@zudojs/validation 1.0.2 → 1.0.3

package/dist/validationConstraints/structure/validationConstraints.circular.d.ts

@@ -17,12 +17,18 @@
  * @param maxDepth - Depth ceiling, so a deep graph cannot exhaust the stack
  *   before a cycle is reported.
  * @throws {CircularReferenceError} on the first cycle found.
+ * @throws {SerializationDepthError} when the graph is deeper than `maxDepth`.
+ *   Running out of depth is not evidence of a cycle, and reporting it as one
+ *   told callers a payload referenced itself when it merely nested too far.
  */
 export declare function assertNoCircularReference(value: unknown, path?: string, maxDepth?: number): void;
 /**
  * Check whether a value contains circular references.
  *
- * Returns true if a cycle is found, false otherwise.
+ * Returns true if a cycle is found, false otherwise. A graph too deep to walk
+ * within the measurable ceiling reports false: no cycle was found, and the
+ * depth is the caller's own `assertDepthWithinLimit` to report.
+ *
  * Does not throw — use assertNoCircularReference for throwing behavior.
  */
 export declare function hasCircularReference(value: unknown): boolean;

package/dist/validationConstraints/structure/validationConstraints.circular.js

@@ -4,7 +4,7 @@
  * Detects circular references in object graphs before serialization
  * or validation to prevent stack overflows and provide clear error messages.
  */
-import { CircularReferenceError } from "@zudojs/errors";
+import { CircularReferenceError, SerializationDepthError, } from "@zudojs/errors";
 import { MAX_MEASURABLE_DEPTH } from "./validationConstraints.depth.js";
 import { TraversalLimitError, traverse, } from "./validationConstraints.traverse.js";
 /**
@@ -20,6 +20,9 @@ import { TraversalLimitError, traverse, } from "./validationConstraints.traverse
  * @param maxDepth - Depth ceiling, so a deep graph cannot exhaust the stack
  *   before a cycle is reported.
  * @throws {CircularReferenceError} on the first cycle found.
+ * @throws {SerializationDepthError} when the graph is deeper than `maxDepth`.
+ *   Running out of depth is not evidence of a cycle, and reporting it as one
+ *   told callers a payload referenced itself when it merely nested too far.
  */
 export function assertNoCircularReference(value, path = "root", maxDepth = MAX_MEASURABLE_DEPTH) {
     try {
@@ -30,7 +33,7 @@ export function assertNoCircularReference(value, path = "root", maxDepth = MAX_M
             throw new CircularReferenceError(error.path);
         }
         if (error instanceof TraversalLimitError && error.halt === "depth") {
-            throw new CircularReferenceError(`${error.path} (exceeded ${maxDepth} levels)`);
+            throw new SerializationDepthError(error.observed, maxDepth);
         }
         throw error;
     }
@@ -38,7 +41,10 @@ export function assertNoCircularReference(value, path = "root", maxDepth = MAX_M
 /**
  * Check whether a value contains circular references.
  *
- * Returns true if a cycle is found, false otherwise.
+ * Returns true if a cycle is found, false otherwise. A graph too deep to walk
+ * within the measurable ceiling reports false: no cycle was found, and the
+ * depth is the caller's own `assertDepthWithinLimit` to report.
+ *
  * Does not throw — use assertNoCircularReference for throwing behavior.
  */
 export function hasCircularReference(value) {
@@ -49,6 +55,8 @@ export function hasCircularReference(value) {
     catch (error) {
         if (error instanceof CircularReferenceError)
             return true;
+        if (error instanceof SerializationDepthError)
+            return false;
         throw error;
     }
 }

package/dist/validationConstraints/structure/validationConstraints.size.d.ts

@@ -12,8 +12,16 @@
  * from shared subtrees estimate at a few hundred bytes while serializing to
  * hundreds of megabytes.
  *
+ * Charging every occurrence means the subtree memo that keeps the walk linear
+ * has to be off, so the budget is the only thing that bounds the work: `n`
+ * shared `{a:node,b:node}` pairs expand to `2^n` visits. The default budget is
+ * therefore finite — {@link SerializationLimits.MAX_SIZE} — rather than
+ * `Infinity`, which left an untrusted 1 KB payload able to burn minutes of CPU.
+ * Pass an explicit `Infinity` only for input you trust.
+ *
  * @param value - The value to measure.
  * @param maxBytes - Stop counting past this budget; the budget is returned.
+ *   Defaults to {@link SerializationLimits.MAX_SIZE}.
  * @returns The estimated serialized size in bytes.
  */
 export declare function estimateSerializedSize(value: unknown, maxBytes?: number): number;

package/dist/validationConstraints/structure/validationConstraints.size.js

@@ -4,6 +4,7 @@
  * Estimates serialized payload size to prevent memory exhaustion
  * from excessively large payloads.
  */
+import { SerializationLimits } from "@zudojs/constants";
 import { SerializationPayloadTooLargeError } from "@zudojs/errors";
 import { MAX_MEASURABLE_DEPTH } from "./validationConstraints.depth.js";
 import { TraversalLimitError, traverse, } from "./validationConstraints.traverse.js";
@@ -69,11 +70,19 @@ function resolveToJson(value) {
  * from shared subtrees estimate at a few hundred bytes while serializing to
  * hundreds of megabytes.
  *
+ * Charging every occurrence means the subtree memo that keeps the walk linear
+ * has to be off, so the budget is the only thing that bounds the work: `n`
+ * shared `{a:node,b:node}` pairs expand to `2^n` visits. The default budget is
+ * therefore finite — {@link SerializationLimits.MAX_SIZE} — rather than
+ * `Infinity`, which left an untrusted 1 KB payload able to burn minutes of CPU.
+ * Pass an explicit `Infinity` only for input you trust.
+ *
  * @param value - The value to measure.
  * @param maxBytes - Stop counting past this budget; the budget is returned.
+ *   Defaults to {@link SerializationLimits.MAX_SIZE}.
  * @returns The estimated serialized size in bytes.
  */
-export function estimateSerializedSize(value, maxBytes = Number.POSITIVE_INFINITY) {
+export function estimateSerializedSize(value, maxBytes = SerializationLimits.MAX_SIZE) {
     try {
         return traverse(value, {
             maxDepth: MAX_MEASURABLE_DEPTH,

package/dist/validationParser/validationParser.collection.js

@@ -3,10 +3,9 @@
  *
  * @module validationParser/validationParser.collection
  */
+import { SCHEMA_FORBIDDEN_KEYS } from "@zudojs/constants";
 import { validate, validateAsync, } from "../validationSchema/validationSchema.core.js";
 import { failure, success } from "../validationResult/validationResult.type.js";
-/** Property names that would mutate a prototype instead of adding a key. */
-const FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 /** Parses multiple values using the same schema. Succeeds only when every value is valid. */
 export function parseMany(schema, values) {
     const parsed = [];
@@ -52,7 +51,7 @@ export function parseRecord(schema, values) {
     const parsed = Object.create(null);
     const issues = [];
     for (const [key, value] of Object.entries(values)) {
-        if (FORBIDDEN_KEYS.has(key)) {
+        if (SCHEMA_FORBIDDEN_KEYS.has(key)) {
             issues.push({
                 path: [key],
                 code: "forbidden_key",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/validation",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Schema validation with Zod integration, constraints, parsers, composers, circular detection, and depth/size checks.",
   "license": "MIT",
   "author": {
@@ -25,8 +25,8 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/constants": "1.1.0",
-    "@zudojs/errors": "1.1.0",
+    "@zudojs/constants": "1.1.1",
+    "@zudojs/errors": "1.2.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {