@nxgt/graphql-validation 0.7.0 → 0.8.1

package/README.md

@@ -279,8 +279,13 @@ One `GraphQLError` per operation: `extensions: { code: 'QUERY_TOO_DEEP', depth,
 limit }`, `{ code: 'QUERY_TOO_COSTLY', cost, limit }` or `{ code: 'QUERY_TOO_WIDE',
 fields, limit }`. `maxFields` counts every field selection in the document, aliases and
 `__typename` included, at each spread of a fragment. A list field is sized by
-its `first`, `last` or `limit` argument; a variable, a negative number or no
-argument uses the argument's SDL default, else `defaultFirst`. A size is an
+its `first`, `last` or `limit` argument. An argument not given says its SDL
+default; with no argument and no default the size is `defaultFirst`. A variable
+or an unusable literal (a negative number) counts as the largest of that
+default (else `defaultFirst`), the argument's declared `@constraint(max)` or
+`exclusiveMax`, and `variableSize` where some definition declares no bound; the
+operation's own variable default is ignored. A code-first argument has no SDL
+node, so only `variableSize` applies to it. A size is an
 Int, a canonical-integer string or an integral Float; the largest of several
 size arguments wins. On a Relay connection the `first` on the object field
 sizes the `edges` and `nodes` lists directly under it (not lists further down,
@@ -349,7 +354,7 @@ the directive declared is this package's. Both at once throw
 | `FieldIssue`, `FieldError`, `IssueParams`, `Translate`, `InvalidInputOptions`, `FieldsErrorOptions` | their types: an issue you write, a `fields` entry, its params, your translator, the options |
 | `ValidationIssue`, `ConstraintValue`, `BadUserInputExtensions` | the types of `extensions.issues`, of an issue's `value`, and of `extensions` |
 | `maxDepth({ depth, ignoreIntrospection? })` | a graphql-js validation rule refusing an operation nested deeper than `depth` fields, `extensions.code` `QUERY_TOO_DEEP`; introspection counts (the standard query is 15 levels) unless `ignoreIntrospection` |
-| `maxListCost({ budget, defaultFirst, sizeArguments?, ignoreIntrospection? })` | a graphql-js validation rule refusing an operation whose list-weighted cost is over `budget`, `extensions.code` `QUERY_TOO_COSTLY`; `sizeArguments` names the arguments sizing a list (default `first`, `last`, `limit`, the largest wins); `ignoreIntrospection` skips `__schema` and `__type` |
+| `maxListCost({ budget, defaultFirst, sizeArguments?, ignoreIntrospection?, variableSize? })` | a graphql-js validation rule refusing an operation whose list-weighted cost is over `budget`, `extensions.code` `QUERY_TOO_COSTLY`; `sizeArguments` names the arguments sizing a list (default `first`, `last`, `limit`, the largest wins); `ignoreIntrospection` skips `__schema` and `__type`; `variableSize` is the size assumed for any size argument (`first`, `last`, `limit`, custom `sizeArguments`) sent as a variable or an unusable literal; see [Variables](docs/guide/query-limits.md#variables) for how a declared bound and `variableSize` combine |
 | `maxFields({ limit, ignoreIntrospection? })` | a graphql-js validation rule refusing an operation that selects more than `limit` fields (aliases, `__typename` and every fragment spread counted, `@skip`/`@include` not evaluated), `extensions.code` `QUERY_TOO_WIDE`; introspection counts (the standard query selects 220 fields) unless `ignoreIntrospection` |
 | `MaxDepthOptions`, `MaxListCostOptions`, `MaxFieldsOptions` | their options |
 | `ConstraintArgument` | the type of `issues[].constraint`: `'minLength' \| 'format' \| ...` |

package/dist/chunks/{index-w9pw7fsk.js → index-5x1yd76p.js}

@@ -4,7 +4,7 @@ import {
   rules,
   applyRule,
   assertOwnConstraint
-} from "./index-atwkcfg3.js";
+} from "./index-sq3exxg2.js";
 
 // src/formats/all.ts
 var exports_all = {};
@@ -558,4 +558,4 @@ function assertNoDirectiveArgumentConstrained(inputs, schema) {
 export { registryOf, constraintsOn2, assertLeafTargets, assertObjectTargets, baseCode, checkConstraints2 };
 
 //# debugId=418E0FAAA9B9E68E64756E2164756E21
-//# sourceMappingURL=index-w9pw7fsk.js.map
+//# sourceMappingURL=index-5x1yd76p.js.map

