@o3co/ts.hocon 1.14.0 → 1.14.1

package/README.ja.md

@@ -249,6 +249,8 @@ const app = validate(cfg, Schema)
 const port = getValidated(cfg, 'server.port', z.number().int())
 ```
 
+スキーマが数値や真偽値を求める位置では文字列を変換するので、`PORT=8081` のとき `port = ${?PORT}` は `z.number()` を通ります。変換はスキーマに沿って、object・array・record（各値）・tuple・union・pipe（入力側のスキーマ）・lazy と、optional / nullable / default / prefault / nonoptional / catch / readonly の各ラッパーの中まで届きます。数値や真偽値の literal にも変換します（`z.literal(1)` に対する `"1"`）。object の `catchall` と intersection の中には届きません。`z.discriminatedUnion` は discriminator が選ぶ option に従って変換します。それ以外の union は、値をそのまま受け入れる option があれば変換せず（`z.union([z.number(), z.string()])` では `"5"` は文字列のまま）、なければ変換後の値を受け入れる最初の option に従って変換します（`z.union([z.number(), z.literal('auto')])` では `"8081"` は 8081）。その option を探すために option を順に試すので、深く再帰する通常の union は検証が遅くなります。そこでは `z.discriminatedUnion` を使ってください。
+
 HOCON の duration と byte size は文字列（`30m`、`64KiB`）なので、`z.number()` では通りません。`hocon.duration(unit?)` / `hocon.bytes(unit?)` マーカーは `getDuration()` / `getBytes()` と同じ規則で読み、指定した単位の数値を返します（既定は `ms` / `B`。単位のない数値は getter と同じ意味）。範囲や整数のチェックは、マーカーを数値スキーマに pipe して書きます:
 
 ```ts
@@ -274,7 +276,7 @@ const Backup = z.object({
 getValidated(cfg, 'backup', Backup) // { keep: { years: 0, months: 0, days: 14 } }
 ```
 
-不正な duration / byte size / period は、キーのパス付きのバリデーションエラーになります。マーカーは普通の Zod スキーマなので、`validate`・`getValidated`・`parseWithSchema`・`parseFileWithSchema` をはじめ、Zod が実行するところならどこでも使えます。指数表記（`1e3`、`"1.5e2s"`）は getter もマーカーも読みます。ただしマーカーは数値を JavaScript の値として読むため、double の精度を超える桁数の数値リテラルは、リテラルの文字列を正確に読む getter と結果が異なることがあります（`1.99999999999999999` B は `getBytes()` では 1、マーカーでは 2）。period のマーカーは、小数点や指数を含むリテラル（`7.0`、`1e2`）も整数として読みます（`getPeriod()` は拒否します）。単位付きで書けば（`30s`、`7d`）どちらの差も出ません。
+不正な duration / byte size / period は、キーのパス付きのバリデーションエラーになります。issue の message は問題だけを示し、値は含めません（`not a duration`、`byte size must be non-negative`）。誤ったキーに置かれたシークレットがログに出ないようにするためです。`params.problem` は `invalid`・`negative`・`overflow` のいずれかで、値は Zod に input の報告を求めたときだけ issue の `input` に入ります。マーカーは普通の Zod スキーマなので、`validate`・`getValidated`・`parseWithSchema`・`parseFileWithSchema` をはじめ、Zod が実行するところならどこでも使えます。指数表記（`1e3`、`"1.5e2s"`）は getter もマーカーも読みます。ただしマーカーは数値を JavaScript の値として読むため、double の精度を超える桁数の数値リテラルは、リテラルの文字列を正確に読む getter と結果が異なることがあります（`1.99999999999999999` B は `getBytes()` では 1、マーカーでは 2）。period のマーカーは、小数点や指数を含むリテラル（`7.0`、`1e2`）も整数として読みます（`getPeriod()` は拒否します）。単位付きで書けば（`30s`、`7d`）どちらの差も出ません。
 
 未解決の Config（`resolveSubstitutions: false` でパースしたもの、`resolve()` 前のフォールバックの重なり、または何かが残った `resolve({ allowUnresolved: true })` の結果）に対しては、`validate` は保留中の値が欠けたツリーを検証するのではなく、getter と同じく `NotResolvedError` を投げます。`getValidated` は、値が未解決のパスでは `NotResolvedError` を投げ、解決済みのパスなら検証します。先に `resolve()` を呼んでください。
 
@@ -283,7 +285,7 @@ Zod をピア依存としてインストール:
 npm install zod
 ```
 
