scientific-computing-system 2.2.15__tar.gz → 2.2.17__tar.gz

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/.github/workflows/codeql.yml

@@ -45,13 +45,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
       - name: Autobuild
-        uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           category: "/language:${{ matrix.language }}"

scientific_computing_system-2.2.17/.github/workflows/fuzz.yml

@@ -0,0 +1,38 @@
+name: Fuzz
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - "src/cds/**"
+      - "tests/fuzz/**"
+      - "pyproject.toml"
+      - ".github/workflows/fuzz.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-scientific-computing-system
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Atheris
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.12"
+      - name: Install Atheris
+        run: python -m pip install atheris==3.1.0
+      - name: Install scientific-computing-system
+        run: python -m pip install -e .
+      - name: Fuzz the BPE merge validator
+        run: python tests/fuzz/fuzz_bpe_merge.py -max_total_time=60 -rss_limit_mb=2048 -print_final_stats=1

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/.github/workflows/npm-publish.yml

@@ -109,15 +109,46 @@ jobs:
           RUN_ID: ${{ github.event.workflow_run.id }}
         run: |
           set -euo pipefail
+          # The trigger is the Release workflow, which normally is itself a
+          # workflow_run consumer: its event is `workflow_run`. The Release
+          # recovery path is dispatched manually and never publishes to PyPI,
+          # so a `workflow_dispatch` run is accepted too; its publish job is
+          # declared workflow_run-only, so it cannot set published=true.
+          # Release already verified its upstream CI run through the Actions
+          # API, so trust the head SHA only after proving the run belongs to
+          # this repository's release.yml on the default branch.
           data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
-            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
-          IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
+            --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name, .path] | @tsv')"
+          IFS=$'\t' read -r sha event branch conclusion repo path <<<"${data}"
           echo "head_sha=${sha}" >> "$GITHUB_OUTPUT"
-          if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
-             [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
-            echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+          case "${event}" in
+            workflow_run|workflow_dispatch) ;;
+            *)
+              echo "::error::Run ${RUN_ID} has unsupported event ${event}."
+              exit 1
+              ;;
+          esac
+          if [ "${path}" != ".github/workflows/release.yml" ] || \
+             [ "${branch}" != "main" ] || \
+             [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
+            echo "::error::Run ${RUN_ID} is not a Release run on ${GITHUB_REPOSITORY} main."
             exit 1
           fi
+          # A Release run whose jobs all skip (the version is already released)
+          # concludes `skipped`. That is an ordinary push, not a release, so the
+          # npm job must skip too. A failed or cancelled release stays loud.
+          case "${conclusion}" in
+            success|skipped) ;;
+            *)
+              echo "::error::Release run ${RUN_ID} concluded ${conclusion}."
+              exit 1
+              ;;
+          esac
+          if [ "${conclusion}" != "success" ]; then
+            echo "Release run was ${conclusion}; no release was published."
+            echo "published=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           publish_conclusion="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/jobs?per_page=100" \
             --jq '[.jobs[] | select(.name == "Build + verify + publish to PyPI + metadata-only GitHub Release") | .conclusion] | first // "missing"')"
           echo "Release publish job: ${publish_conclusion}"

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/.github/workflows/pypi-release-policy.yml

@@ -49,12 +49,28 @@ jobs:
         run: |
           set -euo pipefail
           if [ "${EVENT_NAME}" = "workflow_run" ]; then
+            # This workflow triggers on the Release workflow, which normally is
+            # itself a workflow_run consumer, so the triggering run's event is
+            # `workflow_run`. The Release recovery path is dispatched manually
+            # and never publishes to PyPI, so a `workflow_dispatch` run is
+            # accepted too. The Release gate already verified its own upstream
+            # CI run through the Actions API; here we only need to prove the
+            # trigger came from this repository's Release workflow on the
+            # default branch before trusting its head SHA.
             data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
-              --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name] | @tsv')"
-            IFS=$'\t' read -r sha event branch conclusion repo <<<"${data}"
-            if [ "${event}" != "push" ] || [ "${branch}" != "main" ] || \
+              --jq '[.head_sha, .event, .head_branch, .conclusion, .repository.full_name, .path] | @tsv')"
+            IFS=$'\t' read -r sha event branch conclusion repo path <<<"${data}"
+            case "${event}" in
+              workflow_run|workflow_dispatch) ;;
+              *)
+                echo "::error::Run ${RUN_ID} has unsupported event ${event}."
+                exit 1
+                ;;
+            esac
+            if [ "${path}" != ".github/workflows/release.yml" ] || \
+               [ "${branch}" != "main" ] || \
                [ "${conclusion}" != "success" ] || [ "${repo}" != "${GITHUB_REPOSITORY}" ]; then
-              echo "::error::Run ${RUN_ID} is not a successful push on ${GITHUB_REPOSITORY} main."
+              echo "::error::Run ${RUN_ID} is not a successful Release run on ${GITHUB_REPOSITORY} main."
               exit 1
             fi
           else

