Release Schema Tools 0.2.0

2026-09-02 08:04:49 +02:00
parent 754608e52b
commit 0c47ec5105
30 changed files with 587 additions and 94 deletions
@@ -4,6 +4,6 @@ Schema sources, instances, diagnostics, comparisons, and generated samples stay

 Each source is limited to 2 MiB of text; a workspace is limited to 20 documents and 8 MiB. JSON/YAML trees are capped at 25,000 values, 48 levels, and 2,000 entries in one collection. XML is capped at 25,000 elements and 48 levels. References, instances, and diagnostics have separate caps. A shared sample budget is limited to 50,000 monotonic work steps, exactly 2,000 generated JSON values or XML elements, exactly 20 generated nesting levels, 512 KiB of aggregate derived text, 1,024 UTF-16 code units per copied literal without splitting surrogate pairs, and 2 MiB of serialized output. Reusing a local definition consumes the same aggregate counters on every attempt and generated occurrence; failed heuristic alternatives never refund work. Reaching the work ceiling refuses the generation operation, so exhaustion cannot be mistaken for a viable choice or skip a later mandatory constraint. File byte gates are deliberately conservative before `File.text()` decoding.

-Prototype-sensitive JSON keys, cyclic YAML aliases, NUL input, DTD/entity declarations, absolute/remote/escaping references, and executable schema extensions are rejected. Schematron expressions and imported XML are never executed. JSON Schema formats are annotations, and regex-bearing schema keywords are not executed. The focused validator interprets eligible schemas without dynamic code generation, remote loading, custom code, or `unsafe-eval`; work and diagnostic counts are capped.
+Prototype-sensitive JSON keys, cyclic YAML aliases, NUL input, DTD/entity declarations, absolute/remote/escaping references, and executable schema extensions are rejected. Schematron expressions and imported XML are never executed. JSON Schema formats are annotations. Regex-bearing keywords are evaluated in a fresh worker that is terminated on completion or after one second; expression count and length, candidate count, and total pair evaluations are capped before dispatch. The focused validator interprets eligible schemas without dynamic code generation, remote loading, custom code, or `unsafe-eval`; work and diagnostic counts are capped.

-Sample generation and compatibility results are review aids. A generated document is not guaranteed to satisfy every constraint, and an absence of reported changes does not prove compatibility. Generation refuses a definitely impossible selected `false` JSON Schema branch but does not prove broader satisfiability. JSON validation requires a single declared draft and uses local workspace filenames rather than identifier URIs. Named anchors, nested identifier scopes, dynamic/recursive references, unevaluated keywords, regular expressions, and full meta-schema validation are outside v0.1.2. XSD, Relax NG, and Schematron instance validation is also outside v0.1.2; OpenAPI inspection is not a full conformance certification.
+Sample generation and compatibility results are review aids. A generated document is not guaranteed to satisfy every constraint, and an absence of reported changes does not prove compatibility. Generation refuses a definitely impossible selected `false` JSON Schema branch but does not prove broader satisfiability. JSON validation requires a single declared draft and uses local workspace filenames rather than identifier URIs. Named anchors, nested identifier scopes, dynamic/recursive references, unevaluated keywords, and full meta-schema validation remain outside the focused subset. XSD, Relax NG, and Schematron instance validation is also outside the current scope; OpenAPI inspection is not a full conformance certification.