z-schema 12.2.0 → 12.3.1

package/src/utils/array.ts

@@ -7,9 +7,11 @@ import { areEqual } from './json.js';
  * Falls back to pairwise deep comparison (O(n²)) when the array contains
  * objects or arrays that need structural equality checks.
  */
-export const isUniqueArray = <T>(arr: T[], indexes?: number[], maxDepth?: number): boolean => {
+export const isUniqueArray = (arr: unknown[], indexes?: number[], maxDepth?: number): boolean => {
   const l = arr.length;
-  if (l <= 1) return true;
+  if (l <= 1) {
+    return true;
+  }
 
   // Fast path: if every element is a primitive, use a Set.
   // We distinguish types so that e.g. 1 !== '1' and 0 !== false.
@@ -27,7 +29,7 @@ export const isUniqueArray = <T>(arr: T[], indexes?: number[], maxDepth?: number
     const seen = new Set<string>();
     for (let i = 0; i < l; i++) {
       const v = arr[i];
-      const key = typeof v + ':' + String(v);
+      const key = `${typeof v}:${String(v)}`;
       if (seen.has(key)) {
         // Find the first occurrence for the indexes report.
         if (indexes) {
@@ -47,9 +49,10 @@ export const isUniqueArray = <T>(arr: T[], indexes?: number[], maxDepth?: number
   }
 
   // Slow path: at least one element is an object/array — need deep comparison.
+  const eqOpts = { maxDepth };
   for (let i = 0; i < l; i++) {
     for (let j = i + 1; j < l; j++) {
-      if (areEqual(arr[i], arr[j], { maxDepth })) {
+      if (areEqual(arr[i], arr[j], eqOpts)) {
         if (indexes) {
           indexes.push(i, j);
         }
@@ -60,9 +63,9 @@ export const isUniqueArray = <T>(arr: T[], indexes?: number[], maxDepth?: number
   return true;
 };
 
-export const difference = (bigSet: any[], subSet: any[]) => {
+export const difference = <T>(bigSet: readonly T[], subSet: readonly T[]): T[] => {
   const exclusions = new Set(subSet);
-  const arr = [];
+  const arr: T[] = [];
   let idx = bigSet.length;
   while (idx--) {
     if (!exclusions.has(bigSet[idx])) {

package/src/utils/base64.ts

@@ -20,9 +20,20 @@ export const decodeBase64 = (value: string): string | undefined => {
     }
   }
 
-  if (typeof Buffer !== 'undefined') {
+  // Node fallback (reached only when `atob` is unavailable, i.e. not a browser).
+  // Read `Buffer` off `globalThis` rather than the bare global so it is typed
+  // without an untyped global reference; on Node >=22 `Buffer` is always present
+  // on `globalThis`. (A bundler polyfill injected as a module-scoped variable but
+  // not onto `globalThis` would be missed, but that path is unreachable in browsers
+  // where `atob` above is used instead.)
+  const bufferCtor = (
+    globalThis as {
+      Buffer?: { from(data: string, encoding: string): { toString(encoding: string): string } };
+    }
+  ).Buffer;
+  if (bufferCtor !== undefined) {
     try {
-      return Buffer.from(value, 'base64').toString('utf8');
+      return bufferCtor.from(value, 'base64').toString('utf-8');
     } catch {
       return undefined;
     }

package/src/utils/clone.ts

@@ -5,29 +5,28 @@ export const shallowClone = <T>(src: T): T => {
   if (src == null || typeof src !== 'object') {
     return src;
   }
-  let res: any;
   if (Array.isArray(src)) {
-    res = [];
+    const res: unknown[] = [];
     for (let i = 0; i < src.length; i++) {
       res[i] = src[i];
     }
-  } else {
-    res = {};
-    const keys = Object.keys(src).sort() as Array<keyof T>;
-    for (const key of keys) {
-      copyProp(src, res, key);
-    }
+    return res as T;
+  }
+  const res: Record<string, unknown> = {};
+  const keys = Object.keys(src).sort() as Array<keyof T>;
+  for (let i = 0; i < keys.length; i++) {
+    copyProp(src, res, keys[i]);
   }
-  return res;
+  return res as T;
 };
 
