typia 13.1.19 → 13.2.0

package/native/core/programmers/iterate/json_schema_pattern_property_order_test.go

@@ -0,0 +1,44 @@
+package iterate
+
+import (
+  "slices"
+  "testing"
+
+  nativemetadata "github.com/samchon/typia/packages/typia/native/core/schemas/metadata"
+)
+
+// TestJsonSchemaPatternPropertyOrderPreservesFirstPosition verifies repeated patterns keep one ordered slot.
+//
+// The legacy TypeScript producer stored pairs in a plain object: assigning an
+// existing pattern replaced its value without moving or duplicating its first
+// insertion position. The Go order record must preserve that overwrite contract.
+//
+//  1. Insert two patterns, then replace the first pattern with new metadata and schema values.
+//  2. Assert the ordered keys remain unique and the map retains the replacement pair.
+func TestJsonSchemaPatternPropertyOrderPreservesFirstPosition(t *testing.T) {
+  first := &nativemetadata.MetadataSchema{}
+  replacement := &nativemetadata.MetadataSchema{}
+  extra := json_schema_superfluous{
+    patternProperties: map[string]json_schema_metadata_schema_pair{},
+  }
+  extra.setPatternProperty("first", json_schema_metadata_schema_pair{
+    metadata: first,
+    schema:   JsonSchema{"type": "string"},
+  })
+  extra.setPatternProperty("second", json_schema_metadata_schema_pair{
+    metadata: &nativemetadata.MetadataSchema{},
+    schema:   JsonSchema{"type": "boolean"},
+  })
+  extra.setPatternProperty("first", json_schema_metadata_schema_pair{
+    metadata: replacement,
+    schema:   JsonSchema{"type": "number"},
+  })
+
+  if slices.Equal(extra.patternPropertyKeys, []string{"first", "second"}) == false {
+    t.Fatalf("pattern property order was %v", extra.patternPropertyKeys)
+  }
+  pair := extra.patternProperties["first"]
+  if pair.metadata != replacement || pair.schema["type"] != "number" {
+    t.Fatalf("replacement pair was not retained: %#v", pair)
+  }
+}

package/native/core/programmers/iterate/openapi_v3_downgrader.go

@@ -454,7 +454,40 @@ func openApiV3Downgrader_omit_examples(schema JsonSchema) JsonSchema {
     }
     output[key] = value
   }
-  return output
+  return openApiV3Downgrader_exclusive_bounds(output)
+}
+
+// openApiV3Downgrader_exclusive_bounds rewrites an exclusive numeric bound into
+// the form the 3.0 dialect defines.
+//
+// 3.0's Schema Object descends from JSON Schema draft-04, where
+// `exclusiveMinimum` and `exclusiveMaximum` are booleans qualifying `minimum`
+// and `maximum`; the numeric spelling belongs to 3.1. Carrying the number
+// through left a document that declares itself 3.0 with a 3.1 keyword, and a
+// 3.0 reader taking the value as the boolean its dialect declares finds no
+// `minimum` beside it and drops the bound entirely (#2300).
+//
+// The upgrader already performs the inverse — a boolean `exclusiveMinimum: true`
+// becomes the numeric bound and the redundant `minimum` is dropped — so this
+// makes the pair a round trip.
+func openApiV3Downgrader_exclusive_bounds(schema JsonSchema) JsonSchema {
+  for _, pair := range [][2]string{
+    {"exclusiveMinimum", "minimum"},
+    {"exclusiveMaximum", "maximum"},
+  } {
+    value, ok := schema[pair[0]]
+    if ok == false {
+      continue
+    }
+    if _, boolean := value.(bool); boolean {
+      continue
+    }
+    if openApiV3Downgrader_is_nil(value) == false {
+      schema[pair[1]] = value
+      schema[pair[0]] = true
+    }
+  }
+  return schema
 }
 
 // openApiV3Downgrader_shallow_clone copies a schema's own keys, leaving nested

package/native/core/programmers/iterate/template_runtime_pattern.go

@@ -25,6 +25,17 @@ type templateCapture struct {
   Atomic *nativemetadata.MetadataAtomic
 }
 
