@wirebench/engine 2.2.0 → 3.1.0-rc.1

package/dist/{rest/openapi → json/schema}/sample.d.ts

@@ -44,6 +44,10 @@ export interface SampleOptions {
     /** How many values the sample may hold. Defaults to {@link MAX_SAMPLE_NODES}. */
     readonly maxNodes?: number;
 }
+/** The type to generate for, ignoring `null` — which is an alternative, not a shape. */
+export declare function effectiveType(schema: JsonSchema): string | undefined;
+/** The schema an `allOf` amounts to: every branch merged, later branches filling in blanks. */
+export declare function mergeAllOf(schema: JsonSchema): JsonSchema;
 /**
  * A sample value for one schema.
  *

package/dist/{rest/openapi → json/schema}/sample.js

@@ -60,7 +60,7 @@ function isNullable(schema) {
     return schema.nullable === true || typesOf(schema).has('null');
 }
 /** The type to generate for, ignoring `null` — which is an alternative, not a shape. */
-function effectiveType(schema) {
+export function effectiveType(schema) {
     for (const type of typesOf(schema)) {
         if (type !== 'null') {
             return type;
@@ -109,7 +109,7 @@ function without(schema, ...keys) {
     return copy;
 }
 /** The schema an `allOf` amounts to: every branch merged, later branches filling in blanks. */
-function mergeAllOf(schema) {
+export function mergeAllOf(schema) {
     if (schema.allOf === undefined || schema.allOf.length === 0) {
         return schema;
     }

package/dist/json/schema/source.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Where a description comes from.
+ *
+ * In `json/schema/` because the OpenAPI and the AsyncAPI imports take the same three sources, and no
+ * protocol folder imports another (protocol modules spec §7.2). `rest/openapi/import.ts` re-exports
+ * the type under the name it has always had.
+ */
+/** Where a document comes from: a location to fetch, or text the user already has. */
+export type OpenApiSource = {
+    readonly kind: 'url';
+    readonly url: string;
+} | {
+    readonly kind: 'file';
+    readonly path: string;
+}
+/** Text with a location to resolve relative references against — a paste, or a test. */
+ | {
+    readonly kind: 'text';
+    readonly text: string;
+    readonly location?: string;
+};

package/dist/json/schema/source.js

@@ -0,0 +1,8 @@
+/**
+ * Where a description comes from.
+ *
+ * In `json/schema/` because the OpenAPI and the AsyncAPI imports take the same three sources, and no
+ * protocol folder imports another (protocol modules spec §7.2). `rest/openapi/import.ts` re-exports
+ * the type under the name it has always had.
+ */
+export {};

