@webergency-utils/typechecker 0.2.1 → 0.2.3

package/dist/runtime/validators.js

@@ -18,6 +18,140 @@ function isPlainObject(v) {
     const proto = Object.getPrototypeOf(v);
     return proto === Object.prototype || proto === null;
 }
+function setOwnProperty(target, key, value) {
+    if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
+        target[key] = value;
+        return;
+    }
+    Object.defineProperty(target, key, {
+        value,
+        enumerable: true,
+        configurable: true,
+        writable: true
+    });
+}
+function assignOwnProperties(target, source) {
+    for (const key of Object.keys(source)) {
+        setOwnProperty(target, key, source[key]);
+    }
+}
+function keySetHas(keys, key) {
+    return keys instanceof Set ? keys.has(key) : keys.includes(key);
+}
+function commitContainer(target, source) {
+    if (target === source) {
+        return true;
+    }
+    if (Array.isArray(target) && Array.isArray(source)) {
+        target.length = source.length;
+        for (let i = 0; i < source.length; i++) {
+            target[i] = source[i];
+        }
+        return true;
+    }
+    if (target instanceof Set && source instanceof Set) {
+        target.clear();
+        for (const value of source) {
+            target.add(value);
+        }
+        return true;
+    }
+    if (target instanceof Map && source instanceof Map) {
+        target.clear();
+        for (const [key, value] of source) {
+            target.set(key, value);
+        }
+        return true;
+    }
+    if (isPlainObject(target) && isPlainObject(source)) {
+        for (const key of Object.keys(target)) {
+            if (!Object.hasOwn(source, key)) {
+                delete target[key];
+            }
+        }
+        for (const key of Object.keys(source)) {
+            if (!Object.hasOwn(target, key) || target[key] !== source[key]) {
+                setOwnProperty(target, key, source[key]);
+            }
+        }
+        return true;
+    }
+    return false;
+}
+const regexSafetyCache = new WeakMap();
+function isSafeRegexSource(source) {
+    if (source.length > 1024 || /\\[1-9]/.test(source)) {
+        return false;
+    }
+    const groups = [];
+    let inClass = false;
+    let escaped = false;
+    for (let i = 0; i < source.length; i++) {
+        const ch = source[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (ch === '[') {
+            inClass = true;
+            continue;
+        }
+        if (ch === ']' && inClass) {
+            inClass = false;
+            continue;
+        }
+        if (inClass) {
+            continue;
+        }
+        if (ch === '(') {
+            groups.push({ hasRepeat: false, hasAlternation: false });
+            continue;
+        }
+        if (ch === '|' && groups.length > 0) {
+            groups[groups.length - 1].hasAlternation = true;
+            continue;
+        }
+        if (ch === '*' || ch === '+' || ch === '{') {
+            if (groups.length > 0) {
+                groups[groups.length - 1].hasRepeat = true;
+            }
+            continue;
+        }
+        if (ch === ')' && groups.length > 0) {
+            const group = groups.pop();
+            const next = source[i + 1];
+            const isRepeated = next === '*' || next === '+' || next === '{';
+            if (isRepeated && (group.hasRepeat || group.hasAlternation)) {
+                return false;
+            }
+            if (isRepeated && groups.length > 0) {
+                groups[groups.length - 1].hasRepeat = true;
+            }
+        }
+    }
+    return true;
+}
+function isRegexSafe(regex) {
+    const cached = regexSafetyCache.get(regex);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const safe = isSafeRegexSource(regex.source);
+    regexSafetyCache.set(regex, safe);
+    return safe;
+}
+function createSafeRegex(source, flags) {
+    if (!isSafeRegexSource(source)) {
+        throw new Error(`Unsafe regular expression: ${source}`);
+    }
+    const regex = flags === undefined ? new RegExp(source) : new RegExp(source, flags);
+    regexSafetyCache.set(regex, true);
+    return regex;
+}
 function testRegex(regex, value) {
     if (!regex.global && !regex.sticky) {
         return regex.test(value);
@@ -44,28 +178,38 @@ function wantsQuery(ctx) {
 function wantsJsonRevive(ctx) {
     return ctx.from === 'json' || ctx.from === 'query';
 }
-function pathKey(path) {
-    if (!path) {
-        return '';
+function isIndexSegment(seg) {
+    return seg.startsWith('[') && seg.endsWith(']');
+}
+function pathContext(path, ctx) {
+    const pathParts = tokenizePath(path);
+    const parentPath = joinPathSegments(pathParts.slice(0, -1));
+    const parent = getValueAtPath(ctx.root, parentPath);
+    const last = pathParts[pathParts.length - 1];
+    let index;
+    if (last && isIndexSegment(last)) {
+        const parsed = parseInt(last.slice(1, -1), 10);
+        if (!Number.isNaN(parsed)) {
+            index = parsed;
+        }
     }
-    const bracket = path.lastIndexOf('[');
-    const dot = path.lastIndexOf('.');
-    if (bracket > dot) {
-        const end = path.lastIndexOf(']');
-        if (end > bracket) {
-            return path.slice(bracket + 1, end);
+    let key = '';
+    for (let i = pathParts.length - 1; i >= 0; i--) {
+        if (!isIndexSegment(pathParts[i])) {
+            key = pathParts[i];
+            break;
         }
     }
-    if (dot >= 0) {
-        return path.slice(dot + 1);
