@oxog/vld 2.0.2 → 2.1.0

package/dist/cjs/validators/object.cjs

@@ -0,0 +1,868 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+var locales_runtime = require('../locales/runtime.cjs');
+var validators_enum = require('./enum.cjs');
+var security = require('../chunks/security-Dc3Jh13T.cjs');
+var errorsCore = require('../chunks/errors-core-DWxLFs2f.cjs');
+require('../registry.cjs');
+require('../locales/en.cjs');
+
+/**
+ * Optimized immutable object validator with chainable methods
+ * Features pre-computed keys and Set-based lookups for better performance
+ */
+class VldObject extends validators_base.VldBase {
+    createSafeParseError(message) {
+        return new errorsCore.VldError([{ code: 'invalid_object', path: [], message }]);
+    }
+    /**
+     * Private constructor to enforce immutability
+     */
+    constructor(config) {
+        super(validators_base.VLD_VALIDATOR_TYPES.OBJECT);
+        this._config = config;
+        // Pre-compute shape keys for faster access
+        this._shapeKeys = Object.keys(config.shape);
+        this._shapeKeysSet = new Set(this._shapeKeys);
+        this._validators = this._shapeKeys.map(k => this.tryGetFieldValidator(k));
+        // Pre-compute validator types when possible. Getter-based recursive schemas
+        // may reference the object being constructed, so unresolved getters fall
+        // back to the generic path and are resolved at parse time.
+        this._validatorTypes = this._shapeKeys.map((k, i) => this._validators[i]?.validatorType || this.getValidatorType(k));
+        this._simpleFieldModes = this._validators.map((validator, i) => this.getSimpleFieldMode(validator, this._validatorTypes[i]));
+        this._simpleFieldValues = this._validators.map((validator, i) => this._simpleFieldModes[i] === 'literal' ? validator.literal : undefined);
+        this._canUseSimpleObjectFastPath =
+            !config.strict &&
+                !config.passthrough &&
+                !config.catchall &&
+                this._shapeKeys.length > 0 &&
+                this._simpleFieldModes.every(mode => mode !== undefined);
+        this._canUseSafeParseFastPath =
+            this._validators.every(validator => validator instanceof validators_base.VldBase) &&
+                (config.catchall === undefined || config.catchall instanceof validators_base.VldBase);
+    }
+    tryGetFieldValidator(key) {
+        try {
+            const descriptor = Object.getOwnPropertyDescriptor(this._config.shape, key);
+            if (descriptor?.get) {
+                return undefined;
+            }
+            return this.resolveFieldValidator(key);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    resolveFieldValidator(key) {
+        try {
+            const validator = this._config.shape[key];
+            if (!validator || typeof validator.safeParse !== 'function') {
+                return undefined;
+            }
+            return validator;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    getFieldValidator(key, index) {
+        const cached = index === undefined ? undefined : this._validators[index];
+        const validator = cached || this.resolveFieldValidator(key);
+        if (!validator) {
+            throw new Error(`Invalid validator for field "${key}"`);
+        }
+        return validator;
+    }
+    getValidatorType(key) {
+        try {
+            const validator = this._config.shape[key];
+            return validator?.validatorType || validators_base.VLD_VALIDATOR_TYPES.UNKNOWN;
+        }
+        catch {
+            return validators_base.VLD_VALIDATOR_TYPES.UNKNOWN;
+        }
+    }
+    getSimpleFieldMode(validator, type) {
+        if (!validator || validator.isSimple !== true) {
+            return undefined;
+        }
+        switch (type) {
+            case validators_base.VLD_VALIDATOR_TYPES.STRING:
+                return 'string';
+            case validators_base.VLD_VALIDATOR_TYPES.NUMBER:
+                return 'number';
+            case validators_base.VLD_VALIDATOR_TYPES.BOOLEAN:
+                return 'boolean';
+            case validators_base.VLD_VALIDATOR_TYPES.BIGINT:
+                return 'bigint';
+            case validators_base.VLD_VALIDATOR_TYPES.SYMBOL:
+                return 'symbol';
+            case validators_base.VLD_VALIDATOR_TYPES.NULL:
+                return 'null';
+            case validators_base.VLD_VALIDATOR_TYPES.UNDEFINED:
