@taprootio/docs-artifact 1.0.1 → 1.1.1

package/index.d.ts

@@ -175,6 +175,10 @@ export interface DocsArtifactLimits {
 
 export const MANIFEST_FILE_NAME: "taproot-docs-manifest.json";
 export const SCHEMA_VERSION: 1;
+export const MANAGED_MANIFEST_FILE_NAME: "taproot-docs-manifest.json";
+export const MANAGED_SCHEMA_VERSION: 1;
+export const MANAGED_MODE: "managed";
+export const MANAGED_ARCHIVE_FORMAT: "taproot-docs-tar-gzip-v1";
 export const HTML_FRAGMENT_CAPABILITY: "taproot.docs.fragments.html.v1";
 export const SUPPORTED_CAPABILITIES: readonly string[];
 export const ASSET_MEDIA_TYPES: readonly DocsAssetMediaType[];
@@ -192,6 +196,9 @@ export function normalizeRoute(value: unknown): NormalizedPath | InvalidPath;
 export function validateManifest(input: unknown, options?: ValidationOptions): ValidationResult<DocsArtifactManifest>;
 export function assertValidManifest(input: unknown, options?: ValidationOptions): DocsArtifactManifest;
 export function serializeManifest(input: unknown, options?: ValidationOptions): string;
+export const validateManagedManifest: typeof validateManifest;
+export const assertValidManagedManifest: typeof assertValidManifest;
+export const serializeManagedManifest: typeof serializeManifest;
 export function validateArtifact(
   manifest: unknown,
   files: Iterable<ArtifactFileEntry>,
@@ -202,3 +209,5 @@ export function assertValidArtifact(
   files: Iterable<ArtifactFileEntry>,
   options?: ValidationOptions,
 ): Promise<ValidatedArtifact>;
+export const validateManagedArtifact: typeof validateArtifact;
+export const assertValidManagedArtifact: typeof assertValidArtifact;

package/node.d.ts

@@ -4,3 +4,4 @@ export function validateArtifactDirectory(
   rootDirectory: string,
   options?: ValidationOptions,
 ): Promise<ValidationResult<ValidatedArtifact>>;
+export const validateManagedArtifactDirectory: typeof validateArtifactDirectory;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@taprootio/docs-artifact",
-  "version": "1.0.1",
-  "description": "Canonical Taproot Docs artifact schema, validator, and conformance fixtures",
+  "version": "1.1.1",
+  "description": "Canonical managed and prebuilt Taproot Docs artifact contracts",
   "type": "module",
   "license": "ISC",
   "repository": {
@@ -25,8 +25,26 @@
       "types": "./conformance.d.ts",
       "import": "./src/conformance.js"
     },
+    "./prebuilt": {
+      "types": "./prebuilt.d.ts",
+      "import": "./src/prebuilt.js"
+    },
+    "./prebuilt/archive": {
+      "types": "./prebuilt-archive.d.ts",
+      "import": "./src/prebuilt-archive.js"
+    },
+    "./prebuilt/node": {
+      "types": "./prebuilt-node.d.ts",
+      "import": "./src/prebuilt-node.js"
+    },
+    "./prebuilt/conformance": {
+      "types": "./prebuilt-conformance.d.ts",
+      "import": "./src/prebuilt-conformance.js"
+    },
     "./schema": "./schema/taproot-docs-manifest.schema.json",
-    "./fixtures/conformance.json": "./fixtures/conformance.json"
+    "./prebuilt/schema": "./schema/taproot-docs-prebuilt-manifest.schema.json",
+    "./fixtures/conformance.json": "./fixtures/conformance.json",
+    "./fixtures/prebuilt/conformance.json": "./fixtures/prebuilt/conformance.json"
   },
   "bin": {
     "taproot-docs-validate": "./bin/taproot-docs-validate.js"
@@ -40,12 +58,17 @@
     "README.md",
     "index.d.ts",
     "node.d.ts",
-    "conformance.d.ts"
+    "conformance.d.ts",
+    "prebuilt.d.ts",
+    "prebuilt-archive.d.ts",
+    "prebuilt-node.d.ts",
+    "prebuilt-conformance.d.ts"
   ],
   "scripts": {
     "test": "node --test",
     "conformance": "node ./bin/taproot-docs-conformance.js",
-    "prepack": "npm test && npm run conformance"
+    "conformance:prebuilt": "node ./bin/taproot-docs-conformance.js --mode prebuilt",
+    "prepack": "npm test && npm run conformance && npm run conformance:prebuilt"
   },
   "publishConfig": {
     "access": "public",

