@amritk/generate-parsers 0.15.0 → 0.16.1

package/dist/generators/generate-parser-function.js

@@ -8,9 +8,11 @@ import { unknownKeyCheck } from '@amritk/helpers/unknown-key-check';
 import { findDiscriminator } from '../helpers/find-discriminator.js';
 import { getDefaultValue } from '../helpers/get-default-value.js';
 import { getDiscriminatorValue } from '../helpers/get-discriminator-value.js';
-import { generateObjectStrictAssertion, generateScalarStrictAssertion } from './generate-strict-assertion.js';
-import { canEnforceUnion, generatePropertyTypeCheck, generateUnionCheck, getUnionBranches, isInlineObjectArrayProperty, isInlineObjectProperty, shapeValidatorName, } from './generate-type-checks.js';
-import { generateValidationExpression, isCoercibleItemSchema } from './generate-validation-expression.js';
+import { assertNoUnsupportedKeywords } from './assert-supported-keywords.js';
+import { generateEnumCaseInsensitiveCoercion } from './generate-enum-check.js';
+import { generateContainsCheck, generateObjectKeywordChecks, generateObjectStrictAssertion, generateScalarStrictAssertion, } from './generate-strict-assertion.js';
+import { canEnforceUnion, generatePropertyTypeCheck, generateUnionCheck, getUnionBranches, hasFastPathBlockingKeyword, isInlineObjectArrayProperty, isInlineObjectProperty, shapeValidatorName, } from './generate-type-checks.js';
+import { generatePrefixItemsMap, generateValidationExpression, getPrefixItems, isCoercibleItemSchema, prefixItemsCapsLength, } from './generate-validation-expression.js';
 /**
  * Generates the parser function name from a type name.
  * Converts "UserObject" to "parseUserObject".
@@ -18,6 +20,16 @@ import { generateValidationExpression, isCoercibleItemSchema } from './generate-
 const generateParserName = (typeName) => {
     return `parse${typeName}`;
 };
+/**
+ * Object-literal key form that is safe for the runtime-dangerous name
+ * `__proto__`. In an object literal `{ __proto__: v }` / `{ "__proto__": v }` is
+ * the special prototype-setter syntax — it never creates an own property — so a
+ * schema property literally named `__proto__` would silently vanish (and, for an
+ * object value, reassign the result's prototype). The computed form
+ * `{ ["__proto__"]: v }` creates a normal own property. Every other key keeps
+ * the plain `safeKey` output, so the common path is unchanged.
+ */
+const safeLiteralKey = (key) => (key === '__proto__' ? '["__proto__"]' : safeKey(key));
 /**
  * Checks if a property is required based on the schema's required array.
  */
@@ -49,7 +61,7 @@ const generateOptionalRefCall = (key, ref, suffix) => {
     // Gate on presence, not truthiness: a `&&` guard skips parsing when the value
     // is `false`/`0`/`""`/`null`, spreading it raw. `!== undefined` still omits an
     // absent optional property but coerces every present one, matching the main path.
-    return `...(${acc} !== undefined && { ${safeKey(key)}: ${parserName}(${acc}) })`;
+    return `...(${acc} !== undefined && { ${safeLiteralKey(key)}: ${parserName}(${acc}) })`;
 };
 /**
  * Generates a validateArray call for required array properties with $ref items.
@@ -67,7 +79,7 @@ const generateOptionalArrayRefCall = (key, ref, suffix) => {
     const parserName = generateParserName(refToName(ref, suffix));
     const acc = safeAccessor('input', key);
     // Presence gating (not truthiness) so a falsy-but-present value is still parsed.
-    return `...(${acc} !== undefined && { ${safeKey(key)}: validateArray(${acc}, ${parserName}) })`;
+    return `...(${acc} !== undefined && { ${safeLiteralKey(key)}: validateArray(${acc}, ${parserName}) })`;
 };
 /**
  * Generates a validateRecord call for required object properties with additionalProperties $ref.
@@ -86,14 +98,14 @@ const generateOptionalRecordRefCall = (key, ref, suffix) => {
     const acc = safeAccessor('input', key);
     const parserName = generateParserName(refToName(ref, suffix));
     // Presence gating (not truthiness) so a falsy-but-present value is still parsed.
-    return `...(${acc} !== undefined && { ${safeKey(key)}: validateRecord(${acc}, ${parserName}) })`;
+    return `...(${acc} !== undefined && { ${safeLiteralKey(key)}: validateRecord(${acc}, ${parserName}) })`;
 };
 /**
  * Generates a spread entry for optional inline properties.
  * The value expression is evaluated once and omitted when undefined.
  */
 const generateOptionalInlineProperty = (key, valueExpression) => {
-    return `...((value => value === undefined ? {} : { ${safeKey(key)}: value })(${valueExpression}))`;
+    return `...((value => value === undefined ? {} : { ${safeLiteralKey(key)}: value })(${valueExpression}))`;
 };
 /**
  * Determines if a property schema should use ref imports for validation.
@@ -147,7 +159,7 @@ const shouldUseRecordRefImport = (propSchema, useRefImports) => {
 /**
  * Generates the value expression for a property based on its schema and options.
