@lowdefy/helpers 5.5.1 → 6.0.0

package/dist/set.js

@@ -1,4 +1,4 @@
-/* eslint-disable no-plusplus */ /* eslint-disable no-use-before-define */ /* eslint-disable no-param-reassign */ /*
+/* eslint-disable no-param-reassign */ /*
   Copyright 2020-2026 Lowdefy, Inc
 
   Licensed under the Apache License, Version 2.0 (the "License");
@@ -33,89 +33,74 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 import type from './type.js';
-function isValidKey(key) {
-    return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
+import splitPath from './splitPath.js';
+import { isReserved, ReservedKeyError } from './ReservedKeyError.js';
+// "May I step into this value to reach a child?" Kept local rather than shared with get/unset -
+// a module imported by all three trips a Jest ESM module-cache bug in operators-js' mocked
+// re-imports.
+function isTraversable(value) {
+    return !type.isNone(value) && (typeof value === 'object' || typeof value === 'function');
 }
-function isObjectOrFunction(val) {
-    return val !== null && (typeof val === 'object' || typeof val === 'function');
-}
-function result(target, path, value, merge) {
-    if (merge && isObjectOrFunction(target[path]) && isObjectOrFunction(value)) {
-        target[path] = merge({}, target[path], value);
-    } else {
-        target[path] = value;
+// Only own properties count when deciding whether an intermediate needs to be
+// autovivified, so inherited members like `toString` are never descended into.
+function ownValue(target, prop) {
+    if (!Object.hasOwn(target, prop)) {
+        return undefined;
     }
+    return target[prop];
 }
-// eslint-disable-next-line no-use-before-define
-set.memo = {};
-function set(target, path, value, options) {
+function set(target, path, value) {
     if (!type.isObject(target)) {
         return target;
     }
-    const opts = options || {};
-    if (!type.isArray(path) && !type.isString(path)) {
+    if (!type.isString(path)) {
         return target;
     }
-    let { merge } = opts;
-    if (merge && typeof merge !== 'function') {
-        merge = Object.assign;
+    const keys = splitPath(path);
+    const reserved = keys.find(isReserved);
+    if (!type.isNone(reserved)) {
+        throw new ReservedKeyError(reserved);
     }
-    const keys = (type.isArray(path) ? path : split(path, opts)).filter(isValidKey);
     const len = keys.length;
     const orig = target;
-    if (!options && keys.length === 1) {
-        result(target, keys[0], value, merge);
-        return target;
-    }
-    for(let i = 0; i < len; i++){
-        const prop = keys[i];
-        const propUp = keys[i + 1]; // changed to set an array value where the array was undefined be assigning value
-        if (!isObjectOrFunction(target[prop]) && !type.isInt(parseInt(propUp, 10))) {
-            // changed
-            target[prop] = {};
-        } else if (!isObjectOrFunction(target[prop]) && type.isInt(parseInt(propUp, 10))) {
-            // added
-            target[prop] = []; // added
+    let idx = 0;
+    while(idx < len){
+        let prop = keys[idx];
+        let next = idx + 1;
+        // The strict segment wins if present. On a miss, grow the candidate one segment at a time
+        // looking for a literal dotted key already on the target - shortest-first, no backtracking,
+        // matching get. If nothing matches, keep the strict segment and autovivify as before.
+        if (!Object.hasOwn(target, prop)) {
+            let candidate = prop;
+            let n = next;
+            while(n < len){
+                candidate = `${candidate}.${keys[n]}`;
+                n += 1;
+                if (Object.hasOwn(target, candidate)) {
+                    prop = candidate;
+                    next = n;
+                    break;
+                }
+            }
         }
-        if (i === len - 1) {
-            result(target, prop, value, merge);
+        // Every segment was already rejected by isReserved above, but the assignments
+        // below are the prototype-pollution sinks, so the check also sits beside them
+        // on the resolved key, where it is local to the write.
+        if (prop === '__proto__' || prop === 'constructor' || prop === 'prototype') {
+            throw new ReservedKeyError(prop);
+        }
+        if (next === len) {
+            target[prop] = value;
             break;
         }
+        // The next segment decides whether a missing intermediate becomes an array or an object.
+        const propUp = keys[next];
+        if (!isTraversable(ownValue(target, prop))) {
+            target[prop] = type.isInt(parseInt(propUp, 10)) ? [] : {};
+        }
         target = target[prop];
+        idx = next;
     }
     return orig;
 }
-function createKey(pattern, options) {
-    let id = pattern;
-    if (typeof options === 'undefined') {
-        return `${id}`;
-    }
-    const keys = Object.keys(options);
-    for(let i = 0; i < keys.length; i++){
-        const key = keys[i];
-        id += `;${key}=${String(options[key])}`;
-    }
-    return id;
-}
-export function split(path, options) {
-    const id = createKey(path, options);
-    if (set.memo[id]) return set.memo[id];
-    const char = options && options.separator ? options.separator : '.';
-    let keys = [];
-    const res = [];
-    if (options && typeof options.split === 'function') {
-        keys = options.split(path);
-    } else {
-        keys = path.split(char);
-    }
-    for(let i = 0; i < keys.length; i++){
-        let prop = keys[i];
-        while(prop && prop.slice(-1) === '\\' && keys[i + 1]){
-            prop = prop.slice(0, -1) + char + keys[++i];
-        }
-        res.push(prop);
-    }
-    set.memo[id] = res;
-    return res;
-}
 export default set;