package/prebuilt-archive.d.ts

@@ -0,0 +1,27 @@
+import type { PrebuiltValidationOptions, ValidatedPrebuiltArtifact } from "./prebuilt.js";
+
+export { DocsArtifactValidationError } from "./index.js";
+
+export interface DeterministicPrebuiltArchive {
+  readonly format: "taproot-docs-prebuilt-tar-gzip-v1";
+  readonly bytes: Uint8Array;
+  readonly byteLength: number;
+  readonly contentHash: `sha256:${string}`;
+}
+
+export class PrebuiltArchiveError extends Error {
+  readonly code: string;
+  readonly field?: string;
+  constructor(code: string, message: string, field?: string);
+}
+
+/**
+ * Encodes an isolated snapshot returned by `validatePrebuiltArtifact` or
+ * `validatePrebuiltArtifactDirectory` into the frozen prebuilt archive format.
+ * Throws `PrebuiltArchiveError` for inventory, size, or hash faults and
+ * `DocsArtifactValidationError` when the snapshot manifest fails revalidation.
+ */
+export function createDeterministicPrebuiltArchive(
+  snapshot: ValidatedPrebuiltArtifact,
+  options?: PrebuiltValidationOptions,
+): DeterministicPrebuiltArchive;

package/prebuilt-conformance.d.ts

@@ -0,0 +1,27 @@
+import type { ArtifactFileEntry } from "./index.js";
+import type { ValidationResult } from "./index.js";
+import type { ValidatedPrebuiltArtifact } from "./prebuilt.js";
+
+export interface PrebuiltNodeConformanceScenario {
+  type: "replace-file-with-directory-before-open";
+  path: string;
+}
+
+export interface PrebuiltArtifactConformanceCase {
+  name: string;
+  valid: boolean;
+  expectedCodes: string[];
+  manifest: Uint8Array;
+  files: ArtifactFileEntry[];
+  nodeScenario?: PrebuiltNodeConformanceScenario;
+  expectedArchive?: {
+    bytes: Uint8Array;
+    byteLength: number;
+    sha256: `sha256:${string}`;
+  };
+}
+
+export function loadPrebuiltConformanceCases(): Promise<PrebuiltArtifactConformanceCase[]>;
+export function validatePrebuiltConformanceCase(
+  fixture: PrebuiltArtifactConformanceCase,
+): Promise<ValidationResult<ValidatedPrebuiltArtifact>>;

package/prebuilt-node.d.ts

@@ -0,0 +1,7 @@
+import type { ValidationResult } from "./index.js";
+import type { PrebuiltValidationOptions, ValidatedPrebuiltArtifact } from "./prebuilt.js";
+
+export function validatePrebuiltArtifactDirectory(
+  rootDirectory: string,
+  options?: PrebuiltValidationOptions,
+): Promise<ValidationResult<ValidatedPrebuiltArtifact>>;

