@nullix/zod-mongoose-studio 3.3.0 → 3.3.1

package/.output/server/node_modules/ip-address/dist/v4/constants.js

@@ -1,8 +1,51 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RE_SUBNET_STRING = exports.RE_ADDRESS = exports.GROUPS = exports.BITS = void 0;
+exports.SPECIAL_PURPOSE = exports.RE_SUBNET_STRING = exports.RE_ADDRESS = exports.GROUPS = exports.BITS = void 0;
 exports.BITS = 32;
 exports.GROUPS = 4;
-exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g;
+// Each octet is 0-255 written without a leading zero. A leading zero is
+// octal to the WHATWG URL parser, inet_aton, and getaddrinfo, but decimal to
+// parseInt(part, 10), so accepting the notation would make this library
+// disagree with the network stack about which host a string names.
+exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/g;
 exports.RE_SUBNET_STRING = /\/\d{1,2}$/;
+/**
+ * The IANA IPv4 Special-Purpose Address Registry
+ * (https://www.iana.org/assignments/iana-ipv4-special-registry/), one entry
+ * per block: `[cidr, name, globallyReachable]`. A `null` reachability means
+ * the registry leaves the column blank and the block inherits the answer of
+ * the block containing it (or is global when nothing contains it).
+ *
+ * `Address4.isGlobal()` answers from the most specific entry containing the
+ * address. `test/data/iana-corpus.json` is generated from the registry's CSV
+ * and pins this table to it.
+ */
+exports.SPECIAL_PURPOSE = [
+    ['0.0.0.0/8', 'This network', false],
+    ['0.0.0.0/32', 'This host on this network', false],
+    ['10.0.0.0/8', 'Private-Use', false],
+    ['100.64.0.0/10', 'Shared Address Space', false],
+    ['127.0.0.0/8', 'Loopback', false],
+    ['169.254.0.0/16', 'Link Local', false],
+    ['172.16.0.0/12', 'Private-Use', false],
+    ['192.0.0.0/24', 'IETF Protocol Assignments', false],
+    ['192.0.0.0/29', 'IPv4 Service Continuity Prefix', false],
+    ['192.0.0.8/32', 'IPv4 dummy address', false],
+    ['192.0.0.9/32', 'Port Control Protocol Anycast', true],
+    ['192.0.0.10/32', 'Traversal Using Relays around NAT Anycast', true],
+    ['192.0.0.170/32', 'NAT64/DNS64 Discovery', false],
+    ['192.0.0.171/32', 'NAT64/DNS64 Discovery', false],
+    ['192.0.2.0/24', 'Documentation (TEST-NET-1)', false],
+    ['192.31.196.0/24', 'AS112-v4', true],
+    ['192.52.193.0/24', 'AMT', true],
+    ['192.88.99.0/24', 'Deprecated (6to4 Relay Anycast)', null],
+    ['192.88.99.2/32', '6a44-relay anycast address', false],
+    ['192.168.0.0/16', 'Private-Use', false],
+    ['192.175.48.0/24', 'Direct Delegation AS112 Service', true],
+    ['198.18.0.0/15', 'Benchmarking', false],
+    ['198.51.100.0/24', 'Documentation (TEST-NET-2)', false],
+    ['203.0.113.0/24', 'Documentation (TEST-NET-3)', false],
+    ['240.0.0.0/4', 'Reserved', false],
+    ['255.255.255.255/32', 'Limited Broadcast', false],
+];
 //# sourceMappingURL=constants.js.map

