@amritk/generate-parsers 0.16.0 → 0.16.2

package/dist/generators/generate-parser-function.js

@@ -8,10 +8,11 @@ import { unknownKeyCheck } from '@amritk/helpers/unknown-key-check';
 import { findDiscriminator } from '../helpers/find-discriminator.js';
 import { getDefaultValue } from '../helpers/get-default-value.js';
 import { getDiscriminatorValue } from '../helpers/get-discriminator-value.js';
+import { assertNoUnsupportedKeywords } from './assert-supported-keywords.js';
 import { generateEnumCaseInsensitiveCoercion } from './generate-enum-check.js';
-import { generateObjectStrictAssertion, generateScalarStrictAssertion } from './generate-strict-assertion.js';
-import { canEnforceUnion, generatePropertyTypeCheck, generateUnionCheck, getUnionBranches, isInlineObjectArrayProperty, isInlineObjectProperty, shapeValidatorName, } from './generate-type-checks.js';
-import { generateValidationExpression, isCoercibleItemSchema } from './generate-validation-expression.js';
+import { generateContainsCheck, generateObjectKeywordChecks, generateObjectStrictAssertion, generateScalarStrictAssertion, } from './generate-strict-assertion.js';
+import { canEnforceUnion, generatePropertyTypeCheck, generateUnionCheck, getUnionBranches, hasFastPathBlockingKeyword, isInlineObjectArrayProperty, isInlineObjectProperty, shapeValidatorName, } from './generate-type-checks.js';
+import { generatePrefixItemsMap, generateValidationExpression, getPrefixItems, isCoercibleItemSchema, prefixItemsCapsLength, } from './generate-validation-expression.js';
 /**
  * Generates the parser function name from a type name.
  * Converts "UserObject" to "parseUserObject".
@@ -19,6 +20,16 @@ import { generateValidationExpression, isCoercibleItemSchema } from './generate-
 const generateParserName = (typeName) => {
     return `parse${typeName}`;
 };
+/**
+ * Object-literal key form that is safe for the runtime-dangerous name
+ * `__proto__`. In an object literal `{ __proto__: v }` / `{ "__proto__": v }` is
+ * the special prototype-setter syntax — it never creates an own property — so a
+ * schema property literally named `__proto__` would silently vanish (and, for an
+ * object value, reassign the result's prototype). The computed form
+ * `{ ["__proto__"]: v }` creates a normal own property. Every other key keeps
+ * the plain `safeKey` output, so the common path is unchanged.
+ */
+const safeLiteralKey = (key) => (key === '__proto__' ? '["__proto__"]' : safeKey(key));
 /**
  * Checks if a property is required based on the schema's required array.
  */
@@ -50,7 +61,7 @@ const generateOptionalRefCall = (key, ref, suffix) => {
     // Gate on presence, not truthiness: a `&&` guard skips parsing when the value
     // is `false`/`0`/`""`/`null`, spreading it raw. `!== undefined` still omits an
     // absent optional property but coerces every present one, matching the main path.
-    return `...(${acc} !== undefined && { ${safeKey(key)}: ${parserName}(${acc}) })`;
+    return `...(${acc} !== undefined && { ${safeLiteralKey(key)}: ${parserName}(${acc}) })`;
 };
 /**
  * Generates a validateArray call for required array properties with $ref items.
@@ -68,7 +79,7 @@ const generateOptionalArrayRefCall = (key, ref, suffix) => {
     const parserName = generateParserName(refToName(ref, suffix));
     const acc = safeAccessor('input', key);
     // Presence gating (not truthiness) so a falsy-but-present value is still parsed.
-    return `...(${acc} !== undefined && { ${safeKey(key)}: validateArray(${acc}, ${parserName}) })`;
+    return `...(${acc} !== undefined && { ${safeLiteralKey(key)}: validateArray(${acc}, ${parserName}) })`;
 };
 /**
  * Generates a validateRecord call for required object properties with additionalProperties $ref.
@@ -87,14 +98,14 @@ const generateOptionalRecordRefCall = (key, ref, suffix) => {
     const acc = safeAccessor('input', key);
     const parserName = generateParserName(refToName(ref, suffix));
     // Presence gating (not truthiness) so a falsy-but-present value is still parsed.
-    return `...(${acc} !== undefined && { ${safeKey(key)}: validateRecord(${acc}, ${parserName}) })`;
+    return `...(${acc} !== undefined && { ${safeLiteralKey(key)}: validateRecord(${acc}, ${parserName}) })`;
 };
 /**
  * Generates a spread entry for optional inline properties.