package/prebuilt.d.ts

@@ -0,0 +1,128 @@
+import type {
+  ArtifactFileContent,
+  ArtifactFileEntry,
+  DocsArtifactBuild,
+  DocsArtifactSource,
+  NormalizedPath,
+  InvalidPath,
+  ValidationResult,
+} from "./index.js";
+
+export type PrebuiltMediaType =
+  | "application/json; charset=utf-8"
+  | "application/manifest+json; charset=utf-8"
+  | "application/octet-stream"
+  | "application/wasm"
+  | "application/xml; charset=utf-8"
+  | "font/otf"
+  | "font/ttf"
+  | "font/woff"
+  | "font/woff2"
+  | "image/avif"
+  | "image/gif"
+  | "image/jpeg"
+  | "image/png"
+  | "image/svg+xml"
+  | "image/vnd.microsoft.icon"
+  | "image/webp"
+  | "text/css; charset=utf-8"
+  | "text/html; charset=utf-8"
+  | "text/javascript; charset=utf-8"
+  | "text/plain; charset=utf-8";
+
+export interface PrebuiltArtifactCapabilities {
+  required: string[];
+  optional: string[];
+}
+
+export interface PrebuiltFile {
+  path: string;
+  mediaType: PrebuiltMediaType;
+  bytes: number;
+  sha256: string;
+}
+
+export interface PrebuiltResource {
+  key: string;
+  file: string;
+  title: string;
+}
+
+export interface PrebuiltRedirect {
+  from: string;
+  toResourceKey: string;
+  status: 301 | 308;
+}
+
+export interface PrebuiltArtifactManifest {
+  schemaVersion: 1;
+  mode: "prebuilt";
+  source: DocsArtifactSource;
+  build: DocsArtifactBuild;
+  capabilities: PrebuiltArtifactCapabilities;
+  notFoundFile: "404.html";
+  files: PrebuiltFile[];
+  resources: PrebuiltResource[];
+  redirects: PrebuiltRedirect[];
+}
+
+export interface PrebuiltValidationOptions {
+  supportedCapabilities?: Iterable<string> & object;
+}
+
+export type PrebuiltManifestInput = PrebuiltArtifactManifest | string | Uint8Array | ArrayBuffer;
+
+export interface ValidatedPrebuiltArtifact {
+  manifest: PrebuiltArtifactManifest;
+  /** Caller-isolated snapshots of the exact validated bytes, in manifest path order. */
+  files: Array<{ path: string; content: Uint8Array }>;
+  fileCount: number;
+  totalBytes: number;
+}
+
+export interface PrebuiltArtifactLimits {
+  readonly manifestBytes: number;
+  readonly manifestObjectWork: number;
+  readonly manifestObjectDepth: number;
+  readonly artifactBytes: number;
+  readonly fileBytes: number;
+  readonly files: number;
+  readonly resources: number;
+  readonly redirects: number;
+  readonly artifactPathBytes: number;
+  readonly directoryDepth: number;
+  readonly directoryEntries: number;
+  readonly supportedCapabilities: number;
+  readonly resourceKey: number;
+  readonly title: number;
+  readonly routeBytes: number;
+}
+
+export const PREBUILT_MANIFEST_FILE_NAME: "taproot-docs-prebuilt-manifest.json";
+export const PREBUILT_SCHEMA_VERSION: 1;
+export const PREBUILT_MODE: "prebuilt";
+export const PREBUILT_ARCHIVE_FORMAT: "taproot-docs-prebuilt-tar-gzip-v1";
+export const PREBUILT_FILES_CAPABILITY: "taproot.docs.prebuilt.files.v1";
+export const PREBUILT_NOT_FOUND_FILE: "404.html";
+export const PREBUILT_SUPPORTED_CAPABILITIES: readonly string[];
+export const PREBUILT_LIMITS: Readonly<PrebuiltArtifactLimits>;
+export const PREBUILT_MEDIA_TYPES: readonly PrebuiltMediaType[];
+export const PREBUILT_TEXT_MEDIA_TYPES: readonly PrebuiltMediaType[];
+
+export { DocsArtifactValidationError } from "./index.js";
+export function normalizePrebuiltArtifactPath(value: unknown): NormalizedPath | InvalidPath;
+export function normalizePrebuiltRedirectRoute(value: unknown): NormalizedPath | InvalidPath;
+export function prebuiltFileRoute(value: unknown): NormalizedPath | InvalidPath;
+export function validatePrebuiltManifest(input: unknown, options?: PrebuiltValidationOptions): ValidationResult<PrebuiltArtifactManifest>;
+export function assertValidPrebuiltManifest(input: unknown, options?: PrebuiltValidationOptions): PrebuiltArtifactManifest;
+export function serializePrebuiltManifest(input: unknown, options?: PrebuiltValidationOptions): string;
+export function validatePrebuiltArtifact(
+  manifest: unknown,
+  files: Iterable<ArtifactFileEntry>,
+  options?: PrebuiltValidationOptions,
+): Promise<ValidationResult<ValidatedPrebuiltArtifact>>;
+export function assertValidPrebuiltArtifact(
+  manifest: unknown,
+  files: Iterable<{ path: string; content: ArtifactFileContent }>,
+  options?: PrebuiltValidationOptions,
+): Promise<ValidatedPrebuiltArtifact>;