package/.output/server/node_modules/ip-address/dist/v6/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RE_URL_WITH_PORT = exports.RE_URL = exports.RE_ZONE_STRING = exports.RE_SUBNET_STRING = exports.RE_BAD_ADDRESS = exports.RE_BAD_CHARACTERS = exports.TYPES = exports.SCOPES = exports.GROUPS = exports.BITS = void 0;
+exports.SPECIAL_PURPOSE = exports.RE_URL_WITH_PORT = exports.RE_URL = exports.RE_ZONE_STRING = exports.RE_SUBNET_STRING = exports.RE_BAD_ADDRESS = exports.RE_BAD_CHARACTERS = exports.TYPES = exports.SCOPES = exports.GROUPS = exports.BITS = void 0;
 exports.BITS = 128;
 exports.GROUPS = 8;
 /**
@@ -44,8 +44,20 @@ exports.TYPES = {
     'ff05::1:3/128': 'Multicast (All DHCP servers in this site)',
     '::/128': 'Unspecified',
     '::1/128': 'Loopback',
+    '::ffff:0:0/96': 'IPv4-mapped',
     'ff00::/8': 'Multicast',
     'fe80::/10': 'Link-local unicast',
+    'fc00::/7': 'Unique local',
+    '2001::/32': 'Teredo',
+    '2001:2::/48': 'Benchmarking',
+    '2002::/16': '6to4',
+    '2001:db8::/32': 'Documentation',
+    '3fff::/20': 'Documentation',
+    '100::/64': 'Discard-only',
+    'fec0::/10': 'Site-local unicast (deprecated)',
+    '::/96': 'IPv4-compatible (deprecated)',
+    '64:ff9b::/96': 'NAT64 (well-known)',
+    '64:ff9b:1::/48': 'NAT64 (local-use)',
 };
 /**
  * A regular expression that matches bad characters in an IPv6 address
@@ -71,6 +83,46 @@ exports.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/;
  * @static
  */
 exports.RE_ZONE_STRING = /%.*$/;
-exports.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/;
-exports.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
+exports.RE_URL = /^(?:\[([0-9a-f:.]+)\]|([0-9a-f:.]+))(?:[/?#].*)?$/i;
+exports.RE_URL_WITH_PORT = /^\[([0-9a-f:.]+)\]:([0-9]{1,5})(?:[/?#].*)?$/i;
+/**
+ * The IANA IPv6 Special-Purpose Address Registry
+ * (https://www.iana.org/assignments/iana-ipv6-special-registry/), one entry
+ * per block: `[cidr, name, globallyReachable]`. A `null` reachability means
+ * the registry says N/A or leaves the column blank; N/A blocks (Teredo, 6to4)
+ * are treated as not globally reachable, since a packet to one needs a relay,
+ * and blank blocks inherit the answer of the block containing them.
+ *
+ * `Address6.isGlobal()` answers from the most specific entry containing the
+ * address, after delegating IPv4-mapped and NAT64 well-known addresses to the
+ * embedded IPv4 address. `test/data/iana-corpus.json` is generated from the
+ * registry's CSV and pins this table to it.
+ */
+exports.SPECIAL_PURPOSE = [
+    ['::1/128', 'Loopback Address', false],
+    ['::/128', 'Unspecified Address', false],
+    ['::ffff:0:0/96', 'IPv4-mapped Address', false],
+    ['64:ff9b::/96', 'IPv4-IPv6 Translat.', true],
+    ['64:ff9b:1::/48', 'IPv4-IPv6 Translat.', false],
+    ['100::/64', 'Discard-Only Address Block', false],
+    ['100:0:0:1::/64', 'Dummy IPv6 Prefix', false],
+    ['2001::/23', 'IETF Protocol Assignments', false],
+    ['2001::/32', 'TEREDO', false],
+    ['2001:1::1/128', 'Port Control Protocol Anycast', true],
+    ['2001:1::2/128', 'Traversal Using Relays around NAT Anycast', true],
+    ['2001:1::3/128', 'DNS-SD Service Registration Protocol Anycast', true],
+    ['2001:2::/48', 'Benchmarking', false],
+    ['2001:3::/32', 'AMT', true],
+    ['2001:4:112::/48', 'AS112-v6', true],
+    ['2001:10::/28', 'Deprecated (previously ORCHID)', null],
+    ['2001:20::/28', 'ORCHIDv2', true],
+    ['2001:30::/28', 'Drone Remote ID Protocol Entity Tags (DETs) Prefix', true],
+    ['2001:db8::/32', 'Documentation', false],
+    ['2002::/16', '6to4', false],
+    ['2620:4f:8000::/48', 'Direct Delegation AS112 Service', true],
+    ['3fff::/20', 'Documentation', false],
+    ['5f00::/16', 'Segment Routing (SRv6) SIDs', false],
+    ['fc00::/7', 'Unique-Local', false],
+    ['fe80::/10', 'Link-Local Unicast', false],
+];
 //# sourceMappingURL=constants.js.map