package/dist/json/schema-validate.d.ts

@@ -0,0 +1,49 @@
+/**
+ * A bounded, in-house JSON Schema validator for contract checks.
+ *
+ * There is no JSON Schema validator in the engine and no new dependency is allowed for one, so
+ * this covers a draft-07-shaped subset: enough of AsyncAPI/OpenAPI message schemas to catch real
+ * mistakes without pulling in a library. Unsupported keywords (`format`, `if`/`then`/`else`,
+ * `dependencies`/`dependentSchemas`, `propertyNames`, `contains`, `unevaluated*`) and an unresolved
+ * `$ref` are silently accepted rather than asserted — a caller wanting to warn about that uses
+ * `unsupportedKeywordsIn` up front, once per document.
+ *
+ * The walk is recursive but shares one `{ nodes, problems }` budget across the whole call, so a
+ * pathological schema (a huge array, a `$ref` cycle it does not even try to resolve) cannot make
+ * validation expensive: it stops after `maxNodes` schema nodes visited or `maxProblems` problems
+ * collected, appending one `budget` problem when the node cap is what stopped it.
+ */
+/** One validation failure, located by a JSON pointer into the value that was checked. */
+export interface JsonSchemaProblem {
+    readonly path: string;
+    readonly keyword: string;
+    readonly message: string;
+}
+/** Caps that bound a single `validateJsonSchema` call. */
+export interface ValidateJsonOptions {
+    readonly maxNodes?: number;
+    readonly maxProblems?: number;
+    /**
+     * Word every message without the checked value's own content (a number, a length, a count), so a
+     * result can be kept where the body must not be: "below the minimum 0" rather than "-3 is less
+     * than 0". The schema's own values (bounds, patterns) and the value's keys still appear.
+     */
+    readonly redactValues?: boolean;
+    /**
+     * What a `pattern` (or `patternProperties` key) the validator will not run comes to: an unsafe
+     * pattern, or a value too long to test. `'report'` (the default) adds a "pattern not checked"
+     * problem; `'pass'` adds nothing, so the check neither fills the problem cap nor fails a
+     * combinator branch, for a caller whose own later check applies the pattern.
+     */
+    readonly uncheckedPatterns?: 'report' | 'pass';
+}
+export declare const MAX_VALIDATE_NODES = 10000;
+export declare const MAX_VALIDATE_PROBLEMS = 20;
+/** Keywords this validator recognises but never asserts; a document using one gets a summary line. */
+export declare const UNSUPPORTED_JSON_SCHEMA_KEYWORDS: readonly string[];
+/** Nested `walk` calls past this stop the walk (as the node cap does) instead of the stack. */
+export declare const MAX_VALIDATE_DEPTH = 256;
+/** Validates `value` against `schema`, returning every problem found (bounded by `options`). */
+export declare function validateJsonSchema(value: unknown, schema: unknown, options?: ValidateJsonOptions): JsonSchemaProblem[];
+/** Every keyword this validator does not assert, found anywhere in `schema` (deduplicated, sorted). */
+export declare function unsupportedKeywordsIn(schema: unknown): string[];

