@o3co/ts.hocon 1.10.0 → 1.12.0

package/dist/index.js

@@ -1,3 +1,10 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
 // src/coerce.ts
 var DECIMAL_NUMBER_RE = /^-?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/;
 function isHoconWs(cp) {
@@ -639,6 +646,7 @@ function isFileNotFoundError(e) {
 // src/internal/resolver/include-loader.ts
 import { createRequire } from "module";
 import * as nodePath from "path";
+import { pathToFileURL } from "url";
 
 // src/internal/lexer/lexer.ts
 function isHoconWhitespace(ch) {
@@ -1481,25 +1489,80 @@ function parseTokens(tokens) {
   return new Parser(tokens).parse();
 }
 
+// src/internal/strip-bom.ts
+function stripBom(input) {
+  return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
+}
+
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+async function guardStackDepthAsync(fn, wrap) {
+  try {
+    return await fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+
 // src/internal/properties/properties.ts
 function parseProperties(input) {
   const pairs = [];
-  for (const { text, line } of logicalLines(input)) {
+  for (const { text, line } of logicalLines(stripBom(input))) {
     const [rawKey, rawValue] = splitKeyValue(text);
     const key = unescapeProps(rawKey, line);
     if (key === "") continue;
-    pairs.push([key, unescapeProps(rawValue, line)]);
+    const segments = key.split(".");
+    if (tooDeep(segments.length)) {
+      throw new ParseError(
+        `key maps to a path ${segments.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+        line,
+        1
+      );
+    }
+    pairs.push([segments, unescapeProps(rawValue, line)]);
   }
   return nestPairs(pairs);
 }
 function nestPairs(pairs) {
   const root = /* @__PURE__ */ Object.create(null);
-  const sorted = [...pairs].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  for (const [key, value] of sorted) {
-    setNested(root, key.split("."), value);
+  const sorted = [...pairs].sort(([a], [b]) => compareSegments(a, b));
+  for (const [segments, value] of sorted) {
+    setNested(root, segments, value);
   }
   return root;
 }
+function compareSegments(a, b) {
+  const n = Math.min(a.length, b.length);
+  for (let i = 0; i < n; i++) {
+    const x = a[i];
+    const y = b[i];
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  return a.length - b.length;
+}
 function logicalLines(input) {
   const natural = input.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
   const out = [];
@@ -1586,19 +1649,16 @@ function unescapeProps(s, line) {
   }
   return out;
 }
-var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function setNested(obj, segments, value) {
   let current = obj;
   for (let i = 0; i < segments.length - 1; i++) {
     const seg = segments[i];
-    if (seg === void 0 || DANGEROUS_KEYS.has(seg)) return;
     if (!(seg in current) || typeof current[seg] !== "object" || current[seg] === null) {
       current[seg] = /* @__PURE__ */ Object.create(null);
     }
     current = current[seg];
   }
   const last = segments[segments.length - 1];
-  if (last === void 0 || DANGEROUS_KEYS.has(last)) return;
   if (typeof current[last] === "object" && current[last] !== null) return;
   current[last] = value;
 }
@@ -1619,7 +1679,22 @@ function recordToHoconValue(obj) {
 }
 