package/dist/setKey.js

@@ -0,0 +1,33 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import type from './type.js';
+import { isReserved, ReservedKeyError } from './ReservedKeyError.js';
+// Assigns a single literal key on a plain object. Dots are not path separators.
+function setKey(target, key, value) {
+    if (!type.isObject(target)) {
+        throw new TypeError('setKey: target must be a plain object');
+    }
+    if (!type.isString(key)) {
+        throw new TypeError('setKey: key must be a string');
+    }
+    // Rejected even on null-proto targets, where the write would be safe: a caller seeing
+    // ReservedKeyError always knows the key was rejected, regardless of target shape.
+    if (isReserved(key)) {
+        throw new ReservedKeyError(key);
+    }
+    target[key] = value;
+    return target;
+}
+export default setKey;

package/dist/splitPath.js

@@ -0,0 +1,51 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import type from './type.js';
+// Dot-path grammar: `.` separates segments, `\.` is a literal dot and `\\` a
+// literal backslash. Any other backslash is an ordinary character, so keys such
+// as 'a\b' keep working unescaped. joinPath is the inverse.
+function splitPath(path) {
+    if (!type.isString(path)) {
+        throw new TypeError(`splitPath: path must be a string. Received ${JSON.stringify(path)}.`);
+    }
+    const segments = [];
+    let segment = '';
+    let i = 0;
+    while(i < path.length){
+        const char = path[i];
+        if (char === '\\') {
+            const next = path[i + 1];
+            if (next === '.' || next === '\\') {
+                segment += next;
+                i += 2;
+                continue;
+            }
+            segment += char;
+            i += 1;
+            continue;
+        }
+        if (char === '.') {
+            segments.push(segment);
+            segment = '';
+            i += 1;
+            continue;
+        }
+        segment += char;
+        i += 1;
+    }
+    segments.push(segment);
+    return segments;
+}
+export default splitPath;

package/dist/type.js

@@ -1,4 +1,4 @@
-/* eslint-disable indent */ /* eslint-disable default-case */ /*
+/*
   Copyright 2020-2026 Lowdefy, Inc
 