 export const deepClone = <T>(src: T, maxDepth = DEFAULT_MAX_RECURSION_DEPTH): T => {
   let vidx = 0;
-  const visited = new Map();
-  const cloned: any[] = [];
-  const cloneDeepInner = <T>(src: T, _depth: number): T => {
-    if (typeof src !== 'object' || src === null) {
-      return src;
+  const visited = new Map<unknown, number>();
+  const cloned: unknown[] = [];
+  const cloneDeepInner = <U>(node: U, _depth: number): U => {
+    if (typeof node !== 'object' || node === null) {
+      return node;
     }
 
     if (_depth >= maxDepth) {
@@ -37,29 +36,28 @@ export const deepClone = <T>(src: T, maxDepth = DEFAULT_MAX_RECURSION_DEPTH): T
       );
     }
 
-    let res: any;
-    const cidx = visited.get(src);
+    const cidx = visited.get(node);
 
     if (cidx !== undefined) {
-      return cloned[cidx];
+      return cloned[cidx] as U;
     }
 
-    visited.set(src, vidx++);
-    if (Array.isArray(src)) {
-      res = [];
+    visited.set(node, vidx++);
+    if (Array.isArray(node)) {
+      const res: unknown[] = [];
       cloned.push(res);
-      for (let i = 0; i < src.length; i++) {
-        res[i] = cloneDeepInner(src[i], _depth + 1);
-      }
-    } else {
-      res = {};
-      cloned.push(res);
-      const keys = Object.keys(src).sort() as Array<keyof T>;
-      for (const key of keys) {
-        copyProp(src, res, key, (v: any) => cloneDeepInner(v, _depth + 1));
+      for (let i = 0; i < node.length; i++) {
+        res[i] = cloneDeepInner(node[i], _depth + 1);
       }
+      return res as U;
+    }
+    const res: Record<string, unknown> = {};
+    cloned.push(res);
+    const keys = Object.keys(node).sort() as Array<keyof U>;
+    for (let i = 0; i < keys.length; i++) {
+      copyProp(node, res, keys[i], (v: unknown) => cloneDeepInner(v, _depth + 1));
     }
-    return res;
+    return res as U;
   };
   return cloneDeepInner(src, 0);
 };

package/src/utils/date.ts

@@ -2,15 +2,18 @@ const isLeapYear = (year: number): boolean => year % 4 === 0 && (year % 100 !==
 
 const getDaysInMonth = (year: number, month: number): number => {
   switch (month) {
-    case 2:
+    case 2: {
       return isLeapYear(year) ? 29 : 28;
+    }
     case 4:
     case 6:
     case 9:
-    case 11:
+    case 11: {
       return 30;
-    default:
+    }
+    default: {
       return 31;
+    }
   }
 };
 

package/src/utils/hostname.ts

@@ -1,8 +1,8 @@
 import punycode from 'punycode/punycode.js';
 import isIPModule from 'validator/lib/isIP.js';
 
-const IDN_SEPARATOR_REGEX = /[\u3002\uff0e\uff61]/g;
-const IDN_SEPARATOR_TEST_REGEX = /[\u3002\uff0e\uff61]/;
+const IDN_SEPARATOR_REGEX = /[\u3002\uFF0E\uFF61]/g;
+const IDN_SEPARATOR_TEST_REGEX = /[\u3002\uFF0E\uFF61]/;
 
 const splitHostnameLabels = (hostname: string): string[] | null => {
   if (hostname.length === 0 || hostname.length > 255) {
@@ -12,8 +12,11 @@ const splitHostnameLabels = (hostname: string): string[] | null => {
     return null;
   }
   const labels = hostname.split('.');
-  if (labels.some((label) => label.length === 0 || label.length > 63)) {
-    return null;
+  for (let i = 0; i < labels.length; i++) {
+    const len = labels[i].length;
+    if (len === 0 || len > 63) {
+      return null;
+    }
   }
   return labels;
 };
@@ -33,7 +36,7 @@ const toUnicodeLabel = (label: string): string | null => {
   }
   try {
     return punycode.toUnicode(label.toLowerCase());
-  } catch (_e) {
+  } catch {
     return null;
   }
 };
@@ -51,44 +54,39 @@ const isValidIdnUnicodeLabel = (label: string): boolean => {
     return false;
   }
 
