@mikrojs/native 0.18.3-next.20260829153835 → 0.19.0

package/CMakeLists.txt

@@ -43,7 +43,10 @@ set(MIKROJS_CORE_SOURCES
     src/mik_text_encoding.cpp
     src/mik_color.cpp
     src/mik_abort.cpp
+    src/mik_http_client.cpp
+    src/mik_wifi_client.cpp
     src/mik_cbor.cpp
+    src/mik_schema.cpp
     src/mik_result.cpp
     src/mik_console.cpp
     src/mik_sys.cpp
@@ -88,7 +91,7 @@ endif()
 include(cmake/mikrojs_bytecode.cmake)
 mikrojs_generate_bytecode(
     RUNTIME_DIR "${CMAKE_CURRENT_SOURCE_DIR}/runtime"
-    MODULES abort cbor env result schema fs http/helpers http/request i2c kv/nvs kv/rtc kv/shared module neopixel observable observable/lazy observable/operators ota ota/client ota/config pin pwm reader sleep spi sntp stdio stream sys test uart udp wifi
+    MODULES abort cbor env result schema fs i2c kv/nvs kv/rtc kv/shared module neopixel observable observable/lazy observable/operators ota ota/client ota/config pin pwm reader sleep spi sntp stdio stream sys test uart udp
     MODULE_PREFIX "mikro"
     SYMBOL_PREFIX "mikro"
     TARGET gen_bytecode
@@ -208,6 +211,8 @@ if(BUILD_TESTING)
         test/stream_test.cpp
         test/runtime_recycle_test.cpp
         test/udp_test.cpp
+        test/http_client_test.cpp
+        test/wifi_client_test.cpp
         test/observable_test.cpp
         test/unhandled_rejection_test.cpp
         test/ota_policy_test.cpp
@@ -215,6 +220,7 @@ if(BUILD_TESTING)
         test/ota_config_test.cpp
         test/ota_js_hooks_test.cpp
         test/ota_wire_fixtures_test.cpp
+        test/schema_conformance_test.cpp
         test/sys_codec_test.cpp
     )
 
@@ -234,9 +240,25 @@ if(BUILD_TESTING)
     )
     add_dependencies(mikrojs_tests gen_checkin_fixtures)
 
+    # ── Schema conformance fixtures ──────────────────────────────────
+    # mikro/schema has two implementations: @mikrojs/schema (host) and
+    # src/mik_schema.cpp (device). The generator records what core.ts does and
+    # test/schema_conformance_test.cpp replays it through the native module.
+    # Always regenerated so the fixtures cannot lag core.ts.
+    set(_SCHEMA_FIXTURE_DIR "${CMAKE_CURRENT_BINARY_DIR}/gen/schema-fixtures")
+    add_custom_target(gen_schema_fixtures
+        COMMAND node "${CMAKE_CURRENT_SOURCE_DIR}/scripts/gen-schema-fixtures.js"
+            "${_SCHEMA_FIXTURE_DIR}"
+        COMMENT "Generating schema conformance fixtures from @mikrojs/schema"
+        WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+        VERBATIM
+    )
+    add_dependencies(mikrojs_tests gen_schema_fixtures)
+
     target_link_libraries(mikrojs_tests PRIVATE mikrojs)
     target_compile_definitions(mikrojs_tests PRIVATE
-        "MIK_CHECKIN_FIXTURE_DIR=\"${_CHECKIN_FIXTURE_DIR}\"")
+        "MIK_CHECKIN_FIXTURE_DIR=\"${_CHECKIN_FIXTURE_DIR}\""
+        "MIK_SCHEMA_FIXTURE_DIR=\"${_SCHEMA_FIXTURE_DIR}\"")
     target_include_directories(mikrojs_tests PRIVATE
         "${CMAKE_CURRENT_SOURCE_DIR}/test"
         "${CMAKE_CURRENT_SOURCE_DIR}/deps/nanocbor/include"