+    if (index === undefined) {
+        return { key, path, parent, root: ctx.root };
     }
-    return path;
+    return { key, path, parent, root: ctx.root, index };
 }
-function fromCustom(ctx, path, value, type) {
+function fromCustom(ctx, path, value, kind) {
     if (typeof ctx.from !== 'function') {
         return value;
     }
-    return ctx.from(pathKey(path), value, type);
+    return ctx.from(value, { ...pathContext(path, ctx), kind });
 }
 /** Query-style number coercion — shared by `from: 'query'` and `transform.ToNumber`. */
 export function coerceQueryNumber(v) {
@@ -73,8 +217,12 @@ export function coerceQueryNumber(v) {
         return v;
     }
     if (typeof v === 'string' && v.trim() !== '') {
-        const parsed = parseFloat(v);
-        if (!Number.isNaN(parsed)) {
+        const normalized = v.trim();
+        if (!/^[+-]?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i.test(normalized)) {
+            return v;
+        }
+        const parsed = Number(normalized);
+        if (Number.isFinite(parsed)) {
             return parsed;
         }
     }
@@ -279,17 +427,32 @@ function isUriTemplate(value) {
     return URI_TEMPLATE_RE.test(value);
 }
 function parseFormatDate(value) {
-    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+    if (typeof value !== 'string') {
         return undefined;
     }
-    const parsed = new Date(value);
-    if (Number.isNaN(parsed.getTime())) {
+    const match = value.match(/^(\d{4})-(\d{2})-(\d{2})$/);
+    if (!match) {
+        return undefined;
+    }
+    const year = Number(match[1]);
+    const month = Number(match[2]);
+    const day = Number(match[3]);
+    const parsed = new Date(0);
+    parsed.setUTCHours(0, 0, 0, 0);
+    parsed.setUTCFullYear(year, month - 1, day);
+    if (parsed.getUTCFullYear() !== year ||
+        parsed.getUTCMonth() !== month - 1 ||
+        parsed.getUTCDate() !== day) {
         return undefined;
     }
     return parsed;
 }
 function parseFormatDateTime(value) {
-    if (typeof value !== 'string') {
+    if (typeof value !== 'string' ||
+        !/^\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/i.test(value)) {
+        return undefined;
+    }
+    if (!parseFormatDate(value.slice(0, 10))) {
         return undefined;
     }
     const parsed = new Date(value);
@@ -298,30 +461,236 @@ function parseFormatDateTime(value) {
     }
     return parsed;
 }
-function stableStringify(value, seen = new WeakSet()) {
-    if (value === null || typeof value !== 'object') {
-        return JSON.stringify(value);
+function deepEqual(left, right, seen = new WeakMap()) {
+    if (left === right) {
+        return true;
+    }
+    if (left === null || right === null || typeof left !== 'object' || typeof right !== 'object') {
+        return false;
+    }
+    const seenRight = seen.get(left);
+    if (seenRight?.has(right)) {
+        return true;
+    }
+    if (seenRight) {
+        seenRight.add(right);
+    }
+    else {
+        seen.set(left, new WeakSet([right]));
+    }
+    if (Array.isArray(left) || Array.isArray(right)) {
+        if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length) {
+            return false;
+        }
+        for (let i = 0; i < left.length; i++) {
+            if (!deepEqual(left[i], right[i], seen)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    if (left instanceof Date || right instanceof Date) {
+        return left instanceof Date && right instanceof Date && left.getTime() === right.getTime();
+    }
+    if (left instanceof RegExp || right instanceof RegExp) {
+        return left instanceof RegExp &&
+            right instanceof RegExp &&
+            left.source === right.source &&
+            left.flags === right.flags;
+    }
+    if (left instanceof Set || right instanceof Set) {
+        if (!(left instanceof Set) || !(right instanceof Set) || left.size !== right.size) {
+            return false;
+        }
+        const unmatched = [...right];
+        for (const value of left) {
+            const index = unmatched.findIndex(candidate => deepEqual(value, candidate));
+            if (index === -1) {
+                return false;
+            }
+            unmatched.splice(index, 1);
+        }
+        return true;
+    }
+    if (left instanceof Map || right instanceof Map) {
+        if (!(left instanceof Map) || !(right instanceof Map) || left.size !== right.size) {
+            return false;
+        }
+        const unmatched = [...right.entries()];
+        for (const [key, value] of left) {
+            const index = unmatched.findIndex(([candidateKey, candidateValue]) => deepEqual(key, candidateKey) && deepEqual(value, candidateValue));
+            if (index === -1) {
+                return false;
+            }
+            unmatched.splice(index, 1);
+        }
+        return true;
+    }
+    const leftKeys = Object.keys(left).sort();
+    const rightKeys = Object.keys(right).sort();
+    if (leftKeys.length !== rightKeys.length) {
+        return false;
+    }
+    for (let i = 0; i < leftKeys.length; i++) {
+        const key = leftKeys[i];
+        if (key !== rightKeys[i] || !deepEqual(left[key], right[key], seen)) {
+            return false;
+        }
+    }
+    return true;
+}
+function mixHash(h, part) {
+    return Math.imul(h ^ (part >>> 0), 16777619);
+}
+function mixStringHash(h, value) {
+    const len = value.length;
+    h = mixHash(h, len);
+    // Fast paths for short property names / small strings.