 // src/internal/resolver/include-loader.ts
-var _require = createRequire(import.meta.url);
+var _require;
+function getRequire() {
+  if (_require === void 0) {
+    _require = pickRequire(
+      typeof __require === "function" ? __require : void 0,
+      import.meta.url
+    );
+  }
+  return _require;
+}
+function pickRequire(candidate, metaUrl) {
+  if (typeof candidate?.resolve === "function") {
+    return candidate;
+  }
+  return createRequire(metaUrl ?? pathToFileURL(nodePath.join(process.cwd(), "noop.js")));
+}
 function isPnpPath(p) {
   return p.includes(".yarn/cache") || p.includes(".pnp.cjs") || p.includes(".pnp.loader");
 }
@@ -1675,7 +1750,7 @@ function defaultPackageResolver(identifier, file, includingFile, baseDir, resolv
   const from = resolveFrom ? Array.isArray(resolveFrom) ? resolveFrom : [resolveFrom] : baseDir ? [baseDir] : includingFile ? [nodePath.dirname(includingFile)] : [process.cwd()];
   let resolved;
   try {
-    resolved = _require.resolve(`${identifier}/${file}`, { paths: from });
+    resolved = getRequire().resolve(`${identifier}/${file}`, { paths: from });
   } catch {
     throw new PackageLookupError(
       `include package("${identifier}", "${file}"): module not found (starting from: ${from.join(", ")})`,
@@ -2729,10 +2804,10 @@ var Config = class _Config {
     }
     if (v.kind === "object") {
       const converted = numericObjectToArray(v);
-      if (converted !== null) return converted.map(hoconToJs);
+      if (converted !== null) return converted.map((item) => hoconToJs(item));
     }
     if (v.kind !== "array") throw new ConfigError(`expected array at ${path2}`, path2);
-    return v.items.map(hoconToJs);
+    return v.items.map((item) => hoconToJs(item));
   }
   has(path2) {
     return this.lookupNode(path2) !== void 0;
@@ -2860,8 +2935,52 @@ var Config = class _Config {
       originDescription: this._originDescription
     });
   }
-  toObject() {
-    return hoconToJs(this.root);
+  /**
+   * The whole config as plain JS data: objects, arrays, strings, numbers,
+   * booleans and `null`.
+   *
+   * Keys are reproduced exactly as the config carries them, `__proto__`,
+   * `constructor` and `prototype` included: each is defined as an **own data
+   * property**, so the returned object's prototype is always
+   * `Object.prototype`, and this call writes nothing to the global one.
+   *
+   * ### Passing the result to other code
+   *
+   * A config file — especially a `.properties` file or an env namespace you
+   * merged in — can therefore hand you an own `__proto__` key, and what happens
+   * next depends entirely on how the consumer copies it:
+   *
+   * ```ts
+   * const data = cfg.toObject()
+   * { ...data }                  // safe — own properties are copied as data
+   * structuredClone(data)        // safe
+   * Object.assign({}, data)      // NOT safe — [[Set]] on the {} target hits
+   *                              // Object.prototype's __proto__ setter: the key
+   *                              // vanishes and config data becomes the result's
+   *                              // prototype
+   * deepMerge({}, data)          // NOT safe — a naive recursive merge reads
+   *                              // target['__proto__'], gets Object.prototype,
+   *                              // and writes to it: global pollution
+   * for (const k in data) …      // prefer Object.entries / Object.keys
+   * ```
+   *
+   * Those two hazards come from the **destination** object's prototype, so no
+   * option here can disarm them — copy with spread or `structuredClone` instead.
+   *
+   * What `{ nullPrototype: true }` does give you is a result that inherits
+   * nothing: every object comes back with a `null` prototype, so reading
+   * `x.__proto__`, `x.constructor` or `x.toString` yields config data or
+   * `undefined` rather than something from `Object.prototype`, and code that
+   * merges *into* this object cannot climb out of it. Keys are all still
+   * present. The trade-off is the usual one for prototype-less objects: not
+   * `instanceof Object`, and no `hasOwnProperty` of their own.
+   *
