@flaks/onerecord 0.1.2

package/dist/safety/pre-validate.js

@@ -0,0 +1,123 @@
+import { detectCycle } from './circular-ref.js';
+import { mergeLimits } from './limits.js';
+import { scanForPollution } from './prototype-pollution.js';
+/**
+ * Pre-Zod sanity pass per spec §6.5.2:
+ *   1. Payload byte size
+ *   2. Recursive walk: depth, node count, string length, array length
+ *   3. Prototype-pollution rejection
+ *   4. JS-level circular reference detection
+ *
+ * v2 (A3-m2): opts.meta is threaded into every constructed ParseError.
+ *
+ * Returns the input as `value` on success so callers can chain.
+ */
+export function preValidate(input, opts = {}) {
+    const limits = mergeLimits(opts.limits);
+    const metaSlice = opts.meta ? { meta: opts.meta } : {};
+    // 1. Payload bytes
+    let bytes = opts.payloadByteLength;
+    if (bytes === undefined) {
+        try {
+            bytes = JSON.stringify(input).length;
+        }
+        catch {
+            bytes = limits.maxPayloadBytes + 1;
+        }
+    }
+    if (bytes > limits.maxPayloadBytes) {
+        return {
+            ok: false,
+            error: {
+                kind: 'payload_too_large',
+                sizeBytes: bytes,
+                limitBytes: limits.maxPayloadBytes,
+                ...metaSlice,
+            },
+        };
+    }
+    // 2. Recursive walk
+    let nodes = 0;
+    function walk(v, depth, path) {
+        nodes++;
+        if (nodes > limits.maxNodes) {
+            return {
+                ok: false,
+                error: {
+                    kind: 'node_count_limit_exceeded',
+                    count: nodes,
+                    limit: limits.maxNodes,
+                    ...metaSlice,
+                },
+            };
+        }
+        if (depth > limits.maxDepth) {
+            return {
+                ok: false,
+                error: {
+                    kind: 'depth_limit_exceeded',
+                    depth,
+                    limit: limits.maxDepth,
+                    path,
+                    ...metaSlice,
+                },
+            };
+        }
+        if (typeof v === 'string') {
+            if (v.length > limits.maxStringLength) {
+                return {
+                    ok: false,
+                    error: {
+                        kind: 'string_too_long',
+                        length: v.length,
+                        limit: limits.maxStringLength,
+                        path,
+                        ...metaSlice,
+                    },
+                };
+            }
+            return { ok: true, value: true };
+        }
+        if (v === null || typeof v !== 'object')
+            return { ok: true, value: true };
+        if (Array.isArray(v)) {
+            if (v.length > limits.maxArrayLength) {
+                return {
+                    ok: false,
+                    error: {
+                        kind: 'array_too_long',
+                        length: v.length,
+                        limit: limits.maxArrayLength,
+                        path,
+                        ...metaSlice,
+                    },
+                };
+            }
+            for (let i = 0; i < v.length; i++) {
+                const r = walk(v[i], depth + 1, `${path}[${i}]`);
+                if (!r.ok)
+                    return r;
+            }
+            return { ok: true, value: true };
+        }
+        for (const k of Object.getOwnPropertyNames(v)) {
+            const r = walk(v[k], depth + 1, `${path}.${k}`);
+            if (!r.ok)
+                return r;
+        }
+        return { ok: true, value: true };
+    }
+    const walkR = walk(input, 0, '$');
+    if (!walkR.ok)
+        return walkR;
+    // 3. Prototype-pollution
+    const pollR = scanForPollution(input, '$');
+    if (!pollR.ok)
+        return pollR;
+    // 4. JS cycles
+    const cycleR = detectCycle(input);
+    if (!cycleR.ok)
+        return cycleR;
+    return { ok: true, value: input };
+}
+//# sourceMappingURL=pre-validate.js.map

