typia 13.3.0 → 14.0.0

package/native/cmd/ttsc-typia/transform_helpers_test.go

@@ -131,6 +131,7 @@ func ttscTypiaTestWriteCommonRuntimeStubs(t *testing.T, runtimeDir string) {
     "assert-guard-stub.cjs":            ttscTypiaTestAssertGuardStub,
     "functional-error-stub.cjs":        ttscTypiaTestFunctionalErrorStub,
     "access-expression-stub.cjs":       ttscTypiaTestAccessExpressionStub,
+    "string-length-stub.cjs":           ttscTypiaTestStringLengthStub,
     "notation-stub.cjs":                ttscTypiaTestNotationStub,
     "json-stringify-array-stub.cjs":    ttscTypiaTestJsonStringifyArrayStub,
     "json-stringify-property-stub.cjs": ttscTypiaTestJsonStringifyPropertyStub,
@@ -153,6 +154,7 @@ func ttscTypiaTestRewriteCommonJS(t *testing.T, js string) string {
   runtimeJS = strings.ReplaceAll(runtimeJS, `require("typia/lib/internal/_assertGuard")`, `require("./assert-guard-stub.cjs")`)
   runtimeJS = strings.ReplaceAll(runtimeJS, `require("typia/lib/internal/_functionalTypeGuardErrorFactory")`, `require("./functional-error-stub.cjs")`)
   runtimeJS = strings.ReplaceAll(runtimeJS, `require("typia/lib/internal/_accessExpressionAsString")`, `require("./access-expression-stub.cjs")`)
+  runtimeJS = strings.ReplaceAll(runtimeJS, `require("typia/lib/internal/_stringLength")`, `require("./string-length-stub.cjs")`)
   runtimeJS = strings.ReplaceAll(runtimeJS, `require("typia/lib/internal/_jsonStringifyArray")`, `require("./json-stringify-array-stub.cjs")`)
   runtimeJS = strings.ReplaceAll(runtimeJS, `require("typia/lib/internal/_jsonStringifyProperty")`, `require("./json-stringify-property-stub.cjs")`)
   runtimeJS = strings.ReplaceAll(runtimeJS, `require("typia/lib/internal/_jsonStringifyElement")`, `require("./json-stringify-element-stub.cjs")`)
@@ -290,6 +292,16 @@ const ttscTypiaTestRandomStringStub = `module.exports._randomString = (props) =>
 };
 `
 
+// A double for packages/typia/src/internal/_stringLength.ts: the string
+// iterator walks code points, so a surrogate pair counts once, which is what
+// `MinLength` and `MaxLength` now mean.
+const ttscTypiaTestStringLengthStub = `module.exports._stringLength = (value) => {
+  let count = 0;
+  for (const _ of value) ++count;
+  return count;
+};
+`
+
 const ttscTypiaTestAccessExpressionStub = `const reserved = new Set([
   "break",
   "case",

package/native/core/factories/MetadataCommentTagFactory.go

@@ -196,6 +196,34 @@ func (metadataCommentTagFactoryNamespace) Get(props struct {
   return output
 }
 