  */
-const generatePropertyValue = (key, propSchema, isRequired, useRefImports, suffix) => {
+const generatePropertyValue = (key, propSchema, isRequired, useRefImports, suffix, caseInsensitive = false) => {
     // Handle direct $ref properties
     if (shouldUseRefImport(propSchema, useRefImports)) {
         const ref = propSchema.$ref;
@@ -173,20 +185,20 @@ const generatePropertyValue = (key, propSchema, isRequired, useRefImports, suffi
     }
     // Generate standard validation expression
     const defaultValue = getDefaultValue(propSchema);
-    const valueExpression = generateValidationExpression(key, propSchema, defaultValue, isRequired);
+    const valueExpression = generateValidationExpression(key, propSchema, defaultValue, isRequired, undefined, undefined, undefined, undefined, caseInsensitive);
     return isRequired ? valueExpression : generateOptionalInlineProperty(key, valueExpression);
 };
 /**
  * Generates property entries for all properties in the schema.
  */
-const generatePropertyEntries = (schema, useRefImports, suffix) => {
+const generatePropertyEntries = (schema, useRefImports, suffix, caseInsensitive = false) => {
     if (!hasProperties(schema)) {
         return [];
     }
     const entries = [];
     for (const [key, propSchema] of Object.entries(schema.properties)) {
         const isRequired = isPropertyRequired(key, schema);
-        const value = generatePropertyValue(key, propSchema, isRequired, useRefImports, suffix);
+        const value = generatePropertyValue(key, propSchema, isRequired, useRefImports, suffix, caseInsensitive);
         // Determine if the property uses spread syntax (making it optional in the object literal)
         const isOptional = value.startsWith('...');
         entries.push({ key, value, isOptional });
@@ -255,7 +267,7 @@ const generateFallbackObject = (schema, useRefImports, typeName, suffix, subType
             if (fallbackValue === 'undefined') {
                 return `{} as ${typeName}`;
             }
-            requiredProps.push(`        ${safeKey(key)}: ${fallbackValue},`);
+            requiredProps.push(`        ${safeLiteralKey(key)}: ${fallbackValue},`);
         }
     }
     if (requiredProps.length === 0) {
@@ -419,7 +431,11 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         if (hasEnum(schema) && schema.enum.length > 0) {
             const values = JSON.stringify(schema.enum);
             const fallback = JSON.stringify(schema.enum[0]);
-            return `export const ${functionName} = (input: unknown): ${typeName} => ${values}.includes(input as never) ? input as ${typeName} : ${fallback} as ${typeName};`;
+            // Case-insensitive normalization sits on the non-member branch only, so an
+            // exact member still returns via the `includes` fast path untouched.
+            const ci = unionCtx?.caseInsensitive ? generateEnumCaseInsensitiveCoercion('input', schema.enum, fallback) : null;
+            const coerced = ci ? `(${ci})` : fallback;
+            return `export const ${functionName} = (input: unknown): ${typeName} => ${values}.includes(input as never) ? input as ${typeName} : ${coerced} as ${typeName};`;
         }
         // A top-level union must validate membership: an unmatched value is not of
         // the declared union type, so coerce it to a member-shaped default. Reuse the
@@ -451,6 +467,10 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         !Array.isArray(schema.items)) {
         const items = schema.items;
         const notArrayThrow = `if (!Array.isArray(input)) throw new Error(\`[${typeName}] expected array, got \${input === null ? "null" : typeof input}\`);`;
+        // This delegating path bypasses generateScalarStrictAssertion, so enforce the
+        // array-level `contains` constraint here too — otherwise a root array of
+        // objects/$refs would silently ignore it in strict mode.
+        const strictArrayChecks = strict ? generateContainsCheck('input', schema, `[${typeName}]`).join('\n') : '';
         // validateArray identity-returns the input array when every element parses
         // to itself; this parser is EXPORTED, and exported parsers never alias the
         // value the caller passed in (matching the scalar root-array path's
@@ -458,7 +478,7 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         // element references are still shared, like every other fast path.
         const delegatedBody = (itemParserName) => `  const _parsed = validateArray(input, ${itemParserName});\n  return (_parsed === input ? [..._parsed] : _parsed) as ${typeName};`;
         const delegated = (itemParserName) => strict
-            ? `export const ${functionName} = (input: unknown): ${typeName} => {\n  ${notArrayThrow}\n${delegatedBody(itemParserName)}\n};`
+            ? `export const ${functionName} = (input: unknown): ${typeName} => {\n  ${notArrayThrow}${strictArrayChecks ? `\n${strictArrayChecks}` : ''}\n${delegatedBody(itemParserName)}\n};`
             : `export const ${functionName} = (input: unknown): ${typeName} => {\n${delegatedBody(itemParserName)}\n};`;
         if (unionCtx?.useRefImports && isSchemaObject(items) && hasRef(items)) {
             return delegated(generateParserName(refToName(items.$ref, unionCtx.suffix)));
@@ -477,7 +497,7 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
             const preamble = [
                 `type ${itemName} = ${typeName}[number];`,
                 generateShapeValidator(items, itemName, useRefImports, suffix, false, stripUnknown, reserved),
-                generateObjectParser(items, itemName, useRefImports, suffix, unionCtx?.logWarnings ?? false, strict, false, stripUnknown, unionCtx?.rootSchema, reserved),
+                generateObjectParser(items, itemName, useRefImports, suffix, unionCtx?.logWarnings ?? false, strict, false, stripUnknown, unionCtx?.rootSchema, reserved, unionCtx?.caseInsensitive ?? false),
             ].join('\n\n');
             return `${preamble}\n\n${delegated(generateParserName(itemName))}`;
         }
@@ -490,7 +510,7 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         return `export const ${functionName} = (input: unknown): ${typeName} => null as ${typeName};`;
     }
     if (strict) {
-        const assertion = generateScalarStrictAssertion(schema, typeName);
+        const assertion = generateScalarStrictAssertion(schema, typeName, unionCtx?.rootSchema);
         if (assertion === null) {
             return `export const ${functionName} = (input: unknown): ${typeName} => input as ${typeName};`;
         }
@@ -508,10 +528,17 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         case 'boolean':
             return `export const ${functionName} = (input: unknown): ${typeName} => typeof input === "boolean" ? input as ${typeName} : false as ${typeName};`;
         case 'array': {
+            // Tuple `prefixItems`: coerce each declared position and, under items:false,
+            // drop elements past the tuple length. A non-array coerces to an empty array.