package/dist/json/schema-validate.js

@@ -0,0 +1,557 @@
+/**
+ * A bounded, in-house JSON Schema validator for contract checks.
+ *
+ * There is no JSON Schema validator in the engine and no new dependency is allowed for one, so
+ * this covers a draft-07-shaped subset: enough of AsyncAPI/OpenAPI message schemas to catch real
+ * mistakes without pulling in a library. Unsupported keywords (`format`, `if`/`then`/`else`,
+ * `dependencies`/`dependentSchemas`, `propertyNames`, `contains`, `unevaluated*`) and an unresolved
+ * `$ref` are silently accepted rather than asserted — a caller wanting to warn about that uses
+ * `unsupportedKeywordsIn` up front, once per document.
+ *
+ * The walk is recursive but shares one `{ nodes, problems }` budget across the whole call, so a
+ * pathological schema (a huge array, a `$ref` cycle it does not even try to resolve) cannot make
+ * validation expensive: it stops after `maxNodes` schema nodes visited or `maxProblems` problems
+ * collected, appending one `budget` problem when the node cap is what stopped it.
+ */
+export const MAX_VALIDATE_NODES = 10_000;
+export const MAX_VALIDATE_PROBLEMS = 20;
+/** Keywords this validator recognises but never asserts; a document using one gets a summary line. */
+export const UNSUPPORTED_JSON_SCHEMA_KEYWORDS = [
+    'contains',
+    'dependencies',
+    'dependentSchemas',
+    'format',
+    'if',
+    'propertyNames',
+    'then',
+    'else',
+    'unevaluatedItems',
+    'unevaluatedProperties',
+];
+const UNSUPPORTED_SET = new Set(UNSUPPORTED_JSON_SCHEMA_KEYWORDS);
+/** A string longer than this is never tested against a `pattern`: a contract's regex is
+ *  untrusted, and a bounded scan of a bounded string is the only combination this validator
+ *  will pay for. */
+const MAX_PATTERN_VALUE_LENGTH = 4_096;
+/** Compiled (or rejected) patterns, keyed by source text so a repeated pattern — the common case,
+ *  since one contract's messages share few distinct patterns — is scanned and compiled once. */
+const patternCache = new Map();
+/**
+ * Compiles `pattern`, refusing to run it at all when its shape can cause catastrophic
+ * backtracking: a quantified group whose body itself contains an unbounded quantifier (the
+ * `(a+)+` family), a backreference, or a lookaround. An invalid pattern compiles to `'invalid'`
+ * rather than throwing, matching this validator's existing "ignore, don't throw" rule.
+ */
+function safeCompile(pattern) {
+    const cached = patternCache.get(pattern);
+    if (cached !== undefined)
+        return cached;
+    let result;
+    if (isUnsafePattern(pattern)) {
+        result = 'unsafe';
+    }
+    else {
+        try {
+            result = new RegExp(pattern);
+        }
+        catch {
+            result = 'invalid';
+        }
+    }
+    patternCache.set(pattern, result);
+    return result;
+}
+/** Backreferences, lookarounds, and a quantified group whose body contains its own unbounded
+ *  quantifier — the shapes that make a regex engine's backtracking exponential in input length.
+ *  This is a heuristic scan, not a parser: it errs toward refusing rather than missing a risk. */
+function isUnsafePattern(pattern) {
+    if (/\\[1-9]/.test(pattern) || pattern.includes('\\k<'))
+        return true; // backreference, numbered or named
+    if (/\(\?<?[=!]/.test(pattern))
+        return true; // lookahead or lookbehind
+    return hasNestedUnboundedQuantifier(pattern);
+}
+const UNBOUNDED_QUANTIFIER_AT_START = /^(?:[*+]|\{\d*,\})/;
+function hasNestedUnboundedQuantifier(pattern) {
+    let inClass = false;
+    const groupHasUnbounded = [];
+    let risky = false;
+    for (let i = 0; i < pattern.length; i += 1) {
+        const c = pattern[i];
+        if (c === '\\') {
+            i += 1; // skip the escaped character, it is never a live metacharacter
+            continue;
+        }
+        if (inClass) {
+            if (c === ']')
+                inClass = false;
+            continue;
+        }
+        if (c === '[') {
+            inClass = true;
+            continue;
+        }
+        if (c === '(') {
+            groupHasUnbounded.push(false);
+            continue;
+        }
+        if (c === ')') {
+            const bodyHasUnbounded = groupHasUnbounded.pop() ?? false;
+            const quantified = UNBOUNDED_QUANTIFIER_AT_START.test(pattern.slice(i + 1));
+            if (bodyHasUnbounded && quantified)
+                risky = true;
+            if (groupHasUnbounded.length > 0 && (bodyHasUnbounded || quantified)) {
+                groupHasUnbounded[groupHasUnbounded.length - 1] = true;
+            }
+            continue;
+        }
+        if (groupHasUnbounded.length === 0)
+            continue;
+        if (c === '+' || c === '*') {