package/schema/taproot-docs-prebuilt-manifest.schema.json

@@ -0,0 +1,156 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:taproot:docs:prebuilt-artifact:manifest:v1",
+  "title": "Taproot Docs prebuilt artifact manifest",
+  "description": "Closed byte-preserving static Docs contract. Cross-reference, ASCII case-fold, redirect-source grammar, route-collision, required-array ordering, extension-bound media types, USTAR, aggregate-byte, UTF-8, and exact-inventory rules are additionally enforced by @taprootio/docs-artifact/prebuilt.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "mode", "source", "build", "capabilities", "notFoundFile", "files", "resources", "redirects"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "mode": { "const": "prebuilt" },
+    "source": { "$ref": "#/$defs/source" },
+    "build": { "$ref": "#/$defs/build" },
+    "capabilities": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["required", "optional"],
+      "properties": {
+        "required": {
+          "type": "array",
+          "maxItems": 100,
+          "uniqueItems": true,
+          "contains": { "const": "taproot.docs.prebuilt.files.v1" },
+          "items": { "$ref": "#/$defs/resourceKey" }
+        },
+        "optional": {
+          "type": "array",
+          "maxItems": 100,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/resourceKey" }
+        }
+      }
+    },
+    "notFoundFile": { "const": "404.html" },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 25000,
+      "items": { "$ref": "#/$defs/file" }
+    },
+    "resources": {
+      "type": "array",
+      "maxItems": 25000,
+      "items": { "$ref": "#/$defs/resource" }
+    },
+    "redirects": {
+      "type": "array",
+      "maxItems": 10000,
+      "items": { "$ref": "#/$defs/redirect" }
+    }
+  },
+  "$defs": {
+    "resourceKey": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 200,
+      "pattern": "^[a-z0-9]+(?:[._:/-][a-z0-9]+)*$"
+    },
+    "hash": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["provider", "repositoryId", "repository", "repositoryUrl", "revision", "ref"],
+      "properties": {
+        "provider": { "const": "github" },
+        "repositoryId": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "^[A-Za-z0-9_.:-]+$" },
+        "repository": { "type": "string", "minLength": 3, "maxLength": 300, "pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$" },
+        "repositoryUrl": { "type": "string", "format": "uri", "maxLength": 2000, "pattern": "^https://" },
+        "revision": { "type": "string", "pattern": "^(?:[0-9a-f]{40}|[0-9a-f]{64})$" },
+        "ref": { "type": "string", "maxLength": 500, "pattern": "^refs/(?:heads|tags)/[A-Za-z0-9][A-Za-z0-9._/-]*$" }
+      }
+    },
+    "build": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["producer", "producerVersion", "configurationSha256", "sourceDateEpoch"],
+      "properties": {
+        "producer": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "^(?:@[a-z0-9._-]+/)?[a-z0-9._-]+$" },
+        "producerVersion": { "type": "string", "maxLength": 100, "pattern": "^(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$" },
+        "configurationSha256": { "$ref": "#/$defs/hash" },
+        "sourceDateEpoch": { "type": "integer", "minimum": 0, "maximum": 253402300799 }
+      }
+    },
+    "path": {
+      "type": "string",
+      "$comment": "Runtime validation additionally enforces the 255-byte total, 64-directory, Windows-device, manifest-name, case-fold, and USTAR name/prefix constraints.",
+      "minLength": 1,
+      "maxLength": 255,
+      "pattern": "^(?:[A-Za-z0-9]|[A-Za-z0-9_-][A-Za-z0-9._-]*[A-Za-z0-9])(?:/(?:[A-Za-z0-9]|[A-Za-z0-9_-][A-Za-z0-9._-]*[A-Za-z0-9]))*$"
+    },
+    "mediaType": {
+      "enum": [
+        "application/json; charset=utf-8",
+        "application/manifest+json; charset=utf-8",
+        "application/octet-stream",
+        "application/wasm",
+        "application/xml; charset=utf-8",
+        "font/otf",
+        "font/ttf",
+        "font/woff",
+        "font/woff2",
+        "image/avif",
+        "image/gif",
+        "image/jpeg",
+        "image/png",
+        "image/svg+xml",
+        "image/vnd.microsoft.icon",
+        "image/webp",
+        "text/css; charset=utf-8",
+        "text/html; charset=utf-8",
+        "text/javascript; charset=utf-8",
+        "text/plain; charset=utf-8"
+      ]
+    },
+    "file": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "mediaType", "bytes", "sha256"],
+      "properties": {
+        "path": { "$ref": "#/$defs/path" },
+        "mediaType": { "$ref": "#/$defs/mediaType" },
+        "bytes": { "type": "integer", "minimum": 0, "maximum": 67108864 },
+        "sha256": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "resource": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key", "file", "title"],
+      "properties": {
+        "key": { "$ref": "#/$defs/resourceKey" },
+        "file": { "$ref": "#/$defs/path" },
+        "title": { "type": "string", "minLength": 1, "maxLength": 300 }
+      }
+    },
+    "redirect": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["from", "toResourceKey", "status"],
+      "properties": {
+        "from": {
+          "type": "string",
+          "$comment": "Runtime validation additionally enforces portable ASCII segments; forbids percent signs, backslashes, queries, fragments, dot segments, empty segments, Windows device aliases, the reserved manifest route, and the routing-control route; and requires ASCII case-fold uniqueness.",
+          "minLength": 1,
+          "maxLength": 2000,
+          "pattern": "^/"
+        },
+        "toResourceKey": { "$ref": "#/$defs/resourceKey" },
+        "status": { "enum": [301, 308] }
+      }
+    }
+  }
+}