package/.output/server/node_modules/ip-address/dist/v6/helpers.js

@@ -1,14 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeHtml = escapeHtml;
 exports.spanAllZeroes = spanAllZeroes;
 exports.spanAll = spanAll;
 exports.spanLeadingZeroes = spanLeadingZeroes;
 exports.simpleGroup = simpleGroup;
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
 /**
  * @returns {String} the string with all zeroes contained in a <span>
  */
 function spanAllZeroes(s) {
-    return s.replace(/(0+)/g, '<span class="zero">$1</span>');
+    return escapeHtml(s).replace(/(0+)/g, '<span class="zero">$1</span>');
 }
 /**
  * @returns {String} the string with each character contained in a <span>
@@ -16,11 +25,11 @@ function spanAllZeroes(s) {
 function spanAll(s, offset = 0) {
     const letters = s.split('');
     return letters
-        .map((n, i) => `<span class="digit value-${n} position-${i + offset}">${spanAllZeroes(n)}</span>`)
+        .map((n, i) => `<span class="digit value-${escapeHtml(n)} position-${i + offset}">${spanAllZeroes(n)}</span>`)
         .join('');
 }
 function spanLeadingZeroesSimple(group) {
-    return group.replace(/^(0+)/, '<span class="zero">$1</span>');
+    return escapeHtml(group).replace(/^(0+)/, '<span class="zero">$1</span>');
 }
 /**
  * @returns {String} the string with leading zeroes contained in a <span>

package/.output/server/node_modules/ip-address/package.json

@@ -2,77 +2,89 @@
   "name": "ip-address",
   "description": "A library for parsing IPv4 and IPv6 IP addresses in node and the browser.",
   "keywords": [
-    "ipv6",
+    "ip",
     "ipv4",
-    "browser",
-    "validation"
+    "ipv6",
+    "address",
+    "cidr",
+    "subnet",
+    "netmask",
+    "validate",
+    "validation",
+    "parse",
+    "arpa",
+    "bigint",
+    "browser"
   ],
-  "version": "10.1.0",
+  "version": "10.7.2",
   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
   "license": "MIT",
   "main": "dist/ip-address.js",
   "types": "dist/ip-address.d.ts",
   "scripts": {
-    "docs": "documentation build --github --output docs --format html ./ip-address.js",
+    "docs": "tsx scripts/build-readme.ts",
     "build": "rm -rf dist; mkdir dist; tsc",
-    "prepack": "npm run build",
-    "release": "release-it",
-    "test-ci": "nyc mocha",
+    "prepack": "npm run docs && npm run build",
+    "prepare": "git config core.hooksPath hooks || true",
+    "lint": "prettier --check . && eslint . --ext .ts,.js --max-warnings 0",
+    "lint:fix": "prettier --write . && eslint . --ext .ts,.js --max-warnings 0 --fix",
+    "test-ci": "c8 --experimental-monocart mocha",
     "test": "mocha",
     "watch": "mocha --watch"
   },
-  "nyc": {
-    "extension": [
-      ".ts"
+  "c8": {
+    "include": [
+      "src/**/*.ts"
     ],
     "exclude": [
       "**/*.d.ts",
-      ".eslintrc.js",
-      "coverage/",
-      "dist/",
-      "test/",
-      "tmp/"
+      "src/ip-address.ts",
+      "src/v4/constants.ts",
+      "src/v6/constants.ts"
     ],
     "reporter": [
       "html",
       "lcov",
       "text"
-    ],
-    "all": true
+    ]
   },
   "engines": {
     "node": ">= 12"
   },
+  "sideEffects": false,
   "files": [
-    "src",
     "dist"
   ],
   "repository": {
     "type": "git",
-    "url": "git://github.com/beaugunderson/ip-address.git"
+    "url": "https://github.com/beaugunderson/ip-address.git"
+  },
+  "overrides": {
+    "diff": "^8.0.3",
+    "serialize-javascript": "^7.0.5",
+    "@eslint/plugin-kit": "^0.7.1"
   },
   "devDependencies": {
-    "@types/chai": "^5.0.0",
-    "@types/mocha": "^10.0.8",
-    "@typescript-eslint/eslint-plugin": "^8.8.0",
-    "@typescript-eslint/parser": "^8.8.0",
-    "chai": "^5.1.1",
-    "documentation": "^14.0.3",
-    "eslint": "^8.50.0",
+    "@types/chai": "^5.2.3",
+    "@types/mocha": "^10.0.10",
+    "@typescript-eslint/eslint-plugin": "^8.59.1",
+    "@typescript-eslint/parser": "^8.59.1",
+    "c8": "^11.0.0",
+    "chai": "^6.2.2",
+    "eslint": "^8.57.1",
     "eslint_d": "^14.0.4",
-    "eslint-config-airbnb": "^19.0.4",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint-config-airbnb-base": "^15.0.0",
+    "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-filenames": "^1.3.2",
-    "eslint-plugin-import": "^2.30.0",
-    "eslint-plugin-jsx-a11y": "^6.10.0",
-    "eslint-plugin-prettier": "^5.2.1",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-sort-imports-es6-autofix": "^0.6.0",
-    "mocha": "^10.7.3",
-    "nyc": "^17.1.0",
-    "prettier": "^3.3.3",
-    "release-it": "^17.6.0",
+    "mocha": "^11.7.5",
+    "monocart-coverage-reports": "^2.12.11",
+    "prettier": "^3.8.3",
     "source-map-support": "^0.5.21",
-    "tsx": "^4.19.1",
+    "tsx": "^4.21.0",
+    "typedoc": "^0.28.19",
     "typescript": "<5.6.0"
   }
 }