+   * Numbers follow the JS number model, so an integer wider than 2^53 rounds
+   * here even when the config holds it exactly — read those with
+   * {@link Config.getString} instead.
+   */
+  toObject(opts) {
+    return hoconToJs(this.root, opts?.nullPrototype === true);
   }
   /**
    * @internal Test-only: renders this resolved Config's value tree as canonical
@@ -2973,16 +3092,25 @@ function scalarToJs(raw, valueType) {
       return raw;
   }
 }
-function hoconToJs(v) {
+function hoconToJs(v, nullPrototype = false) {
   switch (v.kind) {
     case "scalar":
       return scalarToJs(v.raw, v.valueType);
     case "array":
-      return v.items.map(hoconToJs);
+      return v.items.map((item) => hoconToJs(item, nullPrototype));
     case "object": {
-      const obj = /* @__PURE__ */ Object.create(null);
-      for (const [k, val] of v.fields) obj[k] = hoconToJs(val);
-      return Object.assign({}, obj);
+      const entries = Array.from(v.fields, ([k, val]) => [k, hoconToJs(val, nullPrototype)]);
+      if (nullPrototype) {
+        const obj = /* @__PURE__ */ Object.create(null);
+        for (const [k, val] of entries) Object.defineProperty(obj, k, {
+          value: val,
+          writable: true,
+          enumerable: true,
+          configurable: true
+        });
+        return obj;
+      }
+      return Object.fromEntries(entries);
     }
   }
 }
@@ -3107,13 +3235,16 @@ function buildResolveContext(input, opts) {
   return { ast, resolveOpts };
 }
 function parse(input, opts = {}) {
-  const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = resolve2(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  return parseStringWithOptions(input, opts);
 }
 var parseString = parse;
 function parseStringWithOptions(input, opts = {}) {
+  return guardStackDepth(
+    () => parseStringInner(input, opts),
+    (msg) => new ParseError(msg, 1, 1, opts.originDescription)
+  );
+}
+function parseStringInner(input, opts) {
   const resolveSubstitutions = opts.resolveSubstitutions ?? true;
   const { ast, resolveOpts } = buildResolveContext(input, opts);
   if (resolveSubstitutions) {
@@ -3144,10 +3275,12 @@ function parseFileWithOptions(filePath, opts = {}) {
   });
 }
 async function parseAsync(input, opts = {}) {
-  const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = await resolveAsync(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value);
+  return guardStackDepthAsync(async () => {
+    const { ast, resolveOpts } = buildResolveContext(input, opts);
+    const value = await resolveAsync(ast, resolveOpts);
+    if (value.kind !== "object") throw new Error("resolved value is not an object");
+    return new Config(value);
+  }, (msg) => new ParseError(msg, 1, 1, opts.originDescription));
 }
 function parseFile(filePath, opts = {}) {
   if (typeof process === "undefined" && !opts.readFileSync) {
@@ -3208,7 +3341,10 @@ function isNull(v) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -3216,6 +3352,8 @@ function empty(originDescription) {
   const root = { kind: "object", fields: /* @__PURE__ */ new Map() };
   return Config._fromResolvedValue(root, { originDescription });
 }
+var INT64_MAX = 9223372036854775807n;
+var INT64_MIN = -9223372036854775808n;
 function coerceObject(obj, atPath) {
   const fields = /* @__PURE__ */ new Map();
   for (const [k, v] of Object.entries(obj)) {
@@ -3244,14 +3382,14 @@ function coerceValue(v, atPath) {
           atPath
         );
       }
-      return { kind: "scalar", raw: String(v), valueType: "number" };
+      return { kind: "scalar", raw: Object.is(v, -0) ? "-0" : String(v), valueType: "number" };
     }
     case "boolean":
       return { kind: "scalar", raw: v ? "true" : "false", valueType: "boolean" };
     case "bigint": {
-      if (v > BigInt(Number.MAX_SAFE_INTEGER) || v < BigInt(Number.MIN_SAFE_INTEGER)) {
+      if (v > INT64_MAX || v < INT64_MIN) {
         throw new ConfigError(
-          `fromMap: bigint ${v} exceeds Number.MAX_SAFE_INTEGER (not representable as HOCON number) at path "${atPath}"`,
+          `fromMap: integer ${v} is out of int64 range (HOCON integers are int64; spec F0.5) at path "${atPath}"`,
           atPath
         );
       }