-Zod の入口（`validate`・`getValidated`・`parseWithSchema`・`parseFileWithSchema`）は、値のどこかに `__proto__`・`constructor`・`prototype` という名前のキーがあると拒否します。Zod は record から `__proto__` キーをエラーなしで落とすため、また結果がスキーマによって変わらないように、3 つとも同じく拒否します。`ZodError` にはキーごとに 1 つの issue が入ります。issue はそのキーを持つオブジェクトの位置に付き、キー名は message と `params.key` に入ります（`key "__proto__" names an object's prototype → at limits`）。キー名を変えるか、影響を受けない通常の getter（`cfg.getNumber('limits."constructor"')`）で読んでください。
+Zod の入口（`validate`・`getValidated`・`parseWithSchema`・`parseFileWithSchema`）は、値のどこかに `__proto__`・`constructor`・`prototype` という名前のキーがあると拒否します。Zod は record から `__proto__` キーをエラーなしで落とすため、また結果がスキーマによって変わらないように、3 つとも同じく拒否します。`ZodError` にはキーごとに 1 つの issue が入ります。issue はそのキーを持つオブジェクトの位置に付き、キー名は message と `params.key` に入ります（`key "__proto__" names an object's prototype → at limits`）。その後に、拒否したキーを除いた値に対するスキーマの issue が続くので、1 回の実行で問題がすべてわかります。キー名を変えるか、影響を受けない通常の getter（`cfg.getNumber('limits."constructor"')`）で読んでください。
 
 ### エラー型
 
@@ -566,7 +568,7 @@ const merged = cfg.withFallback(base).resolve()
 | `@o3co/ts.hocon/adapters/env` | — | プレフィックス付き名前空間の一括マウント。`.env` の読み込みも可能 |
 | `@o3co/ts.hocon/adapters/jsonc` | — | コメントと末尾カンマを許す JSON |
 | `@o3co/ts.hocon/adapters/json5` | — | JSON5 1.0.0。手書き scanner で依存ゼロ |
-| `@o3co/ts.hocon/adapters/toml` | `smol-toml`（>= 1.0） | オプショナルなピア依存 |
+| `@o3co/ts.hocon/adapters/toml` | `smol-toml`（>= 1.0。1.9.0 以上を推奨、[SECURITY.md](SECURITY.md#the-toml-adapter) 参照） | オプショナルなピア依存 |
 | `@o3co/ts.hocon/adapters/yaml` | `yaml`（>= 2.0） | オプショナルなピア依存。スカラー解決はそのライブラリの答えで、`version: '1.2'` を明示してドリフトを防止 |
 
 TOML と YAML のライブラリは **オプショナルなピア依存** なので、本パッケージを入れても

package/README.md

@@ -250,6 +250,8 @@ const app = validate(cfg, Schema)
 const port = getValidated(cfg, 'server.port', z.number().int())
 ```
 
+A string is coerced where the schema expects a number or a boolean, so `port = ${?PORT}` with `PORT=8081` validates against `z.number()`. The coercion follows the schema through objects, arrays, records (each value), tuples, unions, pipes (by the input schema), lazy schemas and the optional / nullable / default / prefault / nonoptional / catch / readonly wrappers, and turns a string into a number or boolean literal (`"1"` for `z.literal(1)`). It does not walk an object's `catchall` or an intersection. A `z.discriminatedUnion` coerces by the option the discriminator picks. Any other union takes the value as it is when an option accepts it, so `z.union([z.number(), z.string()])` keeps `"5"` a string, and coerces it otherwise, by the first option that accepts the coerced value (`z.union([z.number(), z.literal('auto')])` reads `"8081"` as 8081). Finding that option tries the options in turn, so a deeply recursive plain union validates slowly; prefer `z.discriminatedUnion` there.
+
 Durations and byte sizes are strings in HOCON (`30m`, `64KiB`), so `z.number()` refuses them. The `hocon.duration(unit?)` and `hocon.bytes(unit?)` markers read them with the same rules as `getDuration()` / `getBytes()` and give a number in the requested unit (default `ms` / `B`; a plain number keeps the getters' meaning). Pipe the marker into a number schema for range and integer checks:
 
 ```ts
@@ -275,7 +277,7 @@ const Backup = z.object({
 getValidated(cfg, 'backup', Backup) // { keep: { years: 0, months: 0, days: 14 } }
 ```
 
-An invalid duration, size or period fails validation with the key's path. The markers are ordinary Zod schemas, so they work in `validate`, `getValidated`, `parseWithSchema`, `parseFileWithSchema` and anywhere else Zod runs them. Getters and markers both read exponent forms (`1e3`, `"1.5e2s"`). A marker reads a number through its JavaScript value, though, so a number literal with more significant digits than a double holds can read differently from the getters, which read the literal's text exactly (`1.99999999999999999` B is 1 through `getBytes()`, 2 through the marker); a period marker also reads a literal with a decimal point or an exponent (`7.0`, `1e2`) as an integer, which `getPeriod()` refuses. Write unit values with a unit (`30s`, `7d`) to avoid both.
+An invalid duration, size or period fails validation with the key's path. The issue message names the problem, not the value (`not a duration`, `byte size must be non-negative`), so a secret set under the wrong key does not reach the logs; `params.problem` is `invalid`, `negative` or `overflow`, and the value is in the issue's `input` only when Zod is asked to report input. The markers are ordinary Zod schemas, so they work in `validate`, `getValidated`, `parseWithSchema`, `parseFileWithSchema` and anywhere else Zod runs them. Getters and markers both read exponent forms (`1e3`, `"1.5e2s"`). A marker reads a number through its JavaScript value, though, so a number literal with more significant digits than a double holds can read differently from the getters, which read the literal's text exactly (`1.99999999999999999` B is 1 through `getBytes()`, 2 through the marker); a period marker also reads a literal with a decimal point or an exponent (`7.0`, `1e2`) as an integer, which `getPeriod()` refuses. Write unit values with a unit (`30s`, `7d`) to avoid both.
 
 On an unresolved Config (parsed with `resolveSubstitutions: false`, a fallback stack not yet `resolve()`d, or the result of `resolve({ allowUnresolved: true })` with something left), `validate` throws `NotResolvedError`, as the getters do, rather than validating a tree with the pending values missing; `getValidated` throws it for a path whose value is unresolved and validates a resolved one. Call `resolve()` first.
 
@@ -284,7 +286,7 @@ Install Zod as a peer dependency:
 npm install zod
 ```
 
