@ultimat3/schema 16.0.0 → 18.0.0

package/CLAUDE.md

@@ -50,18 +50,28 @@ first already owns, can never be routed to — so it is wrong for every input, a
 of the authoring file is the earliest honest place to say so.
 
 `SCHEMA_ERROR_CODES` in `errors.ts` is data, not a `registerErrorCodes()` call — this package is
-tier 0 and cannot import `@ultimat3/core` to reach it. `@ultimat3/core`'s `schema-error-codes.ts`
-carries a duplicate of these titles and registers them unconditionally, so every process gets the
-real titles just by importing core. Add a code here **and** update that duplicate in the same
-change — `schema-error-codes-pin.test.ts` in `@ultimat3/cli` fails the build if they disagree.
+tier 0 and cannot import `@ultimat3/core` to reach it, and never will. `@ultimat3/core`'s
+`schema-error-codes.ts` READS this object over the declared `core -> schema` edge and registers it
+unconditionally, so every process gets the real titles just by importing core. **Adding a code here
+is the whole edit `As of 2026-08-27`** — the title and its `terminal` retry classification are both
+derived from this set, where they used to be a hand-kept duplicate in core plus a hand-written
+retry list a fifth code would have been silently missing from.
 
 `ERROR_DOCS_URL` in `errors.ts` is the third deliberate tier-0 duplicate, beside `singleLine` and
 `ULTIMATE_ERROR_BRAND` — one URL, spelled out, because `SchemaError` cannot import
 `@ultimat3/core`'s constant. There is no per-code URL anywhere in the framework: codes live in
 `wiki/Error-Codes.md` as table ROWS and a table row has no anchor, so
 `https://ultimate.dev/errors/<code>` was a 404 on every error and was deleted `As of 2026-08-23`. Change it
-here and in `packages/core/src/error-codes.ts` in the same edit. **There is no pin test yet** —
-one belongs in `@ultimat3/cli` beside `single-line-pin.test.ts`, which may legally import both.
+here and in `packages/core/src/error-codes.ts` in the same edit. **It is pinned `As of 2026-08-27`**
+— `packages/core/src/single-line-pin.test.ts` asserts a `SchemaError`'s `docs` equals an
+`UltimateError`'s, which was the one copy with no mechanical check at all and the one that decides
+where every schema refusal sends its reader.
+
+**These three are the whole of the duplication that remains, and the edge does not reach them.**
+`core -> schema` was declared 2026-08-27 and collapsed five copies on the CORE side; `singleLine`,
+`ERROR_DOCS_URL` and `ULTIMATE_ERROR_BRAND` go the other way, and `schema -> core` stays forbidden
+on its merits — `t` is in every bundle graph an app has, so a dependency here is a dependency
+everywhere.
 
 `MoneyValue` in `money-value.ts` — its own file, because it is the only builtin whose *shape* other
 packages alias — is the framework's **one** declaration of a money value. Tier 0 is
@@ -118,6 +128,14 @@ Gotchas:
   PROTOTYPE, so a field named after one was unsatisfiable for every input and its `.default()`
   never fired; a `{}` output let a declared `__proto__` field write through the setter. Never
   reintroduce either half, and never assume a parsed object has `Object.prototype` on it.
+- **Every map keyed by a DECLARED FIELD NAME is built on `Object.create(null)`** — `objectSchema`'s
+  `properties`, `json-schema.ts`'s converted `properties`, and `pick`/`omit`'s rebuilt shape. That
+  last pair is the one with teeth: `next['__proto__'] = member` on a `{}` literal hits the setter,
+  so `pick('__proto__')` answered a schema with **zero** properties and dropped the one field the
+  caller asked to keep from validation, from the IR and from `parse()`'s output. `extend` needs
+  nothing: object spread defines own properties and never invokes a setter. A field named
+  `__proto__` is declarable — `t.object({ ['__proto__']: t.string })`, a COMPUTED key, which is an
+  ordinary own property where the literal `{ __proto__: … }` form is the setter.
 - `t.date` refuses a clock time with no offset and no `Z` (`iso-date.ts`): a zone-less string is a
   different instant per host `TZ`, and `coerceQuery` puts it one query parameter from the wire.
   A date-only string carries no clock time and is UTC by spec, so it still parses.