+            groupHasUnbounded[groupHasUnbounded.length - 1] = true;
+        }
+        else if (c === '{' && UNBOUNDED_QUANTIFIER_AT_START.test(pattern.slice(i))) {
+            groupHasUnbounded[groupHasUnbounded.length - 1] = true;
+        }
+    }
+    return risky;
+}
+/** Nested `walk` calls past this stop the walk (as the node cap does) instead of the stack. */
+export const MAX_VALIDATE_DEPTH = 256;
+/** A `Budget` that shares the outer walk's node counter but collects into its own problem list —
+ *  used to try a combinator's branch without either polluting the caller's problems or letting the
+ *  branch's own node visits escape the shared cap. */
+function branchBudget(outer, maxProblems) {
+    return {
+        get nodes() {
+            return outer.nodes;
+        },
+        set nodes(n) {
+            outer.nodes = n;
+        },
+        get depth() {
+            return outer.depth;
+        },
+        set depth(d) {
+            outer.depth = d;
+        },
+        maxNodes: outer.maxNodes,
+        problems: [],
+        maxProblems,
+        stopped: false,
+        outOfNodes: false,
+        outOfDepth: false,
+        redact: outer.redact,
+        passUnchecked: outer.passUnchecked,
+    };
+}
+/**
+ * Tries one combinator branch. A branch that ran out of nodes proved nothing either way: the stop
+ * is carried to the outer walk (which then gives no combinator verdict) and `undefined` returned.
+ */
+function tryBranch(value, sub, path, budget, applying) {
+    // A branch already being applied to this same value would be skipped by `walk` and so look like a
+    // pass; it proves nothing either way, so it gives no verdict (without stopping the walk).
+    if (isPlainObject(sub) && applying.has(sub))
+        return undefined;
+    const trial = branchBudget(budget, 1);
+    walk(value, sub, path, trial, applying);
+    if (trial.outOfNodes) {
+        budget.stopped = true;
+        budget.outOfNodes = true;
+        if (trial.outOfDepth)
+            budget.outOfDepth = true;
+        return undefined;
+    }
+    return trial.problems.length === 0;
+}
+/** Validates `value` against `schema`, returning every problem found (bounded by `options`). */
+export function validateJsonSchema(value, schema, options) {
+    const budget = {
+        nodes: 0,
+        maxNodes: options?.maxNodes ?? MAX_VALIDATE_NODES,
+        problems: [],
+        maxProblems: options?.maxProblems ?? MAX_VALIDATE_PROBLEMS,
+        stopped: false,
+        outOfNodes: false,
+        depth: 0,
+        outOfDepth: false,
+        redact: options?.redactValues === true,
+        passUnchecked: options?.uncheckedPatterns === 'pass',
+    };
+    walk(value, schema, '', budget);
+    if (budget.outOfNodes &&
+        budget.problems.at(-1)?.keyword !== 'budget' &&
+        budget.problems.length < budget.maxProblems) {
+        budget.problems.push({
+            path: '',
+            keyword: 'budget',
+            message: budget.outOfDepth
+                ? `validation stopped at nesting depth ${MAX_VALIDATE_DEPTH}`
+                : `validation stopped after ${budget.maxNodes} nodes`,
+        });
+    }
+    return budget.problems;
+}
+/** Every keyword this validator does not assert, found anywhere in `schema` (deduplicated, sorted). */
+export function unsupportedKeywordsIn(schema) {
+    const found = new Set();
+    const seen = new Set();
+    collectUnsupported(schema, found, seen);
+    return [...found].sort();
+}
+function collectUnsupported(node, found, seen) {
+    if (!isPlainObject(node) || seen.has(node))
+        return;
+    seen.add(node);
+    for (const key of Object.keys(node)) {
+        if (UNSUPPORTED_SET.has(key))
+            found.add(key);
+        collectUnsupported(node[key], found, seen);
+    }
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function report(budget, path, keyword, message) {
+    if (budget.problems.length >= budget.maxProblems) {
+        budget.stopped = true;
+        return;
+    }
+    budget.problems.push({ path, keyword, message });
+}
+function hasRoom(budget) {
+    if (budget.stopped)
+        return false;
+    if (budget.problems.length >= budget.maxProblems) {
+        budget.stopped = true;
+        return false;
+    }
+    if (budget.nodes >= budget.maxNodes) {
+        budget.stopped = true;
+        budget.outOfNodes = true;
+        return false;
+    }
+    budget.nodes += 1;
+    return true;
+}
+function typeName(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'array';
+    if (typeof value === 'number')
+        return Number.isInteger(value) ? 'integer' : 'number';
+    return typeof value;
+}
+function matchesType(value, want) {
+    if (want === 'integer')
+        return typeof value === 'number' && Number.isInteger(value);
