@maroonedog/luq 2.4.4 → 2.5.0

package/dist/plugins/one-of/one-of.js

@@ -36,7 +36,10 @@ function describeAllowed(allowed) {
 function areAllMembersPrimitive(allowed) {
     return allowed.every((member) => member === null || typeof member !== "object");
 }
-/** One membership test, decided ONCE at build time and never re-decided. */
+/** One membership test, decided ONCE at build time and never re-decided. The
+ *  list must already be a snapshot: the linear path CLOSES OVER it rather than
+ *  copying it into a Set, so a caller-owned array reaching here would stay
+ *  readable — and mutable — through the returned validator. */
 function createMembershipTest(allowed) {
     if (allowed.length > SET_MEMBERSHIP_THRESHOLD &&
         areAllMembersPrimitive(allowed)) {
@@ -53,13 +56,24 @@ exports.oneOfPlugin = (0, plugin_definition_1.definePlugin)()({
         if (!(0, types_1.isArray)(allowed) || allowed.length === 0) {
             throw new plugin_definition_1.PluginArgumentError(ctx.pluginName, "allowed", allowed);
         }
-        const isMember = createMembershipTest(allowed);
-        const rendered = describeAllowed(allowed);
+        // A built validator is a SNAPSHOT of what it was built from, and this list
+        // arrives BY REFERENCE: reached through the `enum` keyword it is the very
+        // array inside the caller's schema document. Without this copy, appending
+        // to that array in place after build() — a config reload that mutates the
+        // document rather than replacing it — silently widens a validator that is
+        // already serving traffic. It would also do so only SOMETIMES: the Set
+        // path in createMembershipTest copies and the linear path does not, so the
+        // behaviour would flip at a member count the caller has no reason to know
+        // about. Copying here, at the one point where the caller's array enters
+        // the plugin, is what makes both paths and the reported `expected` agree.
+        const members = Object.freeze(allowed.slice());
+        const isMember = createMembershipTest(members);
+        const rendered = describeAllowed(members);
         return (0, create_rule_1.check)({
             code: ctx.code,
             messageFactory: ctx.messageFactory,
             severity: ctx.severity,
-            run: (value) => isMember(value) ? types_1.PASS : (0, types_1.fail)({ expected: allowed, actual: value }),
+            run: (value) => isMember(value) ? types_1.PASS : (0, types_1.fail)({ expected: members, actual: value }),
             describe: () => `Value must be one of: ${rendered}`,
             buildMessageContext: () => ({}),
         });

package/dist/plugins/one-of/one-of.mjs

@@ -33,7 +33,10 @@ function describeAllowed(allowed) {
 function areAllMembersPrimitive(allowed) {
     return allowed.every((member) => member === null || typeof member !== "object");
 }
-/** One membership test, decided ONCE at build time and never re-decided. */
+/** One membership test, decided ONCE at build time and never re-decided. The
+ *  list must already be a snapshot: the linear path CLOSES OVER it rather than
+ *  copying it into a Set, so a caller-owned array reaching here would stay
+ *  readable — and mutable — through the returned validator. */
 function createMembershipTest(allowed) {
     if (allowed.length > SET_MEMBERSHIP_THRESHOLD &&
         areAllMembersPrimitive(allowed)) {
@@ -50,13 +53,24 @@ export const oneOfPlugin = /*#__PURE__*/ definePlugin()({
         if (!isArray(allowed) || allowed.length === 0) {
             throw new PluginArgumentError(ctx.pluginName, "allowed", allowed);
         }
-        const isMember = createMembershipTest(allowed);
-        const rendered = describeAllowed(allowed);
+        // A built validator is a SNAPSHOT of what it was built from, and this list
+        // arrives BY REFERENCE: reached through the `enum` keyword it is the very
+        // array inside the caller's schema document. Without this copy, appending
+        // to that array in place after build() — a config reload that mutates the
+        // document rather than replacing it — silently widens a validator that is
+        // already serving traffic. It would also do so only SOMETIMES: the Set
+        // path in createMembershipTest copies and the linear path does not, so the
+        // behaviour would flip at a member count the caller has no reason to know
+        // about. Copying here, at the one point where the caller's array enters
+        // the plugin, is what makes both paths and the reported `expected` agree.
+        const members = Object.freeze(allowed.slice());
+        const isMember = createMembershipTest(members);
+        const rendered = describeAllowed(members);
         return check({
             code: ctx.code,
             messageFactory: ctx.messageFactory,
             severity: ctx.severity,
-            run: (value) => isMember(value) ? PASS : fail({ expected: allowed, actual: value }),
+            run: (value) => isMember(value) ? PASS : fail({ expected: members, actual: value }),
             describe: () => `Value must be one of: ${rendered}`,
             buildMessageContext: () => ({}),
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maroonedog/luq",
-  "version": "2.4.4",
+  "version": "2.5.0",
   "description": "Universal Model & API Definition Platform - TypeScript validation library evolving into cross-language code generation",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -538,9 +538,9 @@
     "ts-node": "^10.9.2",
     "tsx": "^4.20.3",
     "typescript": "^5.8.3",
-    "valibot": "^1.4.2",
+    "valibot": "^1.5.0",
     "yup": "^1.7.1",
-    "zod": "^4.0.14"
+    "zod": "^4.6.2"
   },
   "sideEffects": false
 }