   Licensed under the Apache License, Version 2.0 (the "License");
@@ -12,129 +12,46 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ // Derived from source:
-// because both js typeof and instance of sucks! use this.
-// https://ultimatecourses.com/blog/understanding-javascript-types-and-reliable-type-checking
-const { toString } = Object.prototype;
+*/ // Includes `Buffer` so Node Buffers map to 'buffer'. Buffer extends Uint8Array but reports
+// constructor.name 'Buffer', so matching the name here keeps the legacy kindOf return
+// without a Node-only branch.
+const TYPED_ARRAY_RE = /^(Int|Uint|Float)\d+(Clamped)?Array$|^Buffer$/;
 function ctorName(val) {
-    return val.constructor && typeof val.constructor === 'function' ? val.constructor.name : null;
+    const ctor = val.constructor;
+    return typeof ctor === 'function' ? ctor.name : null;
 }
 function isArray(val) {
-    if (Array.isArray) return Array.isArray(val);
-    return val instanceof Array;
+    return Array.isArray(val);
 }
 function isError(val) {
-    return !!val && (val instanceof Error || typeof val.message === 'string' && val.constructor && typeof val.constructor.stackTraceLimit === 'number');
+    return val instanceof Error;
 }
 function isDate(val) {
-    if (val instanceof Date && !Number.isNaN(val.getTime())) return true;
-    return val && typeof val.toDateString === 'function' && typeof val.getDate === 'function' && typeof val.setDate === 'function' && !Number.isNaN(val.getTime());
-}
-function isRegexp(val) {
-    if (val instanceof RegExp) return true;
-    return typeof val.flags === 'string' && typeof val.ignoreCase === 'boolean' && typeof val.multiline === 'boolean' && typeof val.global === 'boolean';
-}
-function isGeneratorFn(name) {
-    return ctorName(name) === 'GeneratorFunction';
-}
-function isGeneratorObj(val) {
-    return typeof val.throw === 'function' && typeof val.return === 'function' && typeof val.next === 'function';
-}
-function isArguments(val) {
-    try {
-        if (typeof val.length === 'number' && typeof val.callee === 'function') {
-            return true;
-        }
-    } catch (err) {
-        if (err.message.indexOf('callee') !== -1) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * If you need to support Safari 5-7 (8-10 yr-old browser),
- * take a look at https://github.com/feross/is-buffer
- */ function isBuffer(val) {
-    if (val.constructor && typeof val.constructor.isBuffer === 'function') {
-        return val.constructor.isBuffer(val);
-    }
-    return false;
+    return val instanceof Date && !Number.isNaN(val.getTime());
 }
 function kindOf(val) {
-    // eslint-disable-next-line no-void
-    if (val === void 0) return 'undefined';
+    if (val === undefined) return 'undefined';
     if (val === null) return 'null';
-    let type = typeof val;
-    if (type === 'boolean') return 'boolean';
-    if (type === 'string') return 'string';
-    if (type === 'number') return 'number';
-    if (type === 'symbol') return 'symbol';
-    if (type === 'function') {
-        return isGeneratorFn(val) ? 'generatorfunction' : 'function';
-    }
-    if (isArray(val)) return 'array';
-    if (isDate(val)) return 'date';
-    if (isError(val)) return 'error';
-    if (isRegexp(val)) return 'regexp';
-    if (isArguments(val)) return 'arguments';
-    if (isBuffer(val)) return 'buffer';
-    switch(ctorName(val)){
-        case 'Symbol':
-            return 'symbol';
-        case 'Promise':
-            return 'promise';
-        // Set, Map, WeakSet, WeakMap
-        case 'WeakMap':
-            return 'weakmap';
-        case 'WeakSet':
-            return 'weakset';
-        case 'Map':
-            return 'map';
-        case 'Set':
-            return 'set';
-        // 8-bit typed arrays
-        case 'Int8Array':
-            return 'int8array';
-        case 'Uint8Array':
-            return 'uint8array';
-        case 'Uint8ClampedArray':
-            return 'uint8clampedarray';
-        // 16-bit typed arrays
-        case 'Int16Array':
-            return 'int16array';
-        case 'Uint16Array':
-            return 'uint16array';
-        // 32-bit typed arrays
-        case 'Int32Array':
-            return 'int32array';
-        case 'Uint32Array':
-            return 'uint32array';
-        case 'Float32Array':
-            return 'float32array';
-        case 'Float64Array':
-            return 'float64array';
-    }
-    if (isGeneratorObj(val)) {
-        return 'generator';
-    }
-    // Non-plain objects
-    type = toString.call(val);
-    switch(type){
-        case '[object Object]':
-            return 'object';
-        // iterators
-        case '[object Map Iterator]':
-            return 'mapiterator';
-        case '[object Set Iterator]':
-            return 'setiterator';
-        case '[object String Iterator]':
-            return 'stringiterator';
-        case '[object Array Iterator]':
-            return 'arrayiterator';
-    }
-    // other
-    return type.slice(8, -1).toLowerCase().replace(/\s/g, '');
+    const t = typeof val;
+    if (t !== 'object' && t !== 'function') return t;
+    if (Array.isArray(val)) return 'array';
+    if (val instanceof Date) return 'date';
+    if (val instanceof Error) return 'error';
+    if (val instanceof RegExp) return 'regexp';
+    if (val instanceof Map) return 'map';
+    if (val instanceof Set) return 'set';
+    if (val instanceof WeakMap) return 'weakmap';
+    if (val instanceof WeakSet) return 'weakset';
+    if (val instanceof Promise) return 'promise';
+    if (t === 'function') return 'function';
+    const name = ctorName(val);
+    if (name && TYPED_ARRAY_RE.test(name)) return name.toLowerCase();
+    // Tail check: only plain objects map to 'object'. Non-plain web platform objects
+    // (URL, Headers, URLSearchParams, etc.) and user classes with Symbol.toStringTag fall
+    // through to the constructor-name branch so type.isObject preserves its
+    // "plain object only" contract.
+    if (Object.prototype.toString.call(val) === '[object Object]') return 'object';
+    return name ? name.toLowerCase() : 'object';
 }
 const reISO = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2}(?:\.\d*))(?:Z|(\+|-)([\d|:]*))?$/;
 function isDateString(val) {
@@ -158,8 +75,10 @@ type.isSet = (value)=>kindOf(value) === 'set';
 type.isNull = (value)=>kindOf(value) === 'null';
 type.isUndefined = (value)=>kindOf(value) === 'undefined';
 type.isNone = (value)=>kindOf(value) === 'undefined' || kindOf(value) === 'null';
-type.isPrimitive = (value)=>kindOf(value) === 'undefined' || // are we making undefined a primative ?
-    kindOf(value) === 'null' || kindOf(value) === 'string' || kindOf(value) === 'number' || kindOf(value) === 'boolean' || kindOf(value) === 'date';
+// Lowdefy convention: `date` is treated as primitive. Used by the `_type: primitive`
+// operator and `enforceType('primitive', ...)`. Do not "fix" this without coordinating
+// with the operators-js, blocks-antd selector family, and nunjucks consumers.
+type.isPrimitive = (value)=>kindOf(value) === 'undefined' || kindOf(value) === 'null' || kindOf(value) === 'string' || kindOf(value) === 'number' || kindOf(value) === 'boolean' || kindOf(value) === 'date';
 type.isEmptyObject = (value)=>kindOf(value) === 'object' && Object.keys(value).length === 0;
 // Lowdefy operator types
 function isName(value) {

