@zudojs/validation 0.1.0 → 1.0.1

package/dist/validationConstraints/index.js

@@ -5,20 +5,10 @@
  */
 // Base constraints
 export { createConstraint, checkConstraint, checkConstraints, combineConstraints, not, required, assertNonNegativeInteger, } from "./validationConstraints.base.js";
-// String constraints
-export { nonEmptyString, minLength, maxLength, lengthBetween, matches, email, uuid, httpUrl, ascii, digits, letters, slug, } from "./validationConstraints.string.js";
-// Number constraints
-export { min, max, between, finiteNumber, integer, positive, nonNegative, even, odd, } from "./validationConstraints.number.js";
-// Collection constraints
-export { oneOf, noneOf } from "./validationConstraints.collection.js";
-// Date constraints
-export { isoDate, futureDate, pastDate } from "./validationConstraints.date.js";
-// Array constraints
-export { minItems, maxItems, exactItems, everyItem, someItem, } from "./validationConstraints.array.js";
-// Circular reference detection
-export { assertNoCircularReference, hasCircularReference, } from "./validationConstraints.circular.js";
-// Depth checking
-export { getSerializationDepth, assertDepthWithinLimit, } from "./validationConstraints.depth.js";
-// Size estimation
-export { estimateSerializedSize, assertSizeWithinLimit, } from "./validationConstraints.size.js";
+// Scalar constraints: strings, numbers, dates
+export * from "./scalar/index.js";
+// Collection constraints: arrays and membership
+export * from "./collection/index.js";
+// Structural guards: depth, size, and circular references
+export * from "./structure/index.js";
 //# sourceMappingURL=index.js.map

package/dist/validationConstraints/scalar/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/validation — Scalar constraints.
+ *
+ * @module validationConstraints/scalar
+ */
+export * from "./validationConstraints.string.js";
+export * from "./validationConstraints.number.js";
+export * from "./validationConstraints.date.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/validationConstraints/scalar/index.js

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/validation — Scalar constraints.
+ *
+ * @module validationConstraints/scalar
+ */
+export * from "./validationConstraints.string.js";
+export * from "./validationConstraints.number.js";
+export * from "./validationConstraints.date.js";
+//# sourceMappingURL=index.js.map

package/dist/validationConstraints/scalar/validationConstraints.date.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Requires a string to be a valid ISO date representation.
+ */
+export declare const isoDate: import("../validationConstraints.base.js").ValidationConstraint<string>;
+/**
+ * Requires a date to be in the future.
+ */
+export declare const futureDate: import("../validationConstraints.base.js").ValidationConstraint<Date>;
+/**
+ * Requires a date to be in the past.
+ */
+export declare const pastDate: import("../validationConstraints.base.js").ValidationConstraint<Date>;
+//# sourceMappingURL=validationConstraints.date.d.ts.map

package/dist/validationConstraints/scalar/validationConstraints.date.js

@@ -0,0 +1,45 @@
+import { createConstraint } from "../validationConstraints.base.js";
+/** Narrows an unknown value to a valid Date. */
+const isDate = (value) => value instanceof Date && !Number.isNaN(value.getTime());
+/**
+ * Requires a string to be a valid ISO date representation.
+ */
+export const isoDate = createConstraint((value) => {
+    if (!/^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?(?:Z|[+-]\d{2}:\d{2})?)?$/u.test(value)) {
+        return false;
+    }
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime()))
+        return false;
+    // Reject calendar-invalid dates such as 2024-02-31, which Date rolls over
+    // into the following month rather than rejecting.
+    const [year, month, day] = value.slice(0, 10).split("-").map(Number);
+    const asUtc = new Date(Date.UTC(year, month - 1, day));
+    return (asUtc.getUTCFullYear() === year &&
+        asUtc.getUTCMonth() === month - 1 &&
+        asUtc.getUTCDate() === day);
+}, {
+    name: "iso_date",
+    code: "invalid_date",
+    message: "Value must be a valid ISO 8601 date.",
+    guard: (value) => typeof value === "string",
+});
+/**
+ * Requires a date to be in the future.
+ */
+export const futureDate = createConstraint((value) => value.getTime() > Date.now(), {
+    name: "future_date",
+    code: "invalid_future_date",
+    message: "Date must be in the future.",
+    guard: isDate,
+});
+/**
+ * Requires a date to be in the past.
+ */
+export const pastDate = createConstraint((value) => value.getTime() < Date.now(), {
+    name: "past_date",
+    code: "invalid_past_date",
+    message: "Date must be in the past.",
+    guard: isDate,
+});
+//# sourceMappingURL=validationConstraints.date.js.map

package/dist/validationConstraints/{validationConstraints.number.d.ts → scalar/validationConstraints.number.d.ts}

