@zudojs/openapi 1.5.2 → 1.6.0

package/README.md

@@ -301,7 +301,11 @@ items unless the schema sets its own `.max()`. The emitted `maxLength` /
 `maxItems` carry that effective limit (read from `@zudojs/constants`'
 `SCHEMA_DEFAULT_MAX_STRING_LENGTH` / `SCHEMA_DEFAULT_MAX_ARRAY_LENGTH`, the same
 constants the parser uses), so a client generated from the document is never
-told it may send a payload the server rejects.
+told it may send a payload the server rejects. To emit only the bounds a
+schema declares explicitly, pass `implicitLimits: false` — to
+`createOpenAPIManager`, `createOpenAPIDocumentFromRoutes`, `convertSchema` or
+`resolveSchemaInput`; a string with its own `.max(40)` keeps `maxLength: 40`
+either way.
 
 A property is listed in `required` exactly when the object parser rejects
 its absence: fields wrapped in `optional`, fields with a `default`, and

package/dist/index.d.ts

@@ -56,4 +56,3 @@ export type { OpenAPIValidator, OpenAPIValidationResult, } from "./openApiValida
 export { toOpenAPIJSON, toOpenAPIYAML, } from "./openApiSerialization/openApiSerializer.core.js";
 export { OpenAPIManager, createOpenAPIManager, type OpenAPIManagerOptions, type OpenAPIDocumentResponse, type OpenAPIUIResponse, } from "./openApiHttp/index.js";
 export type { OpenAPIVersion, OpenAPIDocument, OpenAPIComponents, OpenAPISecurityRequirement, OpenAPIParameterLocation, OpenAPIResponse, OpenAPIParameter, OpenAPIRequestBody, OpenAPIMediaType, OpenAPIEncoding, OpenAPIHeader, OpenAPILink, OpenAPIExample, OpenAPIPaths, OpenAPIPathItem, OpenAPIOperation, OpenAPIResponses, OpenAPIServer, OpenAPIServerVariable, OpenAPIInfo, OpenAPILogo, OpenAPIContact, OpenAPILicense, OpenAPIExternalDocumentation, OpenAPISchema, OpenAPIDiscriminator, OpenAPIXml, OpenAPISecurityScheme, OpenAPIOAuthFlows, OpenAPIOAuthFlow, OpenAPITag, OpenAPIReference, } from "./openApiTypes/openApiTypes.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -61,4 +61,3 @@ export { OpenAPIValidatorImpl, createOpenAPIValidator, } from "./openApiValidati
 export { toOpenAPIJSON, toOpenAPIYAML, } from "./openApiSerialization/openApiSerializer.core.js";
 /* ─── Manager ───────────────────────────────────────────────────────────── */
 export { OpenAPIManager, createOpenAPIManager, } from "./openApiHttp/index.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiComponents/index.d.ts

@@ -6,4 +6,3 @@
 export { createComponentReference, escapeJsonPointerSegment, unescapeJsonPointerSegment, type ComponentSection, } from "../openApiSchema/references.core.js";
 export type { SchemaRegistry, SchemaRegistryOptions, } from "../openApiSchema/schemaRegistry.core.js";
 export { SchemaRegistryImpl } from "../openApiSchema/schemaRegistry.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiComponents/index.js

@@ -5,4 +5,3 @@
  */
 export { createComponentReference, escapeJsonPointerSegment, unescapeJsonPointerSegment, } from "../openApiSchema/references.core.js";
 export { SchemaRegistryImpl } from "../openApiSchema/schemaRegistry.core.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiConstants/index.d.ts

@@ -2,4 +2,3 @@
  * @zudojs/openapi/openApiConstants
  */
 export { DEFAULT_OPENAPI_VERSION, SUPPORTED_OPENAPI_VERSIONS, MAX_OPERATION_ID_LENGTH, COMPONENT_REF_PREFIX, DEFAULT_MEDIA_TYPE, STATUS_CODE_CATEGORIES, RESPONSE_KEY_PATTERN, PATH_TEMPLATE_PARAMETER, DEFAULT_SERVER_URL, DOCUMENT_CACHE_TTL_MS, UNDOCUMENTED_RESPONSE_DESCRIPTION, } from "./openApiConstants.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiConstants/index.js

@@ -2,4 +2,3 @@
  * @zudojs/openapi/openApiConstants
  */
 export { DEFAULT_OPENAPI_VERSION, SUPPORTED_OPENAPI_VERSIONS, MAX_OPERATION_ID_LENGTH, COMPONENT_REF_PREFIX, DEFAULT_MEDIA_TYPE, STATUS_CODE_CATEGORIES, RESPONSE_KEY_PATTERN, PATH_TEMPLATE_PARAMETER, DEFAULT_SERVER_URL, DOCUMENT_CACHE_TTL_MS, UNDOCUMENTED_RESPONSE_DESCRIPTION, } from "./openApiConstants.core.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiConstants/openApiConstants.core.d.ts

@@ -54,4 +54,3 @@ export declare const DEFAULT_SERVER_URL = "http://localhost";
  * Applied by `OpenAPIManager`; pass `cacheTtlMs` to change or disable it.
  */
 export declare const DOCUMENT_CACHE_TTL_MS: number;
-//# sourceMappingURL=openApiConstants.core.d.ts.map

package/dist/openApiConstants/openApiConstants.core.js

@@ -61,4 +61,3 @@ export const DEFAULT_SERVER_URL = "http://localhost";
  * Applied by `OpenAPIManager`; pass `cacheTtlMs` to change or disable it.
  */
 export const DOCUMENT_CACHE_TTL_MS = 5 * 60 * 1000;
-//# sourceMappingURL=openApiConstants.core.js.map

package/dist/openApiDocument/index.d.ts

@@ -5,4 +5,3 @@
  */
 export type { OpenAPIDocumentOptions } from "./openApiDocument.builder.js";
 export { OpenAPIDocumentBuilder, createOpenAPIDocumentBuilder, } from "./openApiDocument.builder.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiDocument/index.js