package/include/mikrojs/private.h

@@ -115,6 +115,10 @@ struct MIKRuntime {
      * mik__result_ok_void. Safe to share because Result is immutable by
      * convention, and the singleton is frozen + non-extensible. */
     JSValue result_ok_void_singleton;
+    /* Shared BodyConsumedError constructor for the native mikro/http/helpers
+     * module. Created lazily on first http module init, freed in
+     * MIK_FreeRuntime. */
+    JSValue http_body_consumed_ctor;
     JSValue env_obj;  /* Frozen object with env vars, set on import.meta.env */
     struct {
         JSValue on_data;  /* JS callback for stdin data, JS_UNDEFINED when not listening */
@@ -255,9 +259,33 @@ std::string mik_inspect(JSContext* ctx, JSValue value, int depth = 2, bool color
                         bool show_hidden = false);
 void mik__inspect_register(JSContext* ctx);
 
+/* HTTP client modules mikro/http/helpers + mikro/http/request
+ * (mik_http_client.cpp). Loaded lazily via the C-module table in
+ * modules.cpp, not registered at runtime creation. */
+JSModuleDef* mik__http_helpers_load(JSContext* ctx);
+JSModuleDef* mik__http_request_load(JSContext* ctx);
+
+/* Wifi client module mikro/wifi (mik_wifi_client.cpp), same lazy table. */
+JSModuleDef* mik__wifi_client_load(JSContext* ctx);
+
+/* Load `specifier` through the module loader on behalf of `importer` and
+ * return its namespace (modules.cpp). Honors virtual-module overrides. */
+JSValue mik__load_module_ns(JSContext* ctx, const char* importer, const char* specifier,
+                            bool require_evaluated);
+
+/* Timer registry (timers.cpp) — direct scheduling for native callbacks that
+ * must not go through the JS setTimeout global. Schedule dups `func`. */
+uint32_t MIK_Timer_Schedule(MIKTimers* timers, JSContext* ctx, JSValue func, int argc,
+                            const JSValue* argv, int64_t timeout, bool is_interval, int64_t now);
+bool MIK_Timer_UnSchedule(MIKTimers* timers, JSContext* ctx, uint32_t id);
+
 /* CBOR module (mik_cbor.cpp) */
 JSModuleDef* mik__cbor_init(JSContext* ctx);
 
+/* Schema module (mik_schema.cpp). Registered lazily: the loader calls its
+ * init on first import of native:mikro/schema. */
+void mik__schema_register(void);
+
 /* Result module (mik_result.cpp) */
 JSModuleDef* mik__result_init(JSContext* ctx);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikrojs/native",
-  "version": "0.18.3-next.20260829153835",
+  "version": "0.19.0",
   "description": "Mikro.js C++ runtime library and Node.js native addon",
   "keywords": [
     "esp32",
@@ -70,8 +70,6 @@
     "./runtime/reader/types": "./runtime/reader/types.ts",
     "./runtime/result/native-result.node-shim": "./dist/runtime/result/native-result.node-shim.js",
     "./runtime/result/types": "./runtime/result/types.ts",
-    "./runtime/schema/core": "./dist/runtime/schema/core.js",
-    "./runtime/schema/shared": "./dist/runtime/schema/shared.js",
     "./runtime/schema/types": "./runtime/schema/types.ts",
     "./runtime/sleep/types": "./runtime/sleep/types.ts",
     "./runtime/sntp/types": "./runtime/sntp/types.ts",
@@ -88,14 +86,15 @@
     "cmake-js": "^8.0.0",
     "node-addon-api": "^8.7.0",
     "node-gyp-build": "^4.8.4",
-    "@mikrojs/quickjs": "0.18.3-next.20260829153835+bf6b328"
+    "@mikrojs/quickjs": "0.19.0"
   },
   "devDependencies": {
     "@swc/core": "^1.15.30",
     "@types/node": "^24.12.2",
     "esbuild": "^0.28.0",
     "terser": "^5.46.2",
-    "@mikrojs/registry": "0.18.3-next.20260829153835+bf6b328"
+    "@mikrojs/registry": "0.19.0",
+    "@mikrojs/schema": "0.19.0"
   },
   "engines": {
     "node": ">=24.0.0"

