@ac-kit/core 0.1.0 → 0.3.0

package/dist/object/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/object/defaults.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,QAAQ,CACvB,GAAG,IAAsC;IAEzC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,MAAa,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,EAAE,CAAC;YACT,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;gBACvB,IACE,MAAwB,CAAC,GAAG,CAAC,KAAK,SAAS;oBAC3C,GAAqB,CAAC,GAAG,CAAC,KAAK,SAAS,EACxC,CAAC;oBACD,MAAwB,CAAC,GAAG,CAAC,GAAI,GAAqB,CAAC,GAAG,CAAC,CAAC;gBAC9D,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC,EAAE,EAAO,CAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/object/defaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,QAAQ,CACvB,GAAG,IAAsC;IAEzC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,MAAa,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,EAAE,CAAC;YACT,yEAAyE;YACzE,yEAAyE;YACzE,mCAAmC;YACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAI,GAAqB,CAAC,GAAG,CAAC,CAAC;gBAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;oBACzC,CAAC,CAAE,MAAwB,CAAC,GAAG,CAAC;oBAChC,CAAC,CAAC,SAAS,CAAC;gBAEb,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBAClD,cAAc,CAAC,MAAuB,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBACrD,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC,EAAE,EAAO,CAAM,CAAC;AAClB,CAAC"}

package/dist/object/flatten-record.d.ts

@@ -0,0 +1,67 @@
+export type FlattenRecordOptions = {
+    /**
+     * Separator joining the segments of an output key. Default `"."`.
+     *
+     * Must not be empty: `unflattenRecord` splits on it, and splitting on `""`
+     * would take every key apart character by character.
+     */
+    readonly delimiter?: string | null;
+    /**
+     * Descends into arrays, numbering their elements. Default `false`, which
+     * leaves an array whole as a leaf value.
+     *
+     * Off by default because an index is the one segment a flattened key cannot
+     * tell apart from an ordinary key spelled `"0"`, so numbering costs the round
+     * trip its only ambiguity-free case.
+     */
+    readonly flattenArrays?: boolean | null;
+    /**
+     * Greatest number of segments an output key may have. Default: unbounded.
+     *
+     * A value below that depth is copied across whole, still nested. `1` copies
+     * the record's own entries without flattening anything.
+     */
+    readonly maxDepth?: number | null;
+};
+/**
+ * Collapse a nested record into a one-level one, naming each leaf by the
+ * delimiter-joined path that reached it.
+ *
+ * A leaf is anything that is not a plain object — a `Date`, a `Map`, a class
+ * instance and, by default, an array are all copied across whole. So is an
+ * empty plain object, which has no entry to name and would otherwise vanish.
+ *
+ * **A key that contains the delimiter is not escaped.** `{ "a.b": 1 }` flattens
+ * to `{ "a.b": 1 }`, exactly as `{ a: { b: 1 } }` does, and
+ * {@link unflattenRecord} reads both back as `{ a: { b: 1 } }` — the delimiter
+ * always wins over a literal occurrence of it. Two inputs colliding onto one
+ * output key leave the last one written, in `Object.keys` order. Pick a
+ * delimiter the keys cannot contain when the round trip has to hold.
+ *
+ * Keys are written with `setRecordEntry`, so an input key named `__proto__`
+ * becomes an own entry of the result instead of reaching the prototype setter.
+ *
+ * Time is linear in the number of nodes visited, plus the cost of building the
+ * keys, which is the total length of the output's keys. Memory is the output
+ * record plus one stack frame per level of nesting, so a record nested deeper
+ * than the engine's stack overflows rather than degrading.
+ *
+ * @example
+ * 	```ts
+ * 	flattenRecord({ key1: { keyA: "v" }, key2: { a: { b: 2 } } });
+ * 	// { "key1.keyA": "v", "key2.a.b": 2 }
+ *
+ * 	flattenRecord({ host: { tags: ["a", "b"] } });
+ * 	// { "host.tags": ["a", "b"] } — an array is a leaf
+ *
+ * 	flattenRecord({ a: { b: { c: 1 } } }, { delimiter: "/", maxDepth: 2 });
+ * 	// { "a/b": { c: 1 } }
+ * 	```;
+ *
+ * @param source The record to flatten; it is not modified.
+ * @param options Delimiter, array handling and depth cap.
+ * @returns A new one-level record.
+ * @throws RangeError If the delimiter is empty or `maxDepth` is below 1.
+ */
+export declare function flattenRecord(source: Readonly<Record<string, unknown>>, options?: FlattenRecordOptions): Record<string, unknown>;
+//# sourceMappingURL=flatten-record.d.ts.map