@@ -4,4 +4,3 @@
  * OpenAPI document builder.
  */
 export { OpenAPIDocumentBuilder, createOpenAPIDocumentBuilder, } from "./openApiDocument.builder.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiDocument/openApiDocument.builder.d.ts

@@ -44,4 +44,3 @@ export declare class OpenAPIDocumentBuilder {
 }
 /** Creates a document builder. */
 export declare function createOpenAPIDocumentBuilder(options: OpenAPIDocumentOptions): OpenAPIDocumentBuilder;
-//# sourceMappingURL=openApiDocument.builder.d.ts.map

package/dist/openApiDocument/openApiDocument.builder.js

@@ -104,4 +104,3 @@ export class OpenAPIDocumentBuilder {
 export function createOpenAPIDocumentBuilder(options) {
     return new OpenAPIDocumentBuilder(options);
 }
-//# sourceMappingURL=openApiDocument.builder.js.map

package/dist/openApiErrors/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { OpenAPIError, createOpenAPIError, isOpenAPIError, type OpenAPIErrorOptions, } from "./openApiError.base.js";
 export { OpenAPIValidationError, OpenAPIDocumentError, OpenAPIComponentError, OpenAPIComponentConflictError, OpenAPIReferenceError, OpenAPIRouteError, OpenAPISchemaError, OpenAPISerializationError, OpenAPIVersionError, OpenAPIOperationError, formatIssuePath, type OpenAPIValidationIssue, } from "./openApiError.types.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiErrors/index.js

@@ -5,4 +5,3 @@
  */
 export { OpenAPIError, createOpenAPIError, isOpenAPIError, } from "./openApiError.base.js";
 export { OpenAPIValidationError, OpenAPIDocumentError, OpenAPIComponentError, OpenAPIComponentConflictError, OpenAPIReferenceError, OpenAPIRouteError, OpenAPISchemaError, OpenAPISerializationError, OpenAPIVersionError, OpenAPIOperationError, formatIssuePath, } from "./openApiError.types.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiErrors/openApiError.base.d.ts

@@ -20,4 +20,3 @@ export { OpenAPIError, type OpenAPIErrorOptions };
 export declare function createOpenAPIError(message: string, options?: OpenAPIErrorOptions): OpenAPIError;
 /** Determines whether an unknown value is an OpenAPI error. */
 export declare function isOpenAPIError(value: unknown): value is OpenAPIError;
-//# sourceMappingURL=openApiError.base.d.ts.map

package/dist/openApiErrors/openApiError.base.js

@@ -24,4 +24,3 @@ export function createOpenAPIError(message, options = {}) {
 export function isOpenAPIError(value) {
     return value instanceof OpenAPIError;
 }
-//# sourceMappingURL=openApiError.base.js.map

package/dist/openApiErrors/openApiError.core.d.ts

@@ -3,4 +3,3 @@
  */
 export * from "./openApiError.base.js";
 export * from "./openApiError.types.js";
-//# sourceMappingURL=openApiError.core.d.ts.map

package/dist/openApiErrors/openApiError.core.js

@@ -3,4 +3,3 @@
  */
 export * from "./openApiError.base.js";
 export * from "./openApiError.types.js";
-//# sourceMappingURL=openApiError.core.js.map

package/dist/openApiErrors/openApiError.types.d.ts

@@ -68,4 +68,3 @@ export declare class OpenAPIVersionError extends OpenAPIError {
 export declare class OpenAPIOperationError extends OpenAPIError {
     constructor(message: string, options?: OpenAPIErrorOptions);
 }
-//# sourceMappingURL=openApiError.types.d.ts.map

package/dist/openApiErrors/openApiError.types.js

@@ -170,4 +170,3 @@ export class OpenAPIOperationError extends OpenAPIError {
         this.name = "OpenAPIOperationError";
     }
 }
-//# sourceMappingURL=openApiError.types.js.map

package/dist/openApiFromRoutes/index.d.ts

@@ -8,4 +8,3 @@
  */
 export type { OpenAPIRouteDescriptor, OpenAPIDocumentFromRoutesOptions, } from "./openApiFromRoutes.type.js";
 export { createOpenAPIDocumentFromRoutes, createOpenAPIManagerFromRoutes, routeDescriptorToRouteInfo, } from "./openApiFromRoutes.document.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiFromRoutes/index.js

@@ -7,4 +7,3 @@
  * from what it actually registers.
  */
 export { createOpenAPIDocumentFromRoutes, createOpenAPIManagerFromRoutes, routeDescriptorToRouteInfo, } from "./openApiFromRoutes.document.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiFromRoutes/openApiFromRoutes.document.d.ts

@@ -40,4 +40,3 @@ export declare function createOpenAPIManagerFromRoutes(routes: readonly OpenAPIR
  *   is invalid.
  */
 export declare function createOpenAPIDocumentFromRoutes(routes: readonly OpenAPIRouteDescriptor[], options: OpenAPIDocumentFromRoutesOptions): OpenAPIDocument;
-//# sourceMappingURL=openApiFromRoutes.document.d.ts.map

package/dist/openApiFromRoutes/openApiFromRoutes.document.js

@@ -61,4 +61,3 @@ export function createOpenAPIManagerFromRoutes(routes, options) {
 export function createOpenAPIDocumentFromRoutes(routes, options) {
     return createOpenAPIManagerFromRoutes(routes, options).generate(options.validate ?? false);
 }
-//# sourceMappingURL=openApiFromRoutes.document.js.map