package/runtime/http/helpers.ts

@@ -2,6 +2,11 @@
 // `native:mikro/http`. Apps driving HTTP through a non-lwIP transport (e.g. an
 // LTE modem over UART) implement the `Request` type directly and reuse
 // `prepareBody` + `makeResponse` for the boring parts.
+//
+// On-device, `mikro/http/helpers` is the native C module in
+// src/mik_http_client.cpp (behavior pinned by test/http_client_test.cpp).
+// This TS source stays as the type surface and as the Node-side double for
+// the http/server vitest suite.
 
 import {err, ok} from 'mikro/result'
 

package/runtime/internal.d.ts

@@ -26,6 +26,34 @@ declare module 'native:mikro/cbor' {
   export function decode(data: Uint8Array): Result<unknown, CborError>
 }
 
+declare module 'native:mikro/schema' {
+  import type * as S from '@mikrojs/native/runtime/schema/types'
+  /* typeof-aliased rather than re-exported: `export ... from` inside an
+   * ambient module declaration resolves to never, and writing the generic
+   * signatures out again here would be a third copy of the surface. */
+  export const string: typeof S.string
+  export const number: typeof S.number
+  export const boolean: typeof S.boolean
+  export const unknown: typeof S.unknown
+  export const literal: typeof S.literal
+  export const array: typeof S.array
+  export const object: typeof S.object
+  export const tuple: typeof S.tuple
+  export const optional: typeof S.optional
+  export const union: typeof S.union
+  export const enumOf: typeof S.enumOf
+  export const taggedUnion: typeof S.taggedUnion
+  export const applyDefaults: typeof S.applyDefaults
+  export const SchemaError: typeof S.SchemaError
+  /* The plain {ok, error} envelope core.ts's local err() builds, not a
+   * mikro/result Result: parse() in schema.ts wraps it. */
+  export function validate(
+    schema: S.Schema,
+    value: unknown,
+    path: string,
+  ): {ok: false; error: S.SchemaError} | null
+}
+
 declare module 'native:mikro/result' {
   import type {ErrResult, OkResult} from './result/types.js'
   export function ok(): OkResult<void>

package/runtime/ota/types.ts

@@ -374,9 +374,9 @@ export interface Ota {
    * `applyConfig`, with `trialBoots`), and validate the offer fields (exactly
    * `parseOffer(raw)`, with `allowInsecure`). An empty or null response is
    * the registry's quiet round: nothing to deliver, and the confirm still
-   * happens, which is the point of calling. A response that is anything else,
-   * a string or a number, never decoded (a captive portal's HTML, a proxy's
-   * error page), so it is not a completed round: nothing settles, and the
+   * happens, which is the point of calling. A response of any other shape
+   * never decoded: a captive portal handed back HTML, or a proxy sent an
+   * error page. That is not a completed round, so nothing settles and the
    * confirm does not run.
    *
    * Never call it on a failed request: a check-in that did not complete

package/runtime/schema/schema.ts

@@ -1,7 +1,20 @@
+/* mikro/schema. The constructors, the validator and applyDefaults are native
+ * (src/mik_schema.cpp); all this adds is the Result-returning parse(), which
+ * is the only part that needs mikro/result.
+ *
+ * @mikrojs/schema is the same DSL in TypeScript and is what the host
+ * runs (the CLI evaluating mikro.config.ts, the registry, vitest). The two are
+ * held together by scripts/gen-schema-fixtures.js and
+ * test/schema_conformance_test.cpp — change core.ts first, then mik_schema.cpp.
+ *
+ * validate() is deliberately not re-exported: parse() is the public entry, and
+ * that has been true since this module was bytecode. */
+
 import {err, ok} from 'mikro/result'
+import {validate} from 'native:mikro/schema'
 
