@ultimat3/schema 15.0.0 → 17.0.0

package/CLAUDE.md

@@ -118,6 +118,14 @@ Gotchas:
   PROTOTYPE, so a field named after one was unsatisfiable for every input and its `.default()`
   never fired; a `{}` output let a declared `__proto__` field write through the setter. Never
   reintroduce either half, and never assume a parsed object has `Object.prototype` on it.
+- **Every map keyed by a DECLARED FIELD NAME is built on `Object.create(null)`** — `objectSchema`'s
+  `properties`, `json-schema.ts`'s converted `properties`, and `pick`/`omit`'s rebuilt shape. That
+  last pair is the one with teeth: `next['__proto__'] = member` on a `{}` literal hits the setter,
+  so `pick('__proto__')` answered a schema with **zero** properties and dropped the one field the
+  caller asked to keep from validation, from the IR and from `parse()`'s output. `extend` needs
+  nothing: object spread defines own properties and never invokes a setter. A field named
+  `__proto__` is declarable — `t.object({ ['__proto__']: t.string })`, a COMPUTED key, which is an
+  ordinary own property where the literal `{ __proto__: … }` form is the setter.
 - `t.date` refuses a clock time with no offset and no `Z` (`iso-date.ts`): a zone-less string is a
   different instant per host `TZ`, and `coerceQuery` puts it one query parameter from the wire.
   A date-only string carries no clock time and is UTC by spec, so it still parses.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/schema",
-  "version": "15.0.0",
+  "version": "17.0.0",
   "description": "Ultimate's validation seam: Standard Schema interface, the t namespace, JSON Schema output",
   "license": "MIT",
   "type": "module",

package/src/errors.ts

@@ -16,17 +16,17 @@ import { formatIssues } from './standard';
  */
 // biome-ignore lint/suspicious/noControlCharactersInRegex: escaping them is the point.
 const CONTROL = /[\u0000-\u001f\u007f\u2028\u2029]/g;
-const ESCAPES: Readonly<Record<string, string>> = {
+// Null-prototype, so `ESCAPES[char]` cannot answer an `Object.prototype` member no matter what
+// `CONTROL` matched. The domain argument — a key is exactly one control character, and no
+// prototype member has a single-character name — was true and is no longer load-bearing; a table
+// that cannot reach the prototype needs no argument, and `bun run proto-index` stops reporting it.
+const ESCAPES: Readonly<Record<string, string>> = Object.assign(Object.create(null), {
   '\n': String.raw`\n`,
   '\r': String.raw`\r`,
   '\t': String.raw`\t`,
   '\b': String.raw`\b`,
   '\f': String.raw`\f`,
-};
-// `ESCAPES[char]` is a computed read on a plain object and is safe by DOMAIN, not by luck: the
-// key is whatever `CONTROL` matched, so it is exactly one control character — and no
-// `Object.prototype` member has a single-character name. Every other computed read in this file
-// goes through `Object.hasOwn`.
+});
 const singleLine = (text: string): string =>
   text.replace(
     CONTROL,

package/src/json-schema.ts

@@ -231,7 +231,13 @@ function convert(node: SchemaNode): JsonSchema {
         additionalProperties: false,
       });
     case 'object': {
-      const properties: Record<string, JsonSchema> = {};
+      // `Object.create(null)`, the same rule `validators.ts` applies to the IR this reads: a
+      // `__proto__` property assigned into a `{}` literal reaches the setter and is published
+      // nowhere, so the document would omit a field the server enforces.
+      const properties: Record<string, JsonSchema> = Object.create(null) as Record<
+        string,
+        JsonSchema
+      >;
       for (const [key, child] of Object.entries(node.properties ?? {})) {
         properties[key] = convert(child);
       }

package/src/validators.ts

@@ -155,7 +155,11 @@ function makeNumberSchema(node: SchemaNode): NumberSchema {
 }
 
 export function objectSchema<S extends Shape>(shape: S): ObjectSchema<S> {
-  const properties: Record<string, SchemaNode> = {};
+  // `Object.create(null)` for the same reason the parse output below uses one, on the other side
+  // of the same rule: a DECLARED `__proto__` field assigned into a `{}` literal hits the prototype
+  // setter and never becomes a key, so the field vanished from the IR `json-schema.ts` publishes
+  // and `coerce.ts` walks while the `checks` list beside it went on validating it.
+  const properties: Record<string, SchemaNode> = Object.create(null) as Record<string, SchemaNode>;
   const checks: [string, Check<unknown>][] = [];
   for (const [key, member] of Object.entries(shape)) {
     properties[key] = member.node;
@@ -195,14 +199,20 @@ export function objectSchema<S extends Shape>(shape: S): ObjectSchema<S> {
     ...base,
     shape,
     extend: (extra) => objectSchema({ ...shape, ...extra } as Simplified<S & typeof extra>),
+    // `Object.create(null)` in both, for the reason the IR above states and with a worse outcome
+    // here: `next['__proto__'] = member` on a `{}` literal hits the prototype SETTER, so the field
+    // is not mis-published, it is GONE — `pick('__proto__')` answered a schema with no properties
+    // at all, dropping the one field the caller asked to keep from validation, from the IR and
+    // from `parse()`'s output. `extend` needs none of this: object spread defines own properties
+    // and never invokes a setter.
     pick: (...keys) => {
-      const next: Record<string, AnySchema> = {};
+      const next: Record<string, AnySchema> = Object.create(null) as Record<string, AnySchema>;
       for (const key of keys) next[key] = shape[key] as AnySchema;
       return objectSchema(next) as ObjectSchema<Pick<S, (typeof keys)[number]>>;
     },
     omit: (...keys) => {
       const drop = new Set<string>(keys);
-      const next: Record<string, AnySchema> = {};
+      const next: Record<string, AnySchema> = Object.create(null) as Record<string, AnySchema>;
       for (const [key, member] of Object.entries(shape)) {
         if (!drop.has(key)) next[key] = member;
       }