+    if (want === 'number')
+        return typeof value === 'number';
+    return typeName(value) === want;
+}
+function jsonEquals(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b)
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        return a.every((v, i) => jsonEquals(v, b[i]));
+    }
+    if (isPlainObject(a) && isPlainObject(b)) {
+        const aKeys = Object.keys(a);
+        const bKeys = Object.keys(b);
+        if (aKeys.length !== bKeys.length)
+            return false;
+        return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && jsonEquals(a[k], b[k]));
+    }
+    return false;
+}
+/**
+ * Walks one schema node against one value, at `path`, appending problems into the shared budget.
+ *
+ * `applying` holds the schema objects already being applied to this same value (through
+ * `allOf`/`anyOf`/`oneOf`/`not`). A resolved document can be cyclic, and a schema that composes
+ * itself would otherwise recurse without ever moving in the value; re-entering one is skipped,
+ * since its constraints are already being checked here. Descending into a child value starts a
+ * fresh set, and the depth cap backs both up.
+ */
+function walk(value, schemaValue, path, budget, applying = new Set()) {
+    if (!hasRoom(budget))
+        return;
+    if (!isPlainObject(schemaValue))
+        return; // `true`/`false`/malformed schema: nothing to assert
+    if (applying.has(schemaValue))
+        return;
+    if (budget.depth >= MAX_VALIDATE_DEPTH) {
+        budget.stopped = true;
+        budget.outOfNodes = true;
+        budget.outOfDepth = true;
+        return;
+    }
+    applying.add(schemaValue);
+    budget.depth++;
+    try {
+        walkSchema(value, schemaValue, path, budget, applying);
+    }
+    finally {
+        budget.depth--;
+        applying.delete(schemaValue);
+    }
+}
+function walkSchema(value, schema, path, budget, applying) {
+    if (typeof schema.$ref === 'string')
+        return; // unresolved $ref: passes, per scope
+    const nullable = schema.nullable === true;
+    const rawTypes = schema.type === undefined ? undefined : Array.isArray(schema.type) ? schema.type : [schema.type];
+    const types = rawTypes?.filter((t) => typeof t === 'string');
+    if (value === null && (nullable || types?.includes('null'))) {
+        return; // an explicitly nullable slot accepts null without checking the rest of the schema
+    }
+    // 1. type
+    if (types && !types.some((t) => matchesType(value, t))) {
+        report(budget, path, 'type', `expected ${types.join(' or ')}, got ${typeName(value)}`);
+        return; // further keywords assume the right shape
+    }
+    // 2. const
+    if ('const' in schema) {
+        if (!jsonEquals(value, schema.const)) {
+            report(budget, path, 'const', `expected ${JSON.stringify(schema.const)}`);
+            return;
+        }
+    }
+    // 3. enum
+    if (Array.isArray(schema.enum)) {
+        if (!schema.enum.some((v) => jsonEquals(value, v))) {
+            report(budget, path, 'enum', 'not one of the allowed values');
+            return;
+        }
+    }
+    // 4. string checks
+    if (typeof value === 'string') {
+        if (typeof schema.minLength === 'number' && value.length < schema.minLength) {
+            report(budget, path, 'minLength', budget.redact
+                ? `shorter than the minimum length ${schema.minLength}`
+                : `length ${value.length} is less than ${schema.minLength}`);
+        }
+        if (typeof schema.maxLength === 'number' && value.length > schema.maxLength) {
+            report(budget, path, 'maxLength', budget.redact
+                ? `longer than the maximum length ${schema.maxLength}`
+                : `length ${value.length} is more than ${schema.maxLength}`);
+        }
+        if (typeof schema.pattern === 'string') {
+            const compiled = safeCompile(schema.pattern);
+            if (compiled === 'unsafe') {
+                if (!budget.passUnchecked) {
+                    report(budget, path, 'pattern', 'pattern not checked: unsafe for evaluation');
+                }
+            }
+            else if (compiled !== 'invalid') {
+                if (value.length > MAX_PATTERN_VALUE_LENGTH) {
+                    if (!budget.passUnchecked) {
+                        report(budget, path, 'pattern', `pattern not checked: value longer than ${MAX_PATTERN_VALUE_LENGTH} characters`);
+                    }
+                }
+                else if (!compiled.test(value)) {
+                    report(budget, path, 'pattern', `does not match /${schema.pattern}/`);
+                }
+            }
+            // an invalid pattern is ignored rather than thrown
+        }
+    }
+    // 5. number checks
+    if (typeof value === 'number') {