+// metadataCommentTagFactory_PARSER maps a JSDoc tag name to the tag records it
+// produces. Each record's `Validate` is the runtime check the transform splices
+// into the emitted validator, and it must spell the same check as the matching
+// declaration in `packages/interface/src/tags` -- the two are one constraint.
+//
+// # WHEN A RECORD MAY NAME A RUNTIME HELPER
+//
+// A `Validate` may write `$importInternal("x")`, here or in the matching
+// declaration, only under the rule below.
+//
+// That call makes the emitted validator `require("typia/lib/internal/_x")`. The
+// type-tag half of each constraint is declared in `@typia/interface`, which
+// `typia` depends on through a caret range, and a caret only floats upward. So
+// inside one major an older `typia` installs a newer `@typia/interface` and
+// emits an import its own runtime never published; that is #2330, and it is why
+// #2336 and #2339 reverted these very templates to inline expressions.
+//
+// The rule: a template may name only a helper that every `typia` inside the
+// caret range already ships. `isTypeInt8` and its siblings satisfy it --
+// `@typia/interface` 13.0.0 named them and `typia` 13.0.0 shipped them. The
+// four this file and `Type.ts` now name do not: `_stringLength`, `_isMultipleOf`
+// (both first published in 13.1.19), `_isTypeInt64Bigint`, and
+// `_isTypeUint64Bigint` (13.1.19). They are safe only because the release that
+// carries them is a major, where the caret cannot reach a `typia` that predates
+// them. A minor or patch release of this tree reopens #2330.
+//
+// Nothing here can enforce that; the release version is the maintainer's, and a
+// campaign pull request never assigns one. This comment is the record.
 var metadataCommentTagFactory_PARSER = map[string]metadataCommentTagFactory_parser{
   "items": func(props struct {
     Report func(msg string) any
@@ -268,7 +296,13 @@ var metadataCommentTagFactory_PARSER = map[string]metadataCommentTagFactory_pars
     Report func(msg string) any
     Value  string
   }) metadataCommentTagFactory_TagRecord {
-    return metadataCommentTagFactory_numeric(props, "MultipleOf", "multipleOf", "$input % "+props.Value+" === 0", "$input % "+props.Value+"n === 0n")
+    // `@multipleOf` and `MultipleOf<N>` are two spellings of one constraint, so
+    // the number arm divides exact decimals through the same helper the type tag
+    // names. `%` would divide the binary doubles that are actually stored, which
+    // answers a different question than the `multipleOf` keyword this tag emits.
+    // The bigint arm needs no helper: a bigint remainder is already exact.
+    // `_isMultipleOf` first shipped in 13.1.19; see the doc comment above.
+    return metadataCommentTagFactory_numeric(props, "MultipleOf", "multipleOf", "$importInternal(\"_isMultipleOf\")($input, "+props.Value+")", "$input % "+props.Value+"n === 0n")
   },
   "format": func(props struct {
     Report func(msg string) any
@@ -291,9 +325,16 @@ var metadataCommentTagFactory_PARSER = map[string]metadataCommentTagFactory_pars
     Value  string
   }) metadataCommentTagFactory_TagRecord {
     value := metadataCommentTagFactory_parse_number(props)
+    // `@length`, `@minLength`, and `@maxLength` measure through the same helper
+    // `MinLength<N>` and `MaxLength<N>` name, because the JSDoc spelling and the
+    // type-tag spelling of one constraint must never mean different things.
+    // `$input.length` counts UTF-16 code units, while the `minLength` and
+    // `maxLength` keywords these tags emit count characters, so one astral
+    // character would measure 2 against a schema that measures 1.
+    // `_stringLength` first shipped in 13.1.19; see the doc comment above.
     return metadataCommentTagFactory_TagRecord{"string": {
-      {Name: "MinLength<" + props.Value + ">", Target: "string", Kind: "minLength", Value: value, Validate: props.Value + " <= $input.length", Exclusive: metadataCommentTagFactory_exclusive("minLength"), Schema: map[string]any{"minLength": value}},
-      {Name: "MaxLength<" + props.Value + ">", Target: "string", Kind: "maxLength", Value: value, Validate: "$input.length <= " + props.Value, Exclusive: metadataCommentTagFactory_exclusive("maxLength"), Schema: map[string]any{"maxLength": value}},
+      {Name: "MinLength<" + props.Value + ">", Target: "string", Kind: "minLength", Value: value, Validate: props.Value + " <= $importInternal(\"_stringLength\")($input)", Exclusive: metadataCommentTagFactory_exclusive("minLength"), Schema: map[string]any{"minLength": value}},
+      {Name: "MaxLength<" + props.Value + ">", Target: "string", Kind: "maxLength", Value: value, Validate: "$importInternal(\"_stringLength\")($input) <= " + props.Value, Exclusive: metadataCommentTagFactory_exclusive("maxLength"), Schema: map[string]any{"maxLength": value}},
     }}
   },
   "minLength": func(props struct {
@@ -301,14 +342,14 @@ var metadataCommentTagFactory_PARSER = map[string]metadataCommentTagFactory_pars
     Value  string
   }) metadataCommentTagFactory_TagRecord {
     value := metadataCommentTagFactory_parse_number(props)
-    return metadataCommentTagFactory_TagRecord{"string": {{Name: "MinLength<" + props.Value + ">", Target: "string", Kind: "minLength", Value: value, Validate: props.Value + " <= $input.length", Exclusive: metadataCommentTagFactory_exclusive("minLength"), Schema: map[string]any{"minLength": value}}}}
+    return metadataCommentTagFactory_TagRecord{"string": {{Name: "MinLength<" + props.Value + ">", Target: "string", Kind: "minLength", Value: value, Validate: props.Value + " <= $importInternal(\"_stringLength\")($input)", Exclusive: metadataCommentTagFactory_exclusive("minLength"), Schema: map[string]any{"minLength": value}}}}
   },
   "maxLength": func(props struct {
     Report func(msg string) any
     Value  string
   }) metadataCommentTagFactory_TagRecord {
     value := metadataCommentTagFactory_parse_number(props)
-    return metadataCommentTagFactory_TagRecord{"string": {{Name: "MaxLength<" + props.Value + ">", Target: "string", Kind: "maxLength", Value: value, Validate: "$input.length <= " + props.Value, Exclusive: metadataCommentTagFactory_exclusive("maxLength"), Schema: map[string]any{"maxLength": value}}}}
+    return metadataCommentTagFactory_TagRecord{"string": {{Name: "MaxLength<" + props.Value + ">", Target: "string", Kind: "maxLength", Value: value, Validate: "$importInternal(\"_stringLength\")($input) <= " + props.Value, Exclusive: metadataCommentTagFactory_exclusive("maxLength"), Schema: map[string]any{"maxLength": value}}}}
   },
 }
 