package/dist/object/flatten-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flatten-record.d.ts","sourceRoot":"","sources":["../../src/object/flatten-record.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,oBAAoB,GAAG;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AA4CF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,aAAa,CAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,OAAO,CAAC,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBzB"}

package/dist/object/flatten-record.js

@@ -0,0 +1,81 @@
+import { isPojo } from "../guards/is-pojo.js";
+import { setRecordEntry } from "./set-record-entry.js";
+/** An empty container has no entry to name, so flattening it would lose the key. */
+function isDescendable_(value, options) {
+    if (Array.isArray(value)) {
+        return options.flattenArrays && value.length > 0;
+    }
+    return isPojo(value) && Object.keys(value).length > 0;
+}
+function step_(source, prefix, depth, output, options) {
+    // Own keys only: `for...in` would walk a hostile source's prototype too.
+    for (const key of Object.keys(source)) {
+        const value = source[key];
+        // `null` rather than `""` for the root: a top-level key may itself be empty.
+        const outputKey = prefix === null ? key : prefix + options.delimiter + key;
+        if (depth < options.maxDepth && isDescendable_(value, options)) {
+            step_(value, outputKey, depth + 1, output, options);
+        }
+        else {
+            setRecordEntry(output, outputKey, value);
+        }
+    }
+}
+/**
+ * Collapse a nested record into a one-level one, naming each leaf by the
+ * delimiter-joined path that reached it.
+ *
+ * A leaf is anything that is not a plain object — a `Date`, a `Map`, a class
+ * instance and, by default, an array are all copied across whole. So is an
+ * empty plain object, which has no entry to name and would otherwise vanish.
+ *
+ * **A key that contains the delimiter is not escaped.** `{ "a.b": 1 }` flattens
+ * to `{ "a.b": 1 }`, exactly as `{ a: { b: 1 } }` does, and
+ * {@link unflattenRecord} reads both back as `{ a: { b: 1 } }` — the delimiter
+ * always wins over a literal occurrence of it. Two inputs colliding onto one
+ * output key leave the last one written, in `Object.keys` order. Pick a
+ * delimiter the keys cannot contain when the round trip has to hold.
+ *
+ * Keys are written with `setRecordEntry`, so an input key named `__proto__`
+ * becomes an own entry of the result instead of reaching the prototype setter.
+ *
+ * Time is linear in the number of nodes visited, plus the cost of building the
+ * keys, which is the total length of the output's keys. Memory is the output
+ * record plus one stack frame per level of nesting, so a record nested deeper
+ * than the engine's stack overflows rather than degrading.
+ *
+ * @example
+ * 	```ts
+ * 	flattenRecord({ key1: { keyA: "v" }, key2: { a: { b: 2 } } });
+ * 	// { "key1.keyA": "v", "key2.a.b": 2 }
+ *
+ * 	flattenRecord({ host: { tags: ["a", "b"] } });
+ * 	// { "host.tags": ["a", "b"] } — an array is a leaf
+ *
+ * 	flattenRecord({ a: { b: { c: 1 } } }, { delimiter: "/", maxDepth: 2 });
+ * 	// { "a/b": { c: 1 } }
+ * 	```;
+ *
+ * @param source The record to flatten; it is not modified.
+ * @param options Delimiter, array handling and depth cap.
+ * @returns A new one-level record.
+ * @throws RangeError If the delimiter is empty or `maxDepth` is below 1.
+ */
+export function flattenRecord(source, options) {
+    const resolved = {
+        delimiter: options?.delimiter ?? ".",
+        flattenArrays: options?.flattenArrays ?? false,
+        maxDepth: options?.maxDepth ?? Number.POSITIVE_INFINITY,
+    };
+    if (resolved.delimiter.length === 0) {
+        throw new RangeError("flattenRecord: delimiter must not be empty");
+    }
+    // Negated so a `NaN` depth is rejected rather than silently flattening nothing.
+    if (!(resolved.maxDepth >= 1)) {
+        throw new RangeError("flattenRecord: maxDepth must be at least 1");
+    }
+    const output = {};
+    step_(source, null, 1, output, resolved);
+    return output;
+}
+//# sourceMappingURL=flatten-record.js.map