@@ -1,4 +1,4 @@
-import type { ValidationConstraint } from "./validationConstraints.base.js";
+import type { ValidationConstraint } from "../validationConstraints.base.js";
 /**
  * Requires a numeric value to be greater than or equal to a minimum.
  */

package/dist/validationConstraints/{validationConstraints.number.js → scalar/validationConstraints.number.js}

@@ -1,4 +1,6 @@
-import { createConstraint } from "./validationConstraints.base.js";
+import { createConstraint } from "../validationConstraints.base.js";
+/** Narrows an unknown value to a number. */
+const isNumber = (value) => typeof value === "number";
 /**
  * Requires a numeric value to be greater than or equal to a minimum.
  */
@@ -10,6 +12,7 @@ export function min(minimum) {
         name: `min_${minimum}`,
         code: "min_value",
         message: `Value must be greater than or equal to ${minimum}.`,
+        guard: isNumber,
     });
 }
 /**
@@ -23,6 +26,7 @@ export function max(maximum) {
         name: `max_${maximum}`,
         code: "max_value",
         message: `Value must be less than or equal to ${maximum}.`,
+        guard: isNumber,
     });
 }
 /**
@@ -39,6 +43,7 @@ export function between(minimum, maximum) {
         name: `between_${minimum}_${maximum}`,
         code: "value_out_of_range",
         message: `Value must be between ${minimum} and ${maximum}.`,
+        guard: isNumber,
     });
 }
 /**
@@ -48,6 +53,7 @@ export const finiteNumber = createConstraint((value) => Number.isFinite(value),
     name: "finite_number",
     code: "invalid_number",
     message: "Value must be a finite number.",
+    guard: isNumber,
 });
 /**
  * Requires an integer.
@@ -56,6 +62,7 @@ export const integer = createConstraint((value) => Number.isInteger(value), {
     name: "integer",
     code: "invalid_integer",
     message: "Value must be an integer.",
+    guard: isNumber,
 });
 /**
  * Requires a positive number.
@@ -64,6 +71,7 @@ export const positive = createConstraint((value) => value > 0, {
     name: "positive",
     code: "invalid_positive",
     message: "Value must be greater than zero.",
+    guard: isNumber,
 });
 /**
  * Requires a non-negative number.
@@ -72,6 +80,7 @@ export const nonNegative = createConstraint((value) => value >= 0, {
     name: "non_negative",
     code: "invalid_non_negative",
     message: "Value must be zero or greater.",
+    guard: isNumber,
 });
 /**
  * Requires a number to be even.
@@ -80,6 +89,7 @@ export const even = createConstraint((value) => Number.isInteger(value) && value
     name: "even",
     code: "invalid_even",
     message: "Value must be an even integer.",
+    guard: isNumber,
 });
 /**
  * Requires a number to be odd.
@@ -88,5 +98,6 @@ export const odd = createConstraint((value) => Number.isInteger(value) && Math.a
     name: "odd",
     code: "invalid_odd",
     message: "Value must be an odd integer.",
+    guard: isNumber,
 });
 //# sourceMappingURL=validationConstraints.number.js.map

package/dist/validationConstraints/{validationConstraints.string.d.ts → scalar/validationConstraints.string.d.ts}

