@nullix/zod-mongoose-studio 3.3.1 → 3.3.3

package/.output/server/node_modules/devalue/src/base64.js

@@ -1,110 +1,60 @@
-/**
- * Base64 Encodes an arraybuffer
- * @param {ArrayBuffer} arraybuffer
- * @returns {string}
- */
-export function encode64(arraybuffer) {
-  const dv = new DataView(arraybuffer);
-  let binaryString = "";
+/* Baseline 2025 runtimes */
 
-  for (let i = 0; i < arraybuffer.byteLength; i++) {
-    binaryString += String.fromCharCode(dv.getUint8(i));
-  }
+/**	@type {(array_buffer: ArrayBuffer) => string} */
+export function encode_native(array_buffer) {
+	return new Uint8Array(array_buffer).toBase64();
+}
 
-  return binaryToAscii(binaryString);
+/**	@type {(base64: string) => ArrayBuffer} */
+export function decode_native(base64) {
+	return Uint8Array.fromBase64(base64).buffer;
 }
 
-/**
- * Decodes a base64 string into an arraybuffer
- * @param {string} string
- * @returns {ArrayBuffer}
- */
-export function decode64(string) {
-  const binaryString = asciiToBinary(string);
-  const arraybuffer = new ArrayBuffer(binaryString.length);
-  const dv = new DataView(arraybuffer);
+/* Node-compatible runtimes */
 
-  for (let i = 0; i < arraybuffer.byteLength; i++) {
-    dv.setUint8(i, binaryString.charCodeAt(i));
-  }
+/** @type {(array_buffer: ArrayBuffer) => string} */
+export function encode_buffer(array_buffer) {
+	return Buffer.from(array_buffer).toString('base64');
+}
 
-  return arraybuffer;
+/**	@type {(base64: string) => ArrayBuffer} */
+export function decode_buffer(base64) {
+	return Uint8Array.from(Buffer.from(base64, 'base64')).buffer;
 }
 
-const KEY_STRING =
-  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+/* Legacy runtimes */
 
-/**
- * Substitute for atob since it's deprecated in node.
- * Does not do any input validation.
- *
- * @see https://github.com/jsdom/abab/blob/master/lib/atob.js
- *
- * @param {string} data
- * @returns {string}
- */
-function asciiToBinary(data) {
-  if (data.length % 4 === 0) {
-    data = data.replace(/==?$/, "");
-  }
+/** @type {(array_buffer: ArrayBuffer) => string} */
+export function encode_legacy(array_buffer) {
+	const array = new Uint8Array(array_buffer);
+	let binary = '';
 
-  let output = "";
-  let buffer = 0;
-  let accumulatedBits = 0;
+	// the maximum number of arguments to String.fromCharCode.apply
+	// should be around 0xFFFF in modern engines
+	const chunk_size = 0x8000;
+	for (let i = 0; i < array.length; i += chunk_size) {
+		const chunk = array.subarray(i, i + chunk_size);
+		binary += String.fromCharCode.apply(null, chunk);
+	}
 
-  for (let i = 0; i < data.length; i++) {
-    buffer <<= 6;
-    buffer |= KEY_STRING.indexOf(data[i]);
-    accumulatedBits += 6;
-    if (accumulatedBits === 24) {
-      output += String.fromCharCode((buffer & 0xff0000) >> 16);
-      output += String.fromCharCode((buffer & 0xff00) >> 8);
-      output += String.fromCharCode(buffer & 0xff);
-      buffer = accumulatedBits = 0;
-    }
-  }
-  if (accumulatedBits === 12) {
-    buffer >>= 4;
-    output += String.fromCharCode(buffer);
-  } else if (accumulatedBits === 18) {
-    buffer >>= 2;
-    output += String.fromCharCode((buffer & 0xff00) >> 8);
-    output += String.fromCharCode(buffer & 0xff);
-  }
-  return output;
+	return btoa(binary);
 }
 