-The Zod entry points (`validate`, `getValidated`, `parseWithSchema`, `parseFileWithSchema`) refuse an object key named `__proto__`, `constructor` or `prototype` anywhere in the value: Zod drops a `__proto__` key from a record without an error, and the three are refused alike so the result does not depend on the schema. The `ZodError` has one issue per key, at the object that holds it, with the key in the message and in `params.key` (`key "__proto__" names an object's prototype → at limits`). Rename the key, or read it with the plain getters (`cfg.getNumber('limits."constructor"')`), which are unaffected.
+The Zod entry points (`validate`, `getValidated`, `parseWithSchema`, `parseFileWithSchema`) refuse an object key named `__proto__`, `constructor` or `prototype` anywhere in the value: Zod drops a `__proto__` key from a record without an error, and the three are refused alike so the result does not depend on the schema. The `ZodError` has one issue per key, at the object that holds it, with the key in the message and in `params.key` (`key "__proto__" names an object's prototype → at limits`), followed by the schema's issues for the rest of the value: the schema validates the value without the refused keys, so one run lists everything wrong. Rename the key, or read it with the plain getters (`cfg.getNumber('limits."constructor"')`), which are unaffected.
 
 ### Error types
 
@@ -568,7 +570,7 @@ Deferring resolution matters: the plain `parse` resolves as it goes, so a
 | `@o3co/ts.hocon/adapters/env` | — | Bulk-mounts a prefixed namespace; also reads `.env` |
 | `@o3co/ts.hocon/adapters/jsonc` | — | JSON with comments and trailing commas |
 | `@o3co/ts.hocon/adapters/json5` | — | JSON5 1.0.0, hand-rolled scanner, zero dependencies |
-| `@o3co/ts.hocon/adapters/toml` | `smol-toml` (>= 1.0) | Optional peer dependency |
+| `@o3co/ts.hocon/adapters/toml` | `smol-toml` (>= 1.0; >= 1.9.0 recommended, see [SECURITY.md](SECURITY.md#the-toml-adapter)) | Optional peer dependency |
 | `@o3co/ts.hocon/adapters/yaml` | `yaml` (>= 2.0) | Optional peer dependency; scalar resolution is that library's answer, with `version: '1.2'` declared so it cannot drift |
 
 The TOML and YAML libraries are **optional peer dependencies**, so installing

package/dist/adapters/env.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkGBNQADHTcjs = require('../chunk-GBNQADHT.cjs');
+var _chunkPCAMDXJ4cjs = require('../chunk-PCAMDXJ4.cjs');
 
 
 
@@ -8,14 +8,14 @@ var _chunkGBNQADHTcjs = require('../chunk-GBNQADHT.cjs');
 
 
 
-var _chunkRO4D6BH7cjs = require('../chunk-RO4D6BH7.cjs');
+var _chunkL3D2RE2Ucjs = require('../chunk-L3D2RE2U.cjs');
 