package/.output/server/node_modules/ufo/dist/index.mjs

@@ -286,8 +286,8 @@ function withoutBase(input, base) {
   if (nextChar && nextChar !== "/" && nextChar !== "?") {
     return input;
   }
-  const trimmed = input.slice(_base.length);
-  return trimmed[0] === "/" ? trimmed : "/" + trimmed;
+  const trimmed = input.slice(_base.length).replace(/^\/+/, "");
+  return "/" + trimmed;
 }
 function withQuery(input, query) {
   const parsed = parseURL(input);

package/.output/server/node_modules/ufo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ufo",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "description": "URL utils for humans",
   "repository": "unjs/ufo",
   "license": "MIT",
@@ -31,18 +31,18 @@
     "test": "pnpm lint && vitest run --typecheck"
   },
   "devDependencies": {
-    "@types/node": "^25.0.8",
-    "@vitest/coverage-v8": "^4.0.17",
-    "automd": "^0.4.2",
+    "@types/node": "^25.6.0",
+    "@vitest/coverage-v8": "^4.1.5",
+    "automd": "^0.4.3",
     "changelogen": "^0.6.2",
-    "eslint": "^9.39.2",
+    "eslint": "^10.2.1",
     "eslint-config-unjs": "^0.6.2",
     "jiti": "^2.6.1",
-    "prettier": "^3.7.4",
-    "typescript": "^5.9.3",
+    "prettier": "^3.8.3",
+    "typescript": "^6.0.3",
     "unbuild": "^3.6.1",
     "untyped": "^2.0.0",
-    "vitest": "^4.0.17"
+    "vitest": "^4.1.5"
   },
-  "packageManager": "pnpm@10.28.0"
+  "packageManager": "pnpm@10.33.2"
 }

package/.output/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nullix/zod-mongoose-studio-prod",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "type": "module",
   "private": true,
   "dependencies": {
@@ -16,6 +16,7 @@
     "@vue/runtime-dom": "3.5.32",
     "@vue/server-renderer": "3.5.32",
     "@vue/shared": "3.5.32",
+    "acorn": "8.16.0",
     "bson": "7.2.0",
     "consola": "3.4.2",
     "devalue": "5.6.4",
@@ -23,7 +24,7 @@
     "esbuild": "0.28.0",
     "estree-walker": "2.0.2",
     "hookable": "6.1.0",
-    "ip-address": "10.1.0",
+    "ip-address": "10.7.2",
     "kareem": "3.3.0",
     "memory-pager": "1.5.0",
     "mongodb": "7.2.0",
@@ -41,7 +42,7 @@
     "sparse-bitfield": "3.0.3",
     "tailwindcss": "4.2.2",
     "tr46": "5.1.1",
-    "ufo": "1.6.3",
+    "ufo": "1.6.4",
     "unhead": "2.1.12",
     "vue": "3.5.32",
     "vue-bundle-renderer": "2.2.0",

package/README.md

@@ -1,23 +1,51 @@
-<img src="https://raw.githubusercontent.com/Harm-Nullix/zod-mongoose/HEAD/logo.svg" width="200" alt="Logo">
+<div align="center">
+  <img src="https://raw.githubusercontent.com/Harm-Nullix/zod-mongoose/HEAD/logo.svg" width="200" alt="Logo">
+</div>
+<div align="center">
 