+            const prefixItems = getPrefixItems(schema);
+            if (prefixItems) {
+                const mapped = generatePrefixItemsMap('input', prefixItems, prefixItemsCapsLength(schema), unionCtx?.rootSchema, undefined, unionCtx?.caseInsensitive);
+                return `export const ${functionName} = (input: unknown): ${typeName} => Array.isArray(input) ? ${mapped} as ${typeName} : [] as ${typeName};`;
+            }
             // Coerce each element when the item schema is a single scalar type or an enum.
             if (hasItems(schema) && !Array.isArray(schema.items) && isCoercibleItemSchema(schema.items)) {
                 const item = schema.items;
-                const itemExpr = generateValidationExpression('', item, getDefaultValue(item), true, undefined, undefined, '_it', true);
+                const itemExpr = generateValidationExpression('', item, getDefaultValue(item), true, undefined, undefined, '_it', true, unionCtx?.caseInsensitive);
                 return `export const ${functionName} = (input: unknown): ${typeName} => Array.isArray(input) ? (input as unknown[]).map((_it) => ${itemExpr}) as ${typeName} : [] as ${typeName};`;
             }
             return `export const ${functionName} = (input: unknown): ${typeName} => Array.isArray(input) ? [...input] as ${typeName} : [] as ${typeName};`;
@@ -520,15 +547,33 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
             return `export const ${functionName} = (input: unknown): ${typeName} => input as ${typeName};`;
     }
 };
+/**
+ * Object-level keyword checks (`propertyNames` / `dependentSchemas` /
+ * `dependentRequired`) rendered as a newline-prefixed prelude for the
+ * specialized strict object parsers (empty-object, pattern-properties,
+ * additionalProperties, combined) that build their result outside
+ * generateObjectStrictAssertion. Each of those emits its own
+ * `if (!isObject(input)) throw` first, so the checks run against a proven object
+ * (`guard = false`). Returns `''` when the schema carries none of the keywords,
+ * so existing output for every other schema is byte-for-byte unchanged.
+ */
+const strictObjectKeywordPrelude = (schema, typeName) => {
+    if (!isSchemaObject(schema))
+        return '';
+    const lines = generateObjectKeywordChecks('input', schema, `[${typeName}]`, false);
+    return lines.length > 0 ? `\n${lines.join('\n')}` : '';
+};
 /**
  * Generates a parser for empty object schemas or schemas with only additionalProperties.
  * Validates the input is an object before casting, falling back to an empty object.
- * Returns a shallow copy to avoid mutating the original input.
+ * Returns a shallow copy to avoid mutating the original input. `schema`, when
+ * given, supplies any object-level keyword checks the strict parser must enforce.
  */
-const generateEmptyObjectParser = (typeName, strict) => {
+const generateEmptyObjectParser = (typeName, strict, schema) => {
     const functionName = generateParserName(typeName);
     if (strict) {
-        return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return { ...input } as ${typeName};\n};`;
+        const prelude = schema !== undefined ? strictObjectKeywordPrelude(schema, typeName) : '';
+        return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${prelude}\n  return { ...input } as ${typeName};\n};`;
     }
     return `export const ${functionName} = (input: unknown): ${typeName} => isObject(input) ? { ...input } as ${typeName} : {} as ${typeName};`;
 };
@@ -664,12 +709,12 @@ const shouldCacheVariable = (propSchema, _canFastPath, _useRefImports) => {
  * - Fast path that returns input directly when all properties are already valid
  * - Slow path with optimized expressions
  */
-const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnings, strict, exported = true, stripUnknown = false, rootSchema, reservedNames = NO_RESERVED_NAMES) => {
+const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnings, strict, exported = true, stripUnknown = false, rootSchema, reservedNames = NO_RESERVED_NAMES, caseInsensitive = false) => {
     const functionName = generateParserName(typeName);
     const exportPrefix = exported ? 'export ' : '';
     if (!hasProperties(schema)) {
         if (strict) {
-            return `${exportPrefix}const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return input as ${typeName};\n};`;
+            return `${exportPrefix}const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${strictObjectKeywordPrelude(schema, typeName)}\n  return input as ${typeName};\n};`;
         }
         return `${exportPrefix}const ${functionName} = (input: unknown): ${typeName} => isObject(input) ? input as ${typeName} : {} as ${typeName};`;
     }
@@ -690,7 +735,7 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
         const propSchema = schemaProps[key];
         preamble.push(`type ${subName} = ${typeName}[${JSON.stringify(key)}];`);
         preamble.push(generateShapeValidator(propSchema, subName, useRefImports, suffix, false, stripUnknown, reservedNames));
-        preamble.push(generateObjectParser(propSchema, subName, useRefImports, suffix, logWarnings, strict, false, stripUnknown, rootSchema, reservedNames));
+        preamble.push(generateObjectParser(propSchema, subName, useRefImports, suffix, logWarnings, strict, false, stripUnknown, rootSchema, reservedNames, caseInsensitive));
     }
     for (const [key, subName] of subItemNames) {
         const propSchema = schemaProps[key];
@@ -701,7 +746,7 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
         // Hand-rolled loop instead of Array.prototype.every on the guard path — the
         // callback protocol costs a few percent on element-heavy hot paths.