  * The value expression is evaluated once and omitted when undefined.
  */
 const generateOptionalInlineProperty = (key, valueExpression) => {
-    return `...((value => value === undefined ? {} : { ${safeKey(key)}: value })(${valueExpression}))`;
+    return `...((value => value === undefined ? {} : { ${safeLiteralKey(key)}: value })(${valueExpression}))`;
 };
 /**
  * Determines if a property schema should use ref imports for validation.
@@ -256,7 +267,7 @@ const generateFallbackObject = (schema, useRefImports, typeName, suffix, subType
             if (fallbackValue === 'undefined') {
                 return `{} as ${typeName}`;
             }
-            requiredProps.push(`        ${safeKey(key)}: ${fallbackValue},`);
+            requiredProps.push(`        ${safeLiteralKey(key)}: ${fallbackValue},`);
         }
     }
     if (requiredProps.length === 0) {
@@ -443,6 +454,18 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
             return `export const ${functionName} = (input: unknown): ${typeName} => input as ${typeName};`;
         }
     }
+    // Strict counterpart of the block above for a *type-less* `const`/`enum` root
+    // (`{ enum: [...] }` / `{ const: ... }` with no `type`): the no-`type` bail
+    // below would otherwise return a bare cast, so strict mode has to assert
+    // membership here. A typed `const`/`enum` (`{ type: 'string', enum: [...] }`)
+    // keeps flowing to the strict scalar path, which asserts it via
+    // generateScalarStrictAssertion.
+    if (strict && isSchemaObject(schema) && !hasType(schema) && (hasConst(schema) || hasEnum(schema))) {
+        const assertion = generateScalarStrictAssertion(schema, typeName, unionCtx?.rootSchema);
+        if (assertion !== null) {
+            return `export const ${functionName} = (input: unknown): ${typeName} => {\n${assertion}\n  return input as ${typeName};\n};`;
+        }
+    }
     // Root-level arrays with rich item schemas delegate every element to a real
     // parser, so nested enums and $refs inside array items are validated instead
     // of spread through unchecked. $ref items call the imported parser; inline
@@ -456,6 +479,10 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         !Array.isArray(schema.items)) {
         const items = schema.items;
         const notArrayThrow = `if (!Array.isArray(input)) throw new Error(\`[${typeName}] expected array, got \${input === null ? "null" : typeof input}\`);`;
+        // This delegating path bypasses generateScalarStrictAssertion, so enforce the
+        // array-level `contains` constraint here too — otherwise a root array of
+        // objects/$refs would silently ignore it in strict mode.
+        const strictArrayChecks = strict ? generateContainsCheck('input', schema, `[${typeName}]`).join('\n') : '';
         // validateArray identity-returns the input array when every element parses
         // to itself; this parser is EXPORTED, and exported parsers never alias the
         // value the caller passed in (matching the scalar root-array path's
@@ -463,7 +490,7 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         // element references are still shared, like every other fast path.
         const delegatedBody = (itemParserName) => `  const _parsed = validateArray(input, ${itemParserName});\n  return (_parsed === input ? [..._parsed] : _parsed) as ${typeName};`;
         const delegated = (itemParserName) => strict
-            ? `export const ${functionName} = (input: unknown): ${typeName} => {\n  ${notArrayThrow}\n${delegatedBody(itemParserName)}\n};`
+            ? `export const ${functionName} = (input: unknown): ${typeName} => {\n  ${notArrayThrow}${strictArrayChecks ? `\n${strictArrayChecks}` : ''}\n${delegatedBody(itemParserName)}\n};`
             : `export const ${functionName} = (input: unknown): ${typeName} => {\n${delegatedBody(itemParserName)}\n};`;
         if (unionCtx?.useRefImports && isSchemaObject(items) && hasRef(items)) {
             return delegated(generateParserName(refToName(items.$ref, unionCtx.suffix)));
@@ -495,7 +522,7 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         return `export const ${functionName} = (input: unknown): ${typeName} => null as ${typeName};`;
     }
     if (strict) {
-        const assertion = generateScalarStrictAssertion(schema, typeName);
+        const assertion = generateScalarStrictAssertion(schema, typeName, unionCtx?.rootSchema);
         if (assertion === null) {
             return `export const ${functionName} = (input: unknown): ${typeName} => input as ${typeName};`;
         }
@@ -513,6 +540,13 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
         case 'boolean':
             return `export const ${functionName} = (input: unknown): ${typeName} => typeof input === "boolean" ? input as ${typeName} : false as ${typeName};`;
         case 'array': {
+            // Tuple `prefixItems`: coerce each declared position and, under items:false,
+            // drop elements past the tuple length. A non-array coerces to an empty array.