@@ -407,28 +448,23 @@ func metadataCommentTagFactory_parse_type(props struct {
     "number": {{Name: "Type<" + strconv.Quote(value) + ">", Target: "number", Kind: "type", Value: value, Validate: validate, Exclusive: metadataCommentTagFactory_exclusive("type"), Schema: numberSchema}},
   }
   if value == "int64" || value == "uint64" {
-    // Both checks stay inline, spelled exactly as `Type<"int64">` and
-    // `Type<"uint64">` declare them, because `@type int64` and
-    // `bigint & Type<"int64">` are two spellings of one constraint.
+    // `@type int64` and `bigint & Type<"int64">` are two spellings of one
+    // constraint, so both delegate to the helper that holds the exact inclusive
+    // bound. The bigint form used to emit `true` for int64 and a lower bound
+    // only for uint64, which certified any magnitude at all -- and
+    // `typia.protobuf.encode` then truncated the value to 64 bits, so a
+    // certified value came back different.
     //
-    // That declaration must not name a runtime helper the way the `number` arms
-    // above do. A `$importInternal(...)` in a tag template makes the emitted
-    // validator import a `typia/lib/internal/*` module, and the declaration
-    // lives in `@typia/interface`, which `typia` depends on through a caret
-    // range that only floats upward -- so an older `typia` installs a newer
-    // `@typia/interface` and emits an import its own runtime never shipped
-    // (#2330). `isTypeInt64` and `isTypeUint64` are safe there because
-    // `@typia/interface` 13.0.0 already named them and `typia` 13.0.0 already
-    // shipped them; a helper introduced later is not, and inside one major
-    // there is no range that prevents the pairing.
+    // The bound has to live in a helper rather than an inline literal here
+    // because it is only exact as a string: `BigInt(9223372036854775807)` rounds
+    // its `number` literal to 2**63 before BigInt ever parses it.
     //
-    // The bound this leaves unenforced is real: int64 accepts any magnitude and
-    // uint64 only rejects negatives. #2338 owns restoring it, and only a major
-    // can carry it -- an inline exact comparison would name no helper, but
-    // tightening an accepted range rejects data that passes today.
-    bigintValidate := "BigInt(0) <= $input"
+    // See the `metadataCommentTagFactory_PARSER` doc comment: naming a helper
+    // here is safe only under a major bump, and `_isTypeInt64Bigint` /
+    // `_isTypeUint64Bigint` first shipped in 13.1.19.
+    bigintValidate := "$importInternal(\"isTypeUint64Bigint\")($input)"
     if value == "int64" {
-      bigintValidate = "true"
+      bigintValidate = "$importInternal(\"isTypeInt64Bigint\")($input)"
     }
     record["bigint"] = []schemametadata.IMetadataTypeTag{
       {Name: "Type<" + strconv.Quote(value) + ">", Target: "bigint", Kind: "type", Value: value, Validate: bigintValidate, Exclusive: metadataCommentTagFactory_exclusive("type"), Schema: bigintSchema},
@@ -452,7 +488,7 @@ func metadataCommentTagFactory_numeric(props struct {
     "number": {{Name: name + "<" + props.Value + ">", Target: "number", Kind: kind, Value: number, Validate: numberValidate, Exclusive: exclusive, Schema: map[string]any{kind: number}}},
   }
   if integer != nil {
-    record["bigint"] = []schemametadata.IMetadataTypeTag{{Name: name + "<" + props.Value + "n>", Target: "bigint", Kind: kind, Value: int64(*integer), Validate: bigintValidate, Exclusive: exclusive, Schema: map[string]any{kind: number}}}
+    record["bigint"] = []schemametadata.IMetadataTypeTag{{Name: name + "<" + props.Value + "n>", Target: "bigint", Kind: kind, Value: *integer, Validate: bigintValidate, Exclusive: exclusive, Schema: map[string]any{kind: number}}}
   }
   return record
 }
@@ -473,7 +509,7 @@ func metadataCommentTagFactory_parse_integer(props struct {
   Report   func(msg string) any
   Unsigned bool
   Value    string
-}) *int {
+}) *int64 {
   parsedAny := metadataCommentTagFactory_parse_number(struct {
     Report func(msg string) any
     Value  string
@@ -490,10 +526,43 @@ func metadataCommentTagFactory_parse_integer(props struct {
     props.Report("invalid unsigned integer")
     return nil
   }
-  value := int(parsed)
+  // A float64 outside the destination range converts by an
+  // implementation-defined rule, not by wrapping: on amd64 both `1e19` and
+  // `-1e19` become -9223372036854775808, so a magnitude and its negation
+  // collapse to the same wrong number. Reject instead, because a tag whose value
+  // cannot be carried is a tag whose meaning is already lost.
+  if parsed < metadataCommentTagFactory_INT64_MINIMUM || parsed >= metadataCommentTagFactory_INT64_EXCLUSIVE_MAXIMUM {
+    props.Report("integer out of range")
+    return nil
+  }
+  value := int64(parsed)
   return &value
 }
 