package/dist/chunks/{index-atwkcfg3.js → index-sq3exxg2.js}

@@ -48,6 +48,7 @@ var containsRule = defineRule({
   argument: "contains",
   type: "String",
   target: "string",
+  description: "The string must contain this text (case-sensitive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.",
   toZod: (schema, value) => schema.includes(value),
   toCode: (schema, value) => `${schema}.includes(${literal(value)})`,
   owns: (issue) => issue.format === "includes"
@@ -57,6 +58,7 @@ var endsWithRule = defineRule({
   argument: "endsWith",
   type: "String",
   target: "string",
+  description: "The string must end with this text (case-sensitive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.",
   toZod: (schema, value) => schema.endsWith(value),
   toCode: (schema, value) => `${schema}.endsWith(${literal(value)})`,
   owns: (issue) => issue.format === "ends_with"
@@ -66,6 +68,7 @@ var exclusiveMaxRule = defineRule({
   argument: "exclusiveMax",
   type: "Float",
   target: "number",
+  description: "The number must be strictly less than this value (the value itself is refused). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.",
   toZod: (schema, value) => schema.lt(value),
   toCode: (schema, value) => `${schema}.lt(${value})`,
   owns: (issue) => issue.code === "too_big" && issue.origin === "number" && issue.inclusive === false
@@ -75,6 +78,7 @@ var exclusiveMinRule = defineRule({
   argument: "exclusiveMin",
   type: "Float",
   target: "number",
+  description: "The number must be strictly greater than this value (the value itself is refused). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.",
   toZod: (schema, value) => schema.gt(value),
   toCode: (schema, value) => `${schema}.gt(${value})`,
   owns: (issue) => issue.code === "too_small" && issue.origin === "number" && issue.inclusive === false
@@ -85,6 +89,7 @@ var formatRule = defineRule({
   argument: "format",
   type: "String",
   target: "string",
+  description: "The string must match this named format: byte, date, date-time, email, ipv4, ipv6, uri or uuid, or a format the server registered. An unknown name fails at server startup. Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.",
   base: true,
   toZod: (_schema, value, { formats }) => formats.named(value).toZod(),
   toCode: (_schema, value, { formats, formatCode }) => {
@@ -102,6 +107,7 @@ var maxRule = defineRule({
   argument: "max",
   type: "Float",
   target: "number",
+  description: "The number must be less than or equal to this value (inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.",
   toZod: (schema, value) => schema.lte(value),
   toCode: (schema, value) => `${schema}.lte(${value})`,
   owns: (issue) => issue.code === "too_big" && issue.origin === "number" && issue.inclusive === true
@@ -111,6 +117,7 @@ var maxItemsRule = defineRule({
   argument: "maxItems",
   type: "Int",
   target: "list",
+  description: "The list must hold at most this many items (inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to list values.",
   toZod: (schema, value) => schema.max(value),
   toCode: (schema, value) => `${schema}.max(${value})`,
   owns: (issue) => issue.code === "too_big" && issue.origin === "array"
@@ -120,6 +127,7 @@ var maxLengthRule = defineRule({
   argument: "maxLength",
   type: "Int",
   target: "string",
+  description: "The string must be at most this many characters long (UTF-16 code units, inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.",
   toZod: (schema, value) => schema.max(value),
   toCode: (schema, value) => `${schema}.max(${value})`,
   owns: (issue) => issue.code === "too_big" && issue.origin === "string"
@@ -129,6 +137,7 @@ var minRule = defineRule({
   argument: "min",
   type: "Float",
   target: "number",
+  description: "The number must be greater than or equal to this value (inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.",
   toZod: (schema, value) => schema.gte(value),
   toCode: (schema, value) => `${schema}.gte(${value})`,
   owns: (issue) => issue.code === "too_small" && issue.origin === "number" && issue.inclusive === true
@@ -138,6 +147,7 @@ var minItemsRule = defineRule({
   argument: "minItems",
   type: "Int",
   target: "list",
+  description: "The list must hold at least this many items (inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to list values.",
   toZod: (schema, value) => schema.min(value),
   toCode: (schema, value) => `${schema}.min(${value})`,
   owns: (issue) => issue.code === "too_small" && issue.origin === "array"
@@ -147,6 +157,7 @@ var minLengthRule = defineRule({
   argument: "minLength",
   type: "Int",
   target: "string",
+  description: "The string must be at least this many characters long (UTF-16 code units, inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.",
   toZod: (schema, value) => schema.min(value),
   toCode: (schema, value) => `${schema}.min(${value})`,
   owns: (issue) => issue.code === "too_small" && issue.origin === "string"
@@ -156,6 +167,7 @@ var multipleOfRule = defineRule({
   argument: "multipleOf",
   type: "Float",
   target: "number",
+  description: "The number must be a whole multiple of this value (for example 5 accepts 0, 5 and 10). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.",
   toZod: (schema, value) => schema.multipleOf(value),
   toCode: (schema, value) => `${schema}.multipleOf(${value})`,
   owns: (issue) => issue.code === "not_multiple_of"
@@ -166,6 +178,7 @@ var notContainsRule = defineRule({
   argument: "notContains",
   type: "String",
   target: "string",
+  description: "The string must not contain this text (case-sensitive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.",
   toZod: (schema, value) => schema.refine((input) => !input.includes(value), message(value)),
   toCode: (schema, value) => `${schema}.refine((input) => !input.includes(${literal(value)}), ${literal(message(value))})`,
   owns: (issue) => issue.code === "custom"
@@ -182,6 +195,7 @@ var patternRule = defineRule({
   argument: "pattern",
   type: "String",
   target: "string",
+  description: "The string must match this regular expression (JavaScript syntax, not anchored unless it uses ^ and $). An invalid expression fails at server startup. Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.",
   toZod: (schema, value) => schema.regex(compile(value)),
   toCode: (schema, value) => `${schema}.regex(new RegExp(${literal(compile(value).source)}))`,
   owns: (issue) => issue.format === "regex"
@@ -191,6 +205,7 @@ var startsWithRule = defineRule({
   argument: "startsWith",
   type: "String",
   target: "string",
+  description: "The string must start with this text (case-sensitive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.",
   toZod: (schema, value) => schema.startsWith(value),
   toCode: (schema, value) => `${schema}.startsWith(${literal(value)})`,
   owns: (issue) => issue.format === "starts_with"
@@ -214,8 +229,14 @@ function constraintOf(issue) {
 }
 
 // src/constraint-directive.ts
-var constraintTypeDefs2 = `directive @constraint(
-${Object.values(rules).map((rule) => `	${rule.argument}: ${rule.type}`).join(`
+var constraintTypeDefs2 = `"""
+Validates an argument or an input field when the request arrives, before the resolver runs. A value that breaks a constraint is refused with a BAD_USER_INPUT error whose extensions list each issue with its path and the constraint that refused it; null and omitted values are not checked. Each argument below is one constraint, and they combine on one field.
+"""
+directive @constraint(
+${Object.values(rules).map((rule) => `	"""
+	${rule.description}
+	"""
+	${rule.argument}: ${rule.type}`).join(`
 `)}
 ) on ARGUMENT_DEFINITION | INPUT_FIELD_DEFINITION
 `;
@@ -242,5 +263,5 @@ function assertOwnConstraint(directive) {
 
 export { __export, RULE_PARAM, rules, applyRule, applyRuleCode, constraintOf, constraintTypeDefs2, assertOwnConstraint };
 
-//# debugId=02497C6067AC4D4564756E2164756E21
-//# sourceMappingURL=index-atwkcfg3.js.map
+//# debugId=81ADC34E6A09C39064756E2164756E21
+//# sourceMappingURL=index-sq3exxg2.js.map

