@flaks/onerecord 0.1.2

package/dist/operations/validate-operation.js

@@ -0,0 +1,27 @@
+/**
+ * v2 (A3-M1): allowedFields is `ReadonlyArray<JsonPointer | RegExp>` — NO bare
+ * string arm. Literal pointers must be branded via `asJsonPointer(...).value`
+ * first. This matches spec §13.
+ */
+export function validateOperation(op, allowedFields) {
+    if (allowedFields.length === 0)
+        return { ok: true, value: op };
+    for (const allowed of allowedFields) {
+        if (typeof allowed === 'string') {
+            if (op.path === allowed)
+                return { ok: true, value: op };
+        }
+        else if (allowed.test(op.path)) {
+            return { ok: true, value: op };
+        }
+    }
+    return {
+        ok: false,
+        error: {
+            kind: 'operation_field_not_allowed',
+            field: op.path,
+            allowedFields: allowedFields.map((f) => (typeof f === 'string' ? f : f.source)),
+        },
+    };
+}
+//# sourceMappingURL=validate-operation.js.map

package/dist/operations/validate-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-operation.js","sourceRoot":"","sources":["../../src/operations/validate-operation.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAiB,EACjB,aAAkD;IAElD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IAC9D,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QACzD,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QAChC,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,6BAA6B;YACnC,KAAK,EAAE,EAAE,CAAC,IAAI;YACd,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;SAChF;KACF,CAAA;AACH,CAAC"}

package/dist/result.d.ts

@@ -0,0 +1,169 @@
+export type ParseResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: ParseError;
+};
+export type ParseError = {
+    kind: 'unknown_context';
+    got: string;
+    expected: string[];
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'mixed_context';
+    got: string[];
+    allowed: string[];
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'missing_type';
+    objectId?: string;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'unknown_type';
+    got: string;
+    objectId?: string;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'wrong_type_for_endpoint';
+    expected: string;
+    got: string;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'missing_id';
+    objectType: string;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'invalid_iri';
+    got: string;
+    reason: 'malformed' | 'disallowed_scheme' | 'disallowed_host' | 'has_userinfo';
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'duplicate_id_in_graph';
+    iri: string;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'cardinality_violation';
+    field: string;
+    expected: string;
+    got: number;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'circular_reference';
+    cyclePath: string[];
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'zod_validation';
+    issues: {
+        path: string;
+        message: string;
+        code: string;
+    }[];
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'forbidden_state_transition';
+    from: string;
+    to: string;
+    reason?: string;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'operation_field_not_allowed';
+    field: string;
+    allowedFields: ReadonlyArray<string>;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'change_partial_failure';
+    failedAt: number;
+    total: number;
+    cause: ParseError;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'payload_too_large';
+    sizeBytes: number;
+    limitBytes: number;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'depth_limit_exceeded';
+    depth: number;
+    limit: number;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'node_count_limit_exceeded';
+    count: number;
+    limit: number;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'string_too_long';
+    length: number;
+    limit: number;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'array_too_long';
+    length: number;
+    limit: number;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'prototype_pollution_attempt';
+    key: string;
+    path: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'incompatible_ontology_version';
+    serverVersion: string;
+    mapperVersion: string;
+    meta?: Record<string, unknown>;
+} | {
+    kind: 'invalid_pointer';
+    pointer: string;
+    reason: 'empty' | 'segment_not_object' | 'segment_missing';
+    path: string;
+    meta?: Record<string, unknown>;
+};
+/**
+ * Manifest of every ParseError kind — single source of truth.
+ * v3 (A1-R2-B2): bumped 21 -> 22 with the addition of `invalid_pointer`.
+ */
+export declare const PARSE_ERROR_KINDS: readonly ["unknown_context", "mixed_context", "missing_type", "unknown_type", "wrong_type_for_endpoint", "missing_id", "invalid_iri", "duplicate_id_in_graph", "cardinality_violation", "circular_reference", "zod_validation", "forbidden_state_transition", "operation_field_not_allowed", "change_partial_failure", "payload_too_large", "depth_limit_exceeded", "node_count_limit_exceeded", "string_too_long", "array_too_long", "prototype_pollution_attempt", "incompatible_ontology_version", "invalid_pointer"];
+/**
+ * v3 (A2-R2-B5, A3-R2-m1): explicit map from `ParseError.kind` to the test file
+ * that exercises it under `test/deserialize-errors/`. Several kinds collapse into
+ * one file (e.g., `depth_limit_exceeded` and `node_count_limit_exceeded` both point
+ * to `nested-depth.test.ts`; `invalid_pointer` and `prototype_pollution_attempt`
+ * share `prototype-key-injection.test.ts`). The manifest test consumes this map
+ * rather than computing filenames from `kind.replace(/_/g, '-')`, which is what
+ * v2 attempted and which produced day-one failures because file table rows
+ * 93-108 used 5 collapsed names that the algorithm did not know about.
+ *
+ * Contract: every kind maps to a file under test/deserialize-errors/. The file
+ * may contain assertions for multiple kinds. Adding a new ParseError kind
+ * requires: (1) append to union, (2) append to PARSE_ERROR_KINDS, (3) add
+ * an entry here pointing at the file that should exercise it.
+ */
+export declare const PARSE_ERROR_KIND_TO_FILE: Record<ParseError['kind'], string>;
+/** Public-safe redaction of a ParseError. By default exposes only `kind`. */
+export type PublicParseError = {
+    kind: ParseError['kind'];
+    path?: string;
+};
+/** Programmer-error class thrown by non-strict serializers. */
+export declare class SerializationError extends Error {
+    readonly code: 'invalid_application_object' | 'iri_construction_failed';
+    readonly details: unknown;
+    constructor(code: 'invalid_application_object' | 'iri_construction_failed', message: string, details: unknown);
+}
+export declare const ok: <T>(value: T) => ParseResult<T>;
+export declare const err: <T = never>(error: ParseError) => ParseResult<T>;
+//# sourceMappingURL=result.d.ts.map