package/dist/object/flatten-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flatten-record.js","sourceRoot":"","sources":["../../src/object/flatten-record.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAoCvD,oFAAoF;AACpF,SAAS,cAAc,CAAC,KAAc,EAAE,OAAkB;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,KAAK,CACb,MAAyC,EACzC,MAAqB,EACrB,KAAa,EACb,MAA+B,EAC/B,OAAkB;IAElB,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;QAE3E,IAAI,KAAK,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YAChE,KAAK,CACJ,KAA0C,EAC1C,SAAS,EACT,KAAK,GAAG,CAAC,EACT,MAAM,EACN,OAAO,CACP,CAAC;QACH,CAAC;aAAM,CAAC;YACP,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,UAAU,aAAa,CAC5B,MAAyC,EACzC,OAA8B;IAE9B,MAAM,QAAQ,GAAc;QAC3B,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,GAAG;QACpC,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,KAAK;QAC9C,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,iBAAiB;KACvD,CAAC;IAEF,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,gFAAgF;IAChF,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/object/get-at-path.d.ts

@@ -6,6 +6,11 @@ export type PropertyPath = readonly (string | number)[];
 /**
  * Gets the value at `path` inside `root`.
  *
+ * Unlike `setAtPath`, this does not refuse a path through `__proto__`,
+ * `constructor` or `prototype`: reading one hands back a prototype the caller
+ * could already reach through any object it holds, so refusing it would cost an
+ * honest lookup and prevent nothing.
+ *
  * @param root The root object/array to traverse
  * @param path The path to traverse
  * @returns The value at the path, or `undefined` if the path does not exist.

package/dist/object/get-at-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-at-path.d.ts","sourceRoot":"","sources":["../../src/object/get-at-path.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAkBpE"}
+{"version":3,"file":"get-at-path.d.ts","sourceRoot":"","sources":["../../src/object/get-at-path.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAkBpE"}

package/dist/object/get-at-path.js

@@ -2,6 +2,11 @@ import { isObject } from "../guards/is-object.js";
 /**
  * Gets the value at `path` inside `root`.
  *
+ * Unlike `setAtPath`, this does not refuse a path through `__proto__`,
+ * `constructor` or `prototype`: reading one hands back a prototype the caller
+ * could already reach through any object it holds, so refusing it would cost an
+ * honest lookup and prevent nothing.
+ *
  * @param root The root object/array to traverse
  * @param path The path to traverse
  * @returns The value at the path, or `undefined` if the path does not exist.

package/dist/object/get-at-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-at-path.js","sourceRoot":"","sources":["../../src/object/get-at-path.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAQlD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,IAAkB;IAC1D,IAAI,OAAO,GAAG,IAAI,CAAC;IAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC;YACnB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACR,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAI,OAAyB,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,OAAO;QACR,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC"}
+{"version":3,"file":"get-at-path.js","sourceRoot":"","sources":["../../src/object/get-at-path.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAQlD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,IAAkB;IAC1D,IAAI,OAAO,GAAG,IAAI,CAAC;IAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC;YACnB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACR,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAI,OAAyB,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,OAAO;QACR,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/object/is-unsafe-record-key.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Check whether a key may be followed while walking a record built from
+ * untrusted input.
+ *
+ * `__proto__` reaches the prototype setter when assigned to; `constructor`
+ * followed by `prototype` reaches `Object.prototype` when merely read, and a
+ * path-walking writer then mutates it. All three names are rejected together
+ * because a walk cannot tell which position it is in until the damage is done.
+ *
+ * Use this for a **path**. A single leaf assignment wants `setRecordEntry`
+ * instead, which stores such a key rather than refusing it — a record of
+ * environment variables or INI settings should still be able to hold one named
+ * `constructor`.
+ *
+ * @example
+ * 	```ts
+ * 	isUnsafeRecordKey("__proto__"); // true
+ * 	isUnsafeRecordKey("constructor"); // true
+ * 	isUnsafeRecordKey("toString"); // false — shadowing is not pollution
+ * 	```;
+ *
+ * @param key The key to check.
+ * @returns True if following the key can reach a shared prototype.
+ */
+export declare function isUnsafeRecordKey(key: PropertyKey): boolean;
+//# sourceMappingURL=is-unsafe-record-key.d.ts.map

package/dist/object/is-unsafe-record-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-unsafe-record-key.d.ts","sourceRoot":"","sources":["../../src/object/is-unsafe-record-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAE3D"}