package/dist/chunks/index-sq3exxg2.js.map

@@ -0,0 +1,27 @@
+{
+  "version": 3,
+  "sources": ["../src/constraint-directive.ts", "../src/rules/rule.ts", "../src/rules/contains.ts", "../src/rules/ends-with.ts", "../src/rules/exclusive-max.ts", "../src/rules/exclusive-min.ts", "../src/rules/format.ts", "../src/rules/max.ts", "../src/rules/max-items.ts", "../src/rules/max-length.ts", "../src/rules/min.ts", "../src/rules/min-items.ts", "../src/rules/min-length.ts", "../src/rules/multiple-of.ts", "../src/rules/not-contains.ts", "../src/rules/pattern.ts", "../src/rules/starts-with.ts", "../src/rules/index.ts"],
+  "sourcesContent": [
+    "import { DirectiveLocation, type GraphQLDirective } from 'graphql';\nimport { rules } from './rules';\n\n/**\n * The SDL of `@constraint`, to add to a schema-first server's `typeDefs`,\n * written from the rules: an argument is declared once its rule exists.\n *\n * Its arguments are graphql-constraint-directive's, minus `uniqueTypeName`\n * (a detail of that package's scalar wrapping). It is allowed on arguments\n * and input fields only, where that package also allows output fields: a\n * resolver's result is the output scalars' job, and a directive that checked\n * nothing there would be a promise broken in silence.\n */\nexport const constraintTypeDefs: string = `\"\"\"\nValidates an argument or an input field when the request arrives, before the resolver runs. A value that breaks a constraint is refused with a BAD_USER_INPUT error whose extensions list each issue with its path and the constraint that refused it; null and omitted values are not checked. Each argument below is one constraint, and they combine on one field.\n\"\"\"\ndirective @constraint(\n${Object.values(rules)\n\t.map(\n\t\t(rule) =>\n\t\t\t`\\t\"\"\"\\n\\t${rule.description}\\n\\t\"\"\"\\n\\t${rule.argument}: ${rule.type}`,\n\t)\n\t.join('\\n')}\n) on ARGUMENT_DEFINITION | INPUT_FIELD_DEFINITION\n`;\n\nconst allowed = new Set<string>([\n\tDirectiveLocation.ARGUMENT_DEFINITION,\n\tDirectiveLocation.INPUT_FIELD_DEFINITION,\n]);\n\n/**\n * Fails when the schema's `@constraint` is not the one\n * {@link constraintTypeDefs} declares — graphql-constraint-directive's, say,\n * kept from a migration. Its extra locations would be accepted and checked\n * by nothing, its extra arguments mean nothing here, and an argument of\n * another type would reach a rule as the wrong kind of value.\n */\nexport function assertOwnConstraint(directive: GraphQLDirective): void {\n\tconst problems = [\n\t\t...(directive.isRepeatable\n\t\t\t? ['repeatable, and only its first use is read']\n\t\t\t: []),\n\t\t...directive.locations\n\t\t\t.filter((location) => !allowed.has(location))\n\t\t\t.map((location) => `allowed on ${location}`),\n\t\t...directive.args.flatMap((arg) => {\n\t\t\tconst rule = (rules as Record<string, { type: string } | undefined>)[\n\t\t\t\targ.name\n\t\t\t];\n\t\t\tif (!rule) return [`declares ${arg.name}, which no rule reads`];\n\t\t\tconst type = String(arg.type);\n\t\t\treturn type === rule.type\n\t\t\t\t? []\n\t\t\t\t: [`declares ${arg.name}: ${type}, not ${rule.type}`];\n\t\t}),\n\t];\n\tif (problems.length > 0) {\n\t\tthrow new Error(\n\t\t\t`This schema's @constraint is not constraintTypeDefs': it is ${problems.join('; ')}. Declare it with constraintTypeDefs.`,\n\t\t);\n\t}\n}\n",
+    "import type { z } from 'zod';\nimport type { StringSchema } from '../formats/format';\nimport type { FormatRegistry } from '../formats/registry';\n\n/** The schema each kind of rule narrows. */\nexport interface Targets {\n\tstring: StringSchema;\n\tnumber: z.ZodNumber;\n\tlist: z.ZodArray<z.ZodType>;\n}\n\nexport type Target = keyof Targets;\n\n/**\n * What a rule may read besides its value: the formats `format` resolves\n * against, the built-in ones and the application's own, and, when writing\n * source, how to write one of the application's (`InputCodeOptions.format`).\n */\nexport interface RuleContext {\n\treadonly formats: FormatRegistry;\n\treadonly formatCode?: ((name: string) => string) | undefined;\n}\n\n/** What a `@constraint` argument's value can be. */\ninterface ValueOf {\n\tInt: number;\n\tFloat: number;\n\tString: string;\n}\n\n/**\n * One `@constraint` argument: its GraphQL type in the directive's SDL, the\n * kind of value it narrows, and the same narrowing twice — `toZod` applied to\n * a schema at startup, `toCode` written as source by a code generator. The\n * spec beside each rule proves the two accept and refuse the same values.\n *\n * A `base` rule (only `format`) replaces the schema instead of narrowing it,\n * so a builder applies it before every other rule of its target.\n */\nexport interface Rule<\n\tA extends string = string,\n\tT extends keyof ValueOf = keyof ValueOf,\n\tK extends Target = Target,\n> {\n\treadonly argument: A;\n\treadonly type: T;\n\treadonly target: K;\n\t/**\n\t * The argument's description in the shipped SDL: what it enforces, its\n\t * bounds, the values it applies to and how a refusal reaches the client.\n\t */\n\treadonly description: string;\n\treadonly base?: true;\n\treadonly toZod: (\n\t\tschema: Targets[K],\n\t\tvalue: ValueOf[T],\n\t\tcontext: RuleContext,\n\t) => Targets[K];\n\t/**\n\t * `schema` is the source of the schema this rule narrows. The source names\n\t * zod as a free `z`: the generated file imports it.\n\t */\n\treadonly toCode: (\n\t\tschema: string,\n\t\tvalue: ValueOf[T],\n\t\tcontext: RuleContext,\n\t) => string;\n\t/**\n\t * Whether a Zod issue is this rule's refusal, so the error a client gets\n\t * names the rule (`constraint: 'minLength'`), which does not change with\n\t * Zod's own issue codes.\n\t */\n\treadonly owns: (issue: IssueFields) => boolean;\n}\n\n/** The fields of a Zod issue a rule recognises its refusal by. */\nexport interface IssueFields {\n\treadonly code: string;\n\treadonly origin?: string;\n\treadonly format?: string;\n\treadonly inclusive?: boolean;\n\treadonly params?: Readonly<Record<string, unknown>>;\n}\n\n/**\n * The `params` key that marks an issue as one argument's whatever its code:\n * an application format's issues carry `format` there, so a `.regex()` or a\n * `.refine()` inside one is not read as `pattern` or `notContains`.\n */\nexport const RULE_PARAM = 'nxgtConstraint';\n\n/** Declares a rule, with its argument name kept literal. */\nexport function defineRule<\n\tconst A extends string,\n\tT extends keyof ValueOf,\n\tK extends Target,\n>(rule: Rule<A, T, K>): Rule<A, T, K> {\n\treturn rule;\n}\n\n/** A string literal as source: quotes and escapes included. */\nexport const literal = (value: string): string => JSON.stringify(value);\n",
+    "import { defineRule, literal } from './rule';\n\nexport const containsRule = defineRule({\n\targument: 'contains',\n\ttype: 'String',\n\ttarget: 'string',\n\tdescription:\n\t\t'The string must contain this text (case-sensitive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.',\n\ttoZod: (schema, value) => schema.includes(value),\n\ttoCode: (schema, value) => `${schema}.includes(${literal(value)})`,\n\towns: (issue) => issue.format === 'includes',\n});\n",
+    "import { defineRule, literal } from './rule';\n\nexport const endsWithRule = defineRule({\n\targument: 'endsWith',\n\ttype: 'String',\n\ttarget: 'string',\n\tdescription:\n\t\t'The string must end with this text (case-sensitive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.',\n\ttoZod: (schema, value) => schema.endsWith(value),\n\ttoCode: (schema, value) => `${schema}.endsWith(${literal(value)})`,\n\towns: (issue) => issue.format === 'ends_with',\n});\n",