package/src/constants.js

@@ -1,5 +1,9 @@
 export const MANIFEST_FILE_NAME = "taproot-docs-manifest.json";
 export const SCHEMA_VERSION = 1;
+export const MANAGED_MANIFEST_FILE_NAME = MANIFEST_FILE_NAME;
+export const MANAGED_SCHEMA_VERSION = SCHEMA_VERSION;
+export const MANAGED_MODE = "managed";
+export const MANAGED_ARCHIVE_FORMAT = "taproot-docs-tar-gzip-v1";
 export const HTML_FRAGMENT_CAPABILITY = "taproot.docs.fragments.html.v1";
 
 export const SUPPORTED_CAPABILITIES = Object.freeze([

package/src/index.js

@@ -5,6 +5,10 @@ export {
   FRAGMENT_ROLES,
   HTML_FRAGMENT_CAPABILITY,
   LIMITS,
+  MANAGED_ARCHIVE_FORMAT,
+  MANAGED_MANIFEST_FILE_NAME,
+  MANAGED_MODE,
+  MANAGED_SCHEMA_VERSION,
   MANIFEST_FILE_NAME,
   RESERVED_ROUTE_PREFIXES,
   RESERVED_ROUTES,
@@ -13,6 +17,15 @@ export {
   SUPPORTED_CAPABILITIES,
 } from "./constants.js";
 export { assertValidArtifact, validateArtifact } from "./artifact-validator.js";
+export {
+  assertValidArtifact as assertValidManagedArtifact,
+  validateArtifact as validateManagedArtifact,
+} from "./artifact-validator.js";
 export { DocsArtifactValidationError } from "./errors.js";
 export { assertValidManifest, serializeManifest, validateManifest } from "./manifest-validator.js";
+export {
+  assertValidManifest as assertValidManagedManifest,
+  serializeManifest as serializeManagedManifest,
+  validateManifest as validateManagedManifest,
+} from "./manifest-validator.js";
 export { normalizeArtifactPath, normalizeRoute, normalizeSourcePath } from "./path.js";

package/src/json.js

@@ -11,9 +11,10 @@ class StrictJsonError extends Error {
 }
 
 class StrictJsonParser {
-  constructor(text) {
+  constructor(text, maximumDepth = LIMITS.manifestObjectDepth) {
     this.text = text;
     this.offset = 0;
+    this.maximumDepth = maximumDepth;
   }
 
   parse() {
@@ -27,8 +28,8 @@ class StrictJsonParser {
   }
 
   #parseValue(path, depth) {
-    if (depth > 64) {
-      throw new StrictJsonError("json.too_deep", "JSON nesting may not exceed 64 levels.", path);
+    if (depth > this.maximumDepth) {
+      throw new StrictJsonError("json.too_deep", `JSON nesting may not exceed ${this.maximumDepth} levels.`, path);
     }
     const char = this.text[this.offset];
     if (char === "{") return this.#parseObject(path, depth + 1);
@@ -210,10 +211,10 @@ export function classifyManifestInput(input) {
   return { kind: "object" };
 }
 