         preamble.push(`const _every${subName} = (arr: readonly unknown[]): boolean => {\n  for (let i = 0; i < arr.length; i++) if (!${shapeValidatorName(subName)}(arr[i])) return false;\n  return true;\n};`);
-        preamble.push(generateObjectParser(itemSchema, subName, useRefImports, suffix, logWarnings, strict, false, stripUnknown, rootSchema, reservedNames));
+        preamble.push(generateObjectParser(itemSchema, subName, useRefImports, suffix, logWarnings, strict, false, stripUnknown, rootSchema, reservedNames, caseInsensitive));
     }
     // additionalProperties: false — the per-key "is this undeclared" test inlines
     // `!==` comparisons for a short key list and hoists a Set only for a long one
@@ -745,7 +790,12 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
         isSchemaObject(schema) &&
         hasAllOf(schema) &&
         schema.allOf.some((entry) => isSchemaObject(entry) && hasRef(entry));
-    let canFastPath = !hasAllOfRefParsers;
+    // Object-level keywords the fast path cannot mirror (dependentRequired,
+    // dependentSchemas, propertyNames) force the slow path so the strict assertion
+    // actually runs them; returning `{ ...input }` on a bare shape match would skip
+    // the enforcement. (A property-level blocker like `contains` is already caught
+    // per-property by generatePropertyTypeCheck returning null.)
+    let canFastPath = !hasAllOfRefParsers && !hasFastPathBlockingKeyword(schema);
     const fastPathChecks = [];
     // `toVarName` collapses distinct keys that differ only in non-identifier chars
     // (e.g. `a-b` and `a.b` both → `_a_b`), which would emit two `const _a_b`
@@ -814,7 +864,7 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
     // stripUnknown input — which carries extras the build removes, and nested
     // extras each sub-parser removes — while the cold path's per-property
     // assertions still produce the precise error on a genuine mismatch.
-    let canShallowGuard = strict && stripUnknown && !strictKeys;
+    let canShallowGuard = strict && stripUnknown && !strictKeys && !hasFastPathBlockingKeyword(schema);
     const shallowChecks = [];
     if (canShallowGuard) {
         for (const { key, varName, isRequired, propSchema } of propInfo) {
@@ -901,10 +951,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
             if (subName) {
                 const subParserName = generateParserName(subName);
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: ${subParserName}(${accessor}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: ${subParserName}(${accessor}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: ${subParserName}(${accessor}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: ${subParserName}(${accessor}) }),`);
                 }
                 continue;
             }
@@ -916,10 +966,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
             if (itemSubName) {
                 const itemParserName = generateParserName(itemSubName);
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: validateArray(${accessor}, ${itemParserName}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: validateArray(${accessor}, ${itemParserName}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: validateArray(${accessor}, ${itemParserName}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: validateArray(${accessor}, ${itemParserName}) }),`);
                 }
                 continue;
             }
@@ -928,10 +978,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
                 const ref = propSchema.$ref;
                 const parserName = generateParserName(refToName(ref, suffix));
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: ${parserName}(${accessor}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: ${parserName}(${accessor}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: ${parserName}(${accessor}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: ${parserName}(${accessor}) }),`);
                 }
                 continue;
             }
@@ -941,10 +991,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
                 const ref = items.$ref;
                 const parserName = generateParserName(refToName(ref, suffix));
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: validateArray(${accessor}, ${parserName}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: validateArray(${accessor}, ${parserName}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: validateArray(${accessor}, ${parserName}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: validateArray(${accessor}, ${parserName}) }),`);
                 }
                 continue;
             }
@@ -954,17 +1004,17 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
                 const ref = additionalProps.$ref;
                 const parserName = generateParserName(refToName(ref, suffix));
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: validateRecord(${accessor}, ${parserName}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: validateRecord(${accessor}, ${parserName}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: validateRecord(${accessor}, ${parserName}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: validateRecord(${accessor}, ${parserName}) }),`);
                 }
                 continue;
             }
             // Handle non-schema-object properties
             if (!isSchemaObject(propSchema)) {
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: undefined,`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: undefined,`);
                 }
                 continue;
             }
@@ -979,13 +1029,13 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
                 // For optional properties we know the value is not undefined because
                 // we're inside the `...(accessor !== undefined && { ... })` check.