+            const prefixItems = getPrefixItems(schema);
+            if (prefixItems) {
+                const mapped = generatePrefixItemsMap('input', prefixItems, prefixItemsCapsLength(schema), unionCtx?.rootSchema, undefined, unionCtx?.caseInsensitive);
+                return `export const ${functionName} = (input: unknown): ${typeName} => Array.isArray(input) ? ${mapped} as ${typeName} : [] as ${typeName};`;
+            }
             // Coerce each element when the item schema is a single scalar type or an enum.
             if (hasItems(schema) && !Array.isArray(schema.items) && isCoercibleItemSchema(schema.items)) {
                 const item = schema.items;
@@ -525,15 +559,33 @@ const generateNonObjectParser = (typeName, schema, strict, unionCtx) => {
             return `export const ${functionName} = (input: unknown): ${typeName} => input as ${typeName};`;
     }
 };
+/**
+ * Object-level keyword checks (`propertyNames` / `dependentSchemas` /
+ * `dependentRequired`) rendered as a newline-prefixed prelude for the
+ * specialized strict object parsers (empty-object, pattern-properties,
+ * additionalProperties, combined) that build their result outside
+ * generateObjectStrictAssertion. Each of those emits its own
+ * `if (!isObject(input)) throw` first, so the checks run against a proven object
+ * (`guard = false`). Returns `''` when the schema carries none of the keywords,
+ * so existing output for every other schema is byte-for-byte unchanged.
+ */
+const strictObjectKeywordPrelude = (schema, typeName) => {
+    if (!isSchemaObject(schema))
+        return '';
+    const lines = generateObjectKeywordChecks('input', schema, `[${typeName}]`, false);
+    return lines.length > 0 ? `\n${lines.join('\n')}` : '';
+};
 /**
  * Generates a parser for empty object schemas or schemas with only additionalProperties.
  * Validates the input is an object before casting, falling back to an empty object.
- * Returns a shallow copy to avoid mutating the original input.
+ * Returns a shallow copy to avoid mutating the original input. `schema`, when
+ * given, supplies any object-level keyword checks the strict parser must enforce.
  */
-const generateEmptyObjectParser = (typeName, strict) => {
+const generateEmptyObjectParser = (typeName, strict, schema) => {
     const functionName = generateParserName(typeName);
     if (strict) {
-        return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return { ...input } as ${typeName};\n};`;
+        const prelude = schema !== undefined ? strictObjectKeywordPrelude(schema, typeName) : '';
+        return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${prelude}\n  return { ...input } as ${typeName};\n};`;
     }
     return `export const ${functionName} = (input: unknown): ${typeName} => isObject(input) ? { ...input } as ${typeName} : {} as ${typeName};`;
 };
@@ -674,7 +726,7 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
     const exportPrefix = exported ? 'export ' : '';
     if (!hasProperties(schema)) {
         if (strict) {
-            return `${exportPrefix}const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return input as ${typeName};\n};`;
+            return `${exportPrefix}const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${strictObjectKeywordPrelude(schema, typeName)}\n  return input as ${typeName};\n};`;
         }
         return `${exportPrefix}const ${functionName} = (input: unknown): ${typeName} => isObject(input) ? input as ${typeName} : {} as ${typeName};`;
     }
@@ -750,7 +802,12 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
         isSchemaObject(schema) &&
         hasAllOf(schema) &&
         schema.allOf.some((entry) => isSchemaObject(entry) && hasRef(entry));
-    let canFastPath = !hasAllOfRefParsers;
+    // Object-level keywords the fast path cannot mirror (dependentRequired,
+    // dependentSchemas, propertyNames) force the slow path so the strict assertion
+    // actually runs them; returning `{ ...input }` on a bare shape match would skip
+    // the enforcement. (A property-level blocker like `contains` is already caught
+    // per-property by generatePropertyTypeCheck returning null.)