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/.github/workflows/release.yml

@@ -420,7 +420,7 @@ jobs:
 
       - name: Publish to PyPI (Trusted Publishing)
         if: steps.pypi_state.outputs.already_published != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
 
       - name: Create or verify release tag after successful PyPI state
         # The tag is created only after PyPI accepted the upload. An existing tag

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/.github/workflows/scorecard.yml

@@ -32,6 +32,6 @@ jobs:
           name: scorecard-sarif
           path: results.sarif
           retention-days: 5
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif

scientific_computing_system-2.2.17/.github/workflows/sign-release.yml

@@ -0,0 +1,170 @@
+name: Sign release
+
+# Attach a signed source archive plus a cosign keyless signature bundle to the
+# GitHub Release that the publish workflows already created. OpenSSF Scorecard's
+# Signed-Releases check looks for a release asset whose name ends in
+# `.sigstore`, and this workflow is the only producer of one.
+#
+# Security: the workflow_run payload is untrusted input. The run is re-read from
+# the Actions API, validated against this repository, the allowed event types
+# and the exact release workflow paths, and only then is its head_sha checked
+# out. The checkout never consumes a raw event expression.
+on:
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing release tag to sign (e.g. v1.2.3)"
+        required: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sign-release-${{ github.event.workflow_run.head_sha || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  sign:
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository)
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Resolve the trusted release commit
+        id: resolve
+        shell: bash
+        env:
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "sha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          data="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}" \
+            --jq '[.head_sha, .event, .conclusion, .repository.full_name, .path] | @tsv')"
+          IFS=$'\t' read -r sha event conclusion repo path <<<"${data}"
+          # The Release workflow here is itself a workflow_run consumer that
+          # waits for CI, so the run this workflow follows has event
+          # `workflow_run`. All of these are accepted; the path, repository and
+          # conclusion checks below still have to pass.
+          case "${event}" in
+            push|release|workflow_run|workflow_dispatch) ;;
+            *) echo "::error::Run ${RUN_ID} has unsupported event ${event}."; exit 1 ;;
+          esac
+          case "${path}" in
+            .github/workflows/release.yml) ;;
+            *) echo "::error::Run ${RUN_ID} is not a release workflow (${path})."; exit 1 ;;
+          esac
+          if [[ "${conclusion}" != "success" || "${repo}" != "${GITHUB_REPOSITORY}" ]]; then
+            echo "::error::Run ${RUN_ID} is not a successful release run on ${GITHUB_REPOSITORY}."
+            exit 1
+          fi
+          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
+
+      - name: Check out the released commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          ref: ${{ steps.resolve.outputs.sha }}
+
+      - name: Resolve the release tag
+        id: tag
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+          HEAD_SHA: ${{ steps.resolve.outputs.sha }}
+        run: |
+          set -euo pipefail
+          if [[ "$EVENT_NAME" == "workflow_dispatch" && -n "$INPUT_TAG" ]]; then
+            TAG="$INPUT_TAG"
+          else
+            git fetch --tags --force origin
+            refs="$(git for-each-ref --format='%(refname:short) %(objectname) %(*objectname)' refs/tags)"
+            TAG="$(printf '%s\n' "$refs" | awk -v sha="$HEAD_SHA" '$2==sha || $3==sha {print $1; exit}')"
+          fi
+          if [[ -z "$TAG" ]]; then
+            echo "::notice::No tag points at ${HEAD_SHA}; nothing to sign."
+            exit 0
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "Resolved tag: $TAG"
+
+      - name: Check the GitHub Release exists
+        id: release
+        if: steps.tag.outputs.tag != ''
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::GitHub Release $TAG does not exist; nothing to sign."
+          fi
+
+      - name: Check the release is not signed yet
+        id: signature
+        if: steps.release.outputs.exists == 'true'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          names="$(gh release view "$TAG" --json assets --jq '.assets[].name')"
+          if grep -q '\.sigstore$' <<<"$names"; then
+            echo "signed=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::Release $TAG already has a .sigstore asset; skipping."
+          else
+            echo "signed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build the source archive
+        id: archive
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          git fetch --tags --force origin
+          repo="${GITHUB_REPOSITORY##*/}"
+          asset="${repo}-${TAG}.tar.gz"
+          git archive --format=tar.gz --prefix="${repo}-${TAG}/" -o "$asset" "$TAG"
+          echo "asset=$asset" >> "$GITHUB_OUTPUT"
+          echo "Built $asset from $TAG"
+
+      - name: Install cosign
+        if: steps.signature.outputs.signed == 'false'
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign the archive with a keyless identity
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          ASSET: ${{ steps.archive.outputs.asset }}
+        run: |
+          set -euo pipefail
+          cosign sign-blob --yes --bundle "${ASSET}.sigstore" "$ASSET"
+
+      - name: Upload the archive and the signature bundle
+        if: steps.signature.outputs.signed == 'false'
+        shell: bash
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+          ASSET: ${{ steps.archive.outputs.asset }}
+        run: |
+          set -euo pipefail
+          gh release upload "$TAG" "$ASSET" "${ASSET}.sigstore" --clobber