+// TemplateRuntimePattern returns the structural regular-expression pattern the
+// runtime template checker uses for one template-literal row.
+//
+// Consumers that only need template membership can share the checker's exact
+// pattern without duplicating its lowering. Runtime tag conditions remain owned
+// by Check_template because they require the checker context and capture map.
+func TemplateRuntimePattern(row []*nativemetadata.MetadataSchema) string {
+  pattern, _ := template_runtime_pattern(row)
+  return pattern
+}
+
 // template_runtime_pattern builds the structural regex of a template literal for
 // the runtime checker and, alongside it, the capture map of every constrained
 // interpolation placeholder.

package/native/core/programmers/json/JsonStringifyProgrammer.go

@@ -278,7 +278,34 @@ func jsonStringifyProgrammer_decode(props struct {
       Value: func() *shimast.Node {
         next := props
         next.Metadata = metadata
-        return jsonStringifyProgrammer_decode_to_json(next)
+        resolved := jsonStringifyProgrammer_decode_to_json(next)
+        if isDate {
+          return resolved
+        }
+        // The arm's own test is `typeof input.toJSON === "function"`, but an arm
+        // test is not always emitted — a sole arm needs no choice, and a final
+        // arm is the else — while this value *calls* `toJSON`. Leaving the call
+        // to be guarded by the arm meant a value whose `toJSON` is not callable
+        // threw `input.toJSON is not a function` from inside the serializer,
+        // including under `isStringify` and `validateStringify`, whose contract
+        // is to answer rather than throw (samchon/typia#2271).
+        //
+        // The guard therefore belongs to the call. `JSON.stringify` ignores a
+        // non-callable `toJSON` and serializes the object itself, and the
+        // metadata already carries that shape, so the fallback describes the
+        // original rather than inventing an answer. `Date` keeps the plain form:
+        // its arm is `instanceof Date`, and a real Date's `toJSON` is callable.
+        original := props
+        original.Metadata = props.Metadata.Escaped.Original
+        return nativefactories.ExpressionFactory.Conditional(
+          nativeprogrammers.IsProgrammer.Decode_to_json(struct {
+            Input     *shimast.Expression
+            CheckNull bool
+          }{Input: props.Input, CheckNull: false}),
+          resolved,
+          jsonStringifyProgrammer_decode(original),
+          props.Context.Emit,
+        )
       },
     })
   } else if len(props.Metadata.Functions) != 0 {
@@ -697,9 +724,10 @@ func jsonStringifyProgrammer_decode_array_inline(props jsonStringifyProgrammer_d
       Arrow *shimast.Node
     }) *shimast.Node {
       return nativehelpers.StringifyJoiner.Array(nativehelpers.StringifyJoiner_ArrayProps{
-        Input: next.Input,
-        Arrow: next.Arrow,
-        Emit:  props.Context.Emit,
+        Context: props.Context,
+        Input:   next.Input,
+        Arrow:   next.Arrow,
+        Emit:    props.Context.Emit,
       })
     },
     Array:   props.Array,
@@ -772,7 +800,7 @@ func jsonStringifyProgrammer_decode_tuple_inline(props jsonStringifyProgrammer_d
     } else {
       explore.Postfix = fmt.Sprintf("\"[%d]\"", index)
     }
-    elements = append(elements, jsonStringifyProgrammer_decode(struct {
+    code := jsonStringifyProgrammer_decode(struct {
       Context   nativecontext.ITypiaContext
       Config    nativeinternal.FeatureProgrammer_IConfig
       Functor   *nativehelpers.FunctionProgrammer
@@ -788,7 +816,20 @@ func jsonStringifyProgrammer_decode_tuple_inline(props jsonStringifyProgrammer_d
       Metadata:  elem,
       Explore:   explore,
       Validated: props.Validated,
-    }))
+    })
+    if nativehelpers.StringifyJoiner_ResultUndefinable(elem) {
+      // A tuple slot holds its position, so an element that serializes to
+      // nothing is `null` rather than omitted; without this its text was the
+      // literal `undefined` (#2253).
+      code = f.NewCallExpression(
+        jsonStringifyProgrammer_internal(props.Context, "jsonStringifyElement"),
+        nil,
+        nil,
+        f.NewNodeList([]*shimast.Node{code}),
+        shimast.NodeFlagsNone,
+      )
+    }
+    elements = append(elements, code)
   }
   var rest *shimast.Node
   if len(props.Tuple.Elements) != 0 {

