/native/generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.js","sourceRoot":"","sources":["../../src/native/generated.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,0EAA0E;AAC1E,qEAAqE;AACrE,4DAA4D"}

package/dist/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8BH;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAaA;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAaD,sEAAsE;AACtE,qBAAa,uBAAwB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;;CAQ9C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAuCH;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG;IACpD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAaA;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAaD,sEAAsE;AACtE,qBAAa,uBAAwB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;;CAQ9C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dist/native.js.map

@@ -1 +1 @@
-{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3D,MAAM,WAAW,GAA2B;IAC3C,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,YAAY;IAC1B,cAAc,EAAE,cAAc;IAC9B,WAAW,EAAE,gBAAgB;CAC7B,CAAC;AAEF,IAAI,MAA0D,CAAC;AAC/D,IAAI,SAAkB,CAAC;AAEvB,IAAI,CAAC;IACJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,MAAM,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;AACF,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IACZ,SAAS,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAKjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,+DAA+D,SAAS,IAAI,kBAAkB,EAAE,CAChG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACd,uEAAuE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAC/F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,MAAM,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,mBAAmB,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;IACjG,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,SAAS;QACvC,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,0BAA0B,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,sEAAsE;AACtE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACxC,IAAI,GAAG,oBAA6B,CAAC;IAC9C;QACC,KAAK,CACJ,gFAAgF,iBAAiB,EAAE,KAAK;YACvG,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACvC,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3D,MAAM,WAAW,GAA2B;IAC3C,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,YAAY;IAC1B,cAAc,EAAE,cAAc;IAC9B,WAAW,EAAE,gBAAgB;CAC7B,CAAC;AAWF,IAAI,MAA8B,CAAC;AACnC,IAAI,SAAkB,CAAC;AAEvB,IAAI,CAAC;IACJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,MAAM,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;AACF,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IACZ,SAAS,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAKjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACd,+DAA+D,SAAS,IAAI,kBAAkB,EAAE,CAChG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACd,uEAAuE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAC/F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,OAAO,MAAM,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,mBAAmB,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;IACjG,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC,KAAK,SAAS;QACvC,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,0BAA0B,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,sEAAsE;AACtE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACxC,IAAI,GAAG,oBAA6B,CAAC;IAC9C;QACC,KAAK,CACJ,gFAAgF,iBAAiB,EAAE,KAAK;YACvG,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACvC,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;AAC/D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/rune",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Rune — Validation engine for the Ream framework",
   "license": "MIT",
   "type": "module",
@@ -48,7 +48,8 @@
     "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsc -p tsconfig.build.json",
     "build:rust": "cargo build --release -p rune-engine-napi",
-    "build:napi": "pnpm build:rust && node scripts/copy-napi.mjs",
+    "build:napi": "pnpm build:rust && pnpm build:napi-types && node scripts/copy-napi.mjs",
+    "build:napi-types": "node scripts/build-napi-types.mjs",
     "test": "vitest run",
     "test:rust": "cargo test -p rune-engine",
     "lint": "biome check src/",

package/scripts/build-napi-types.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+/**
+ * Regenerate `src/native/generated.ts` from the Rust.
+ *
+ * Node rather than a shell script because this runs inside `build:napi`, and
+ * that runs on the Windows prebuild runner too: a bash `mktemp` there hands
+ * cargo a `/tmp/...` path the native proc-macro cannot write to, so the
+ * type-def file comes back empty and the build fails for no visible reason.
+ *
+ * One crate at a time on purpose: napi-derive APPENDS to `TYPE_DEF_TMP_PATH`
+ * while cargo compiles, and a parallel build interleaves the writes —
+ * definitions go missing, silently, and the generated file comes out short.
+ */
+
+import { execFileSync } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const CRATES = ['rune-engine-napi']
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..')
+const output = join('src', 'native', 'generated.ts')
+const scratch = mkdtempSync(join(tmpdir(), 'napi-types-'))
+
+try {
+  const lines = []
+  for (const crate of CRATES) {
+    const perCrate = join(scratch, `${crate}.jsonl`)
+    writeFileSync(perCrate, '')
+    execFileSync('cargo', ['build', '-p', crate], {
+      cwd: packageRoot,
+      env: { ...process.env, TYPE_DEF_TMP_PATH: perCrate },
+      stdio: ['ignore', 'ignore', 'inherit'],
+    })
+    const emitted = readFileSync(perCrate, 'utf8').split('\n').filter(Boolean)
+    if (emitted.length === 0) {
+      throw new Error(
+        `[napi-types] ${crate} emitted nothing — is napi-derive's "type-def" feature on?`,
+      )
+    }
+    lines.push(...emitted)
+  }
+
+  const combined = join(scratch, 'combined.jsonl')
+  writeFileSync(combined, `${lines.join('\n')}\n`)
+
+  execFileSync(
+    process.execPath,
+    [join('scripts', 'generate-napi-types.mjs'), combined, output],
+    { cwd: packageRoot, stdio: 'inherit' },
+  )
+
+  // Formatted here rather than excluded from the linter: the file is checked
+  // in, so it should read like the rest of the tree — and formatting it at
+  // generation means it never shows up as a diff someone has to fix by hand.
+  // Resolved through the package entry rather than `node_modules/.bin`, whose
+  // shim is a shell script the Windows runner cannot execute directly.
+  const biome = createRequire(import.meta.url).resolve('@biomejs/biome/bin/biome')
+  execFileSync(process.execPath, [biome, 'format', '--write', output], {
+    cwd: packageRoot,
+    stdio: ['ignore', 'ignore', 'inherit'],
+  })
+} finally {
+  rmSync(scratch, { recursive: true, force: true })
+}

