@aexhq/sdk 1.0.5-canary → 1.0.6-canary

package/dist/_contracts/schemas/wire.js

@@ -131,6 +131,18 @@ export function errorFromZod(error) {
 }
 /** Parse `input` against `schema`, throwing the family's own error text on failure. */
 export function parseWire(schema, input) {
+    const meta = wireObjectMeta.get(schema);
+    if (meta && input !== null && typeof input === "object" && !Array.isArray(input)) {
+        // Zod deliberately skips `__proto__` while collecting unknown keys so a
+        // plain-object output cannot have its prototype replaced. That safety
+        // rule must not turn an attacker-controlled field into an accepted field;
+        // recover the strict wire-object diagnostic before Zod sees the input.
+        const unknownKey = Object.keys(input).find((key) => !meta.permitted.includes(key));
+        if (unknownKey !== undefined) {
+            const diagnostic = meta.unknownKey(meta.resolvePath([]), unknownKey, meta.permitted);
+            throw typeof diagnostic === "string" ? new Error(diagnostic) : diagnostic;
+        }
+    }
     const result = z.safeParse(schema, input);
     if (!result.success) {
         throw structuredError(schema, result.error) ?? errorFromZod(result.error);

package/dist/cli.mjs

@@ -1782,6 +1782,14 @@ function errorFromZod(error) {
   return new Error(primaryIssue(error.issues)?.message ?? "invalid input");
 }
 function parseWire(schema, input) {
+  const meta2 = wireObjectMeta.get(schema);
+  if (meta2 && input !== null && typeof input === "object" && !Array.isArray(input)) {
+    const unknownKey = Object.keys(input).find((key) => !meta2.permitted.includes(key));
+    if (unknownKey !== void 0) {
+      const diagnostic = meta2.unknownKey(meta2.resolvePath([]), unknownKey, meta2.permitted);
+      throw typeof diagnostic === "string" ? new Error(diagnostic) : diagnostic;
+    }
+  }
   const result = safeParse(schema, input);
   if (!result.success) {
     throw structuredError(schema, result.error) ?? errorFromZod(result.error);

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-7c9ef23d338e4cb7205bf51f442ec53bec5b6c18c103e700b9ad4344fb9913a0  cli.mjs
+1f35333a7b3ceb4bbf8461214ae7a9b23cf985195b36e68b61e5e6a016f1f0c2  cli.mjs

package/dist/version.d.ts

@@ -6,4 +6,4 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export declare const SDK_VERSION = "1.0.5-canary";
+export declare const SDK_VERSION = "1.0.6-canary";

package/dist/version.js

@@ -6,5 +6,5 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export const SDK_VERSION = "1.0.5-canary";
+export const SDK_VERSION = "1.0.6-canary";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/sdk",
-  "version": "1.0.5-canary",
+  "version": "1.0.6-canary",
   "description": "TypeScript SDK for autonomous agent sessions with managed Vercel AI Gateway model access.",
   "license": "Apache-2.0",
   "repository": {
@@ -55,6 +55,6 @@
     "zod": "4.4.3"
   },
   "aexRelease": {
-    "sourceSha": "3f747bd862826938ba13bba2304d9260e829efeb"
+    "sourceSha": "ee2aa45e4ad7e3af492f0ecd109c95c550d3ea7a"
   }
 }