+    let canFastPath = !hasAllOfRefParsers && !hasFastPathBlockingKeyword(schema);
     const fastPathChecks = [];
     // `toVarName` collapses distinct keys that differ only in non-identifier chars
     // (e.g. `a-b` and `a.b` both → `_a_b`), which would emit two `const _a_b`
@@ -819,7 +876,7 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
     // stripUnknown input — which carries extras the build removes, and nested
     // extras each sub-parser removes — while the cold path's per-property
     // assertions still produce the precise error on a genuine mismatch.
-    let canShallowGuard = strict && stripUnknown && !strictKeys;
+    let canShallowGuard = strict && stripUnknown && !strictKeys && !hasFastPathBlockingKeyword(schema);
     const shallowChecks = [];
     if (canShallowGuard) {
         for (const { key, varName, isRequired, propSchema } of propInfo) {
@@ -906,10 +963,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
             if (subName) {
                 const subParserName = generateParserName(subName);
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: ${subParserName}(${accessor}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: ${subParserName}(${accessor}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: ${subParserName}(${accessor}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: ${subParserName}(${accessor}) }),`);
                 }
                 continue;
             }
@@ -921,10 +978,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
             if (itemSubName) {
                 const itemParserName = generateParserName(itemSubName);
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: validateArray(${accessor}, ${itemParserName}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: validateArray(${accessor}, ${itemParserName}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: validateArray(${accessor}, ${itemParserName}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: validateArray(${accessor}, ${itemParserName}) }),`);
                 }
                 continue;
             }
@@ -933,10 +990,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
                 const ref = propSchema.$ref;
                 const parserName = generateParserName(refToName(ref, suffix));
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: ${parserName}(${accessor}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: ${parserName}(${accessor}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: ${parserName}(${accessor}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: ${parserName}(${accessor}) }),`);
                 }
                 continue;
             }
@@ -946,10 +1003,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
                 const ref = items.$ref;
                 const parserName = generateParserName(refToName(ref, suffix));
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: validateArray(${accessor}, ${parserName}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: validateArray(${accessor}, ${parserName}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: validateArray(${accessor}, ${parserName}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: validateArray(${accessor}, ${parserName}) }),`);
                 }
                 continue;
             }
@@ -959,17 +1016,17 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
                 const ref = additionalProps.$ref;
                 const parserName = generateParserName(refToName(ref, suffix));
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: validateRecord(${accessor}, ${parserName}),`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: validateRecord(${accessor}, ${parserName}),`);
                 }
                 else {
-                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: validateRecord(${accessor}, ${parserName}) }),`);
+                    objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: validateRecord(${accessor}, ${parserName}) }),`);
                 }
                 continue;
             }
             // Handle non-schema-object properties
             if (!isSchemaObject(propSchema)) {
                 if (isRequired) {
-                    objectLines.push(`    ${safeKey(key)}: undefined,`);
+                    objectLines.push(`    ${safeLiteralKey(key)}: undefined,`);
                 }
                 continue;
             }
@@ -987,10 +1044,10 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
                 valueExpr = generateValidationExpression(key, propSchema, defaultValue, true, undefined, undefined, shouldCache ? varName : undefined, knownNotUndefined, caseInsensitive);
             }
             if (isRequired) {
-                objectLines.push(`    ${safeKey(key)}: ${valueExpr},`);
+                objectLines.push(`    ${safeLiteralKey(key)}: ${valueExpr},`);
             }
             else {
-                objectLines.push(`    ...(${accessor} !== undefined && { ${safeKey(key)}: ${valueExpr} }),`);
+                objectLines.push(`    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: ${valueExpr} }),`);
             }
         }
         return objectLines;
@@ -1032,15 +1089,15 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
         for (const { key, varName, isRequired, propSchema } of propInfo) {
             if (!isSchemaObject(propSchema)) {
                 if (isRequired)
-                    fields.push(`    ${safeKey(key)}: undefined,`);
+                    fields.push(`    ${safeLiteralKey(key)}: undefined,`);
                 continue;
             }
             const accessor = shouldCacheVariable(propSchema, canFastPath, useRefImports)
                 ? varName
                 : safeAccessor('input', key);
             fields.push(isRequired
-                ? `    ${safeKey(key)}: ${accessor},`
-                : `    ...(${accessor} !== undefined && { ${safeKey(key)}: ${accessor} }),`);
+                ? `    ${safeLiteralKey(key)}: ${accessor},`
+                : `    ...(${accessor} !== undefined && { ${safeLiteralKey(key)}: ${accessor} }),`);
         }
         lines.push(`  if (${deepGuard}) return {`);
         lines.push(fields.join('\n'));
@@ -1148,6 +1205,21 @@ const generateObjectParser = (schema, typeName, useRefImports, suffix, logWarnin
  * its imported parser when ref imports are on), and every other key is rejected
  * in strict mode or stripped in coerce mode — matching the interpreter.