+            case validators_base.VLD_VALIDATOR_TYPES.VOID:
+                return 'undefinedValue';
+            case validators_base.VLD_VALIDATOR_TYPES.LITERAL:
+                return 'literal';
+            case validators_base.VLD_VALIDATOR_TYPES.ANY:
+            case validators_base.VLD_VALIDATOR_TYPES.UNKNOWN:
+                return 'passthrough';
+            default:
+                return undefined;
+        }
+    }
+    getSimpleFieldError(mode, expected, received) {
+        switch (mode) {
+            case 'string':
+                return locales_runtime.getMessages().invalidString;
+            case 'number':
+                return locales_runtime.getMessages().invalidNumber;
+            case 'boolean':
+                return locales_runtime.getMessages().invalidBoolean;
+            case 'bigint':
+                return locales_runtime.getMessages().invalidBigint;
+            case 'symbol':
+                return locales_runtime.getMessages().invalidSymbol;
+            case 'null':
+                return `Expected null, received ${typeof received}`;
+            case 'undefinedValue':
+                return locales_runtime.getMessages().expectedUndefined;
+            case 'literal':
+                return locales_runtime.getMessages().literalExpected(JSON.stringify(expected), JSON.stringify(received));
+            case 'passthrough':
+                return locales_runtime.getMessages().invalidObject;
+            default:
+                return locales_runtime.getMessages().invalidObject;
+        }
+    }
+    parseCheckedField(validator, type, value) {
+        if (type === validators_base.VLD_VALIDATOR_TYPES.STRING && typeof value === 'string') {
+            const parseKnownString = validator.parseKnownString;
+            if (typeof parseKnownString === 'function') {
+                return parseKnownString.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.NUMBER && typeof value === 'number' && !isNaN(value)) {
+            const parseKnownNumber = validator.parseKnownNumber;
+            if (typeof parseKnownNumber === 'function') {
+                return parseKnownNumber.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.BOOLEAN && typeof value === 'boolean') {
+            const parseKnownBoolean = validator.parseKnownBoolean;
+            if (typeof parseKnownBoolean === 'function') {
+                return parseKnownBoolean.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.BIGINT && typeof value === 'bigint') {
+            const parseKnownBigInt = validator.parseKnownBigInt;
+            if (typeof parseKnownBigInt === 'function') {
+                return parseKnownBigInt.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.SYMBOL && typeof value === 'symbol') {
+            const parseKnownSymbol = validator.parseKnownSymbol;
+            if (typeof parseKnownSymbol === 'function') {
+                return parseKnownSymbol.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.FUNCTION && typeof value === 'function') {
+            const parseKnownFunction = validator.parseKnownFunction;
+            if (typeof parseKnownFunction === 'function') {
+                return parseKnownFunction.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.FILE &&
+            typeof value === 'object' &&
+            value !== null &&
+            (('size' in value && 'type' in value) ||
+                (typeof File !== 'undefined' && value instanceof File))) {
+            const parseKnownFile = validator.parseKnownFile;
+            if (typeof parseKnownFile === 'function') {
+                return parseKnownFile.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.DATE && value instanceof Date) {
+            const parseKnownDate = validator.parseKnownDate;
+            if (typeof parseKnownDate === 'function') {
+                return parseKnownDate.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.OBJECT &&
+            typeof value === 'object' &&
+            value !== null &&
+            !Array.isArray(value)) {
+            const parseKnownObject = validator.parseKnownObject;
+            if (typeof parseKnownObject === 'function') {
+                return parseKnownObject.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.ARRAY && Array.isArray(value)) {
+            const parseKnownArray = validator.parseKnownArray;
+            if (typeof parseKnownArray === 'function') {