@@ -1,10 +1,12 @@
-import type { ValidationConstraint } from "./validationConstraints.base.js";
+import type { ValidationConstraint } from "../validationConstraints.base.js";
 /**
  * Requires a string to be non-empty after trimming.
  */
 export declare const nonEmptyString: ValidationConstraint<string>;
 /**
  * Requires a string to contain at least the specified number of characters.
+ *
+ * Counts code points, so an emoji costs one character rather than two.
  */
 export declare function minLength(minimum: number): ValidationConstraint<string>;
 /**
@@ -17,14 +19,23 @@ export declare function maxLength(maximum: number): ValidationConstraint<string>
 export declare function lengthBetween(minimum: number, maximum: number): ValidationConstraint<string>;
 /**
  * Requires a string to match a regular expression.
+ *
+ * The pattern is copied without the `g` and `y` flags. Those make `test()`
+ * stateful through `lastIndex`, so a shared pattern would alternate between
+ * accepting and rejecting the very same value.
  */
 export declare function matches(pattern: RegExp, message?: string): ValidationConstraint<string>;
 /**
  * Requires a valid email-like format.
+ *
+ * Deliberately structural, not a full RFC 5322 parser: it rejects the shapes
+ * that are certainly wrong and leaves deliverability to a verification step.
  */
 export declare const email: ValidationConstraint<string>;
 /**
  * Requires a UUID-like format.
+ *
+ * Accepts versions 1 through 8, covering UUIDv7, plus the nil and max UUIDs.
  */
 export declare const uuid: ValidationConstraint<string>;
 /**
@@ -32,7 +43,11 @@ export declare const uuid: ValidationConstraint<string>;
  */
 export declare const httpUrl: ValidationConstraint<string>;
 /**
- * Requires a string to contain only ASCII characters.
+ * Requires a string to contain only printable ASCII characters.
+ *
+ * Control characters are excluded. A value that passes this is safe to place
+ * in a header or a single log line, which is what callers assume of a check
+ * named "ascii".
  */
 export declare const ascii: ValidationConstraint<string>;
 /**
@@ -44,7 +59,7 @@ export declare const digits: ValidationConstraint<string>;
  */
 export declare const letters: ValidationConstraint<string>;
 /**
- * Requires a string to contain only letters, numbers, underscores, or hyphens.
+ * Requires a lowercase, hyphen-separated slug.
  */
 export declare const slug: ValidationConstraint<string>;
 //# sourceMappingURL=validationConstraints.string.d.ts.map

package/dist/validationConstraints/{validationConstraints.string.js → scalar/validationConstraints.string.js}