+    if (len === 1) {
+        return mixHash(h, value.charCodeAt(0));
+    }
+    if (len === 2) {
+        return mixHash(mixHash(h, value.charCodeAt(0)), value.charCodeAt(1));
+    }
+    if (len === 3) {
+        h = mixHash(h, value.charCodeAt(0));
+        h = mixHash(h, value.charCodeAt(1));
+        return mixHash(h, value.charCodeAt(2));
+    }
+    for (let i = 0; i < len; i++) {
+        h = mixHash(h, value.charCodeAt(i));
+    }
+    return h;
+}
+const uniqueFloat64Buf = new ArrayBuffer(8);
+const uniqueFloat64View = new Float64Array(uniqueFloat64Buf);
+const uniqueFloat64Words = new Int32Array(uniqueFloat64Buf);
+function mixNumberHash(h, value) {
+    if (Object.is(value, -0)) {
+        return mixHash(h, 0x30000001);
+    }
+    if (Number.isNaN(value)) {
+        return mixHash(h, 0x30000002);
     }
-    if (seen.has(value)) {
+    if (value === Infinity) {
+        return mixHash(h, 0x30000003);
+    }
+    if (value === -Infinity) {
+        return mixHash(h, 0x30000004);
+    }
+    uniqueFloat64View[0] = value;
+    return mixHash(mixHash(h, uniqueFloat64Words[0]), uniqueFloat64Words[1]);
+}
+/**
+ * Order-independent content hash for plain objects / arrays.
+ * Returns `undefined` for cycles and non-plain values (caller uses deepEqual list).
+ * Collisions are resolved with `deepEqual`.
+ */
+function uniqueContentHash(value, seen) {
+    if (value === null) {
+        return 0x10000001;
+    }
+    if (value === undefined) {
+        return 0x10000002;
+    }
+    const type = typeof value;
+    if (type === 'string') {
+        return mixStringHash(0x20000000, value) >>> 0;
+    }
+    if (type === 'number') {
+        return mixNumberHash(0x30000000, value) >>> 0;
+    }
+    if (type === 'boolean') {
+        return value ? 0x40000001 : 0x40000002;
+    }
+    if (type === 'bigint') {
+        // Split into 32-bit limbs — avoids string alloc for common small bigints.
+        let h = 0x50000000;
+        let n = value < 0n ? -value : value;
+        if (value < 0n) {
+            h = mixHash(h, 1);
+        }
+        while (n > 0n) {
+            h = mixHash(h, Number(n & 0xffffffffn));
+            n >>= 32n;
+        }
+        return h >>> 0;
+    }
+    if (type !== 'object') {
+        return undefined;
+    }
+    if (value instanceof Date) {
+        return mixNumberHash(0x60000000, value.getTime()) >>> 0;
+    }
+    if (value instanceof RegExp) {
+        return mixStringHash(0x70000000, `${value.source}/${value.flags}`) >>> 0;
+    }
+    if (value instanceof Map || value instanceof Set || ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+        return undefined;
+    }
+    if (seen?.has(value)) {
         return undefined;
     }
-    seen.add(value);
     if (Array.isArray(value)) {
-        const parts = value.map(item => {
-            const s = stableStringify(item, seen);
-            return s === undefined ? '"[Circular]"' : s;
-        });
-        return `[${parts.join(',')}]`;
+        const cycleSet = seen ?? new WeakSet();
+        cycleSet.add(value);
+        let h = mixHash(0x80000000, value.length);
+        for (let i = 0; i < value.length; i++) {
+            const child = uniqueContentHash(value[i], cycleSet);
+            if (child === undefined) {
+                return undefined;
+            }
+            h = mixHash(h, child);
+        }
+        return h >>> 0;
+    }
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) {
+        return undefined;
     }
-    const keys = Object.keys(value).sort();
-    const parts = keys.map(key => `${JSON.stringify(key)}:${stableStringify(value[key], seen) ?? '"[Circular]"'}`);
-    return `{${parts.join(',')}}`;
+    const keys = Object.keys(value);
+    const keyCount = keys.length;
+    if (keyCount > 1) {
+        // Avoid Array#sort when already ordered (common for same-shape rows).
