@plasius/economy 0.1.0 → 0.2.0

package/README.md

@@ -45,7 +45,13 @@ const restored = parseTokenSubunits(wireAmount); // 50000n
 ```
 
 Non-canonical values such as `"01"`, decimals, exponent notation, and values
-outside signed PostgreSQL `bigint` range are rejected.
+outside signed PostgreSQL `bigint` range are rejected. Runtime validators also
+reject non-string JSON values rather than coercing numbers into wire amounts.
+
+`ActivityEntryV1` contains both a stable `source` (`shopify`, `ayet`, `bitlabs`,
+`subscription`, `event`, `competition`, or `adjustment`) and a bounded
+display-oriented `sourceLabel`. Filters and reconciliation must use `source`;
+localized UI must use `sourceLabel`.
 
 ## Baseline GBP catalog
 

package/dist/index.cjs

@@ -119,7 +119,7 @@ function assertInRange(amount) {
 }
 function parseTokenSubunits(value) {
   economyAssert(
-    CANONICAL_INTEGER.test(value),
+    typeof value === "string" && CANONICAL_INTEGER.test(value),
     "INVALID_AMOUNT",
     "TokenSubunit amount must be a canonical base-10 integer string"
   );
@@ -168,12 +168,17 @@ var ECONOMY_CONTRACT_VERSION = "1";
 var IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 function assertEconomyIdentifier(value, label = "identifier") {
   economyAssert(
-    IDENTIFIER.test(value),
+    typeof value === "string" && IDENTIFIER.test(value),
     "INVALID_CONTRACT",
     `${label} must be a non-empty opaque identifier`
   );
 }
 function parseIsoTimestamp(value) {
+  economyAssert(
+    typeof value === "string",
+    "INVALID_CONTRACT",
+    "Timestamp must be an ISO-8601 UTC value"
+  );
   const match = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d{3}))?Z$/u.exec(
     value
   );
@@ -895,6 +900,15 @@ var ACTIVITY_STATUSES = /* @__PURE__ */ new Set([
   "reversed",
   "failed"
 ]);
+var ACTIVITY_SOURCES = /* @__PURE__ */ new Set([
+  "shopify",
+  "ayet",
+  "bitlabs",
+  "subscription",
+  "event",
+  "competition",
+  "adjustment"
+]);
 function assertCanonicalHash(value, label) {
   economyAssert(
     /^sha256:[a-f0-9]{64}$/u.test(value),
@@ -916,9 +930,9 @@ function assertActivityEntry(entry) {
   );
   assertEconomyIdentifier(entry.transactionId, "transactionId");
   economyAssert(
-    ACTIVITY_TYPES.has(entry.activityType) && ACTIVITY_STATUSES.has(entry.status),
+    ACTIVITY_TYPES.has(entry.activityType) && ACTIVITY_STATUSES.has(entry.status) && ACTIVITY_SOURCES.has(entry.source),
     "INVALID_CONTRACT",
-    "Activity type or status is unsupported"
+    "Activity type, status, or source is unsupported"
   );
   parseIsoTimestamp(entry.occurredAt);
   economyAssert(
@@ -934,13 +948,13 @@ function assertActivityEntry(entry) {
   }
   if (entry.maskedReference !== void 0) {
     economyAssert(
-      entry.maskedReference.length > 0 && entry.maskedReference.length <= 128 && !hasControlCharacters(entry.maskedReference),
+      typeof entry.maskedReference === "string" && entry.maskedReference.length > 0 && entry.maskedReference.length <= 128 && !hasControlCharacters(entry.maskedReference),
       "INVALID_CONTRACT",
       "Masked activity references must be bounded and safe for display"
     );
   }
   economyAssert(
-    entry.sourceLabel.trim().length > 0 && entry.sourceLabel.length <= 128 && !hasControlCharacters(entry.sourceLabel),
+    typeof entry.sourceLabel === "string" && entry.sourceLabel.trim().length > 0 && entry.sourceLabel.length <= 128 && !hasControlCharacters(entry.sourceLabel),
     "INVALID_CONTRACT",
     "Activity source labels must be bounded and safe for display"
   );