package/dist/openApiFromRoutes/openApiFromRoutes.type.d.ts

@@ -53,4 +53,3 @@ export interface OpenAPIDocumentFromRoutesOptions extends Omit<OpenAPIManagerOpt
      */
     readonly schemas?: Readonly<Record<string, unknown>>;
 }
-//# sourceMappingURL=openApiFromRoutes.type.d.ts.map

package/dist/openApiFromRoutes/openApiFromRoutes.type.js

@@ -2,4 +2,3 @@
  * Transport-neutral input for generating a document from a route table.
  */
 export {};
-//# sourceMappingURL=openApiFromRoutes.type.js.map

package/dist/openApiHttp/index.d.ts

@@ -4,4 +4,3 @@
  * Document coordination and HTTP serving.
  */
 export { OpenAPIManager, createOpenAPIManager, type OpenAPIManagerOptions, type OpenAPIDocumentResponse, type OpenAPIUIResponse, } from "./openApiHttpAdapter.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiHttp/index.js

@@ -4,4 +4,3 @@
  * Document coordination and HTTP serving.
  */
 export { OpenAPIManager, createOpenAPIManager, } from "./openApiHttpAdapter.core.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiHttp/openApiHttpAdapter.core.d.ts

@@ -33,6 +33,14 @@ export interface OpenAPIManagerOptions {
     readonly onRouteWarning?: (message: string) => void;
     /** Supplies the clock, for tests. */
     readonly now?: () => number;
+    /**
+     * Whether `@zudojs/schema`'s implicit ceilings — 255 characters for a
+     * string and 1000 items for an array without their own `.max()` — are
+     * written into the document as `maxLength` / `maxItems`. Default: true,
+     * because the parser enforces them, so the document states what the API
+     * accepts. Set `false` to emit only explicitly declared bounds.
+     */
+    readonly implicitLimits?: boolean;
     /**
      * Logo written to `info["x-logo"]` so viewers such as ReDoc and Scalar
      * show it, and used by {@link OpenAPIManager.toUIResponse}.
@@ -73,6 +81,7 @@ export declare class OpenAPIManager {
     private readonly customLogo;
     private readonly onSchemaWarning;
     private readonly onRouteWarning;
+    private readonly implicitLimits;
     private lastRouteWarnings;
     private cachedDocument?;
     private cachedAt;
@@ -166,4 +175,3 @@ export declare class OpenAPIManager {
 }
 /** Creates an OpenAPI manager. */
 export declare function createOpenAPIManager(options?: OpenAPIManagerOptions): OpenAPIManager;
-//# sourceMappingURL=openApiHttpAdapter.core.d.ts.map

package/dist/openApiHttp/openApiHttpAdapter.core.js

@@ -26,6 +26,7 @@ export class OpenAPIManager {
     customLogo;
     onSchemaWarning;
     onRouteWarning;
+    implicitLimits;
     lastRouteWarnings = [];
     cachedDocument;
     cachedAt = 0;
@@ -41,7 +42,9 @@ export class OpenAPIManager {
         this.schemas = new SchemaRegistryImpl({
             version: options.version ?? DEFAULT_OPENAPI_VERSION,
             onWarning: options.onSchemaWarning,
+            implicitLimits: options.implicitLimits,
         });
+        this.implicitLimits = options.implicitLimits;
         this.onSchemaWarning = options.onSchemaWarning;
         this.onRouteWarning = options.onRouteWarning;
         this.cacheTtlMs = options.cacheTtlMs ?? DOCUMENT_CACHE_TTL_MS;
@@ -164,6 +167,7 @@ export class OpenAPIManager {
         const routeWarnings = [];
         const scanned = this.scanner.scan({
             version: this.registry.version,
+            implicitLimits: this.implicitLimits,
             onWarning: (message) => {
                 routeWarnings.push(message);
                 this.onRouteWarning?.(message);
@@ -317,4 +321,3 @@ export class OpenAPIManager {
 export function createOpenAPIManager(options) {
     return new OpenAPIManager(options ?? {});
 }
-//# sourceMappingURL=openApiHttpAdapter.core.js.map

package/dist/openApiRegistry/index.d.ts

@@ -5,4 +5,3 @@
  */
 export type { OpenAPIRegistry, OpenAPIRoute, OpenAPIComponentRegistration, } from "./openApiRegistry.type.js";
 export { OpenAPIRegistryImpl } from "./openApiRegistry.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiRegistry/index.js

@@ -4,4 +4,3 @@
  * OpenAPI registry for collecting routes, schemas, and components.
  */
 export { OpenAPIRegistryImpl } from "./openApiRegistry.core.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiRegistry/openApiRegistry.core.d.ts

@@ -70,4 +70,3 @@ export declare class OpenAPIRegistryImpl implements OpenAPIRegistry {
     generate(): OpenAPIDocument;
     clear(): void;
 }
-//# sourceMappingURL=openApiRegistry.core.d.ts.map

package/dist/openApiRegistry/openApiRegistry.core.js

@@ -261,4 +261,3 @@ export class OpenAPIRegistryImpl {
         }
     }
 }
-//# sourceMappingURL=openApiRegistry.core.js.map

package/dist/openApiRegistry/openApiRegistry.type.d.ts

@@ -44,4 +44,3 @@ export interface OpenAPIRegistry {
     generate(): OpenAPIDocument;
     clear(): void;
 }
-//# sourceMappingURL=openApiRegistry.type.d.ts.map

package/dist/openApiRegistry/openApiRegistry.type.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=openApiRegistry.type.js.map

package/dist/openApiRouting/index.d.ts

@@ -8,4 +8,3 @@ export { toOpenAPIPath, extractPathParameters, convertRouteToOpenAPI, buildRespo
 export { OpenAPIRouteScannerImpl } from "./routeScanner.core.js";
 export { buildOperationParameters } from "./routeSchema.core.js";
 export { buildOperationRequestBody, buildOperationResponses, describeResponseKey, } from "./routeContent.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiRouting/index.js