+        let ordered = true;
+        for (let i = 1; i < keyCount; i++) {
+            if (keys[i] < keys[i - 1]) {
+                ordered = false;
+                break;
+            }
+        }
+        if (!ordered) {
+            keys.sort();
+        }
+    }
+    let cycleSet = seen;
+    let h = mixHash(0x90000000, keyCount);
+    for (let i = 0; i < keyCount; i++) {
+        const key = keys[i];
+        const childValue = value[key];
+        h = mixStringHash(h, key);
+        if (childValue !== null && typeof childValue === 'object') {
+            cycleSet ??= new WeakSet();
+            cycleSet.add(value);
+        }
+        const child = uniqueContentHash(childValue, cycleSet);
+        if (child === undefined) {
+            return undefined;
+        }
+        h = mixHash(h, child);
+    }
+    return h >>> 0;
 }
 export const validators = {
     coerceQueryNumber,
     coerceQueryBoolean,
     coerceQueryDate,
     coerceJsonDate,
+    safeRegExp: createSafeRegex,
+    assign: (target, source) => {
+        assignOwnProperties(target, source);
+        return target;
+    },
     string: (v, path, ctx) => {
         if (typeof v === 'string') {
             return v;
@@ -519,7 +888,7 @@ export const validators = {
     },
     array: (v, path, ctx, childValidator) => {
         if (!Array.isArray(v)) {
-            if (ctx.wrapArrays && v !== undefined && v !== null) {
+            if (wantsQuery(ctx) && v !== undefined && v !== null) {
                 v = [v];
             }
             else if (typeof ctx.from === 'function') {
@@ -537,11 +906,15 @@ export const validators = {
                 return v;
             }
         }
-        const mutate = shouldMutate(ctx);
-        const data = mutate ? v : [];
+        if (shouldMutate(ctx)) {
+            for (let i = 0; i < v.length; i++) {
+                v[i] = childValidator(v[i], path + '[' + i + ']', ctx);
+            }
+            return v;
+        }
+        const data = [];
         for (let i = 0; i < v.length; i++) {
-            const val = childValidator(v[i], path + '[' + i + ']', ctx);
-            data[i] = val;
+            data[i] = childValidator(v[i], path + '[' + i + ']', ctx);
         }
         return data;
     },
@@ -552,7 +925,7 @@ export const validators = {
             const wasSuccess = ctx.success;
             const result = validator(val, path + '.' + key, ctx);
             if (ctx.success) {
-                data[key] = result;
+                setOwnProperty(data, key, result);
             }
             else if (isOptional && val === undefined) {
                 ctx.errors.length = oldErrors;
@@ -577,7 +950,7 @@ export const validators = {
             return data;
         }
         for (const k of Object.keys(data)) {
-            if (!allowedKeys.includes(k)) {
+            if (!keySetHas(allowedKeys, k)) {
                 delete data[k];
             }
         }
@@ -588,10 +961,10 @@ export const validators = {
             return;
         }
         for (const key of Object.keys(v)) {
-            if (knownKeys.includes(key)) {
+            if (keySetHas(knownKeys, key)) {
                 continue;
             }
-            data[key] = childValidator(v[key], path + '.' + key, ctx);
+            setOwnProperty(data, key, childValidator(v[key], path + '.' + key, ctx));
         }
     },
     object: (v, path, ctx, allowedKeys, expected = 'Type<Object>') => {
@@ -613,7 +986,7 @@ export const validators = {
         }
         if (ctx.mode === 'strict' && allowedKeys) {
             for (const k of Object.keys(v)) {
-                if (!allowedKeys.includes(k)) {
+                if (!keySetHas(allowedKeys, k)) {
                     report(ctx, path, `PropertyNotAllowed<${k}>`, v[k]);
                 }
             }
@@ -664,7 +1037,13 @@ export const validators = {
     },
     multipleOf: (v, path, ctx, n, message) => {
         if (typeof v === 'bigint' || typeof n === 'bigint') {
-            if (BigInt(v) % BigInt(n) !== 0n) {
+            try {
+                const divisor = BigInt(n);
+                if (divisor === 0n || BigInt(v) % divisor !== 0n) {
+                    report(ctx, path, `MultipleOf<${n}>`, v, message);
+                }
+            }
+            catch {
                 report(ctx, path, `MultipleOf<${n}>`, v, message);
             }
         }
@@ -674,6 +1053,10 @@ export const validators = {
         return v;
     },
     pattern: (v, path, ctx, regex, expected, message) => {
+        if (!isRegexSafe(regex)) {
+            report(ctx, path, 'UnsafePattern', v, message);
+            return v;
+        }
         if (!testRegex(regex, v)) {
             report(ctx, path, expected, v, message);
         }
@@ -730,7 +1113,7 @@ export const validators = {
             case 'password': break; // Anything is a password
             case 'regex':
                 try {
-                    new RegExp(v);
+                    createSafeRegex(v);
                 }
                 catch {
                     isValid = false;
@@ -792,39 +1175,181 @@ export const validators = {
         return v;
     },
     uniqueItems: (v, path, ctx, message) => {
-        const seen = new Set();
+        // Typed scalar sets avoid per-item string encoding (SameValueZero for numbers,
+        // with an explicit -0 flag because Set collapses -0 with 0).
+        let seenStrings;
+        let seenNumbers;
+        let seenBigints;
+        let seenDates;
+        let seenRegex;
+        let seenNull = false;
+        let seenUndefined = false;
+        let seenTrue = false;
+        let seenFalse = false;
+        let seenNegZero = false;
+        // First item per hash; collision buckets allocated only when a hash repeats.