package/dist/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAA;AAEtF,MAAM,MAAM,UAAU,GAClB;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,eAAe,CAAA;IACrB,GAAG,EAAE,MAAM,EAAE,CAAA;IACb,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACzF;IACE,IAAI,EAAE,cAAc,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,yBAAyB,CAAA;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACxF;IACE,IAAI,EAAE,aAAa,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,WAAW,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAC9E,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC5F;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACnF;IACE,IAAI,EAAE,gBAAgB,CAAA;IACtB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,4BAA4B,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,6BAA6B,CAAA;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,wBAAwB,CAAA;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,UAAU,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,mBAAmB,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,sBAAsB,CAAA;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,2BAA2B,CAAA;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,gBAAgB,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,6BAA6B,CAAA;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GACD;IACE,IAAI,EAAE,+BAA+B,CAAA;IACrC,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,GAID;IACE,IAAI,EAAE,iBAAiB,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,GAAG,oBAAoB,GAAG,iBAAiB,CAAA;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B,CAAA;AAEL;;;GAGG;AACH,eAAO,MAAM,iBAAiB,0fAuBwB,CAAA;AAEtD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,CAuBvE,CAAA;AAED,6EAA6E;AAC7E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,+DAA+D;AAC/D,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,4BAA4B,GAAG,yBAAyB,CAAA;IACvE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;gBAEvB,IAAI,EAAE,4BAA4B,GAAG,yBAAyB,EAC9D,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO;CAOnB;AAED,eAAO,MAAM,EAAE,GAAI,CAAC,EAAE,OAAO,CAAC,KAAG,WAAW,CAAC,CAAC,CAA0B,CAAA;AACxE,eAAO,MAAM,GAAG,GAAI,CAAC,GAAG,KAAK,EAAE,OAAO,UAAU,KAAG,WAAW,CAAC,CAAC,CAA2B,CAAA"}