package/dist/safety/pre-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-validate.js","sourceRoot":"","sources":["../../src/safety/pre-validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAQ3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,OAAwB,EAAE;IACpE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAEtD,mBAAmB;IACnB,IAAI,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAA;IAClC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAA;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,MAAM,CAAC,eAAe,GAAG,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,MAAM,CAAC,eAAe;gBAClC,GAAG,SAAS;aACb;SACF,CAAA;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,SAAS,IAAI,CAAC,CAAU,EAAE,KAAa,EAAE,IAAY;QACnD,KAAK,EAAE,CAAA;QACP,IAAI,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,2BAA2B;oBACjC,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,MAAM,CAAC,QAAQ;oBACtB,GAAG,SAAS;iBACb;aACF,CAAA;QACH,CAAC;QACD,IAAI,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,sBAAsB;oBAC5B,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,QAAQ;oBACtB,IAAI;oBACJ,GAAG,SAAS;iBACb;aACF,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;gBACtC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,iBAAiB;wBACvB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,KAAK,EAAE,MAAM,CAAC,eAAe;wBAC7B,IAAI;wBACJ,GAAG,SAAS;qBACb;iBACF,CAAA;YACH,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACzE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;gBACrC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,gBAAgB;wBACtB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,KAAK,EAAE,MAAM,CAAC,cAAc;wBAC5B,IAAI;wBACJ,GAAG,SAAS;qBACb;iBACF,CAAA;YACH,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;gBAChD,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAA;YACrB,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAClC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,IAAI,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5E,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAE3B,yBAAyB;IACzB,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1C,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAE3B,eAAe;IACf,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAE7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AACnC,CAAC"}

package/dist/safety/prototype-pollution.d.ts

@@ -0,0 +1,19 @@
+import type { ParseResult } from '../result.js';
+/**
+ * Per spec §6.5.2 + v3 expansion: reject any key that matches a forbidden
+ * pattern after Unicode NFKC normalization. NFKC handles full-width and
+ * compatibility variants that look identical to humans.
+ *
+ * Spec amendment note: NFKC (compatibility decomposition) is strictly stronger
+ * than spec §6.5.2 step 3's NFC. NFKC catches full-width Unicode confusables
+ * like `＿＿proto＿＿`. This is documented under "Spec amendment candidates" §1.
+ */
+export declare function isForbiddenKey(key: string): boolean;
+/**
+ * Walk an unknown input and reject if any property key is forbidden, any
+ * Symbol-keyed property is enumerable, or any accessor (getter/setter) is
+ * present. Operates on plain objects + arrays only — primitive leaves
+ * are skipped.
+ */
+export declare function scanForPollution(input: unknown, path: string): ParseResult<true>;
+//# sourceMappingURL=prototype-pollution.d.ts.map

package/dist/safety/prototype-pollution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prototype-pollution.d.ts","sourceRoot":"","sources":["../../src/safety/prototype-pollution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAY/C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CA6ChF"}