 // src/adapters/env.ts
 var SEPARATOR = "__";
 function loadEnv(opts = {}) {
   const prefix = _nullishCoalesce(opts.prefix, () => ( ""));
   if (prefix === "") {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       "loadEnv: a prefix is required when mounting the environment (spec F1.1)",
       ""
     );
@@ -29,44 +29,44 @@ function loadEnv(opts = {}) {
     const value = source[name];
     if (value === void 0) continue;
     const path = toPath(name.slice(prefix.length));
-    const key = _chunkRO4D6BH7cjs.pathKey.call(void 0, path);
+    const key = _chunkL3D2RE2Ucjs.pathKey.call(void 0, path);
     const prev = seen.get(key);
     if (prev !== void 0) {
-      throw new (0, _chunkRO4D6BH7cjs.ConfigError)(`loadEnv: ${prev} and ${name} both map to "${path.join(".")}"`, path.join("."));
+      throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(`loadEnv: ${prev} and ${name} both map to "${path.join(".")}"`, path.join("."));
     }
     seen.set(key, name);
     pairs.push([path, value]);
   }
-  return _chunkGBNQADHTcjs.fromMap.call(void 0, _chunkRO4D6BH7cjs.nestPairs.call(void 0, pairs), _nullishCoalesce(opts.originDescription, () => ( "environment variables")));
+  return _chunkPCAMDXJ4cjs.fromMap.call(void 0, _chunkL3D2RE2Ucjs.nestPairs.call(void 0, pairs), _nullishCoalesce(opts.originDescription, () => ( "environment variables")));
 }
 function parseDotEnv(input, opts = {}) {
   const origin = _nullishCoalesce(opts.originDescription, () => ( ".env"));
   const prefix = _nullishCoalesce(opts.prefix, () => ( ""));
   const pairs = [];
-  const lines = _chunkRO4D6BH7cjs.stripBom.call(void 0, input).replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
+  const lines = _chunkL3D2RE2Ucjs.stripBom.call(void 0, input).replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
   for (let i = 0; i < lines.length; i++) {
     const raw = (_nullishCoalesce(lines[i], () => ( ""))).trim();
     if (raw === "" || raw.startsWith("#")) continue;
     const line = stripExport(raw);
     const eq = line.indexOf("=");
-    if (eq === -1) throw new (0, _chunkRO4D6BH7cjs.ConfigError)(`${origin}:${i + 1}: expected NAME=value`, "");
+    if (eq === -1) throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(`${origin}:${i + 1}: expected NAME=value`, "");
     const name = line.slice(0, eq).trim();
-    if (name === "") throw new (0, _chunkRO4D6BH7cjs.ConfigError)(`${origin}:${i + 1}: empty variable name`, "");
+    if (name === "") throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(`${origin}:${i + 1}: empty variable name`, "");
     if (!name.startsWith(prefix)) continue;
     checkName(name, origin, i + 1);
     const value = dotEnvValue(line.slice(eq + 1).replace(/^[ \t]+/, ""), origin, i + 1, name);
     pairs.push([toPath(name.slice(prefix.length)), value]);
   }
-  return _chunkGBNQADHTcjs.fromMap.call(void 0, _chunkRO4D6BH7cjs.nestPairs.call(void 0, pairs), origin);
+  return _chunkPCAMDXJ4cjs.fromMap.call(void 0, _chunkL3D2RE2Ucjs.nestPairs.call(void 0, pairs), origin);
 }
 function toPath(name) {
   const segs = name.split(SEPARATOR).map(asciiLower);
   if (segs.some((s) => s === "")) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(`env: "${name}" produces an empty path segment`, name);
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(`env: "${name}" produces an empty path segment`, name);
   }
-  if (_chunkRO4D6BH7cjs.tooDeep.call(void 0, segs.length)) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
-      `env: "${name}" maps to a path ${segs.length} segments deep, over the limit of ${_chunkRO4D6BH7cjs.MAX_PATH_SEGMENTS}`,
+  if (_chunkL3D2RE2Ucjs.tooDeep.call(void 0, segs.length)) {
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
+      `env: "${name}" maps to a path ${segs.length} segments deep, over the limit of ${_chunkL3D2RE2Ucjs.MAX_PATH_SEGMENTS}`,
       name
     );
   }
@@ -77,7 +77,7 @@ function asciiLower(s) {
 }
 function dotEnvValue(v, origin, line, name) {
   const fail = (msg) => {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(`${origin}:${line}: ${name}: ${msg}`, name);
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(`${origin}:${line}: ${name}: ${msg}`, name);
   };
   if (v.startsWith("'")) {
     const end = v.indexOf("'", 1);
@@ -123,7 +123,7 @@ function checkName(name, origin, line) {
   const bad = /\p{White_Space}|#/u.exec(name);
   if (bad) {
     const what = bad[0] === "#" ? "'#'" : "whitespace";
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       `${origin}:${line}: variable name "${name}" contains ${what}; the line is not NAME=value (spec F1.7)`,
       name
     );

package/dist/adapters/env.js

@@ -1,6 +1,6 @@
 import {
   fromMap
-} from "../chunk-QY7ECGS6.js";
+} from "../chunk-YRNDXYGQ.js";
 import {
   ConfigError,
   MAX_PATH_SEGMENTS,
@@ -8,7 +8,7 @@ import {
   pathKey,
   stripBom,
   tooDeep
-} from "../chunk-WTXULUZS.js";
+} from "../chunk-GOXMKYWS.js";
 
 // src/adapters/env.ts
 var SEPARATOR = "__";

package/dist/adapters/json5.cjs

@@ -1,27 +1,27 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkGBNQADHTcjs = require('../chunk-GBNQADHT.cjs');
+var _chunkPCAMDXJ4cjs = require('../chunk-PCAMDXJ4.cjs');
 