+        if (typeof schema.minimum === 'number' && value < schema.minimum) {
+            report(budget, path, 'minimum', budget.redact ? `below the minimum ${schema.minimum}` : `${value} is less than ${schema.minimum}`);
+        }
+        if (typeof schema.maximum === 'number' && value > schema.maximum) {
+            report(budget, path, 'maximum', budget.redact ? `above the maximum ${schema.maximum}` : `${value} is more than ${schema.maximum}`);
+        }
+        const exclusiveMin = schema.exclusiveMinimum;
+        if (typeof exclusiveMin === 'number' && value <= exclusiveMin) {
+            report(budget, path, 'exclusiveMinimum', budget.redact ? `not above the exclusive minimum ${exclusiveMin}` : `${value} is not more than ${exclusiveMin}`);
+        }
+        else if (exclusiveMin === true && typeof schema.minimum === 'number' && value <= schema.minimum) {
+            report(budget, path, 'exclusiveMinimum', budget.redact
+                ? `not above the exclusive minimum ${schema.minimum}`
+                : `${value} is not more than ${schema.minimum}`);
+        }
+        const exclusiveMax = schema.exclusiveMaximum;
+        if (typeof exclusiveMax === 'number' && value >= exclusiveMax) {
+            report(budget, path, 'exclusiveMaximum', budget.redact ? `not below the exclusive maximum ${exclusiveMax}` : `${value} is not less than ${exclusiveMax}`);
+        }
+        else if (exclusiveMax === true && typeof schema.maximum === 'number' && value >= schema.maximum) {
+            report(budget, path, 'exclusiveMaximum', budget.redact
+                ? `not below the exclusive maximum ${schema.maximum}`
+                : `${value} is not less than ${schema.maximum}`);
+        }
+        if (typeof schema.multipleOf === 'number' && schema.multipleOf > 0) {
+            const ratio = value / schema.multipleOf;
+            if (Math.abs(ratio - Math.round(ratio)) > 1e-9) {
+                report(budget, path, 'multipleOf', budget.redact
+                    ? `not a multiple of ${schema.multipleOf}`
+                    : `${value} is not a multiple of ${schema.multipleOf}`);
+            }
+        }
+    }
+    // 6. array checks
+    if (Array.isArray(value)) {
+        if (typeof schema.minItems === 'number' && value.length < schema.minItems) {
+            report(budget, path, 'minItems', budget.redact
+                ? `fewer items than the minimum ${schema.minItems}`
+                : `has ${value.length} items, fewer than ${schema.minItems}`);
+        }
+        if (typeof schema.maxItems === 'number' && value.length > schema.maxItems) {
+            report(budget, path, 'maxItems', budget.redact
+                ? `more items than the maximum ${schema.maxItems}`
+                : `has ${value.length} items, more than ${schema.maxItems}`);
+        }
+        if (schema.uniqueItems === true) {
+            const dup = value.some((v, i) => value.slice(0, i).some((prior) => jsonEquals(prior, v)));
+            if (dup)
+                report(budget, path, 'uniqueItems', 'items are not unique');
+        }
+        if (Array.isArray(schema.items)) {
+            const itemSchemas = schema.items;
+            for (let i = 0; i < value.length; i += 1) {
+                if (budget.stopped)
+                    break;
+                if (i < itemSchemas.length) {
+                    const itemSchema = itemSchemas[i];
+                    if (itemSchema !== undefined)
+                        walk(value[i], itemSchema, `${path}/${i}`, budget);
+                }
+                else if (schema.additionalItems === false) {
+                    report(budget, `${path}/${i}`, 'additionalItems', 'unexpected item beyond the tuple');
+                }
+                else if (isPlainObject(schema.additionalItems)) {
+                    walk(value[i], schema.additionalItems, `${path}/${i}`, budget);
+                }
+            }
+        }
+        else if (isPlainObject(schema.items)) {
+            for (let i = 0; i < value.length; i += 1) {
+                if (budget.stopped)
+                    break;
+                walk(value[i], schema.items, `${path}/${i}`, budget);
+            }
+        }
+    }
+    // 7. object checks
+    if (isPlainObject(value)) {
+        if (Array.isArray(schema.required)) {
+            for (const key of schema.required) {
+                if (!Object.prototype.hasOwnProperty.call(value, key)) {
+                    report(budget, path, 'required', `missing required property "${key}"`);
+                }
+            }
+        }
+        if (typeof schema.minProperties === 'number' && Object.keys(value).length < schema.minProperties) {
+            report(budget, path, 'minProperties', `has fewer than ${schema.minProperties} properties`);