+                return parseKnownArray.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.TUPLE && Array.isArray(value)) {
+            const parseKnownTuple = validator.parseKnownTuple;
+            if (typeof parseKnownTuple === 'function') {
+                return parseKnownTuple.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.RECORD &&
+            typeof value === 'object' &&
+            value !== null &&
+            !Array.isArray(value)) {
+            const parseKnownRecord = validator.parseKnownRecord;
+            if (typeof parseKnownRecord === 'function') {
+                return parseKnownRecord.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.SET && value instanceof Set) {
+            const parseKnownSet = validator.parseKnownSet;
+            if (typeof parseKnownSet === 'function') {
+                return parseKnownSet.call(validator, value);
+            }
+        }
+        if (type === validators_base.VLD_VALIDATOR_TYPES.MAP && value instanceof Map) {
+            const parseKnownMap = validator.parseKnownMap;
+            if (typeof parseKnownMap === 'function') {
+                return parseKnownMap.call(validator, value);
+            }
+        }
+        return validator.parse(value);
+    }
+    parseSimpleObjectValue(obj, trustedKey, skipTrustedLiteralCheck = false) {
+        if (this._shapeKeys.length === 2 &&
+            this._simpleFieldModes[0] === 'string' &&
+            this._simpleFieldModes[1] === 'number') {
+            const key0 = this._shapeKeys[0];
+            const value0 = obj[key0];
+            if (typeof value0 !== 'string') {
+                throw new Error(locales_runtime.getMessages().objectField(key0, locales_runtime.getMessages().invalidString));
+            }
+            const key1 = this._shapeKeys[1];
+            const value1 = obj[key1];
+            if (typeof value1 !== 'number' || isNaN(value1)) {
+                throw new Error(locales_runtime.getMessages().objectField(key1, locales_runtime.getMessages().invalidNumber));
+            }
+            const result = {};
+            result[key0] = value0;
+            result[key1] = value1;
+            return result;
+        }
+        if (this._shapeKeys.length === 3 &&
+            this._simpleFieldModes[0] === 'literal' &&
+            this._simpleFieldModes[1] === 'string' &&
+            this._simpleFieldModes[2] === 'number') {
+            const key0 = this._shapeKeys[0];
+            const value0 = obj[key0];
+            const literal0 = this._simpleFieldValues[0];
+            if (!(skipTrustedLiteralCheck && key0 === trustedKey) && value0 !== literal0) {
+                throw new Error(locales_runtime.getMessages().objectField(key0, this.getSimpleFieldError('literal', literal0, value0)));
+            }
+            const key1 = this._shapeKeys[1];
+            const value1 = obj[key1];
+            if (typeof value1 !== 'string') {
+                throw new Error(locales_runtime.getMessages().objectField(key1, locales_runtime.getMessages().invalidString));
+            }
+            const key2 = this._shapeKeys[2];
+            const value2 = obj[key2];
+            if (typeof value2 !== 'number' || isNaN(value2)) {
+                throw new Error(locales_runtime.getMessages().objectField(key2, locales_runtime.getMessages().invalidNumber));
+            }
+            const result = {};
+            result[key0] = literal0;
+            result[key1] = value1;
+            result[key2] = value2;
+            return result;
+        }
+        const result = {};
+        for (let i = 0; i < this._shapeKeys.length; i++) {
+            const key = this._shapeKeys[i];
+            const fieldValue = obj[key];
+            const simpleMode = this._simpleFieldModes[i];
+            switch (simpleMode) {
+                case 'string':
+                    if (typeof fieldValue !== 'string') {
+                        throw new Error(locales_runtime.getMessages().objectField(key, locales_runtime.getMessages().invalidString));
+                    }
+                    result[key] = fieldValue;
+                    break;
+                case 'number':
+                    if (typeof fieldValue !== 'number' || isNaN(fieldValue)) {
+                        throw new Error(locales_runtime.getMessages().objectField(key, locales_runtime.getMessages().invalidNumber));
+                    }
+                    result[key] = fieldValue;
+                    break;
+                case 'boolean':