package/dist/safety/prototype-pollution.js

@@ -0,0 +1,72 @@
+const FORBIDDEN_KEYS = new Set([
+    '__proto__',
+    'constructor',
+    'prototype',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+]);
+/**
+ * Per spec §6.5.2 + v3 expansion: reject any key that matches a forbidden
+ * pattern after Unicode NFKC normalization. NFKC handles full-width and
+ * compatibility variants that look identical to humans.
+ *
+ * Spec amendment note: NFKC (compatibility decomposition) is strictly stronger
+ * than spec §6.5.2 step 3's NFC. NFKC catches full-width Unicode confusables
+ * like `＿＿proto＿＿`. This is documented under "Spec amendment candidates" §1.
+ */
+export function isForbiddenKey(key) {
+    const normalized = key.normalize('NFKC');
+    return FORBIDDEN_KEYS.has(normalized);
+}
+/**
+ * Walk an unknown input and reject if any property key is forbidden, any
+ * Symbol-keyed property is enumerable, or any accessor (getter/setter) is
+ * present. Operates on plain objects + arrays only — primitive leaves
+ * are skipped.
+ */
+export function scanForPollution(input, path) {
+    if (input === null || typeof input !== 'object') {
+        return { ok: true, value: true };
+    }
+    if (Array.isArray(input)) {
+        for (let i = 0; i < input.length; i++) {
+            const r = scanForPollution(input[i], `${path}[${i}]`);
+            if (!r.ok)
+                return r;
+        }
+        return { ok: true, value: true };
+    }
+    const obj = input;
+    // Symbol keys (v2 A1-m5: use optional chaining + nullish coalescing instead of non-null assertion)
+    const syms = Object.getOwnPropertySymbols(obj);
+    if (syms.length > 0) {
+        return {
+            ok: false,
+            error: {
+                kind: 'prototype_pollution_attempt',
+                key: syms[0]?.toString() ?? '<symbol>',
+                path,
+            },
+        };
+    }
+    // String keys
+    for (const k of Object.getOwnPropertyNames(obj)) {
+        if (isForbiddenKey(k)) {
+            return { ok: false, error: { kind: 'prototype_pollution_attempt', key: k, path } };
+        }
+        const desc = Object.getOwnPropertyDescriptor(obj, k);
+        if (desc && (desc.get !== undefined || desc.set !== undefined)) {
+            return {
+                ok: false,
+                error: { kind: 'prototype_pollution_attempt', key: `accessor:${k}`, path: `${path}.${k}` },
+            };
+        }
+        const r = scanForPollution(obj[k], `${path}.${k}`);
+        if (!r.ok)
+            return r;
+    }
+    return { ok: true, value: true };
+}
+//# sourceMappingURL=prototype-pollution.js.map

package/dist/safety/prototype-pollution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prototype-pollution.js","sourceRoot":"","sources":["../../src/safety/prototype-pollution.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,WAAW;IACX,aAAa;IACb,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,IAAY;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAClC,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;YACrD,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,CAAC,CAAA;QACrB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAClC,CAAC;IAED,MAAM,GAAG,GAAG,KAAyC,CAAA;IAErD,mGAAmG;IACnG,MAAM,IAAI,GAAG,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,6BAA6B;gBACnC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,UAAU;gBACtC,IAAI;aACL;SACF,CAAA;IACH,CAAC;IAED,cAAc;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAA;QACpF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE;aAC3F,CAAA;QACH,CAAC;QACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,CAAA;IACrB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AAClC,CAAC"}