+        const firstByHash = new Map();
+        const collisionBuckets = new Map();
+        const complex = [];
         for (let i = 0; i < v.length; i++) {
             const item = v[i];
-            const key = typeof item === 'object' && item !== null
-                ? stableStringify(item) ?? item
-                : item;
-            if (seen.has(key)) {
-                report(ctx, path, 'UniqueItems', v, message);
-                break;
+            if (item === null) {
+                if (seenNull) {
+                    report(ctx, path, 'UniqueItems', v, message);
+                    return v;
+                }
+                seenNull = true;
+                continue;
+            }
+            if (item === undefined) {
+                if (seenUndefined) {
+                    report(ctx, path, 'UniqueItems', v, message);
+                    return v;
+                }
+                seenUndefined = true;
+                continue;
+            }
+            const type = typeof item;
+            if (type === 'string') {
+                seenStrings ??= new Set();
+                if (seenStrings.has(item)) {
+                    report(ctx, path, 'UniqueItems', v, message);
+                    return v;
+                }
+                seenStrings.add(item);
+                continue;
             }
-            seen.add(key);
+            if (type === 'number') {
+                if (Object.is(item, -0)) {
+                    if (seenNegZero) {
+                        report(ctx, path, 'UniqueItems', v, message);
+                        return v;
+                    }
+                    seenNegZero = true;
+                    continue;
+                }
+                seenNumbers ??= new Set();
+                if (seenNumbers.has(item)) {
+                    report(ctx, path, 'UniqueItems', v, message);
+                    return v;
+                }
+                seenNumbers.add(item);
+                continue;
+            }
+            if (type === 'boolean') {
+                if (item) {
+                    if (seenTrue) {
+                        report(ctx, path, 'UniqueItems', v, message);
+                        return v;
+                    }
+                    seenTrue = true;
+                }
+                else {
+                    if (seenFalse) {
+                        report(ctx, path, 'UniqueItems', v, message);
+                        return v;
+                    }
+                    seenFalse = true;
+                }
+                continue;
+            }
+            if (type === 'bigint') {
+                seenBigints ??= new Set();
+                if (seenBigints.has(item)) {
+                    report(ctx, path, 'UniqueItems', v, message);
+                    return v;
+                }
+                seenBigints.add(item);
+                continue;
+            }
+            if (type === 'object') {
+                if (item instanceof Date) {
+                    const time = item.getTime();
+                    seenDates ??= new Set();
+                    if (seenDates.has(time)) {
+                        report(ctx, path, 'UniqueItems', v, message);
+                        return v;
+                    }
+                    seenDates.add(time);
+                    continue;
+                }
+                if (item instanceof RegExp) {
+                    const key = `${item.source}/${item.flags}`;
+                    seenRegex ??= new Set();
+                    if (seenRegex.has(key)) {
+                        report(ctx, path, 'UniqueItems', v, message);
+                        return v;
+                    }
+                    seenRegex.add(key);
+                    continue;
+                }
+                const hash = uniqueContentHash(item);
+                if (hash !== undefined) {
+                    const first = firstByHash.get(hash);
+                    if (first === undefined) {
+                        firstByHash.set(hash, item);
+                        continue;
+                    }
+                    let bucket = collisionBuckets.get(hash);
+                    if (!bucket) {
+                        if (deepEqual(item, first)) {
+                            report(ctx, path, 'UniqueItems', v, message);
+                            return v;
+                        }
+                        collisionBuckets.set(hash, [first, item]);
+                        continue;
+                    }
+                    for (let j = 0; j < bucket.length; j++) {
+                        if (deepEqual(item, bucket[j])) {
+                            report(ctx, path, 'UniqueItems', v, message);
+                            return v;
+                        }
+                    }
+                    bucket.push(item);
+                    continue;
+                }
+            }
+            for (let j = 0; j < complex.length; j++) {
+                if (deepEqual(item, complex[j])) {
+                    report(ctx, path, 'UniqueItems', v, message);
+                    return v;
+                }
+            }
+            complex.push(item);
         }
         return v;
     },
     custom: (v, path, ctx, fn, message) => {
-        const pathParts = tokenizePath(path);
-        const parentPath = joinPathSegments(pathParts.slice(0, -1));
-        const parent = getValueAtPath(ctx.root, parentPath);
-        const last = pathParts[pathParts.length - 1];
-        const index = last && last.startsWith('[') ? parseInt(last.slice(1, -1), 10) : undefined;
-        if (!fn(v, { parent, root: ctx.root, path, index: Number.isNaN(index) ? undefined : index })) {
+        if (!fn(v, pathContext(path, ctx))) {
             report(ctx, path, fn.name ? `Custom<${fn.name}>` : 'Custom', v, message);
         }
         return v;
     },
     union: (v, path, ctx, checks, expected = 'Type<Union>') => {
         const unionErrors = [];
+        // Speculative arms always use a side tree so a failed arm cannot poison the next.