+// The int64 range as float64 bounds.
+//
+// int64 rather than int, because `int` is 32 bits on the 32-bit platforms ttsc
+// publishes a binary for (`@ttsc/linux-arm`). Bounding by `int` would make the
+// same `@minimum 3000000000` on a `bigint` compile on x64 and either be rejected
+// or silently converted out of range on arm, and the value is already widened to
+// int64 at its only numeric use. Bounding by int64 is what the tag means on
+// every platform.
+//
+// The maximum is exclusive and spelled 2**63 rather than math.MaxInt64, because
+// the inclusive form does not survive the comparison. An untyped constant
+// 9223372036854775807.0 rounds to 2**63 once it meets a float64 operand, so
+// `parsed > max` compares 2**63 against 2**63 and lets the one value through
+// that int64 cannot hold. A strict `>=` against 2**63 is exact instead: no
+// float64 lies between 2**63 - 1024 and 2**63, so rejecting from 2**63 up
+// rejects exactly the magnitudes int64 cannot represent.
+//
+// The minimum needs no such care -- -2**63 is math.MinInt64 and is exactly
+// representable as a float64.
+const (
+  metadataCommentTagFactory_INT64_MINIMUM           = -9223372036854775808.0
+  metadataCommentTagFactory_INT64_EXCLUSIVE_MAXIMUM = 9223372036854775808.0
+)
+
 func metadataCommentTagFactory_includes(values []string, target string) bool {
   for _, value := range values {
     if value == target {

package/native/core/factories/metadata_comment_tag_factory_coverage_test.go

@@ -124,8 +124,8 @@ func TestMetadataCommentTagFactoryCoverage(t *testing.T) {
   if len(reports) != decimalReportCount || len(decimal["number"]) != 1 || len(decimal["bigint"]) != 0 {
     t.Fatalf("decimal multipleOf must remain a number-only JSDoc tag: %#v, reports=%#v", decimal, reports[decimalReportCount:])
   }
-  if decimal["number"][0].Validate != "$input % 0.01 === 0" {
-    t.Fatalf("decimal multipleOf must spell the same remainder check the MultipleOf type tag declares: %s", decimal["number"][0].Validate)
+  if decimal["number"][0].Validate != "$importInternal(\"_isMultipleOf\")($input, 0.01)" {
+    t.Fatalf("decimal multipleOf must use the shared exact helper: %s", decimal["number"][0].Validate)
   }
   invalidBefore := len(reports)
   _ = metadataCommentTagFactory_parse_number(struct {

package/native/core/factories/metadata_comment_tag_factory_rejects_out_of_range_integer_test.go

