z-schema 12.2.0 → 12.4.0

package/src/utils/array.ts

@@ -7,9 +7,11 @@ import { areEqual } from './json.js';
  * Falls back to pairwise deep comparison (O(n²)) when the array contains
  * objects or arrays that need structural equality checks.
  */
-export const isUniqueArray = <T>(arr: T[], indexes?: number[], maxDepth?: number): boolean => {
+export const isUniqueArray = (arr: unknown[], indexes?: number[], maxDepth?: number): boolean => {
   const l = arr.length;
-  if (l <= 1) return true;
+  if (l <= 1) {
+    return true;
+  }
 
   // Fast path: if every element is a primitive, use a Set.
   // We distinguish types so that e.g. 1 !== '1' and 0 !== false.
@@ -27,7 +29,7 @@ export const isUniqueArray = <T>(arr: T[], indexes?: number[], maxDepth?: number
     const seen = new Set<string>();
     for (let i = 0; i < l; i++) {
       const v = arr[i];
-      const key = typeof v + ':' + String(v);
+      const key = `${typeof v}:${String(v)}`;
       if (seen.has(key)) {
         // Find the first occurrence for the indexes report.
         if (indexes) {
@@ -47,9 +49,10 @@ export const isUniqueArray = <T>(arr: T[], indexes?: number[], maxDepth?: number
   }
 
   // Slow path: at least one element is an object/array — need deep comparison.
+  const eqOpts = { maxDepth };
   for (let i = 0; i < l; i++) {
     for (let j = i + 1; j < l; j++) {
-      if (areEqual(arr[i], arr[j], { maxDepth })) {
+      if (areEqual(arr[i], arr[j], eqOpts)) {
         if (indexes) {
           indexes.push(i, j);
         }
@@ -60,9 +63,9 @@ export const isUniqueArray = <T>(arr: T[], indexes?: number[], maxDepth?: number
   return true;
 };
 
-export const difference = (bigSet: any[], subSet: any[]) => {
+export const difference = <T>(bigSet: readonly T[], subSet: readonly T[]): T[] => {
   const exclusions = new Set(subSet);
-  const arr = [];
+  const arr: T[] = [];
   let idx = bigSet.length;
   while (idx--) {
     if (!exclusions.has(bigSet[idx])) {

package/src/utils/base64.ts

@@ -20,9 +20,20 @@ export const decodeBase64 = (value: string): string | undefined => {
     }
   }
 
-  if (typeof Buffer !== 'undefined') {
+  // Node fallback (reached only when `atob` is unavailable, i.e. not a browser).
+  // Read `Buffer` off `globalThis` rather than the bare global so it is typed
+  // without an untyped global reference; on Node >=22 `Buffer` is always present
+  // on `globalThis`. (A bundler polyfill injected as a module-scoped variable but
+  // not onto `globalThis` would be missed, but that path is unreachable in browsers
+  // where `atob` above is used instead.)
+  const bufferCtor = (
+    globalThis as {
+      Buffer?: { from: (data: string, encoding: string) => { toString: (encoding: string) => string } };
+    }
+  ).Buffer;
+  if (bufferCtor !== undefined) {
     try {
-      return Buffer.from(value, 'base64').toString('utf8');
+      return bufferCtor.from(value, 'base64').toString('utf-8');
     } catch {
       return undefined;
     }

package/src/utils/clone.ts

@@ -5,29 +5,28 @@ export const shallowClone = <T>(src: T): T => {
   if (src == null || typeof src !== 'object') {
     return src;
   }
-  let res: any;
   if (Array.isArray(src)) {
-    res = [];
+    const res: unknown[] = [];
     for (let i = 0; i < src.length; i++) {
       res[i] = src[i];
     }
-  } else {
-    res = {};
-    const keys = Object.keys(src).sort() as Array<keyof T>;
-    for (const key of keys) {
-      copyProp(src, res, key);
-    }
+    return res as T;
+  }
+  const res: Record<string, unknown> = {};
+  const keys = Object.keys(src).sort() as Array<keyof T>;
+  for (let i = 0; i < keys.length; i++) {
+    copyProp(src, res, keys[i]);
   }
-  return res;
+  return res as T;
 };
 
 export const deepClone = <T>(src: T, maxDepth = DEFAULT_MAX_RECURSION_DEPTH): T => {
   let vidx = 0;
-  const visited = new Map();
-  const cloned: any[] = [];
-  const cloneDeepInner = <T>(src: T, _depth: number): T => {
-    if (typeof src !== 'object' || src === null) {
-      return src;
+  const visited = new Map<unknown, number>();
+  const cloned: unknown[] = [];
+  const cloneDeepInner = <U>(node: U, _depth: number): U => {
+    if (typeof node !== 'object' || node === null) {
+      return node;
     }
 
     if (_depth >= maxDepth) {
@@ -37,29 +36,28 @@ export const deepClone = <T>(src: T, maxDepth = DEFAULT_MAX_RECURSION_DEPTH): T
       );
     }
 