-/**
- * Substitute for btoa since it's deprecated in node.
- * Does not do any input validation.
- *
- * @see https://github.com/jsdom/abab/blob/master/lib/btoa.js
- *
- * @param {string} str
- * @returns {string}
- */
-function binaryToAscii(str) {
-  let out = "";
-  for (let i = 0; i < str.length; i += 3) {
-    /** @type {[number, number, number, number]} */
-    const groupsOfSix = [undefined, undefined, undefined, undefined];
-    groupsOfSix[0] = str.charCodeAt(i) >> 2;
-    groupsOfSix[1] = (str.charCodeAt(i) & 0x03) << 4;
-    if (str.length > i + 1) {
-      groupsOfSix[1] |= str.charCodeAt(i + 1) >> 4;
-      groupsOfSix[2] = (str.charCodeAt(i + 1) & 0x0f) << 2;
-    }
-    if (str.length > i + 2) {
-      groupsOfSix[2] |= str.charCodeAt(i + 2) >> 6;
-      groupsOfSix[3] = str.charCodeAt(i + 2) & 0x3f;
-    }
-    for (let j = 0; j < groupsOfSix.length; j++) {
-      if (typeof groupsOfSix[j] === "undefined") {
-        out += "=";
-      } else {
-        out += KEY_STRING[groupsOfSix[j]];
-      }
-    }
-  }
-  return out;
+/**	@type {(base64: string) => ArrayBuffer} */
+export function decode_legacy(base64) {
+	const binary_string = atob(base64);
+	const len = binary_string.length;
+	const array = new Uint8Array(len);
+
+	for (let i = 0; i < len; i++) {
+		array[i] = binary_string.charCodeAt(i);
+	}
+
+	return array.buffer;
 }
+
+const native = typeof Uint8Array.fromBase64 === 'function';
+const buffer = typeof process === 'object' && process.versions?.node !== undefined;
+
+export const encode64 = native ? encode_native : buffer ? encode_buffer : encode_legacy;
+export const decode64 = native ? decode_native : buffer ? decode_buffer : decode_legacy;

package/.output/server/node_modules/devalue/src/constants.js

@@ -5,3 +5,8 @@ export const POSITIVE_INFINITY = -4;
 export const NEGATIVE_INFINITY = -5;
 export const NEGATIVE_ZERO = -6;
 export const SPARSE = -7;
+
+// The largest valid value for a JavaScript array's `length` property,
+// and the largest valid array index (one less than the max length).
+export const MAX_ARRAY_LEN = 2 ** 32 - 1;
+export const MAX_ARRAY_INDEX = MAX_ARRAY_LEN - 1;