  */
+/**
+ * Emits a prototype-safe `result[key] = value` for the dynamic `for..in` copy
+ * loops in the pattern-property parsers. A bare `result[key] = v` is a `[[Set]]`
+ * — and for the key `"__proto__"` (own-enumerable when the input came from
+ * `JSON.parse`) it invokes the inherited `Object.prototype` setter and reassigns
+ * `result`'s prototype to attacker-controlled data, the same vector
+ * `validateRecord` guards against. `"__proto__"` is the only own-enumerable key
+ * whose name resolves to an accessor on `Object.prototype` (`constructor` et al.
+ * are writable data properties, so a `[[Set]]` there just creates an own key),
+ * so a single-keyed guard is sufficient. Each loop already runs a `.test(key)`
+ * regex per iteration, which dominates the cost, so the extra `===` on the
+ * common path is immeasurable. Assumes the target variable is named `result`,
+ * as it is in every parser that calls this.
+ */
+const safeResultAssign = (keyVar, valueExpr) => `if (${keyVar} === "__proto__") { Object.defineProperty(result, ${keyVar}, { value: ${valueExpr}, writable: true, enumerable: true, configurable: true }); } else { (result as Record<string, unknown>)[${keyVar}] = ${valueExpr}; }`;
 const generateStrictCombinedParser = (schema, typeName, functionName, propertyLines, patterns, useRefImports, suffix, strict) => {
     const declaredKeys = hasProperties(schema) ? Object.keys(schema.properties) : [];
     // Below the inline threshold a key === "a" || key === "b" chain skips declared
@@ -1160,7 +1232,7 @@ const generateStrictCombinedParser = (schema, typeName, functionName, propertyLi
     if (refPattern) {
         const parserName = generateParserName(refToName(refPattern[1].$ref, suffix));
         loopLines.push(`    if (/${escapeRegexPattern(refPattern[0])}/.test(key)) {`);
-        loopLines.push(`      (result as Record<string, unknown>)[key] = ${parserName}(input[key]);`);
+        loopLines.push(`      ${safeResultAssign('key', `${parserName}(input[key])`)}`);
         loopLines.push(`      continue;`);
         loopLines.push(`    }`);
     }
@@ -1169,7 +1241,7 @@ const generateStrictCombinedParser = (schema, typeName, functionName, propertyLi
         .map(([p]) => `/${escapeRegexPattern(p)}/.test(key)`);
     if (keepConditions.length > 0) {
         loopLines.push(`    if (${keepConditions.join(' || ')}) {`);
-        loopLines.push(`      (result as Record<string, unknown>)[key] = input[key];`);
+        loopLines.push(`      ${safeResultAssign('key', 'input[key]')}`);
         loopLines.push(`      continue;`);
         loopLines.push(`    }`);
     }
@@ -1183,10 +1255,22 @@ const generateStrictCombinedParser = (schema, typeName, functionName, propertyLi
     const resultBody = propertyLines.length > 0 ? `{\n${propertyLines.join('\n')}\n  }` : '{}';
     // Only the Set form needs a declaration; the inline === chain is stateless.
     const knownKeysDeclaration = knownKeyCheck.declarations.map((decl) => `  ${decl};\n`).join('');
+    // In strict mode assert the declared properties (type, required, enum,
+    // constraints) — the `result` below is built from the *coercing* property
+    // lines, which silently repair a wrong type and default a missing required key
+    // instead of throwing. `generateObjectStrictAssertion` throws first; the
+    // coercing build then runs only on already-valid input (a no-op there). It also
+    // covers the object-level keyword checks, so it replaces the keyword-only
+    // prelude. `.slice(1)` drops its `isObject` check (emitted just below). Coerce
+    // mode (stripUnknown) keeps its lighter prelude.
