@ultimat3/time 25.0.0 → 25.1.0

package/CLAUDE.md

@@ -139,6 +139,8 @@
   canonical zero most emitters write — was refused along with `'PT0H0M0S'` and `'P0W'`, while
   `'P0D'` was let through by a special case. `ISO_8601` already requires a component group for any
   body past a bare `'P'`, which is the case the guard was written for.
+- **`parseDuration`'s rounded total must be `Number.isSafeInteger`** (`safeTotal`, both arms) —
+  finite components can still sum to `Infinity` or past 2^53. `X_DURATION_INVALID`.
 - **An impossible day/month pair is refused by `parseCron`, in constant time.**
   `isValidCron('0 0 30 2 *')` answered `true` and the refusal arrived ~150 ms later out of
   `nextCronOccurrence`, after 200,000 walk steps — a cost `firedSince` pays on every tick of the

package/README.md

@@ -220,7 +220,7 @@ negated; an empty one is `0` in either direction, never `-0`.
 |---|---|
 | `X_TIMEZONE_INVALID` | not `Area/Location` or `UTC`: an abbreviation (`CET`), a numeric offset (`+02:00`), or a single-label legacy name (`Japan`) |
 | `X_CRON_INVALID` | unparseable expression, or one that can never match |
-| `X_DURATION_INVALID` | `'3'` with no unit, trailing junk, unknown unit |
+| `X_DURATION_INVALID` | `'3'` with no unit, trailing junk, unknown unit, or a total past `Number.MAX_SAFE_INTEGER` ms (`'99999999999999999999d'`) |
 | `X_DST_AMBIGUOUS` | overlap hit with `overlap: 'throw'` |
 | `X_DST_NONEXISTENT` | gap hit with `gap: 'throw'` |
 | `X_INSTANT_INVALID` | unparseable timestamp |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/time",
-  "version": "25.0.0",
+  "version": "25.1.0",
   "description": "UTC instants, DST-correct zone math, cron, durations and Intl formatting with an explicit timezone",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "25.0.0",
-    "@ultimat3/schema": "25.0.0"
+    "@ultimat3/core": "25.1.0",
+    "@ultimat3/schema": "25.1.0"
   }
 }

package/src/duration.ts

@@ -40,7 +40,7 @@ export function parseDuration(input: string): number {
   const negative = value.startsWith('-');
   const body = negative ? value.slice(1) : value;
 
-  if (/^p/i.test(body)) return (negative ? -1 : 1) * parseIso8601Duration(body, input);
+  if (/^p/i.test(body)) return safeTotal(parseIso8601Duration(body, input), negative, input);
 
   COMPONENT.lastIndex = 0;
   let total = 0;
@@ -58,7 +58,18 @@ export function parseDuration(input: string): number {
   // Sticky matching starts at 0, so anything short of the end is trailing junk, and a
   // zero-length match means there was no unit at all (`'3'` must not mean 3 of anything).
   if (matched === 0 || matched !== body.length) throw durationInvalid(input);
-  return (negative ? -1 : 1) * Math.round(total);
+  return safeTotal(Math.round(total), negative, input);
+}
+
+/**
+ * Each component is finite and their SUM still need not be: `'9'.repeat(305) + 'd'` is
+ * `Infinity`, and twenty nines of days is 8.64e27 — past 2^53, where no timer, `Date` or
+ * `wakeAt > now` reads what was written. Refused like any other unreadable duration, on the
+ * rounded total of both arms.
+ */
+function safeTotal(ms: number, negative: boolean, input: string): number {
+  if (!Number.isSafeInteger(ms)) throw durationInvalid(input);
+  return negative ? -ms : ms;
 }
 
 /**