 import type {Result} from '../result/types.js'
-import {type Infer, type Schema, type SchemaError, validate} from './core.js'
+import type {Infer, Schema, SchemaError} from './types.js'
 
 export type {
   ArrayOptions,
@@ -28,7 +41,7 @@ export type {
   UnionSchema,
   Unit,
   UnknownSchema,
-} from './core.js'
+} from './types.js'
 export {
   applyDefaults,
   array,
@@ -44,7 +57,7 @@ export {
   tuple,
   union,
   unknown,
-} from './core.js'
+} from 'native:mikro/schema'
 
 export function parse<S extends Schema>(schema: S, value: unknown): Result<Infer<S>, SchemaError> {
   const result = validate(schema, value, '')

package/runtime/schema/types.ts

@@ -281,7 +281,7 @@ export type InferRead<S> =
       : Simplify<InferReadObject<Shape>>
     : Infer<S>
 
-/* Kept in lockstep with core.ts (and materializeDefaults in shared.ts). */
+/* Kept in lockstep with @mikrojs/schema (and its materializeDefaults). */
 type Filled<S> = S extends {default: unknown}
   ? true
   : S extends OptionalSchema

package/runtime/test/test.ts

@@ -510,13 +510,17 @@ async function run(): Promise<void> {
       } catch (e) {
         const msg = formatThrown(e)
         emit({e: 7, s: suite.name, m: msg})
+        // Fail the suite's tests rather than skip them: a broken beforeAll is
+        // a broken run, and skipping made it indistinguishable from a
+        // deliberate gate. The e:7 above carries the real error; the per-test
+        // message just points at it.
         for (const t of suite.tests) {
           if (t.todo) {
             emit({e: 9, s: suite.name, t: t.name})
             todo++
           } else {
-            emit({e: 4, s: suite.name, t: t.name})
-            skipped++
+            emit({e: 3, s: suite.name, t: t.name, d: 0, m: 'beforeAll failed'})
+            failed++
           }
         }
         emit({e: 5, s: suite.name})

package/runtime/wifi/types.ts

@@ -1,3 +1,6 @@
+/* Type surface for mikro/wifi. On-device the module is the native
+ * implementation in src/mik_wifi_client.cpp (behavior pinned by
+ * test/wifi_client_test.cpp). */
 import type {Observable} from '../observable/types.js'
 import type {Result} from '../result/types.js'
 