package/dist/object/is-unsafe-record-key.js

@@ -0,0 +1,28 @@
+/**
+ * Check whether a key may be followed while walking a record built from
+ * untrusted input.
+ *
+ * `__proto__` reaches the prototype setter when assigned to; `constructor`
+ * followed by `prototype` reaches `Object.prototype` when merely read, and a
+ * path-walking writer then mutates it. All three names are rejected together
+ * because a walk cannot tell which position it is in until the damage is done.
+ *
+ * Use this for a **path**. A single leaf assignment wants `setRecordEntry`
+ * instead, which stores such a key rather than refusing it — a record of
+ * environment variables or INI settings should still be able to hold one named
+ * `constructor`.
+ *
+ * @example
+ * 	```ts
+ * 	isUnsafeRecordKey("__proto__"); // true
+ * 	isUnsafeRecordKey("constructor"); // true
+ * 	isUnsafeRecordKey("toString"); // false — shadowing is not pollution
+ * 	```;
+ *
+ * @param key The key to check.
+ * @returns True if following the key can reach a shared prototype.
+ */
+export function isUnsafeRecordKey(key) {
+    return key === "__proto__" || key === "constructor" || key === "prototype";
+}
+//# sourceMappingURL=is-unsafe-record-key.js.map

package/dist/object/is-unsafe-record-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-unsafe-record-key.js","sourceRoot":"","sources":["../../src/object/is-unsafe-record-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAgB;IACjD,OAAO,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,CAAC;AAC5E,CAAC"}

package/dist/object/merge-inplace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-inplace.d.ts","sourceRoot":"","sources":["../../src/object/merge-inplace.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAOlD,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,MAAM,oBAAoB,CAAC;AA4B5B;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EACvD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,EACT,OAAO,CAAC,EAAE,YAAY,GAAG;IAAE,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5C,CAAC,CAAC;AACL,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAC3D,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,YAAY,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GACzC,CAAC,CAAC;AASL;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,QAAQ,SAAS,SAAS,OAAO,EAAE,EAC3E,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,QAAQ,EACjB,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CASnC"}
+{"version":3,"file":"merge-inplace.d.ts","sourceRoot":"","sources":["../../src/object/merge-inplace.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAOlD,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,MAAM,oBAAoB,CAAC;AA6B5B;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EACvD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,EACT,OAAO,CAAC,EAAE,YAAY,GAAG;IAAE,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5C,CAAC,CAAC;AACL,wBAAgB,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAC3D,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,YAAY,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GACzC,CAAC,CAAC;AASL;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,QAAQ,SAAS,SAAS,OAAO,EAAE,EAC3E,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,QAAQ,EACjB,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CASnC"}

package/dist/object/merge-inplace.js

@@ -4,6 +4,7 @@ import { isPojo } from "../guards/is-pojo.js";
 import { isSet } from "../guards/is-set.js";
 import { clone } from "./clone.js";
 import { MERGE_DEFAULT_OPTIONS, } from "./merge-options.js";
+import { setRecordEntry } from "./set-record-entry.js";
 function resolve_(options) {
     return {
         recursive: options?.recursive ?? MERGE_DEFAULT_OPTIONS.recursive,
@@ -65,8 +66,9 @@ function mergeInplace_(target, source, options) {
     return fromSource_(source, options);
 }
 function mergePojoInplace_(target, source, options) {
-    for (const key in source) {
-        target[key] = nested_(target[key], source[key], options);
+    // Own keys only: `for...in` would walk a hostile source's prototype too.
+    for (const key of Object.keys(source)) {
+        setRecordEntry(target, key, nested_(target[key], source[key], options));
     }
 }
 function mergeSetInplace_(target, source, options) {