-  if (/[\u302e\u302f\u0640\u07fa]/u.test(label)) {
+  if (/[\u302E\u302F\u0640\u07FA]/u.test(label)) {
     return false;
   }
 
   for (let idx = 0; idx < label.length; idx++) {
     const char = label[idx];
 
-    if (char === '\u00b7') {
-      if (idx === 0 || idx === label.length - 1 || label[idx - 1] !== 'l' || label[idx + 1] !== 'l') {
-        return false;
-      }
+    if (
+      char === '\u00B7' &&
+      (idx === 0 || idx === label.length - 1 || label[idx - 1] !== 'l' || label[idx + 1] !== 'l')
+    ) {
+      return false;
     }
 
-    if (char === '\u0375') {
-      if (idx === label.length - 1 || !isGreek(label[idx + 1])) {
-        return false;
-      }
+    if (char === '\u0375' && (idx === label.length - 1 || !isGreek(label[idx + 1]))) {
+      return false;
     }
 
-    if (char === '\u05f3' || char === '\u05f4') {
-      if (idx === 0 || !isHebrew(label[idx - 1])) {
-        return false;
-      }
+    if ((char === '\u05F3' || char === '\u05F4') && (idx === 0 || !isHebrew(label[idx - 1]))) {
+      return false;
     }
 
-    if (char === '\u200d') {
-      if (idx === 0 || label[idx - 1] !== '\u094d') {
-        return false;
-      }
+    if (char === '\u200D' && (idx === 0 || label[idx - 1] !== '\u094D')) {
+      return false;
     }
   }
 
-  if (label.includes('\u30fb') && !hasCjkKanaOrHan(label.replace(/\u30fb/g, ''))) {
+  if (label.includes('\u30FB') && !hasCjkKanaOrHan(label.replaceAll('・', ''))) {
     return false;
   }
 
   const hasArabicIndic = /[\u0660-\u0669]/.test(label);
-  const hasExtendedArabicIndic = /[\u06f0-\u06f9]/.test(label);
+  const hasExtendedArabicIndic = /[\u06F0-\u06F9]/.test(label);
   if (hasArabicIndic && hasExtendedArabicIndic) {
     return false;
   }
@@ -129,7 +127,7 @@ const isValidIdnUnicodeLabel = (label: string): boolean => {
 */
 export const isValidHostname = (hostname: string): boolean => {
   // eslint-disable-next-line no-control-regex
-  if (IDN_SEPARATOR_TEST_REGEX.test(hostname) || /[^\x00-\x7F]/.test(hostname)) {
+  if (IDN_SEPARATOR_TEST_REGEX.test(hostname) || /[^\u0000-\u007F]/.test(hostname)) {
     return false;
   }
 
@@ -142,7 +140,8 @@ export const isValidHostname = (hostname: string): boolean => {
     return false;
   }
 
-  for (const label of labels) {
+  for (let i = 0; i < labels.length; i++) {
+    const label = labels[i];
     if (!isAsciiHostnameLabel(label)) {
       return false;
     }
@@ -166,7 +165,8 @@ export const isValidIdnHostname = (hostname: string): boolean => {
     return false;
   }
 
-  for (const label of labels) {
+  for (let i = 0; i < labels.length; i++) {
+    const label = labels[i];
     const unicodeLabel = toUnicodeLabel(label);
     if (unicodeLabel === null || !isValidIdnUnicodeLabel(unicodeLabel)) {
       return false;