package/native/core/programmers/llm/LlmApplicationProgrammer.go

@@ -240,7 +240,15 @@ func (llmApplicationProgrammerNamespace) WriteApplication(props struct {
       functions = append(functions, written)
     }
   }
-  result := map[string]any{"functions": functions}
+  // The call site's schema configuration is resolved here and nowhere else, so
+  // it travels with the emitted application; the runtime finalizer only adds
+  // the validate hook to it. Rebuilding it at runtime reported `strict: false`
+  // for a strict build (issue #2293).
+  strict, _ := props.Config["strict"].(bool)
+  result := map[string]any{
+    "config":    map[string]any{"strict": strict},
+    "functions": functions,
+  }
   if len(metadata.Objects) != 0 {
     if object := metadata.Objects[0].Type; object != nil {
       if description := llmApplicationProgrammer_describe(object.Description, object.JsDocTags); description != nil && len(*description) != 0 {

package/native/core/programmers/protobuf/ProtobufMessageProgrammer.go

@@ -35,7 +35,7 @@ func (protobufMessageProgrammerNamespace) Write(props ProtobufMessageProgrammer_
   f := nativecontext.EmitFactoryOf(protobufMessageProgrammer_factory, props.Context.Emit)
   collection := schemametadata.NewMetadataCollection()
   nativefactories.ProtobufFactory.Metadata(nativefactories.ProtobufFactory_IProps{
-    Method:     "message",
+    Method:     "typia.protobuf.message",
     Checker:    props.Context.Checker,
     Components: collection,
     Type:       props.Type,

package/native/core/schemas/metadata/MetadataCollection.go

@@ -784,15 +784,6 @@ func metadataCollection_isOpenApiNameRune(ch rune) bool {
     ch == '_'
 }
 
-func MetadataCollection_escape(str string) string {
-  for _, pair := range metadataCollection_replacers {
-    if pair.After != "" {
-      str = strings.ReplaceAll(str, pair.After, pair.Before)
-    }
-  }
-  return str
-}
-
 type metadataCollection_replacer struct {
   Before string
   After  string

