@forgezero/runtime 0.1.3 → 0.1.5

package/dist/schema-typebox.js

@@ -21,6 +21,7 @@ var DEFAULT_RESTRICTIONS = {
   maxDepth: 4,
   maxFields: 100,
   maxBytes: 64 * 1024,
+  maxArrayItems: 1000,
   forbidden: ["$ref", "$id", "$dynamicRef", "$dynamicAnchor", "$schema", "definitions", "$defs"]
 };
 function restrictJsonSchema(schema, limits = DEFAULT_RESTRICTIONS) {
@@ -59,8 +60,20 @@ function restrictJsonSchema(schema, limits = DEFAULT_RESTRICTIONS) {
         walk(properties[name], depth + 1, path ? `${path}.${name}` : name);
       }
     }
-    if (record.type === "array" && record.items) {
-      walk(record.items, depth + 1, `${path}[]`);
+    if (record.type === "array") {
+      const maximum = record.maxItems;
+      if (!Number.isInteger(maximum) || maximum < 0) {
+        throw new SchemaError("SCHEMA_ARRAY_UNBOUNDED", "Arrays must declare a finite non-negative integer maxItems.", path || "(root)");
+      }
+      if (maximum > limits.maxArrayItems) {
+        throw new SchemaError("SCHEMA_ARRAY_TOO_LARGE", `Array maxItems ${maximum} exceeds the platform limit of ${limits.maxArrayItems}.`, path || "(root)");
+      }
+      const minimum = record.minItems;
+      if (minimum !== undefined && (!Number.isInteger(minimum) || minimum < 0 || minimum > maximum)) {
+        throw new SchemaError("SCHEMA_ARRAY_BOUNDS_INVALID", "minItems must be a non-negative integer no larger than maxItems.", path || "(root)");
+      }
+      if (record.items)
+        walk(record.items, depth + 1, `${path}[]`);
     }
   };
   walk(schema, 1, "");
@@ -194,7 +207,24 @@ function parse(schema, value) {
   const first = result.errors[0];
   throw new SchemaError("SCHEMA_INVALID", first?.message ?? "Value does not match schema", first?.path);
 }
+function typeboxQueryCodec(schema) {
+  const issues = (value) => [...Value.Errors(schema, value)].map((error) => ({
+    path: error.path || "(root)",
+    message: error.message
+  }));
+  return {
+    schema,
+    decode(value) {
+      const converted = Value.Convert(schema, value);
+      return Value.Check(schema, converted) ? { ok: true, value: Value.Clean(schema, converted) } : { ok: false, issues: issues(converted) };
+    },
+    encode(value) {
+      return Value.Check(schema, value) ? { ok: true, value: Value.Clean(schema, value) } : { ok: false, issues: issues(value) };
+    }
+  };
+}
 export {
+  typeboxQueryCodec,
   typebox,
   parse,
   Type as T

package/dist/schema.d.ts

@@ -38,6 +38,8 @@ export interface Restrictions {
     maxDepth: number;
     maxFields: number;
     maxBytes: number;
+    /** Largest caller-authored array a persisted value may contain. */
+    maxArrayItems: number;
     /** Keywords refused outright, wherever they appear. */
     forbidden: readonly string[];
 }

package/dist/schema.js

@@ -21,6 +21,7 @@ var DEFAULT_RESTRICTIONS = {
   maxDepth: 4,
   maxFields: 100,
   maxBytes: 64 * 1024,
+  maxArrayItems: 1000,
   forbidden: ["$ref", "$id", "$dynamicRef", "$dynamicAnchor", "$schema", "definitions", "$defs"]
 };
 function restrictJsonSchema(schema, limits = DEFAULT_RESTRICTIONS) {
@@ -59,8 +60,20 @@ function restrictJsonSchema(schema, limits = DEFAULT_RESTRICTIONS) {
         walk(properties[name], depth + 1, path ? `${path}.${name}` : name);
       }
     }
-    if (record.type === "array" && record.items) {
-      walk(record.items, depth + 1, `${path}[]`);
+    if (record.type === "array") {
+      const maximum = record.maxItems;
+      if (!Number.isInteger(maximum) || maximum < 0) {
+        throw new SchemaError("SCHEMA_ARRAY_UNBOUNDED", "Arrays must declare a finite non-negative integer maxItems.", path || "(root)");
+      }
+      if (maximum > limits.maxArrayItems) {
+        throw new SchemaError("SCHEMA_ARRAY_TOO_LARGE", `Array maxItems ${maximum} exceeds the platform limit of ${limits.maxArrayItems}.`, path || "(root)");
+      }
+      const minimum = record.minItems;
+      if (minimum !== undefined && (!Number.isInteger(minimum) || minimum < 0 || minimum > maximum)) {
+        throw new SchemaError("SCHEMA_ARRAY_BOUNDS_INVALID", "minItems must be a non-negative integer no larger than maxItems.", path || "(root)");
+      }
+      if (record.items)
+        walk(record.items, depth + 1, `${path}[]`);
     }
   };
   walk(schema, 1, "");

