@gobing-ai/ts-utils 0.4.28 → 0.4.31

package/dist/event-severity.d.ts

@@ -0,0 +1,7 @@
+/** Observability severity stamped by the event producer at emit time. */
+export type EventSeverity = 'info' | 'warning' | 'error';
+/** Mixin for lifecycle event details that carry producer-owned severity. */
+export interface WithEventSeverity {
+    severity: EventSeverity;
+}
+//# sourceMappingURL=event-severity.d.ts.map

package/dist/event-severity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-severity.d.ts","sourceRoot":"","sources":["../src/event-severity.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEzD,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,EAAE,aAAa,CAAC;CAC3B"}

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export * from './const';
 export * from './cursor';
 export * from './date';
 export * from './errors';
+export * from './event-severity';
 export * from './object';
 export * from './origin';
 export * from './output';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC;AACzB,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -4,6 +4,7 @@ export * from './const.js';
 export * from './cursor.js';
 export * from './date.js';
 export * from './errors.js';
+export * from './event-severity.js';
 export * from './object.js';
 export * from './origin.js';
 export * from './output.js';

package/dist/object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object.d.ts","sourceRoot":"","sources":["../src/object.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWnH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,SAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW7F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAetF"}
+{"version":3,"file":"object.d.ts","sourceRoot":"","sources":["../src/object.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWnH;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,SAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW7F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBtF"}

package/dist/object.js

@@ -53,6 +53,13 @@ export function deFlattenKeys(entries) {
     const result = {};
     for (const [key, rawValue] of Object.entries(entries)) {
         const parts = key.split('.');
+        // Prototype-pollution guard: navigating `current['__proto__']` resolves to
+        // `Object.prototype` (isPlainObject true), so a later assign would land on the global
+        // prototype; `constructor`/`prototype` segments let hostile input pivot through
+        // `Function.prototype`. Skipping (symmetric with deepMerge) makes deflate of hostile
+        // input a no-op rather than a throw callers must catch.
+        if (parts.some((part) => part === '__proto__' || part === 'constructor' || part === 'prototype'))
+            continue;
         let current = result;
         for (const part of parts.slice(0, -1)) {
             if (!isPlainObject(current[part]))

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/ts-utils",
-    "version": "0.4.28",
+    "version": "0.4.31",
     "description": "Zero-dependency TypeScript utilities for dates, cursors, errors, output, origins, roles, and API responses.",
     "keywords": [
         "typescript",

package/src/event-severity.ts

@@ -0,0 +1,7 @@
+/** Observability severity stamped by the event producer at emit time. */
+export type EventSeverity = 'info' | 'warning' | 'error';
+
+/** Mixin for lifecycle event details that carry producer-owned severity. */
+export interface WithEventSeverity {
+    severity: EventSeverity;
+}

package/src/index.ts

@@ -4,6 +4,7 @@ export * from './const';
 export * from './cursor';
 export * from './date';
 export * from './errors';
+export * from './event-severity';
 export * from './object';
 export * from './origin';
 export * from './output';

package/src/object.ts

@@ -53,6 +53,12 @@ export function deFlattenKeys(entries: Record<string, string>): Record<string, u
     const result: Record<string, unknown> = {};
     for (const [key, rawValue] of Object.entries(entries)) {
         const parts = key.split('.');
+        // Prototype-pollution guard: navigating `current['__proto__']` resolves to
+        // `Object.prototype` (isPlainObject true), so a later assign would land on the global
+        // prototype; `constructor`/`prototype` segments let hostile input pivot through
+        // `Function.prototype`. Skipping (symmetric with deepMerge) makes deflate of hostile
+        // input a no-op rather than a throw callers must catch.
+        if (parts.some((part) => part === '__proto__' || part === 'constructor' || part === 'prototype')) continue;
         let current = result;
         for (const part of parts.slice(0, -1)) {
             if (!isPlainObject(current[part])) current[part] = {};