@crvouga/atlas 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog: @crvouga/atlas
 
-## 0.10.0 (2026-10-21)
+## 0.10.1 (2026-10-24)
+
+### Fixes and improvements
+
+- patch Vite and Zod vulnerabilities (#17) ([4d8e389](https://github.com/crvouga/atlas/commit/4d8e389acb31eccfc34736cb83c6b10fdd6e292e))
+
+## 0.10.0 (2026-10-20)
 
 ### Features
 

package/dist/schema/src/common.d.ts

@@ -33,12 +33,12 @@ export declare const EVENT_KINDS: readonly ["user", "system", "time", "hand-off"
  * Zod schema for an `EVENT_KINDS` value that first rewrites the legacy value `member` to `user`, so specs written
  * before the kinds were renamed still parse.
  */
-export declare const EventKindSchema: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+export declare const EventKindSchema: z.ZodPreprocess<z.ZodEnum<{
     time: "time";
     user: "user";
     system: "system";
     "hand-off": "hand-off";
-}>>;
+}>, unknown>;
 /** One of `EVENT_KINDS`. */
 export type EventKind = z.infer<typeof EventKindSchema>;
 /**

package/dist/schema/src/manifest.d.ts

@@ -258,12 +258,12 @@ export declare const MapEdgeSchema: z.ZodObject<{
     source: z.ZodString;
     target: z.ZodString;
     event: z.ZodString;
-    kind: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+    kind: z.ZodPreprocess<z.ZodEnum<{
         time: "time";
         user: "user";
         system: "system";
         "hand-off": "hand-off";
-    }>>;
+    }>, unknown>;
     inScope: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /**
@@ -380,12 +380,12 @@ export declare const TransitionRecordSchema: z.ZodObject<{
     source: z.ZodString;
     target: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     event: z.ZodString;
-    kind: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+    kind: z.ZodOptional<z.ZodPreprocess<z.ZodEnum<{
         time: "time";
         user: "user";
         system: "system";
         "hand-off": "hand-off";
-    }>>>;
+    }>, unknown>>;
     how: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     client: z.ZodOptional<z.ZodString>;
     status: z.ZodEnum<{

package/dist/schema/src/spec.d.ts

@@ -90,12 +90,12 @@ export declare const StateMetaShape: {
         label: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     readonly hints: z.ZodArray<z.ZodString>;
-    readonly eventKinds: z.ZodRecord<z.ZodString, z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+    readonly eventKinds: z.ZodRecord<z.ZodString, z.ZodPreprocess<z.ZodEnum<{
         time: "time";
         user: "user";
         system: "system";
         "hand-off": "hand-off";
-    }>>>;
+    }>, unknown>>;
     readonly timeEvents: z.ZodRecord<z.ZodString, z.ZodString>;
 };
 /** `StateMetaShape` with every field optional: the `meta` of a state or of a whole chart. */
@@ -134,12 +134,12 @@ export declare const StateMetaSchema: z.ZodObject<{
         label: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     hints: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    eventKinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+    eventKinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodPreprocess<z.ZodEnum<{
         time: "time";
         user: "user";
         system: "system";
         "hand-off": "hand-off";
-    }>>>>;
+    }>, unknown>>>;
     timeEvents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 /** A parsed `StateMetaSchema` value. */
@@ -216,12 +216,12 @@ export declare const MachineSchema: z.ZodObject<{
             label: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         hints: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        eventKinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodEnum<{
+        eventKinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodPreprocess<z.ZodEnum<{
             time: "time";
             user: "user";
             system: "system";
             "hand-off": "hand-off";
-        }>>>>;
+        }>, unknown>>>;
         timeEvents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, z.core.$strip>>;
     states: z.ZodRecord<z.ZodString, z.ZodUnknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/atlas",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Atlas: specs of any kind, reported as layered evidence. Publish checks from any runner (JUnit, CTRF, a script), combine them across nodes, branches, environments and backends, gate CI on the result, and run statecharts against the real app.",
   "license": "MIT",
   "type": "module",
@@ -207,10 +207,10 @@
     "react-dom": "^19.3.0",
     "solid-js": "^1.9.15",
     "tsx": "4.23.13",
-    "vite": "7.3.6",
+    "vite": "7.3.7",
     "xstate": "5.33.2",
     "yaml": "^2.9.0",
-    "zod": "^3.25.76",
+    "zod": "^4.6.7",
     "zustand": "^5.0.15"
   },
   "peerDependencies": {

