@timber-js/app 0.2.0-alpha.212 → 0.2.0-alpha.214

package/dist/_chunks/{actions-CCdnVtWm.js → actions-CUh3cClk.js}

@@ -1,4 +1,4 @@
-import { r as canonicalize } from "./canonicalize-CgHoscYO.js";
+import { i as canonicalize } from "./canonicalize-BAWkWiKK.js";
 import { a as revalidationAls, i as requestContextAls, r as reactCacheScopeAls } from "./als-registry-BZqHCtq-.js";
 import { C as isRedirectSignal, F as withSpan, S as isDenySignal, T as isDevMode, b as REDIRECT_BRAND, w as isDebug, y as DENY_BRAND } from "./logger-CbLdcy-W.js";
 import { n as _setGetSegmentParamsFn, t as _setGetSearchParamsFn } from "./als-slots-BEEIPKYm.js";
@@ -850,9 +850,15 @@ function waitUntil(promise) {
 * Handles:
 * - **Duplicate keys → arrays**: `tags=js&tags=ts` → `{ tags: ["js", "ts"] }`
 * - **Nested dot-paths**: `user.name=Alice` → `{ user: { name: "Alice" } }`
-* - **Empty strings → undefined**: Enables `.optional()` semantics in schemas
+* - **Indexed lists → arrays**: `rows.0.name=A&rows.1.name=B` →
+*   `{ rows: [{ name: "A" }, { name: "B" }] }`, when the indexes are exactly
+*   `0..n-1`. A list with a gap stays an object keyed by index.
+* - **Empty strings stay `""`**: a blank text input is `""`, so
+*   `z.string().min(1, 'Required')` reports its own message. Use
+*   `coerce.text` to make a blank optional field `undefined`
 * - **Empty Files → undefined**: File inputs with no selection become `undefined`
 * - **Strips `$ACTION_*` fields**: React's internal hidden fields are excluded
+* - **Drops `__proto__` paths and names deeper than 32 segments**
 */
 function parseFormData(formData) {
 	const flat = {};
@@ -895,6 +901,7 @@ function expandDotPaths(flat) {
 	for (const [key, value] of Object.entries(flat)) {
 		const parts = key.split(".");
 		if (parts.some((p) => DANGEROUS_KEYS.has(p))) continue;
+		if (parts.length > MAX_PATH_DEPTH) continue;
 		if (parts.length === 1) {
 			result[parts[0]] = value;
 			continue;
@@ -902,20 +909,47 @@ function expandDotPaths(flat) {
 		let current = result;
 		for (let i = 0; i < parts.length - 1; i++) {
 			const part = parts[i];
-			if (current[part] === void 0 || current[part] === null) current[part] = {};
-			if (typeof current[part] !== "object" || current[part] instanceof File) current[part] = {};
+			if (!isPlainObject(current[part])) current[part] = {};
 			current = current[part];
 		}
 		current[parts[parts.length - 1]] = value;
 	}
+	for (const [key, value] of Object.entries(result)) if (isPlainObject(value)) result[key] = indexedListsToArrays(value);
 	return result;
 }
+/**
+* `node`, with every nested object whose keys are exactly `"0".."n-1"`
+* turned into an array, depth first. Only a dense, canonical index set
+* converts: `{ "0", "2" }` (a gap), `{ "01" }` and `{ "0", "name" }` stay
+* objects. So a forged `rows.99999` stays one key instead of allocating a
+* sparse array, and the array's length is bounded by the field count limit.
+*
+* Object.keys lists integer-like keys first, in ascending order, so a dense
+* set reads as `0, 1, … n-1` and `Object.values` is already in index order.
+*/
+function indexedListsToArrays(node) {
+	for (const [key, value] of Object.entries(node)) if (isPlainObject(value)) node[key] = indexedListsToArrays(value);
+	const keys = Object.keys(node);
+	return keys.length > 0 && keys.every((key, i) => key === String(i)) ? Object.values(node) : node;
+}
+/** An object the dot-path walk built — not an array, File or other instance. */
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && Object.getPrototypeOf(value) === Object.prototype;
+}
 var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__"]);
 /**
+* The most segments a dot-path field name may have. A deeper name is dropped,
+* like a `__proto__` path, so no walk over the parsed value can exhaust the
+* stack (TIM-1573).
+*/
+var MAX_PATH_DEPTH = 32;
+/**
 * Schema-agnostic coercion primitives for common FormData patterns.
 *
 * These are plain transform functions — they compose with any schema library's
-* `transform`/`preprocess` pipeline:
+* `transform`/`preprocess` pipeline. In Zod, use `z.preprocess`: it runs on an
+* absent key (an unchecked checkbox), where `z.unknown().transform()` fails
+* with "expected nonoptional" before the transform runs.
 *
 * ```ts
 * // Zod
@@ -930,8 +964,9 @@ var coerce = {
 	* Use with `.optional()` schemas where an empty input means "not provided".
 	*
 	* ```ts
-	* // Zod
-	* z.unknown().transform(coerce.text).pipe(z.string().optional())
+	* // Zod — preprocess, not `z.unknown().transform(…)`: Zod 4 rejects an
+	* // absent key before a transform runs ("expected nonoptional")
+	* z.preprocess(coerce.text, z.string().optional())
 	* // Valibot
 	* v.pipe(v.unknown(), v.transform(coerce.text), v.optional(v.string()))
 	* ```
@@ -1198,4 +1233,4 @@ function revalidationPathMatches(revalidatedPath, requestPathname, requestSearch
 //#endregion
 export { setMutableCookieContext as C, setMatchedSegmentPath as S, runOutsideReactCacheScope as T, getHeaders as _, parseFormData as a, markResponseFlushed as b, deny as c, waitUntil as d, getCookie as f, getHeader as g, applyRequestHeaderOverlay as h, coerce as i, redirect as l, getSetCookieHeaders as m, revalidatePath as n, DenySignal as o, getCookieJar as p, revalidateTag as r, RedirectSignal as s, executeAction as t, redirectExternal as u, getSearchParams as v, setSegmentParams as w, runWithRequestContext as x, getSegmentParams as y };
 
-//# sourceMappingURL=actions-CCdnVtWm.js.map
+//# sourceMappingURL=actions-CUh3cClk.js.map