@@ -0,0 +1,124 @@
+package factories
+
+import "testing"
+
+// TestMetadataCommentTagFactoryRejectsOutOfRangeInteger pins the boundary of the
+// float64-to-int conversion behind every numeric JSDoc tag.
+//
+// `metadataCommentTagFactory_parse_integer` used to end in a bare `int(parsed)`.
+// A float64 outside the destination range converts by an implementation-defined
+// rule rather than by wrapping, so on amd64 both `1e19` and `-1e19` became
+// -9223372036854775808 -- a magnitude and its negation collapsing to the same
+// wrong number, silently, inside `@minItems` and `@maxItems`.
+//
+// The destination is int64, not int. `int` is 32 bits on the 32-bit platforms
+// ttsc publishes a binary for (`@ttsc/linux-arm`), so bounding by `int` would
+// leave the same defect at 2**31 there while closing it at 2**63 on x64 -- and
+// would make `@minimum 3000000000` on a `bigint` mean one thing per platform.
+// Case 4 is what holds the boundary platform-independent.
+//
+// The guard has to be exclusive at 2**63 rather than inclusive at
+// math.MaxInt64. An untyped constant 9223372036854775807.0 rounds to 2**63 once
+// it meets a float64 operand, so an inclusive comparison lets exactly the one
+// value through that int64 cannot hold. This test is what keeps that distinction
+// from being "simplified" back.
+//
+//  1. Reject magnitudes at and beyond 2**63 in both directions.
+//  2. Accept the true minimum and the largest float64 below the maximum, and
+//     require the value carried through to be the value parsed.
+//  3. Keep the existing non-integer and unsigned diagnostics untouched.
+//  4. Require the accepted range to be int64's on every platform, not the
+//     compiling platform's `int`.
+func TestMetadataCommentTagFactoryRejectsOutOfRangeInteger(t *testing.T) {
+  parse := func(value string, unsigned bool) (*int64, []string) {
+    messages := []string{}
+    report := func(msg string) any {
+      messages = append(messages, msg)
+      return nil
+    }
+    return metadataCommentTagFactory_parse_integer(struct {
+      Report   func(msg string) any
+      Unsigned bool
+      Value    string
+    }{Report: report, Unsigned: unsigned, Value: value}), messages
+  }
+
+  //----
+  // 1. out of range, both directions
+  //----
+  for _, value := range []string{
+    "9223372036854775808",   // 2**63 exactly -- the value an inclusive guard let through
+    "10000000000000000000",  // 1e19
+    "-10000000000000000000", // -1e19, which collapsed to the same int as +1e19
+    "1e30",
+  } {
+    parsed, messages := parse(value, false)
+    if parsed != nil {
+      t.Fatalf("%s must be rejected, got %d", value, *parsed)
+    }
+    if len(messages) == 0 {
+      t.Fatalf("%s must be reported, not dropped silently", value)
+    }
+  }
+
+  //----
+  // 2. in range, carried through unchanged
+  //----
+  for _, tuple := range []struct {
+    value    string
+    expected int64
+  }{
+    {value: "0", expected: 0},
+    {value: "1", expected: 1},
+    {value: "-1", expected: -1},
+    {value: "-9223372036854775808", expected: -9223372036854775808}, // the true minimum
+    {value: "9223372036854774784", expected: 9223372036854774784},   // largest float64 below 2**63
+  } {
+    parsed, messages := parse(tuple.value, false)
+    if parsed == nil {
+      t.Fatalf("%s must be accepted, reports=%#v", tuple.value, messages)
+    }
+    if *parsed != tuple.expected {
+      t.Fatalf("%s must parse to %d, got %d", tuple.value, tuple.expected, *parsed)
+    }
+    if len(messages) != 0 {
+      t.Fatalf("%s must report nothing, got %#v", tuple.value, messages)
+    }
+  }
+
+  //----
+  // 3. the diagnostics that already existed
+  //----
+  if parsed, messages := parse("1.5", false); parsed != nil || len(messages) == 0 {
+    t.Fatalf("a non-integer must still be rejected: %#v %#v", parsed, messages)
+  }
+  if parsed, messages := parse("-1", true); parsed != nil || len(messages) == 0 {
+    t.Fatalf("a negative unsigned integer must still be rejected: %#v %#v", parsed, messages)
+  }
+
+  //----
+  // 4. the boundary is int64's on every platform, not the compiling one's int
+  //----
+  // These sit above int32 and below int64. A guard written against `int`
+  // accepts them here and converts them out of range on `@ttsc/linux-arm` --
+  // the same defect this test closes, moved to a platform the suite does not
+  // usually run on. `GOARCH=arm go vet ./core/factories/` is what executes this
+  // case for real; on a 64-bit host it is the declared type that carries it.
+  for _, tuple := range []struct {
+    value    string
+    expected int64
+  }{
+    {value: "2147483648", expected: 2147483648},   // 2**31
+    {value: "-2147483649", expected: -2147483649}, // -2**31 - 1
+    {value: "4294967296", expected: 4294967296},   // 2**32, past uint32 too
+    {value: "3000000000", expected: 3000000000},   // a plausible @minimum on a bigint
+  } {
+    parsed, messages := parse(tuple.value, false)
+    if parsed == nil {
+      t.Fatalf("%s is inside int64 and must be accepted on every platform, reports=%#v", tuple.value, messages)
+    }
+    if *parsed != tuple.expected {
+      t.Fatalf("%s must parse to %d, got %d", tuple.value, tuple.expected, *parsed)
+    }
+  }
+}

