@gabrielbryk/json-schema-to-zod 2.12.0 → 2.12.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @gabrielbryk/json-schema-to-zod
 
+## 2.12.1
+
+### Patch Changes
+
+- e8cbafc: Fix `unevaluatedProperties: false` with `oneOf` by avoiding strict union branches, allowing base properties through, and enforcing unknown-key rejection after composition.
+
 ## 2.12.0
 
 ### Minor Changes

package/dist/parsers/parseObject.js

@@ -6,6 +6,25 @@ import { parseIfThenElse } from "./parseIfThenElse.js";
 import { addJsdocs } from "../utils/jsdocs.js";
 import { anyOrUnknown } from "../utils/anyOrUnknown.js";
 import { containsRecursiveRef, inferTypeFromExpression } from "../utils/schemaRepresentation.js";
+const collectKnownPropertyKeys = (schema) => {
+    const keys = new Set();
+    const visit = (node) => {
+        if (typeof node !== "object" || node === null)
+            return;
+        const obj = node;
+        if (obj.properties && typeof obj.properties === "object") {
+            Object.keys(obj.properties).forEach((key) => keys.add(key));
+        }
+    };
+    visit(schema);
+    if (Array.isArray(schema.oneOf))
+        schema.oneOf.forEach(visit);
+    if (Array.isArray(schema.anyOf))
+        schema.anyOf.forEach(visit);
+    if (Array.isArray(schema.allOf))
+        schema.allOf.forEach(visit);
+    return Array.from(keys);
+};
 export function parseObject(objectSchema, refs) {
     // Optimization: if we have composition keywords (allOf/anyOf/oneOf) but no direct properties,
     // delegate entirely to the composition parser to avoid generating z.object({}).and(...)
@@ -230,28 +249,40 @@ export function parseObject(objectSchema, refs) {
     // we should NOT default to z.record(z.string(), z.any()) because that would allow any properties.
     // Instead, use z.object({}) and let the .and() call add properties from the composition.
     // This is especially important when unevaluatedProperties: false is set.
+    const shouldPassthroughForUnevaluated = unevaluated === false && hasCompositionKeywords;
+    const passthroughProperties = shouldPassthroughForUnevaluated && properties && !patternProperties
+        ? `${properties}.passthrough()`
+        : properties;
     const fallback = anyOrUnknown(refs);
-    let output = properties
-        ? patternProperties
-            ? properties + patternProperties
-            : additionalProperties
-                ? additionalProperties.expression === "z.never()"
-                    // Don't use .strict() if there are composition keywords that add properties
-                    ? hasCompositionKeywords
-                        ? properties
-                        : properties + ".strict()"
-                    : properties + `.catchall(${additionalProperties.expression})`
-                : properties
-        : patternProperties
-            ? patternProperties
-            : additionalProperties
-                ? `z.record(z.string(), ${additionalProperties.expression})`
-                // If we have composition keywords, start with empty object instead of z.record()
-                // The composition will provide the actual schema via .and()
-                : hasCompositionKeywords
-                    ? "z.object({})"
-                    // No constraints = any object. Use z.record() which is cleaner than z.object({}).catchall()
-                    : `z.record(z.string(), ${fallback.expression})`;
+    let output;
+    if (properties) {
+        if (patternProperties) {
+            output = properties + patternProperties;
+        }
+        else if (additionalProperties) {
+            if (additionalProperties.expression === "z.never()") {
+                // Don't use .strict() if there are composition keywords that add properties
+                output = hasCompositionKeywords ? passthroughProperties : properties + ".strict()";
+            }
+            else {
+                output = properties + `.catchall(${additionalProperties.expression})`;
+            }
+        }
+        else {
+            output = passthroughProperties;
+        }
+    }
+    else if (patternProperties) {
+        output = patternProperties;
+    }
+    else if (additionalProperties) {
+        output = `z.record(z.string(), ${additionalProperties.expression})`;
+    }
+    else {
+        // If we have composition keywords, start with empty object instead of z.record()
+        // The composition will provide the actual schema via .and()
+        output = hasCompositionKeywords ? "z.object({})" : `z.record(z.string(), ${fallback.expression})`;
+    }
     if (unevaluated === false && properties && !hasCompositionKeywords) {
         output += ".strict()";
     }
@@ -328,6 +359,27 @@ export function parseObject(objectSchema, refs) {
         output += `.and(${conditionalResult.expression})`;
         intersectionTypes.push(conditionalResult.type);
     }
+    if (unevaluated === false && hasCompositionKeywords) {
+        const knownKeys = collectKnownPropertyKeys(objectSchema);
+        const patternRegexps = objectSchema.patternProperties
+            ? Object.keys(objectSchema.patternProperties).map((pattern) => new RegExp(pattern))
+            : [];
+        const patternRegexpsLiteral = patternRegexps.length
+            ? `[${patternRegexps.map((r) => r.toString()).join(", ")}]`
+            : "[new RegExp(\"$^\")]";
+        output += `.superRefine((value, ctx) => {
+  if (!value || typeof value !== "object") return;
+  const knownKeys = ${JSON.stringify(knownKeys)};
+  const patternRegexps = ${patternRegexpsLiteral};
+  for (const key in value) {
+    const isKnown = knownKeys.includes(key);
+    const matchesPattern = patternRegexps.length ? patternRegexps.some((r) => r.test(key)) : false;
+    if (!isKnown && !matchesPattern) {
+      ctx.addIssue({ code: "unrecognized_keys", keys: [key], path: [key], message: "Unknown property" });
+    }
+  }
+})`;
+    }
     // Only add required validation for missing keys when there are no composition keywords
     // When allOf/anyOf/oneOf exist, they should define the properties and handle required validation
     if (missingRequiredKeys.length > 0 && !hasCompositionKeywords) {

package/dist/parsers/parseOneOf.js

@@ -297,6 +297,14 @@ export const parseOneOf = (schema, refs) => {
     // in Zod v4 because ZodDiscriminatedUnion cannot be nested inside ZodUnion at the type level.
     // The runtime would work, but the types wouldn't match, causing compile errors.
     // So we fall through to the regular union handling below.
+    // If the parent object has its own shape (properties/patternProperties/additionalProperties)
+    // or explicitly forbids unevaluated properties, we shouldn't make the oneOf branches strict.
+    // Otherwise, the intersection with the parent schema would reject the parent's properties
+    // before the union gets a chance to validate.
+    const parentHasDirectObjectShape = Boolean(schema.properties ||
+        schema.patternProperties ||
+        schema.additionalProperties);
+    const parentForbidsUnevaluated = schema.unevaluatedProperties === false;
     // Fallback: Standard z.union
     const parsedSchemas = schema.oneOf.map((s, i) => {
         const extracted = extractInlineObject(s, refs, [...refs.path, "oneOf", i]);
@@ -317,6 +325,8 @@ export const parseOneOf = (schema, refs) => {
             parsed.expression.startsWith("z.object(") && // Critical check: Must be a Zod object
             !parsed.expression.includes(".and(") &&
             !parsed.expression.includes(".intersection(") &&
+            !parentHasDirectObjectShape &&
+            !parentForbidsUnevaluated &&
             !parsed.expression.includes(".strict()") &&
             !parsed.expression.includes(".catchall") &&
             !parsed.expression.includes(".passthrough")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gabrielbryk/json-schema-to-zod",
-  "version": "2.12.0",
+  "version": "2.12.1",
   "description": "Converts JSON schema objects or files into Zod schemas",
   "type": "module",
   "types": "./dist/types/index.d.ts",