@@ -7,4 +7,3 @@ export { toOpenAPIPath, extractPathParameters, convertRouteToOpenAPI, buildRespo
 export { OpenAPIRouteScannerImpl } from "./routeScanner.core.js";
 export { buildOperationParameters } from "./routeSchema.core.js";
 export { buildOperationRequestBody, buildOperationResponses, describeResponseKey, } from "./routeContent.core.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiRouting/routeContent.core.d.ts

@@ -19,4 +19,3 @@ export declare function buildOperationRequestBody(meta: RouteOpenAPIMetadata | u
  * through `options.onWarning`. No status is invented.
  */
 export declare function buildOperationResponses(meta: RouteOpenAPIMetadata | undefined, context: string, options?: RouteConversionOptions): OpenAPIResponses;
-//# sourceMappingURL=routeContent.core.d.ts.map

package/dist/openApiRouting/routeContent.core.js

@@ -98,4 +98,3 @@ export function buildOperationResponses(meta, context, options = {}) {
     }
     return Object.freeze(responses);
 }
-//# sourceMappingURL=routeContent.core.js.map

package/dist/openApiRouting/routeConverter.core.d.ts

@@ -44,4 +44,3 @@ export declare function convertRouteToOpenAPI(method: string, path: string, meta
     path: string;
     operation: OpenAPIOperation;
 };
-//# sourceMappingURL=routeConverter.core.d.ts.map

package/dist/openApiRouting/routeConverter.core.js

@@ -123,4 +123,3 @@ export function convertRouteToOpenAPI(method, path, metadata, options = {}) {
         operation,
     };
 }
-//# sourceMappingURL=routeConverter.core.js.map

package/dist/openApiRouting/routeMetadata.type.d.ts

@@ -92,4 +92,3 @@ export interface RouteInfo {
     readonly path: string;
     readonly metadata?: RouteMetadata;
 }
-//# sourceMappingURL=routeMetadata.type.d.ts.map

package/dist/openApiRouting/routeMetadata.type.js

@@ -8,4 +8,3 @@
  * use.
  */
 export {};
-//# sourceMappingURL=routeMetadata.type.js.map

package/dist/openApiRouting/routeScanner.core.d.ts

@@ -28,4 +28,3 @@ export declare class OpenAPIRouteScannerImpl {
     scan(options?: RouteConversionOptions): readonly OpenAPIRoute[];
     clear(): void;
 }
-//# sourceMappingURL=routeScanner.core.d.ts.map

package/dist/openApiRouting/routeScanner.core.js

@@ -89,4 +89,3 @@ export class OpenAPIRouteScannerImpl {
         this.routes.clear();
     }
 }
-//# sourceMappingURL=routeScanner.core.js.map

package/dist/openApiRouting/routeSchema.core.d.ts

@@ -16,4 +16,3 @@ import type { RouteConversionOptions, RouteOpenAPIMetadata } from "./routeMetada
  * a document that cannot validate.
  */
 export declare function buildOperationParameters(slots: readonly string[], meta: RouteOpenAPIMetadata | undefined, context: string, options?: RouteConversionOptions): readonly OpenAPIParameter[];
-//# sourceMappingURL=routeSchema.core.d.ts.map

package/dist/openApiRouting/routeSchema.core.js

@@ -90,4 +90,3 @@ export function buildOperationParameters(slots, meta, context, options = {}) {
     }
     return result;
 }
-//# sourceMappingURL=routeSchema.core.js.map

package/dist/openApiSchema/index.d.ts

@@ -9,4 +9,3 @@ export type { SchemaRegistry, SchemaRegistryOptions, } from "./schemaRegistry.co
 export { SchemaRegistryImpl } from "./schemaRegistry.core.js";
 export { createComponentReference, escapeJsonPointerSegment, unescapeJsonPointerSegment, type ComponentSection, } from "./references.core.js";
 export { isSchemaDefinition, resolveSchemaInput, type SchemaInputOptions, } from "./schemaInput.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiSchema/index.js

@@ -7,4 +7,3 @@ export { convertSchema, createSchemaConverter, isVersion31, } from "./schemaConv
 export { SchemaRegistryImpl } from "./schemaRegistry.core.js";
 export { createComponentReference, escapeJsonPointerSegment, unescapeJsonPointerSegment, } from "./references.core.js";
 export { isSchemaDefinition, resolveSchemaInput, } from "./schemaInput.core.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiSchema/references.core.d.ts

@@ -23,4 +23,3 @@ export declare function unescapeJsonPointerSegment(segment: string): string;
  * @param name - The component name
  */
 export declare function createComponentReference(section: ComponentSection | string, name: string): OpenAPIReference;
-//# sourceMappingURL=references.core.d.ts.map

package/dist/openApiSchema/references.core.js

@@ -29,4 +29,3 @@ export function createComponentReference(section, name) {
         $ref: `${COMPONENT_REF_PREFIX}/${escapeJsonPointerSegment(section)}/${escapeJsonPointerSegment(name)}`,
     };
 }
-//# sourceMappingURL=references.core.js.map

package/dist/openApiSchema/schemaConverter.core.d.ts

@@ -52,6 +52,17 @@ export interface SchemaConversionOptions {
      * schema whose `lazy` wrapper resolves to itself. Default: 32.
      */
     readonly maxDepth?: number;
+    /**
+     * Whether the parser's implicit ceilings are written into the document.
+     *
+     * `@zudojs/schema` rejects a string longer than
+     * `SCHEMA_DEFAULT_MAX_STRING_LENGTH` (255) and an array longer than
+     * `SCHEMA_DEFAULT_MAX_ARRAY_LENGTH` (1000) unless the schema sets its own
+     * `.max()`, so by default (`true`) the emitted `maxLength` / `maxItems`
+     * states what the API actually accepts. Set `false` to emit only the
+     * bounds the schema declares explicitly.
+     */
+    readonly implicitLimits?: boolean;
 }
 /** True when the document being produced follows OpenAPI 3.1 or later. */
 export declare function isVersion31(version: string): boolean;
@@ -69,4 +80,3 @@ export interface SchemaConverter {
 }
 /** Creates a converter bound to a specification version. */
 export declare function createSchemaConverter(defaults?: SchemaConversionOptions): SchemaConverter;
-//# sourceMappingURL=schemaConverter.core.d.ts.map