package/scripts/generate-napi-types.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+/**
+ * Generate the TypeScript surface of the native module FROM the Rust.
+ *
+ * `napi-derive`'s `type-def` feature emits one JSON line per exported item
+ * while cargo compiles. Those lines are the source of truth: they are derived
+ * from the `#[napi]` items themselves, so a signature cannot drift from the
+ * Rust without this file changing.
+ *
+ * Hand-written interfaces are what this replaces, and they do drift — nothing
+ * on the TypeScript side notices when a `pub fn` gains a parameter or stops
+ * being `async`.
+ *
+ * One thing napi-rs cannot infer: the shape of a `JsFunction` callback. It
+ * emits `(...args: any[]) => any`. Any such parameter is refined below, by
+ * name, and the script fails if a refinement no longer matches anything — so
+ * the table cannot rot either.
+ *
+ *   TYPE_DEF_TMP_PATH=<file> cargo build -p <crate>
+ *   node scripts/generate-napi-types.mjs <file> <out.d.ts>
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs'
+
+/**
+ * Callback signatures napi-rs erases to `any`, restored here.
+ *
+ * Keyed by `<owner>.<method>`; the value replaces the whole parameter. Every
+ * entry must match, or the script fails: a stale refinement is how a hand
+ * annotation quietly stops describing the Rust.
+ *
+ * Empty while this crate exposes no `JsFunction` parameter — add an entry the
+ * day one appears, rather than letting an `any` through.
+ */
+const CALLBACK_REFINEMENTS = {}
+
+const [input, output] = process.argv.slice(2)
+if (!input || !output) {
+  console.error('usage: generate-napi-types.mjs <type-def file> <out.d.ts>')
+  process.exit(2)
+}
+
+const entries = readFileSync(input, 'utf8')
+  .split('\n')
+  .map((l) => l.trim())
+  .filter(Boolean)
+  .map((l) => JSON.parse(l))
+
+const used = new Set()
+
+/** Apply the refinements that belong to `owner`, tracking which ones matched. */
+function refine(owner, body) {
+  let out = body
+  for (const [key, { from, to }] of Object.entries(CALLBACK_REFINEMENTS)) {
+    const [entryOwner] = key.split('.')
+    if (entryOwner !== owner) continue
+    if (out.includes(from)) {
+      out = out.replace(from, to)
+      used.add(key)
+    }
+  }
+  return out
+}
+
+/**
+ * JSDoc as emitted by napi-derive, indented to sit above its member.
+ *
+ * `*` followed by `/` inside the text closes the comment early — a Rust doc
+ * example holding a cron expression (`0 *​/5 * * *`) is enough to do it, and
+ * the generated file then fails to parse. Escaped rather than stripped, so the
+ * example still reads correctly.
+ */
+function docBlock(doc, indent = '') {
+  if (!doc) return ''
+  // Escape every `*/` EXCEPT the one that closes the block. A Rust doc example
+  // holding a cron expression (`0 */5 * * *`) closes the comment early
+  // otherwise, and the generated file stops parsing — but escaping the closer
+  // too breaks it just as thoroughly, whether the block spans one line or many.
+  const closer = doc.lastIndexOf('*/')
+  const escaped =
+    closer === -1
+      ? doc
+      : doc.slice(0, closer).replaceAll('*/', '*\\/') + doc.slice(closer)
+  return (
+    escaped
+      .split('\n')
+      .filter((l) => l.length > 0)
+      .map((l) => `${indent}${l}`)
+      .join('\n') + '\n'
+  )
+}
+
+const interfaces = entries.filter((e) => e.kind === 'interface')
+const structs = entries.filter((e) => e.kind === 'struct')
+const impls = new Map(entries.filter((e) => e.kind === 'impl').map((e) => [e.name, e]))
+const fns = entries.filter((e) => e.kind === 'fn')
+
+const out = [
+  '// GENERATED FROM THE RUST — do not edit.',
+  '//',
+  "// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def",
+  '// output. Editing this file by hand puts it back where it started: a',
+  '// description that can disagree with the code it describes.',
+  '',
+]
+
+for (const iface of interfaces) {
+  out.push(docBlock(iface.js_doc))
+  out.push(`export interface ${iface.name} {`)
+  for (const line of iface.def.split('\n')) {
+    out.push(line ? `  ${line.trim()}` : '')
+  }
+  out.push('}', '')
+}
+
+for (const struct of structs) {
+  const impl = impls.get(struct.name)
+  out.push(docBlock(struct.js_doc))
+  out.push(`export declare class ${struct.name} {`)
+  if (impl) {
+    for (const line of refine(struct.name, impl.def).split('\n')) {
+      out.push(line ? `  ${line.trim()}` : '')
+    }
+  }
+  out.push('}', '')
+}
+
+for (const fn of fns) {
+  out.push(docBlock(fn.js_doc))
+  // napi-derive emits the whole declaration for a function, unlike a struct
+  // where `def` holds only the members.
+  const declaration = fn.def.trim()
+  out.push(
+    declaration.startsWith('export declare function')
+      ? `${declaration};`
+      : `export declare function ${fn.name}${declaration};`,
+    '',
+  )
+}
+
+const stale = Object.keys(CALLBACK_REFINEMENTS).filter((k) => !used.has(k))
+if (stale.length > 0) {
+  console.error(
+    `[napi-types] refinement(s) that matched nothing: ${stale.join(', ')}\n` +
+      '[napi-types] the Rust changed under them — update or remove the entry.',
+  )
+  process.exit(1)
+}
+
+writeFileSync(output, out.join('\n'))
+console.log(
+  `[napi-types] ${output} — ${interfaces.length} interface(s), ${structs.length} class(es), ${fns.length} function(s)`,
+)