@@ -1,4 +1,8 @@
-import { createConstraint, assertNonNegativeInteger, } from "./validationConstraints.base.js";
+import { createConstraint, assertNonNegativeInteger, } from "../validationConstraints.base.js";
+/** Counts Unicode code points rather than UTF-16 code units. */
+function characterLength(value) {
+    return [...value].length;
+}
 /**
  * Requires a string to be non-empty after trimming.
  */
@@ -9,13 +13,16 @@ export const nonEmptyString = createConstraint((value) => typeof value === "stri
 });
 /**
  * Requires a string to contain at least the specified number of characters.
+ *
+ * Counts code points, so an emoji costs one character rather than two.
  */
 export function minLength(minimum) {
     assertNonNegativeInteger(minimum, "minimum");
-    return createConstraint((value) => value.length >= minimum, {
+    return createConstraint((value) => characterLength(value) >= minimum, {
         name: `min_length_${minimum}`,
         code: "min_length",
         message: `Value must contain at least ${minimum} characters.`,
+        guard: (value) => typeof value === "string",
     });
 }
 /**
@@ -23,10 +30,11 @@ export function minLength(minimum) {
  */
 export function maxLength(maximum) {
     assertNonNegativeInteger(maximum, "maximum");
-    return createConstraint((value) => value.length <= maximum, {
+    return createConstraint((value) => characterLength(value) <= maximum, {
         name: `max_length_${maximum}`,
         code: "max_length",
         message: `Value must contain at most ${maximum} characters.`,
+        guard: (value) => typeof value === "string",
     });
 }
 /**
@@ -38,37 +46,56 @@ export function lengthBetween(minimum, maximum) {
     if (minimum > maximum) {
         throw new RangeError("minimum cannot be greater than maximum.");
     }
-    return createConstraint((value) => value.length >= minimum && value.length <= maximum, {
+    return createConstraint((value) => {
+        const length = characterLength(value);
+        return length >= minimum && length <= maximum;
+    }, {
         name: `length_between_${minimum}_${maximum}`,
         code: "length_between",
         message: `Value must contain between ${minimum} and ${maximum} characters.`,
+        guard: (value) => typeof value === "string",
     });
 }
 /**
  * Requires a string to match a regular expression.
+ *
+ * The pattern is copied without the `g` and `y` flags. Those make `test()`
+ * stateful through `lastIndex`, so a shared pattern would alternate between
+ * accepting and rejecting the very same value.
  */
 export function matches(pattern, message = "Value has an invalid format.") {
-    return createConstraint((value) => pattern.test(value), {
+    const stateless = new RegExp(pattern.source, pattern.flags.replace(/[gy]/gu, ""));
+    return createConstraint((value) => stateless.test(value), {
         name: "matches",
         code: "invalid_format",
         message,
+        guard: (value) => typeof value === "string",
     });
 }
 /**
  * Requires a valid email-like format.
+ *
+ * Deliberately structural, not a full RFC 5322 parser: it rejects the shapes
+ * that are certainly wrong and leaves deliverability to a verification step.
  */
-export const email = createConstraint((value) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(value), {
+export const email = createConstraint((value) => /^[^\s@,;<>"[\]\\]+@[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/iu.test(value) && !value.includes(".."), {
     name: "email",
     code: "invalid_email",
     message: "Value must be a valid email address.",
+    guard: (value) => typeof value === "string",
 });
 /**
  * Requires a UUID-like format.
+ *
+ * Accepts versions 1 through 8, covering UUIDv7, plus the nil and max UUIDs.
  */
-export const uuid = createConstraint((value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value), {
+export const uuid = createConstraint((value) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(value) ||
+    value === "00000000-0000-0000-0000-000000000000" ||
+    value.toLowerCase() === "ffffffff-ffff-ffff-ffff-ffffffffffff", {
     name: "uuid",
     code: "invalid_uuid",
     message: "Value must be a valid UUID.",
+    guard: (value) => typeof value === "string",
 });
 /**
  * Requires an HTTP or HTTPS URL.
@@ -85,22 +112,29 @@ export const httpUrl = createConstraint((value) => {
     name: "http_url",
     code: "invalid_url",
     message: "Value must be a valid HTTP or HTTPS URL.",
+    guard: (value) => typeof value === "string",
 });
 /**
- * Requires a string to contain only ASCII characters.
+ * Requires a string to contain only printable ASCII characters.
+ *
+ * Control characters are excluded. A value that passes this is safe to place
+ * in a header or a single log line, which is what callers assume of a check
+ * named "ascii".
  */
-export const ascii = createConstraint((value) => /^[\x00-\x7F]*$/u.test(value), {
+export const ascii = createConstraint((value) => /^[\x20-\x7E]*$/u.test(value), {
     name: "ascii",
     code: "invalid_ascii",
-    message: "Value must contain only ASCII characters.",
+    message: "Value must contain only printable ASCII characters.",
+    guard: (value) => typeof value === "string",
 });
 /**
  * Requires a string to contain only digits.
  */
-export const digits = createConstraint((value) => /^\d+$/u.test(value), {
+export const digits = createConstraint((value) => /^[0-9]+$/u.test(value), {
     name: "digits",
     code: "invalid_digits",
     message: "Value must contain only digits.",
+    guard: (value) => typeof value === "string",
 });
 /**
  * Requires a string to contain only letters.
@@ -109,13 +143,15 @@ export const letters = createConstraint((value) => /^\p{L}+$/u.test(value), {
     name: "letters",
     code: "invalid_letters",
     message: "Value must contain only letters.",
+    guard: (value) => typeof value === "string",
 });
 /**
- * Requires a string to contain only letters, numbers, underscores, or hyphens.
+ * Requires a lowercase, hyphen-separated slug.
  */
 export const slug = createConstraint((value) => /^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(value), {
     name: "slug",
     code: "invalid_slug",
-    message: "Value must be a valid slug.",
+    message: "Value must be a slug: lowercase letters and digits, separated by single hyphens.",
+    guard: (value) => typeof value === "string",
 });
 //# sourceMappingURL=validationConstraints.string.js.map

package/dist/validationConstraints/structure/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @zudojs/validation — Structural guards for untrusted object graphs.
+ *
+ * @module validationConstraints/structure
+ */
+export * from "./validationConstraints.traverse.js";
+export * from "./validationConstraints.depth.js";
+export * from "./validationConstraints.size.js";
+export * from "./validationConstraints.circular.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/validationConstraints/structure/index.js

@@ -0,0 +1,10 @@
+/**
+ * @zudojs/validation — Structural guards for untrusted object graphs.
+ *
+ * @module validationConstraints/structure
+ */
+export * from "./validationConstraints.traverse.js";
+export * from "./validationConstraints.depth.js";
+export * from "./validationConstraints.size.js";
+export * from "./validationConstraints.circular.js";
+//# sourceMappingURL=index.js.map

package/dist/validationConstraints/{validationConstraints.circular.d.ts → structure/validationConstraints.circular.d.ts}