package/dist/object/merge-inplace.js.map

@@ -1 +1 @@
-{"version":3,"file":"merge-inplace.js","sourceRoot":"","sources":["../../src/object/merge-inplace.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACN,qBAAqB,GAGrB,MAAM,oBAAoB,CAAC;AAI5B,SAAS,QAAQ,CAAC,OAAiC;IAClD,OAAO;QACN,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,qBAAqB,CAAC,SAAS;QAChE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAC,WAAW;QACtE,cAAc,EACb,OAAO,EAAE,cAAc,IAAI,qBAAqB,CAAC,cAAc;KAChE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,OAAkB;IACtD,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CACf,MAAe,EACf,MAAe,EACf,OAAkB;IAElB,OAAO,OAAO,CAAC,SAAS;QACvB,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;QACxC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAwBD,MAAM,UAAU,YAAY,CAC3B,MAAS,EACT,MAAS,EACT,OAAsB;IAEtB,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAe,EACf,OAAiB,EACjB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,MAAM,GAAY,MAAM,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,MAA2C,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CACrB,MAAe,EACf,MAAe,EACf,OAAkB;IAElB,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,iBAAiB,CACzB,MAA+B,EAC/B,MAA+B,EAC/B,OAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CACxB,MAAoB,EACpB,MAAoB,EACpB,OAAkB;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CACxB,MAA6B,EAC7B,MAA6B,EAC7B,OAAkB;IAElB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAiB,EACjB,MAAiB,EACjB,OAAkB;IAElB,QAAQ,OAAO,CAAC,cAAc,EAAE,CAAC;QAChC,KAAK,QAAQ;YACZ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM;QAEP,KAAK,OAAO;YACX,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;gBACrD,MAAM,CAAC,KAAK,CAAC;oBACZ,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;wBAC1B,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC;wBACnC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YACD,MAAM;QAEP;YACC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM;IACR,CAAC;AACF,CAAC"}
+{"version":3,"file":"merge-inplace.js","sourceRoot":"","sources":["../../src/object/merge-inplace.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACN,qBAAqB,GAGrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,SAAS,QAAQ,CAAC,OAAiC;IAClD,OAAO;QACN,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,qBAAqB,CAAC,SAAS;QAChE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAC,WAAW;QACtE,cAAc,EACb,OAAO,EAAE,cAAc,IAAI,qBAAqB,CAAC,cAAc;KAChE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,OAAkB;IACtD,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CACf,MAAe,EACf,MAAe,EACf,OAAkB;IAElB,OAAO,OAAO,CAAC,SAAS;QACvB,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;QACxC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAwBD,MAAM,UAAU,YAAY,CAC3B,MAAS,EACT,MAAS,EACT,OAAsB;IAEtB,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC9B,MAAe,EACf,OAAiB,EACjB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,MAAM,GAAY,MAAM,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,MAA2C,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CACrB,MAAe,EACf,MAAe,EACf,OAAkB;IAElB,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,iBAAiB,CACzB,MAA+B,EAC/B,MAA+B,EAC/B,OAAkB;IAElB,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CACxB,MAAoB,EACpB,MAAoB,EACpB,OAAkB;IAElB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CACxB,MAA6B,EAC7B,MAA6B,EAC7B,OAAkB;IAElB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAiB,EACjB,MAAiB,EACjB,OAAkB;IAElB,QAAQ,OAAO,CAAC,cAAc,EAAE,CAAC;QAChC,KAAK,QAAQ;YACZ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM;QAEP,KAAK,OAAO;YACX,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;gBACrD,MAAM,CAAC,KAAK,CAAC;oBACZ,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;wBAC1B,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC;wBACnC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YACD,MAAM;QAEP;YACC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM;IACR,CAAC;AACF,CAAC"}

package/dist/object/merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/object/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAOlD,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,MAAM,oBAAoB,CAAC;AA4B5B;;;;;;;;;;;GAWG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAChD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,EACT,OAAO,CAAC,EAAE,YAAY,GAAG;IAAE,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5C,CAAC,CAAC;AACL,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EACpD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,YAAY,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GACzC,CAAC,CAAC;AASL;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,SAAS,SAAS,OAAO,EAAE,EAC3D,OAAO,EAAE,QAAQ,EACjB,OAAO,CAAC,EAAE,YAAY,GACpB,aAAa,CAAC,QAAQ,CAAC,CASzB"}
+{"version":3,"file":"merge.d.ts","sourceRoot":"","sources":["../../src/object/merge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAOlD,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,MAAM,oBAAoB,CAAC;AA6B5B;;;;;;;;;;;GAWG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAChD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,EACT,OAAO,CAAC,EAAE,YAAY,GAAG;IAAE,SAAS,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5C,CAAC,CAAC;AACL,wBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EACpD,MAAM,EAAE,CAAC,EACT,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,YAAY,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GACzC,CAAC,CAAC;AASL;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,SAAS,SAAS,OAAO,EAAE,EAC3D,OAAO,EAAE,QAAQ,EACjB,OAAO,CAAC,EAAE,YAAY,GACpB,aAAa,CAAC,QAAQ,CAAC,CASzB"}

package/dist/object/merge.js

@@ -4,6 +4,7 @@ import { isPojo } from "../guards/is-pojo.js";
 import { isSet } from "../guards/is-set.js";
 import { clone } from "./clone.js";
 import { MERGE_DEFAULT_OPTIONS, } from "./merge-options.js";
+import { setRecordEntry } from "./set-record-entry.js";
 function resolve_(options) {
     return {
         recursive: options?.recursive ?? MERGE_DEFAULT_OPTIONS.recursive,
@@ -60,8 +61,9 @@ function merge_(target, source, options) {
 }
 function mergePojo_(target, source, options) {
     const output = { ...target };
-    for (const key in source) {
-        output[key] = nested_(target[key], source[key], options);
+    // Own keys only: `for...in` would walk a hostile source's prototype too.
+    for (const key of Object.keys(source)) {
+        setRecordEntry(output, key, nested_(target[key], source[key], options));
     }
     return output;
 }