package/dist/result.js

@@ -0,0 +1,82 @@
+// src/result.ts
+/**
+ * Manifest of every ParseError kind — single source of truth.
+ * v3 (A1-R2-B2): bumped 21 -> 22 with the addition of `invalid_pointer`.
+ */
+export const PARSE_ERROR_KINDS = [
+    'unknown_context',
+    'mixed_context',
+    'missing_type',
+    'unknown_type',
+    'wrong_type_for_endpoint',
+    'missing_id',
+    'invalid_iri',
+    'duplicate_id_in_graph',
+    'cardinality_violation',
+    'circular_reference',
+    'zod_validation',
+    'forbidden_state_transition',
+    'operation_field_not_allowed',
+    'change_partial_failure',
+    'payload_too_large',
+    'depth_limit_exceeded',
+    'node_count_limit_exceeded',
+    'string_too_long',
+    'array_too_long',
+    'prototype_pollution_attempt',
+    'incompatible_ontology_version',
+    'invalid_pointer',
+];
+/**
+ * v3 (A2-R2-B5, A3-R2-m1): explicit map from `ParseError.kind` to the test file
+ * that exercises it under `test/deserialize-errors/`. Several kinds collapse into
+ * one file (e.g., `depth_limit_exceeded` and `node_count_limit_exceeded` both point
+ * to `nested-depth.test.ts`; `invalid_pointer` and `prototype_pollution_attempt`
+ * share `prototype-key-injection.test.ts`). The manifest test consumes this map
+ * rather than computing filenames from `kind.replace(/_/g, '-')`, which is what
+ * v2 attempted and which produced day-one failures because file table rows
+ * 93-108 used 5 collapsed names that the algorithm did not know about.
+ *
+ * Contract: every kind maps to a file under test/deserialize-errors/. The file
+ * may contain assertions for multiple kinds. Adding a new ParseError kind
+ * requires: (1) append to union, (2) append to PARSE_ERROR_KINDS, (3) add
+ * an entry here pointing at the file that should exercise it.
+ */
+export const PARSE_ERROR_KIND_TO_FILE = {
+    unknown_context: 'unknown-context.test.ts',
+    mixed_context: 'mixed-context.test.ts',
+    missing_type: 'missing-type.test.ts',
+    unknown_type: 'zod-shape.test.ts',
+    wrong_type_for_endpoint: 'wrong-type.test.ts',
+    missing_id: 'missing-id.test.ts',
+    invalid_iri: 'invalid-iri.test.ts',
+    duplicate_id_in_graph: 'duplicate-id-in-graph.test.ts',
+    cardinality_violation: 'cardinality.test.ts',
+    circular_reference: 'circular-reference.test.ts',
+    zod_validation: 'zod-shape.test.ts',
+    forbidden_state_transition: 'forbidden-state-transition.test.ts',
+    operation_field_not_allowed: 'operation-field-not-allowed.test.ts',
+    change_partial_failure: 'zod-shape.test.ts',
+    payload_too_large: 'payload-too-large.test.ts',
+    depth_limit_exceeded: 'nested-depth.test.ts',
+    node_count_limit_exceeded: 'nested-depth.test.ts',
+    string_too_long: 'zod-shape.test.ts',
+    array_too_long: 'zod-shape.test.ts',
+    prototype_pollution_attempt: 'prototype-key-injection.test.ts',
+    incompatible_ontology_version: 'zod-shape.test.ts',
+    invalid_pointer: 'prototype-key-injection.test.ts',
+};
+/** Programmer-error class thrown by non-strict serializers. */
+export class SerializationError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.name = 'SerializationError';
+        this.code = code;
+        this.details = details;
+    }
+}
+export const ok = (value) => ({ ok: true, value });
+export const err = (error) => ({ ok: false, error });
+//# sourceMappingURL=result.js.map

package/dist/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAsIhB;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,cAAc;IACd,yBAAyB;IACzB,YAAY;IACZ,aAAa;IACb,uBAAuB;IACvB,uBAAuB;IACvB,oBAAoB;IACpB,gBAAgB;IAChB,4BAA4B;IAC5B,6BAA6B;IAC7B,wBAAwB;IACxB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,iBAAiB;IACjB,gBAAgB;IAChB,6BAA6B;IAC7B,+BAA+B;IAC/B,iBAAiB;CACmC,CAAA;AAEtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC1E,eAAe,EAAE,yBAAyB;IAC1C,aAAa,EAAE,uBAAuB;IACtC,YAAY,EAAE,sBAAsB;IACpC,YAAY,EAAE,mBAAmB;IACjC,uBAAuB,EAAE,oBAAoB;IAC7C,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,qBAAqB;IAClC,qBAAqB,EAAE,+BAA+B;IACtD,qBAAqB,EAAE,qBAAqB;IAC5C,kBAAkB,EAAE,4BAA4B;IAChD,cAAc,EAAE,mBAAmB;IACnC,0BAA0B,EAAE,oCAAoC;IAChE,2BAA2B,EAAE,qCAAqC;IAClE,sBAAsB,EAAE,mBAAmB;IAC3C,iBAAiB,EAAE,2BAA2B;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,yBAAyB,EAAE,sBAAsB;IACjD,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,mBAAmB;IACnC,2BAA2B,EAAE,iCAAiC;IAC9D,6BAA6B,EAAE,mBAAmB;IAClD,eAAe,EAAE,iCAAiC;CACnD,CAAA;AAQD,+DAA+D;AAC/D,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAA0D;IAC9D,OAAO,CAAS;IACzB,YACE,IAA8D,EAC9D,OAAe,EACf,OAAgB;QAEhB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,EAAE,GAAG,CAAI,KAAQ,EAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACxE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAY,KAAiB,EAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA"}