package/native/core/schemas/metadata/MetadataDefaultLibrary.go

@@ -0,0 +1,81 @@
+package metadata
+
+import (
+  "strings"
+  "sync"
+
+  nativeast "github.com/microsoft/typescript-go/shim/ast"
+  nativechecker "github.com/microsoft/typescript-go/shim/checker"
+)
+
+// MetadataDefaultLibrary routes the compiler's own default-library
+// classification to metadata analysis, which decides runtime-native identity
+// from it: a global is the JavaScript built-in only when a runtime authority —
+// a TypeScript default library, or Node's `buffer` core module — declares it
+// (#2200).
+//
+// Only the program knows which files those are. `bundled:///libs/lib.es2022.d.ts`
+// under the embedded default, an on-disk path under `noembed`, and
+// `node_modules/@typescript/lib-es2022/index.d.ts` under `libReplacement` are
+// all the same authority, and none of them is recognizable from the file name:
+// the last one does not even start with `lib.`, while `lib.d.ts` is an ordinary
+// published file name that any dependency or `typeRoots` package may use
+// (samchon/typia#2108 recorded the same lesson for dependency reporting).
+//
+// The registry is keyed by checker for the same reason MetadataDependency is:
+// analysis code deep inside the metadata iterators holds the checker but no
+// transform context, while one transform host drives one program at a time. A
+// sync.Map keeps unrelated programs in the same process (tests) isolated.
+//
+// When no classifier is registered the file name is the only evidence left, so
+// the fallback is the historical `lib.*.d.ts` base-name test. That keeps a host
+// that never registers on exactly the behavior this package had before the
+// registry existed rather than silently classifying every real native as a
+// user declaration.
+var metadataDefaultLibrary_classifiers sync.Map
+
+// MetadataDefaultLibrary_register records the program-level classifier for
+// `checker`. Register it once per loaded program, before any transform runs.
+func MetadataDefaultLibrary_register(checker *nativechecker.Checker, classifier func(*nativeast.SourceFile) bool) {
+  if checker == nil || classifier == nil {
+    return
+  }
+  metadataDefaultLibrary_classifiers.Store(checker, classifier)
+}
+
+// MetadataDefaultLibrary_release removes the classifier registered for
+// `checker`.
+func MetadataDefaultLibrary_release(checker *nativechecker.Checker) {
+  if checker == nil {
+    return
+  }
+  metadataDefaultLibrary_classifiers.Delete(checker)
+}
+
+// MetadataDefaultLibrary_is reports whether `source` is one of the program's
+// default library files.
+func MetadataDefaultLibrary_is(checker *nativechecker.Checker, source *nativeast.SourceFile) bool {
+  if source == nil {
+    return false
+  }
+  if checker != nil {
+    if stored, ok := metadataDefaultLibrary_classifiers.Load(checker); ok {
+      if classifier, ok := stored.(func(*nativeast.SourceFile) bool); ok {
+        return classifier(source)
+      }
+    }
+  }
+  return MetadataDefaultLibrary_isFileNamed(source.FileName())
+}
+
+// MetadataDefaultLibrary_isFileNamed is the registry's file-name fallback,
+// exported so the one predicate that still answers without a checker keeps
+// using the same rule.
+func MetadataDefaultLibrary_isFileNamed(fileName string) bool {
+  slash := strings.ReplaceAll(fileName, "\\", "/")
+  base := slash
+  if index := strings.LastIndex(slash, "/"); index >= 0 {
+    base = slash[index+1:]
+  }
+  return strings.HasPrefix(base, "lib.") && strings.HasSuffix(base, ".d.ts")
+}

package/native/core/schemas/metadata/MetadataObjectType.go

@@ -13,25 +13,25 @@ type IMetadataSchema_IObjectType struct {
 }
 
 type MetadataObjectType struct {
-  Name              string
-  DisplayName       string
+  Name        string
+  DisplayName string
   // Source is the absolute-or-as-declared path of the file declaring a named
   // class, captured at analysis time so plain.classify can value-import a
   // cross-module class it reconstructs (Object.create / new / from). nil for
   // anonymous/literal shapes and types with no locatable declaration. Read
   // in-process by the classify programmer; not serialized (classify is
   // single-pass), and ignored by clone/prune.
-  Source            *string
+  Source *string
   // SourceDefault is true when the class is the default export of Source, so a
   // cross-module classify value-import uses a default (not named) import.
-  SourceDefault     bool
+  SourceDefault bool
   // PrivateFields is true when the named class declaration carries at least one
   // ES `#private` member (a member named with a PrivateIdentifier). Such slots
   // are installed only by running the constructor; plain.classify's field-copy
   // (Object.create + assign) cannot restore them, so classify rejects any such
   // class at a field-copied position. Read in-process by the classify
   // programmer; ignored by clone/prune, not serialized.
-  PrivateFields     bool
+  PrivateFields bool
   // IsClass is true when this object's declaration is a `class` (declaration or
   // expression), so it has a runtime VALUE binding plain.classify can
   // `Object.create(<name>.prototype)`/`new` against. False for an interface, a
@@ -39,7 +39,7 @@ type MetadataObjectType struct {
   // value, so classify field-copies a plain {} instead of referencing a
   // type-only name. Read in-process by the classify programmer; ignored by
   // clone/prune, not serialized.
-  IsClass           bool
+  IsClass bool
   // ValueRef overrides the runtime VALUE-binding name plain.classify uses when
   // the class's metadata Name is not a usable runtime constructor reference —
   // namely a NAMED class EXPRESSION (`const X = class Beast {...}`), whose Name
@@ -56,7 +56,7 @@ type MetadataObjectType struct {
   Validated         bool
   Recursive         bool
   Nullables         []bool
-  Parent_objects_  []*MetadataObject
+  Parent_objects_   []*MetadataObject
   Check_properties_ []*MetadataProperty
   Tagged_           bool
   literal_          *bool
@@ -205,17 +205,6 @@ func (obj *MetadataObjectType) ToJSON() IMetadataSchema_IObjectType {
   }
 }
 