package/scripts/gen-schema-fixtures.js

@@ -0,0 +1,317 @@
+/**
+ * Schema conformance fixtures: every case is run through the TypeScript
+ * implementation here and its outcome recorded, then replayed through the
+ * native module by test/schema_conformance_test.cpp.
+ *
+ * `mikro/schema` has two implementations of one contract: @mikrojs/schema
+ * (host: the CLI evaluating mikro.config.ts, the registry, vitest) and
+ * src/mik_schema.cpp (device). Two independent suites are not enough to keep
+ * them together — the check-in wire had exactly this shape and drifted while
+ * both suites stayed green (see test/ota_wire_fixtures_test.cpp). These
+ * fixtures make the C++ answer the same questions the TypeScript answered.
+ *
+ * The recorded outcome is whatever core.ts does, bugs included. That is the
+ * point: this file proves the two agree, and the vitest suite proves core.ts is
+ * right. Regenerated on every test build so it cannot lag.
+ *
+ * Usage: node gen-schema-fixtures.js <outdir>
+ */
+
+import {mkdirSync, writeFileSync} from 'node:fs'
+import {join} from 'node:path'
+
+/* The source, not the package specifier: Node would resolve @mikrojs/schema
+ * through its `import` condition to dist and make this need a build first. */
+const s = await import('../../schema/src/core.ts')
+
+const outDir = process.argv[2]
+if (!outDir) {
+  // eslint-disable-next-line no-console
+  console.error('Usage: gen-schema-fixtures.js <outdir>')
+  process.exit(1)
+}
+
+/* ── Cases ─────────────────────────────────────────────────────────── */
+
+/* Constructor calls: the driver does S[call](...args) and compares the node it
+ * builds, or the TypeError message it throws. Args are plain data because a
+ * schema is plain data — that is what makes the same list drivable from C++. */
+const CONSTRUCT_CASES = [
+  ['string()', 'string', []],
+  ['string with annotations', 'string', [{title: 'Name', description: 'Who', default: 'a'}]],
+  ['string with constraints', 'string', [{minLength: 1, maxLength: 8, format: 'email'}]],
+  ['string masked', 'string', [{mask: true}]],
+  ['number()', 'number', []],
+  ['number with bounds', 'number', [{min: 0, max: 10, integer: true, unit: 'ms'}]],
+  ['number with default', 'number', [{default: 5}]],
+  ['boolean with default', 'boolean', [{default: true}]],
+  ['unknown()', 'unknown', []],
+  ['literal string', 'literal', ['on']],
+  ['literal number with title', 'literal', [3, {title: 'Three'}]],
+  ['literal boolean', 'literal', [false]],
+  ['array of numbers', 'array', [{kind: 'number'}]],
+  ['array with item bounds', 'array', [{kind: 'string'}, {minItems: 1, maxItems: 4}]],
+  ['array with default', 'array', [{kind: 'number'}, {default: [1, 2]}]],
+  ['object empty', 'object', [{}]],
+  ['object with fields', 'object', [{a: {kind: 'number'}, b: {kind: 'string'}}]],
+  ['object with title', 'object', [{a: {kind: 'number'}}, {title: 'Group'}]],
+  ['optional wraps', 'optional', [{kind: 'number'}]],
+  ['tuple', 'tuple', [[{kind: 'number'}, {kind: 'string'}]]],
+  ['union', 'union', [[{kind: 'number'}, {kind: 'string'}]]],
+  [
+    'enumOf',
+    'enumOf',
+    [
+      [
+        {value: 1, title: 'One'},
+        {value: 2, description: 'Two'},
+      ],
+    ],
+  ],
+  ['enumOf with default', 'enumOf', [[{value: 'a'}, {value: 'b'}], {default: 'b'}]],
+  [
+    'taggedUnion',
+    'taggedUnion',
+    ['type', {a: {kind: 'object', shape: {}}, b: {kind: 'object', shape: {}}}],
+  ],
+
+  // Authoring rejections. These are TypeErrors thrown where the schema is
+  // written, and they are as much a part of the contract as validation is.
+  ['object rejects a default', 'object', [{}, {default: {}}]],
+  ['optional rejects a defaulted inner', 'optional', [{kind: 'number', default: 1}]],
+  ['array rejects an inner default', 'array', [{kind: 'number', default: 1}]],