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/CHANGELOG.md

@@ -19,6 +19,17 @@ a git tag in this repository or on `origin` (checked with `git ls-remote --tags`
 Any retroactive `v2.2.6` or `v2.2.7` tag should point at those commits. This note records
 what the history supports; it does not claim that a tag exists.
 
+## [v2.2.17] - 2026-10-24
+
+### Dependency hygiene
+
+- Update the locked `ruff` development pin from 0.15.17 to 0.17.1 (Dependabot routine update), in both `pyproject.toml` and `requirements-dev.lock`.
+- Refresh `requirements-dev.lock` to `filelock==4.2.4` on Python 3.11+, clearing CVE-2026-112940 reported by the `pip-audit` lock gate. No fixed release supports Python 3.10, so the dev-only 3.10 pin stays at 3.29.4 (marker split).
+- Refresh `requirements-dev.lock` to `virtualenv==21.14.13`, clearing CVE-2026-113713 and CVE-2026-115586 reported by the `pip-audit` lock gate.
+- Bump synchronized package metadata to 2.2.17 as required by the version-discipline gate for the `[project]` dev-extra change.
+
+> 2.2.16 was staged on `main` but never published: its CI run failed on advisories disclosed after the bump, so these changes ship in 2.2.17.
+
 ## [v2.2.15] - 2026-10-23
 
 ### Dependency security floors

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/CITATION.cff

@@ -5,7 +5,7 @@ title: "scientific-computing-system"
 # Keep `version` in lockstep with pyproject.toml [project].version and
 # src/cds/_version.py. scripts/check_version_discipline.py and
 # scripts/check_version_lockstep.py enforce this.
-version: 2.2.15
+version: 2.2.17
 authors:
   - name: "Furox-Art"
     email: "furkanarkn1451@gmail.com"
@@ -50,5 +50,5 @@ preferred-citation:
   authors:
     - name: "Furox-Art"
   year: 2026
-  version: 2.2.15
+  version: 2.2.17
   url: "https://github.com/Furox-Art/scientific-computing-system"

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scientific-computing-system
-Version: 2.2.15
+Version: 2.2.17
 Summary: A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies.
 Project-URL: Homepage, https://github.com/Furox-Art/scientific-computing-system
 Project-URL: Repository, https://github.com/Furox-Art/scientific-computing-system
@@ -45,7 +45,7 @@ Requires-Dist: pandas>=2.0; extra == 'all'
 Requires-Dist: pre-commit; extra == 'all'
 Requires-Dist: pytest-cov; extra == 'all'
 Requires-Dist: pytest>=9.0.3; extra == 'all'
-Requires-Dist: ruff==0.15.17; extra == 'all'
+Requires-Dist: ruff==0.17.1; extra == 'all'
 Requires-Dist: scikit-learn>=1.4; extra == 'all'
 Requires-Dist: scipy>=1.11; extra == 'all'
 Requires-Dist: statsmodels>=0.14; extra == 'all'
@@ -63,7 +63,7 @@ Requires-Dist: notebook; extra == 'dev'
 Requires-Dist: numpy<2.5,>=2.0; extra == 'dev'
 Requires-Dist: pandas-stubs>=2.0; extra == 'dev'
 Requires-Dist: pre-commit; extra == 'dev'
-Requires-Dist: ruff==0.15.17; extra == 'dev'
+Requires-Dist: ruff==0.17.1; extra == 'dev'
 Provides-Extra: docs
 Requires-Dist: mkdocs-material>=9.7.7; extra == 'docs'
 Requires-Dist: mkdocs>=1.5.0; extra == 'docs'
@@ -277,7 +277,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.15
+System version 2.2.17
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/README.md

@@ -181,7 +181,7 @@ The package installs a `cds` command with 13 subcommands:
 
 ```console
 $ cds --version
-System version 2.2.15
+System version 2.2.17
 $ cds constants        # physical constants table
 ```
 