 
 
 
 
-var _chunkRO4D6BH7cjs = require('../chunk-RO4D6BH7.cjs');
+var _chunkL3D2RE2Ucjs = require('../chunk-L3D2RE2U.cjs');
 
 // src/adapters/json5.ts
 function parseJson5(input, originDescription) {
-  const p = new Parser(_chunkRO4D6BH7cjs.stripBom.call(void 0, input), originDescription);
-  const doc = _chunkRO4D6BH7cjs.guardStackDepth.call(void 0, 
+  const p = new Parser(_chunkL3D2RE2Ucjs.stripBom.call(void 0, input), originDescription);
+  const doc = _chunkL3D2RE2Ucjs.guardStackDepth.call(void 0, 
     () => p.parseDocument(),
-    (msg) => _chunkRO4D6BH7cjs.depthError.call(void 0, `json5: ${describe(originDescription)}: ${msg}`)
+    (msg) => _chunkL3D2RE2Ucjs.depthError.call(void 0, `json5: ${describe(originDescription)}: ${msg}`)
   );
   if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       `json5: ${describe(originDescription)}: document root is ${rootKind(doc)}, but a config root must be an object (spec F0.3)`,
       ""
     );
   }
-  return _chunkGBNQADHTcjs.fromMap.call(void 0, doc, originDescription);
+  return _chunkPCAMDXJ4cjs.fromMap.call(void 0, doc, originDescription);
 }
 function describe(origin) {
   return origin === void 0 || origin === "" ? "document" : origin;
@@ -95,7 +95,7 @@ var Parser = class {
   }
   errf(msg) {
     const col = [...this.src.slice(this.lineAt, this.pos)].length + 1;
-    return new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    return new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       `json5: ${describe(this.origin)}: line ${this.line + 1} col ${col}: ${msg}`,
       ""
     );

package/dist/adapters/json5.js

@@ -1,12 +1,12 @@
 import {
   fromMap
-} from "../chunk-QY7ECGS6.js";
+} from "../chunk-YRNDXYGQ.js";
 import {
   ConfigError,
   depthError,
   guardStackDepth,
   stripBom
-} from "../chunk-WTXULUZS.js";
+} from "../chunk-GOXMKYWS.js";
 
 // src/adapters/json5.ts
 function parseJson5(input, originDescription) {

package/dist/adapters/jsonc.cjs

@@ -1,26 +1,26 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkGBNQADHTcjs = require('../chunk-GBNQADHT.cjs');
+var _chunkPCAMDXJ4cjs = require('../chunk-PCAMDXJ4.cjs');
 
 
 
 
 
-var _chunkRO4D6BH7cjs = require('../chunk-RO4D6BH7.cjs');
+var _chunkL3D2RE2Ucjs = require('../chunk-L3D2RE2U.cjs');
 
 // src/adapters/jsonc.ts
 function parseJsonc(input, originDescription) {
-  const doc = _chunkRO4D6BH7cjs.guardStackDepth.call(void 0, 
-    () => JSON.parse(stripTrailingCommas(stripComments(_chunkRO4D6BH7cjs.stripBom.call(void 0, input))), bigIntReviver),
-    (msg) => _chunkRO4D6BH7cjs.depthError.call(void 0, `jsonc: ${msg}`)
+  const doc = _chunkL3D2RE2Ucjs.guardStackDepth.call(void 0, 
+    () => JSON.parse(stripTrailingCommas(stripComments(_chunkL3D2RE2Ucjs.stripBom.call(void 0, input))), bigIntReviver),
+    (msg) => _chunkL3D2RE2Ucjs.depthError.call(void 0, `jsonc: ${msg}`)
   );
   if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       `jsonc: document root is ${Array.isArray(doc) ? "an array" : typeof doc}, but a config root must be an object (spec F0.3)`,
       ""
     );
   }
-  return _chunkGBNQADHTcjs.fromMap.call(void 0, doc, originDescription);
+  return _chunkPCAMDXJ4cjs.fromMap.call(void 0, doc, originDescription);
 }
 function isIntegerLiteral(source) {
   return !/[.eE]/.test(source);
@@ -38,7 +38,7 @@ function bigIntReviver(key, value, context) {
   const source = _optionalChain([context, 'optionalAccess', _2 => _2.source]);
   if (source === void 0) {
     if (!Number.isInteger(value)) return value;
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       `jsonc: the integer at "${key || "<root>"}" needs more precision than a JS number holds, and this runtime does not expose JSON.parse source text (${HAS_SOURCE_TEXT_ACCESS ? "unexpected \u2014 the capability probe said otherwise" : "requires Node >= 22 or an engine with JSON.parse source access"}), so it cannot be read losslessly (spec F0.5)`,
       key
     );
@@ -82,7 +82,7 @@ function stripComments(src) {
     }
     if (c === "/" && src[i + 1] === "*") {
       const end = src.indexOf("*/", i + 2);
-      if (end === -1) throw new (0, _chunkRO4D6BH7cjs.ConfigError)("jsonc: unterminated block comment", "");
+      if (end === -1) throw new (0, _chunkL3D2RE2Ucjs.ConfigError)("jsonc: unterminated block comment", "");
       out += lineBreaksOf(src.slice(i, end + 2)) || " ";
       i = end + 2;
       continue;
@@ -97,7 +97,7 @@ function endOfString(src, i) {
     if (src[j] === "\\") j++;
     else if (src[j] === '"') return j + 1;
   }
-  throw new (0, _chunkRO4D6BH7cjs.ConfigError)("jsonc: unterminated string literal", "");
+  throw new (0, _chunkL3D2RE2Ucjs.ConfigError)("jsonc: unterminated string literal", "");
 }
 function stripTrailingCommas(src) {
   let out = "";