+        const subCtx = {
+            success: true,
+            errors: [],
+            mode: ctx.mode,
+            from: undefined,
+            mutate: false,
+            root: ctx.root
+        };
+        const accept = (val) => {
+            if (shouldMutate(ctx) && commitContainer(v, val)) {
+                return v;
+            }
+            return val;
+        };
         // Pass 1: No conversion
         for (const check of checks) {
-            const subCtx = { ...ctx, success: true, errors: [], from: undefined };
+            subCtx.success = true;
+            subCtx.errors.length = 0;
+            subCtx.from = undefined;
             const val = check(v, path, subCtx);
             if (subCtx.success) {
-                return val;
+                return accept(val);
             }
             unionErrors.push(...subCtx.errors);
         }
@@ -832,10 +1357,12 @@ export const validators = {
         if (ctx.from) {
             unionErrors.length = 0;
             for (const check of checks) {
-                const subCtx = { ...ctx, success: true, errors: [] };
+                subCtx.success = true;
+                subCtx.errors.length = 0;
+                subCtx.from = ctx.from;
                 const val = check(v, path, subCtx);
                 if (subCtx.success) {
-                    return val;
+                    return accept(val);
                 }
                 unionErrors.push(...subCtx.errors);
             }
@@ -866,8 +1393,13 @@ export const validators = {
                 return v;
             }
         }
-        const mutate = shouldMutate(ctx);
-        const data = mutate ? v : [];
+        if (shouldMutate(ctx)) {
+            for (let i = 0; i < checks.length; i++) {
+                v[i] = checks[i](v[i], path + '[' + i + ']', ctx);
+            }
+            return v;
+        }
+        const data = [];
         for (let i = 0; i < checks.length; i++) {
             data[i] = checks[i](v[i], path + '[' + i + ']', ctx);
         }
@@ -940,7 +1472,7 @@ export const validators = {
         const mutate = shouldMutate(ctx);
         const data = mutate ? v : {};
         for (const key of Object.keys(v)) {
-            data[key] = childValidator(v[key], path + '.' + key, ctx);
+            setOwnProperty(data, key, childValidator(v[key], path + '.' + key, ctx));
         }
         return data;
     },
@@ -967,13 +1499,17 @@ export const validators = {
                 return v;
             }
         }
-        const mutate = shouldMutate(ctx);
         const source = [...v];
-        if (mutate) {
+        let index = 0;
+        if (shouldMutate(ctx)) {
             v.clear();
+            for (const item of source) {
+                v.add(childValidator(item, `${path}[${index}]`, ctx));
+                index++;
+            }
+            return v;
         }
-        const data = mutate ? v : new Set();
-        let index = 0;
+        const data = new Set();
         for (const item of source) {
             data.add(childValidator(item, `${path}[${index}]`, ctx));
             index++;
@@ -1000,12 +1536,17 @@ export const validators = {
                 return v;
             }
         }
-        const mutate = shouldMutate(ctx);
         const source = [...v.entries()];
-        if (mutate) {
+        if (shouldMutate(ctx)) {
             v.clear();
+            for (const [key, val] of source) {
+                const validatedKey = keyValidator(key, `${path}.key(${JSON.stringify(key)})`, ctx);
+                const validatedVal = valueValidator(val, `${path}[${JSON.stringify(key)}]`, ctx);
+                v.set(validatedKey, validatedVal);
+            }
+            return v;
         }
-        const data = mutate ? v : new Map();
+        const data = new Map();
         for (const [key, val] of source) {
             const validatedKey = keyValidator(key, `${path}.key(${JSON.stringify(key)})`, ctx);
             const validatedVal = valueValidator(val, `${path}[${JSON.stringify(key)}]`, ctx);
@@ -1132,8 +1673,11 @@ export class MetadataStoreClass {
         return schema;
     }
     getOrCompileSchema(schema) {
+        if (typeof schema === 'boolean') {
+            return compileSchema(schema);
+        }
         if (typeof schema !== 'object' || schema === null) {
-            throw new Error('Invalid JSON Schema: must be a non-null object');
+            throw new Error('Invalid JSON Schema: must be a non-null object or boolean');
         }
         let compiled = this.compiledSchemas.get(schema);
         if (!compiled) {
@@ -1145,20 +1689,24 @@ export class MetadataStoreClass {
     is(validator, value, options) {
         const opt = options;
         const mode = typeof opt === 'string' ? opt : (opt?.mode || 'strict');
-        // Type predicates require the value already match T — never coerce.
-        const wrapArrays = typeof opt === 'object' ? opt?.wrapArrays : undefined;
-        const mutate = typeof opt === 'object' ? opt?.mutate === true : false;
-        const ctx = { success: true, errors: [], mode, wrapArrays, mutate, root: value };
-        validator(value, '', ctx);
-        return ctx.success;
+        const from = typeof opt === 'object' ? opt?.from : undefined;
+        const ctx = { success: true, errors: [], mode, from, mutate: true, root: value };
+        const res = validator(value, '', ctx);
+        if (!ctx.success) {
+            return false;
+        }
+        if (res === value) {
+            return true;
+        }
+        // Fallback when a branch returned a side tree (e.g. union) that still needs copying.