package/native/core/programmers/AssertProgrammer.go

@@ -65,13 +65,13 @@ func (assertProgrammerNamespace) Decompose(props AssertProgrammer_DecomposeProps
     Type:    props.Type,
     Name:    props.Name,
     Config: nativeinternal.CheckerProgrammer_IConfig{
-      Prefix:  "_a",
-      Path:    true,
-      Trace:   true,
-      Numeric: nativehelpers.OptionPredicator.Numeric(props.Context.Options),
-      Equals:  props.Config.Equals,
+      Prefix:        "_a",
+      Path:          true,
+      Trace:         true,
+      Numeric:       nativehelpers.OptionPredicator.Numeric(props.Context.Options),
+      Equals:        props.Config.Equals,
       ObjectParents: props.Config.Equals == false,
-      Atomist: assertProgrammer_atomist(props),
+      Atomist:       assertProgrammer_atomist(props),
       Combiner: assertProgrammer_combiner(struct {
         Config  AssertProgrammer_IConfig
         Context nativecontext.ITypiaContext
@@ -323,6 +323,20 @@ func assertProgrammer_assert_object(props assertProgrammer_assertObjectProps) *s
           Input:    input,
         })
       },
+      InvalidKey: func(input *shimast.Expression, expected string, description *shimast.Expression) *shimast.Node {
+        return assertProgrammer_create_guard_call(assertProgrammer_createGuardCallProps{
+          Context: props.Context,
+          Functor: props.Functor,
+          Path: assertProgrammer_binary(
+            f.NewIdentifier("_path"),
+            shimast.KindPlusToken,
+            f.NewCallExpression(assertProgrammer_internal(props.Context, "accessExpressionAsString"), nil, nil, f.NewNodeList([]*shimast.Node{f.NewIdentifier("key")}), shimast.NodeFlagsNone),
+            props.Context.Emit,
+          ),
+          Expected: expected,
+          Input:    input,
+        })
+      },
       Halt: func(expr *shimast.Expression) *shimast.Node {
         return assertProgrammer_or(
           assertProgrammer_equal(f.NewKeywordExpression(shimast.KindFalseKeyword), f.NewIdentifier("_exceptionable"), props.Context.Emit),