@@ -7,14 +7,18 @@
 /**
  * Detect circular references in a value graph.
  *
- * Uses a WeakSet to track visited objects without preventing GC.
- * Throws CircularReferenceError on first cycle detected.
+ * Only a value that references *itself* through the current path is a cycle.
+ * The same object appearing twice in sibling positions is an ordinary shared
+ * reference and is allowed: rejecting it turned away every valid payload that
+ * reused a config object or a lookup record.
  *
  * @param value - The value to check for circular references.
  * @param path - Current traversal path for error reporting.
- * @param seen - WeakSet tracking visited objects (internal).
+ * @param maxDepth - Depth ceiling, so a deep graph cannot exhaust the stack
+ *   before a cycle is reported.
+ * @throws {CircularReferenceError} on the first cycle found.
  */
-export declare function assertNoCircularReference(value: unknown, path?: string, seen?: WeakSet<object>): void;
+export declare function assertNoCircularReference(value: unknown, path?: string, maxDepth?: number): void;
 /**
  * Check whether a value contains circular references.
  *

package/dist/validationConstraints/structure/validationConstraints.circular.js

@@ -0,0 +1,55 @@
+/**
+ * @zudojs/validation — Circular reference detection.
+ *
+ * Detects circular references in object graphs before serialization
+ * or validation to prevent stack overflows and provide clear error messages.
+ */
+import { CircularReferenceError } from "@zudojs/errors";
+import { MAX_MEASURABLE_DEPTH } from "./validationConstraints.depth.js";
+import { TraversalLimitError, traverse, } from "./validationConstraints.traverse.js";
+/**
+ * Detect circular references in a value graph.
+ *
+ * Only a value that references *itself* through the current path is a cycle.
+ * The same object appearing twice in sibling positions is an ordinary shared
+ * reference and is allowed: rejecting it turned away every valid payload that
+ * reused a config object or a lookup record.
+ *
+ * @param value - The value to check for circular references.
+ * @param path - Current traversal path for error reporting.
+ * @param maxDepth - Depth ceiling, so a deep graph cannot exhaust the stack
+ *   before a cycle is reported.
+ * @throws {CircularReferenceError} on the first cycle found.
+ */
+export function assertNoCircularReference(value, path = "root", maxDepth = MAX_MEASURABLE_DEPTH) {
+    try {
+        traverse(value, { maxDepth, failOnCycle: true }, path);
+    }
+    catch (error) {
+        if (error instanceof TraversalLimitError && error.halt === "cycle") {
+            throw new CircularReferenceError(error.path);
+        }
+        if (error instanceof TraversalLimitError && error.halt === "depth") {
+            throw new CircularReferenceError(`${error.path} (exceeded ${maxDepth} levels)`);
+        }
+        throw error;
+    }
+}
+/**
+ * Check whether a value contains circular references.
+ *
+ * Returns true if a cycle is found, false otherwise.
+ * Does not throw — use assertNoCircularReference for throwing behavior.
+ */
+export function hasCircularReference(value) {
+    try {
+        assertNoCircularReference(value);
+        return false;
+    }
+    catch (error) {
+        if (error instanceof CircularReferenceError)
+            return true;
+        throw error;
+    }
+}
+//# sourceMappingURL=validationConstraints.circular.js.map

package/dist/validationConstraints/structure/validationConstraints.depth.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @zudojs/validation — Depth checking.
+ *
+ * Computes and validates the nesting depth of object graphs
+ * to prevent stack overflows from deeply nested payloads.
+ */
+/**
+ * Hard ceiling on how deep {@link getSerializationDepth} will descend.
+ *
+ * The measurement itself is recursive, so it needs a bound of its own: a guard
+ * that overflows the stack on the input it was checking protects nothing.
+ */
+export declare const MAX_MEASURABLE_DEPTH = 512;
+/**
+ * Compute the maximum nesting depth of a value.
+ *
+ * Primitives return 0. Arrays and objects return 1 + the maximum
+ * depth of their children. Cycles are not followed.
+ *
+ * @param value - The value to measure.
+ * @param limit - Stop measuring beyond this depth. Defaults to
+ *   {@link MAX_MEASURABLE_DEPTH}; the limit itself is returned when reached.
+ * @returns The observed depth, capped at `limit`.
+ */
+export declare function getSerializationDepth(value: unknown, limit?: number): number;
+/**
+ * Assert that a value does not exceed the maximum allowed depth.
+ *
+ * Stops descending the moment the limit is passed, so the cost of the check is
+ * bounded by `maxDepth` rather than by the size of the input.
+ *
+ * @param value - The value to check.
+ * @param maxDepth - Maximum permitted nesting depth.
+ * @throws {SerializationDepthError} when depth exceeds the limit.
+ */
+export declare function assertDepthWithinLimit(value: unknown, maxDepth: number): void;
+//# sourceMappingURL=validationConstraints.depth.d.ts.map