package/dist/unset.js

@@ -1,4 +1,4 @@
-/* eslint-disable no-param-reassign */ /*
+/*
   Copyright 2020-2026 Lowdefy, Inc
 
   Licensed under the Apache License, Version 2.0 (the "License");
@@ -33,71 +33,61 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
 import type from './type.js';
-import get from './get.js';
-const hasValues = (val)=>{
-    switch(type.typeOf(val)){
-        case 'boolean':
-        case 'date':
-        case 'function':
-        case 'null':
-        case 'number':
-            return true;
-        case 'undefined':
-            return false;
-        case 'regexp':
-            return val.source !== '(?:)' && val.source !== '';
-        case 'buffer':
-            return val.toString() !== '';
-        case 'error':
-            return val.message !== '';
-        case 'string':
-        case 'arguments':
-            return val.length !== 0;
-        case 'file':
-        case 'map':
-        case 'set':
-            return val.size !== 0;
-        case 'array':
-        case 'object':
-            // eslint-disable-next-line no-restricted-syntax
-            // CHANGED - we are assuming that an empty object and array is a value.
-            // for (const key of Object.keys(val)) {
-            //   if (hasValues(val[key])) {
-            //     return true;
-            //   }
-            // }
-            // return false;
-            return true;
-        // everything else
-        default:
-            {
-                return true;
-            }
-    }
-};
-const hasValue = (obj, path, options)=>{
-    if (type.isObject(obj) && (type.isString(path) || type.isArray(path))) {
-        return hasValues(get(obj, path, options));
-    }
-    return false;
-};
+import splitPath from './splitPath.js';
+import { isReserved, ReservedKeyError } from './ReservedKeyError.js';
+// "May I step into this value to reach a child?" Kept local rather than shared with get/set -
+// a module imported by all three trips a Jest ESM module-cache bug in operators-js' mocked
+// re-imports.
+function isTraversable(value) {
+    return !type.isNone(value) && (typeof value === 'object' || typeof value === 'function');
+}
 const unset = (obj, prop)=>{
-    // support array refence in the form a.0 , a.0.b or a[0] , a[0].b
+    // supports array references in the form a.0 or a.0.b
     if (!type.isObject(obj)) {
         throw new TypeError('expected an object.');
     }
-    if (Object.prototype.hasOwnProperty.call(obj, prop)) {
-        delete obj[prop];
+    if (!type.isString(prop)) {
         return true;
     }
-    if (hasValue(obj, prop)) {
-        const segs = prop.split('.');
-        let last = segs.pop();
-        while(segs.length && segs[segs.length - 1].slice(-1) === '\\'){
-            last = `${segs.pop().slice(0, -1)}.${last}`;
+    const segs = splitPath(prop);
+    const reserved = segs.find(isReserved);
+    if (!type.isNone(reserved)) {
+        throw new ReservedKeyError(reserved);
+    }
+    const len = segs.length;
+    let target = obj;
+    let idx = 0;
+    while(idx < len){
+        let seg = segs[idx];
+        let next = idx + 1;
+        // The strict segment wins if present. On a miss, grow the candidate one segment at a time
+        // looking for a literal dotted key - shortest-first, no backtracking, matching get and set.
+        if (!Object.hasOwn(target, seg)) {
+            let candidate = seg;
+            let n = next;
+            while(n < len){
+                candidate = `${candidate}.${segs[n]}`;
+                n += 1;
+                if (Object.hasOwn(target, candidate)) {
+                    seg = candidate;
+                    next = n;
+                    break;
+                }
+            }
+        }
+        // Nothing matches at this level, so there is nothing to unset.
+        if (!Object.hasOwn(target, seg)) {
+            return true;
+        }
+        if (next === len) {
+            return delete target[seg];
+        }
+        target = target[seg];
+        // A missing or primitive intermediate means there is nothing to unset.
+        if (!isTraversable(target)) {
+            return true;
         }
-        while(segs.length)obj = obj[segs.shift()];
-        return delete obj[last];
+        idx = next;
     }
     return true;
 };