+        return commitContainer(value, res);
     }
     assert(validator, value, options) {
         const opt = options;
         const mode = typeof opt === 'string' ? opt : (opt?.mode || 'strict');
         const from = typeof opt === 'object' ? opt?.from : undefined;
-        const wrapArrays = typeof opt === 'object' ? opt?.wrapArrays : undefined;
         const mutate = typeof opt === 'object' ? opt?.mutate === true : false;
-        const ctx = { success: true, errors: [], mode, from, wrapArrays, mutate, root: value };
+        const ctx = { success: true, errors: [], mode, from, mutate, root: value };
         const res = validator(value, '', ctx);
         if (!ctx.success) {
             if (typeof opt === 'object' && opt?.errorFactory) {
@@ -1166,40 +1714,63 @@ export class MetadataStoreClass {
             }
             throw new Error('Validation Error: ' + ctx.errors.map(e => e.path ? `${e.path}: ${e.error}` : e.error).join(', '));
         }
+        if (mutate) {
+            if (res === value || commitContainer(value, res)) {
+                return value;
+            }
+            return res;
+        }
         return res;
     }
     assertGuard(validator, value, options) {
         const opt = options;
         const mode = typeof opt === 'string' ? opt : (opt?.mode || 'strict');
-        // Assertion predicates require the value already match T — never coerce.
-        const wrapArrays = typeof opt === 'object' ? opt?.wrapArrays : undefined;
-        const mutate = typeof opt === 'object' ? opt?.mutate === true : false;
-        const ctx = { success: true, errors: [], mode, wrapArrays, mutate, root: value };
-        validator(value, '', ctx);
-        if (!ctx.success) {
-            if (typeof opt === 'object' && opt?.errorFactory) {
-                throw opt.errorFactory(ctx.errors);
+        const from = typeof opt === 'object' ? opt?.from : undefined;
+        const ctx = { success: true, errors: [], mode, from, mutate: true, root: value };
+        const res = validator(value, '', ctx);
+        if (ctx.success && (res === value || commitContainer(value, res))) {
+            return;
+        }
+        // Root was replaced (e.g. primitive coerce) — binding unchanged; report a normal type failure.
+        if (ctx.success && res !== value) {
+            ctx.success = true;
+            ctx.errors.length = 0;
+            ctx.from = undefined;
+            validator(value, '', ctx);
+            if (ctx.success) {
+                report(ctx, '', 'RootNotRewritable', value);
             }
-            throw new Error('Validation Error: ' + ctx.errors.map(e => e.path ? `${e.path}: ${e.error}` : e.error).join(', '));
         }
+        if (typeof opt === 'object' && opt?.errorFactory) {
+            throw opt.errorFactory(ctx.errors);
+        }
+        throw new Error('Validation Error: ' + ctx.errors.map(e => e.path ? `${e.path}: ${e.error}` : e.error).join(', '));
     }
     validate(validator, value, options) {
         const opt = options;
         const mode = typeof opt === 'string' ? opt : (opt?.mode || 'strict');
         const from = typeof opt === 'object' ? opt?.from : undefined;
-        const wrapArrays = typeof opt === 'object' ? opt?.wrapArrays : undefined;
         const mutate = typeof opt === 'object' ? opt?.mutate === true : false;
-        const ctx = { success: true, errors: [], mode, from, wrapArrays, mutate, root: value };
+        const ctx = { success: true, errors: [], mode, from, mutate, root: value };
         const res = validator(value, '', ctx);
-        return { success: ctx.success, errors: ctx.errors, data: res };
+        if (!ctx.success) {
+            return { success: false, errors: ctx.errors };
+        }
+        if (mutate) {
+            if (res === value || commitContainer(value, res)) {
+                return { success: true, errors: [], data: value };
+            }
+            return { success: true, errors: [], data: res };
+        }
+        return { success: true, errors: [], data: res };
     }
 }
 export function groupErrorsByPath(errors) {
-    const grouped = {};
+    const grouped = Object.create(null);
     const visit = (list) => {
         for (const err of list) {
-            if (!grouped[err.path]) {
-                grouped[err.path] = { value: err.value, errors: [] };
+            if (!Object.hasOwn(grouped, err.path)) {
+                setOwnProperty(grouped, err.path, { value: err.value, errors: [] });
             }
             if (!grouped[err.path].errors.includes(err.error)) {
                 grouped[err.path].errors.push(err.error);
@@ -1213,13 +1784,53 @@ export function groupErrorsByPath(errors) {
     return grouped;
 }
 export const MetadataStore = new MetadataStoreClass();
+const UNSUPPORTED_SCHEMA_KEYWORDS = [
+    'enum',
+    'oneOf',
+    'not',
+    'if',
+    'then',
+    'else',
+    'patternProperties',
+    'propertyNames',
+    'dependencies',
+    'dependentRequired',
+    'dependentSchemas',
+    'contains',
+    'minContains',
+    'maxContains',
+    'prefixItems',
+    'unevaluatedProperties',
+    'unevaluatedItems'
+];
 export function compileSchema(schema) {
     const rootDefs = schema.$defs || schema.definitions || {};
     const compiledDefs = new Map();
     function build(subSchema) {
-        if (!subSchema || typeof subSchema !== 'object') {
+        if (subSchema === true || subSchema === undefined) {
             return (v) => v;
         }
+        if (subSchema === false) {
+            return (v, path, ctx) => {
+                report(ctx, path, 'Schema<false>', v);
+                return v;
+            };
+        }
+        if (!subSchema || typeof subSchema !== 'object') {
+            throw new Error('Invalid JSON Schema: subschemas must be objects or booleans');
+        }