package/src/utils/json.ts

@@ -6,6 +6,8 @@ interface AreEqualOptions {
   maxDepth?: number;
 }
 
+export const sortedKeys = (obj: Record<string, unknown>): string[] => Object.keys(obj).sort();
+
 export const areEqual = (json1: unknown, json2: unknown, options?: AreEqualOptions, _depth = 0): boolean => {
   const caseInsensitiveComparison = options?.caseInsensitiveComparison || false;
   const maxDepth = options?.maxDepth ?? DEFAULT_MAX_RECURSION_DEPTH;
@@ -21,7 +23,7 @@ export const areEqual = (json1: unknown, json2: unknown, options?: AreEqualOptio
     return true;
   }
   if (
-    caseInsensitiveComparison === true &&
+    caseInsensitiveComparison &&
     typeof json1 === 'string' &&
     typeof json2 === 'string' &&
     json1.toUpperCase() === json2.toUpperCase()
@@ -75,16 +77,21 @@ export const areEqual = (json1: unknown, json2: unknown, options?: AreEqualOptio
   return false;
 };
 
-export const decodeJSONPointer = (str: string) => {
-  // http://tools.ietf.org/html/draft-ietf-appsawg-json-pointer-07#section-3
-  return decodeURIComponent(str).replace(/~[0-1]/g, (x) => (x === '~1' ? '/' : '~'));
-};
+export const decodeJSONPointer = (str: string) =>
+  decodeURIComponent(str).replaceAll(/~[0-1]/g, (x) => (x === '~1' ? '/' : '~'));
 
-export const sortedKeys = (obj: Record<string, unknown>): string[] => Object.keys(obj).sort();
-
-export const get = (obj: any, path: string | Array<string | number>): any => {
+export const get = (obj: unknown, path: string | Array<string | number>): unknown => {
   if (typeof path === 'string') {
     path = path.split('.');
   }
-  return path.reduce((acc, key) => (acc && acc[key] !== undefined ? acc[key] : undefined), obj);
+  let acc: unknown = obj;
+  for (let i = 0; i < path.length; i++) {
+    const key = path[i];
+    if (acc && (acc as Record<string | number, unknown>)[key] !== undefined) {
+      acc = (acc as Record<string | number, unknown>)[key];
+    } else {
+      return undefined;
+    }
+  }
+  return acc;
 };

package/src/utils/properties.ts

@@ -1,7 +1,7 @@
-export function copyProp(from: object, to: object, key: string | number | symbol, fn?: <T>(obj: T) => T) {
+export function copyProp(from: object, to: object, key: string | number | symbol, fn?: (value: unknown) => unknown) {
   if (Object.hasOwn(from, key)) {
     Object.defineProperty(to, key, {
-      value: fn ? fn((from as any)[key]) : (from as any)[key],
+      value: fn ? fn((from as Record<PropertyKey, unknown>)[key]) : (from as Record<PropertyKey, unknown>)[key],
       enumerable: true,
       writable: true,
       configurable: true,

package/src/utils/schema-regex.ts

@@ -40,12 +40,12 @@ export function compileSchemaRegex(
     try {
       const re = new RegExp(pattern, 'u');
       return { ok: true, value: re };
-    } catch (e: any) {
+    } catch (error: unknown) {
       return {
         ok: false,
         error: {
           pattern,
-          message: e && e.message ? e.message : 'Invalid regular expression',
+          message: error instanceof Error ? error.message : 'Invalid regular expression',
         },
       };
     }
@@ -53,12 +53,12 @@ export function compileSchemaRegex(
     try {
       const re = new RegExp(pattern);
       return { ok: true, value: re };
-    } catch (e: any) {
+    } catch (error: unknown) {
       return {
         ok: false,
         error: {
           pattern,
-          message: e && e.message ? e.message : 'Invalid regular expression',
+          message: error instanceof Error ? error.message : 'Invalid regular expression',
         },
       };
     }

package/src/utils/time.ts

@@ -32,9 +32,9 @@ export const parseRfc3339Time = (time: string): ParsedRfc3339Time | null => {
     return null;
   }
 