package/dist/adapters/jsonc.js

@@ -1,12 +1,12 @@
 import {
   fromMap
-} from "../chunk-QY7ECGS6.js";
+} from "../chunk-YRNDXYGQ.js";
 import {
   ConfigError,
   depthError,
   guardStackDepth,
   stripBom
-} from "../chunk-WTXULUZS.js";
+} from "../chunk-GOXMKYWS.js";
 
 // src/adapters/jsonc.ts
 function parseJsonc(input, originDescription) {

package/dist/adapters/properties.cjs

@@ -1,13 +1,13 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkGBNQADHTcjs = require('../chunk-GBNQADHT.cjs');
+var _chunkPCAMDXJ4cjs = require('../chunk-PCAMDXJ4.cjs');
 
 
-var _chunkRO4D6BH7cjs = require('../chunk-RO4D6BH7.cjs');
+var _chunkL3D2RE2Ucjs = require('../chunk-L3D2RE2U.cjs');
 
 // src/adapters/properties.ts
 function parsePropertiesConfig(input, originDescription) {
-  return _chunkGBNQADHTcjs.fromMap.call(void 0, _chunkRO4D6BH7cjs.parseProperties.call(void 0, input), originDescription);
+  return _chunkPCAMDXJ4cjs.fromMap.call(void 0, _chunkL3D2RE2Ucjs.parseProperties.call(void 0, input), originDescription);
 }
 
 

package/dist/adapters/properties.js

@@ -1,9 +1,9 @@
 import {
   fromMap
-} from "../chunk-QY7ECGS6.js";
+} from "../chunk-YRNDXYGQ.js";
 import {
   parseProperties
-} from "../chunk-WTXULUZS.js";
+} from "../chunk-GOXMKYWS.js";
 
 // src/adapters/properties.ts
 function parsePropertiesConfig(input, originDescription) {

package/dist/adapters/toml.cjs

@@ -1,21 +1,21 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkGBNQADHTcjs = require('../chunk-GBNQADHT.cjs');
+var _chunkPCAMDXJ4cjs = require('../chunk-PCAMDXJ4.cjs');
 
 
 
 
 
-var _chunkRO4D6BH7cjs = require('../chunk-RO4D6BH7.cjs');
+var _chunkL3D2RE2Ucjs = require('../chunk-L3D2RE2U.cjs');
 
 // src/adapters/toml.ts
 var _smoltoml = require('smol-toml');
 function parseTomlConfig(input, originDescription) {
-  const doc = _smoltoml.parse.call(void 0, _chunkRO4D6BH7cjs.stripBom.call(void 0, input));
-  return _chunkGBNQADHTcjs.fromMap.call(void 0, 
-    _chunkRO4D6BH7cjs.guardStackDepth.call(void 0, 
+  const doc = _smoltoml.parse.call(void 0, _chunkL3D2RE2Ucjs.stripBom.call(void 0, input));
+  return _chunkPCAMDXJ4cjs.fromMap.call(void 0, 
+    _chunkL3D2RE2Ucjs.guardStackDepth.call(void 0, 
       () => convert(doc, ""),
-      (msg) => _chunkRO4D6BH7cjs.depthError.call(void 0, `toml: ${msg}`)
+      (msg) => _chunkL3D2RE2Ucjs.depthError.call(void 0, `toml: ${msg}`)
     ),
     originDescription
   );
@@ -33,7 +33,7 @@ function convert(v, atPath) {
     );
   }
   if (typeof v === "number" && !Number.isFinite(v)) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       `toml: ${v} at "${atPath}" is not representable in HOCON (spec F0.6)`,
       atPath
     );

package/dist/adapters/toml.js

@@ -1,12 +1,12 @@
 import {
   fromMap
-} from "../chunk-QY7ECGS6.js";
+} from "../chunk-YRNDXYGQ.js";
 import {
   ConfigError,
   depthError,
   guardStackDepth,
   stripBom
-} from "../chunk-WTXULUZS.js";
+} from "../chunk-GOXMKYWS.js";
 