+    "import { defineRule } from './rule';\n\nexport const exclusiveMaxRule = defineRule({\n\targument: 'exclusiveMax',\n\ttype: 'Float',\n\ttarget: 'number',\n\tdescription:\n\t\t'The number must be strictly less than this value (the value itself is refused). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.',\n\ttoZod: (schema, value) => schema.lt(value),\n\ttoCode: (schema, value) => `${schema}.lt(${value})`,\n\towns: (issue) =>\n\t\tissue.code === 'too_big' &&\n\t\tissue.origin === 'number' &&\n\t\tissue.inclusive === false,\n});\n",
+    "import { defineRule } from './rule';\n\nexport const exclusiveMinRule = defineRule({\n\targument: 'exclusiveMin',\n\ttype: 'Float',\n\ttarget: 'number',\n\tdescription:\n\t\t'The number must be strictly greater than this value (the value itself is refused). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.',\n\ttoZod: (schema, value) => schema.gt(value),\n\ttoCode: (schema, value) => `${schema}.gt(${value})`,\n\towns: (issue) =>\n\t\tissue.code === 'too_small' &&\n\t\tissue.origin === 'number' &&\n\t\tissue.inclusive === false,\n});\n",
+    "import { defineRule, RULE_PARAM } from './rule';\n\n// The string rules' own formats; every other invalid_format is a format's.\nconst NARROWING = new Set(['starts_with', 'ends_with', 'includes', 'regex']);\n\nexport const formatRule = defineRule({\n\targument: 'format',\n\ttype: 'String',\n\ttarget: 'string',\n\tdescription:\n\t\t'The string must match this named format: byte, date, date-time, email, ipv4, ipv6, uri or uuid, or a format the server registered. An unknown name fails at server startup. Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.',\n\tbase: true,\n\ttoZod: (_schema, value, { formats }) => formats.named(value).toZod(),\n\ttoCode: (_schema, value, { formats, formatCode }) => {\n\t\tconst format = formats.named(value);\n\t\tif (format.toCode) return format.toCode();\n\t\tif (formatCode) return formatCode(value);\n\t\tthrow new Error(\n\t\t\t`@constraint(format: \"${value}\") is one of the application's formats: its source is the code generator's to write, through inputCode's format option.`,\n\t\t);\n\t},\n\t// An application format's issues are marked, whatever their code\n\t// (`custom` for a `.refine()`): see FormatRegistry.\n\towns: (issue) =>\n\t\tissue.params?.[RULE_PARAM] === 'format' ||\n\t\t(issue.code === 'invalid_format' && !NARROWING.has(issue.format ?? '')),\n});\n",
+    "import { defineRule } from './rule';\n\nexport const maxRule = defineRule({\n\targument: 'max',\n\ttype: 'Float',\n\ttarget: 'number',\n\tdescription:\n\t\t'The number must be less than or equal to this value (inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.',\n\ttoZod: (schema, value) => schema.lte(value),\n\ttoCode: (schema, value) => `${schema}.lte(${value})`,\n\towns: (issue) =>\n\t\tissue.code === 'too_big' &&\n\t\tissue.origin === 'number' &&\n\t\tissue.inclusive === true,\n});\n",
+    "import { defineRule } from './rule';\n\nexport const maxItemsRule = defineRule({\n\targument: 'maxItems',\n\ttype: 'Int',\n\ttarget: 'list',\n\tdescription:\n\t\t'The list must hold at most this many items (inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to list values.',\n\ttoZod: (schema, value) => schema.max(value),\n\ttoCode: (schema, value) => `${schema}.max(${value})`,\n\towns: (issue) => issue.code === 'too_big' && issue.origin === 'array',\n});\n",
+    "import { defineRule } from './rule';\n\nexport const maxLengthRule = defineRule({\n\targument: 'maxLength',\n\ttype: 'Int',\n\ttarget: 'string',\n\tdescription:\n\t\t'The string must be at most this many characters long (UTF-16 code units, inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.',\n\ttoZod: (schema, value) => schema.max(value),\n\ttoCode: (schema, value) => `${schema}.max(${value})`,\n\towns: (issue) => issue.code === 'too_big' && issue.origin === 'string',\n});\n",
+    "import { defineRule } from './rule';\n\nexport const minRule = defineRule({\n\targument: 'min',\n\ttype: 'Float',\n\ttarget: 'number',\n\tdescription:\n\t\t'The number must be greater than or equal to this value (inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.',\n\ttoZod: (schema, value) => schema.gte(value),\n\ttoCode: (schema, value) => `${schema}.gte(${value})`,\n\towns: (issue) =>\n\t\tissue.code === 'too_small' &&\n\t\tissue.origin === 'number' &&\n\t\tissue.inclusive === true,\n});\n",
+    "import { defineRule } from './rule';\n\nexport const minItemsRule = defineRule({\n\targument: 'minItems',\n\ttype: 'Int',\n\ttarget: 'list',\n\tdescription:\n\t\t'The list must hold at least this many items (inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to list values.',\n\ttoZod: (schema, value) => schema.min(value),\n\ttoCode: (schema, value) => `${schema}.min(${value})`,\n\towns: (issue) => issue.code === 'too_small' && issue.origin === 'array',\n});\n",
+    "import { defineRule } from './rule';\n\nexport const minLengthRule = defineRule({\n\targument: 'minLength',\n\ttype: 'Int',\n\ttarget: 'string',\n\tdescription:\n\t\t'The string must be at least this many characters long (UTF-16 code units, inclusive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.',\n\ttoZod: (schema, value) => schema.min(value),\n\ttoCode: (schema, value) => `${schema}.min(${value})`,\n\towns: (issue) => issue.code === 'too_small' && issue.origin === 'string',\n});\n",
+    "import { defineRule } from './rule';\n\nexport const multipleOfRule = defineRule({\n\targument: 'multipleOf',\n\ttype: 'Float',\n\ttarget: 'number',\n\tdescription:\n\t\t'The number must be a whole multiple of this value (for example 5 accepts 0, 5 and 10). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to Int and Float values.',\n\ttoZod: (schema, value) => schema.multipleOf(value),\n\ttoCode: (schema, value) => `${schema}.multipleOf(${value})`,\n\towns: (issue) => issue.code === 'not_multiple_of',\n});\n",
+    "import { defineRule, literal } from './rule';\n\nconst message = (value: string) => `Must not contain ${literal(value)}`;\n\nexport const notContainsRule = defineRule({\n\targument: 'notContains',\n\ttype: 'String',\n\ttarget: 'string',\n\tdescription:\n\t\t'The string must not contain this text (case-sensitive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.',\n\t// `refine` keeps the schema's own type, so later rules still chain.\n\ttoZod: (schema, value) =>\n\t\tschema.refine((input) => !input.includes(value), message(value)),\n\ttoCode: (schema, value) =>\n\t\t`${schema}.refine((input) => !input.includes(${literal(value)}), ${literal(message(value))})`,\n\towns: (issue) => issue.code === 'custom',\n});\n",
+    "import { defineRule, literal } from './rule';\n\n/** The pattern as a RegExp, or an error that names the argument. */\nfunction compile(value: string): RegExp {\n\ttry {\n\t\treturn new RegExp(value);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Invalid @constraint pattern ${literal(value)}: ${(error as Error).message}`,\n\t\t);\n\t}\n}\n\nexport const patternRule = defineRule({\n\targument: 'pattern',\n\ttype: 'String',\n\ttarget: 'string',\n\tdescription:\n\t\t'The string must match this regular expression (JavaScript syntax, not anchored unless it uses ^ and $). An invalid expression fails at server startup. Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.',\n\ttoZod: (schema, value) => schema.regex(compile(value)),\n\ttoCode: (schema, value) =>\n\t\t`${schema}.regex(new RegExp(${literal(compile(value).source)}))`,\n\towns: (issue) => issue.format === 'regex',\n});\n",
+    "import { defineRule, literal } from './rule';\n\nexport const startsWithRule = defineRule({\n\targument: 'startsWith',\n\ttype: 'String',\n\ttarget: 'string',\n\tdescription:\n\t\t'The string must start with this text (case-sensitive). Refused otherwise with a BAD_USER_INPUT error naming the constraint. Applies to String and ID values.',\n\ttoZod: (schema, value) => schema.startsWith(value),\n\ttoCode: (schema, value) => `${schema}.startsWith(${literal(value)})`,\n\towns: (issue) => issue.format === 'starts_with',\n});\n",