                 const knownNotUndefined = !isRequired;
-                valueExpr = generateValidationExpression(key, propSchema, defaultValue, true, undefined, undefined, shouldCache ? varName : undefined, knownNotUndefined);
+                valueExpr = generateValidationExpression(key, propSchema, defaultValue, true, undefined, undefined, shouldCache ? varName : undefined, knownNotUndefined, caseInsensitive);
             }
             if (isRequired) {
-                objectLines.push(`    ${safeKey(key)}: ${valueExpr},`);
+                objectLines.push(`    ${safeLiteralKey(key)}: ${valueExpr},`);
             }
             else {
-                objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: ${valueExpr} }),`);
+                objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: ${valueExpr} }),`);
             }
         }
         return objectLines;
@@ -1027,15 +1077,15 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
         for (const { key, varName, isRequired, propSchema } of propInfo) {
             if (!isSchemaObject(propSchema)) {
                 if (isRequired)
-                    fields.push(`    ${safeKey(key)}: undefined,`);
+                    fields.push(`    ${safeLiteralKey(key)}: undefined,`);
                 continue;
             }
             const accessor = shouldCacheVariable(propSchema, canFastPath, useRefImports)
                 ? varName
                 : safeAccessor('input', key);
             fields.push(isRequired
-                ? `    ${safeKey(key)}: ${accessor},`
-                : `    ...(${accessor} !== undefined && { ${safeKey(key)}: ${accessor} }),`);
+                ? `    ${safeLiteralKey(key)}: ${accessor},`
+                : `    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: ${accessor} }),`);
         }
         lines.push(`  if (${deepGuard}) return {`);
         lines.push(fields.join('\n'));
@@ -1143,6 +1193,21 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
  * its imported parser when ref imports are on), and every other key is rejected
  * in strict mode or stripped in coerce mode — matching the interpreter.
  */
+/**
+ * Emits a prototype-safe `result[key] = value` for the dynamic `for..in` copy
+ * loops in the pattern-property parsers. A bare `result[key] = v` is a `[[Set]]`
+ * — and for the key `"__proto__"` (own-enumerable when the input came from
+ * `JSON.parse`) it invokes the inherited `Object.prototype` setter and reassigns
+ * `result`'s prototype to attacker-controlled data, the same vector
+ * `validateRecord` guards against. `"__proto__"` is the only own-enumerable key
+ * whose name resolves to an accessor on `Object.prototype` (`constructor` et al.
+ * are writable data properties, so a `[[Set]]` there just creates an own key),
+ * so a single-keyed guard is sufficient. Each loop already runs a `.test(key)`
+ * regex per iteration, which dominates the cost, so the extra `===` on the
+ * common path is immeasurable. Assumes the target variable is named `result`,
+ * as it is in every parser that calls this.
+ */
+const safeResultAssign = (keyVar, valueExpr) => `if (${keyVar} === "__proto__") { Object.defineProperty(result, ${keyVar}, { value: ${valueExpr}, writable: true, enumerable: true, configurable: true }); } else { (result as Record<string, unknown>)[${keyVar}] = ${valueExpr}; }`;
 const generateStrictCombinedParser = (schema, typeName, functionName, propertyLines, patterns, useRefImports, suffix, strict) => {
     const declaredKeys = hasProperties(schema) ? Object.keys(schema.properties) : [];
     // Below the inline threshold a key === "a" || key === "b" chain skips declared
@@ -1155,7 +1220,7 @@ const generateStrictCombinedParser = (schema, typeName, functionName, propertyLi
     if (refPattern) {
         const parserName = generateParserName(refToName(refPattern[1].$ref, suffix));
         loopLines.push(`    if (/${escapeRegexPattern(refPattern[0])}/.test(key)) {`);
-        loopLines.push(`      (result as Record<string, unknown>)[key] = ${parserName}(input[key]);`);
+        loopLines.push(`      ${safeResultAssign('key', `${parserName}(input[key])`)}`);
         loopLines.push(`      continue;`);
         loopLines.push(`    }`);
     }
@@ -1164,7 +1229,7 @@ const generateStrictCombinedParser = (schema, typeName, functionName, propertyLi
         .map(([p]) => `/${escapeRegexPattern(p)}/.test(key)`);
     if (keepConditions.length > 0) {
         loopLines.push(`    if (${keepConditions.join(' || ')}) {`);
-        loopLines.push(`      (result as Record<string, unknown>)[key] = input[key];`);
+        loopLines.push(`      ${safeResultAssign('key', 'input[key]')}`);
         loopLines.push(`      continue;`);
         loopLines.push(`    }`);
     }
@@ -1178,10 +1243,11 @@ const generateStrictCombinedParser = (schema, typeName, functionName, propertyLi
     const resultBody = propertyLines.length > 0 ? `{\n${propertyLines.join('\n')}\n  }` : '{}';
     // Only the Set form needs a declaration; the inline === chain is stateless.
     const knownKeysDeclaration = knownKeyCheck.declarations.map((decl) => `  ${decl};\n`).join('');
+    const keywordPrelude = strict ? strictObjectKeywordPrelude(schema, typeName) : '';
     return `export const ${functionName} = (input: unknown): ${typeName} => {
   if (!isObject(input)) {
 ${notObjectBranch}
-  }
+  }${keywordPrelude}
 ${knownKeysDeclaration}  const result = ${resultBody} as unknown as ${typeName};
   for (const key in input) {
 ${loopLines.join('\n')}
@@ -1193,19 +1259,19 @@ ${loopLines.join('\n')}
  * Generates a parser for schemas that have both properties AND patternProperties.
  * Parses the known properties first, then iterates remaining keys to match patterns.