+  [
+    'array rejects a nested inner default',
+    'array',
+    [{kind: 'object', shape: {a: {kind: 'number', default: 1}}}],
+  ],
+  ['tuple rejects an inner default', 'tuple', [[{kind: 'number', default: 1}]]],
+  ['union rejects an inner default', 'union', [[{kind: 'number', default: 1}]]],
+  [
+    'taggedUnion rejects an inner default',
+    'taggedUnion',
+    ['t', {a: {kind: 'object', shape: {x: {kind: 'number', default: 1}}}}],
+  ],
+  ['default must match the node', 'number', [{default: 'nope'}]],
+  ['array default must match', 'array', [{kind: 'number'}, {default: ['nope']}]],
+  ['default must satisfy its own bound', 'number', [{min: 10, default: 5}]],
+  ['default within its bound is fine', 'number', [{min: 1, max: 10, default: 5}]],
+  ['default must satisfy minLength', 'string', [{minLength: 3, default: 'ab'}]],
+]
+
+/* Validation: schemas are built with the constructors for readability and
+ * serialized as data, which is what the device receives anyway. */
+const V = {
+  str: s.string(),
+  num: s.number(),
+  bool: s.boolean(),
+  unk: s.unknown(),
+  litOn: s.literal('on'),
+  lit3: s.literal(3),
+  arrNum: s.array(s.number()),
+  obj: s.object({a: s.number(), b: s.string()}),
+  objOpt: s.object({a: s.number(), b: s.optional(s.string())}),
+  nested: s.object({outer: s.object({inner: s.array(s.number())})}),
+  tup: s.tuple([s.number(), s.string()]),
+  uni: s.union([s.number(), s.string()]),
+  tagged: s.taggedUnion('type', {
+    move: s.object({x: s.number()}),
+    stop: s.object({}),
+  }),
+  optNum: s.optional(s.number()),
+  bounded: s.number({min: 0, max: 10}),
+  whole: s.number({integer: true}),
+  fractional: s.number({min: 0.5, max: 2.5}),
+  sized: s.string({minLength: 2, maxLength: 4}),
+  items: s.array(s.number(), {minItems: 1, maxItems: 3}),
+  emailed: s.string({format: 'email'}),
+  boundedObj: s.object({pin: s.number({min: 0, max: 30, integer: true})}),
+  /* The rule the two-pass arrangement got wrong: a union accepts what ANY
+   * member accepts, so 150 has to pass on the second member even though it
+   * matches the first member's shape and fails its bound. */
+  splitRange: s.union([s.number({max: 10}), s.number({min: 100})]),
+}
+
+const VALIDATE_CASES = [
+  ['string accepts', V.str, 'hello'],
+  ['string rejects a number', V.str, 42],
+  ['string rejects null', V.str, null],
+  ['string rejects undefined', V.str, undefined],
+  ['number accepts', V.num, 1.5],
+  ['number accepts a negative', V.num, -7],
+  ['number rejects NaN', V.num, NaN],
+  ['number rejects a string', V.num, '1'],
+  ['boolean accepts', V.bool, false],
+  ['boolean rejects 0', V.bool, 0],
+  ['unknown accepts a string', V.unk, 'x'],
+  ['unknown accepts undefined', V.unk, undefined],
+  ['unknown accepts an object', V.unk, {a: 1}],
+  ['literal accepts its value', V.litOn, 'on'],
+  ['literal rejects another string', V.litOn, 'off'],
+  ['literal number accepts', V.lit3, 3],
+  ['literal number rejects', V.lit3, 4],
+  ['literal reports undefined', V.lit3, undefined],
+  ['array accepts', V.arrNum, [1, 2, 3]],
+  ['array accepts empty', V.arrNum, []],
+  ['array rejects a non-array', V.arrNum, 'no'],
+  ['array rejects an object', V.arrNum, {}],
+  ['array reports the bad index', V.arrNum, [1, 'two', 3]],
+  ['object accepts', V.obj, {a: 1, b: 'x'}],
+  ['object ignores extra keys', V.obj, {a: 1, b: 'x', extra: true}],
+  ['object reports a missing field', V.obj, {a: 1}],
+  ['object reports a bad field', V.obj, {a: 1, b: 2}],
+  ['object rejects an array', V.obj, [1, 2]],
+  ['object rejects null', V.obj, null],
+  ['optional field may be absent', V.objOpt, {a: 1}],
+  ['optional field may be present', V.objOpt, {a: 1, b: 'x'}],
+  ['optional field still typechecked', V.objOpt, {a: 1, b: 2}],