package/dist/safety/circular-ref.d.ts

@@ -0,0 +1,8 @@
+import type { ParseResult } from '../result.js';
+/**
+ * JS-level cycle detection per spec §13. JSON-LD `@id` back-references are
+ * VALID graph navigation and are NOT flagged here — that distinction matters
+ * because OneRecord graphs are highly cross-referential.
+ */
+export declare function detectCycle(input: unknown): ParseResult<true>;
+//# sourceMappingURL=circular-ref.d.ts.map

package/dist/safety/circular-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"circular-ref.d.ts","sourceRoot":"","sources":["../../src/safety/circular-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CA4B7D"}

package/dist/safety/circular-ref.js

@@ -0,0 +1,37 @@
+/**
+ * JS-level cycle detection per spec §13. JSON-LD `@id` back-references are
+ * VALID graph navigation and are NOT flagged here — that distinction matters
+ * because OneRecord graphs are highly cross-referential.
+ */
+export function detectCycle(input) {
+    const seen = new WeakSet();
+    const path = [];
+    function walk(v, segment) {
+        if (v === null || typeof v !== 'object')
+            return { ok: true, value: true };
+        if (seen.has(v)) {
+            return { ok: false, error: { kind: 'circular_reference', cyclePath: [...path, segment] } };
+        }
+        seen.add(v);
+        path.push(segment);
+        if (Array.isArray(v)) {
+            for (let i = 0; i < v.length; i++) {
+                const r = walk(v[i], `[${i}]`);
+                if (!r.ok)
+                    return r;
+            }
+        }
+        else {
+            for (const k of Object.getOwnPropertyNames(v)) {
+                const r = walk(v[k], `.${k}`);
+                if (!r.ok)
+                    return r;
+            }
+        }
+        path.pop();
+        seen.delete(v);
+        return { ok: true, value: true };
+    }
+    return walk(input, '$');
+}
+//# sourceMappingURL=circular-ref.js.map

package/dist/safety/circular-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circular-ref.js","sourceRoot":"","sources":["../../src/safety/circular-ref.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAA;IAClC,MAAM,IAAI,GAAa,EAAE,CAAA;IAEzB,SAAS,IAAI,CAAC,CAAU,EAAE,OAAe;QACvC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACzE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;QAC5F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAW,CAAC,CAAA;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAClB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC9B,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,MAAM,CAAC,GAAG,IAAI,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC1D,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAA;QACV,IAAI,CAAC,MAAM,CAAC,CAAW,CAAC,CAAA;QACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAClC,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACzB,CAAC"}

package/dist/safety/index.d.ts

@@ -0,0 +1,8 @@
+export type { SafetyLimits, DeserializeOpts, SerializeOpts } from './limits.js';
+export { DEFAULT_SAFETY_LIMITS, mergeLimits } from './limits.js';
+export { preValidate } from './pre-validate.js';
+export type { PreValidateOpts } from './pre-validate.js';
+export { isForbiddenKey, scanForPollution } from './prototype-pollution.js';
+export { detectCycle } from './circular-ref.js';
+export { isSafePathSegment, isValidArrayIndex, validatePathSegments, unescapeJsonPointerSegment, } from './path-traversal.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/safety/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/safety/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAA"}

package/dist/safety/index.js

@@ -0,0 +1,6 @@
+export { DEFAULT_SAFETY_LIMITS, mergeLimits } from './limits.js';
+export { preValidate } from './pre-validate.js';
+export { isForbiddenKey, scanForPollution } from './prototype-pollution.js';
+export { detectCycle } from './circular-ref.js';
+export { isSafePathSegment, isValidArrayIndex, validatePathSegments, unescapeJsonPointerSegment, } from './path-traversal.js';
+//# sourceMappingURL=index.js.map

package/dist/safety/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/safety/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAA"}