package/.output/server/node_modules/devalue/src/operations.js

@@ -0,0 +1,221 @@
+import { MAX_ARRAY_INDEX } from './constants.js';
+import {
+	enumerable_symbols,
+	get_type,
+	is_buffer,
+	is_plain_object,
+	valid_array_indices
+} from './utils.js';
+
+/**
+ * Merges caller-provided operation overrides over the defaults. Iterating the
+ * default keys (rather than the override's own keys) means nullish members
+ * fall back to the default, and inherited members — e.g. from a class
+ * instance — are picked up.
+ *
+ * @template {Record<string, any>} T
+ * @param {T} defaults
+ * @param {Partial<T> | undefined} overrides
+ * @returns {T}
+ */
+export function merge_operations(defaults, overrides) {
+	if (!overrides) return defaults;
+
+	const merged = /** @type {T} */ ({});
+
+	for (const key of /** @type {(keyof T)[]} */ (Object.keys(defaults))) {
+		merged[key] = overrides[key] ?? defaults[key];
+	}
+
+	return merged;
+}
+
+/** @type {{ kind: 'not-plain' }} */
+const NOT_PLAIN = /* @__PURE__ */ Object.freeze({ kind: 'not-plain' });
+
+/** @type {{ kind: 'symbol-keys' }} */
+const SYMBOL_KEYS = /* @__PURE__ */ Object.freeze({ kind: 'symbol-keys' });
+
+/**
+ * The default implementations of every introspection/extraction operation
+ * `stringify` performs on the value being serialized. Each one uses native
+ * JavaScript semantics (property access, iteration, prototype methods, etc).
+ *
+ * Pass overrides via the `operations` option of `stringify`/`stringifyAsync`
+ * to customize how values are inspected — e.g. to serialize values without
+ * triggering getters, proxy traps, or patched prototype methods, or to
+ * serialize values that live in a different JavaScript runtime (a `node:vm`
+ * context, a WASM-hosted engine, a remote process) through handle objects.
+ *
+ * The object is frozen — it is shared by every `stringify` call that does
+ * not override a given operation.
+ *
+ */
+/** @type {import('./types.js').DefaultStringifyOperations} */
+const stringify_operations = {
+	identify: (value) => value,
+
+	typeOf: (value) => (value === null ? 'null' : typeof value),
+
+	toPrimitive: (value) => value,
+
+	tagOf: (value) => get_type(value),
+
+	isThenable: (value) => typeof value.then === 'function',
+
+	toPromise: (thenable) => Promise.resolve(thenable),
+
+	unbox: (boxed) => boxed.valueOf(),
+
+	toISOString: (date) => (isNaN(date.getDate()) ? '' : date.toISOString()),
+
+	toStringValue: (value) => value.toString(),
+
+	regExpInfo: (regexp) => ({ source: regexp.source, flags: regexp.flags }),
+
+	valuesOf: (set) => set,
+
+	entriesOf: (map) => map,
+
+	viewInfo: (view) => {
+		// Node Buffers may share a pool containing unrelated, sensitive data.
+		// Copy only the visible bytes, without using Buffer's pooling or slice.
+		if (is_buffer(view)) view = new Uint8Array(view);
+
+		return {
+			buffer: view.buffer,
+			byteOffset: view.byteOffset,
+			byteLength: view.byteLength,
+			length: view.length,
+			bufferByteLength: view.buffer.byteLength
+		};
+	},
+
+	toArrayBuffer: (buffer) => buffer,
+
+	lengthOf: (array) => array.length,
+
+	hasOwn: (value, key) => Object.hasOwn(value, key),
+
+	indicesOf: (array) => valid_array_indices(array),
+
+	shapeOf: (value) => {
+		if (!is_plain_object(value)) return NOT_PLAIN;
+		if (enumerable_symbols(value).length > 0) return SYMBOL_KEYS;
+
+		return {
+			kind: Object.getPrototypeOf(value) === null ? 'null-proto' : 'plain',
+			keys: Object.keys(value)
+		};
+	},
+
+	get: (value, key) => value[key]
+};
+
+export const default_stringify_operations = /* @__PURE__ */ Object.freeze(stringify_operations);
+
+const array_buffer_byte_length = Object.getOwnPropertyDescriptor(
+	ArrayBuffer.prototype,
+	'byteLength'
+).get;
+
+const shared_array_buffer_byte_length =
+	typeof SharedArrayBuffer === 'undefined'
+		? undefined
+		: Object.getOwnPropertyDescriptor(SharedArrayBuffer.prototype, 'byteLength').get;
+
+/**
+ * The default implementations of every construction operation `parse` and
+ * `unflatten` perform while reviving a value. Each one uses native
+ * JavaScript semantics (built-in constructors, property assignment, etc).
+ *
+ * Pass overrides via the `operations` option of `parse`/`unflatten` to
+ * customize how values are built — e.g. to construct them from the
+ * intrinsics of a different realm (a `node:vm` context), or to build up
+ * values inside another JavaScript runtime (a WASM-hosted engine, a remote
+ * process) through handle objects.
+ *
+ * The object is frozen — it is shared by every `parse` call that does not
+ * override a given operation.
+ *
+ */
+/** @type {import('./types.js').DefaultParseOperations} */
+const parse_operations = {
+	fromPrimitive: (primitive) => primitive,
+
+	fromISOString: (iso) => new Date(iso),
+
+	fromStringValue: (tag, text) => {
+		if (tag === 'URL') return new URL(text);
+		if (tag === 'URLSearchParams') return new URLSearchParams(text);
+		// 'Temporal.Instant', 'Temporal.PlainDate', ...
+		// @ts-expect-error TS doesn't know about Temporal yet
+		return Temporal[tag.slice(9)].from(text);
+	},
+
+	fromArrayBuffer: (buffer) => buffer,
+
+	fromRegExpInfo: (source, flags) => new RegExp(source, flags),
+
+	fromViewInfo: (tag, buffer, byteOffset, length) => {
+		// A reviver can replace an ArrayBuffer with a length or array-like value,
+		// which a typed array constructor would use to allocate a new buffer.
+		// The native getters check internal slots, so they work across realms
+		// and cannot be fooled by a forged prototype or Symbol.toStringTag.
+		try {
+			array_buffer_byte_length.call(buffer);
+		} catch (error) {
+			if (!shared_array_buffer_byte_length) throw error;
+			shared_array_buffer_byte_length.call(buffer);
+		}
+
+		const Constructor = /** @type {any} */ (globalThis)[tag];
+		return byteOffset !== undefined
+			? new Constructor(buffer, byteOffset, length)
+			: new Constructor(buffer);
+	},
+
+	box: (value) => Object(value),
+
+	createArray: (length) => new Array(length),
+
+	createSparseArray: (length) => {
+		/** @type {any[]} */
+		const array = [];
+
+		// Setting `array.length = length` (or equivalently calling
+		// `new Array(length)`) on an untrusted length is a DoS vector: V8
+		// eagerly allocates a contiguous backing store for array lengths below
+		// ~10^8, so a small payload with a huge declared length can force
+		// arbitrary memory allocation. Touching the largest-possible index
+		// first forces V8 into dictionary-elements mode, where `length` is
+		// just a number and no contiguous allocation occurs.
+		array[MAX_ARRAY_INDEX] = undefined;
+		delete array[MAX_ARRAY_INDEX];
+		array.length = length;
+
+		return array;
+	},
+
+	createObject: () => ({}),
+
+	createNullPrototypeObject: () => Object.create(null),
+
+	createSet: () => new Set(),
+
+	createMap: () => new Map(),
+
+	set: (target, key, value) => {
+		target[key] = value;
+	},
+
+	addValue: (set, value) => {
+		set.add(value);
+	},
+
+	addEntry: (map, key, value) => {
+		map.set(key, value);
+	}
+};
+
+export const default_parse_operations = /* @__PURE__ */ Object.freeze(parse_operations);