+        for (const keyword of UNSUPPORTED_SCHEMA_KEYWORDS) {
+            if (keyword in subSchema) {
+                throw new Error(`Unsupported JSON Schema keyword: ${keyword}`);
+            }
+        }
+        if (Array.isArray(subSchema.type)) {
+            throw new Error('Unsupported JSON Schema keyword: type arrays');
+        }
+        if (typeof subSchema.type === 'string' &&
+            !['string', 'number', 'integer', 'boolean', 'null', 'array', 'object'].includes(subSchema.type)) {
+            throw new Error(`Unsupported JSON Schema type: ${subSchema.type}`);
+        }
         if (subSchema.$ref) {
             const refPath = subSchema.$ref;
             if (compiledDefs.has(refPath)) {
@@ -1281,31 +1892,90 @@ export function compileSchema(schema) {
                 return v;
             };
         }
+        if ('x-typescript-type' in subSchema) {
+            throw new Error(`Unsupported x-typescript-type: ${subSchema['x-typescript-type']}`);
+        }
         if (subSchema.allOf) {
             const checks = subSchema.allOf.map((s) => build(s));
-            return (v, path, ctx) => {
-                const prevMode = ctx.mode;
-                if (ctx.mode !== 'strip') {
-                    ctx.mode = 'relaxed';
+            const mergeKeys = subSchema.allOf.map((s) => {
+                if (s?.type !== 'object' ||
+                    ('additionalProperties' in s && s.additionalProperties !== false)) {
+                    return undefined;
                 }
-                let data = validators.objectShell(v, ctx);
-                for (const check of checks) {
-                    const val = check(v, path, ctx);
+                return new Set(Object.keys(s.properties || {}));
+            });
+            const allObjectSchemas = subSchema.allOf.length > 0 &&
+                subSchema.allOf.every((s) => s?.type === 'object');
+            const allowsAdditional = !allObjectSchemas ||
+                subSchema.allOf.some((s) => 'additionalProperties' in s && s.additionalProperties !== false);
+            const combinedKeys = allowsAdditional
+                ? undefined
+                : new Set(subSchema.allOf.flatMap((s) => Object.keys(s.properties || {})));
+            return (v, path, ctx) => {
+                const errors = [];
+                let data = undefined;
+                const subCtx = {
+                    success: true,
+                    errors: [],
+                    mode: 'relaxed',
+                    from: ctx.from,
+                    mutate: false,
+                    root: ctx.root
+                };
+                for (let i = 0; i < checks.length; i++) {
+                    const check = checks[i];
+                    subCtx.success = true;
+                    subCtx.errors.length = 0;
+                    subCtx.from = ctx.from;
+                    subCtx.root = ctx.root;
+                    const val = check(v, path, subCtx);
+                    errors.push(...subCtx.errors);
+                    if (data === undefined) {
+                        data = isPlainObject(val) ? {} : val;
+                    }
                     if (isPlainObject(val) && isPlainObject(data)) {
-                        Object.assign(data, val);
+                        const keys = mergeKeys[i] || new Set(Object.keys(val));
+                        for (const key of keys) {
+                            if (Object.hasOwn(val, key)) {
+                                setOwnProperty(data, key, val[key]);
+                            }
+                        }
                     }
-                    else {
+                    else if (data !== val) {
                         data = val;
                     }
                 }
-                ctx.mode = prevMode;
-                return data;
+                if (errors.length > 0) {
+                    ctx.success = false;
+                    ctx.errors.push(...errors);
+                    return v;
+                }
+                if (combinedKeys && isPlainObject(v) && isPlainObject(data)) {
+                    for (const key of Object.keys(v)) {
+                        if (combinedKeys.has(key)) {
+                            continue;
+                        }
+                        if (ctx.mode === 'strict') {
+                            report(ctx, path, `PropertyNotAllowed<${key}>`, v[key]);
+                        }
+                        else if (ctx.mode === 'strip') {
+                            delete data[key];
+                        }
+                    }
+                }
+                if (!ctx.success) {
+                    return v;
+                }
+                if (shouldMutate(ctx) && commitContainer(v, data)) {
+                    return v;
+                }
+                return data === undefined ? v : data;
             };
         }
         if (subSchema.type === 'string') {
             const minLength = subSchema.minLength;
             const maxLength = subSchema.maxLength;
-            const pattern = subSchema.pattern ? new RegExp(subSchema.pattern) : undefined;
+            const pattern = subSchema.pattern ? createSafeRegex(subSchema.pattern) : undefined;
             const patternStr = subSchema.pattern;
             const format = subSchema.format;
             return (v, path, ctx) => {
@@ -1406,7 +2076,7 @@ export function compileSchema(schema) {
                 const check = build(s);
                 return [key, isOptional, check];
             });
-            const knownKeys = Object.keys(subSchema.properties || {});
+            const knownKeys = new Set(Object.keys(subSchema.properties || {}));
             const additional = 'additionalProperties' in subSchema
                 ? subSchema.additionalProperties
                 : false;