 [![Release](https://github.com/Harm-Nullix/zod-mongoose/actions/workflows/release.yml/badge.svg)](https://github.com/Harm-Nullix/zod-mongoose/actions/workflows/release.yml)
-[![NPM Version](https://img.shields.io/npm/v/@nullix/zod-mongoose.svg)](https://www.npmjs.com/package/@nullix/zod-mongoose-studio)
-[![License](https://img.shields.io/npm/l/@nullix/zod-mongoose.svg)](https://github.com/Harm-Nullix/zod-mongoose/blob/main/packages/core/LICENSE.md)
+[![NPM Version](https://img.shields.io/npm/v/@nullix/zod-mongoose-studio.svg)](https://www.npmjs.com/package/@nullix/zod-mongoose-studio)
+[![NPM Downloads](https://img.shields.io/npm/dm/@nullix/zod-mongoose-studio.svg)](https://www.npmjs.com/package/@nullix/zod-mongoose-studio)
+[![TypeScript](https://img.shields.io/badge/TypeScript-Strict-blue.svg)](https://www.typescriptlang.org/)
+[![Node.js Version](https://img.shields.io/node/v/@nullix/zod-mongoose-studio.svg)](https://www.npmjs.com/package/@nullix/zod-mongoose-studio)
+[![License](https://img.shields.io/npm/l/@nullix/zod-mongoose.svg)](https://github.com/Harm-Nullix/zod-mongoose/blob/main/packages/studio/LICENSE.md)
+
+</div>
 
 
 # @nullix/zod-mongoose-studio
 
 A Monaco-powered TypeScript playground for [@nullix/zod-mongoose](https://github.com/Harm-Nullix/zod-mongoose). 
 
-The Studio provides a powerful web-integrated interface to experiment with Zod-to-Mongoose transformations. It supports local development via a CLI with full filesystem access and a sandboxed mode for documentation and live demos.
+The Studio provides a web-integrated interface to experiment with Zod validation and Zod-to-Mongoose transformations. It supports local development via a CLI and an embedded documentation mode.
 
 ## Goal
 
 Create a CLI tool and web-integrated "Studio" that provides:
-- A Monaco-powered TypeScript editor for Zod schemas.
-- Real-time transformation to Mongoose schema definitions and POJOs.
+- A Monaco-powered TypeScript editor for Zod schemas and a separate JSON data editor.
+- Parsed Zod output or field-level validation issues next to Mongoose conversion output.
+- Schema discovery, valid example data, and Run shortcuts.
 - **Local Mode**: Runs via `npx` with full filesystem bridge for IntelliSense in your project.
-- **Docs Mode**: A secure, sandboxed environment for embedding in documentation or static deployments.
+- **Docs Mode**: An embeddable playground that sends Run requests to a separate container runner through a Unix socket.
+
+## Studio workflow
+
+Define one or more Zod schemas in the TypeScript editor. `z` from `zod/v4` and the runtime exports of `@nullix/zod-mongoose` are available without import lines:
+
+```ts
+const UserSchema = z.object({
+  name: z.string().trim().min(2),
+  role: z.enum(['reader', 'admin']).default('reader'),
+});
+```
+
+Studio discovers top-level schemas automatically. When there are several, choose one from **Active schema**. Existing snippets using explicit imports and `export default` still work.
+
+Use the expand button in any panel header for a full Studio workspace, then press Escape or the button again to restore the grid. The schema code, JSON input, and selected schema survive reloads in the same browser tab through `sessionStorage`; they are not saved on the server.
+
+Enter JSON in **Try some data** and select **Run studio**. The validation result shows parsed data, including defaults and transforms, or Zod issues with their paths. Mongoose output remains available under **Definition**, **.obj**, **.tree**, and **.paths**. Use `⌘/Ctrl+S` or `⌘/Ctrl+R` to run while Studio has focus. Local mode also reruns after a short pause when schema code changes.
+
+**Load valid example** generates JSON input and checks it against the selected schema before inserting it. For a custom refinement that cannot be generated automatically, provide a top-level `const exampleInput = { ... }` in the code editor; Studio checks that value too.
 
 ## Technical Stack
 
@@ -79,22 +107,21 @@ export default defineNuxtConfig({
   <UContainer>
     <h1 class="text-2xl font-bold my-4">Try it live!</h1>
     
-    <!-- Automatically connects to the injected /api/parse route -->
-    <ZodMongooseStudio class="h-[600px] border rounded-lg shadow-sm" />
+    <!-- Run uses the isolated runner configured on the docs host. -->
+    <ZodMongooseStudio class="border rounded-lg shadow-sm" style="--studio-height: 600px" />
   </UContainer>
 </template>
 ```
 
 ## Features & Configuration
 
-### Transformation Engine (`/api/parse`)
+### Transformation Engine (`/api/parse` locally, `/api/studio/run` in docs)
 
-The core logic executes Zod schemas in a controlled environment. It automatically injects the necessary imports for `zod/v4` and `@nullix/zod-mongoose`:
+The runner exposes `z` and the public runtime helpers from `@nullix/zod-mongoose` as editor globals. Explicit imports of `zod/v4`, `@nullix/zod-mongoose`, and `mongoose` are also supported. The API accepts schema code, selected schema name, and JSON input; it returns validation and conversion results separately.
 