package/.output/server/node_modules/devalue/src/parse.js

@@ -8,22 +8,29 @@ import {
 	SPARSE,
 	UNDEFINED
 } from './constants.js';
+import { default_parse_operations, merge_operations } from './operations.js';
+import { is_valid_array_index, is_valid_array_len } from './utils.js';
 
 /**
  * Revive a value serialized with `devalue.stringify`
  * @param {string} serialized
  * @param {Record<string, (value: any) => any>} [revivers]
+ * @param {import('./types.js').ParseOptions} [options]
  */
-export function parse(serialized, revivers) {
-	return unflatten(JSON.parse(serialized), revivers);
+export function parse(serialized, revivers, options) {
+	return unflatten(JSON.parse(serialized), revivers, options);
 }
 
 /**
  * Revive a value flattened with `devalue.stringify`
  * @param {number | any[]} parsed
  * @param {Record<string, (value: any) => any>} [revivers]
+ * @param {import('./types.js').ParseOptions} [options]
  */
-export function unflatten(parsed, revivers) {
+export function unflatten(parsed, revivers, options) {
+	/** @type {import('./types.js').ParseOperations} */
+	const ops = merge_operations(default_parse_operations, options?.operations);
+
 	if (typeof parsed === 'number') return hydrate(parsed, true);
 
 	if (!Array.isArray(parsed) || parsed.length === 0) {
@@ -46,11 +53,11 @@ export function unflatten(parsed, revivers) {
 	 * @returns {any}
 	 */
 	function hydrate(index, standalone = false) {
-		if (index === UNDEFINED) return undefined;
-		if (index === NAN) return NaN;
-		if (index === POSITIVE_INFINITY) return Infinity;
-		if (index === NEGATIVE_INFINITY) return -Infinity;
-		if (index === NEGATIVE_ZERO) return -0;
+		if (index === UNDEFINED) return ops.fromPrimitive(undefined);
+		if (index === NAN) return ops.fromPrimitive(NaN);
+		if (index === POSITIVE_INFINITY) return ops.fromPrimitive(Infinity);
+		if (index === NEGATIVE_INFINITY) return ops.fromPrimitive(-Infinity);
+		if (index === NEGATIVE_ZERO) return ops.fromPrimitive(-0);
 
 		if (standalone || typeof index !== 'number') {
 			throw new Error(`Invalid input`);
@@ -58,18 +65,19 @@ export function unflatten(parsed, revivers) {
 
 		if (index in hydrated) return hydrated[index];
 