+                    if (typeof fieldValue !== 'boolean') {
+                        throw new Error(locales_runtime.getMessages().objectField(key, locales_runtime.getMessages().invalidBoolean));
+                    }
+                    result[key] = fieldValue;
+                    break;
+                case 'bigint':
+                    if (typeof fieldValue !== 'bigint') {
+                        throw new Error(locales_runtime.getMessages().objectField(key, locales_runtime.getMessages().invalidBigint));
+                    }
+                    result[key] = fieldValue;
+                    break;
+                case 'symbol':
+                    if (typeof fieldValue !== 'symbol') {
+                        throw new Error(locales_runtime.getMessages().objectField(key, locales_runtime.getMessages().invalidSymbol));
+                    }
+                    result[key] = fieldValue;
+                    break;
+                case 'null':
+                    if (fieldValue !== null) {
+                        throw new Error(locales_runtime.getMessages().objectField(key, this.getSimpleFieldError(simpleMode, undefined, fieldValue)));
+                    }
+                    result[key] = null;
+                    break;
+                case 'undefinedValue':
+                    if (fieldValue !== undefined) {
+                        throw new Error(locales_runtime.getMessages().objectField(key, locales_runtime.getMessages().expectedUndefined));
+                    }
+                    result[key] = undefined;
+                    break;
+                case 'literal':
+                    if (skipTrustedLiteralCheck && key === trustedKey) {
+                        result[key] = this._simpleFieldValues[i];
+                        break;
+                    }
+                    if (fieldValue !== this._simpleFieldValues[i]) {
+                        throw new Error(locales_runtime.getMessages().objectField(key, this.getSimpleFieldError(simpleMode, this._simpleFieldValues[i], fieldValue)));
+                    }
+                    result[key] = this._simpleFieldValues[i];
+                    break;
+                case 'passthrough':
+                    result[key] = fieldValue;
+                    break;
+                default:
+                    throw new Error(locales_runtime.getMessages().objectField(key, locales_runtime.getMessages().invalidObject));
+            }
+        }
+        return result;
+    }
+    /**
+     * Get the validator configuration
+     * @internal Used by discriminated union validator
+     */
+    get config() {
+        return this._config;
+    }
+    /**
+     * Get the shape keys array
+     */
+    get shapeKeys() {
+        return this._shapeKeys;
+    }
+    /**
+     * Get the shape keys set for O(1) lookups
+     * @internal Used by discriminated union validator
+     */
+    get shapeKeysSet() {
+        return this._shapeKeysSet;
+    }
+    /**
+     * Create a new object validator
+     */
+    static create(shape) {
+        return new VldObject({ shape });
+    }
+    /**
+     * Parse and validate an object value
+     * Ultra-optimized with inline type checks and minimal overhead
+     */
+    parse(value) {
+        // Fast type check
+        if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+            throw new Error(this._config.errorMessage || locales_runtime.getMessages().invalidObject);
+        }
+        return this.parseObjectValue(value);
+    }
+    /**
+     * Parse an object value that already passed the object type guard.
+     * @internal Used by discriminated unions after discriminator lookup.
+     */
+    parseKnownObject(value, trustedKey) {
+        return this.parseObjectValue(value, trustedKey);
+    }
+    /**
+     * Parse an object after an owning discriminated union has already matched
+     * the discriminator value to this exact object schema.
+     * @internal
+     */
+    parseTrustedKnownObject(value, trustedKey) {
+        return this.parseObjectValue(value, trustedKey, true);
+    }
+    parseObjectValue(obj, trustedKey, skipTrustedLiteralCheck = false) {
+        if (this._canUseSimpleObjectFastPath) {
+            return this.parseSimpleObjectValue(obj, trustedKey, skipTrustedLiteralCheck);
+        }
+        const result = {};
+        // Validate fields directly on parse() to avoid safeParse result allocation
+        // in the successful hot path.