-func MetadataObjectType_intersects(x *MetadataObjectType, y *MetadataObjectType) bool {
-  for _, prop := range x.Properties {
-    for _, oppo := range y.Properties {
-      if prop.Key.GetName() == oppo.Key.GetName() {
-        return true
-      }
-    }
-  }
-  return false
-}
-
 func MetadataObjectType_covers(x *MetadataObjectType, y *MetadataObjectType) bool {
   if len(x.Properties) < len(y.Properties) {
     return false

package/native/go.mod

@@ -5,10 +5,10 @@ go 1.26
 // Build-time floor: the driver reference-graph SDK
 // (driver.NewTransformGraph / driver.TransformGraph / driver.TransformOutputKey)
 // this plugin consumes exists only in ttsc >= 0.19.2. That floor is enforced
-// through typia's package.json peerDependencies (ttsc / @ttsc/unplugin), not
-// here: ttsc builds this plugin from source on the user's machine and its
-// buildSourcePlugin generates `replace github.com/samchon/ttsc/packages/ttsc
-// v0.0.0 => <installed ttsc root>`, so the require below must stay v0.0.0 or the
+// through typia's package.json `ttsc` peerDependency, not here: ttsc builds
+// this plugin from source on the user's machine and its buildSourcePlugin
+// generates `replace github.com/samchon/ttsc/packages/ttsc v0.0.0 =>
+// <installed ttsc root>`, so the require below must stay v0.0.0 or the
 // generated replace no longer matches and the plugin build fails to resolve.
 require (
 	github.com/microsoft/typescript-go/shim/ast v0.0.0

package/native/transform/features/protobuf/ProtobufMessageTransformer.go

@@ -20,7 +20,7 @@ func (protobufMessageTransformerNamespace) Transform(props nativetransform.ITran
   typ := props.Context.Checker.GetTypeFromTypeNode(props.Expression.TypeArguments.Nodes[0])
   if typ != nil && typ.IsTypeParameter() {
     panic(nativetransform.NewTransformerError(nativetransform.TransformerError_IProps{
-      Code:    "tyipa.protobuf.message",
+      Code:    "typia.protobuf.message",
       Message: "non-specified generic argument.",
     }))
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "typia",
-  "version": "13.1.19",
+  "version": "13.2.0",
   "description": "Superfast runtime validators with only one line",
   "main": "lib/index.js",
   "exports": {
@@ -50,17 +50,13 @@
     "inquirer": "^8.2.5",
     "randexp": "^0.5.3",
     "tinyglobby": "^0.2.12",
-    "@typia/interface": "^13.1.19",
-    "@typia/utils": "^13.1.19"
+    "@typia/interface": "^13.2.0",
+    "@typia/utils": "^13.2.0"
   },
   "peerDependencies": {
-    "@ttsc/unplugin": ">=0.19.2",
     "ttsc": ">=0.19.2"
   },
   "peerDependenciesMeta": {
-    "@ttsc/unplugin": {
-      "optional": true
-    },
     "ttsc": {
       "optional": true
     }