 // src/adapters/toml.ts
 import { parse as parseToml } from "smol-toml";

package/dist/adapters/yaml.cjs

@@ -1,43 +1,43 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkGBNQADHTcjs = require('../chunk-GBNQADHT.cjs');
+var _chunkPCAMDXJ4cjs = require('../chunk-PCAMDXJ4.cjs');
 
 
 
 
 
-var _chunkRO4D6BH7cjs = require('../chunk-RO4D6BH7.cjs');
+var _chunkL3D2RE2Ucjs = require('../chunk-L3D2RE2U.cjs');
 
 // src/adapters/yaml.ts
 var _yaml = require('yaml'); var _yaml2 = _interopRequireDefault(_yaml);
 function parseYaml(input, originDescription) {
-  const docs = _yaml2.default.parseAllDocuments(_chunkRO4D6BH7cjs.stripBom.call(void 0, input), { version: "1.2", merge: true, intAsBigInt: true });
+  const docs = _yaml2.default.parseAllDocuments(_chunkL3D2RE2Ucjs.stripBom.call(void 0, input), { version: "1.2", merge: true, intAsBigInt: true });
   if (docs.length > 1) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       "yaml: multi-document streams are not supported (spec F5.7); a config is one document",
       ""
     );
   }
   const doc = docs[0];
-  if (doc === void 0) return _chunkGBNQADHTcjs.fromMap.call(void 0, {}, originDescription);
+  if (doc === void 0) return _chunkPCAMDXJ4cjs.fromMap.call(void 0, {}, originDescription);
   if (doc.errors.length > 0) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(`yaml: ${_nullishCoalesce(_optionalChain([doc, 'access', _ => _.errors, 'access', _2 => _2[0], 'optionalAccess', _3 => _3.message]), () => ( "parse error"))}`, "");
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(`yaml: ${_nullishCoalesce(_optionalChain([doc, 'access', _ => _.errors, 'access', _2 => _2[0], 'optionalAccess', _3 => _3.message]), () => ( "parse error"))}`, "");
   }
   return fromYamlValue(doc.toJS({ mapAsMap: true }), originDescription);
 }
 function fromYamlValue(value, originDescription) {
-  if (value === null || value === void 0) return _chunkGBNQADHTcjs.fromMap.call(void 0, {}, originDescription);
-  const normalized = _chunkRO4D6BH7cjs.guardStackDepth.call(void 0, 
+  if (value === null || value === void 0) return _chunkPCAMDXJ4cjs.fromMap.call(void 0, {}, originDescription);
+  const normalized = _chunkL3D2RE2Ucjs.guardStackDepth.call(void 0, 
     () => convert(value, ""),
-    (msg) => _chunkRO4D6BH7cjs.depthError.call(void 0, `yaml: ${msg}`)
+    (msg) => _chunkL3D2RE2Ucjs.depthError.call(void 0, `yaml: ${msg}`)
   );
   if (typeof normalized !== "object" || normalized === null || Array.isArray(normalized)) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       `yaml: document root is ${Array.isArray(normalized) ? "an array" : typeof normalized}, but a config root must be an object (spec F0.3)`,
       ""
     );
   }
-  return _chunkGBNQADHTcjs.fromMap.call(void 0, normalized, originDescription);
+  return _chunkPCAMDXJ4cjs.fromMap.call(void 0, normalized, originDescription);
 }
 function convert(v, atPath) {
   if (Array.isArray(v)) return v.map((e, i) => convert(e, `${atPath}[${i}]`));
@@ -49,14 +49,14 @@ function convert(v, atPath) {
     const seen = /* @__PURE__ */ new Map();
     for (const [k, e] of v) {
       if (k !== null && typeof k === "object") {
-        throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+        throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
           `yaml: a collection key at "${atPath}" is not usable as an object key (spec F5.3)`,
           atPath
         );
       }
       const key = String(k);
       if (seen.has(key)) {
-        throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+        throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
           `yaml: sibling mapping keys ${keyForm(seen.get(key))} and ${keyForm(k)} both give the key "${key}"${atPath === "" ? "" : ` at "${atPath}"`}; rename one of them, because one of the two values would otherwise be lost. Quoting a non-string key helps only where that changes the key text, as 0x10 does and 1 does not (spec F5.3)`,
           atPath
         );
@@ -77,7 +77,7 @@ function convert(v, atPath) {
     );
   }
   if (typeof v === "number" && !Number.isFinite(v)) {
-    throw new (0, _chunkRO4D6BH7cjs.ConfigError)(
+    throw new (0, _chunkL3D2RE2Ucjs.ConfigError)(
       `yaml: ${v} at "${atPath}" is not representable in HOCON (spec F0.6)`,
       atPath
     );

package/dist/adapters/yaml.js

@@ -1,12 +1,12 @@
 import {
   fromMap
-} from "../chunk-QY7ECGS6.js";
+} from "../chunk-YRNDXYGQ.js";
 import {
   ConfigError,
   depthError,
   guardStackDepth,
   stripBom
-} from "../chunk-WTXULUZS.js";
+} from "../chunk-GOXMKYWS.js";
 