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@ultimat3/schema",
-  "version": "16.0.0",
+  "version": "18.0.0",
   "description": "Ultimate's validation seam: Standard Schema interface, the t namespace, JSON Schema output",
   "license": "MIT",
   "type": "module",
+  "sideEffects": false,
   "repository": {
     "type": "git",
     "url": "git+https://github.com/developerz-ai/ultimate.git",
@@ -24,7 +25,7 @@
     "LICENSE"
   ],
   "engines": {
-    "bun": ">=1.3.0"
+    "bun": ">=1.4.0"
   },
   "scripts": {
     "typecheck": "tsc --noEmit -p tsconfig.json",

package/src/errors.ts

@@ -16,17 +16,17 @@ import { formatIssues } from './standard';
  */
 // biome-ignore lint/suspicious/noControlCharactersInRegex: escaping them is the point.
 const CONTROL = /[\u0000-\u001f\u007f\u2028\u2029]/g;
-const ESCAPES: Readonly<Record<string, string>> = {
+// Null-prototype, so `ESCAPES[char]` cannot answer an `Object.prototype` member no matter what
+// `CONTROL` matched. The domain argument — a key is exactly one control character, and no
+// prototype member has a single-character name — was true and is no longer load-bearing; a table
+// that cannot reach the prototype needs no argument, and `bun run proto-index` stops reporting it.
+const ESCAPES: Readonly<Record<string, string>> = Object.assign(Object.create(null), {
   '\n': String.raw`\n`,
   '\r': String.raw`\r`,
   '\t': String.raw`\t`,
   '\b': String.raw`\b`,
   '\f': String.raw`\f`,
-};
-// `ESCAPES[char]` is a computed read on a plain object and is safe by DOMAIN, not by luck: the
-// key is whatever `CONTROL` matched, so it is exactly one control character — and no
-// `Object.prototype` member has a single-character name. Every other computed read in this file
-// goes through `Object.hasOwn`.
+});
 const singleLine = (text: string): string =>
   text.replace(
     CONTROL,

package/src/index.ts

@@ -91,6 +91,7 @@ export {
 } from './standard';
 export type { Infer } from './t';
 export { t } from './t';
+export { isIanaZoneName } from './time-zone-name';
 export type {
   NumberSchema,
   ObjectSchema,

package/src/json-schema.ts

@@ -231,7 +231,13 @@ function convert(node: SchemaNode): JsonSchema {
         additionalProperties: false,
       });
     case 'object': {
-      const properties: Record<string, JsonSchema> = {};
+      // `Object.create(null)`, the same rule `validators.ts` applies to the IR this reads: a
+      // `__proto__` property assigned into a `{}` literal reaches the setter and is published
+      // nowhere, so the document would omit a field the server enforces.
+      const properties: Record<string, JsonSchema> = Object.create(null) as Record<
+        string,
+        JsonSchema
+      >;
       for (const [key, child] of Object.entries(node.properties ?? {})) {
         properties[key] = convert(child);
       }

package/src/time-zone-name.ts

@@ -1,8 +1,12 @@
-// Single responsibility: is a string an IANA zone NAME? Tier 0's second statement of the one rule
+// Single responsibility: is a string an IANA zone NAME? TIER 0'S ONE STATEMENT of the rule
 // `@ultimat3/time` enforces everywhere above it — a zone is `Area/Location`, and `UTC` is the one
-// exception. It is stated a third time because `schema` is tier 0 and may import neither
-// `@ultimat3/time` nor `@ultimat3/core`; `packages/time/src/zone-canonical.ts` is where the rule
-// and its reasoning are written down.
+// exception. `@ultimat3/core` imported its own copy of this predicate until 2026-08-27 and now
+// re-exports this one, over the declared `core -> schema` edge.
+//
+// `@ultimat3/time`'s `canonicalTimeZone` is NOT a fourth copy and is deliberately left alone: it
+// answers a different question (the canonical SPELLING, memoised over ~445 listed zones plus a
+// probe cache) and shares only the leading-sign rule below. Collapsing it into this predicate
+// would trade a cache a request header can hit for one it cannot.
 