package/dist/openApiSchema/schemaConverter.core.js

@@ -1,5 +1,14 @@
 import { SCHEMA_DEFAULT_MAX_ARRAY_LENGTH, SCHEMA_DEFAULT_MAX_STRING_LENGTH, } from "@zudojs/constants";
 import { DEFAULT_OPENAPI_VERSION } from "../openApiConstants/openApiConstants.core.js";
+/**
+ * An upper bound to emit: the schema's own when it declares one, else the
+ * parser's implicit ceiling when `implicitLimits` is on, else nothing.
+ */
+function bound(keyword, declared, implicit, state) {
+    if (declared !== undefined)
+        return { [keyword]: declared };
+    return state.implicitLimits ? { [keyword]: implicit } : {};
+}
 /** Maps `@zudojs/schema` string formats onto OpenAPI `format` values. */
 const STRING_FORMATS = {
     email: "email",
@@ -156,7 +165,7 @@ function convertString(schema, state) {
             ? { minLength: exact, maxLength: exact }
             : {
                 ...(num(c["min"]) !== undefined ? { minLength: num(c["min"]) } : {}),
-                maxLength: num(c["max"]) ?? SCHEMA_DEFAULT_MAX_STRING_LENGTH,
+                ...bound("maxLength", num(c["max"]), SCHEMA_DEFAULT_MAX_STRING_LENGTH, state),
             }),
         ...(pattern instanceof RegExp
             ? { pattern: pattern.source }
@@ -343,7 +352,7 @@ function convertSchemaNode(schema, state) {
                         ...(num(c["min"]) !== undefined
                             ? { minItems: num(c["min"]) }
                             : {}),
-                        maxItems: num(c["max"]) ?? SCHEMA_DEFAULT_MAX_ARRAY_LENGTH,
+                        ...bound("maxItems", num(c["max"]), SCHEMA_DEFAULT_MAX_ARRAY_LENGTH, state),
                     }),
             };
         }
@@ -537,6 +546,7 @@ export function convertSchema(input, options) {
         visited: new Set(),
         version: options?.version ?? DEFAULT_OPENAPI_VERSION,
         maxDepth: options?.maxDepth ?? 32,
+        implicitLimits: options?.implicitLimits ?? true,
         depth: 0,
     };
     const schema = convertNode(input, state);
@@ -548,4 +558,3 @@ export function createSchemaConverter(defaults) {
         convert: (input, options) => convertSchema(input, { ...defaults, ...options }),
     };
 }
-//# sourceMappingURL=schemaConverter.core.js.map

package/dist/openApiSchema/schemaInput.core.d.ts

@@ -11,6 +11,12 @@ export interface SchemaInputOptions {
     readonly version?: string;
     /** Receives everything a conversion could not express exactly. */
     readonly onWarning?: (message: string) => void;
+    /**
+     * Whether the parser's implicit string and array ceilings are emitted as
+     * `maxLength` / `maxItems`. Default: true. See
+     * `SchemaConversionOptions.implicitLimits`.
+     */
+    readonly implicitLimits?: boolean;
 }
 /** True when `value` is a `@zudojs/schema` schema (it carries a string `_type`). */
 export declare function isSchemaDefinition(value: unknown): value is {
@@ -25,4 +31,3 @@ export declare function isSchemaDefinition(value: unknown): value is {
  * becomes `{}`.
  */
 export declare function resolveSchemaInput(input: unknown, context: string, options?: SchemaInputOptions): OpenAPISchema;
-//# sourceMappingURL=schemaInput.core.d.ts.map

package/dist/openApiSchema/schemaInput.core.js

@@ -21,7 +21,10 @@ export function isSchemaDefinition(value) {
  */
 export function resolveSchemaInput(input, context, options = {}) {
     if (isSchemaDefinition(input)) {
-        const result = convertSchema(input, { version: options.version });
+        const result = convertSchema(input, {
+            version: options.version,
+            implicitLimits: options.implicitLimits,
+        });
         for (const warning of result.warnings) {
             options.onWarning?.(`${context}: ${warning}`);
         }
@@ -33,4 +36,3 @@ export function resolveSchemaInput(input, context, options = {}) {
     options.onWarning?.(`${context}: expected a schema, got ${typeof input}; emitted {}.`);
     return {};
 }
-//# sourceMappingURL=schemaInput.core.js.map

package/dist/openApiSchema/schemaInput.type.d.ts

@@ -45,4 +45,3 @@ export interface OpenAPIRouteResponse {
  * schemas are converted for, and a sink for what they could not express.
  */
 export type RouteConversionOptions = SchemaInputOptions;
-//# sourceMappingURL=schemaInput.type.d.ts.map

package/dist/openApiSchema/schemaInput.type.js

@@ -2,4 +2,3 @@
  * Schema-bearing inputs a route or operation may declare.
  */
 export {};
-//# sourceMappingURL=schemaInput.type.js.map

package/dist/openApiSchema/schemaRegistry.core.d.ts

@@ -42,4 +42,3 @@ export declare class SchemaRegistryImpl implements SchemaRegistry {
     all(): Readonly<Record<string, OpenAPISchema>>;
     clear(): void;
 }
-//# sourceMappingURL=schemaRegistry.core.d.ts.map

package/dist/openApiSchema/schemaRegistry.core.js

@@ -52,4 +52,3 @@ export class SchemaRegistryImpl {
         this.conversionWarnings.clear();
     }
 }
-//# sourceMappingURL=schemaRegistry.core.js.map

package/dist/openApiSerialization/index.d.ts

@@ -4,4 +4,3 @@
  * OpenAPI document serialization (JSON, YAML).
  */
 export { toOpenAPIJSON, toOpenAPIYAML } from "./openApiSerializer.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiSerialization/index.js