package/dist/types/index.d.ts

@@ -0,0 +1,39 @@
+export type { ParseError, ParseResult, PublicParseError } from '../result.js';
+export type { Codec } from '../classes/shared/codec.js';
+export type { JsonLd } from '../classes/shared/jsonld-brand.js';
+export type { LogisticsObject } from '../classes/shared/logistics-object.js';
+export type { SafeIri, IriStrategy, IriParts, ClassName } from '../iri/strategy.js';
+export type { SafetyLimits, DeserializeOpts, SerializeOpts } from '../safety/limits.js';
+export type { AccessDelegation, JsonLdAccessDelegation, } from '../classes/access-delegation/index.js';
+export type { AccessDelegationRequest, JsonLdAccessDelegationRequest, } from '../classes/access-delegation-request/index.js';
+export type { AccountNumber, JsonLdAccountNumber } from '../classes/account-number/index.js';
+export type { Address, JsonLdAddress } from '../classes/address/index.js';
+export type { Booking, JsonLdBooking } from '../classes/booking/index.js';
+export type { BookingOption, JsonLdBookingOption } from '../classes/booking-option/index.js';
+export type { BookingOptionRequest, JsonLdBookingOptionRequest, } from '../classes/booking-option-request/index.js';
+export type { BookingPreferences, JsonLdBookingPreferences, } from '../classes/booking-preferences/index.js';
+export type { BookingRequest, JsonLdBookingRequest } from '../classes/booking-request/index.js';
+export type { BookingSegment, JsonLdBookingSegment } from '../classes/booking-segment/index.js';
+export type { BookingShipment, JsonLdBookingShipment } from '../classes/booking-shipment/index.js';
+export type { BookingTimes, JsonLdBookingTimes } from '../classes/booking-times/index.js';
+export type { Change, JsonLdChange } from '../classes/change/index.js';
+export type { ChangeRequest, JsonLdChangeRequest } from '../classes/change-request/index.js';
+export type { HandlingService, JsonLdHandlingService } from '../classes/handling-service/index.js';
+export type { JsonLdLocation, Location } from '../classes/location/index.js';
+export type { JsonLdLogisticsEvent, LogisticsEvent } from '../classes/logistics-event/index.js';
+export type { JsonLdMovementTime, MovementTime } from '../classes/movement-time/index.js';
+export type { JsonLdNotification, Notification } from '../classes/notification/index.js';
+export type { JsonLdOperation, Operation } from '../classes/operation/index.js';
+export type { JsonLdOrganization, Organization } from '../classes/organization/index.js';
+export type { JsonLdParty, Party } from '../classes/party/index.js';
+export type { JsonLdPerson, Person } from '../classes/person/index.js';
+export type { JsonLdPiece, Piece } from '../classes/piece/index.js';
+export type { JsonLdServerInformation, ServerInformation, } from '../classes/server-information/index.js';
+export type { JsonLdShipment, Shipment } from '../classes/shipment/index.js';
+export type { JsonLdSubscription, Subscription } from '../classes/subscription/index.js';
+export type { JsonLdSubscriptionRequest, SubscriptionRequest, } from '../classes/subscription-request/index.js';
+export type { JsonLdTransportMovement, TransportMovement, } from '../classes/transport-movement/index.js';
+export type { JsonLdVerification, UnverifiedVerification, Verification, } from '../classes/verification/index.js';
+export type { JsonLdVerificationRequest, VerificationRequest, } from '../classes/verification-request/index.js';
+export type { JsonLdWaybill, Waybill } from '../classes/waybill/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAIA,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC7E,YAAY,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AACvD,YAAY,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAA;AAC5E,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnF,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGvF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uCAAuC,CAAA;AAC9C,YAAY,EACV,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,+CAA+C,CAAA;AACtD,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC5F,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AACzE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AACzE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC5F,YAAY,EACV,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAA;AACnD,YAAY,EACV,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,yCAAyC,CAAA;AAChD,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC/F,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC/F,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAClG,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AACzF,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACtE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC5F,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAClG,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAC5E,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAA;AAC/F,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AACzF,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AACxF,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAA;AAC/E,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AACxF,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACnE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACtE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACnE,YAAY,EACV,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,wCAAwC,CAAA;AAC/C,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AAC5E,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AACxF,YAAY,EACV,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,0CAA0C,CAAA;AACjD,YAAY,EACV,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,wCAAwC,CAAA;AAC/C,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,GACb,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,0CAA0C,CAAA;AACjD,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/types/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":""}

package/dist/util/deep-freeze.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Recursively freeze an object and every nested object/array.
+ * Used by STATE_DIAGRAM (Task 54) and createMapper bound limits (Task 76)
+ * so that nested mutation (e.g. STATE_DIAGRAM.X.Y.Z.accept.nextType = 'Pwn')
+ * is rejected at runtime, not just at compile time via `as const`.
+ */
+export declare function deepFreeze<T>(value: T): Readonly<T>;
+//# sourceMappingURL=deep-freeze.d.ts.map

package/dist/util/deep-freeze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-freeze.d.ts","sourceRoot":"","sources":["../../src/util/deep-freeze.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAUnD"}

package/dist/util/deep-freeze.js

@@ -0,0 +1,21 @@
+/**
+ * Recursively freeze an object and every nested object/array.
+ * Used by STATE_DIAGRAM (Task 54) and createMapper bound limits (Task 76)
+ * so that nested mutation (e.g. STATE_DIAGRAM.X.Y.Z.accept.nextType = 'Pwn')
+ * is rejected at runtime, not just at compile time via `as const`.
+ */
+export function deepFreeze(value) {
+    if (value === null || typeof value !== 'object' || Object.isFrozen(value))
+        return value;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            deepFreeze(item);
+    }
+    else {
+        for (const k of Object.getOwnPropertyNames(value)) {
+            deepFreeze(value[k]);
+        }
+    }
+    return Object.freeze(value);
+}
+//# sourceMappingURL=deep-freeze.js.map