-function asBytes(input, classification = classifyManifestInput(input)) {
+function asBytes(input, classification = classifyManifestInput(input), maximumBytes = LIMITS.manifestBytes) {
   if (typeof input === "string") {
-    if (input.length > LIMITS.manifestBytes) {
-      throw new StrictJsonError("manifest.too_large", `Manifest bytes may not exceed ${LIMITS.manifestBytes}.`);
+    if (input.length > maximumBytes) {
+      throw new StrictJsonError("manifest.too_large", `Manifest bytes may not exceed ${maximumBytes}.`);
     }
     let byteLength = 0;
     for (let offset = 0; offset < input.length; offset += 1) {
@@ -230,39 +231,44 @@ function asBytes(input, classification = classifyManifestInput(input)) {
       } else {
         byteLength += first <= 0x7f ? 1 : first <= 0x7ff ? 2 : 3;
       }
-      if (byteLength > LIMITS.manifestBytes) {
-        throw new StrictJsonError("manifest.too_large", `Manifest bytes may not exceed ${LIMITS.manifestBytes}.`);
+      if (byteLength > maximumBytes) {
+        throw new StrictJsonError("manifest.too_large", `Manifest bytes may not exceed ${maximumBytes}.`);
       }
     }
     return new TextEncoder().encode(input);
   }
   if (classification.kind === "uint8array" || classification.kind === "arraybuffer") {
-    const snapshot = snapshotBinaryInput(input, LIMITS.manifestBytes, classification);
+    const snapshot = snapshotBinaryInput(input, maximumBytes, classification);
     if (snapshot.kind === "too_large") {
-      throw new StrictJsonError("manifest.too_large", `Manifest bytes may not exceed ${LIMITS.manifestBytes}.`);
+      throw new StrictJsonError("manifest.too_large", `Manifest bytes may not exceed ${maximumBytes}.`);
     }
     if (snapshot.kind === "bytes") return snapshot.bytes;
   }
   throw new TypeError("Manifest input must be a string, Uint8Array, or ArrayBuffer.");
 }
 
-export function parseManifestJson(input, classification = classifyManifestInput(input)) {
+export function parseManifestJson(
+  input,
+  classification = classifyManifestInput(input),
+  maximumBytes = LIMITS.manifestBytes,
+  maximumDepth = LIMITS.manifestObjectDepth,
+) {
   let bytes;
   try {
-    bytes = asBytes(input, classification);
+    bytes = asBytes(input, classification, maximumBytes);
   } catch (error) {
     if (error instanceof StrictJsonError) {
       return { ok: false, errors: [sanitizeValidationError(error)] };
     }
     return { ok: false, errors: [sanitizeValidationError({ code: "json.invalid_input", path: "$", message: error.message })] };
   }
-  if (bytes.byteLength > LIMITS.manifestBytes) {
+  if (bytes.byteLength > maximumBytes) {
     return {
       ok: false,
       errors: [sanitizeValidationError({
         code: "manifest.too_large",
         path: "$",
-        message: `Manifest bytes may not exceed ${LIMITS.manifestBytes}.`,
+        message: `Manifest bytes may not exceed ${maximumBytes}.`,
       })],
     };
   }
@@ -278,7 +284,7 @@ export function parseManifestJson(input, classification = classifyManifestInput(
   }
 
   try {
-    return { ok: true, value: new StrictJsonParser(text).parse() };
+    return { ok: true, value: new StrictJsonParser(text, maximumDepth).parse() };
   } catch (error) {
     if (error instanceof StrictJsonError) {
       return { ok: false, errors: [sanitizeValidationError(error)] };
@@ -380,17 +386,29 @@ function jsonStringByteLength(value, maximumBytes) {
   return bytes;
 }
 