@@ -4,4 +4,3 @@
  * OpenAPI document serialization (JSON, YAML).
  */
 export { toOpenAPIJSON, toOpenAPIYAML } from "./openApiSerializer.core.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiSerialization/openApiSerializer.core.d.ts

@@ -15,4 +15,3 @@ export declare function toOpenAPIJSON(document: OpenAPIDocument, options?: {
  * reserved character) are quoted.
  */
 export declare function toOpenAPIYAML(document: OpenAPIDocument): string;
-//# sourceMappingURL=openApiSerializer.core.d.ts.map

package/dist/openApiSerialization/openApiSerializer.core.js

@@ -172,4 +172,3 @@ export function toOpenAPIYAML(document) {
         throw new OpenAPISerializationError(`Failed to serialize the OpenAPI document to YAML: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
 }
-//# sourceMappingURL=openApiSerializer.core.js.map

package/dist/openApiTypes/index.d.ts

@@ -4,4 +4,3 @@
  * Core OpenAPI specification types.
  */
 export type { OpenAPIVersion, OpenAPIDocument, OpenAPIComponents, OpenAPISecurityRequirement, OpenAPIParameterLocation, OpenAPIResponse, OpenAPIParameter, OpenAPIRequestBody, OpenAPIMediaType, OpenAPIEncoding, OpenAPIHeader, OpenAPILink, OpenAPIExample, OpenAPIPaths, OpenAPIPathItem, OpenAPIOperation, OpenAPIResponses, OpenAPIServer, OpenAPIServerVariable, OpenAPIInfo, OpenAPILogo, OpenAPIContact, OpenAPILicense, OpenAPIExternalDocumentation, OpenAPISchema, OpenAPIDiscriminator, OpenAPIXml, OpenAPISecurityScheme, OpenAPIOAuthFlows, OpenAPIOAuthFlow, OpenAPITag, OpenAPIReference, } from "./openApiTypes.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiTypes/index.js

@@ -4,4 +4,3 @@
  * Core OpenAPI specification types.
  */
 export {};
-//# sourceMappingURL=index.js.map

package/dist/openApiTypes/openApiComponent.type.d.ts

@@ -66,4 +66,3 @@ export interface OpenAPIExample {
     readonly value?: unknown;
     readonly externalUrl?: string;
 }
-//# sourceMappingURL=openApiComponent.type.d.ts.map

package/dist/openApiTypes/openApiComponent.type.js

@@ -2,4 +2,3 @@
  * OpenAPI component types (responses, request bodies, media types, etc.).
  */
 export {};
-//# sourceMappingURL=openApiComponent.type.js.map

package/dist/openApiTypes/openApiDocument.type.d.ts

@@ -74,4 +74,3 @@ export interface OpenAPIReference {
     readonly summary?: string;
     readonly description?: string;
 }
-//# sourceMappingURL=openApiDocument.type.d.ts.map

package/dist/openApiTypes/openApiDocument.type.js

@@ -2,4 +2,3 @@
  * OpenAPI document, info, and server types.
  */
 export {};
-//# sourceMappingURL=openApiDocument.type.js.map

package/dist/openApiTypes/openApiPath.type.d.ts

@@ -45,4 +45,3 @@ export interface OpenAPIParameter {
     readonly content?: Readonly<Record<string, import("./openApiComponent.type.js").OpenAPIMediaType>>;
 }
 export type OpenAPIParameterLocation = "query" | "header" | "path" | "cookie";
-//# sourceMappingURL=openApiPath.type.d.ts.map

package/dist/openApiTypes/openApiPath.type.js

@@ -2,4 +2,3 @@
  * OpenAPI path, operation, and parameter types.
  */
 export {};
-//# sourceMappingURL=openApiPath.type.js.map

package/dist/openApiTypes/openApiSchema.type.d.ts

@@ -60,4 +60,3 @@ export interface OpenAPIXml {
     readonly attribute?: boolean;
     readonly wrapped?: boolean;
 }
-//# sourceMappingURL=openApiSchema.type.d.ts.map

package/dist/openApiTypes/openApiSchema.type.js

@@ -5,4 +5,3 @@
  * `nullable` keyword available for documents targeting 3.0.x.
  */
 export {};
-//# sourceMappingURL=openApiSchema.type.js.map

package/dist/openApiTypes/openApiSecurity.type.d.ts

@@ -26,4 +26,3 @@ export interface OpenAPIOAuthFlow {
     readonly refreshUrl?: string;
     readonly scopes?: Readonly<Record<string, string>>;
 }
-//# sourceMappingURL=openApiSecurity.type.d.ts.map

package/dist/openApiTypes/openApiSecurity.type.js

@@ -2,4 +2,3 @@
  * OpenAPI security types.
  */
 export {};
-//# sourceMappingURL=openApiSecurity.type.js.map

package/dist/openApiTypes/openApiTypes.core.d.ts

@@ -8,4 +8,3 @@ export * from "./openApiPath.type.js";
 export * from "./openApiComponent.type.js";
 export * from "./openApiSchema.type.js";
 export * from "./openApiSecurity.type.js";
-//# sourceMappingURL=openApiTypes.core.d.ts.map