package/native/core/programmers/RandomProgrammer.go

@@ -546,6 +546,26 @@ func randomProgrammer_decode(props randomProgrammer_decodeProps) *shimast.Node {
   if len(expressions) == 1 {
     return expressions[0]
   }
+  if escape := randomProgrammer_recursion_escape(props); escape != nil {
+    return nativefactories.ExpressionFactory.Conditional(
+      f.NewBinaryExpression(
+        nil,
+        nativefactories.ExpressionFactory.Number(nativehelpers.RandomJoiner_RECURSION_CUTOFF, props.Context.Emit),
+        nil,
+        f.NewToken(shimast.KindGreaterThanEqualsToken),
+        f.NewIdentifier("_depth"),
+      ),
+      randomProgrammer_decode_pick(props, expressions),
+      escape,
+      props.Context.Emit,
+    )
+  }
+  return randomProgrammer_decode_pick(props, expressions)
+}
+
+// randomProgrammer_decode_pick draws one of the candidate expressions uniformly.
+func randomProgrammer_decode_pick(props randomProgrammer_decodeProps, expressions []*shimast.Node) *shimast.Node {
+  f := nativecontext.EmitFactoryOf(randomProgrammer_factory, props.Context.Emit)
   pickers := make([]*shimast.Node, 0, len(expressions))
   for _, expr := range expressions {
     value := expr
@@ -576,6 +596,50 @@ func randomProgrammer_decode(props randomProgrammer_decodeProps) *shimast.Node {
   )
 }
 
+// randomProgrammer_recursion_escape reports the terminating candidate a
+// recursive leaf must take once the depth cutoff is reached, or nil when the
+// leaf has none to force.
+//
+// A recursive array already stops at the cutoff -- RandomJoiner emits
+// `CUTOFF >= _depth ? … : []` around it. The nullable and optional escapes had
+// no such guard: `null` and `undefined` were simply two more candidates in the
+// uniform `_randomPick`, so the depth of a `self?: T` or `self: T | null` chain
+// was geometric with no bound at all. Measured before this guard, 20,000 draws
+// of `{ value: string; self?: Self }` reached depth 16, and exceeded 8 on 44 of
+// them -- which is why a suite asserting a depth bound failed at random.
+//
+// The guard needs `_depth` in scope, so it applies only inside a generated
+// function (`Explore.Function`) reached recursively (`Explore.Recursive`), and
+// only where the leaf actually recurses through an object or tuple. A leaf that
+// is merely nullable, with no recursive candidate, keeps drawing uniformly.
+func randomProgrammer_recursion_escape(props randomProgrammer_decodeProps) *shimast.Node {
+  if props.Explore.Function == false || props.Explore.Recursive == false {
+    return nil
+  }
+  recursive := false
+  for _, object := range props.Metadata.Objects {
+    if object.Type != nil && object.Type.Recursive {
+      recursive = true
+    }
+  }
+  for _, tuple := range props.Metadata.Tuples {
+    if tuple.Type != nil && tuple.Type.Recursive {
+      recursive = true
+    }
+  }
+  if recursive == false {
+    return nil
+  }
+  f := nativecontext.EmitFactoryOf(randomProgrammer_factory, props.Context.Emit)
+  if props.Metadata.Nullable {
+    return f.NewKeywordExpression(shimast.KindNullKeyword)
+  }
+  if props.Metadata.IsRequired() == false {
+    return f.NewIdentifier("undefined")
+  }
+  return nil
+}
+
 func randomProgrammer_decode_atomic(props randomProgrammer_decodeAtomicProps) []*shimast.Node {
   var schemaList []nativeiterate.JsonSchema
   if props.Atomic.Type == "boolean" {
@@ -1441,12 +1505,20 @@ func randomProgrammer_is_typed_array(name string) bool {
 // copy of the 64-bit bound that is deliberately inexact. They become `minimum` and
 // `maximum` comment tags on a number-typed JSON schema, and `number` cannot
 // represent 2**63 - 1 or 2**64 - 1 -- both arrive rounded up to the next power of
-// two. That costs nothing here: the generator only picks a value from the range,
-// and the TypedArray constructor wraps whatever it is handed. On the `number`
-// path validation owns exactness instead, in _isTypeInt64 and _isTypeUint64. The
-// `bigint` path owns none: Type<"int64"> declares no check and Type<"uint64">
-// only a lower bound, so that neither declaration names a runtime helper an
-// older `typia` cannot resolve (#2330). #2338 owns restoring the bound.
+// two. That costs nothing here, and not because the generator is careless: it
+// draws Math.floor(Math.random() * (maximum - minimum + 1)) + minimum, and that
+// span is 2**64 either way, where consecutive doubles are 2048 apart. So the
+// largest draw is 2**63 - 2048 for int64 and 2**64 - 2048 for uint64, both
+// inside the width. (Nearer the int64 maximum itself the spacing is 1024, which
+// is why the largest double below 2**63 is 2**63 - 1024; the span is what bounds
+// the draw.) The TypedArray constructor then wraps whatever it is handed anyway.
+//
+// Only the `bigint` path is exact, in _isTypeInt64Bigint and _isTypeUint64Bigint,
+// which take the true inclusive bound through a BigInt string a `number` literal
+// here could not spell. _isTypeInt64 and _isTypeUint64 on the `number` path
+// carry the same rounding this table does: their maxima are written 2**63 - 1
+// and 2**64 - 1, which are the powers of two as doubles, so each accepts one
+// value above its width -- the only float form that maximum has.
 func randomProgrammer_typed_array_range(name string) (string, string, string) {
   switch name {
   case "Uint8Array", "Uint8ClampedArray":