package/package.json

@@ -1,10 +1,10 @@
 {
-	"//": "Publishing happens from an operator's machine, not CI \u2014 CLAUDE.md records that the absence of CI is deliberate. npm's `provenance` attests a tarball was built by a recognised CI provider from a named commit, so it cannot be produced here: it was set, and the first publish failed with `Automatic provenance generation not supported for provider: null`. A setting that can never be satisfied is worse than none, because it reads as a guarantee nobody is getting. Restore it the day this publishes from CI, and not before.",
 	"name": "@forgezero/runtime",
-	"version": "0.1.3",
+	"version": "0.1.5",
 	"type": "module",
-	"publishConfig": {
-		"access": "public"
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
 	},
 	"exports": {
 		"./jobs": {
@@ -43,6 +43,10 @@
 			"types": "./dist/schema-typebox.d.ts",
 			"default": "./dist/schema-typebox.js"
 		},
+		"./query": {
+			"types": "./dist/query.d.ts",
+			"default": "./dist/query.js"
+		},
 		"./calendar": {
 			"types": "./dist/calendar.d.ts",
 			"default": "./dist/calendar.js"
@@ -179,7 +183,7 @@
 	"scripts": {
 		"check": "tsc --noEmit",
 		"prebuild": "rm -rf dist",
-		"build": "bun build src/jobs.ts src/queue.ts src/outbox.ts src/audit.ts src/backup.ts src/notify.ts src/notify-templates.ts src/calendar.ts src/compliance.ts src/pipeline.ts src/totp.ts src/otpauth.ts src/identity.ts src/slip10.ts src/openssh.ts src/ssh-cert.ts src/importers.ts src/snp.ts src/passkey.ts src/custody-crypto.ts src/custody-share.ts src/phrase.ts src/ssh-agent.ts src/schema.ts src/schema-typebox.ts src/finance/discounts.ts src/finance/money.ts src/finance/storage.ts src/finance/custody.ts src/finance/tax.ts src/finance/derive.ts src/finance/venues.ts src/finance/ledger.ts src/finance/rates.ts src/finance/transfers.ts src/finance/chain.ts src/finance/chain-addresses.ts src/finance/chain-deposits.ts src/finance/chain-withdrawals.ts src/finance/chain-reconcile.ts src/finance/market.ts src/finance/commission.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
+		"build": "bun build src/query.ts src/jobs.ts src/queue.ts src/outbox.ts src/audit.ts src/backup.ts src/notify.ts src/notify-templates.ts src/calendar.ts src/compliance.ts src/pipeline.ts src/totp.ts src/otpauth.ts src/identity.ts src/slip10.ts src/openssh.ts src/ssh-cert.ts src/importers.ts src/snp.ts src/passkey.ts src/custody-crypto.ts src/custody-share.ts src/phrase.ts src/ssh-agent.ts src/schema.ts src/schema-typebox.ts src/finance/discounts.ts src/finance/money.ts src/finance/storage.ts src/finance/custody.ts src/finance/tax.ts src/finance/derive.ts src/finance/venues.ts src/finance/ledger.ts src/finance/rates.ts src/finance/transfers.ts src/finance/chain.ts src/finance/chain-addresses.ts src/finance/chain-deposits.ts src/finance/chain-withdrawals.ts src/finance/chain-reconcile.ts src/finance/market.ts src/finance/commission.ts --root src --outdir dist --target browser --format esm --packages external && tsc --emitDeclarationOnly --declaration --noEmit false --outDir dist",
 		"prepublishOnly": "bun run check && bun run build"
 	},
 	"dependencies": {
@@ -242,7 +246,7 @@
 	"repository": {
 		"type": "git",
 		"url": "git+https://github.com/forgezero-net/packages.git",
-		"directory": "packages/runtime"
+		"directory": "runtime"
 	},
 	"bugs": "https://github.com/forgezero-net/packages/issues",
 	"sideEffects": false,