@plasius/schema 1.4.0 → 1.4.2

package/README.md

@@ -113,7 +113,9 @@ reporting:
 
 ```ts
 import {
+  FeedbackBugHealthMetricsProjectionSchema,
   FeedbackBugPacketSchema,
+  FeedbackCommittedAcceptanceEvidenceSchema,
   FeedbackPublicSummarySchema,
   FeedbackRichTextAstSchema,
   FeedbackReviewPacketSchema,
@@ -227,13 +229,44 @@ hours and review suppression at 30 days; acceptance receipts distinguish bugs
 from reviews and accept only the five-step bug ladder or exact 30-day review
 period.
 
+`FeedbackCommittedAcceptanceEvidenceSchema` is a separate, durable proof that
+the control-plane commit for one immutable packet completed. It contains only
+the canonical packet UUID, `bug`/`review` kind, and the packet's canonical
+server-owned UTC acceptance time. Canonical timestamp validation rejects
+impossible calendar or clock values as ordinary closed validation failures; it
+does not expose the rejected value or a native date exception. It cannot
+express a control-state key, reservation, idempotency value, reporter
+pseudonym, request metadata, Blob locator, content hash, narrative, ciphertext,
+or pixels, and its PII audit is empty. Only a trusted delivery worker may
+construct this evidence after an atomic control-plane commit; it is not an
+intake request. Report processors must select packets through this evidence
+rather than by enumerating packet storage, preventing an immutable Blob written
+before a failed commit from entering aggregates. See
+[ADR-0011](./docs/adrs/adr-0011-identifier-free-feedback-acceptance-evidence.md).
+
+`FeedbackBugHealthMetricsProjectionSchema` is the separate trusted input for
+facts that accepted packets cannot supply: application rejection counts,
+privacy-safe traffic denominators, and allowlisted abuse-control block bands.
+It covers one exact UTC hour, is finalized no earlier than the window end, and
+contains no raw edge event, request, reporter, client, route, narrative, or
+pixel data. Abuse bands are unique, non-zero, and ordered by the frozen
+`FEEDBACK_ABUSE_BLOCK_BANDS` vocabulary. A producer must derive the
+`projectionId` deterministically from the hour and consumers must verify that
+binding before materialization; the schema deliberately performs no
+environment-dependent hashing. See
+[ADR-0012](./docs/adrs/adr-0012-identifier-free-bug-health-metrics-projection.md).
+
 All feedback contracts opt in to recursive unknown-field rejection, including
 direct references and arrays of references. Unshaped references admit only
 `type` and `id`; shaped references admit only those keys plus their declared
 fields. Closed feedback vocabularies and definition objects are runtime frozen
 before schemas capture them. Before recursive cloning, strict validation also
-performs an iterative whole-value node/depth budget so malformed containers
-hidden under scalar fields cannot exhaust the call stack. The
+performs an iterative whole-value node/depth budget and inspects own data
+property descriptors. It rejects enumerable accessors, symbol keys, exotic
+prototypes, sparse or oversized arrays, and malformed proxy traps without
+evaluating accessor values or reflecting thrown messages, so malformed
+containers hidden under scalar fields cannot exhaust the call stack or expand
+into an attacker-selected logical array length. The
 general schema default remains backwards-compatible stripping:
 