+    "import type { z } from 'zod';\nimport * as all from './all';\nimport { type IssueFields, RULE_PARAM, type RuleContext } from './rule';\n\n/**\n * One of the rules, as its own type: a builder narrows it on `target`, so a\n * number schema never reaches a string rule.\n */\nexport type RegisteredRule = (typeof all)[keyof typeof all];\n\n/** An argument `@constraint` takes. */\nexport type ConstraintArgument = RegisteredRule['argument'];\n\n/**\n * Every rule, keyed by its `@constraint` argument. Derived from what\n * `./all` exports, so a new rule is one file and one line there, and the\n * directive's SDL follows.\n */\nexport const rules = Object.fromEntries(\n\tObject.values(all).map((rule) => [rule.argument, rule]),\n) as {\n\treadonly [A in ConstraintArgument]: Extract<RegisteredRule, { argument: A }>;\n};\n\n/**\n * Applies a rule to a schema its caller has already matched to the rule's\n * target: the one place the rule's typed `toZod` meets a schema built from\n * GraphQL types, which the compiler cannot relate.\n */\nexport function applyRule(\n\trule: RegisteredRule,\n\tschema: z.ZodType,\n\tvalue: string | number,\n\tcontext: RuleContext,\n): z.ZodType {\n\tconst toZod = rule.toZod as unknown as (\n\t\tschema: z.ZodType,\n\t\tvalue: string | number,\n\t\tcontext: RuleContext,\n\t) => z.ZodType;\n\treturn toZod(schema, value, context);\n}\n\n/** `applyRule` for source: the rule's typed `toCode` on a schema's source. */\nexport function applyRuleCode(\n\trule: RegisteredRule,\n\tsource: string,\n\tvalue: string | number,\n\tcontext: RuleContext,\n): string {\n\tconst toCode = rule.toCode as (\n\t\tschema: string,\n\t\tvalue: string | number,\n\t\tcontext: RuleContext,\n\t) => string;\n\treturn toCode(source, value, context);\n}\n\n/**\n * The `@constraint` argument whose rule refused with this issue, if any: the\n * one the issue is marked with (an application format's), else the one rule\n * that owns its shape.\n */\nexport function constraintOf(\n\tissue: z.core.$ZodIssue,\n): ConstraintArgument | undefined {\n\tconst fields = issue as unknown as IssueFields;\n\tconst marked = fields.params?.[RULE_PARAM];\n\tif (typeof marked === 'string' && Object.hasOwn(rules, marked))\n\t\treturn marked as ConstraintArgument;\n\treturn Object.values(rules).find((rule) => rule.owns(fields))?.argument;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;ACyFO,IAAM,aAAa;AAGnB,SAAS,UAIf,CAAC,MAAoC;AAAA,EACrC,OAAO;AAAA;AAID,IAAM,UAAU,CAAC,UAA0B,KAAK,UAAU,KAAK;;;ACnG/D,IAAM,eAAe,WAAW;AAAA,EACtC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,SAAS,KAAK;AAAA,EAC/C,QAAQ,CAAC,QAAQ,UAAU,GAAG,mBAAmB,QAAQ,KAAK;AAAA,EAC9D,MAAM,CAAC,UAAU,MAAM,WAAW;AACnC,CAAC;;ACTM,IAAM,eAAe,WAAW;AAAA,EACtC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,SAAS,KAAK;AAAA,EAC/C,QAAQ,CAAC,QAAQ,UAAU,GAAG,mBAAmB,QAAQ,KAAK;AAAA,EAC9D,MAAM,CAAC,UAAU,MAAM,WAAW;AACnC,CAAC;;ACTM,IAAM,mBAAmB,WAAW;AAAA,EAC1C,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,GAAG,KAAK;AAAA,EACzC,QAAQ,CAAC,QAAQ,UAAU,GAAG,aAAa;AAAA,EAC3C,MAAM,CAAC,UACN,MAAM,SAAS,aACf,MAAM,WAAW,YACjB,MAAM,cAAc;AACtB,CAAC;;ACZM,IAAM,mBAAmB,WAAW;AAAA,EAC1C,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,GAAG,KAAK;AAAA,EACzC,QAAQ,CAAC,QAAQ,UAAU,GAAG,aAAa;AAAA,EAC3C,MAAM,CAAC,UACN,MAAM,SAAS,eACf,MAAM,WAAW,YACjB,MAAM,cAAc;AACtB,CAAC;;ACXD,IAAM,YAAY,IAAI,IAAI,CAAC,eAAe,aAAa,YAAY,OAAO,CAAC;AAEpE,IAAM,aAAa,WAAW;AAAA,EACpC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,MAAM;AAAA,EACN,OAAO,CAAC,SAAS,SAAS,cAAc,QAAQ,MAAM,KAAK,EAAE,MAAM;AAAA,EACnE,QAAQ,CAAC,SAAS,SAAS,SAAS,iBAAiB;AAAA,IACpD,MAAM,SAAS,QAAQ,MAAM,KAAK;AAAA,IAClC,IAAI,OAAO;AAAA,MAAQ,OAAO,OAAO,OAAO;AAAA,IACxC,IAAI;AAAA,MAAY,OAAO,WAAW,KAAK;AAAA,IACvC,MAAM,IAAI,MACT,wBAAwB,8HACzB;AAAA;AAAA,EAID,MAAM,CAAC,UACN,MAAM,SAAS,gBAAgB,YAC9B,MAAM,SAAS,oBAAoB,CAAC,UAAU,IAAI,MAAM,UAAU,EAAE;AACvE,CAAC;;ACxBM,IAAM,UAAU,WAAW;AAAA,EACjC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,IAAI,KAAK;AAAA,EAC1C,QAAQ,CAAC,QAAQ,UAAU,GAAG,cAAc;AAAA,EAC5C,MAAM,CAAC,UACN,MAAM,SAAS,aACf,MAAM,WAAW,YACjB,MAAM,cAAc;AACtB,CAAC;;ACZM,IAAM,eAAe,WAAW;AAAA,EACtC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,IAAI,KAAK;AAAA,EAC1C,QAAQ,CAAC,QAAQ,UAAU,GAAG,cAAc;AAAA,EAC5C,MAAM,CAAC,UAAU,MAAM,SAAS,aAAa,MAAM,WAAW;AAC/D,CAAC;;ACTM,IAAM,gBAAgB,WAAW;AAAA,EACvC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,IAAI,KAAK;AAAA,EAC1C,QAAQ,CAAC,QAAQ,UAAU,GAAG,cAAc;AAAA,EAC5C,MAAM,CAAC,UAAU,MAAM,SAAS,aAAa,MAAM,WAAW;AAC/D,CAAC;;ACTM,IAAM,UAAU,WAAW;AAAA,EACjC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,IAAI,KAAK;AAAA,EAC1C,QAAQ,CAAC,QAAQ,UAAU,GAAG,cAAc;AAAA,EAC5C,MAAM,CAAC,UACN,MAAM,SAAS,eACf,MAAM,WAAW,YACjB,MAAM,cAAc;AACtB,CAAC;;ACZM,IAAM,eAAe,WAAW;AAAA,EACtC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,IAAI,KAAK;AAAA,EAC1C,QAAQ,CAAC,QAAQ,UAAU,GAAG,cAAc;AAAA,EAC5C,MAAM,CAAC,UAAU,MAAM,SAAS,eAAe,MAAM,WAAW;AACjE,CAAC;;ACTM,IAAM,gBAAgB,WAAW;AAAA,EACvC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,IAAI,KAAK;AAAA,EAC1C,QAAQ,CAAC,QAAQ,UAAU,GAAG,cAAc;AAAA,EAC5C,MAAM,CAAC,UAAU,MAAM,SAAS,eAAe,MAAM,WAAW;AACjE,CAAC;;ACTM,IAAM,iBAAiB,WAAW;AAAA,EACxC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,WAAW,KAAK;AAAA,EACjD,QAAQ,CAAC,QAAQ,UAAU,GAAG,qBAAqB;AAAA,EACnD,MAAM,CAAC,UAAU,MAAM,SAAS;AACjC,CAAC;;ACTD,IAAM,UAAU,CAAC,UAAkB,oBAAoB,QAAQ,KAAK;AAE7D,IAAM,kBAAkB,WAAW;AAAA,EACzC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EAED,OAAO,CAAC,QAAQ,UACf,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,SAAS,KAAK,GAAG,QAAQ,KAAK,CAAC;AAAA,EAChE,QAAQ,CAAC,QAAQ,UAChB,GAAG,4CAA4C,QAAQ,KAAK,OAAO,QAAQ,QAAQ,KAAK,CAAC;AAAA,EAC1F,MAAM,CAAC,UAAU,MAAM,SAAS;AACjC,CAAC;;ACbD,SAAS,OAAO,CAAC,OAAuB;AAAA,EACvC,IAAI;AAAA,IACH,OAAO,IAAI,OAAO,KAAK;AAAA,IACtB,OAAO,OAAO;AAAA,IACf,MAAM,IAAI,MACT,+BAA+B,QAAQ,KAAK,MAAO,MAAgB,SACpE;AAAA;AAAA;AAIK,IAAM,cAAc,WAAW;AAAA,EACrC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,MAAM,QAAQ,KAAK,CAAC;AAAA,EACrD,QAAQ,CAAC,QAAQ,UAChB,GAAG,2BAA2B,QAAQ,QAAQ,KAAK,EAAE,MAAM;AAAA,EAC5D,MAAM,CAAC,UAAU,MAAM,WAAW;AACnC,CAAC;;ACrBM,IAAM,iBAAiB,WAAW;AAAA,EACxC,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,aACC;AAAA,EACD,OAAO,CAAC,QAAQ,UAAU,OAAO,WAAW,KAAK;AAAA,EACjD,QAAQ,CAAC,QAAQ,UAAU,GAAG,qBAAqB,QAAQ,KAAK;AAAA,EAChE,MAAM,CAAC,UAAU,MAAM,WAAW;AACnC,CAAC;;ACOM,IAAM,QAAQ,OAAO,YAC3B,OAAO,OAAO,WAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,UAAU,IAAI,CAAC,CACvD;AASO,SAAS,SAAS,CACxB,MACA,QACA,OACA,SACY;AAAA,EACZ,MAAM,QAAQ,KAAK;AAAA,EAKnB,OAAO,MAAM,QAAQ,OAAO,OAAO;AAAA;AAI7B,SAAS,aAAa,CAC5B,MACA,QACA,OACA,SACS;AAAA,EACT,MAAM,SAAS,KAAK;AAAA,EAKpB,OAAO,OAAO,QAAQ,OAAO,OAAO;AAAA;AAQ9B,SAAS,YAAY,CAC3B,OACiC;AAAA,EACjC,MAAM,SAAS;AAAA,EACf,MAAM,SAAS,OAAO,SAAS;AAAA,EAC/B,IAAI,OAAO,WAAW,YAAY,OAAO,OAAO,OAAO,MAAM;AAAA,IAC5D,OAAO;AAAA,EACR,OAAO,OAAO,OAAO,KAAK,EAAE,KAAK,CAAC,SAAS,KAAK,KAAK,MAAM,CAAC,GAAG;AAAA;;;AjBzDzD,IAAM,sBAA6B;AAAA;AAAA;AAAA;AAAA,EAIxC,OAAO,OAAO,KAAK,EACnB,IACA,CAAC,SACA;AAAA,GAAY,KAAK;AAAA;AAAA,GAAyB,KAAK,aAAa,KAAK,MACnE,EACC,KAAK;AAAA,CAAI;AAAA;AAAA;AAIX,IAAM,UAAU,IAAI,IAAY;AAAA,EAC/B,kBAAkB;AAAA,EAClB,kBAAkB;AACnB,CAAC;AASM,SAAS,mBAAmB,CAAC,WAAmC;AAAA,EACtE,MAAM,WAAW;AAAA,IAChB,GAAI,UAAU,eACX,CAAC,4CAA4C,IAC7C,CAAC;AAAA,IACJ,GAAG,UAAU,UACX,OAAO,CAAC,aAAa,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAC3C,IAAI,CAAC,aAAa,cAAc,UAAU;AAAA,IAC5C,GAAG,UAAU,KAAK,QAAQ,CAAC,QAAQ;AAAA,MAClC,MAAM,OAAQ,MACb,IAAI;AAAA,MAEL,IAAI,CAAC;AAAA,QAAM,OAAO,CAAC,YAAY,IAAI,2BAA2B;AAAA,MAC9D,MAAM,OAAO,OAAO,IAAI,IAAI;AAAA,MAC5B,OAAO,SAAS,KAAK,OAClB,CAAC,IACD,CAAC,YAAY,IAAI,SAAS,aAAa,KAAK,MAAM;AAAA,KACrD;AAAA,EACF;AAAA,EACA,IAAI,SAAS,SAAS,GAAG;AAAA,IACxB,MAAM,IAAI,MACT,+DAA+D,SAAS,KAAK,IAAI,wCAClF;AAAA,EACD;AAAA;",
+  "debugId": "81ADC34E6A09C39064756E2164756E21",
+  "names": []
+}