-export function preflightManifestObject(value) {
+export function preflightManifestObject(value, limits = {}) {
+  const maximumBytes = limits.manifestBytes ?? LIMITS.manifestBytes;
+  const maximumWork = limits.manifestObjectWork ?? LIMITS.manifestObjectWork;
+  const maximumDepth = limits.manifestObjectDepth ?? LIMITS.manifestObjectDepth;
+  const stopAtByteLimit = limits.stopAtByteLimit === true;
   const visiting = new WeakSet();
   const cachedSubtrees = new WeakMap();
   const state = { work: 0 };
-  const add = (left, right) => Math.min(LIMITS.manifestBytes + 1, left + right);
+  const byteLimitError = () => new ManifestObjectPreflightError(
+    "manifest.too_large",
+    `Canonical manifest bytes may not exceed ${maximumBytes}.`,
+  );
+  const checkByteLimit = (bytes) => {
+    if (stopAtByteLimit && bytes > maximumBytes) throw byteLimitError();
+    return Math.min(maximumBytes + 1, bytes);
+  };
+  const add = (left, right) => checkByteLimit(left + right);
   const consumeWork = (logicalWork = 1) => {
     state.work += logicalWork;
-    if (state.work > LIMITS.manifestObjectWork) {
+    if (state.work > maximumWork) {
       throw new ManifestObjectPreflightError(
         "manifest.too_large",
-        `Manifest object validation work may not exceed ${LIMITS.manifestObjectWork} values.`,
+        `Manifest object validation work may not exceed ${maximumWork} values.`,
       );
     }
   };
@@ -398,7 +416,7 @@ export function preflightManifestObject(value) {
     if (typeof candidate === "string") {
       consumeWork();
       return {
-        bytes: jsonStringByteLength(candidate, LIMITS.manifestBytes),
+        bytes: jsonStringByteLength(candidate, maximumBytes),
         logicalWork: 1,
         relativeDepth: -1,
         snapshot: candidate,
@@ -425,19 +443,19 @@ export function preflightManifestObject(value) {
     }
     const cached = cachedSubtrees.get(candidate);
     if (cached !== undefined) {
-      if (depth + cached.relativeDepth > LIMITS.manifestObjectDepth) {
+      if (depth + cached.relativeDepth > maximumDepth) {
         throw new ManifestObjectPreflightError(
           "manifest.object_too_deep",
-          `Manifest object nesting may not exceed ${LIMITS.manifestObjectDepth} levels.`,
+          `Manifest object nesting may not exceed ${maximumDepth} levels.`,
         );
       }
       consumeWork(cached.logicalWork);
       return cached;
     }
-    if (depth > LIMITS.manifestObjectDepth) {
+    if (depth > maximumDepth) {
       throw new ManifestObjectPreflightError(
         "manifest.object_too_deep",
-        `Manifest object nesting may not exceed ${LIMITS.manifestObjectDepth} levels.`,
+        `Manifest object nesting may not exceed ${maximumDepth} levels.`,
       );
     }
     const workAtStart = state.work;
@@ -471,11 +489,17 @@ export function preflightManifestObject(value) {
       snapshot = Object.create(null);
       let first = true;
       for (const key of Object.keys(candidate)) {
+        if (stopAtByteLimit) {
+          let minimumBytes = bytes;
+          if (!first) minimumBytes = add(minimumBytes, 1);
+          minimumBytes = add(minimumBytes, jsonStringByteLength(key, maximumBytes));
+          add(minimumBytes, 1);
+        }
         const child = visit(Reflect.get(candidate, key), depth + 1);
         if (child.snapshot === OMITTED_JSON_VALUE) continue;
         if (!first) bytes = add(bytes, 1);
         first = false;
-        bytes = add(bytes, jsonStringByteLength(key, LIMITS.manifestBytes));
+        bytes = add(bytes, jsonStringByteLength(key, maximumBytes));
         bytes = add(bytes, 1);
         bytes = add(bytes, child.bytes);
         relativeDepth = Math.max(relativeDepth, child.relativeDepth + 1);
@@ -497,7 +521,7 @@ export function preflightManifestObject(value) {
     const result = visit(value, 0);
     return {
       ok: true,
-      exceedsByteLimit: result.bytes > LIMITS.manifestBytes,
+      exceedsByteLimit: result.bytes > maximumBytes,
       value: result.snapshot === OMITTED_JSON_VALUE ? undefined : result.snapshot,
     };
   } catch (error) {