package/dist/safety/limits.d.ts

@@ -0,0 +1,26 @@
+export interface SafetyLimits {
+    maxDepth: number;
+    maxNodes: number;
+    maxStringLength: number;
+    maxArrayLength: number;
+    maxPayloadBytes: number;
+}
+/** Per spec §6.5.1. Frozen — no global mutator (spec §13). */
+export declare const DEFAULT_SAFETY_LIMITS: Readonly<SafetyLimits>;
+/**
+ * Merge a partial override with the defaults. v2: returns a deep-frozen object
+ * and rejects negative/non-integer limits. v3: also rejects > Number.MAX_SAFE_INTEGER.
+ * The returned value is safe to capture by closure in `createMapper` (Task 76)
+ * without later mutation.
+ */
+export declare function mergeLimits(partial?: Partial<SafetyLimits>): Readonly<SafetyLimits>;
+export interface DeserializeOpts {
+    limits?: Partial<SafetyLimits>;
+    payloadByteLength?: number;
+    allowedContexts?: readonly string[];
+    meta?: Record<string, unknown>;
+}
+export interface SerializeOpts {
+    iri?: import('../iri/strategy.js').IriStrategy;
+}
+//# sourceMappingURL=limits.d.ts.map

package/dist/safety/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/safety/limits.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,8DAA8D;AAC9D,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAMvD,CAAA;AAYF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAUnF;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,OAAO,oBAAoB,EAAE,WAAW,CAAA;CAC/C"}

package/dist/safety/limits.js

@@ -0,0 +1,36 @@
+/** Per spec §6.5.1. Frozen — no global mutator (spec §13). */
+export const DEFAULT_SAFETY_LIMITS = Object.freeze({
+    maxDepth: 32,
+    maxNodes: 10_000,
+    maxStringLength: 65_536,
+    maxArrayLength: 5_000,
+    maxPayloadBytes: 5_000_000,
+});
+function nonNeg(field, v) {
+    if (!Number.isFinite(v) || v < 0 || !Number.isInteger(v)) {
+        throw new Error(`mergeLimits: ${field} must be a non-negative integer (got ${v})`);
+    }
+    // v3 (A1-R2-m6): cap upper bound to catch DoS-via-stupendous-limit
+    if (v > Number.MAX_SAFE_INTEGER) {
+        throw new Error(`mergeLimits: ${field} must be <= Number.MAX_SAFE_INTEGER (got ${v})`);
+    }
+}
+/**
+ * Merge a partial override with the defaults. v2: returns a deep-frozen object
+ * and rejects negative/non-integer limits. v3: also rejects > Number.MAX_SAFE_INTEGER.
+ * The returned value is safe to capture by closure in `createMapper` (Task 76)
+ * without later mutation.
+ */
+export function mergeLimits(partial) {
+    const out = {
+        maxDepth: partial?.maxDepth ?? DEFAULT_SAFETY_LIMITS.maxDepth,
+        maxNodes: partial?.maxNodes ?? DEFAULT_SAFETY_LIMITS.maxNodes,
+        maxStringLength: partial?.maxStringLength ?? DEFAULT_SAFETY_LIMITS.maxStringLength,
+        maxArrayLength: partial?.maxArrayLength ?? DEFAULT_SAFETY_LIMITS.maxArrayLength,
+        maxPayloadBytes: partial?.maxPayloadBytes ?? DEFAULT_SAFETY_LIMITS.maxPayloadBytes,
+    };
+    for (const k of Object.keys(out))
+        nonNeg(k, out[k]);
+    return Object.freeze(out);
+}
+//# sourceMappingURL=limits.js.map

package/dist/safety/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/safety/limits.ts"],"names":[],"mappings":"AAQA,8DAA8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAA2B,MAAM,CAAC,MAAM,CAAC;IACzE,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,MAAM;IAChB,eAAe,EAAE,MAAM;IACvB,cAAc,EAAE,KAAK;IACrB,eAAe,EAAE,SAAS;CAC3B,CAAC,CAAA;AAEF,SAAS,MAAM,CAAC,KAAyB,EAAE,CAAS;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,wCAAwC,CAAC,GAAG,CAAC,CAAA;IACpF,CAAC;IACD,mEAAmE;IACnE,IAAI,CAAC,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,4CAA4C,CAAC,GAAG,CAAC,CAAA;IACxF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAA+B;IACzD,MAAM,GAAG,GAAiB;QACxB,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,qBAAqB,CAAC,QAAQ;QAC7D,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,qBAAqB,CAAC,QAAQ;QAC7D,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,qBAAqB,CAAC,eAAe;QAClF,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,qBAAqB,CAAC,cAAc;QAC/E,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,qBAAqB,CAAC,eAAe;KACnF,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAA2B;QAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC"}