+  ['nested reports a deep path', V.nested, {outer: {inner: [1, 'no']}}],
+  ['nested accepts', V.nested, {outer: {inner: []}}],
+  ['tuple accepts', V.tup, [1, 'x']],
+  ['tuple rejects a short one', V.tup, [1]],
+  ['tuple rejects a long one', V.tup, [1, 'x', 3]],
+  ['tuple reports a bad position', V.tup, ['x', 'x']],
+  ['union accepts the first', V.uni, 1],
+  ['union accepts the second', V.uni, 'x'],
+  ['union rejects neither', V.uni, true],
+  ['taggedUnion accepts a branch', V.tagged, {type: 'move', x: 1}],
+  ['taggedUnion accepts the empty branch', V.tagged, {type: 'stop'}],
+  ['taggedUnion reports a missing tag', V.tagged, {x: 1}],
+  ['taggedUnion reports an unknown tag', V.tagged, {type: 'spin'}],
+  ['taggedUnion reports a non-primitive tag', V.tagged, {type: {}}],
+  ['taggedUnion validates the branch', V.tagged, {type: 'move', x: 'no'}],
+  ['taggedUnion rejects an array', V.tagged, []],
+  ['bare optional accepts undefined', V.optNum, undefined],
+  ['bare optional accepts a value', V.optNum, 1],
+  ['bare optional rejects a bad value', V.optNum, 'x'],
+
+  /* Bounds. These used to be host-only; parse() now enforces everything except
+   * format and unit wherever it runs. */
+  ['min accepts the boundary', V.bounded, 0],
+  ['max accepts the boundary', V.bounded, 10],
+  ['below min rejected', V.bounded, -1],
+  ['above max rejected', V.bounded, 11],
+  ['integer accepts a whole number', V.whole, 4],
+  ['integer rejects a fraction', V.whole, 4.5],
+  ['integer rejects Infinity', V.whole, Infinity],
+  ['fractional bounds accept', V.fractional, 1.25],
+  ['fractional bounds report the bound as written', V.fractional, 0.25],
+  ['minLength accepts the boundary', V.sized, 'ab'],
+  ['maxLength accepts the boundary', V.sized, 'abcd'],
+  ['shorter than minLength rejected', V.sized, 'a'],
+  ['longer than maxLength rejected', V.sized, 'abcde'],
+  ['length counts UTF-16 units', V.sized, '\u{1F600}'],
+  ['minItems accepts the boundary', V.items, [1]],
+  ['maxItems accepts the boundary', V.items, [1, 2, 3]],
+  ['fewer than minItems rejected', V.items, []],
+  ['more than maxItems rejected', V.items, [1, 2, 3, 4]],
+  ['length is checked before elements', V.items, [1, 2, 3, 'no']],
+  ['bounds report the field path', V.boundedObj, {pin: 200}],
+  ['format is not checked here', V.emailed, 'not-an-email'],
+  ['a union member failing its bound falls through', V.splitRange, 150],
+  ['a union with no member in range is rejected', V.splitRange, 50],
+
+  /* Prototype-chain hazards. core.ts uses Object.hasOwn at three sites so an
+   * inherited member cannot stand in for a field or a branch; JS_GetPropertyStr
+   * walks the prototype chain and would reopen exactly this. */
+  ['object does not read an inherited field', s.object({constructor: s.number()}), {}],
+  [
+    'object accepts a real constructor field',
+    s.object({constructor: s.number()}),
+    {constructor: 1},
+  ],
+  ['taggedUnion does not dispatch on an inherited tag', V.tagged, {type: 'constructor'}],
+  ['taggedUnion does not dispatch on toString', V.tagged, {type: 'toString'}],
+  ['object does not read an inherited __proto__', s.object({a: s.number()}), {}],
+]
+
+const APPLY_DEFAULTS_CASES = [
+  ['fills a scalar default', s.object({a: s.number({default: 5})}), undefined],
+  ['keeps a present value', s.object({a: s.number({default: 5})}), {a: 9}],
+  ['drops unknown keys', s.object({a: s.number({default: 5})}), {a: 1, z: 2}],
+  ['leaves an optional absent', s.object({a: s.optional(s.number())}), {}],
+  ['keeps a present optional', s.object({a: s.optional(s.number())}), {a: 1}],
+  ['recurses into nested objects', s.object({o: s.object({a: s.number({default: 2})})}), {}],
+  ['array default fills', s.object({a: s.array(s.number(), {default: [1]})}), {}],
+  ['array without a default is empty', s.object({a: s.array(s.number())}), {}],
