prefix-safe-json 0.4.0 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -6
- package/package.json +4 -2
package/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# prefix-safe-json
|
|
2
2
|
|
|
3
|
-
> **v0.4.
|
|
3
|
+
> **v0.4.1** — Core APIs are stable; raw provider adapters remain
|
|
4
4
|
> experimental. See [Current Status](#current-status) and
|
|
5
5
|
> [CHANGELOG.md](CHANGELOG.md).
|
|
6
6
|
|
|
@@ -20,7 +20,21 @@ pnpm add prefix-safe-json ai
|
|
|
20
20
|
# or: npm install prefix-safe-json ai
|
|
21
21
|
```
|
|
22
22
|
|
|
23
|
-
The package is ESM-only and
|
|
23
|
+
The published package is ESM-only and supports Node `>=18.0.0`. Repository
|
|
24
|
+
development and release jobs remain on Node 22/24 because the development
|
|
25
|
+
toolchain and the exact `ai@7.0.77` lifecycle proof require newer Node; those
|
|
26
|
+
requirements do not apply to the package's runtime dependency graph.
|
|
27
|
+
|
|
28
|
+
## Supply-chain verification
|
|
29
|
+
|
|
30
|
+
Verify releases independently rather than relying on publisher claims. The
|
|
31
|
+
`0.4.1` npm artifact has npm provenance from this repository's GitHub Actions
|
|
32
|
+
publish workflow, and its tarball can be rebuilt and compared with the release
|
|
33
|
+
tag by running `npm run verify:published-release -- 0.4.1` from a clone with
|
|
34
|
+
tags fetched. See the command-driven [maintainer audit](docs/MAINTAINER_AUDIT.md),
|
|
35
|
+
the exact [release/hash mapping](docs/RELEASE_INTEGRITY.md), the
|
|
36
|
+
[runtime dependency graph](docs/RUNTIME_DEPENDENCIES.md), and the
|
|
37
|
+
[execution-critical source map](docs/EXECUTION_AUDIT_SURFACE.md).
|
|
24
38
|
|
|
25
39
|
## Recommended AI SDK boundary
|
|
26
40
|
|
|
@@ -395,11 +409,12 @@ A schema mismatch also surfaces as a coordinator diagnostic (`E_SCHEMA_VALIDATIO
|
|
|
395
409
|
## Package requirements
|
|
396
410
|
|
|
397
411
|
ESM only — `import`, not `require`. There is currently no CommonJS build.
|
|
398
|
-
Node `>=
|
|
399
|
-
|
|
412
|
+
Node `>=18.0.0`. Node 18/20 are end-of-life and no longer receive security
|
|
413
|
+
patches; compatibility here describes the package runtime, not a recommendation
|
|
414
|
+
to operate an unpatched Node release. See
|
|
400
415
|
[`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md) for the full
|
|
401
|
-
|
|
402
|
-
compatibility matrix.
|
|
416
|
+
runtime-versus-toolchain distinction, exact AI SDK pin requirements, and the
|
|
417
|
+
per-provider compatibility matrix.
|
|
403
418
|
|
|
404
419
|
## Low-level API: Quick Start
|
|
405
420
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "prefix-safe-json",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.2",
|
|
4
4
|
"description": "Fail-closed execution integrity for streamed LLM tool calls — reject truncated or unconfirmed arguments before side effects",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"json",
|
|
@@ -41,7 +41,7 @@
|
|
|
41
41
|
"README.md"
|
|
42
42
|
],
|
|
43
43
|
"engines": {
|
|
44
|
-
"node": ">=
|
|
44
|
+
"node": ">=18.0.0"
|
|
45
45
|
},
|
|
46
46
|
"dependencies": {
|
|
47
47
|
"ajv": "^8.20.0"
|
|
@@ -61,6 +61,8 @@
|
|
|
61
61
|
"test:fuzz": "vitest run test/fuzz/",
|
|
62
62
|
"bench": "vitest bench --run",
|
|
63
63
|
"validate-corpus": "tsx scripts/validate-corpus.ts",
|
|
64
|
+
"verify:package-policy": "node scripts/verify-package-policy.mjs",
|
|
65
|
+
"verify:published-release": "node scripts/verify-published-release.mjs",
|
|
64
66
|
"clean": "rimraf dist coverage .vitest",
|
|
65
67
|
"pack:check": "pnpm pack --dry-run",
|
|
66
68
|
"example:anthropic": "node examples/anthropic-truncation-safety.mjs",
|