package/packages/schema/schemas/check-detail.schema.json

@@ -13,9 +13,9 @@
       "type": "object",
       "properties": {
         "id": {
-          "description": "The check's stable identity within its producer. The same check must keep the same id in every layer, or layers cannot replace one another",
           "type": "string",
-          "minLength": 1
+          "minLength": 1,
+          "description": "The check's stable identity within its producer. The same check must keep the same id in every layer, or layers cannot replace one another"
         },
         "title": {
           "type": "string"
@@ -30,8 +30,8 @@
           ]
         },
         "detail": {
-          "description": "Why it failed, or what was measured",
           "default": "",
+          "description": "Why it failed, or what was measured",
           "type": "string"
         },
         "specPath": {
@@ -49,8 +49,8 @@
                 "minLength": 1
               },
               "value": {
-                "description": "A finite number",
-                "type": "number"
+                "type": "number",
+                "description": "A finite number"
               },
               "unit": {
                 "type": "string"
@@ -215,9 +215,9 @@
             "type": "object",
             "properties": {
               "type": {
-                "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…",
                 "type": "string",
-                "minLength": 1
+                "minLength": 1,
+                "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…"
               },
               "message": {
                 "type": "string"
@@ -443,9 +443,9 @@
                   "type": "object",
                   "properties": {
                     "type": {
-                      "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…",
                       "type": "string",
-                      "minLength": 1
+                      "minLength": 1,
+                      "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…"
                     },
                     "message": {
                       "type": "string"
@@ -708,9 +708,9 @@
                         "type": "object",
                         "properties": {
                           "type": {
-                            "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…",
                             "type": "string",
-                            "minLength": 1
+                            "minLength": 1,
+                            "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…"
                           },
                           "message": {
                             "type": "string"
@@ -908,9 +908,9 @@
                   "type": "object",
                   "properties": {
                     "type": {
-                      "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…",
                       "type": "string",
-                      "minLength": 1
+                      "minLength": 1,
+                      "description": "An open vocabulary: note, warning, deprecation, issue, accessibility, coverage…"
                     },
                     "message": {
                       "type": "string"
@@ -1016,10 +1016,10 @@
       "additionalProperties": {}
     },
     "run": {
-      "description": "What the run as a whole carries: its logs, links, labels, annotations and extensions",
       "type": "object",
       "properties": {},
-      "additionalProperties": {}
+      "additionalProperties": {},
+      "description": "What the run as a whole carries: its logs, links, labels, annotations and extensions"
     }
   },
   "required": [

package/packages/schema/schemas/checks-result.schema.json

@@ -8,8 +8,8 @@
       "const": true
     },
     "id": {
-      "description": "The layer id",
-      "type": "string"
+      "type": "string",
+      "description": "The layer id"
     },
     "checks": {
       "type": "integer",

package/packages/schema/schemas/command-error.schema.json

@@ -11,13 +11,13 @@
       "type": "object",
       "properties": {
         "message": {
-          "description": "What is wrong, and usually what to do about it",
-          "type": "string"
+          "type": "string",
+          "description": "What is wrong, and usually what to do about it"
         },
         "code": {
-          "description": "`usage`: the command or its inputs were wrong. Nothing was written",
           "type": "string",
-          "const": "usage"
+          "const": "usage",
+          "description": "`usage`: the command or its inputs were wrong. Nothing was written"
         }
       },
       "required": [