package/dist/unsetKey.js

@@ -0,0 +1,36 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import type from './type.js';
+import { isReserved, ReservedKeyError } from './ReservedKeyError.js';
+// Deletes a single literal key off a plain object. Dots are not path separators.
+function unsetKey(target, key) {
+    if (!type.isObject(target)) {
+        throw new TypeError('unsetKey: target must be a plain object');
+    }
+    if (!type.isString(key)) {
+        throw new TypeError('unsetKey: key must be a string');
+    }
+    // Rejected even on null-proto targets, where the delete would be safe: a caller seeing
+    // ReservedKeyError always knows the key was rejected, regardless of target shape.
+    if (isReserved(key)) {
+        throw new ReservedKeyError(key);
+    }
+    // Own-property check so deleting an absent key never touches the prototype chain.
+    if (Object.hasOwn(target, key)) {
+        delete target[key];
+    }
+    return target;
+}
+export default unsetKey;

package/dist/urlQuery.js

@@ -12,17 +12,26 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import serializer from './serializer.js';
+*/ // Imported from the source module, not index.js, to avoid a circular import.
+import { isReserved } from './ReservedKeyError.js';
+import serializer from './serializer.js';
+import setKey from './setKey.js';
 import type from './type.js';
 const parse = (str)=>{
     const parsed = new URLSearchParams(str);
     const deserialized = {};
     parsed.forEach((value, key)=>{
+        // URL keys are user-controlled: skip reserved-named keys (?__proto__=...) and keep parsing.
+        if (isReserved(key)) {
+            return;
+        }
+        let resolved;
         try {
-            deserialized[key] = serializer.deserializeFromString(value);
+            resolved = serializer.deserializeFromString(value);
         } catch (error) {
-            deserialized[key] = value;
+            resolved = value;
         }
+        setKey(deserialized, key, resolved);
     });
     return deserialized;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/helpers",
-  "version": "5.5.1",
+  "version": "6.0.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -31,14 +31,13 @@
     "dist/*"
   ],
   "dependencies": {
-    "@lowdefy/errors": "5.5.1",
-    "intl-messageformat": "11.2.7",
-    "lodash.merge": "4.6.2"
+    "@lowdefy/errors": "6.0.0",
+    "intl-messageformat": "11.2.7"
   },
   "devDependencies": {
     "@jest/globals": "28.1.3",
-    "@swc/cli": "0.8.0",
-    "@swc/core": "1.15.18",
+    "@swc/cli": "0.8.1",
+    "@swc/core": "1.15.32",
     "@swc/jest": "0.2.39",
     "jest": "28.1.3",
     "jest-diff": "28.1.3"