 // src/adapters/yaml.ts
 import YAML from "yaml";

package/dist/{chunk-WTXULUZS.js → chunk-GOXMKYWS.js}

@@ -2778,7 +2778,7 @@ var SubstitutionResolver = class {
       }
       if (this.opts.useSystemEnvironment !== false) {
         const envKey = s.segments.map((seg) => seg.text).join(".");
-        const envVal = this.opts.env[envKey] ?? (s.prefixLen > 0 ? this.opts.env[s.segments.slice(s.prefixLen).map((seg) => seg.text).join(".")] : void 0);
+        const envVal = this.envVar(envKey) ?? (s.prefixLen > 0 ? this.envVar(s.segments.slice(s.prefixLen).map((seg) => seg.text).join(".")) : void 0);
         if (envVal !== void 0) {
           const result = { kind: "scalar", raw: envVal, valueType: "string" };
           this.cache.set(key, result);
@@ -2813,17 +2813,26 @@ var SubstitutionResolver = class {
     const bases = this.candidateBases(s);
     for (const base of bases) {
       const key0 = base + "_0";
-      if (!(key0 in this.opts.env)) continue;
+      if (this.envVar(key0) === void 0) continue;
       const items = [];
       for (let i = 0; ; i++) {
-        const k = base + "_" + i;
-        if (!(k in this.opts.env)) break;
-        items.push({ kind: "scalar", raw: this.opts.env[k], valueType: "string" });
+        const v = this.envVar(base + "_" + i);
+        if (v === void 0) break;
+        items.push({ kind: "scalar", raw: v, valueType: "string" });
       }
       return { kind: "array", items };
     }
     return void 0;
   }
+  /**
+   * The environment variable `name`, or undefined when it is not set. Own keys
+   * only: the environment is a plain object (process.env, or the caller's
+   * `env`), so `env[name]` would answer `${?constructor}` or `${?toString}`
+   * from Object.prototype (#228).
+   */
+  envVar(name) {
+    return Object.prototype.hasOwnProperty.call(this.opts.env, name) ? this.opts.env[name] : void 0;
+  }
   /**
    * Return the candidate base names for env-var-list lookup, in precedence order.
    * Mirrors the fully-qualified→bare fallback used by the scalar env path.

package/dist/{chunk-XWKO4JM3.js → chunk-JVABBNF5.js}

@@ -11,7 +11,7 @@ import {
   resolve,
   resolveAsync,
   tokenize
-} from "./chunk-WTXULUZS.js";
+} from "./chunk-GOXMKYWS.js";
 
 // src/parse.ts
 import * as fs from "fs";

package/dist/{chunk-RO4D6BH7.cjs → chunk-L3D2RE2U.cjs}

@@ -2778,7 +2778,7 @@ var SubstitutionResolver = class {
       }
       if (this.opts.useSystemEnvironment !== false) {
         const envKey = s.segments.map((seg) => seg.text).join(".");
-        const envVal = _nullishCoalesce(this.opts.env[envKey], () => ( (s.prefixLen > 0 ? this.opts.env[s.segments.slice(s.prefixLen).map((seg) => seg.text).join(".")] : void 0)));
+        const envVal = _nullishCoalesce(this.envVar(envKey), () => ( (s.prefixLen > 0 ? this.envVar(s.segments.slice(s.prefixLen).map((seg) => seg.text).join(".")) : void 0)));
         if (envVal !== void 0) {
           const result = { kind: "scalar", raw: envVal, valueType: "string" };
           this.cache.set(key, result);
@@ -2813,17 +2813,26 @@ var SubstitutionResolver = class {
     const bases = this.candidateBases(s);
     for (const base of bases) {
       const key0 = base + "_0";
-      if (!(key0 in this.opts.env)) continue;
+      if (this.envVar(key0) === void 0) continue;
       const items = [];
       for (let i = 0; ; i++) {
-        const k = base + "_" + i;
-        if (!(k in this.opts.env)) break;
-        items.push({ kind: "scalar", raw: this.opts.env[k], valueType: "string" });
+        const v = this.envVar(base + "_" + i);
+        if (v === void 0) break;
+        items.push({ kind: "scalar", raw: v, valueType: "string" });
       }
       return { kind: "array", items };
     }
     return void 0;
   }
+  /**
+   * The environment variable `name`, or undefined when it is not set. Own keys
+   * only: the environment is a plain object (process.env, or the caller's
+   * `env`), so `env[name]` would answer `${?constructor}` or `${?toString}`
+   * from Object.prototype (#228).
+   */
+  envVar(name) {
+    return Object.prototype.hasOwnProperty.call(this.opts.env, name) ? this.opts.env[name] : void 0;
+  }
   /**
    * Return the candidate base names for env-var-list lookup, in precedence order.
    * Mirrors the fully-qualified→bare fallback used by the scalar env path.