 /**
  * A LEADING sign is a fixed offset, which carries no DST rules. `Etc/GMT+2` keeps its `+`.
@@ -22,10 +26,9 @@ const NUMERIC_OFFSET = /^[+-]/;
  * file enforces is that same rule at the EDGE: an identifier is `Area/Location`, `UTC` is the one
  * legal exception, and a leading sign is an offset rather than a name.
  *
- * `@ultimat3/core`'s `isIanaZoneName` is the same predicate for `app.config.ts`. Nothing below
- * tier 5 can compare the two, so `timezone-validator-pin.test.ts` in `@ultimat3/cli` is the
- * mechanical half — the arrangement `schema-error-codes-pin.test.ts` already uses for tier 0's
- * other deliberate duplicate.
+ * `@ultimat3/core` re-exports THIS function for `app.config.ts`, so the edge validator and the
+ * config validator are one predicate. They were two, held equal by a 123-line pin test in
+ * `@ultimat3/cli` that no rule required to exist.
  *
  * Of the three copies this is the one that guards CALLER input: `t.timezone` is a request body
  * field and a query parameter through `coerceQuery`, so the bare `new Intl.DateTimeFormat(…)`

package/src/validators.ts

@@ -155,7 +155,11 @@ function makeNumberSchema(node: SchemaNode): NumberSchema {
 }
 
 export function objectSchema<S extends Shape>(shape: S): ObjectSchema<S> {
-  const properties: Record<string, SchemaNode> = {};
+  // `Object.create(null)` for the same reason the parse output below uses one, on the other side
+  // of the same rule: a DECLARED `__proto__` field assigned into a `{}` literal hits the prototype
+  // setter and never becomes a key, so the field vanished from the IR `json-schema.ts` publishes
+  // and `coerce.ts` walks while the `checks` list beside it went on validating it.
+  const properties: Record<string, SchemaNode> = Object.create(null) as Record<string, SchemaNode>;
   const checks: [string, Check<unknown>][] = [];
   for (const [key, member] of Object.entries(shape)) {
     properties[key] = member.node;
@@ -195,14 +199,20 @@ export function objectSchema<S extends Shape>(shape: S): ObjectSchema<S> {
     ...base,
     shape,
     extend: (extra) => objectSchema({ ...shape, ...extra } as Simplified<S & typeof extra>),
+    // `Object.create(null)` in both, for the reason the IR above states and with a worse outcome
+    // here: `next['__proto__'] = member` on a `{}` literal hits the prototype SETTER, so the field
+    // is not mis-published, it is GONE — `pick('__proto__')` answered a schema with no properties
+    // at all, dropping the one field the caller asked to keep from validation, from the IR and
+    // from `parse()`'s output. `extend` needs none of this: object spread defines own properties
+    // and never invokes a setter.
     pick: (...keys) => {
-      const next: Record<string, AnySchema> = {};
+      const next: Record<string, AnySchema> = Object.create(null) as Record<string, AnySchema>;
       for (const key of keys) next[key] = shape[key] as AnySchema;
       return objectSchema(next) as ObjectSchema<Pick<S, (typeof keys)[number]>>;
     },
     omit: (...keys) => {
       const drop = new Set<string>(keys);
-      const next: Record<string, AnySchema> = {};
+      const next: Record<string, AnySchema> = Object.create(null) as Record<string, AnySchema>;
       for (const [key, member] of Object.entries(shape)) {
         if (!drop.has(key)) next[key] = member;
       }