  */
-const generateCombinedObjectParser = (schema, typeName, useRefImports, suffix, logWarnings, strict, stripUnknown = false) => {
+const generateCombinedObjectParser = (schema, typeName, useRefImports, suffix, logWarnings, strict, stripUnknown = false, caseInsensitive = false) => {
     const functionName = generateParserName(typeName);
-    const entries = generatePropertyEntries(schema, useRefImports, suffix);
+    const entries = generatePropertyEntries(schema, useRefImports, suffix, caseInsensitive);
     // Build the known property lines for the initial object
     const propertyLines = entries.map((entry) => {
         if (entry.isOptional) {
             return `    ${entry.value},`;
         }
-        return `    ${safeKey(entry.key)}: ${entry.value},`;
+        return `    ${safeLiteralKey(entry.key)}: ${entry.value},`;
     });
     // Find the first pattern with a $ref for parser delegation
     if (!isSchemaObject(schema) || !('patternProperties' in schema)) {
-        return generateObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown);
+        return generateObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown, undefined, NO_RESERVED_NAMES, caseInsensitive);
     }
     const patternProps = schema.patternProperties;
     const patterns = Object.entries(patternProps);
@@ -1219,7 +1285,7 @@ const generateCombinedObjectParser = (schema, typeName, useRefImports, suffix, l
         return generateStrictCombinedParser(schema, typeName, functionName, propertyLines, patterns, useRefImports, suffix, strict);
     }
     if (!refPattern || !useRefImports) {
-        return generateObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown);
+        return generateObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown, undefined, NO_RESERVED_NAMES, caseInsensitive);
     }
     const [pattern, patternSchema] = refPattern;
     const ref = patternSchema.$ref;
@@ -1236,10 +1302,11 @@ const generateCombinedObjectParser = (schema, typeName, useRefImports, suffix, l
     const notObjectBranch = strict
         ? `    throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);`
         : `    return {} as unknown as ${typeName};`;
+    const keywordPrelude = strict ? strictObjectKeywordPrelude(schema, typeName) : '';
     return `export const ${functionName} = (input: unknown): ${typeName} => {
   if (!isObject(input)) {
 ${notObjectBranch}
-  }
+  }${keywordPrelude}
   const result = {
 ${objectProperties}
   } as unknown as ${typeName};
@@ -1260,14 +1327,15 @@ const generateAdditionalPropertiesParser = (schema, typeName, useRefImports, suf
     const additionalProps = schema.additionalProperties;
     // Check if additionalProps is defined before using it
     if (!additionalProps) {
-        return generateEmptyObjectParser(typeName, strict);
+        return generateEmptyObjectParser(typeName, strict, schema);
     }
+    const keywordPrelude = strict ? strictObjectKeywordPrelude(schema, typeName) : '';
     // If additionalProperties is a $ref and useRefImports is true, generate a loop
     if (useRefImports && isSchemaObject(additionalProps) && hasRef(additionalProps)) {
         const ref = additionalProps.$ref;
         const parserName = generateParserName(refToName(ref, suffix));
         if (strict) {
-            return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return validateRecord(input, ${parserName}) as ${typeName};\n};`;
+            return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${keywordPrelude}\n  return validateRecord(input, ${parserName}) as ${typeName};\n};`;
         }
         return `export const ${functionName} = (input: unknown): ${typeName} => validateRecord(input, ${parserName}) as ${typeName};`;
     }
@@ -1276,14 +1344,14 @@ const generateAdditionalPropertiesParser = (schema, typeName, useRefImports, suf
         const inlineParser = generateInlineValueParser(additionalProps);
         if (inlineParser) {
             if (strict) {
-                return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return validateRecord(input, ${inlineParser}) as ${typeName};\n};`;
+                return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${keywordPrelude}\n  return validateRecord(input, ${inlineParser}) as ${typeName};\n};`;
             }
             return `export const ${functionName} = (input: unknown): ${typeName} => validateRecord(input, ${inlineParser}) as ${typeName};`;
         }
     }
     // Otherwise, just validate the input type and shallow copy
     if (strict) {
-        return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return { ...input } as ${typeName};\n};`;
+        return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${keywordPrelude}\n  return { ...input } as ${typeName};\n};`;
     }
     return `export const ${functionName} = (input: unknown): ${typeName} => isObject(input) ? { ...input } as ${typeName} : {};`;
 };
@@ -1302,8 +1370,11 @@ const generateInlineValueParser = (schema) => {
         case 'string':
             return '(value: unknown) => typeof value === "string" ? value : ""';
         case 'number':
-        case 'integer':
             return '(value: unknown) => typeof value === "number" ? value : 0';
+        case 'integer':
+            // `integer` rejects non-integral numbers; a bare typeof accepts `1.5`,
+            // matching every other integer site in this package (and strict mode).
+            return '(value: unknown) => typeof value === "number" && Number.isInteger(value) ? value : 0';
         case 'boolean':
             return '(value: unknown) => typeof value === "boolean" ? value : false';
         case 'array':
@@ -1319,47 +1390,53 @@ const generateInlineValueParser = (schema) => {
 const generatePatternPropertiesParser = (schema, typeName, useRefImports, suffix, strict) => {
     const functionName = generateParserName(typeName);
     if (!('patternProperties' in schema) || typeof schema.patternProperties !== 'object') {
-        return generateEmptyObjectParser(typeName, strict);
+        return generateEmptyObjectParser(typeName, strict, schema);
     }
     const patternProps = schema.patternProperties;
     // Find the first pattern and its schema
     const patterns = Object.entries(patternProps);
     if (patterns.length === 0) {
-        return generateEmptyObjectParser(typeName, strict);
+        return generateEmptyObjectParser(typeName, strict, schema);
     }
     const [pattern, patternSchema] = patterns[0];
     let patternAssignment = '(result as Record<string, unknown>)[key] = value;';
+    // The value-expression form, used by the strictKeys path (which builds from
+    // `{}`) to emit a prototype-safe assignment. `null` when no value is allowed.