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   constraintTypeDefs2
-} from "./chunks/index-atwkcfg3.js";
+} from "./chunks/index-sq3exxg2.js";
 
 // src/typedefs-command.ts
 import { mkdir, writeFile } from "node:fs/promises";

package/dist/codegen.js

@@ -1,6 +1,6 @@
 import {
   applyRuleCode
-} from "./chunks/index-atwkcfg3.js";
+} from "./chunks/index-sq3exxg2.js";
 import {
   registryOf,
   constraintsOn2,
@@ -8,7 +8,7 @@ import {
   assertObjectTargets,
   baseCode,
   checkConstraints2
-} from "./chunks/index-w9pw7fsk.js";
+} from "./chunks/index-5x1yd76p.js";
 // src/builder/input-code.ts
 import {
   getNamedType,

package/dist/constraint-directive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constraint-directive.d.ts","sourceRoot":"","sources":["../src/constraint-directive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAGnE;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAKhC,CAAC;AAOF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAwBrE"}
+{"version":3,"file":"constraint-directive.d.ts","sourceRoot":"","sources":["../src/constraint-directive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAGnE;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAWhC,CAAC;AAOF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAwBrE"}

package/dist/index.js

@@ -1,10 +1,10 @@
 import {
   constraintOf,
   constraintTypeDefs2
-} from "./chunks/index-atwkcfg3.js";
+} from "./chunks/index-sq3exxg2.js";
 import {
   checkConstraints2
-} from "./chunks/index-w9pw7fsk.js";
+} from "./chunks/index-5x1yd76p.js";
 