+    const assertionPrelude = strict
+        ? generateObjectStrictAssertion(schema, typeName, { useRefImports, suffix }).slice(1)
+        : [];
+    const keywordPrelude = assertionPrelude.length > 0 ? `\n${assertionPrelude.join('\n')}` : '';
     return `export const ${functionName} = (input: unknown): ${typeName} => {
   if (!isObject(input)) {
 ${notObjectBranch}
-  }
+  }${keywordPrelude}
 ${knownKeysDeclaration}  const result = ${resultBody} as unknown as ${typeName};
   for (const key in input) {
 ${loopLines.join('\n')}
@@ -1206,7 +1290,7 @@ const generateCombinedObjectParser = (schema, typeName, useRefImports, suffix, l
         if (entry.isOptional) {
             return `    ${entry.value},`;
         }
-        return `    ${safeKey(entry.key)}: ${entry.value},`;
+        return `    ${safeLiteralKey(entry.key)}: ${entry.value},`;
     });
     // Find the first pattern with a $ref for parser delegation
     if (!isSchemaObject(schema) || !('patternProperties' in schema)) {
@@ -1223,6 +1307,14 @@ const generateCombinedObjectParser = (schema, typeName, useRefImports, suffix, l
     if (strictKeys) {
         return generateStrictCombinedParser(schema, typeName, functionName, propertyLines, patterns, useRefImports, suffix, strict);
     }
+    // `stripUnknown` (coerce mode) must keep keys a `patternProperties` regex
+    // declares and drop only the genuinely-undeclared ones. Delegating to
+    // `generateObjectParser` below would strip the pattern-matching keys too — its
+    // strip logic only knows the declared `properties`. The selective combined
+    // copy keeps declared + pattern-matching keys, exactly like the interpreter.
+    if (stripUnknown && !strict) {
+        return generateStrictCombinedParser(schema, typeName, functionName, propertyLines, patterns, useRefImports, suffix, false);
+    }
     if (!refPattern || !useRefImports) {
         return generateObjectParser(schema, typeName, useRefImports, suffix, logWarnings, strict, true, stripUnknown, undefined, NO_RESERVED_NAMES, caseInsensitive);
     }
@@ -1241,10 +1333,11 @@ const generateCombinedObjectParser = (schema, typeName, useRefImports, suffix, l
     const notObjectBranch = strict
         ? `    throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);`
         : `    return {} as unknown as ${typeName};`;
+    const keywordPrelude = strict ? strictObjectKeywordPrelude(schema, typeName) : '';
     return `export const ${functionName} = (input: unknown): ${typeName} => {
   if (!isObject(input)) {
 ${notObjectBranch}
-  }
+  }${keywordPrelude}
   const result = {
 ${objectProperties}
   } as unknown as ${typeName};
@@ -1265,30 +1358,31 @@ const generateAdditionalPropertiesParser = (schema, typeName, useRefImports, suf
     const additionalProps = schema.additionalProperties;
     // Check if additionalProps is defined before using it
     if (!additionalProps) {
-        return generateEmptyObjectParser(typeName, strict);
+        return generateEmptyObjectParser(typeName, strict, schema);
     }
+    const keywordPrelude = strict ? strictObjectKeywordPrelude(schema, typeName) : '';
     // If additionalProperties is a $ref and useRefImports is true, generate a loop
     if (useRefImports && isSchemaObject(additionalProps) && hasRef(additionalProps)) {
         const ref = additionalProps.$ref;
         const parserName = generateParserName(refToName(ref, suffix));
         if (strict) {
-            return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return validateRecord(input, ${parserName}) as ${typeName};\n};`;
+            return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${keywordPrelude}\n  return validateRecord(input, ${parserName}) as ${typeName};\n};`;
         }
         return `export const ${functionName} = (input: unknown): ${typeName} => validateRecord(input, ${parserName}) as ${typeName};`;
     }
     // Handle additionalProperties with a known type by generating inline validation
     if (isSchemaObject(additionalProps) && hasType(additionalProps)) {
-        const inlineParser = generateInlineValueParser(additionalProps);
+        const inlineParser = generateInlineValueParser(additionalProps, strict, `[${typeName}]`);
         if (inlineParser) {
             if (strict) {
-                return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return validateRecord(input, ${inlineParser}) as ${typeName};\n};`;
+                return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${keywordPrelude}\n  return validateRecord(input, ${inlineParser}) as ${typeName};\n};`;
             }
             return `export const ${functionName} = (input: unknown): ${typeName} => validateRecord(input, ${inlineParser}) as ${typeName};`;
         }
     }
     // Otherwise, just validate the input type and shallow copy
     if (strict) {
-        return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);\n  return { ...input } as ${typeName};\n};`;
+        return `export const ${functionName} = (input: unknown): ${typeName} => {\n  if (!isObject(input)) throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);${keywordPrelude}\n  return { ...input } as ${typeName};\n};`;
     }
     return `export const ${functionName} = (input: unknown): ${typeName} => isObject(input) ? { ...input } as ${typeName} : {};`;
 };
@@ -1299,16 +1393,39 @@ const generateAdditionalPropertiesParser = (schema, typeName, useRefImports, suf
  * Used to generate parsers for Record-like types where values have a known
  * primitive or array type (e.g. Record<string, string> or Record<string, string[]>).
