bupkis 0.15.0 → 0.17.0

package/src/value-to-schema.ts

@@ -1,4 +1,4 @@
-import { z } from 'zod/v4';
+import { z } from 'zod';
 
 import { SatisfactionError } from './error.js';
 import {
@@ -146,13 +146,6 @@ export const valueToSchema = (
     visited.add(value);
 
     try {
-      // Check for objects with own __proto__ property - these can cause unexpected behavior
-      if (hasOwn(value, '__proto__')) {
-        throw new SatisfactionError(
-          'Objects with an own "__proto__" property are not supported by valueToSchema',
-        );
-      }
-
       // Handle built-in object types
       if (value instanceof Date) {
         // Check if it's a valid date
@@ -396,8 +389,25 @@ export const valueToSchema = (
         const schemaShape: Record<string, z.ZodType<any>> = {};
         const undefinedKeys: string[] = [];
 
+        // Handle __proto__ specially - Zod ignores it in z.object() shapes,
+        // so we validate it separately via superRefine
+        let protoSchema: null | z.ZodType = null;
+        if (hasOwn(value, '__proto__')) {
+          const protoValue = (value as Record<string, unknown>)['__proto__'];
+          protoSchema = valueToSchema(
+            protoValue,
+            { ...options, _currentDepth: _currentDepth + 1 },
+            visited,
+          );
+        }
+
         for (const [key, val] of entries(value)) {
           if (isString(key)) {
+            // Skip __proto__ - handled separately since Zod ignores it in object shapes
+            if (key === '__proto__') {
+              continue;
+            }
+
             // Skip undefined values unless we're in literalPrimitives mode
             // This prevents objects with only undefined values from matching any object
             if (val === undefined && !literalPrimitives) {
@@ -426,22 +436,71 @@ export const valueToSchema = (
           ? z.strictObject(schemaShape)
           : z.looseObject(schemaShape);
 
-        // If we have undefined keys in literalPrimitives mode, add validation to ensure they exist
-        if (undefinedKeys.length > 0 && literalPrimitives) {
+        // When __proto__ is present, we MUST use z.custom() because Zod strips
+        // __proto__ before it reaches superRefine. z.custom() receives the raw input.
+        if (protoSchema) {
+          const capturedProtoSchema = protoSchema;
+          const capturedUndefinedKeys = undefinedKeys;
+          const needsUndefinedValidation =
+            capturedUndefinedKeys.length > 0 && literalPrimitives;
+
+          return z.custom<Record<string, unknown>>(
+            (val) => {
+              if (typeof val !== 'object' || val === null) {
+                return false;
+              }
+
+              // Validate __proto__ BEFORE Zod can strip it
+              if (!hasOwn(val, '__proto__')) {
+                return false;
+              }
+              const actualProto = (val as Record<string, unknown>)['__proto__'];
+              if (!capturedProtoSchema.safeParse(actualProto).success) {
+                return false;
+              }
+
+              // Validate the rest of the object via the base schema
+              if (!baseSchema.safeParse(val).success) {
+                return false;
+              }
+
+              // Validate undefined keys if needed
+              if (needsUndefinedValidation) {
+                for (const key of capturedUndefinedKeys) {
+                  if (!hasOwn(val, key)) {
+                    return false;
+                  }
+                }
+              }
+
+              return true;
+            },
+            {
+              message: 'Expected object to have own "__proto__" property',
+            },
+          );
+        }
+
+        // Apply refinements for undefined keys (no __proto__ case)
+        const needsUndefinedKeyValidation =
+          undefinedKeys.length > 0 && literalPrimitives;
+        if (needsUndefinedKeyValidation) {
           return baseSchema.superRefine((data, ctx) => {
             if (typeof data !== 'object' || data === null) {
               ctx.addIssue({
-                code: z.ZodIssueCode.custom,
+                code: 'custom',
                 message: 'Expected an object',
               });
               return;
             }
 
             const obj = data as Record<string, unknown>;
+
+            // Validate undefined keys exist
             for (const key of undefinedKeys) {
               if (!hasOwn(obj, key)) {
                 ctx.addIssue({
-                  code: z.ZodIssueCode.custom,
+                  code: 'custom',
                   message: `Expected property "${key}" to exist with value undefined`,
                   path: [key],
                 });

package/LICENSE.md

@@ -1,55 +0,0 @@
-# Blue Oak Model License
-
-Version 1.0.0
-
-## Purpose
-
-This license gives everyone as much permission to work with
-this software as possible, while protecting contributors
-from liability.
-
-## Acceptance
-
-In order to receive this license, you must agree to its
-rules. The rules of this license are both obligations
-under that agreement and conditions to your license.
-You must not do anything with this software that triggers
-a rule that you cannot or will not follow.
-
-## Copyright
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe that contributor's
-copyright in it.
-
-## Notices
-
-You must ensure that everyone who gets a copy of
-any part of this software from you, with or without
-changes, also gets the text of this license or a link to
-<https://blueoakcouncil.org/license/1.0.0>.
-
-## Excuse
-
-If anyone notifies you in writing that you have not
-complied with [Notices](#notices), you can keep your
-license by taking all practical steps to comply within 30
-days after the notice. If you do not do so, your license
-ends immediately.
-
-## Patent
-
-Each contributor licenses you to do everything with this
-software that would otherwise infringe any patent claims
-they can license or become able to license.
-
-## Reliability
-
-No contributor can revoke this license.
-
-## No Liability
-
-**_As far as the law allows, this software comes as is,
-without any warranty or condition, and no contributor
-will be liable to anyone for any damages related to this
-software or this license, under any kind of legal claim._**