+		if (index >= values.length) {
+			throw new Error(`Invalid input`);
+		}
+
 		const value = values[index];
 
 		if (!value || typeof value !== 'object') {
-			hydrated[index] = value;
+			hydrated[index] = ops.fromPrimitive(value);
 		} else if (Array.isArray(value)) {
 			if (typeof value[0] === 'string') {
 				const type = value[0];
 
-				const reviver =
-					revivers && Object.hasOwn(revivers, type)
-						? revivers[type]
-						: undefined;
+				const reviver = revivers && Object.hasOwn(revivers, type) ? revivers[type] : undefined;
 
 				if (reviver) {
 					let i = value[1];
@@ -79,6 +87,16 @@ export function unflatten(parsed, revivers) {
 						i = values.push(value[1]) - 1;
 					}
 
+					// If the payload is already hydrated, its recursion has already
+					// terminated (e.g. a self-referential object cached itself before
+					// following its own back-reference), so revive it directly. Falling
+					// through to the `hydrating` guard here would wrongly reject a valid
+					// cycle. An actually infinite payload (e.g. `[["Custom", 0]]`) is never
+					// cached, so it still hits the guard below.
+					if (Object.hasOwn(hydrated, i)) {
+						return (hydrated[index] = reviver(hydrated[i]));
+					}
+
 					hydrating ??= new Set();
 
 					if (hydrating.has(i)) {
@@ -94,52 +112,62 @@ export function unflatten(parsed, revivers) {
 
 				switch (type) {
 					case 'Date':
-						hydrated[index] = new Date(value[1]);
+						hydrated[index] = ops.fromISOString(value[1]);
 						break;
 
 					case 'Set':
-						const set = new Set();
+						const set = ops.createSet();
 						hydrated[index] = set;
 						for (let i = 1; i < value.length; i += 1) {
-							set.add(hydrate(value[i]));
+							ops.addValue(set, hydrate(value[i]));
 						}
 						break;
 
 					case 'Map':
-						const map = new Map();
+						const map = ops.createMap();
 						hydrated[index] = map;
 						for (let i = 1; i < value.length; i += 2) {
-							map.set(hydrate(value[i]), hydrate(value[i + 1]));
+							ops.addEntry(map, hydrate(value[i]), hydrate(value[i + 1]));
 						}
 						break;
 
 					case 'RegExp':
-						hydrated[index] = new RegExp(value[1], value[2]);
+						hydrated[index] = ops.fromRegExpInfo(value[1], value[2]);
 						break;
 
-					case 'Object':
-						const object = Object(value[1]);
+					case 'Object': {
+						const wrapped_index = value[1];
 
-						if (Object.hasOwn(object, '__proto__')) {
-							throw new Error('Cannot parse an object with a `__proto__` property');
+						if (
+							typeof values[wrapped_index] === 'object' &&
+							values[wrapped_index][0] !== 'BigInt'
+						) {
+							// avoid infinite recusion in case of malformed input
+							throw new Error('Invalid input');
 						}
 
-						hydrated[index] = object;
+						hydrated[index] = ops.box(hydrate(wrapped_index));
 						break;
+					}
 
 					case 'BigInt':
-						hydrated[index] = BigInt(value[1]);
+						hydrated[index] = ops.fromPrimitive(BigInt(value[1]));
 						break;
 
 					case 'null':
-						const obj = Object.create(null);
+						const obj = ops.createNullPrototypeObject();
 						hydrated[index] = obj;
 						for (let i = 1; i < value.length; i += 2) {
-							if (value[i] === '__proto__') {
+							const key = value[i];
+							if (typeof key !== 'string') {
+								throw new Error('Cannot parse an object with a non-string key');
+							}
+
+							if (key === '__proto__') {
 								throw new Error('Cannot parse an object with a `__proto__` property');
 							}
 
-							obj[value[i]] = hydrate(value[i + 1]);
+							ops.set(obj, key, hydrate(value[i + 1]));
 						}
 						break;
 