package/dist/zod.cjs

@@ -682,6 +682,7 @@ function isFileNotFoundError(e) {
 // src/internal/resolver/include-loader.ts
 var import_node_module = require("module");
 var nodePath = __toESM(require("path"), 1);
+var import_node_url = require("url");
 
 // src/internal/lexer/lexer.ts
 function isHoconWhitespace(ch) {
@@ -1524,25 +1525,69 @@ function parseTokens(tokens) {
   return new Parser(tokens).parse();
 }
 
+// src/internal/strip-bom.ts
+function stripBom(input) {
+  return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
+}
+
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+
 // src/internal/properties/properties.ts
 function parseProperties(input) {
   const pairs = [];
-  for (const { text, line } of logicalLines(input)) {
+  for (const { text, line } of logicalLines(stripBom(input))) {
     const [rawKey, rawValue] = splitKeyValue(text);
     const key = unescapeProps(rawKey, line);
     if (key === "") continue;
-    pairs.push([key, unescapeProps(rawValue, line)]);
+    const segments = key.split(".");
+    if (tooDeep(segments.length)) {
+      throw new ParseError(
+        `key maps to a path ${segments.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+        line,
+        1
+      );
+    }
+    pairs.push([segments, unescapeProps(rawValue, line)]);
   }
   return nestPairs(pairs);
 }
 function nestPairs(pairs) {
   const root = /* @__PURE__ */ Object.create(null);
-  const sorted = [...pairs].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  for (const [key, value] of sorted) {
-    setNested(root, key.split("."), value);
+  const sorted = [...pairs].sort(([a], [b]) => compareSegments(a, b));
+  for (const [segments, value] of sorted) {
+    setNested(root, segments, value);
   }
   return root;
 }
+function compareSegments(a, b) {
+  const n = Math.min(a.length, b.length);
+  for (let i = 0; i < n; i++) {
+    const x = a[i];
+    const y = b[i];
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  return a.length - b.length;
+}
 function logicalLines(input) {
   const natural = input.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
   const out = [];
@@ -1629,19 +1674,16 @@ function unescapeProps(s, line) {
   }
   return out;
 }
-var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function setNested(obj, segments, value) {
   let current = obj;
   for (let i = 0; i < segments.length - 1; i++) {
     const seg = segments[i];
-    if (seg === void 0 || DANGEROUS_KEYS.has(seg)) return;
     if (!(seg in current) || typeof current[seg] !== "object" || current[seg] === null) {
       current[seg] = /* @__PURE__ */ Object.create(null);
     }
     current = current[seg];
   }
   const last = segments[segments.length - 1];
-  if (last === void 0 || DANGEROUS_KEYS.has(last)) return;
   if (typeof current[last] === "object" && current[last] !== null) return;
   current[last] = value;
 }
@@ -1663,7 +1705,22 @@ function recordToHoconValue(obj) {
 