package/dist/object/merge.js.map

@@ -1 +1 @@
-{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/object/merge.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACN,qBAAqB,GAGrB,MAAM,oBAAoB,CAAC;AAI5B,SAAS,QAAQ,CAAC,OAAiC;IAClD,OAAO;QACN,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,qBAAqB,CAAC,SAAS;QAChE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAC,WAAW;QACtE,cAAc,EACb,OAAO,EAAE,cAAc,IAAI,qBAAqB,CAAC,cAAc;KAChE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,OAAkB;IACtD,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CACf,MAAe,EACf,MAAe,EACf,OAAkB;IAElB,OAAO,OAAO,CAAC,SAAS;QACvB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;QACjC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAwBD,MAAM,UAAU,KAAK,CACpB,MAAS,EACT,MAAS,EACT,OAAsB;IAEtB,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACvB,OAAiB,EACjB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,MAAM,GAAY,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,MAAiC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAe,EAAE,MAAe,EAAE,OAAkB;IACnE,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAClB,MAA+B,EAC/B,MAA+B,EAC/B,OAAkB;IAElB,MAAM,MAAM,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAEtD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CACjB,MAAoB,EACpB,MAAoB,EACpB,OAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CACjB,MAA6B,EAC7B,MAA6B,EAC7B,OAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,MAAiB,EACjB,MAAiB,EACjB,OAAkB;IAElB,IAAI,OAAO,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,MAAM,EAAE,GAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAe,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAE9B,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC;gBACZ,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;oBAC1B,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC;oBACnC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,uEAAuE;QACvE,+CAA+C;QAC/C,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAc,CAAC;AAClD,CAAC"}
+{"version":3,"file":"merge.js","sourceRoot":"","sources":["../../src/object/merge.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EACN,qBAAqB,GAGrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD,SAAS,QAAQ,CAAC,OAAiC;IAClD,OAAO;QACN,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,qBAAqB,CAAC,SAAS;QAChE,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAC,WAAW;QACtE,cAAc,EACb,OAAO,EAAE,cAAc,IAAI,qBAAqB,CAAC,cAAc;KAChE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,OAAkB;IACtD,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CACf,MAAe,EACf,MAAe,EACf,OAAkB;IAElB,OAAO,OAAO,CAAC,SAAS;QACvB,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;QACjC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAwBD,MAAM,UAAU,KAAK,CACpB,MAAS,EACT,MAAS,EACT,OAAsB;IAEtB,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACvB,OAAiB,EACjB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEnC,IAAI,MAAM,GAAY,EAAE,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,MAAiC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,MAAe,EAAE,MAAe,EAAE,OAAkB;IACnE,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACF,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAClB,MAA+B,EAC/B,MAA+B,EAC/B,OAAkB;IAElB,MAAM,MAAM,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAEtD,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CACjB,MAAoB,EACpB,MAAoB,EACpB,OAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CACjB,MAA6B,EAC7B,MAA6B,EAC7B,OAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CACnB,MAAiB,EACjB,MAAiB,EACjB,OAAkB;IAElB,IAAI,OAAO,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,MAAM,EAAE,GAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAe,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAE9B,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC;gBACZ,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS;oBAC1B,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC;oBACnC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,uEAAuE;QACvE,+CAA+C;QAC/C,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAc,CAAC;AAClD,CAAC"}

package/dist/object/null-if-empty.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Normalizes an object with no own enumerable property to `null`.
+ *
+ * Useful against APIs that report "no value" as an empty object rather than as
+ * `null` or `undefined`, so that callers only have one absent form to test.
+ *
+ * @param value The object to normalize.
+ * @returns The object, or `null` when it is absent or has no own enumerable
+ *   property.
+ */
+export declare function nullIfEmpty<T extends object>(value: T | null | undefined): T | null;
+//# sourceMappingURL=null-if-empty.d.ts.map

package/dist/object/null-if-empty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"null-if-empty.d.ts","sourceRoot":"","sources":["../../src/object/null-if-empty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,EAC3C,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACzB,CAAC,GAAG,IAAI,CAMV"}