 ```ts
-import * as zod from 'zod/v4';
-const z = zod.z;
-import { toMongooseScheme, extractMongooseDefinition } from '@nullix/zod-mongoose';
+const UserSchema = z.object({ name: z.string() });
+const exampleInput = { name: 'Ada' }; // Optional for custom validation rules
 ```
 
 ### Filesystem Bridge (`/api/resolve`)
@@ -103,12 +130,28 @@ Available only in **Local Mode** (`LOCAL_MODE=true`). It uses Node's `fs` or `ts
 
 ### Sandboxing & Security
 
-When running in **Docs Mode** (`DOCS_MODE=true`), several security layers are enforced:
+Node's `vm` is **not a security boundary for untrusted code**. In Docs Mode, `/api/studio/run` forwards requests to a warm container through `STUDIO_RUNNER_SOCKET`; `/api/parse` remains restricted to the local CLI. Without the socket, the docs route returns 503. The docs process never evaluates visitor code. The runner container has no network and is read-only with CPU, memory, and process limits in `docker/compose.yaml`. Its small root supervisor accepts requests over the socket and starts a **new process with a fresh, unprivileged UID for every run**. No session retains a worker; at most two requests execute at once and eight wait in the queue. The three-second deadline kills the worker process group. The socket is owned by UID/GID 1000 and cannot be opened by workers. The supervisor needs only CHOWN, SETUID, SETGID and KILL capabilities. This reduces cross-request exposure, but does not make arbitrary code execution risk-free: malicious code could still try to exhaust the runner container or escape a process group. Keep Docker and the VPS patched and retain edge-level rate limits. Do not mount the Docker daemon socket into the docs server or runner.
+
+To run this on a VPS, create `/run/zod-studio` owned by root and group 1000. The root supervisor creates the socket, then gives socket access to UID/GID 1000. Put the docs service in group 1000. Then build and start the runner from the repository root:
+
+```shell
+sudo install -d -m 0770 -o 0 -g 1000 /run/zod-studio
+docker compose -f packages/studio/docker/compose.yaml up -d --build
+```
+
+Set `STUDIO_RUNNER_SOCKET=/run/zod-studio/runner.sock` in the docs server environment, make that socket path visible to its process, and restart the docs server. If the docs server itself runs in a container, mount only `/run/zod-studio`, never the Docker socket. The docs UI enables Run through its Nuxt configuration. The runner has no TCP listener; only the docs server's H3 route is exposed publicly. Keep the existing public rate limit or add an edge-level limit when running multiple docs instances.
+
+After deployment, verify the process boundary from the repository root:
+
+```shell
+docker compose -f packages/studio/docker/compose.yaml exec -T --user 1000:1000 studio-runner node - < packages/studio/docker/smoke-test.cjs
+```
+
+This checks separate UIDs for concurrent runs, worker denial of socket access, timeout handling, and a successful request after timeout. A fresh process adds startup time to each Run request; no process or server-side session remains allocated between requests.
+
+Local CLI mode continues to run directly, binds to `127.0.0.1`, and checks API hosts and origins. Browser session data stays in `sessionStorage` and is not kept by the runner.
 
-- **Isolated Execution**: Code transformations occur in a virtual machine context (using `isolated-vm` or equivalent workers) to prevent access to the host `process.env`, `window`, or `document`.
-- **Disabled Resolvers**: The `/api/resolve` endpoint is completely disabled.
-- **Rate Limiting**: Built-in Nitro middleware tracks IP addresses and limits requests (default: 2 per second) to prevent abuse.
-- **UI Hardening**: Elements related to the local filesystem are automatically hidden.
+Running `pnpm --filter @nullix/zod-mongoose-studio dev` also uses the local parse endpoint, without Docker. In docs mode the editors remain usable without a runner, but Run reports that the runner is unavailable until the container and `STUDIO_RUNNER_SOCKET` are configured.
 
 ## Project Structure
 

package/app/assets/css/main.css

@@ -1,2 +1,3 @@
 @import "tailwindcss";
 @import "@nuxt/ui";
+@import "./studio.css";