@@ -148,12 +176,14 @@ export function unflatten(parsed, revivers) {
 					case 'Uint8ClampedArray':
 					case 'Int16Array':
 					case 'Uint16Array':
+					case 'Float16Array':
 					case 'Int32Array':
 					case 'Uint32Array':
 					case 'Float32Array':
 					case 'Float64Array':
 					case 'BigInt64Array':
-					case 'BigUint64Array': {
+					case 'BigUint64Array':
+					case 'DataView': {
 						if (values[value[1]][0] !== 'ArrayBuffer') {
 							// without this, if we receive malformed input we could
 							// end up trying to hydrate in a circle or allocate
@@ -161,14 +191,9 @@ export function unflatten(parsed, revivers) {
 							throw new Error('Invalid data');
 						}
 
-						const TypedArrayConstructor = globalThis[type];
 						const buffer = hydrate(value[1]);
-						const typedArray = new TypedArrayConstructor(buffer);
 
-						hydrated[index] =
-							value[2] !== undefined
-								? typedArray.subarray(value[2], value[3])
-								: typedArray;
+						hydrated[index] = ops.fromViewInfo(type, buffer, value[2], value[3]);
 
 						break;
 					}
@@ -178,11 +203,12 @@ export function unflatten(parsed, revivers) {
 						if (typeof base64 !== 'string') {
 							throw new Error('Invalid ArrayBuffer encoding');
 						}
-						const arraybuffer = decode64(base64);
-						hydrated[index] = arraybuffer;
+						hydrated[index] = ops.fromArrayBuffer(decode64(base64));
 						break;
 					}
 
+					case 'URL':
+					case 'URLSearchParams':
 					case 'Temporal.Duration':
 					case 'Temporal.Instant':
 					case 'Temporal.PlainDate':
@@ -191,21 +217,8 @@ export function unflatten(parsed, revivers) {
 					case 'Temporal.PlainMonthDay':
 					case 'Temporal.PlainYearMonth':
 					case 'Temporal.ZonedDateTime': {
-						const temporalName = type.slice(9);
-						// @ts-expect-error TS doesn't know about Temporal yet
-						hydrated[index] = Temporal[temporalName].from(value[1]);
-						break;
-					}
-
-					case 'URL': {
-						const url = new URL(value[1]);
-						hydrated[index] = url;
-						break;
-					}
-
-					case 'URLSearchParams': {
-						const url = new URLSearchParams(value[1]);
-						hydrated[index] = url;
+						// the same tags `toStringValue` serializes on the stringify side
+						hydrated[index] = ops.fromStringValue(type, value[1]);
 						break;
 					}
 
@@ -216,36 +229,38 @@ export function unflatten(parsed, revivers) {
 				// Sparse array encoding: [SPARSE, length, idx, val, idx, val, ...]
 				const len = value[1];
 
-				if (!Number.isInteger(len) || len < 0) {
+				if (!is_valid_array_len(len)) {
 					throw new Error('Invalid input');
 				}
 
-				const array = new Array(len);
+				// `len` comes from the input rather than being bounded by it, so
+				// `createSparseArray` is responsible for not allocating storage
+				// proportional to it.
+				const array = ops.createSparseArray(len);
 				hydrated[index] = array;
 
 				for (let i = 2; i < value.length; i += 2) {
 					const idx = value[i];
 
-					if (!Number.isInteger(idx) || idx < 0 || idx >= len) {
+					if (!is_valid_array_index(idx) || idx >= len) {
 						throw new Error('Invalid input');
 					}
 
-					array[idx] = hydrate(value[i + 1]);
+					ops.set(array, idx, hydrate(value[i + 1]));
 				}
 			} else {
-				const array = new Array(value.length);
+				const array = ops.createArray(value.length);
 				hydrated[index] = array;
 
 				for (let i = 0; i < value.length; i += 1) {
 					const n = value[i];
 					if (n === HOLE) continue;
 
-					array[i] = hydrate(n);
+					ops.set(array, i, hydrate(n));
 				}
 			}
 		} else {
-			/** @type {Record<string, any>} */
-			const object = {};
+			const object = ops.createObject();
 			hydrated[index] = object;
 
 			for (const key of Object.keys(value)) {
@@ -253,8 +268,7 @@ export function unflatten(parsed, revivers) {
 					throw new Error('Cannot parse an object with a `__proto__` property');
 				}
 
-				const n = value[key];
-				object[key] = hydrate(n);
+				ops.set(object, key, hydrate(value[key]));
 			}
 		}