package/dist/util/deep-freeze.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-freeze.js","sourceRoot":"","sources":["../../src/util/deep-freeze.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAI,KAAQ;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACvF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,UAAU,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,UAAU,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,23 @@
+export { CARGO_CONTEXT_IRI, API_CONTEXT_IRI, ALLOWED_CONTEXTS, assertContextAllowed, } from './context.js';
+export declare const __VERSION__: "0.0.0-prerelease";
+export declare const CARGO_ONTOLOGY_VERSION: "3.2";
+export declare const API_SPEC_VERSION: "2.2.0";
+import type { ServerInformation } from './classes/server-information/index.js';
+/**
+ * Hard-fail if the consumer's expected ontology version does not match
+ * the mapper's pin. Use at consumer startup to surface mismatch loudly.
+ */
+export declare function assertOntologyVersion(expected: string): void;
+export interface ServerCompatibility {
+    compatible: boolean;
+    mapperOntologyVersion: string;
+    serverOntologyVersion: string | null;
+    reason?: string;
+}
+/**
+ * Inspect a deserialized `ServerInformation` and report compatibility with
+ * this mapper's ontology pin. Returns structured result rather than throwing
+ * so consumers can warn-and-continue or hard-fail per their policy.
+ */
+export declare function checkServerInformation(si: ServerInformation): ServerCompatibility;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,cAAc,CAAA;AAErB,eAAO,MAAM,WAAW,EAAG,kBAA2B,CAAA;AACtD,eAAO,MAAM,sBAAsB,EAAG,KAAc,CAAA;AACpD,eAAO,MAAM,gBAAgB,EAAG,OAAgB,CAAA;AAGhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAG9E;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAY5D;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,CAAA;IACnB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,iBAAiB,GAAG,mBAAmB,CAuBjF"}

package/dist/version.js

@@ -0,0 +1,49 @@
+// src/version.ts
+export { CARGO_CONTEXT_IRI, API_CONTEXT_IRI, ALLOWED_CONTEXTS, assertContextAllowed, } from './context.js';
+export const __VERSION__ = '0.0.0-prerelease';
+export const CARGO_ONTOLOGY_VERSION = '3.2';
+export const API_SPEC_VERSION = '2.2.0';
+/**
+ * Hard-fail if the consumer's expected ontology version does not match
+ * the mapper's pin. Use at consumer startup to surface mismatch loudly.
+ */
+export function assertOntologyVersion(expected) {
+    if (expected !== CARGO_ONTOLOGY_VERSION) {
+        const error = {
+            kind: 'incompatible_ontology_version',
+            serverVersion: expected,
+            mapperVersion: CARGO_ONTOLOGY_VERSION,
+        };
+        throw new Error(`incompatible_ontology_version: expected=${expected} mapper=${CARGO_ONTOLOGY_VERSION}`, { cause: error });
+    }
+}
+/**
+ * Inspect a deserialized `ServerInformation` and report compatibility with
+ * this mapper's ontology pin. Returns structured result rather than throwing
+ * so consumers can warn-and-continue or hard-fail per their policy.
+ */
+export function checkServerInformation(si) {
+    const serverOntologyVersion = si.cargoOntologyVersion ?? null;
+    if (serverOntologyVersion === null) {
+        return {
+            compatible: false,
+            mapperOntologyVersion: CARGO_ONTOLOGY_VERSION,
+            serverOntologyVersion: null,
+            reason: 'ServerInformation did not advertise cargoOntologyVersion',
+        };
+    }
+    if (serverOntologyVersion !== CARGO_ONTOLOGY_VERSION) {
+        return {
+            compatible: false,
+            mapperOntologyVersion: CARGO_ONTOLOGY_VERSION,
+            serverOntologyVersion,
+            reason: `Server reports cargoOntologyVersion=${serverOntologyVersion}, mapper pinned to ${CARGO_ONTOLOGY_VERSION}`,
+        };
+    }
+    return {
+        compatible: true,
+        mapperOntologyVersion: CARGO_ONTOLOGY_VERSION,
+        serverOntologyVersion,
+    };
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,iBAAiB;AACjB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,cAAc,CAAA;AAErB,MAAM,CAAC,MAAM,WAAW,GAAG,kBAA2B,CAAA;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAc,CAAA;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAgB,CAAA;AAMhD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,MAAM,KAAK,GAAe;YACxB,IAAI,EAAE,+BAA+B;YACrC,aAAa,EAAE,QAAQ;YACvB,aAAa,EAAE,sBAAsB;SACtC,CAAA;QACD,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,WAAW,sBAAsB,EAAE,EACtF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAA;IACH,CAAC;AACH,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAqB;IAC1D,MAAM,qBAAqB,GAAG,EAAE,CAAC,oBAAoB,IAAI,IAAI,CAAA;IAC7D,IAAI,qBAAqB,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,sBAAsB;YAC7C,qBAAqB,EAAE,IAAI;YAC3B,MAAM,EAAE,0DAA0D;SACnE,CAAA;IACH,CAAC;IACD,IAAI,qBAAqB,KAAK,sBAAsB,EAAE,CAAC;QACrD,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,qBAAqB,EAAE,sBAAsB;YAC7C,qBAAqB;YACrB,MAAM,EAAE,uCAAuC,qBAAqB,sBAAsB,sBAAsB,EAAE;SACnH,CAAA;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,qBAAqB,EAAE,sBAAsB;QAC7C,qBAAqB;KACtB,CAAA;AACH,CAAC"}