+        let currentKey = '';
+        try {
+            for (let i = 0; i < this._shapeKeys.length; i++) {
+                currentKey = this._shapeKeys[i];
+                if (skipTrustedLiteralCheck &&
+                    currentKey === trustedKey &&
+                    this._simpleFieldModes[i] === 'literal') {
+                    result[currentKey] = this._simpleFieldValues[i];
+                    continue;
+                }
+                const simpleMode = this._simpleFieldModes[i];
+                if (simpleMode !== undefined) {
+                    const fieldValue = obj[currentKey];
+                    switch (simpleMode) {
+                        case 'string':
+                            if (typeof fieldValue !== 'string') {
+                                throw new Error(locales_runtime.getMessages().invalidString);
+                            }
+                            result[currentKey] = fieldValue;
+                            continue;
+                        case 'number':
+                            if (typeof fieldValue !== 'number' || isNaN(fieldValue)) {
+                                throw new Error(locales_runtime.getMessages().invalidNumber);
+                            }
+                            result[currentKey] = fieldValue;
+                            continue;
+                        case 'boolean':
+                            if (typeof fieldValue !== 'boolean') {
+                                throw new Error(locales_runtime.getMessages().invalidBoolean);
+                            }
+                            result[currentKey] = fieldValue;
+                            continue;
+                        case 'bigint':
+                            if (typeof fieldValue !== 'bigint') {
+                                throw new Error(locales_runtime.getMessages().invalidBigint);
+                            }
+                            result[currentKey] = fieldValue;
+                            continue;
+                        case 'symbol':
+                            if (typeof fieldValue !== 'symbol') {
+                                throw new Error(locales_runtime.getMessages().invalidSymbol);
+                            }
+                            result[currentKey] = fieldValue;
+                            continue;
+                        case 'null':
+                            if (fieldValue !== null) {
+                                throw new Error(this.getSimpleFieldError(simpleMode, undefined, fieldValue));
+                            }
+                            result[currentKey] = null;
+                            continue;
+                        case 'undefinedValue':
+                            if (fieldValue !== undefined) {
+                                throw new Error(locales_runtime.getMessages().expectedUndefined);
+                            }
+                            result[currentKey] = undefined;
+                            continue;
+                        case 'literal':
+                            if (fieldValue !== this._simpleFieldValues[i]) {
+                                throw new Error(this.getSimpleFieldError(simpleMode, this._simpleFieldValues[i], fieldValue));
+                            }
+                            result[currentKey] = this._simpleFieldValues[i];
+                            continue;
+                        case 'passthrough':
+                            result[currentKey] = fieldValue;
+                            continue;
+                    }
+                    continue;
+                }
+                const validator = this.getFieldValidator(currentKey, i);
+                result[currentKey] = this.parseCheckedField(validator, this._validatorTypes[i], obj[currentKey]);
+            }
+        }
+        catch (error) {
+            throw new Error(locales_runtime.getMessages().objectField(currentKey, error.message));
+        }
+        // Handle strict/passthrough/catchall modes - optimized single Object.keys() call
+        if (this._config.strict || this._config.passthrough || this._config.catchall) {
+            const objKeys = Object.keys(obj);
+            // Handle strict mode - optimized with Set
+            if (this._config.strict) {
+                const extraKeys = [];
+                for (let i = 0; i < objKeys.length; i++) {
+                    const key = objKeys[i];
+                    if (!this._shapeKeysSet.has(key)) {
+                        extraKeys.push(key);
+                    }
+                }
+                if (extraKeys.length > 0) {
+                    throw new Error(locales_runtime.getMessages().unexpectedKeys(extraKeys));
+                }
+            }
+            // Handle passthrough mode - optimized with comprehensive prototype pollution protection
+            if (this._config.passthrough) {