 // src/internal/resolver/include-loader.ts
 var import_meta = {};
-var _require = (0, import_node_module.createRequire)(import_meta.url);
+var _require;
+function getRequire() {
+  if (_require === void 0) {
+    _require = pickRequire(
+      typeof require === "function" ? require : void 0,
+      import_meta.url
+    );
+  }
+  return _require;
+}
+function pickRequire(candidate, metaUrl) {
+  if (typeof candidate?.resolve === "function") {
+    return candidate;
+  }
+  return (0, import_node_module.createRequire)(metaUrl ?? (0, import_node_url.pathToFileURL)(nodePath.join(process.cwd(), "noop.js")));
+}
 function isPnpPath(p) {
   return p.includes(".yarn/cache") || p.includes(".pnp.cjs") || p.includes(".pnp.loader");
 }
@@ -1719,7 +1776,7 @@ function defaultPackageResolver(identifier, file, includingFile, baseDir, resolv
   const from = resolveFrom ? Array.isArray(resolveFrom) ? resolveFrom : [resolveFrom] : baseDir ? [baseDir] : includingFile ? [nodePath.dirname(includingFile)] : [process.cwd()];
   let resolved;
   try {
-    resolved = _require.resolve(`${identifier}/${file}`, { paths: from });
+    resolved = getRequire().resolve(`${identifier}/${file}`, { paths: from });
   } catch {
     throw new PackageLookupError(
       `include package("${identifier}", "${file}"): module not found (starting from: ${from.join(", ")})`,
@@ -2769,10 +2826,10 @@ var Config = class _Config {
     }
     if (v.kind === "object") {
       const converted = numericObjectToArray(v);
-      if (converted !== null) return converted.map(hoconToJs);
+      if (converted !== null) return converted.map((item) => hoconToJs(item));
     }
     if (v.kind !== "array") throw new ConfigError(`expected array at ${path2}`, path2);
-    return v.items.map(hoconToJs);
+    return v.items.map((item) => hoconToJs(item));
   }
   has(path2) {
     return this.lookupNode(path2) !== void 0;
@@ -2900,8 +2957,52 @@ var Config = class _Config {
       originDescription: this._originDescription
     });
   }
-  toObject() {
-    return hoconToJs(this.root);
+  /**
+   * The whole config as plain JS data: objects, arrays, strings, numbers,
+   * booleans and `null`.
+   *
+   * Keys are reproduced exactly as the config carries them, `__proto__`,
+   * `constructor` and `prototype` included: each is defined as an **own data
+   * property**, so the returned object's prototype is always
+   * `Object.prototype`, and this call writes nothing to the global one.
+   *
+   * ### Passing the result to other code
+   *
+   * A config file — especially a `.properties` file or an env namespace you
+   * merged in — can therefore hand you an own `__proto__` key, and what happens
+   * next depends entirely on how the consumer copies it:
+   *
+   * ```ts
+   * const data = cfg.toObject()
+   * { ...data }                  // safe — own properties are copied as data
+   * structuredClone(data)        // safe
+   * Object.assign({}, data)      // NOT safe — [[Set]] on the {} target hits
+   *                              // Object.prototype's __proto__ setter: the key
+   *                              // vanishes and config data becomes the result's
+   *                              // prototype
+   * deepMerge({}, data)          // NOT safe — a naive recursive merge reads
+   *                              // target['__proto__'], gets Object.prototype,
+   *                              // and writes to it: global pollution
+   * for (const k in data) …      // prefer Object.entries / Object.keys
+   * ```
+   *
+   * Those two hazards come from the **destination** object's prototype, so no
+   * option here can disarm them — copy with spread or `structuredClone` instead.
+   *
+   * What `{ nullPrototype: true }` does give you is a result that inherits
+   * nothing: every object comes back with a `null` prototype, so reading
+   * `x.__proto__`, `x.constructor` or `x.toString` yields config data or
+   * `undefined` rather than something from `Object.prototype`, and code that
+   * merges *into* this object cannot climb out of it. Keys are all still
+   * present. The trade-off is the usual one for prototype-less objects: not
+   * `instanceof Object`, and no `hasOwnProperty` of their own.
+   *
+   * Numbers follow the JS number model, so an integer wider than 2^53 rounds
+   * here even when the config holds it exactly — read those with
+   * {@link Config.getString} instead.
+   */
+  toObject(opts) {
+    return hoconToJs(this.root, opts?.nullPrototype === true);
   }
   /**
    * @internal Test-only: renders this resolved Config's value tree as canonical
@@ -3013,16 +3114,25 @@ function scalarToJs(raw, valueType) {
       return raw;
   }
 }
-function hoconToJs(v) {
+function hoconToJs(v, nullPrototype = false) {
   switch (v.kind) {
     case "scalar":
       return scalarToJs(v.raw, v.valueType);
     case "array":
-      return v.items.map(hoconToJs);
+      return v.items.map((item) => hoconToJs(item, nullPrototype));
     case "object": {
-      const obj = /* @__PURE__ */ Object.create(null);
-      for (const [k, val] of v.fields) obj[k] = hoconToJs(val);
-      return Object.assign({}, obj);
+      const entries = Array.from(v.fields, ([k, val]) => [k, hoconToJs(val, nullPrototype)]);
+      if (nullPrototype) {
+        const obj = /* @__PURE__ */ Object.create(null);
+        for (const [k, val] of entries) Object.defineProperty(obj, k, {
+          value: val,
+          writable: true,
+          enumerable: true,
+          configurable: true
+        });
+        return obj;
+      }
+      return Object.fromEntries(entries);
     }
   }
 }
@@ -3136,10 +3246,30 @@ function buildResolveContext(input, opts) {
   return { ast, resolveOpts };
 }
 function parse(input, opts = {}) {
+  return parseStringWithOptions(input, opts);
+}
+function parseStringWithOptions(input, opts = {}) {
+  return guardStackDepth(
+    () => parseStringInner(input, opts),
+    (msg) => new ParseError(msg, 1, 1, opts.originDescription)
+  );
+}
+function parseStringInner(input, opts) {
+  const resolveSubstitutions = opts.resolveSubstitutions ?? true;
   const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = resolve2(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  if (resolveSubstitutions) {
+    const value = resolve2(ast, resolveOpts);
+    if (value.kind !== "object") throw new Error("resolved value is not an object");
+    return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  }
+  const tree = buildTree(ast, resolveOpts);
+  const hasPlaceholders = containsPlaceholders(tree);
+  return Config._fromUnresolvedResObj(tree, {
+    parseBaseDir: opts.baseDir,
+    originDescription: opts.originDescription,
+    resolved: !hasPlaceholders,
+    resolveOpts
+  });
 }
 function parseFile(filePath, opts = {}) {
   if (typeof process === "undefined" && !opts.readFileSync) {
@@ -3213,7 +3343,7 @@ function coerceValue(value, schema) {
       const obj = value;
       const result = { ...obj };
       for (const key of Object.keys(shape)) {
-        if (key in obj) {
+        if (Object.prototype.hasOwnProperty.call(obj, key)) {
           result[key] = coerceValue(obj[key], shape[key]);
         }
       }

package/dist/zod.d.cts

@@ -1,5 +1,5 @@
 import { ZodType } from 'zod';
-import { C as Config, a as ParseOptions } from './config-PdhVgeLS.cjs';
+import { C as Config, a as ParseOptions } from './config-Dlq6rF3w.cjs';
 
 declare function validate<T>(config: Config, schema: ZodType<T>): T;
 declare function getValidated<T>(config: Config, path: string, schema: ZodType<T>): T;

package/dist/zod.d.ts

@@ -1,5 +1,5 @@
 import { ZodType } from 'zod';
-import { C as Config, a as ParseOptions } from './config-PdhVgeLS.js';
+import { C as Config, a as ParseOptions } from './config-Dlq6rF3w.js';
 
 declare function validate<T>(config: Config, schema: ZodType<T>): T;
 declare function getValidated<T>(config: Config, path: string, schema: ZodType<T>): T;