package/dist/object/null-if-empty.js

@@ -0,0 +1,17 @@
+/**
+ * Normalizes an object with no own enumerable property to `null`.
+ *
+ * Useful against APIs that report "no value" as an empty object rather than as
+ * `null` or `undefined`, so that callers only have one absent form to test.
+ *
+ * @param value The object to normalize.
+ * @returns The object, or `null` when it is absent or has no own enumerable
+ *   property.
+ */
+export function nullIfEmpty(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    return Object.keys(value).length === 0 ? null : value;
+}
+//# sourceMappingURL=null-if-empty.js.map

package/dist/object/null-if-empty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"null-if-empty.js","sourceRoot":"","sources":["../../src/object/null-if-empty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAC1B,KAA2B;IAE3B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AACvD,CAAC"}

package/dist/object/set-at-path.d.ts

@@ -6,6 +6,11 @@ import { PropertyPath } from "./get-at-path.js";
  * the next key (`number` → array, `string` → object). Existing `null` or
  * `undefined` intermediates are replaced.
  *
+ * A path containing `__proto__`, `constructor` or `prototype` is refused
+ * outright and nothing is written, because walking one reaches a prototype
+ * shared with every other object. The refusal is silent, like the one for a
+ * non-numeric index into an array.
+ *
  * @param root The root object/array to mutate
  * @param path The path to traverse
  * @param value The value to set at the path

package/dist/object/set-at-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-at-path.d.ts","sourceRoot":"","sources":["../../src/object/set-at-path.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,EACzC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,OAAO,GACZ,IAAI,CAyCN"}
+{"version":3,"file":"set-at-path.d.ts","sourceRoot":"","sources":["../../src/object/set-at-path.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIhD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,EACzC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,OAAO,GACZ,IAAI,CAyCN"}

package/dist/object/set-at-path.js

@@ -1,4 +1,6 @@
 import { isObject } from "../guards/is-object.js";
+import { isUnsafeRecordKey } from "./is-unsafe-record-key.js";
+import { setRecordEntry } from "./set-record-entry.js";
 /**
  * Mutates `root` by setting the value at `path`.
  *
@@ -6,12 +8,17 @@ import { isObject } from "../guards/is-object.js";
  * the next key (`number` → array, `string` → object). Existing `null` or
  * `undefined` intermediates are replaced.
  *
+ * A path containing `__proto__`, `constructor` or `prototype` is refused
+ * outright and nothing is written, because walking one reaches a prototype
+ * shared with every other object. The refusal is silent, like the one for a
+ * non-numeric index into an array.
+ *
  * @param root The root object/array to mutate
  * @param path The path to traverse
  * @param value The value to set at the path
  */
 export function setAtPath(root, path, value) {
-    if (path.length === 0) {
+    if (path.length === 0 || path.some(isUnsafeRecordKey)) {
         return;
     }
     let current = root;
@@ -31,7 +38,7 @@ export function setAtPath(root, path, value) {
         else {
             const obj = current;
             if (!isObject(obj[key]) && !Array.isArray(obj[key])) {
-                obj[key] = typeof nextKey === "number" ? [] : {};
+                setRecordEntry(obj, String(key), typeof nextKey === "number" ? [] : {});
             }
             current = obj[key];
         }
@@ -45,7 +52,7 @@ export function setAtPath(root, path, value) {
         current[lastIndex] = value;
     }
     else {
-        current[lastKey] = value;
+        setRecordEntry(current, String(lastKey), value);
     }
 }
 //# sourceMappingURL=set-at-path.js.map

package/dist/object/set-at-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"set-at-path.js","sourceRoot":"","sources":["../../src/object/set-at-path.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGlD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CACxB,IAAyC,EACzC,IAAkB,EAClB,KAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;IACR,CAAC;IAED,IAAI,OAAO,GAAY,IAAI,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAE7B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC;YACnB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,GAAG,OAAwB,CAAC;YAErC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,CAAC;YACD,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,OAAyB,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;AACF,CAAC"}
+{"version":3,"file":"set-at-path.js","sourceRoot":"","sources":["../../src/object/set-at-path.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,SAAS,CACxB,IAAyC,EACzC,IAAkB,EAClB,KAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvD,OAAO;IACR,CAAC;IAED,IAAI,OAAO,GAAY,IAAI,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAE7B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC;YACnB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACP,MAAM,GAAG,GAAG,OAAwB,CAAC;YAErC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrD,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO;QACR,CAAC;QACD,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;SAAM,CAAC;QACP,cAAc,CAAC,OAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;AACF,CAAC"}