 ```ts

package/dist/{chunk-UQHPDQZX.js → chunk-GNL2RBO5.js}

@@ -1446,45 +1446,113 @@ function getShape(def) {
 var MAX_STRICT_VALIDATION_NODES = 1e4;
 var MAX_STRICT_VALIDATION_DEPTH = 256;
 var MAX_STRICT_VALIDATION_OBJECTS = MAX_STRICT_VALIDATION_NODES;
-function strictInputIsWithinComplexityLimit(input) {
-  const pending = [
-    { value: input, depth: 0 }
-  ];
+function snapshotStrictInput(input) {
+  const snapshot = Array.isArray(input) ? [] : {};
+  const pending = [{ source: input, target: snapshot, depth: 0 }];
   const seen = /* @__PURE__ */ new WeakSet();
-  let visitedNodes = 0;
+  let visitedNodes = 1;
   try {
     while (pending.length > 0) {
       const current = pending.pop();
       if (!current) {
         continue;
       }
-      visitedNodes += 1;
       if (visitedNodes > MAX_STRICT_VALIDATION_NODES || current.depth > MAX_STRICT_VALIDATION_DEPTH) {
-        return false;
+        return { valid: false };
       }
-      if (typeof current.value !== "object" || current.value === null) {
-        continue;
+      if (seen.has(current.source)) {
+        return { valid: false };
+      }
+      seen.add(current.source);
+      const isArray = Array.isArray(current.source);
+      const prototype = Object.getPrototypeOf(current.source);
+      if (isArray && prototype !== Array.prototype || !isArray && prototype !== Object.prototype && prototype !== null) {
+        return { valid: false };
+      }
+      const ownKeys = Reflect.ownKeys(current.source);
+      if (visitedNodes + ownKeys.length > MAX_STRICT_VALIDATION_NODES) {
+        return { valid: false };
       }
-      if (seen.has(current.value)) {
-        return false;
+      const descriptors = /* @__PURE__ */ new Map();
+      for (const key of ownKeys) {
+        const descriptor = Object.getOwnPropertyDescriptor(
+          current.source,
+          key
+        );
+        if (descriptor === void 0) {
+          return { valid: false };
+        }
+        descriptors.set(key, descriptor);
       }
-      seen.add(current.value);
-      const keys = Object.keys(current.value);
-      if (visitedNodes + pending.length + keys.length > MAX_STRICT_VALIDATION_NODES) {
-        return false;
+      if (isArray) {
+        const lengthDescriptor = descriptors.get("length");
+        if (lengthDescriptor === void 0 || !("value" in lengthDescriptor) || !Number.isSafeInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || lengthDescriptor.value > MAX_STRICT_VALIDATION_NODES) {
+          return { valid: false };
+        }
+        let elementCount = 0;
+        for (const key of ownKeys) {
+          if (key === "length") {
+            continue;
+          }
+          if (typeof key !== "string" || !/^(?:0|[1-9]\d*)$/.test(key)) {
+            return { valid: false };
+          }
+          const descriptor = descriptors.get(key);
+          if (descriptor === void 0 || descriptor.enumerable !== true || Number(key) >= lengthDescriptor.value) {
+            return { valid: false };
+          }
+          elementCount += 1;
+        }
+        if (elementCount !== lengthDescriptor.value) {
+          return { valid: false };
+        }
       }
-      const record = current.value;
+      visitedNodes += ownKeys.length;
+      const keys = ownKeys.filter(
+        (key) => descriptors.get(key)?.enumerable
+      );
       for (const key of keys) {
-        pending.push({
-          value: record[key],
-          depth: current.depth + 1
+        if (typeof key !== "string") {
+          return { valid: false };
+        }
+        if (isArray && !/^(?:0|[1-9]\d*)$/.test(key)) {
+          return { valid: false };
+        }
+        const descriptor = descriptors.get(key);
+        if (descriptor === void 0 || !("value" in descriptor) || descriptor.get !== void 0 || descriptor.set !== void 0) {
+          return { valid: false };
+        }
+        const child = descriptor.value;
+        if (typeof child === "function") {
+          return { valid: false };
+        }
+        if (typeof child === "object" && child !== null) {
+          const childSnapshot = Array.isArray(child) ? [] : {};
+          Object.defineProperty(current.target, key, {
+            value: childSnapshot,
+            enumerable: true,
+            configurable: true,
+            writable: true
+          });
+          pending.push({
+            source: child,
+            target: childSnapshot,
+            depth: current.depth + 1
+          });
+          continue;
+        }
+        Object.defineProperty(current.target, key, {
+          value: child,
+          enumerable: true,
+          configurable: true,
+          writable: true
         });
       }
     }
   } catch {
-    return false;
+    return { valid: false };
   }
-  return true;
+  return { valid: true, value: snapshot };
 }
 function strictReferenceShape(def) {
   return {
@@ -2051,8 +2119,10 @@ function createSchema(_shape, entityType, options = {
       if (typeof input !== "object" || input === null) {
         return { valid: false, errors: ["Input must be an object"] };
       }
+      let strictInputSnapshot;
       if (options.unknownFields === "reject") {
-        if (!strictInputIsWithinComplexityLimit(input)) {
+        const snapshot = snapshotStrictInput(input);
+        if (!snapshot.valid) {
           return {
             valid: false,
             errors: ["Strict validation complexity limit exceeded."],
@@ -2065,16 +2135,32 @@ function createSchema(_shape, entityType, options = {
             ]
           };
         }
+        strictInputSnapshot = snapshot.value;
         const scanState = {
           remainingObjects: MAX_STRICT_VALIDATION_OBJECTS,
           limitExceeded: false
         };
-        const locations = unknownFieldLocations(
-          input,
-          schema._shape,
-          "root",
-          scanState
-        );
+        let locations;
+        try {
+          locations = unknownFieldLocations(
+            strictInputSnapshot,
+            schema._shape,
+            "root",
+            scanState
+          );
+        } catch {
+          return {
+            valid: false,
+            errors: ["Strict validation complexity limit exceeded."],
+            issues: [
+              {
+                path: "root",
+                code: "validation_complexity_limit",
+                message: "Strict validation complexity limit exceeded."
+              }
+            ]
+          };
+        }
         if (scanState.limitExceeded) {
           return {
             valid: false,
@@ -2102,7 +2188,23 @@ function createSchema(_shape, entityType, options = {
           };
         }
       }
-      const working = typeof input === "object" && input !== null ? deepClone(input) : { ...input };
+      let working;
+      try {
+        working = strictInputSnapshot ?? (typeof input === "object" && input !== null ? deepClone(input) : { ...input });
+      } catch {
+        return {
+          valid: false,
+          errors: ["Input could not be safely cloned."],
+          issues: [
+            {
+              path: "root",
+              code: "unsafe_input",
+              message: "Input could not be safely cloned."
+            }
+          ]
+        };
+      }
+      const providedFieldNames = new Set(Object.keys(working));
       if (working.type == null) working.type = entityType;
       if (working.version == null) working.version = version;
       const fromVersion = String(working.version ?? "0.0.0");
@@ -2219,9 +2321,8 @@ function createSchema(_shape, entityType, options = {
       }
       if (errors.length === 0 && options.schemaValidator) {
         const castValue = result;
-        const source = input;
         const validationContext = Object.freeze({
-          wasProvided: (fieldName) => Object.prototype.hasOwnProperty.call(source, fieldName)
+          wasProvided: (fieldName) => providedFieldNames.has(fieldName)
         });
         if (!options.schemaValidator(castValue, validationContext)) {
           errors.push("Schema-level validation failed.");
@@ -2603,4 +2704,4 @@ export {
   FeedbackGameDiagnosticsSchema,
   validateFeedbackGameDiagnostics
 };
-//# sourceMappingURL=chunk-UQHPDQZX.js.map
+//# sourceMappingURL=chunk-GNL2RBO5.js.map