Repository navigation
Feat/serialize package - #1
Merged
Merged
Conversation
…rom obj-diff
Extract obj-diff's stringify/parse codec into a standalone, dependency-free
package with an unchanged wire format, plus low-level encode/decode for
embedding encoded values in other JSON shapes.
Hardening for untrusted input:
- "__proto__" keys are defined as own properties; prototypes never change
- optional maxLength / maxDepth limits on parse (maxDepth on stringify too)
- a clear INVALID_ENVELOPE error for input missing the {v, $refs} wrapper
- every failure is a SerializeError with a machine-readable code
- type tags and Error names can no longer reach Object.prototype members
- self-referencing Map/Set input throws CIRCULAR_REF instead of overflowing
- payloads are shape-checked instead of building broken values
Tooling: esdev (test, build, typecheck), pnpm (TypeScript 7, Biome), tsr tasks.
- benchmarks/: fidelity, malformed-input, wire-size and speed comparison against superjson, devalue, seroval and @ungap/structured-clone on esdev bench; writes benchmarks/results.json - benchmarks/readme.ts renders the results into README's Measured section (tsr bench:readme) - README rewritten in the Open Tech Foundation style, with a feature comparison and the AFW / obj-diff context
- Any value reachable by more than one edge is written once in $refs and
referenced by token; Map, Set and Error claim their id before their
children, and the decoder registers their empty shells first, so cycles
through them round-trip and every shared value keeps its identity.
- Array holes encode as tokens for one shared {"_t":"hole"} entry; a hole
anywhere but an array element is rejected as INVALID_PAYLOAD.
- Output for values without shared specials or holes is unchanged, byte for
byte, from obj-diff 0.18; CIRCULAR_REF now only flags forged leaf entries.
- Fidelity benchmark: 28/28; README regenerated.
- .github/workflows/ci.yml: pnpm install, esdev and tsr, then `tsr ci`. - CHANGELOG.md with an [Unreleased] section for the curated strategy. - release.toml: drop the [discovery] entry that matched no package, build with esdev before publishing (a [[setup]] step installs it), and enable provenance so the workflow gets id-token: write; release.yml regenerated with `release upgrade --force`. `release doctor` reports no issues.
Thanga-Ganapathy
force-pushed
the
feat/serialize-package
branch
from
November 4, 2026 13:59
9974719 to
d51f0cc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.