[csdev19]

Refs NIW2-311. Spec: design/generate-hardening.md. ADR: 0017 (references never leave the document, and there is no switch).

Decisions

• quicktype runs on a deny-all schema store, so it never fetches anything.
• A non-local $ref in any schema position is refused at import and at export.
• There is no opt-in for remote or file refs.
• One declarationName() produces every generated type name: valid, unique, non-shadowing, with a length cap.
• compileSchema memoizes per $ref and has a budget of 100k nodes.
• parseTypes memoizes and has a budget of 50k visits.
• OpenAPI import carries only the reachable components.
• The parseTypes compiler host is in-memory only.
• No change to packages/schema.

All five findings were reproduced again on main. The spec amends three rows of design/json-schema-adapters.md.

Open questions

1. Prefix for names that start with a digit: T2fa or _2fa?
2. additionalProperties beside properties: compile it silently (proposed), or warn with loss.index-signature?
3. Exporting a stored snapshot with a non-local ref: fail for every target (proposed), or keep TypeScript printing unknown?
4. Fold the MAX_SHAPE_DEPTH double count into this work, or defer it?
5. Seeded bodies change for documents with cycles reached through several paths. Accept?

Status

This PR contains only the design spec and ADR drafts. It is opened as a draft so the design is not lost. The implementation will land on this same branch after the open questions are answered. Everything is "proposed, not implemented".

Part of the 2026-10-12 audit, umbrella NIW2-302. Specs were written by Fable agents against a read-only export of main at ee34302. The ADR numbers (0014–0026) are assigned across all eight audit PRs. decisions/index.md is not edited in these PRs, to avoid eight-way conflicts; add the index rows when each PR is promoted.

🤖 Generated with Claude Code