package/native/core/programmers/ValidateProgrammer.go

@@ -55,13 +55,13 @@ func (validateProgrammerNamespace) Decompose(props ValidateProgrammer_DecomposeP
     Type:    props.Type,
     Name:    props.Name,
     Config: nativeinternal.CheckerProgrammer_IConfig{
-      Prefix:  "_v",
-      Path:    true,
-      Trace:   true,
-      Numeric: nativehelpers.OptionPredicator.Numeric(props.Context.Options),
-      Equals:  props.Config.Equals,
+      Prefix:        "_v",
+      Path:          true,
+      Trace:         true,
+      Numeric:       nativehelpers.OptionPredicator.Numeric(props.Context.Options),
+      Equals:        props.Config.Equals,
       ObjectParents: props.Config.Equals == false,
-      Atomist: validateProgrammer_atomist(props),
+      Atomist:       validateProgrammer_atomist(props),
       Combiner: validateProgrammer_combine(struct {
         Config  ValidateProgrammer_IConfig
         Context nativecontext.ITypiaContext
@@ -312,6 +312,21 @@ func validateProgrammer_validate_object(props validateProgrammer_validateObjectP
           Emit:        props.Context.Emit,
         })
       },
+      InvalidKey: func(input *shimast.Expression, expected string, description *shimast.Expression) *shimast.Node {
+        return validateProgrammer_create_report_call(validateProgrammer_createReportCallProps{
+          Path: validateProgrammer_binary(
+            f.NewIdentifier("_path"),
+            shimast.KindPlusToken,
+            f.NewCallExpression(validateProgrammer_internal(props.Context, "accessExpressionAsString"), nil, nil, f.NewNodeList([]*shimast.Node{f.NewIdentifier("key")}), shimast.NodeFlagsNone),
+            props.Context.Emit,
+          ),
+          Expected:    expected,
+          Value:       input,
+          Description: description,
+          Functor:     props.Functor,
+          Emit:        props.Context.Emit,
+        })
+      },
       Halt: func(expr *shimast.Expression) *shimast.Node {
         return validateProgrammer_or(validateProgrammer_equal(f.NewKeywordExpression(shimast.KindFalseKeyword), f.NewIdentifier("_exceptionable"), props.Context.Emit), expr, props.Context.Emit)
       },

package/native/core/programmers/helpers/RandomJoiner.go

@@ -15,6 +15,13 @@ type randomJoinerNamespace struct{}
 
 var RandomJoiner = randomJoinerNamespace{}
 
+// RandomJoiner_RECURSION_CUTOFF is the `_depth` past which a recursive draw
+// stops descending: a recursive array empties, and a recursive leaf with a
+// nullable or optional escape takes it. One constant because one number decides
+// both -- a recursive value that stopped at two different depths depending on
+// which escape it happened to own would make a depth bound unstatable.
+const RandomJoiner_RECURSION_CUTOFF = 5
+
 type RandomJoiner_Decoder func(metadata *nativemetadata.MetadataSchema) *shimast.Node
 
 type RandomJoiner_ArrayProps struct {
@@ -126,7 +133,7 @@ func (randomJoinerNamespace) Array(props RandomJoiner_ArrayProps) *shimast.Node
   return nativefactories.ExpressionFactory.Conditional(
     f.NewBinaryExpression(
       nil,
-      nativefactories.ExpressionFactory.Number(5, props.Emit),
+      nativefactories.ExpressionFactory.Number(RandomJoiner_RECURSION_CUTOFF, props.Emit),
       nil,
       f.NewToken(shimast.KindGreaterThanEqualsToken),
       f.NewIdentifier("_depth"),