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/codemeta.json

@@ -2,7 +2,7 @@
   "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
   "@type": "SoftwareSourceCode",
   "name": "scientific-computing-system",
-  "version": "2.2.15",
+  "version": "2.2.17",
   "description": "Pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, and scientific workflows. Zero runtime dependencies. This is the front door; scientific-computing-system-2.0 is the NumPy build of the same work.",
   "license": "https://spdx.org/licenses/MIT",
   "codeRepository": "https://github.com/Furox-Art/scientific-computing-system",

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scientific-computing-system",
-  "version": "2.2.15",
+  "version": "2.2.17",
   "description": "Scientific Computing System launcher - a thin Node wrapper that forwards to the pure-Python `cds` CLI. This npm package ships NO Python code: it requires the Python distribution to be installed (`pip install scientific-computing-system`), otherwise `scs` exits non-zero with an actionable message.",
   "main": "index.js",
   "bin": {

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/pyproject.toml

@@ -2,7 +2,7 @@
 # Distribution name. Formerly published as "cognitive-discovery-system";
 # the import name stays `cds`. Keep the old PyPI project alive as an alias.
 name = "scientific-computing-system"
-version = "2.2.15"
+version = "2.2.17"
 description = "A pure-Python computational science platform for numerical methods, modeling, validation, uncertainty, scientific workflows, dimensional analysis, and optional research-data backends. Zero runtime dependencies."
 readme = "README.md"
 license = "MIT"
@@ -40,7 +40,7 @@ all = [
     "matplotlib>=3.8.0",
     "pytest>=9.0.3",
     "pytest-cov",
-    "ruff==0.15.17",
+    "ruff==0.17.1",
     "mypy>=1.10",
     "pre-commit",
     "build",
@@ -105,7 +105,7 @@ property = [
     "hypothesis>=6.100",
 ]
 dev = [
-    "ruff==0.15.17",
+    "ruff==0.17.1",
     "mypy>=1.10",
     "pre-commit",
     "build",

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/requirements-dev.lock

@@ -67,7 +67,14 @@ executing==2.2.1
     # via stack-data
 fastjsonschema==2.21.2
     # via nbformat
-filelock==3.29.4
+filelock==4.2.4 ; python_version >= "3.11"
+    # via
+    #   python-discovery
+    #   virtualenv
+# CVE-2026-112940 (GHSA-v4x8-3wr5-3wq8) is fixed only in filelock>=4.2.1, and every
+# fixed release requires Python >=3.11. Python 3.10 therefore keeps the last
+# installable version; filelock is dev-only here (requirements.lock is empty).
+filelock==3.29.4 ; python_version < "3.11"
     # via
     #   python-discovery
     #   virtualenv
@@ -356,7 +363,7 @@ rpds-py==2026.5.1
     # via
     #   jsonschema
     #   referencing
-ruff==0.15.17
+ruff==0.17.1
     # via scientific-computing-system (pyproject.toml)
 send2trash==2.1.0
     # via jupyter-server
@@ -408,7 +415,7 @@ uri-template==1.3.0
     # via jsonschema
 urllib3==2.8.0
     # via requests
-virtualenv==21.14.9
+virtualenv==21.14.13
     # via pre-commit
 watchdog==6.0.0
     # via mkdocs

{scientific_computing_system-2.2.15 → scientific_computing_system-2.2.17}/src/cds/_version.py

@@ -5,5 +5,5 @@ from __future__ import annotations
 
 __all__ = ["__version__", "version", "__version_tuple__", "version_tuple"]
 
-__version__ = version = "2.2.15"
-__version_tuple__ = version_tuple = (2, 2, 14)
+__version__ = version = "2.2.17"
+__version_tuple__ = version_tuple = (2, 2, 17)

scientific_computing_system-2.2.17/tests/fuzz/fuzz_bpe_merge.py

@@ -0,0 +1,27 @@
+"""Atheris harness for the BPE merge-rule JSON validator."""
+
+import json
+import sys
+
+import atheris  # type: ignore
+
+from cds.nlp.bpe import BPEMerge
+
+
+def TestOneInput(data: bytes) -> None:
+    fdp = atheris.FuzzedDataProvider(data)
+    document = fdp.ConsumeUnicodeNoSurrogates(4096)
+    try:
+        record = json.loads(document)
+    except json.JSONDecodeError:
+        return
+    if not isinstance(record, dict):
+        return
+    try:
+        BPEMerge.from_dict(record)
+    except (KeyError, ValueError):
+        return
+
+
+atheris.Setup(sys.argv, TestOneInput)
+atheris.Fuzz()