package/src/executable/FileSystemIdentity.ts

@@ -147,6 +147,39 @@ export namespace FileSystemIdentity {
     );
   }
 
+  /**
+   * Builds the key that decides whether two paths are the same filesystem
+   * object.
+   *
+   * The identity is read from `fs.BigIntStats` rather than `fs.Stats`, because
+   * `fs.Stats.ino` is a JavaScript number. An NTFS file ID is `(sequenceNumber
+   * << 48) | mftRecordIndex` and routinely exceeds `Number.MAX_SAFE_INTEGER` —
+   * in a 4000-directory probe, 1879 of them did — where the spacing between
+   * representable doubles is 8 or more. Two entries sharing a sequence number
+   * with MFT record indices within that spacing round to one double. The
+   * traversal callers would then treat a distinct directory or file as already
+   * visited and skip it with no diagnostic, and the overwrite guard would
+   * refuse a legitimate output (samchon/typia#2269).
+   *
+   * A filesystem that reports no inode at all keeps the canonical path
+   * fallback, which is the only identity available there.
+   *
+   * @param stat Stats read with `{ bigint: true }`.
+   * @param realpath Canonical path of the same object.
+   * @returns Key that is equal for two paths only when they are one object.
+   */
+  export function identityKey(
+    stat: Pick<fs.BigIntStats, "dev" | "ino">,
+    realpath: string,
+  ): string {
+    // `BigInt(0)` rather than `0n`: this package compiles at ES2016, where a
+    // BigInt literal is a syntax error, while the constructor and the `bigint`
+    // type are fine.
+    return stat.ino === BigInt(0)
+      ? `path:${path.normalize(realpath)}`
+      : `inode:${stat.dev}:${stat.ino}`;
+  }
+
   function alternateCase(name: string): string | undefined {
     let changed: boolean = false;
     let output: string = "";

package/src/executable/TypiaGenerateWizard.ts

@@ -453,7 +453,7 @@ export namespace TypiaGenerateWizard {
     for (const entry of entries) {
       inputs.add(
         fileIdentityKey(
-          await fs.promises.stat(entry.file),
+          await fs.promises.stat(entry.file, { bigint: true }),
           await fs.promises.realpath(entry.file),
         ),
       );
@@ -461,9 +461,9 @@ export namespace TypiaGenerateWizard {
     }
 
     for (const entry of files.values()) {
-      let stat: fs.Stats;
+      let stat: fs.BigIntStats;
       try {
-        stat = await fs.promises.lstat(entry.target);
+        stat = await fs.promises.lstat(entry.target, { bigint: true });
       } catch (exp) {
         if (isMissingFileError(exp)) {
           continue;
@@ -486,7 +486,7 @@ export namespace TypiaGenerateWizard {
           `Error on TypiaGenerateWizard.generate(): output file would overwrite input file through a physical file alias: ${entry.target}`,
         );
       }
-      if (stat.nlink > 1) {
+      if (stat.nlink > BigInt(1)) {
         throw new URIError(
           `Error on TypiaGenerateWizard.generate(): output file has multiple hard links: ${entry.target}`,
         );
@@ -874,7 +874,9 @@ export namespace TypiaGenerateWizard {
       real: currentReal,
     });
 
-    const currentStat: fs.Stats = await fs.promises.stat(props.from);
+    const currentStat: fs.BigIntStats = await fs.promises.stat(props.from, {
+      bigint: true,
+    });
     const directoryIdentity: string = fileIdentityKey(currentStat, currentReal);
     if (props.visitedDirectories.has(directoryIdentity)) {
       const lexicalStat: fs.Stats = await fs.promises.lstat(props.from);
@@ -907,14 +909,16 @@ export namespace TypiaGenerateWizard {
     entries.sort((x, y) => {
       const linkOrder: number =
         Number(x.stat.isSymbolicLink()) - Number(y.stat.isSymbolicLink());
-      return linkOrder !== 0 ? linkOrder : x.name.localeCompare(y.name);
+      return linkOrder !== 0
+        ? linkOrder
+        : Buffer.compare(Buffer.from(x.name), Buffer.from(y.name));
     });
 
     for (const entry of entries) {
-      let stat: fs.Stats;
+      let stat: fs.BigIntStats;
       let real: string;
       try {
-        stat = await fs.promises.stat(entry.file);
+        stat = await fs.promises.stat(entry.file, { bigint: true });
         real = await fs.promises.realpath(entry.file);
       } catch (error) {
         throw new URIError(
@@ -1086,10 +1090,12 @@ export namespace TypiaGenerateWizard {
     );
   }
 