package/dist/object/set-record-entry.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Assign into a record whose keys come from untrusted input.
+ *
+ * `record[key] = value` runs the `__proto__` setter inherited from
+ * `Object.prototype`, so one key out of parsed text can replace the prototype
+ * of every object built afterwards. Defining the property instead stores an
+ * ordinary own `__proto__` entry and reaches no setter, leaving the record an
+ * otherwise normal object: same prototype, same spread, same `deepEqual`.
+ *
+ * Costs one string comparison over a plain assignment for every other key, so
+ * it is safe to call from a parser loop — `Object.defineProperty` is far slower
+ * and is taken only for the single key that needs it.
+ *
+ * This guards a **write**. A caller walking a path of untrusted keys must also
+ * guard its reads with `isUnsafeRecordKey`: stepping through `constructor` and
+ * then `prototype` pollutes without ever assigning to `__proto__`.
+ *
+ * @example
+ * 	```ts
+ * 	const parsed: Record<string, unknown> = {};
+ * 	setRecordEntry(parsed, "__proto__", { polluted: true });
+ *
+ * 	parsed["__proto__"]; // { polluted: true } — an own entry
+ * 	Object.getPrototypeOf(parsed) === Object.prototype; // true — untouched
+ * 	```;
+ *
+ * @param record The record to assign into.
+ * @param key The key, which may come from untrusted input.
+ * @param value The value to store.
+ */
+export declare function setRecordEntry<T>(record: Record<string, T>, key: string, value: NoInfer<T>): void;
+//# sourceMappingURL=set-record-entry.d.ts.map

package/dist/object/set-record-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-record-entry.d.ts","sourceRoot":"","sources":["../../src/object/set-record-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GACf,IAAI,CAYN"}

package/dist/object/set-record-entry.js

@@ -0,0 +1,43 @@
+/**
+ * Assign into a record whose keys come from untrusted input.
+ *
+ * `record[key] = value` runs the `__proto__` setter inherited from
+ * `Object.prototype`, so one key out of parsed text can replace the prototype
+ * of every object built afterwards. Defining the property instead stores an
+ * ordinary own `__proto__` entry and reaches no setter, leaving the record an
+ * otherwise normal object: same prototype, same spread, same `deepEqual`.
+ *
+ * Costs one string comparison over a plain assignment for every other key, so
+ * it is safe to call from a parser loop — `Object.defineProperty` is far slower
+ * and is taken only for the single key that needs it.
+ *
+ * This guards a **write**. A caller walking a path of untrusted keys must also
+ * guard its reads with `isUnsafeRecordKey`: stepping through `constructor` and
+ * then `prototype` pollutes without ever assigning to `__proto__`.
+ *
+ * @example
+ * 	```ts
+ * 	const parsed: Record<string, unknown> = {};
+ * 	setRecordEntry(parsed, "__proto__", { polluted: true });
+ *
+ * 	parsed["__proto__"]; // { polluted: true } — an own entry
+ * 	Object.getPrototypeOf(parsed) === Object.prototype; // true — untouched
+ * 	```;
+ *
+ * @param record The record to assign into.
+ * @param key The key, which may come from untrusted input.
+ * @param value The value to store.
+ */
+export function setRecordEntry(record, key, value) {
+    if (key === "__proto__") {
+        Object.defineProperty(record, key, {
+            value,
+            enumerable: true,
+            writable: true,
+            configurable: true,
+        });
+        return;
+    }
+    record[key] = value;
+}
+//# sourceMappingURL=set-record-entry.js.map

package/dist/object/set-record-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-record-entry.js","sourceRoot":"","sources":["../../src/object/set-record-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,cAAc,CAC7B,MAAyB,EACzB,GAAW,EACX,KAAiB;IAEjB,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;YAClC,KAAK;YACL,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AACrB,CAAC"}

package/dist/object/traverse.js

@@ -1,5 +1,5 @@
+import { hasObjectPrototype } from "../guards/has-object-prototype.js";
 import { isMap } from "../guards/is-map.js";
-import { isPlainObject } from "../guards/is-plain-object.js";
 import { isSet } from "../guards/is-set.js";
 import { defaults } from "./defaults.js";
 import { getObjectKeys, } from "./get-object-keys.js";
@@ -95,8 +95,8 @@ function traverseValue_(value, visitor, options, context) {
             return value;
         }
         // Check if we should traverse this object's properties
-        const shouldTraverseObject = (isPlainObject(value) && options.traversePlainObjects) ||
-            (!isPlainObject(value) &&
+        const shouldTraverseObject = (hasObjectPrototype(value) && options.traversePlainObjects) ||
+            (!hasObjectPrototype(value) &&
                 shouldTraverseCustomObject(value, options.traverseCustomObjects));
         if (shouldTraverseObject) {
             return traverseObjectProperties_(value, visitor, options, parentPath);