-  const hour = parseInt(matches[1], 10);
-  const minute = parseInt(matches[2], 10);
-  const second = parseInt(matches[3], 10);
+  const hour = Number.parseInt(matches[1], 10);
+  const minute = Number.parseInt(matches[2], 10);
+  const second = Number.parseInt(matches[3], 10);
   if (hour > 23 || minute > 59 || second > 60) {
     return null;
   }
@@ -48,8 +48,8 @@ export const parseRfc3339Time = (time: string): ParsedRfc3339Time | null => {
     }
 
     const offsetSign = offsetMatches[1] as '+' | '-';
-    const offsetHour = parseInt(offsetMatches[2], 10);
-    const offsetMinute = parseInt(offsetMatches[3], 10);
+    const offsetHour = Number.parseInt(offsetMatches[2], 10);
+    const offsetMinute = Number.parseInt(offsetMatches[3], 10);
     if (offsetHour > 23 || offsetMinute > 59) {
       return null;
     }

package/src/utils/unicode.ts

@@ -1,12 +1,19 @@
 /**
  * Returns the number of Unicode code points in the string.
- * Uses the built-in string iterator which correctly handles surrogate pairs.
+ * Uses a surrogate-aware charCodeAt scan (equivalent to the string iterator)
+ * that counts a surrogate pair as one code point and lone surrogates as one each.
  */
 export function unicodeLength(str: string): number {
-  let count = 0;
-  for (const _cp of str) {
-    void _cp;
-    count++;
+  let count = str.length;
+  for (let i = 0; i < str.length - 1; i++) {
+    const hi = str.charCodeAt(i);
+    if (hi >= 0xd8_00 && hi <= 0xdb_ff) {
+      const lo = str.charCodeAt(i + 1);
+      if (lo >= 0xdc_00 && lo <= 0xdf_ff) {
+        count--;
+        i++;
+      }
+    }
   }
   return count;
 }

package/src/utils/what-is.ts

@@ -26,11 +26,7 @@ export const whatIs = (what: unknown): WHAT_IS => {
 
   if (typeof what === 'number') {
     if (Number.isFinite(what)) {
-      if (what % 1 === 0) {
-        return 'integer';
-      } else {
-        return 'number';
-      }
+      return what % 1 === 0 ? 'integer' : 'number';
     }
     if (Number.isNaN(what)) {
       return 'not-a-number';

package/src/validation/array.ts

@@ -9,9 +9,9 @@ import { cacheValidationResult, deferOrRunSync, shouldSkipValidate } from './sha
 // additionalItems
 // ---------------------------------------------------------------------------
 
-export function additionalItemsValidator(this: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
+export function additionalItemsValidator(ctx: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
   // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.3.1.2
-  if (shouldSkipValidate(this.validateOptions, ['ARRAY_ADDITIONAL_ITEMS'])) {
+  if (shouldSkipValidate(ctx.validateOptions, ['ARRAY_ADDITIONAL_ITEMS'])) {
     return;
   }
   if (!Array.isArray(json)) {
@@ -19,10 +19,8 @@ export function additionalItemsValidator(this: ZSchemaBase, report: Report, sche
   }
   // if the value of "additionalItems" is boolean value false and the value of "items" is an array,
   // the json is valid if its size is less than, or equal to, the size of "items".
-  if (schema.additionalItems === false && Array.isArray(schema.items)) {
-    if (json.length > schema.items.length) {
-      report.addError('ARRAY_ADDITIONAL_ITEMS', undefined, undefined, schema, 'additionalItems');
-    }
+  if (schema.additionalItems === false && Array.isArray(schema.items) && json.length > schema.items.length) {
+    report.addError('ARRAY_ADDITIONAL_ITEMS', undefined, undefined, schema, 'additionalItems');
   }
 }
 
@@ -47,9 +45,9 @@ export function prefixItemsValidator() {
 // maxItems
 // ---------------------------------------------------------------------------
 
-export function maxItemsValidator(this: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
+export function maxItemsValidator(ctx: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
   // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.3.2.2
-  if (shouldSkipValidate(this.validateOptions, ['ARRAY_LENGTH_LONG'])) {
+  if (shouldSkipValidate(ctx.validateOptions, ['ARRAY_LENGTH_LONG'])) {
     return;
   }
   if (!Array.isArray(json)) {
@@ -64,9 +62,9 @@ export function maxItemsValidator(this: ZSchemaBase, report: Report, schema: Jso
 // minItems
 // ---------------------------------------------------------------------------
 