package/src/Schema.ts

@@ -1850,6 +1850,7 @@ export class RuleChain<Output = unknown> {
 	#nestedSchema: Record<string, RuleChain> | null = null;
 	#arrayItemChain: RuleChain | null = null;
 	#allowUnknown = false;
+	#denyUnknown = false;
 	#metadata: Record<string, unknown> | null = null;
 	/** Extensions / MIME types declared by `file()` / `mimeTypes()`. */
 	#declaredExtnames: readonly string[] | null = null;
@@ -1933,6 +1934,11 @@ export class RuleChain<Output = unknown> {
 	get allowsUnknown(): boolean {
 		return this.#allowUnknown;
 	}
+
+	/** Whether an undeclared key fails the payload rather than being dropped. */
+	get deniesUnknown(): boolean {
+		return this.#denyUnknown;
+	}
 	/** Free-form JSON Schema metadata attached with `meta()`. */
 	get metadata(): Record<string, unknown> | null {
 		return this.#metadata;
@@ -1980,6 +1986,7 @@ export class RuleChain<Output = unknown> {
 		next.#dateFormats = this.#dateFormats;
 		next.#coercions = [...this.#coercions];
 		next.#allowUnknown = this.#allowUnknown;
+		next.#denyUnknown = this.#denyUnknown;
 		next.#metadata = this.#metadata ? { ...this.#metadata } : null;
 		next.#declaredExtnames = this.#declaredExtnames;
 		next.#declaredMimeTypes = this.#declaredMimeTypes;
@@ -2290,6 +2297,23 @@ export class RuleChain<Output = unknown> {
 	 */
 	allowUnknownProperties(): this {
 		this.#allowUnknown = true;
+		this.#denyUnknown = false;
+		return this;
+	}
+
+	/**
+	 * Fail the payload on a key the shape does not declare, instead of dropping
+	 * it.
+	 *
+	 * A deliberate addition: upstream offers keep-or-drop and nothing else, and
+	 * dropping stays the default so a migrated schema behaves the same. This is
+	 * for an API whose contract is that it refuses what it does not understand
+	 * — where a client sending `emial` should be told, not silently ignored and
+	 * left wondering why the address never changed.
+	 */
+	denyUnknownProperties(): this {
+		this.#denyUnknown = true;
+		this.#allowUnknown = false;
 		return this;
 	}
 