  */
-const generateInlineValueParser = (schema) => {
+const generateInlineValueParser = (schema, strict = false, label = '') => {
     if (!isSchemaObject(schema) || !hasType(schema)) {
         return null;
     }
+    // Strict mode must *throw* on a wrong-typed record value, not repair it — the
+    // coercing branch below would silently turn `{ a: 'x' }` into `{ a: 0 }` for a
+    // `Record<string, number>`, which strict mode is documented never to do.
+    if (strict) {
+        const err = (t) => `throw new Error(${JSON.stringify(`${label} record value must be ${t}`)})`;
+        switch (schema.type) {
+            case 'string':
+                return `(value: unknown) => { if (typeof value !== "string") ${err('string')}; return value; }`;
+            case 'number':
+                return `(value: unknown) => { if (typeof value !== "number") ${err('number')}; return value; }`;
+            case 'integer':
+                return `(value: unknown) => { if (typeof value !== "number" || !Number.isInteger(value)) ${err('integer')}; return value; }`;
+            case 'boolean':
+                return `(value: unknown) => { if (typeof value !== "boolean") ${err('boolean')}; return value; }`;
+            case 'array':
+                return `(value: unknown) => { if (!Array.isArray(value)) ${err('array')}; return value; }`;
+            default:
+                return null;
+        }
+    }
     switch (schema.type) {
         case 'string':
             return '(value: unknown) => typeof value === "string" ? value : ""';
         case 'number':
-        case 'integer':
             return '(value: unknown) => typeof value === "number" ? value : 0';
+        case 'integer':
+            // `integer` rejects non-integral numbers; a bare typeof accepts `1.5`,
+            // matching every other integer site in this package (and strict mode).
+            return '(value: unknown) => typeof value === "number" && Number.isInteger(value) ? value : 0';
         case 'boolean':
             return '(value: unknown) => typeof value === "boolean" ? value : false';
         case 'array':
@@ -1324,47 +1441,53 @@ const generateInlineValueParser = (schema) => {
 const generatePatternPropertiesParser = (schema, typeName, useRefImports, suffix, strict) => {
     const functionName = generateParserName(typeName);
     if (!('patternProperties' in schema) || typeof schema.patternProperties !== 'object') {
-        return generateEmptyObjectParser(typeName, strict);
+        return generateEmptyObjectParser(typeName, strict, schema);
     }
     const patternProps = schema.patternProperties;
     // Find the first pattern and its schema
     const patterns = Object.entries(patternProps);
     if (patterns.length === 0) {
-        return generateEmptyObjectParser(typeName, strict);
+        return generateEmptyObjectParser(typeName, strict, schema);
     }
     const [pattern, patternSchema] = patterns[0];
     let patternAssignment = '(result as Record<string, unknown>)[key] = value;';
+    // The value-expression form, used by the strictKeys path (which builds from
+    // `{}`) to emit a prototype-safe assignment. `null` when no value is allowed.
+    let patternValueExpr = 'value';
     // Use imported parser when pattern schema points to a $ref.
     if (useRefImports && isSchemaObject(patternSchema) && hasRef(patternSchema)) {
         const ref = patternSchema.$ref;
         const parserName = generateParserName(refToName(ref, suffix));
         patternAssignment = `(result as Record<string, unknown>)[key] = ${parserName}(value);`;
+        patternValueExpr = `${parserName}(value)`;
     }
     else if (patternSchema === false) {
         // `false` means no values are allowed for matching keys.
         patternAssignment = '';
+        patternValueExpr = null;
     }
     // Escape the pattern for safe inclusion in generated code
     const escapedPattern = escapeRegexPattern(pattern);
     const notObjectBranch = strict
         ? `    throw new Error(\`[${typeName}] expected object, got \${input === null ? "null" : typeof input}\`);`
         : `    return {} as unknown as ${typeName};`;
+    const keywordPrelude = strict ? strictObjectKeywordPrelude(schema, typeName) : '';
     // With `additionalProperties: false`, only keys matching a pattern survive:
     // others are rejected (strict) or stripped (coerce). Start from an empty
     // object rather than spreading every input key.