 // src/bad-user-input.ts
 import { GraphQLError } from "graphql";
@@ -137,15 +137,42 @@ import {
 } from "graphql";
 
 // src/limits/describe.ts
+var CEILING = Number.MAX_SAFE_INTEGER;
+var add = (a, b) => Math.min(CEILING, a + b);
 function operationLabel(operation) {
   return operation.name ? `Operation "${operation.name.value}"` : "Operation";
 }
-function assertInteger(option, value, min, max = Number.MAX_SAFE_INTEGER) {
+function assertInteger(option, value, min, max = CEILING) {
   if (!Number.isInteger(value) || value < min || value >= max) {
     throw new RangeError(`${option} must be an integer from ${min} to ${max - 1}.`);
   }
 }
 
+// src/limits/fragments.ts
+var NO_KEY = -1;
+function newFragmentWalk(getFragment) {
+  return { getFragment, values: new Map, visiting: new Set };
+}
+function fragmentValue(walk, name, key, compute) {
+  let known = walk.values.get(name);
+  if (!known) {
+    known = new Map;
+    walk.values.set(name, known);
+  }
+  const at = typeof key === "number" ? key : key(known);
+  const memo = known.get(at);
+  if (memo !== undefined)
+    return memo;
+  const fragment = walk.getFragment(name);
+  if (!fragment || walk.visiting.has(name))
+    return 0;
+  walk.visiting.add(name);
+  const result = compute(fragment, at);
+  walk.visiting.delete(name);
+  known.set(at, result);
+  return result;
+}
+
 // src/limits/introspection.ts
 import {
   isEnumType,
@@ -230,26 +257,14 @@ function depthOf(depth, selectionSet) {
   return deepest;
 }
 function fragmentDepth(depth, name) {
-  const known = depth.fragmentDepths.get(name);
-  if (known !== undefined)
-    return known;
-  const fragment = depth.getFragment(name);
-  if (!fragment || depth.measuring.has(name))
-    return 0;
-  depth.measuring.add(name);
-  const result = depthOf(depth, fragment.selectionSet);
-  depth.measuring.delete(name);
-  depth.fragmentDepths.set(name, result);
-  return result;
+  return fragmentValue(depth, name, NO_KEY, (fragment) => depthOf(depth, fragment.selectionSet));
 }
 function maxDepth(options) {
   const limit = options.depth;
   assertInteger("maxDepth: depth", limit, 1);
   return (context) => {
     const walk = {
-      getFragment: (name) => context.getFragment(name),
-      fragmentDepths: new Map,
-      measuring: new Set,
+      ...newFragmentWalk((name) => context.getFragment(name)),
       ignoreIntrospection: options.ignoreIntrospection ?? false
     };
     return {
@@ -270,9 +285,6 @@ function maxDepth(options) {
 import {
   GraphQLError as GraphQLError4
 } from "graphql";
-function add(a, b) {
-  return Math.min(a + b, Number.MAX_SAFE_INTEGER);
-}
 function countOf(walk, selectionSet) {
   let total = 0;
   for (const selection of selectionSet.selections) {
@@ -291,26 +303,14 @@ function countOf(walk, selectionSet) {
   return total;
 }
 function fragmentCount(walk, name) {
-  const known = walk.fragmentCounts.get(name);
-  if (known !== undefined)
-    return known;
-  const fragment = walk.getFragment(name);
-  if (!fragment || walk.counting.has(name))
-    return 0;
-  walk.counting.add(name);
-  const result = countOf(walk, fragment.selectionSet);
-  walk.counting.delete(name);
-  walk.fragmentCounts.set(name, result);
-  return result;
+  return fragmentValue(walk, name, NO_KEY, (fragment) => countOf(walk, fragment.selectionSet));
 }
 function maxFields(options) {
   const limit = options.limit;
   assertInteger("maxFields: limit", limit, 1);
   return (context) => {
     const walk = {
-      getFragment: (name) => context.getFragment(name),
-      fragmentCounts: new Map,
-      counting: new Set,
+      ...newFragmentWalk((name) => context.getFragment(name)),
       ignoreIntrospection: options.ignoreIntrospection ?? false
     };
     return {
@@ -340,8 +340,6 @@ import {
   isInterfaceType as isInterfaceType2,
   isObjectType as isObjectType2
 } from "graphql";
-var CEILING = Number.MAX_SAFE_INTEGER;
-var add2 = (a, b) => Math.min(CEILING, a + b);
 var multiply = (a, b) => Math.min(CEILING, a * b);
 function fieldOf(cost, parent, name) {
   if (parent === cost.schema.getQueryType() && isIntrospectionRoot(name)) {
@@ -354,7 +352,7 @@ function rootType(schema, operation) {
   return type ?? undefined;
 }
 var EXACT_SIZES = 8;
-var NO_PENDING = -1;
+var NO_PENDING = NO_KEY;
 function memoSize(known, pending) {
   if (pending === undefined || known.has(pending) || known.size < EXACT_SIZES) {
     return pending;
@@ -369,16 +367,17 @@ function memoSize(known, pending) {
 import {
   isAbstractType
 } from "graphql";
-var CEILING2 = Number.MAX_SAFE_INTEGER;
+
+// src/limits/size-reading.ts
 var CANONICAL_INTEGER = /^(0|[1-9]\d*)$/;
 function sizeOf(value) {
   if (typeof value === "string") {
-    return CANONICAL_INTEGER.test(value) ? Math.min(Number(value), CEILING2) : undefined;
+    return CANONICAL_INTEGER.test(value) ? Math.min(Number(value), CEILING) : undefined;
   }
   if (typeof value === "bigint") {
-    return value >= 0n ? Math.min(Number(value), CEILING2) : undefined;
+    return value >= 0n ? Math.min(Number(value), CEILING) : undefined;
   }
-  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? Math.min(value, CEILING2) : undefined;
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? Math.min(value, CEILING) : undefined;
 }
 function literalSize(value) {
   if (value.kind === "IntValue" || value.kind === "FloatValue") {
@@ -407,6 +406,30 @@ function defaultSizeOf(argument) {
   }
   return;
 }
+function boundOf(value) {
+  if (value.kind === "StringValue")
+    return literalSize(value);
+  if (value.kind !== "IntValue" && value.kind !== "FloatValue")
+    return;
+  const number = Number(value.value);
+  return Number.isFinite(number) && number >= 0 ? Math.min(Math.ceil(number), CEILING) : undefined;
+}
+function constraintMaxOf(argument) {
+  const directive = argument?.astNode?.directives?.find((node) => node.name.value === "constraint");
+  let largest;
+  for (const node of directive?.arguments ?? []) {
+    if (node.name.value !== "max" && node.name.value !== "exclusiveMax") {
+      continue;
+    }
+    const bound = boundOf(node.value);
+    if (bound !== undefined && (largest === undefined || bound > largest)) {
+      largest = bound;
+    }
+  }
+  return largest;
+}
+
+// src/limits/list-size.ts
 var profiles = new WeakMap;
 function profileOf(cost, parent, definition) {
   let bySizes = profiles.get(cost.schema);
@@ -435,6 +458,10 @@ function profileOf(cost, parent, definition) {
     largest: cost.sizeArguments.map(() => {
       return;
     }),
+    maxima: cost.sizeArguments.map(() => {
+      return;
+    }),
+    someNoMax: cost.sizeArguments.map(() => false),
     someLack: cost.sizeArguments.map(() => false),
     someBare: false,
     declares: false,
@@ -443,7 +470,13 @@ function profileOf(cost, parent, definition) {
   for (const field of definitions) {
     let any = false;
     cost.sizeArguments.forEach((name, index) => {
-      const size = defaultSizeOf(field.args.find((arg) => arg.name === name));
+      const argument = field.args.find((arg) => arg.name === name);
+      const max = constraintMaxOf(argument);
+      if (max === undefined)
+        profile.someNoMax[index] = true;
+      else
+        profile.maxima[index] = Math.max(profile.maxima[index] ?? 0, max);
+      const size = defaultSizeOf(argument);
       if (size === undefined) {
         profile.someLack[index] = true;
         return;
@@ -469,7 +502,16 @@ function argumentSize(cost, profile, index, node) {
   const literal = literalSize(node.value);
   if (literal !== undefined)
     return literal;
-  return profile.someLack[index] ? Math.max(largest ?? 0, cost.defaultFirst) : largest;
+  const today = profile.someLack[index] ? Math.max(largest ?? 0, cost.defaultFirst) : largest;
+  const bound = unusableBound(cost, profile, index);
+  return bound === undefined ? today : Math.max(today ?? 0, bound);
+}
+function unusableBound(cost, profile, index) {
+  const assumed = profile.someNoMax[index] ? cost.variableSize : undefined;
+  const declared = profile.maxima[index];
+  if (assumed === undefined)
+    return declared;
+  return Math.max(declared ?? 0, assumed);
 }
 function statedSize(cost, parent, definition, args) {
   const profile = profileOf(cost, parent, definition);
@@ -495,6 +537,9 @@ function declaration(cost, parent, definition) {
   return someUndeclared ? "some" : "all";
 }
 