+    let patternValueExpr = 'value';
     // Use imported parser when pattern schema points to a $ref.
     if (useRefImports && isSchemaObject(patternSchema) && hasRef(patternSchema)) {
         const ref = patternSchema.$ref;
         const parserName = generateParserName(refToName(ref, suffix));
         patternAssignment = `(result as Record<string, unknown>)[key] = ${parserName}(value);`;
+        patternValueExpr = `${parserName}(value)`;
     }
     else if (patternSchema === false) {
         // `false` means no values are allowed for matching keys.
         patternAssignment = '';
+        patternValueExpr = null;
     }
     // Escape the pattern for safe inclusion in generated code
     const escapedPattern = escapeRegexPattern(pattern);
     const notObjectBranch = strict
         ? `    throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);`
         : `    return {} as unknown as ${typeName};`;
+    const keywordPrelude = strict ? strictObjectKeywordPrelude(schema, typeName) : '';
     // With `additionalProperties: false`, only keys matching a pattern survive:
     // others are rejected (strict) or stripped (coerce). Start from an empty
     // object rather than spreading every input key.
     const strictKeys = hasAdditionalProperties(schema) && schema.additionalProperties === false;
     if (strictKeys) {
         const loopLines = [`    if (/${escapedPattern}/.test(key)) {`];
-        if (patternAssignment) {
+        if (patternValueExpr) {
             loopLines.push(`      const value = input[key];`);
-            loopLines.push(`      ${patternAssignment}`);
+            loopLines.push(`      ${safeResultAssign('key', patternValueExpr)}`);
         }
         loopLines.push(`      continue;`);
         loopLines.push(`    }`);
         const keepConditions = patterns.slice(1).map(([p]) => `/${escapeRegexPattern(p)}/.test(key)`);
         if (keepConditions.length > 0) {
             loopLines.push(`    if (${keepConditions.join(' || ')}) {`);
-            loopLines.push(`      (result as Record<string, unknown>)[key] = input[key];`);
+            loopLines.push(`      ${safeResultAssign('key', 'input[key]')}`);
             loopLines.push(`      continue;`);
             loopLines.push(`    }`);
         }
@@ -1368,7 +1445,7 @@ const generatePatternPropertiesParser = (schema, typeName, useRefImports, suffix
         return `export const ${functionName} = (input: unknown): ${typeName} => {
   if (!isObject(input)) {
 ${notObjectBranch}
-  }
+  }${keywordPrelude}
   const result = {} as unknown as ${typeName};
   for (const key in input) {
 ${loopLines.join('\n')}
@@ -1380,7 +1457,7 @@ ${loopLines.join('\n')}
     return `export const ${functionName} = (input: unknown): ${typeName} => {
   if (!isObject(input)) {
 ${notObjectBranch}
-  }
+  }${keywordPrelude}
   const result = {
     ...input,
   } as unknown as ${typeName};
@@ -1398,7 +1475,7 @@ ${notObjectBranch}
  * This always generates parser calls regardless of useRefImports setting,
  * because conditional logic requires delegating to the appropriate parser.
  */
-const generateConditionalParser = (schema, typeName, suffix, stripUnknown = false) => {
+const generateConditionalParser = (schema, typeName, suffix, stripUnknown = false, caseInsensitive = false) => {
     const functionName = generateParserName(typeName);
     // Extract the condition and branches
     const ifSchema = schema.if;
@@ -1413,7 +1490,7 @@ const generateConditionalParser = (schema, typeName, suffix, stripUnknown = fals
         // regular object parser from the merged property set.
         const mergedSchema = getConditionalObjectSchema(schema);
         if (mergedSchema) {
-            return generateObjectParser(mergedSchema, typeName, false, suffix, false, false, true, stripUnknown);
+            return generateObjectParser(mergedSchema, typeName, false, suffix, false, false, true, stripUnknown, undefined, NO_RESERVED_NAMES, caseInsensitive);
         }
         return generateEmptyObjectParser(typeName);
     }
@@ -1427,7 +1504,7 @@ const generateConditionalParser = (schema, typeName, suffix, stripUnknown = fals
         // Condition is not a $ref check — flatten into an object parser
         const mergedSchema = getConditionalObjectSchema(schema);
         if (mergedSchema) {
-            return generateObjectParser(mergedSchema, typeName, false, suffix, false, false, true, stripUnknown);
+            return generateObjectParser(mergedSchema, typeName, false, suffix, false, false, true, stripUnknown, undefined, NO_RESERVED_NAMES, caseInsensitive);
         }
         return generateEmptyObjectParser(typeName);
     }
@@ -1523,6 +1600,7 @@ const selectParserStrategy = (schema, typeName, options) => {
     const logWarnings = options?.logWarnings ?? false;
     const strict = options?.strict ?? false;
     const stripUnknown = options?.stripUnknown ?? false;
+    const caseInsensitive = options?.caseInsensitive ?? false;
     const suffix = options?.typeSuffix ?? '';
     // Special case for the self-referential JSON Schema meta-schema type (e.g.