package/packages/schema/schemas/doctor-result.schema.json

@@ -4,8 +4,8 @@
   "type": "object",
   "properties": {
     "ok": {
-      "description": "True when every check of every store passed (otherwise the exit code is 1)",
-      "type": "boolean"
+      "type": "boolean",
+      "description": "True when every check of every store passed (otherwise the exit code is 1)"
     },
     "stores": {
       "type": "array",
@@ -21,8 +21,8 @@
               "type": "object",
               "properties": {
                 "name": {
-                  "description": "`store`, `list`, `contents`, `write`, …",
-                  "type": "string"
+                  "type": "string",
+                  "description": "`store`, `list`, `contents`, `write`, …"
                 },
                 "ok": {
                   "type": "boolean"

package/packages/schema/schemas/effective-delta.schema.json

@@ -4,11 +4,10 @@
   "type": "object",
   "properties": {
     "version": {
-      "description": "Changes exactly when the report does",
-      "type": "string"
+      "type": "string",
+      "description": "Changes exactly when the report does"
     },
     "layers": {
-      "description": "Layers that are new or changed since `base`, whole",
       "type": "array",
       "items": {
         "type": "object",
@@ -22,12 +21,12 @@
               "type": "object",
               "properties": {
                 "kind": {
-                  "description": "The kind of the part holding the check. Part of the slot",
-                  "type": "string"
+                  "type": "string",
+                  "description": "The kind of the part holding the check. Part of the slot"
                 },
                 "id": {
-                  "description": "The check id. Part of the slot",
-                  "type": "string"
+                  "type": "string",
+                  "description": "The check id. Part of the slot"
                 },
                 "title": {
                   "type": "string"
@@ -43,18 +42,14 @@
                 },
                 "specPath": {
                   "description": "The spec the check belongs to, `specs/<path>`, or null",
-                  "anyOf": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "type": "null"
-                    }
+                  "type": [
+                    "string",
+                    "null"
                   ]
                 },
                 "detail": {
-                  "description": "Why it has this status; empty when there is nothing to add",
-                  "type": "string"
+                  "type": "string",
+                  "description": "Why it has this status; empty when there is nothing to add"
                 },
                 "measurements": {
                   "type": "array",
@@ -83,13 +78,9 @@
                   }
                 },
                 "testId": {
-                  "anyOf": [
-                    {
-                      "type": "string"
-                    },
-                    {
-                      "type": "null"
-                    }
+                  "type": [
+                    "string",
+                    "null"
                   ]
                 },
                 "variant": {
@@ -102,13 +93,9 @@
                   }
                 },
                 "durationMs": {
-                  "anyOf": [
-                    {
-                      "type": "number"
-                    },
-                    {
-                      "type": "null"
-                    }
+                  "type": [
+                    "number",
+                    "null"
                   ]
                 },
                 "evidence": {
@@ -190,96 +177,76 @@
             }
           },
           "fingerprints": {
-            "description": "Spec path to the fingerprint the layer recorded for it",
             "type": "object",
             "propertyNames": {
               "type": "string"
             },
             "additionalProperties": {
               "type": "string"
-            }
+            },
+            "description": "Spec path to the fingerprint the layer recorded for it"
           },
           "layer": {
             "type": "object",
             "properties": {
               "id": {
-                "description": "The layer id: 64 lowercase hex digits, the SHA-256 of its content",
-                "type": "string"
+                "type": "string",
+                "description": "The layer id: 64 lowercase hex digits, the SHA-256 of its content"
               },
               "backend": {
-                "description": "The backend it was read from; the one that sorts first when several hold it",
-                "type": "string"
+                "type": "string",
+                "description": "The backend it was read from; the one that sorts first when several hold it"
               },
               "producer": {
-                "description": "The suite or tool that made it. Part of the slot",
-                "type": "string"
+                "type": "string",
+                "description": "The suite or tool that made it. Part of the slot"
               },
               "packageDir": {
-                "anyOf": [
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "type": "null"
-                  }
+                "type": [
+                  "string",
+                  "null"
                 ]
               },
               "recordedAtMs": {