+                for (let i = 0; i < objKeys.length; i++) {
+                    const key = objKeys[i];
+                    // Skip dangerous keys to prevent prototype pollution
+                    if (!this._shapeKeysSet.has(key) && !security.isDangerousKey(key)) {
+                        result[key] = obj[key];
+                    }
+                }
+            }
+            // Handle catchall - validate extra keys with catchall validator
+            if (this._config.catchall) {
+                for (let i = 0; i < objKeys.length; i++) {
+                    const key = objKeys[i];
+                    // Skip keys already in shape and dangerous keys
+                    if (!this._shapeKeysSet.has(key) && !security.isDangerousKey(key)) {
+                        try {
+                            result[key] = this._config.catchall.parse(obj[key]);
+                        }
+                        catch (error) {
+                            throw new Error(locales_runtime.getMessages().objectField(key, error.message));
+                        }
+                    }
+                }
+            }
+        }
+        return result;
+    }
+    /**
+     * Safely parse and validate an object value
+     * Optimized version using pre-computed keys
+     */
+    safeParse(value) {
+        // Fast type check
+        if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+            return {
+                success: false,
+                error: this.createSafeParseError(this._config.errorMessage || locales_runtime.getMessages().invalidObject)
+            };
+        }
+        const obj = value;
+        if (this._canUseSimpleObjectFastPath) {
+            try {
+                return { success: true, data: this.parseSimpleObjectValue(obj) };
+            }
+            catch (error) {
+                return { success: false, error: this.createSafeParseError(error.message) };
+            }
+        }
+        if (this._canUseSafeParseFastPath) {
+            try {
+                return { success: true, data: this.parseObjectValue(obj) };
+            }
+            catch (error) {
+                return { success: false, error: this.createSafeParseError(error.message) };
+            }
+        }
+        const result = {};
+        // Ultra-optimized field validation - use pre-computed validatorTypes in hot path
+        for (let i = 0; i < this._shapeKeys.length; i++) {
+            const key = this._shapeKeys[i];
+            const fieldValue = obj[key];
+            const simpleMode = this._simpleFieldModes[i];
+            if (simpleMode !== undefined) {
+                if ((simpleMode === 'string' && typeof fieldValue === 'string') ||
+                    (simpleMode === 'number' && typeof fieldValue === 'number' && !isNaN(fieldValue)) ||
+                    (simpleMode === 'boolean' && typeof fieldValue === 'boolean') ||
+                    (simpleMode === 'bigint' && typeof fieldValue === 'bigint') ||
+                    (simpleMode === 'symbol' && typeof fieldValue === 'symbol') ||
+                    (simpleMode === 'null' && fieldValue === null) ||
+                    (simpleMode === 'undefinedValue' && fieldValue === undefined) ||
+                    (simpleMode === 'literal' && fieldValue === this._simpleFieldValues[i]) ||
+                    simpleMode === 'passthrough') {
+                    result[key] = simpleMode === 'literal'
+                        ? this._simpleFieldValues[i]
+                        : simpleMode === 'null'
+                            ? null
+                            : fieldValue;
+                    continue;
+                }
+                return {
+                    success: false,
+                    error: this.createSafeParseError(locales_runtime.getMessages().objectField(key, this.getSimpleFieldError(simpleMode, this._simpleFieldValues[i], fieldValue)))
+                };
+            }
+            let validator;
+            try {
+                validator = this.getFieldValidator(key, i);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                return {
+                    success: false,
+                    error: this.createSafeParseError(locales_runtime.getMessages().objectField(key, message))
+                };
+            }
+            try {
+                if (validator instanceof validators_base.VldBase) {
+                    result[key] = this.parseCheckedField(validator, this._validatorTypes[i], fieldValue);
+                }
+                else {
+                    const parseResult = validator.safeParse(fieldValue);
+                    if (!parseResult.success) {
+                        return {
+                            success: false,
+                            error: this.createSafeParseError(locales_runtime.getMessages().objectField(key, parseResult.error.message))