+// src/limits/max-list-cost-options.ts
+var DEFAULT_SIZE_ARGUMENTS = ["first", "last", "limit"];
+
 // src/limits/pending-size.ts
 function listSizeUnder(cost, parent, definition, args, pending) {
   const own = () => statedSize(cost, parent, definition, args) ?? cost.defaultFirst;
@@ -509,7 +554,6 @@ function listSizeUnder(cost, parent, definition, args, pending) {
 }
 
 // src/limits/max-list-cost.ts
-var DEFAULT_SIZE_ARGUMENTS = ["first", "last", "limit"];
 function fieldCost(cost, parent, selection, definition, pending) {
   if (!selection.selectionSet)
     return 1;
@@ -518,11 +562,11 @@ function fieldCost(cost, parent, selection, definition, pending) {
   if (!isListType(getNullableType(definition.type))) {
     const stated = statedSize(cost, parent, definition, selection.arguments);
     const inner = costOf(cost, selection.selectionSet, type, stated);
-    return add2(1, inner);
+    return add(1, inner);
   }
   const inner = costOf(cost, selection.selectionSet, type, undefined);
   const size = parent?.name.startsWith("__") ? introspectionSize(cost.schema, name) : listSizeUnder(cost, parent, definition, selection.arguments, pending);
-  return add2(1, multiply(inner, size));
+  return add(1, multiply(inner, size));
 }
 function costOf(cost, selectionSet, parent, pending) {
   let total = 0;
@@ -536,35 +580,19 @@ function costOf(cost, selectionSet, parent, pending) {
       const definition = fieldOf(cost, parent, name);
       if (!definition)
         continue;
-      total = add2(total, fieldCost(cost, parent, selection, definition, pending));
+      total = add(total, fieldCost(cost, parent, selection, definition, pending));
     } else if (selection.kind === "InlineFragment") {
       const condition = selection.typeCondition ? cost.schema.getType(selection.typeCondition.name.value) : parent;
-      total = add2(total, costOf(cost, selection.selectionSet, condition, pending));
+      total = add(total, costOf(cost, selection.selectionSet, condition, pending));
     } else {
-      total = add2(total, fragmentCost(cost, selection.name.value, pending));
+      total = add(total, fragmentCost(cost, selection.name.value, pending));
     }
   }
   return total;
 }
 function fragmentCost(cost, name, pending) {
-  let known = cost.fragmentCosts.get(name);
-  if (!known) {
-    known = new Map;
-    cost.fragmentCosts.set(name, known);
-  }
-  const size = memoSize(known, pending);
-  const key = size ?? NO_PENDING;
-  const memo = known.get(key);
-  if (memo !== undefined)
-    return memo;
-  const fragment = cost.getFragment(name);
-  if (!fragment || cost.costing.has(name))
-    return 0;
-  cost.costing.add(name);
-  const result = costOf(cost, fragment.selectionSet, cost.schema.getType(fragment.typeCondition.name.value), size);
-  cost.costing.delete(name);
-  known.set(key, result);
-  return result;
+  const key = (known) => memoSize(known, pending) ?? NO_PENDING;
+  return fragmentValue(cost, name, key, (fragment, at) => costOf(cost, fragment.selectionSet, cost.schema.getType(fragment.typeCondition.name.value), at === NO_PENDING ? undefined : at));
 }
 function maxListCost(options) {
   const { budget, defaultFirst } = options;
@@ -573,16 +601,19 @@ function maxListCost(options) {
   ]);
   assertInteger("maxListCost: budget", budget, 0);
   assertInteger("maxListCost: defaultFirst", defaultFirst, 0);
+  const { variableSize } = options;
+  if (variableSize !== undefined) {
+    assertInteger("maxListCost: variableSize", variableSize, 0);
+  }
   return (context) => {
     const schema = context.getSchema();
     const cost = {
       schema,
       sizeArguments,
       defaultFirst,
+      variableSize,
       ignoreIntrospection: options.ignoreIntrospection ?? false,
-      getFragment: (name) => context.getFragment(name),
-      fragmentCosts: new Map,
-      costing: new Set
+      ...newFragmentWalk((name) => context.getFragment(name))
     };
     return {
       OperationDefinition(operation) {
@@ -683,5 +714,5 @@ export {
   withValidation
 };
 
-//# debugId=3B937DADAE820B8964756E2164756E21
+//# debugId=B1856E23719B140164756E2164756E21
 //# sourceMappingURL=index.js.map