-                "description": "When the checks ran, epoch milliseconds. The newest completed result wins its slot",
-                "type": "number"
+                "type": "number",
+                "description": "When the checks ran, epoch milliseconds. The newest completed result wins its slot"
               },
               "sha": {
                 "description": "The commit it was recorded at. Provenance only",
-                "anyOf": [
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "type": "null"
-                  }
+                "type": [
+                  "string",
+                  "null"
                 ]
               },
               "branch": {
                 "description": "The branch it was recorded on. Provenance only",
-                "anyOf": [
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "type": "null"
-                  }
+                "type": [
+                  "string",
+                  "null"
                 ]
               },
               "environment": {
                 "description": "The client it checked, such as `ios`. Part of the slot",
-                "anyOf": [
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "type": "null"
-                  }
+                "type": [
+                  "string",
+                  "null"
                 ]
               },
               "runUrl": {
-                "anyOf": [
-                  {
-                    "type": "string"
-                  },
-                  {
-                    "type": "null"
-                  }
+                "type": [
+                  "string",
+                  "null"
                 ]
               },
               "parameters": {
-                "description": "Other choices that make a result its own slot",
                 "type": "object",
                 "propertyNames": {
                   "type": "string"
                 },
                 "additionalProperties": {
                   "type": "string"
-                }
+                },
+                "description": "Other choices that make a result its own slot"
               },
               "freshness": {
                 "description": "`modified`: recorded from a checkout with uncommitted changes. `unknown`: origin not captured. Absent: clean",
@@ -290,13 +257,13 @@
                 ]
               },
               "recording": {
-                "description": "Where recorded timelines are read from, or null",
                 "anyOf": [
                   {},
                   {
                     "type": "null"
                   }
-                ]
+                ],
+                "description": "Where recorded timelines are read from, or null"
               },
               "live": {
                 "type": "boolean"
@@ -316,7 +283,13 @@
                   "type": "integer",
                   "minimum": 0,
                   "maximum": 9007199254740991
-                }
+                },
+                "required": [
+                  "passed",
+                  "failed",
+                  "running",
+                  "not-run"
+                ]
               },
               "execution": {
                 "type": "string"
@@ -410,7 +383,8 @@
           "layer"
         ],
         "additionalProperties": {}
-      }
+      },
+      "description": "Layers that are new or changed since `base`, whole"
     },
     "backends": {
       "type": "array",
@@ -424,12 +398,12 @@
             "type": "string"
           },
           "live": {
-            "description": "Always false on a server",
-            "type": "boolean"
+            "type": "boolean",
+            "description": "Always false on a server"
           },
           "available": {
-            "description": "False when the backend could not be read; its results are then unknown, never passed",
-            "type": "boolean"
+            "type": "boolean",
+            "description": "False when the backend could not be read; its results are then unknown, never passed"
           }
         },
         "required": [
@@ -442,37 +416,37 @@
       }
     },
     "notices": {
-      "description": "What could not be read. A gate treats any notice as unknown, never as passed",
       "type": "array",
       "items": {
         "type": "string"
-      }
+      },
+      "description": "What could not be read. A gate treats any notice as unknown, never as passed"
     },
     "totalLayers": {
-      "description": "Every layer read, whether or not it still wins anything",
       "type": "integer",
       "minimum": 0,
-      "maximum": 9007199254740991
+      "maximum": 9007199254740991,
+      "description": "Every layer read, whether or not it still wins anything"
     },
     "active": {
-      "description": "Always empty on a server; kept for viewers written for live spec runs",
       "type": "array",
-      "items": {}
+      "items": {},
+      "description": "Always empty on a server; kept for viewers written for live spec runs"
     },
     "delta": {
       "type": "boolean",
       "const": true
     },
     "base": {
-      "description": "The version this applies to",
-      "type": "string"
+      "type": "string",
+      "description": "The version this applies to"
     },
     "removed": {
-      "description": "Ids of layers that no longer hold a winner",
       "type": "array",
       "items": {
         "type": "string"
-      }
+      },
+      "description": "Ids of layers that no longer hold a winner"
     }
   },
   "required": [