package/dist/safety/path-traversal.d.ts

@@ -0,0 +1,11 @@
+import type { ParseResult } from '../result.js';
+export declare function unescapeJsonPointerSegment(seg: string): string;
+export declare function isSafePathSegment(segment: string): boolean;
+/**
+ * v2 (A3-M3): canonical non-negative-integer test for array indices.
+ * Accepts only `0`, `1`, ... `999...` — rejects negative, decimal, scientific
+ * notation, leading-zero, whitespace, NaN, Infinity, hex.
+ */
+export declare function isValidArrayIndex(segment: string): boolean;
+export declare function validatePathSegments(pointer: string): ParseResult<readonly string[]>;
+//# sourceMappingURL=path-traversal.d.ts.map

package/dist/safety/path-traversal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-traversal.d.ts","sourceRoot":"","sources":["../../src/safety/path-traversal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAG/C,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO1D;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAAC,SAAS,MAAM,EAAE,CAAC,CAepF"}

package/dist/safety/path-traversal.js

@@ -0,0 +1,41 @@
+import { isForbiddenKey } from './prototype-pollution.js';
+export function unescapeJsonPointerSegment(seg) {
+    return seg.replace(/~1/g, '/').replace(/~0/g, '~');
+}
+export function isSafePathSegment(segment) {
+    return !isForbiddenKey(segment);
+}
+/**
+ * v2 (A3-M3): canonical non-negative-integer test for array indices.
+ * Accepts only `0`, `1`, ... `999...` — rejects negative, decimal, scientific
+ * notation, leading-zero, whitespace, NaN, Infinity, hex.
+ */
+export function isValidArrayIndex(segment) {
+    if (segment === '' || segment.length > 10)
+        return false;
+    if (segment === '0')
+        return true;
+    // Canonical form: first char is 1-9, rest are 0-9
+    if (!/^[1-9][0-9]*$/.test(segment))
+        return false;
+    const n = Number(segment);
+    return Number.isInteger(n) && n >= 0 && n < 2 ** 32;
+}
+export function validatePathSegments(pointer) {
+    if (pointer === '')
+        return { ok: true, value: [] };
+    if (!pointer.startsWith('/')) {
+        return {
+            ok: false,
+            error: { kind: 'prototype_pollution_attempt', key: pointer, path: pointer },
+        };
+    }
+    const segments = pointer.slice(1).split('/').map(unescapeJsonPointerSegment);
+    for (const seg of segments) {
+        if (!isSafePathSegment(seg)) {
+            return { ok: false, error: { kind: 'prototype_pollution_attempt', key: seg, path: pointer } };
+        }
+    }
+    return { ok: true, value: segments };
+}
+//# sourceMappingURL=path-traversal.js.map

package/dist/safety/path-traversal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-traversal.js","sourceRoot":"","sources":["../../src/safety/path-traversal.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IACvD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAChC,kDAAkD;IAClD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IACzB,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IAClD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;SAC5E,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;IAC5E,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAA;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AACtC,CAAC"}

package/dist/safety/pre-validate.d.ts

@@ -0,0 +1,20 @@
+import type { ParseResult } from '../result.js';
+import type { SafetyLimits } from './limits.js';
+export interface PreValidateOpts {
+    limits?: Partial<SafetyLimits>;
+    payloadByteLength?: number;
+    meta?: Record<string, unknown>;
+}
+/**
+ * Pre-Zod sanity pass per spec §6.5.2:
+ *   1. Payload byte size
+ *   2. Recursive walk: depth, node count, string length, array length
+ *   3. Prototype-pollution rejection
+ *   4. JS-level circular reference detection
+ *
+ * v2 (A3-m2): opts.meta is threaded into every constructed ParseError.
+ *
+ * Returns the input as `value` on success so callers can chain.
+ */
+export declare function preValidate(input: unknown, opts?: PreValidateOpts): ParseResult<unknown>;
+//# sourceMappingURL=pre-validate.d.ts.map

package/dist/safety/pre-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-validate.d.ts","sourceRoot":"","sources":["../../src/safety/pre-validate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAI/C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,eAAoB,GAAG,WAAW,CAAC,OAAO,CAAC,CAyG5F"}