     const strictKeys = hasAdditionalProperties(schema) && schema.additionalProperties === false;
     if (strictKeys) {
         const loopLines = [`    if (/${escapedPattern}/.test(key)) {`];
-        if (patternAssignment) {
+        if (patternValueExpr) {
             loopLines.push(`      const value = input[key];`);
-            loopLines.push(`      ${patternAssignment}`);
+            loopLines.push(`      ${safeResultAssign('key', patternValueExpr)}`);
         }
         loopLines.push(`      continue;`);
         loopLines.push(`    }`);
         const keepConditions = patterns.slice(1).map(([p]) => `/${escapeRegexPattern(p)}/.test(key)`);
         if (keepConditions.length > 0) {
             loopLines.push(`    if (${keepConditions.join(' || ')}) {`);
-            loopLines.push(`      (result as Record<string, unknown>)[key] = input[key];`);
+            loopLines.push(`      ${safeResultAssign('key', 'input[key]')}`);
             loopLines.push(`      continue;`);
             loopLines.push(`    }`);
         }
@@ -1373,7 +1496,7 @@ const generatePatternPropertiesParser = (schema, typeName, useRefImports, suffix
         return `export const ${functionName} = (input: unknown): ${typeName} => {
   if (!isObject(input)) {
 ${notObjectBranch}
-  }
+  }${keywordPrelude}
   const result = {} as unknown as ${typeName};
   for (const key in input) {
 ${loopLines.join('\n')}
@@ -1385,7 +1508,7 @@ ${loopLines.join('\n')}
     return `export const ${functionName} = (input: unknown): ${typeName} => {
   if (!isObject(input)) {
 ${notObjectBranch}
-  }
+  }${keywordPrelude}
   const result = {
     ...input,
   } as unknown as ${typeName};
@@ -1597,17 +1720,17 @@ const selectParserStrategy = (schema, typeName, options) => {
         const additionalProps = schema.additionalProperties;
         // If additionalProperties is true or false, validate it is an object
         if (additionalProps === true || additionalProps === false) {
-            return generateEmptyObjectParser(typeName, strict);
+            return generateEmptyObjectParser(typeName, strict, schema);
         }
         // Otherwise, handle as a schema (could be a $ref or object schema)
         return generateAdditionalPropertiesParser(schema, typeName, useRefImports, suffix, strict);
     }
     // Handle empty object schemas
     if ('type' in schema && schema.type === 'object' && !hasProperties(schema)) {
-        return generateEmptyObjectParser(typeName, strict);
+        return generateEmptyObjectParser(typeName, strict, schema);
     }
     // Default fallback - validate it is an object since we passed the isObjectSchema check
-    return generateEmptyObjectParser(typeName, strict);
+    return generateEmptyObjectParser(typeName, strict, schema);
 };
 /**
  * Generates a safe parser as an arrow function that never throws.
@@ -1619,6 +1742,12 @@ const selectParserStrategy = (schema, typeName, options) => {
  * $ref will map each element through the imported parser.
  */
 export const generateParserFunction = (schema, typeName, options) => {
+    // Strict parsers promise to throw on violations, so any keyword we cannot
+    // enforce must fail loudly at generation rather than emit a permissive parser.
+    // Coercing parsers are documented to repair rather than reject, so the guard
+    // does not apply to them.
+    if (options?.strict)
+        assertNoUnsupportedKeywords(schema, typeName);
     return selectParserStrategy(schema, typeName, options);
 };
 /**
@@ -1645,6 +1774,12 @@ export const generateShapeValidator = (schema, typeName, useRefImports, suffix =
     const stub = `${exportPrefix}const ${fnName} = (_input: unknown): boolean => false;`;
     if (!isSchemaObject(schema))
         return stub;
+    // Keywords the parser's fast path cannot mirror (contains, dependentRequired,
+    // dependentSchemas, propertyNames) make a bare shape match insufficient: a
+    // parent that fast-pathed through this predicate would skip their enforcement,
+    // so stub out and force the parent's slow path (which calls the real parser).
+    if (hasFastPathBlockingKeyword(schema))
+        return stub;
     // An alias definition (a bare `$ref` with no shape of its own) delegates to
     // the referenced type's validator. Guarded against self-reference.
     if (useRefImports && hasRef(schema) && !hasProperties(schema)) {