+        }
+        if (typeof schema.maxProperties === 'number' && Object.keys(value).length > schema.maxProperties) {
+            report(budget, path, 'maxProperties', `has more than ${schema.maxProperties} properties`);
+        }
+        const properties = isPlainObject(schema.properties) ? schema.properties : undefined;
+        const patternProperties = isPlainObject(schema.patternProperties) ? schema.patternProperties : undefined;
+        const compiledPatterns = [];
+        if (patternProperties) {
+            for (const [pattern, sub] of Object.entries(patternProperties)) {
+                if (!isPlainObject(sub))
+                    continue;
+                const compiled = safeCompile(pattern);
+                if (compiled === 'unsafe') {
+                    if (!budget.passUnchecked) {
+                        report(budget, path, 'patternProperties', 'pattern not checked: unsafe for evaluation');
+                    }
+                }
+                else if (compiled !== 'invalid') {
+                    compiledPatterns.push([compiled, sub]);
+                }
+                // an invalid pattern is ignored rather than thrown
+            }
+        }
+        for (const key of Object.keys(value)) {
+            if (budget.stopped)
+                break;
+            const childPath = `${path}/${escapePointerSegment(key)}`;
+            let matched = false;
+            if (properties && Object.prototype.hasOwnProperty.call(properties, key)) {
+                matched = true;
+                walk(value[key], properties[key], childPath, budget);
+            }
+            for (const [regex, sub] of compiledPatterns) {
+                if (budget.stopped)
+                    break;
+                if (key.length <= MAX_PATTERN_VALUE_LENGTH && regex.test(key)) {
+                    matched = true;
+                    walk(value[key], sub, childPath, budget);
+                }
+            }
+            if (!matched && schema.additionalProperties === false) {
+                report(budget, childPath, 'additionalProperties', `unexpected property "${key}"`);
+            }
+            else if (!matched && isPlainObject(schema.additionalProperties)) {
+                walk(value[key], schema.additionalProperties, childPath, budget);
+            }
+        }
+    }
+    // 8. allOf / anyOf / oneOf / not
+    if (Array.isArray(schema.allOf)) {
+        for (const sub of schema.allOf) {
+            if (budget.stopped)
+                break;
+            walk(value, sub, path, budget, applying);
+        }
+    }
+    if (Array.isArray(schema.anyOf) && !budget.stopped) {
+        let anyPasses = false;
+        let undecided = false;
+        for (const sub of schema.anyOf) {
+            const passed = tryBranch(value, sub, path, budget, applying);
+            if (passed === undefined) {
+                undecided = true;
+                if (budget.stopped)
+                    break;
+                continue;
+            }
+            if (passed) {
+                anyPasses = true;
+                break;
+            }
+        }
+        if (!anyPasses && !undecided && !budget.stopped) {
+            report(budget, path, 'anyOf', 'value matches none of the allowed schemas');
+        }
+    }
+    if (Array.isArray(schema.oneOf) && !budget.stopped) {
+        let matches = 0;
+        let undecided = false;
+        for (const sub of schema.oneOf) {
+            const passed = tryBranch(value, sub, path, budget, applying);
+            if (passed === undefined) {
+                undecided = true;
+                if (budget.stopped)
+                    break;
+                continue;
+            }
+            if (passed)
+                matches += 1;
+        }
+        if ((undecided ? matches > 1 : matches !== 1) && !budget.stopped) {
+            report(budget, path, 'oneOf', `value matches ${matches} of the allowed schemas, not exactly one`);
+        }
+    }
+    if (isPlainObject(schema.not) && !budget.stopped) {
+        const notPasses = tryBranch(value, schema.not, path, budget, applying);
+        if (notPasses === true && !budget.stopped) {
+            report(budget, path, 'not', 'value matches the disallowed schema');
+        }
+    }
+}
+function escapePointerSegment(segment) {
+    return segment.replace(/~/g, '~0').replace(/\//g, '~1');
+}

package/dist/{wss/keystore → keystore}/index.js

@@ -3,7 +3,7 @@
  * container format, `selectAlias` picks the entry a send should present, and
  * `toTlsClientIdentity` shapes it for `TlsOptions`.
  */
-import { WssError } from '../../errors.js';
+import { WssError } from '../errors.js';
 import { loadPem } from './pem.js';
 import { loadPkcs12 } from './pkcs12.js';
 export { loadPem } from './pem.js';