package/dist/openApiTypes/openApiTypes.core.js

@@ -8,4 +8,3 @@ export * from "./openApiPath.type.js";
 export * from "./openApiComponent.type.js";
 export * from "./openApiSchema.type.js";
 export * from "./openApiSecurity.type.js";
-//# sourceMappingURL=openApiTypes.core.js.map

package/dist/openApiUi/index.d.ts

@@ -7,4 +7,3 @@ export { renderOpenAPIUI, zudoLogo, escapeHtml, type OpenAPIUIOptions, type Open
 export { ZUDO_MARK_SVG, ZUDO_MARK_DARK_SVG, ZUDO_WORDMARK_SVG, ZUDO_WORDMARK_DARK_SVG, ZUDO_FAVICON_SVG, ZUDO_MARK_DATA_URI, ZUDO_MARK_DARK_DATA_URI, ZUDO_WORDMARK_DATA_URI, ZUDO_WORDMARK_DARK_DATA_URI, ZUDO_FAVICON_DATA_URI, ZUDO_SITE_URL, svgToDataUri, } from "./openApiUi.brand.js";
 export { SWAGGER_UI_VERSION, REDOC_VERSION, DEFAULT_SWAGGER_ASSETS, DEFAULT_REDOC_ASSETS, SWAGGER_UI_INTEGRITY, REDOC_INTEGRITY, type OpenAPIUIAssetIntegrity, } from "./openApiUi.assets.js";
 export { buildOpenAPIUIContentSecurityPolicy } from "./openApiUi.csp.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiUi/index.js

@@ -7,4 +7,3 @@ export { renderOpenAPIUI, zudoLogo, escapeHtml, } from "./openApiUi.core.js";
 export { ZUDO_MARK_SVG, ZUDO_MARK_DARK_SVG, ZUDO_WORDMARK_SVG, ZUDO_WORDMARK_DARK_SVG, ZUDO_FAVICON_SVG, ZUDO_MARK_DATA_URI, ZUDO_MARK_DARK_DATA_URI, ZUDO_WORDMARK_DATA_URI, ZUDO_WORDMARK_DARK_DATA_URI, ZUDO_FAVICON_DATA_URI, ZUDO_SITE_URL, svgToDataUri, } from "./openApiUi.brand.js";
 export { SWAGGER_UI_VERSION, REDOC_VERSION, DEFAULT_SWAGGER_ASSETS, DEFAULT_REDOC_ASSETS, SWAGGER_UI_INTEGRITY, REDOC_INTEGRITY, } from "./openApiUi.assets.js";
 export { buildOpenAPIUIContentSecurityPolicy } from "./openApiUi.csp.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiUi/openApiUi.assets.d.ts

@@ -38,4 +38,3 @@ export declare const REDOC_INTEGRITY: OpenAPIUIAssetIntegrity;
  * not a well-formed SRI token, since it is interpolated into an attribute.
  */
 export declare function integrityAttrs(hash: string | undefined): string;
-//# sourceMappingURL=openApiUi.assets.d.ts.map

package/dist/openApiUi/openApiUi.assets.js

@@ -45,4 +45,3 @@ export function integrityAttrs(hash) {
     }
     return ` integrity="${tokens.join(" ")}" crossorigin="anonymous"`;
 }
-//# sourceMappingURL=openApiUi.assets.js.map

package/dist/openApiUi/openApiUi.brand.d.ts

@@ -23,4 +23,3 @@ export declare const ZUDO_WORDMARK_DARK_DATA_URI: string;
 export declare const ZUDO_FAVICON_DATA_URI: string;
 /** Where the logo links by default. */
 export declare const ZUDO_SITE_URL = "https://zudojs.oyinlola.site";
-//# sourceMappingURL=openApiUi.brand.d.ts.map

package/dist/openApiUi/openApiUi.brand.js

@@ -41,4 +41,3 @@ export const ZUDO_WORDMARK_DARK_DATA_URI = svgToDataUri(ZUDO_WORDMARK_DARK_SVG);
 export const ZUDO_FAVICON_DATA_URI = svgToDataUri(ZUDO_FAVICON_SVG);
 /** Where the logo links by default. */
 export const ZUDO_SITE_URL = "https://zudojs.oyinlola.site";
-//# sourceMappingURL=openApiUi.brand.js.map

package/dist/openApiUi/openApiUi.core.d.ts

@@ -63,4 +63,3 @@ export declare function zudoLogo(overrides?: Partial<OpenAPILogo>): OpenAPILogo;
 export declare function escapeHtml(value: string): string;
 /** Renders a complete, branded documentation page for `options.specUrl`. */
 export declare function renderOpenAPIUI(options: OpenAPIUIOptions): string;
-//# sourceMappingURL=openApiUi.core.d.ts.map

package/dist/openApiUi/openApiUi.core.js

@@ -129,4 +129,3 @@ function resolveIntegrity(options, renderer) {
         return {};
     return renderer === "redoc" ? REDOC_INTEGRITY : SWAGGER_UI_INTEGRITY;
 }
-//# sourceMappingURL=openApiUi.core.js.map

package/dist/openApiUi/openApiUi.csp.d.ts

@@ -22,4 +22,3 @@ export declare function cspSourceFor(url: string): string | undefined;
 export declare function buildOpenAPIUIContentSecurityPolicy(options: OpenAPIUIOptions, connectSources?: readonly string[]): string;
 /** Every `servers[].url` in a document: top level, path items and operations. */
 export declare function documentServerUrls(document: OpenAPIDocument): string[];
-//# sourceMappingURL=openApiUi.csp.d.ts.map

package/dist/openApiUi/openApiUi.csp.js

@@ -89,4 +89,3 @@ export function documentServerUrls(document) {
     }
     return urls;
 }
-//# sourceMappingURL=openApiUi.csp.js.map

package/dist/openApiUi/openApiUiPage/index.d.ts

@@ -6,4 +6,3 @@
  */
 export { jsLiteral, swaggerInitScript, type SwaggerInitInput, } from "./openApiUiPage.script.js";
 export { THEME_CSS } from "./openApiUiPage.theme.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiUi/openApiUiPage/index.js