+  ['a present non-object stays as-is', s.object({a: s.number()}), 42],
+  ['does not fill through an inherited key', s.object({constructor: s.number({default: 1})}), {}],
+  ['unknown passes through', s.unknown(), undefined],
+  ['scalar default at the root', s.number({default: 3}), undefined],
+  /* Hand-built AST: the constructors reject a default that breaks its own
+   * bound, but a schema that arrived as JSON ran none of them, and
+   * applyDefaults must still fill without validating. */
+  [
+    'a default outside its own bound still fills',
+    {kind: 'object', shape: {a: {kind: 'number', min: 10, default: 5}}},
+    {},
+  ],
+]
+
+/* ── Recording ─────────────────────────────────────────────────────── */
+
+function recordConstruct([name, call, args]) {
+  try {
+    return {name, kind: 'construct', call, args, expect: s[call](...args)}
+  } catch (e) {
+    return {name, kind: 'construct', call, args, throws: e.message}
+  }
+}
+
+function recordValidate([name, schema, value]) {
+  const result = s.validate(schema, value, '')
+  return {
+    name,
+    kind: 'validate',
+    schema,
+    value,
+    expect: result === null ? null : {message: result.error.message, path: result.error.path},
+  }
+}
+
+function recordApplyDefaults([name, schema, value]) {
+  return {name, kind: 'applyDefaults', schema, value, expect: s.applyDefaults(schema, value)}
+}
+
+/* ── Emitting ──────────────────────────────────────────────────────── */
+
+/* JS source, not JSON: the cases carry undefined and NaN, which JSON cannot
+ * represent and which are exactly the values the edge cases are about. */
+function js(value) {
+  if (value === undefined) return 'undefined'
+  if (value === null) return 'null'
+  if (typeof value === 'number') {
+    if (Number.isNaN(value)) return 'NaN'
+    if (value === Infinity) return 'Infinity'
+    if (value === -Infinity) return '-Infinity'
+    return String(value)
+  }
+  if (typeof value === 'string' || typeof value === 'boolean') return JSON.stringify(value)
+  if (Array.isArray(value)) return `[${value.map(js).join(',')}]`
+  if (typeof value === 'object') {
+    const body = Object.keys(value)
+      .map((k) => `${JSON.stringify(k)}:${js(value[k])}`)
+      .join(',')
+    return `{${body}}`
+  }
+  throw new TypeError(`cannot serialize ${typeof value}`)
+}
+
+const cases = [
+  ...CONSTRUCT_CASES.map(recordConstruct),
+  ...VALIDATE_CASES.map(recordValidate),
+  ...APPLY_DEFAULTS_CASES.map(recordApplyDefaults),
+]
+
+const body = cases.map((c) => `  ${js(c)},`).join('\n')
+const source = `/* GENERATED by scripts/gen-schema-fixtures.js. Do not edit. */
+const cases = [
+${body}
+]
+`
+
+mkdirSync(outDir, {recursive: true})
+writeFileSync(join(outDir, 'schema-fixtures.js'), source)
+
+// eslint-disable-next-line no-console
+console.log(`schema fixtures: ${cases.length} cases -> ${join(outDir, 'schema-fixtures.js')}`)

package/src/mik_app_config.cpp

@@ -337,7 +337,15 @@ int MIK_LoadConfig(const char* base_path, MIKConfig* config) {
                 config->stack_size = (size_t)num_val;
             }
             if (mik__json_get_number(buf, "memReserved", &num_val)) {
-                config->mem_reserved = (uint32_t)num_val;
+                /* The uint32 cast would wrap a negative value into a ~4 GB
+                 * reserve; keep the default instead. */
+                if (num_val < 0) {
+                    platform->log(MIK_LOG_WARN, TAG,
+                                  "Ignoring negative memReserved (%ld); using default",
+                                  (long)num_val);
+                } else {
+                    config->mem_reserved = (uint32_t)num_val;
+                }
             }
             if (mik__json_get_number(buf, "fsReadMax", &num_val)) {
                 config->fs_read_max = (uint32_t)num_val;