@@ -2869,11 +2893,31 @@ export class RuleChain<Output = unknown> {
 		);
 	}
 
-	/** Must match a regular expression (TS-only — never dispatched to Rust). */
+	/**
+	 * Must match a regular expression (TS-only — never dispatched to Rust).
+	 *
+	 * `toJSONSchema()` emits the expression's SOURCE. JSON Schema's `pattern`
+	 * has nowhere to carry flags, so `i`, `m` and `s` do not survive into the
+	 * emitted schema even though they are honoured here — a `/abc/i` validates
+	 * case-insensitively and exports as case-sensitive. Keep that in mind when
+	 * the emitted schema is handed to another validator.
+	 */
 	regex(pattern: RegExp): this {
+		// `test()` advances `lastIndex` on a global or sticky expression, so the
+		// SAME value alternates between valid and invalid across calls. Reset it
+		// before each test rather than stripping the flags: `y` anchors the
+		// match at `lastIndex`, and dropping it would let the pattern match
+		// anywhere instead.
+		const matches = (value: string): boolean => {
+			pattern.lastIndex = 0;
+			return pattern.test(value);
+		};
 		this.#pushRule({
 			name: "regex",
-			validate: (v) => typeof v === "string" && pattern.test(v),
+			// The source is carried so `toJSONSchema()` can emit the constraint;
+			// without it the emitted schema silently accepts anything.
+			args: { pattern: pattern.source },
+			validate: (v) => typeof v === "string" && matches(v),
 			message: "Invalid format",
 		});
 		return this;
@@ -3107,7 +3151,7 @@ export class RuleChain<Output = unknown> {
 	 *
 	 * Checksums are run where the country defines a short, well-defined one
 	 * (BE, DE, NL, IT, PT, LU, CH); the others are FORMAT-only, which is stated
-	 * rather than implied. An unknown country LEVES rather than accepting the
+	 * rather than implied. An unknown country RAISES rather than accepting the
 	 * value unchecked.
 	 */
 	vat(options: VatOptions | ((field: FieldContext) => VatOptions)): this {
@@ -3316,7 +3360,7 @@ export class RuleChain<Output = unknown> {
 		return this.#stringMutation("toCamelCase", toCamelCase);
 	}
 
-	/** HTML-escape `& < > " '` (VineJS `escape`). */
+	/** HTML-escape the eight characters VineJS `escape` does. */
 	escape(): this {
 		return this.#stringMutation("escape", escapeHtml);
 	}
@@ -3977,6 +4021,24 @@ export class RuleChain<Output = unknown> {
 					) ?? grp.branches.find((candidate) => candidate.predicate === null);
 				if (branch) shape = { ...shape, ...branch.shape };
 			}
+			if (this.#denyUnknown) {
+				const declared = new Set(Object.keys(shape));
+				const undeclared = Object.keys(source).filter(
+					(key) => !declared.has(key),
+				);
+				if (undeclared.length > 0) {
+					// Named one by one, and the shape listed: a typo is the common
+					// case, and "unknown field" without the alternatives leaves the
+					// caller to guess which spelling was expected.
+					for (const key of undeclared) {
+						errors.push({
+							field: field ? `${field}.${key}` : key,
+							rule: "unknownField",
+							message: `unknown field \`${key}\`, expected one of ${[...declared].join(", ")}`,
+						});
+					}
+				}
+			}
 			for (const [nestedField, chain] of Object.entries(shape)) {
 				const nestedResult = chain._validateWithTransform(
 					`${field}.${nestedField}`,

package/src/formats.ts

@@ -167,10 +167,13 @@ export const isMobile = (v: string): boolean =>
 export function escapeHtml(v: string): string {
 	return v
 		.replace(/&/g, "&")
+		.replace(/"/g, """)
+		.replace(/'/g, "'")
 		.replace(/</g, "&lt;")
 		.replace(/>/g, "&gt;")
-		.replace(/"/g, "&quot;")
-		.replace(/'/g, "&#x27;");
+		.replace(/\//g, "&#x2F;")
+		.replace(/\\/g, "&#x5C;")
+		.replace(/`/g, "&#96;");
 }
 
 /** Options accepted by `normalizeEmail` (subset of VineJS's). */

package/src/native/generated.ts

@@ -0,0 +1,9 @@
+// GENERATED FROM THE RUST — do not edit.
+//
+// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def
+// output. Editing this file by hand puts it back where it started: a
+// description that can disagree with the code it describes.
+
+/** Validate data against a schema (JSON string). */
+
+export declare function validate(requestJson: string): string;

package/src/native.ts

@@ -20,7 +20,16 @@ const platformMap: Record<string, string> = {
 	"win32-x64": "win32-x64-msvc",
 };
 
-let native: { validate: (json: string) => string } | undefined;
+/**
+ * The engine's surface, as the Rust declares it.
+ *
+ * Derived from `./native/generated.js` — written by `pnpm build:napi-types`
+ * from napi-derive's own `type-def` output — rather than restated here, where
+ * nothing would notice a `pub fn` gaining a parameter or changing its return.
+ */
+type NativeRune = typeof import("./native/generated.js");
+
+let native: NativeRune | undefined;
 let loadError: unknown;
 
 try {