+                        };
+                    }
+                    result[key] = parseResult.data;
+                }
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                return {
+                    success: false,
+                    error: this.createSafeParseError(locales_runtime.getMessages().objectField(key, message))
+                };
+            }
+        }
+        // Handle strict/passthrough/catchall modes - optimized single Object.keys() call
+        if (this._config.strict || this._config.passthrough || this._config.catchall) {
+            const objKeys = Object.keys(obj);
+            // Handle strict mode
+            if (this._config.strict) {
+                const extraKeys = [];
+                for (let i = 0; i < objKeys.length; i++) {
+                    const key = objKeys[i];
+                    if (!this._shapeKeysSet.has(key)) {
+                        extraKeys.push(key);
+                    }
+                }
+                if (extraKeys.length > 0) {
+                    return {
+                        success: false,
+                        error: this.createSafeParseError(locales_runtime.getMessages().unexpectedKeys(extraKeys))
+                    };
+                }
+            }
+            // Handle passthrough mode with comprehensive prototype pollution protection
+            if (this._config.passthrough) {
+                for (let i = 0; i < objKeys.length; i++) {
+                    const key = objKeys[i];
+                    // Skip dangerous keys to prevent prototype pollution
+                    if (!this._shapeKeysSet.has(key) && !security.isDangerousKey(key)) {
+                        result[key] = obj[key];
+                    }
+                }
+            }
+            // Handle catchall - validate extra keys with catchall validator
+            if (this._config.catchall) {
+                const catchallValidator = this._config.catchall;
+                for (let i = 0; i < objKeys.length; i++) {
+                    const key = objKeys[i];
+                    // Skip keys already in shape and dangerous keys
+                    if (!this._shapeKeysSet.has(key) && !security.isDangerousKey(key)) {
+                        try {
+                            if (catchallValidator instanceof validators_base.VldBase) {
+                                result[key] = catchallValidator.parse(obj[key]);
+                            }
+                            else {
+                                const catchallResult = catchallValidator.safeParse(obj[key]);
+                                if (!catchallResult.success) {
+                                    return {
+                                        success: false,
+                                        error: this.createSafeParseError(locales_runtime.getMessages().objectField(key, catchallResult.error.message))
+                                    };
+                                }
+                                result[key] = catchallResult.data;
+                            }
+                        }
+                        catch (error) {
+                            const message = error instanceof Error ? error.message : String(error);
+                            return {
+                                success: false,
+                                error: this.createSafeParseError(locales_runtime.getMessages().objectField(key, message))
+                            };
+                        }
+                    }
+                }
+            }
+        }
+        return { success: true, data: result };
+    }
+    /**
+     * Create a new validator in strict mode (no extra keys allowed)
+     */
+    strict(message) {
+        return new VldObject({
+            ...this._config,
+            strict: true,
+            passthrough: false,
+            errorMessage: message
+        });
+    }
+    /**
+     * Create a new validator in passthrough mode (extra keys are preserved)
+     */
+    passthrough() {
+        return new VldObject({
+            ...this._config,
+            strict: false,
+            passthrough: true
+        });
+    }
+    /**
+     * Create a new validator with all fields optional
+     */
+    partial() {
+        const partialShape = {};
+        for (const key in this._config.shape) {
+            partialShape[key] = new validators_base.VldOptional(this._config.shape[key]);
+        }
+        return new VldObject({
+            ...this._config,
+            shape: partialShape
+        });
+    }
+    /**
+     * Create a new validator with deep partial (nested objects also partial)
+     */
+    deepPartial() {
+        const deepPartialShape = {};
+        for (const key in this._config.shape) {
+            const validator = this._config.shape[key];
+            if (validator instanceof VldObject) {