-  function fileIdentityKey(stat: fs.Stats, realpath: string): string {
-    return stat.ino === 0
-      ? `path:${path.normalize(realpath)}`
-      : `inode:${stat.dev}:${stat.ino}`;
+  /**
+   * Delegates to {@link FileSystemIdentity.identityKey}, which owns the rule and
+   * carries the reasoning for reading the identity as a `bigint`.
+   */
+  function fileIdentityKey(stat: fs.BigIntStats, realpath: string): string {
+    return FileSystemIdentity.identityKey(stat, realpath);
   }
 
   function formatDiagnostics(diagnostics: ITtscCompilerDiagnostic[]): string {

package/src/internal/_ProtobufReader.ts

@@ -110,15 +110,19 @@ export class _ProtobufReader {
    * Advance by exactly one varint, which carries no length prefix.
    *
    * A varint terminates at its first byte without the continuation bit, and may
-   * occupy no more than {@link VARINT_MAX_BYTES}. Reading past that limit would
-   * accept a varint that `varint32` and `varint64` could not, making the limit
-   * depend on which method happens to consume the value.
+   * occupy no more than {@link VARINT_MAX_BYTES}. Its tenth byte is bounded
+   * twice over, by {@link lastVarintByte}: it may neither continue into an
+   * eleventh byte nor carry payload above bit 63. Skipping is where that is
+   * easiest to get wrong, because this path discards the bytes it reads and so
+   * never notices a value it could not have represented. Relaxing either bound
+   * here would accept a varint that `varint32` and `varint64` reject, making
+   * the limit depend on which method happens to consume the value.
    */
   public skipVarint(): void {
     this.atomic(() => {
-      for (let i: number = 0; i < VARINT_MAX_BYTES; ++i)
+      for (let i: number = 1; i < VARINT_MAX_BYTES; ++i)
         if ((this.u8() & 0x80) === 0) return;
-      throw error(`varint exceeds ${VARINT_MAX_BYTES} bytes.`);
+      this.lastVarintByte();
     });
   }
 
@@ -172,8 +176,7 @@ export class _ProtobufReader {
     if (this.u8() < 0x80) return value;
     if (this.u8() < 0x80) return value;
     if (this.u8() < 0x80) return value;
-    if (this.u8() < 0x80) return value;
-
+    this.lastVarintByte();
     return value;
   }
 
@@ -208,10 +211,28 @@ export class _ProtobufReader {
     value |= ((loaded = this.u8n()) & BigInt(0x7f)) << BigInt(56);
     if (loaded < BigInt(0x80)) return value;
 
-    value |= (this.u8n() & BigInt(0x01)) << BigInt(63);
+    value |= BigInt(this.lastVarintByte()) << BigInt(63);
     return BigInt.asUintN(64, value);
   }
 
+  /**
+   * Read the only byte whose varint payload is limited to bit 63.
+   *
+   * Two distinct faults meet on this byte, and each is named for what it is. A
+   * continuation bit means the varint would occupy an eleventh byte, which no
+   * 64-bit value can reach. Any other payload bit means the varint terminates
+   * within its ten bytes but carries a value bit above 63. Reporting the second
+   * as a length fault would tell the caller something untrue about a payload
+   * that is exactly ten bytes long.
+   */
+  private lastVarintByte(): number {
+    const loaded: number = this.u8();
+    if ((loaded & 0x80) !== 0)
+      throw error(`varint exceeds ${VARINT_MAX_BYTES} bytes.`);
+    if (loaded > 0x01) throw error(`varint exceeds ${VARINT_MAX_BITS} bits.`);
+    return loaded;
+  }
+
   private u8(): number {
     return this.view.getUint8(this.take(1));
   }
@@ -262,12 +283,20 @@ const error = (message: string): Error =>
 /**
  * The most bytes a varint may occupy: a 64-bit value in seven-bit groups.
  *
- * `varint32` and `varint64` hold this same limit structurally, by reading no
- * further than their tenth byte. This constant is what a loop-driven consumer
- * holds it by.
+ * Every path reads no further than its tenth byte and accepts only bit 63 from
+ * that byte. This constant keeps the loop-driven skip path on the same limit.
  */
 const VARINT_MAX_BYTES = 10;
 
+/**
+ * The widest value a varint may carry: the 64-bit Protocol Buffer wire domain.
+ *
+ * The tenth byte reaches only bit 63, so a payload bit above it belongs to no
+ * representable value. This names the overflow fault apart from the length
+ * one.
+ */
+const VARINT_MAX_BITS = 64;
+
 const utf8 = new Singleton(
   () => new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }),
 );