@@ -6,4 +6,3 @@
  */
 export { jsLiteral, swaggerInitScript, } from "./openApiUiPage.script.js";
 export { THEME_CSS } from "./openApiUiPage.theme.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiUi/openApiUiPage/openApiUiPage.script.d.ts

@@ -11,4 +11,3 @@ export interface SwaggerInitInput {
 }
 /** Returns the body of the inline `<script>` that boots Swagger UI. */
 export declare function swaggerInitScript(input: SwaggerInitInput): string;
-//# sourceMappingURL=openApiUiPage.script.d.ts.map

package/dist/openApiUi/openApiUiPage/openApiUiPage.script.js

@@ -21,4 +21,3 @@ export function swaggerInitScript(input) {
     };
     return `window.addEventListener("load",function(){window.ui=SwaggerUIBundle(${jsLiteral(config)});});`;
 }
-//# sourceMappingURL=openApiUiPage.script.js.map

package/dist/openApiUi/openApiUiPage/openApiUiPage.theme.d.ts

@@ -3,4 +3,3 @@
  */
 /** Built-in page CSS; `customCss` is appended after it. */
 export declare const THEME_CSS = "\n:root{--zd-ink:#1A1A2E;--zd-red:#C0392B;--zd-bg:#FAFAF9;--zd-border:#E5E7EB}\n*{border-radius:0!important}\nhtml,body{margin:0;background:var(--zd-bg);font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.zudo-bar{position:sticky;top:0;z-index:50;display:flex;align-items:center;gap:14px;height:56px;padding:0 20px;background:var(--zd-ink);color:var(--zd-bg);border-bottom:3px solid var(--zd-red)}\n.zudo-bar a{display:inline-flex;align-items:center;color:inherit;text-decoration:none}\n.zudo-bar img{height:22px;width:auto;display:block}\n.zudo-bar .zudo-sep{width:1px;height:22px;background:rgba(250,250,249,.25)}\n.zudo-bar .zudo-title{font-weight:800;font-size:14px;letter-spacing:.02em;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}\n.zudo-bar .zudo-spec{margin-left:auto;font:700 11px/1 ui-monospace,SFMono-Regular,Menlo,monospace;letter-spacing:.06em;text-transform:uppercase;color:rgba(250,250,249,.75);border:2px solid rgba(250,250,249,.3);padding:6px 10px}\n.zudo-bar .zudo-spec:hover{border-color:var(--zd-bg);color:var(--zd-bg)}\n.zudo-foot{padding:16px 20px;border-top:1px solid var(--zd-border);color:#6B7280;font-size:12px;display:flex;gap:8px;align-items:center}\n.zudo-foot img{height:14px;width:auto}\n.swagger-ui .topbar{display:none}\n.swagger-ui .info .title{font-weight:900;letter-spacing:-.01em;color:var(--zd-ink)}\n.swagger-ui .opblock{border-width:2px;box-shadow:none}\n.swagger-ui .btn{border-width:2px;font-weight:700}\n.swagger-ui .btn.execute{background:var(--zd-red);border-color:var(--zd-red)}\n.swagger-ui .scheme-container{box-shadow:none;border-bottom:1px solid var(--zd-border);background:#fff}\n";
-//# sourceMappingURL=openApiUiPage.theme.d.ts.map

package/dist/openApiUi/openApiUiPage/openApiUiPage.theme.js

@@ -22,4 +22,3 @@ html,body{margin:0;background:var(--zd-bg);font-family:Inter,system-ui,-apple-sy
 .swagger-ui .btn.execute{background:var(--zd-red);border-color:var(--zd-red)}
 .swagger-ui .scheme-container{box-shadow:none;border-bottom:1px solid var(--zd-border);background:#fff}
 `;
-//# sourceMappingURL=openApiUiPage.theme.js.map

package/dist/openApiValidation/index.d.ts

@@ -5,4 +5,3 @@
  */
 export type { OpenAPIValidator, OpenAPIValidationResult, } from "./openApiValidator.core.js";
 export { OpenAPIValidatorImpl, createOpenAPIValidator, } from "./openApiValidator.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/openApiValidation/index.js

@@ -4,4 +4,3 @@
  * OpenAPI document validation.
  */
 export { OpenAPIValidatorImpl, createOpenAPIValidator, } from "./openApiValidator.core.js";
-//# sourceMappingURL=index.js.map

package/dist/openApiValidation/openApiValidator.core.d.ts

@@ -41,4 +41,3 @@ export declare class OpenAPIValidatorImpl implements OpenAPIValidator {
 }
 /** Creates a validator. */
 export declare function createOpenAPIValidator(): OpenAPIValidatorImpl;
-//# sourceMappingURL=openApiValidator.core.d.ts.map

package/dist/openApiValidation/openApiValidator.core.js

@@ -340,4 +340,3 @@ function resolvePointer(document, ref) {
 export function createOpenAPIValidator() {
     return new OpenAPIValidatorImpl();
 }
-//# sourceMappingURL=openApiValidator.core.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/openapi",
-  "version": "1.5.2",
+  "version": "1.6.0",
   "description": "OpenAPI 3.0 and 3.1 specification generation, validation, and serialization for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -26,12 +26,12 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/constants": "1.1.4",
-    "@zudojs/errors": "1.3.2"
+    "@zudojs/constants": "1.2.0",
+    "@zudojs/errors": "1.4.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.2",
-    "@zudojs/schema": "1.2.3",
+    "@zudojs/schema": "1.3.0",
     "typescript": "7.0.2",
     "vitest": "^5.0.1"
   },