+                deepPartialShape[key] = new validators_base.VldOptional(validator.deepPartial());
+            }
+            else {
+                deepPartialShape[key] = new validators_base.VldOptional(validator);
+            }
+        }
+        return new VldObject({
+            ...this._config,
+            shape: deepPartialShape
+        });
+    }
+    /**
+     * Create a new validator with only specified keys
+     */
+    pick(...keys) {
+        const pickedShape = {};
+        for (const key of keys) {
+            if (key in this._config.shape) {
+                pickedShape[key] = this._config.shape[key];
+            }
+        }
+        return new VldObject({
+            ...this._config,
+            shape: pickedShape
+        });
+    }
+    /**
+     * Create a new validator without specified keys
+     */
+    omit(...keys) {
+        const omittedShape = {};
+        const keysToOmit = new Set(keys);
+        for (const key in this._config.shape) {
+            if (!keysToOmit.has(key)) {
+                omittedShape[key] = this._config.shape[key];
+            }
+        }
+        return new VldObject({
+            ...this._config,
+            shape: omittedShape
+        });
+    }
+    /**
+     * Create a new validator with additional fields
+     */
+    extend(extension) {
+        return new VldObject({
+            ...this._config,
+            shape: { ...this._config.shape, ...extension }
+        });
+    }
+    /**
+     * Create a new validator by merging with another object validator
+     */
+    merge(other) {
+        return new VldObject({
+            ...this._config,
+            shape: { ...this._config.shape, ...other.config.shape }
+        });
+    }
+    /**
+     * Create a new validator with all fields required (removes optional)
+     */
+    required() {
+        const requiredShape = {};
+        for (const key in this._config.shape) {
+            const validator = this._config.shape[key];
+            // If it's optional, unwrap it
+            if (validator instanceof validators_base.VldOptional) {
+                // BUG-001 FIX: Add defensive check for baseValidator property
+                const unwrapped = validator.baseValidator;
+                if (!unwrapped || typeof unwrapped.parse !== 'function') {
+                    throw new Error(`Invalid VldOptional structure for field "${key}": missing or invalid baseValidator`);
+                }
+                requiredShape[key] = unwrapped;
+            }
+            else {
+                requiredShape[key] = validator;
+            }
+        }
+        return new VldObject({
+            ...this._config,
+            shape: requiredShape
+        });
+    }
+    /**
+     * Create a new validator with a catchall validator for extra keys
+     * Zod 4 API parity - validates unknown keys with provided schema
+     */
+    catchall(schema) {
+        return new VldObject({
+            ...this._config,
+            catchall: schema,
+            passthrough: false // catchall overrides passthrough
+        });
+    }
+    /**
+     * Access the inner shape schemas
+     * Zod 4 API parity - returns the shape object
+     */
+    get shape() {
+        return this._config.shape;
+    }
+    /**
+     * Create an enum validator from object keys
+     * Zod 4 API parity - creates literal union of keys
+     */
+    keyof() {
+        const keys = Object.keys(this._config.shape);
+        if (keys.length === 0) {
+            throw new Error('Cannot create keyof enum from empty object');
+        }
+        return validators_enum.VldEnum.create(keys);
+    }
+    /**
+     * Type-safe extend that throws an error if any key already exists
+     * Zod 4 API parity - prevents accidental field override
+     * @param extension The extension shape to add
+     * @returns A new validator with extended shape
+     * @throws {Error} If any extension key already exists in the shape
+     * @example
+     * const base = v.object({ name: v.string() });
+     * const extended = base.safeExtend({ age: v.number() }); // OK
+     * const invalid = base.safeExtend({ name: v.number() }); // Throws error
+     */
+    safeExtend(extension) {
+        // Check for overlapping keys
+        const existingKeys = new Set(Object.keys(this._config.shape));
+        const extensionKeys = Object.keys(extension);
+        const overlappingKeys = [];
+        for (const key of extensionKeys) {
+            if (existingKeys.has(key)) {
+                overlappingKeys.push(key);
+            }
+        }
+        if (overlappingKeys.length > 0) {
+            throw new Error(`safeExtend: ${locales_runtime.getMessages().safeExtendOverlap(overlappingKeys)}`);
+        }
+        return new VldObject({
+            ...this._config,
+            shape: { ...this._config.shape, ...extension }
+        });
+    }
+}
+
+exports.VldObject = VldObject;