package/dist/validationConstraints/structure/validationConstraints.depth.js

@@ -0,0 +1,58 @@
+/**
+ * @zudojs/validation — Depth checking.
+ *
+ * Computes and validates the nesting depth of object graphs
+ * to prevent stack overflows from deeply nested payloads.
+ */
+import { SerializationDepthError } from "@zudojs/errors";
+import { TraversalLimitError, traverse, } from "./validationConstraints.traverse.js";
+/**
+ * Hard ceiling on how deep {@link getSerializationDepth} will descend.
+ *
+ * The measurement itself is recursive, so it needs a bound of its own: a guard
+ * that overflows the stack on the input it was checking protects nothing.
+ */
+export const MAX_MEASURABLE_DEPTH = 512;
+/**
+ * Compute the maximum nesting depth of a value.
+ *
+ * Primitives return 0. Arrays and objects return 1 + the maximum
+ * depth of their children. Cycles are not followed.
+ *
+ * @param value - The value to measure.
+ * @param limit - Stop measuring beyond this depth. Defaults to
+ *   {@link MAX_MEASURABLE_DEPTH}; the limit itself is returned when reached.
+ * @returns The observed depth, capped at `limit`.
+ */
+export function getSerializationDepth(value, limit = MAX_MEASURABLE_DEPTH) {
+    try {
+        return traverse(value, { maxDepth: limit }).depth;
+    }
+    catch (error) {
+        if (error instanceof TraversalLimitError)
+            return limit;
+        throw error;
+    }
+}
+/**
+ * Assert that a value does not exceed the maximum allowed depth.
+ *
+ * Stops descending the moment the limit is passed, so the cost of the check is
+ * bounded by `maxDepth` rather than by the size of the input.
+ *
+ * @param value - The value to check.
+ * @param maxDepth - Maximum permitted nesting depth.
+ * @throws {SerializationDepthError} when depth exceeds the limit.
+ */
+export function assertDepthWithinLimit(value, maxDepth) {
+    try {
+        traverse(value, { maxDepth });
+    }
+    catch (error) {
+        if (error instanceof TraversalLimitError && error.halt === "depth") {
+            throw new SerializationDepthError(error.observed, maxDepth);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=validationConstraints.depth.js.map

package/dist/validationConstraints/structure/validationConstraints.size.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @zudojs/validation — Size checking.
+ *
+ * Estimates serialized payload size to prevent memory exhaustion
+ * from excessively large payloads.
+ */
+/**
+ * Estimate the byte size of a value as JSON without allocating a string.
+ *
+ * A value referenced from several places is charged once per occurrence, the
+ * way a serializer expands it. Counting it once let a compact payload built
+ * from shared subtrees estimate at a few hundred bytes while serializing to
+ * hundreds of megabytes.
+ *
+ * @param value - The value to measure.
+ * @param maxBytes - Stop counting past this budget; the budget is returned.
+ * @returns The estimated serialized size in bytes.
+ */
+export declare function estimateSerializedSize(value: unknown, maxBytes?: number): number;
+/**
+ * Assert that a value's estimated serialized size is within limits.
+ *
+ * Aborts as soon as the budget is passed, so an oversized payload is rejected
+ * without first being measured in full.
+ *
+ * @param value - The value to check.
+ * @param maxSize - Maximum permitted size in bytes.
+ * @throws {SerializationPayloadTooLargeError} when the estimate exceeds maxSize.
+ */
+export declare function assertSizeWithinLimit(value: unknown, maxSize: number): void;
+//# sourceMappingURL=validationConstraints.size.d.ts.map