     // `Schema` / `SchemaObject`) - it can be any JSON Schema. This is an OpenAPI
@@ -1541,6 +1619,7 @@ const selectParserStrategy = (schema, typeName, options) => {
             useRefImports,
             suffix,
             stripUnknown,
+            caseInsensitive,
             logWarnings,
             ...(options?.rootSchema !== undefined ? { rootSchema: options.rootSchema } : {}),
             ...(options?.reservedNames !== undefined ? { reservedNames: options.reservedNames } : {}),
@@ -1550,24 +1629,24 @@ const selectParserStrategy = (schema, typeName, options) => {
     // This generates a parser that handles known properties and also iterates
     // pattern-matched keys (e.g. responses with "default" + "200", "4XX").
     if (hasProperties(schema) && isSchemaObject(schema) && 'patternProperties' in schema) {
-        return generateCombinedObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, stripUnknown);
+        return generateCombinedObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, stripUnknown, caseInsensitive);
     }
     // Handle schemas that have explicit properties — generate a full object parser.
     // This intentionally runs before if/then checks so that schemas with both
     // properties AND conditional keywords use all declared properties rather than
     // only the if/then fragment.
     if (hasProperties(schema)) {
-        return generateObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown, options?.rootSchema, options?.reservedNames);
+        return generateObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown, options?.rootSchema, options?.reservedNames, caseInsensitive);
     }
     // Handle conditional schemas (if/then/else) for schemas without explicit properties.
     if (isSchemaObject(schema) && 'if' in schema && 'then' in schema && 'else' in schema) {
-        return generateConditionalParser(schema, typeName, suffix, stripUnknown);
+        return generateConditionalParser(schema, typeName, suffix, stripUnknown, caseInsensitive);
     }
     // Handle conditional schemas that only define if/then object fragments.
     // We flatten the fragments into a regular object parser.
     const conditionalObjectSchema = getConditionalObjectSchema(schema);
     if (conditionalObjectSchema) {
-        return generateObjectParser(conditionalObjectSchema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown);
+        return generateObjectParser(conditionalObjectSchema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown, undefined, NO_RESERVED_NAMES, caseInsensitive);
     }
     // Handle non-object schemas with type-appropriate validation (no properties, no conditionals)
     if (!isObjectLikeSchema) {
@@ -1575,6 +1654,7 @@ const selectParserStrategy = (schema, typeName, options) => {
             useRefImports,
             suffix,
             stripUnknown,
+            caseInsensitive,
             logWarnings,
             ...(options?.rootSchema !== undefined ? { rootSchema: options.rootSchema } : {}),
             ...(options?.reservedNames !== undefined ? { reservedNames: options.reservedNames } : {}),
@@ -1589,17 +1669,17 @@ const selectParserStrategy = (schema, typeName, options) => {
         const additionalProps = schema.additionalProperties;
         // If additionalProperties is true or false, validate it is an object
         if (additionalProps === true || additionalProps === false) {
-            return generateEmptyObjectParser(typeName, strict);
+            return generateEmptyObjectParser(typeName, strict, schema);
         }
         // Otherwise, handle as a schema (could be a $ref or object schema)
         return generateAdditionalPropertiesParser(schema, typeName, useRefImports, suffix, strict);
     }
     // Handle empty object schemas
     if ('type' in schema && schema.type === 'object' && !hasProperties(schema)) {
-        return generateEmptyObjectParser(typeName, strict);
+        return generateEmptyObjectParser(typeName, strict, schema);
     }
     // Default fallback - validate it is an object since we passed the isObjectSchema check
-    return generateEmptyObjectParser(typeName, strict);
+    return generateEmptyObjectParser(typeName, strict, schema);
 };
 /**
  * Generates a safe parser as an arrow function that never throws.
@@ -1611,6 +1691,12 @@ const selectParserStrategy = (schema, typeName, options) => {
  * $ref will map each element through the imported parser.
  */
 export const generateParserFunction = (schema, typeName, options) => {
+    // Strict parsers promise to throw on violations, so any keyword we cannot
+    // enforce must fail loudly at generation rather than emit a permissive parser.
+    // Coercing parsers are documented to repair rather than reject, so the guard
+    // does not apply to them.
+    if (options?.strict)
+        assertNoUnsupportedKeywords(schema, typeName);
     return selectParserStrategy(schema, typeName, options);
 };
 /**
@@ -1637,6 +1723,12 @@ export const generateShapeValidator = (schema, typeName, useRefImports, suffix =
     const stub = `${exportPrefix}const ${fnName} = (_input: unknown): boolean => false;`;
     if (!isSchemaObject(schema))
         return stub;
+    // Keywords the parser's fast path cannot mirror (contains, dependentRequired,
+    // dependentSchemas, propertyNames) make a bare shape match insufficient: a
+    // parent that fast-pathed through this predicate would skip their enforcement,
+    // so stub out and force the parent's slow path (which calls the real parser).
+    if (hasFastPathBlockingKeyword(schema))
+        return stub;
     // An alias definition (a bare `$ref` with no shape of its own) delegates to
     // the referenced type's validator. Guarded against self-reference.
     if (useRefImports && hasRef(schema) && !hasProperties(schema)) {