package/package.json

@@ -0,0 +1,88 @@
+{
+  "name": "@flaks/onerecord",
+  "version": "0.1.2",
+  "description": "Zero-dependency Zod-first JSON-LD mapper for IATA OneRecord cargo data model 3.2 + API spec 2.2.0",
+  "type": "module",
+  "license": "Apache-2.0",
+  "author": "tjo099 <tjo099@gmail.com>",
+  "homepage": "https://github.com/tjo099/onerecord-mapper",
+  "bugs": "https://github.com/tjo099/onerecord-mapper/issues",
+  "keywords": [
+    "onerecord",
+    "iata",
+    "cargo",
+    "air-cargo",
+    "logistics",
+    "json-ld",
+    "zod",
+    "typescript",
+    "mapper",
+    "schema",
+    "validation",
+    "waybill",
+    "shipment",
+    "booking",
+    "ontology"
+  ],
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tjo099/onerecord-mapper.git"
+  },
+  "engines": {
+    "node": ">=20.0.0",
+    "bun": "1.3.x"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./types": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/types/index.js"
+    },
+    "./codecs": {
+      "types": "./dist/codecs.d.ts",
+      "import": "./dist/codecs.js"
+    },
+    "./package.json": {
+      "default": "./package.json"
+    }
+  },
+  "files": ["dist/", "LICENSE", "NOTICE", "README.md", "CHANGELOG.md", "MIGRATING.md", "SECURITY.md"],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepare": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check src/ test/",
+    "lint:fix": "biome check --write src/ test/",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "test:bench": "vitest bench",
+    "test:contract": "vitest run test/contract",
+    "test:property": "vitest run test/property",
+    "audit:bun": "bun audit",
+    "audit:osv": "npx --yes osv-scanner@latest --lockfile=bun.lock",
+    "audit": "bun run audit:bun; bun run audit:osv",
+    "secrets:scan": "npx --yes gitleaks@latest detect --source . --no-banner",
+    "api:check": "npx --yes @arethetypeswrong/cli@latest --pack ."
+  },
+  "dependencies": {
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.16.0",
+    "@biomejs/biome": "^1.9.0",
+    "@types/node": "^20.14.0",
+    "@vitest/coverage-v8": "^2.1.0",
+    "fast-check": "^3.22.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0",
+    "xlsx": "^0.18.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}