-export function minItemsValidator(this: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
+export function minItemsValidator(ctx: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
   // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.3.3.2
-  if (shouldSkipValidate(this.validateOptions, ['ARRAY_LENGTH_SHORT'])) {
+  if (shouldSkipValidate(ctx.validateOptions, ['ARRAY_LENGTH_SHORT'])) {
     return;
   }
   if (!Array.isArray(json)) {
@@ -81,9 +79,9 @@ export function minItemsValidator(this: ZSchemaBase, report: Report, schema: Jso
 // uniqueItems
 // ---------------------------------------------------------------------------
 
-export function uniqueItemsValidator(this: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
+export function uniqueItemsValidator(ctx: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
   // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.3.4.2
-  if (shouldSkipValidate(this.validateOptions, ['ARRAY_UNIQUE'])) {
+  if (shouldSkipValidate(ctx.validateOptions, ['ARRAY_UNIQUE'])) {
     return;
   }
   if (!Array.isArray(json)) {
@@ -91,7 +89,7 @@ export function uniqueItemsValidator(this: ZSchemaBase, report: Report, schema:
   }
   if (schema.uniqueItems === true) {
     const matches: any[] = [];
-    if (isUniqueArray(json, matches, this.options.maxRecursionDepth) === false) {
+    if (!isUniqueArray(json, matches, ctx.options.maxRecursionDepth)) {
       report.addError('ARRAY_UNIQUE', matches, undefined, schema, 'uniqueItems');
     }
   }
@@ -101,8 +99,8 @@ export function uniqueItemsValidator(this: ZSchemaBase, report: Report, schema:
 // contains
 // ---------------------------------------------------------------------------
 
-export function containsValidator(this: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
-  if (shouldSkipValidate(this.validateOptions, ['CONTAINS'])) {
+export function containsValidator(ctx: ZSchemaBase, report: Report, schema: JsonSchemaInternal, json: unknown) {
+  if (shouldSkipValidate(ctx.validateOptions, ['CONTAINS'])) {
     return;
   }
 
@@ -120,19 +118,19 @@ export function containsValidator(this: ZSchemaBase, report: Report, schema: Jso
   for (let idx = 0; idx < json.length; idx++) {
     const subReport = new Report_(report);
     subReports.push(subReport);
-    this._jsonValidate(subReport, containsSchema as any, json[idx]);
+    ctx._jsonValidate(subReport, containsSchema, json[idx]);
     cacheValidationResult(report, containsSchema, json[idx], subReport.errors.length === 0);
   }
 
   const addContainsErrorIfNeeded = () => {
     let matchingItems = 0;
-    for (const subReport of subReports) {
-      if (subReport.errors.length === 0) {
+    for (let i = 0; i < subReports.length; i++) {
+      if (subReports[i].errors.length === 0) {
         matchingItems += 1;
       }
     }
 
-    const supportsContainsBounds = this.options.version === 'draft2019-09' || this.options.version === 'draft2020-12';
+    const supportsContainsBounds = ctx.options.version === 'draft2019-09' || ctx.options.version === 'draft2020-12';
     const minContains: number =
       supportsContainsBounds && typeof schema.minContains === 'number' ? (schema.minContains ?? 1) : 1;
     const maxContains =
@@ -142,7 +140,7 @@ export function containsValidator(this: ZSchemaBase, report: Report, schema: Jso
     const notTooManyMatches = maxContains === undefined || matchingItems <= maxContains;
 
     if (!hasEnoughMatches || !notTooManyMatches) {
-      report.addError('CONTAINS', undefined, subReports, schema, undefined);
+      report.addError('CONTAINS', undefined, subReports, schema);
     }
   };
 
@@ -153,5 +151,9 @@ export function containsValidator(this: ZSchemaBase, report: Report, schema: Jso
 // maxContains / minContains  (no-op — handled inside contains)
 // ---------------------------------------------------------------------------
 
-export function maxContainsValidator() {}
-export function minContainsValidator() {}
+export function maxContainsValidator() {
+  // no-op: maxContains is evaluated inside the `contains` validator
+}
+export function minContainsValidator() {
+  // no-op: minContains is evaluated inside the `contains` validator
+}