-    let res: any;
-    const cidx = visited.get(src);
+    const cidx = visited.get(node);
 
     if (cidx !== undefined) {
-      return cloned[cidx];
+      return cloned[cidx] as U;
     }
 
-    visited.set(src, vidx++);
-    if (Array.isArray(src)) {
-      res = [];
+    visited.set(node, vidx++);
+    if (Array.isArray(node)) {
+      const res: unknown[] = [];
       cloned.push(res);
-      for (let i = 0; i < src.length; i++) {
-        res[i] = cloneDeepInner(src[i], _depth + 1);
-      }
-    } else {
-      res = {};
-      cloned.push(res);
-      const keys = Object.keys(src).sort() as Array<keyof T>;
-      for (const key of keys) {
-        copyProp(src, res, key, (v: any) => cloneDeepInner(v, _depth + 1));
+      for (let i = 0; i < node.length; i++) {
+        res[i] = cloneDeepInner(node[i], _depth + 1);
       }
+      return res as U;
+    }
+    const res: Record<string, unknown> = {};
+    cloned.push(res);
+    const keys = Object.keys(node).sort() as Array<keyof U>;
+    for (let i = 0; i < keys.length; i++) {
+      copyProp(node, res, keys[i], (v: unknown) => cloneDeepInner(v, _depth + 1));
     }
-    return res;
+    return res as U;
   };
   return cloneDeepInner(src, 0);
 };

package/src/utils/date.ts

@@ -2,15 +2,18 @@ const isLeapYear = (year: number): boolean => year % 4 === 0 && (year % 100 !==
 
 const getDaysInMonth = (year: number, month: number): number => {
   switch (month) {
-    case 2:
+    case 2: {
       return isLeapYear(year) ? 29 : 28;
+    }
     case 4:
     case 6:
     case 9:
-    case 11:
+    case 11: {
       return 30;
-    default:
+    }
+    default: {
       return 31;
+    }
   }
 };
 

package/src/utils/hostname.ts

@@ -1,8 +1,188 @@
 import punycode from 'punycode/punycode.js';
 import isIPModule from 'validator/lib/isIP.js';
 
-const IDN_SEPARATOR_REGEX = /[\u3002\uff0e\uff61]/g;
-const IDN_SEPARATOR_TEST_REGEX = /[\u3002\uff0e\uff61]/;
+const IDN_SEPARATOR_REGEX = /[\u3002\uFF0E\uFF61]/g;
+const IDN_SEPARATOR_TEST_REGEX = /[\u3002\uFF0E\uFF61]/;
+
+// IDNA2008 (RFC 5890-5893) support below is a hand-rolled approximation built on
+// General_Category / Script Unicode-property regexes (JS regex has no
+// \p{Bidi_Class} or \p{Joining_Type}). It covers the JSON-Schema-Test-Suite
+// corpus, not the full IDNA table. Known limitations: joining-context (CONTEXTJ)
+// only models Arabic script; the ZWJ/ZWNJ Virama context recognizes only the
+// Devanagari virama U+094D (not other scripts' viramas); Bidi class detection
+// covers L/R/AL/AN/EN/NSM and treats everything else as ON; and U-labels are not
+// required to be in Unicode NFC form. All regexes/Sets are hoisted to module scope
+// so they are compiled once (format validation runs on hot paths).
+
+// Matches an A-label (ACE) prefix; hoisted so it is compiled once, not per label.
+const XN_LABEL_REGEX = /^xn--/i;
+
+// RFC 5892 section 2.6 lists a handful of code points that are PVALID (or governed
+// by a contextual rule) despite being Punctuation/Symbol. A blanket "reject
+// P/S/Z/C" DISALLOWED heuristic must whitelist exactly these so valid labels are
+// not rejected. Letters (e.g. U+00DF sharp s, U+03C2 final sigma) and Numbers
+// (e.g. U+3007) are unaffected by the heuristic and need no entry here.
+const DISALLOWED_CATEGORY_REGEX = /[\p{P}\p{S}\p{Z}\p{C}]/u;
+const DISALLOWED_CATEGORY_WHITELIST: ReadonlySet<string> = new Set([
+  '-', // HYPHEN-MINUS (medial; leading/trailing rejected separately)
+  '\u00B7', // MIDDLE DOT (CONTEXTO)
+  '\u0375', // GREEK LOWER NUMERAL SIGN / KERAIA (CONTEXTO)
+  '\u05F3', // HEBREW PUNCTUATION GERESH (CONTEXTO)
+  '\u05F4', // HEBREW PUNCTUATION GERSHAYIM (CONTEXTO)
+  '\u30FB', // KATAKANA MIDDLE DOT (CONTEXTO)
+  '\u06FD', // ARABIC SIGN SINDHI AMPERSAND (RFC 5892 section 2.6 PVALID)
+  '\u06FE', // ARABIC SIGN SINDHI POSTPOSITION MEN (RFC 5892 section 2.6 PVALID)
+  '\u0F0B', // TIBETAN MARK INTERSYLLABIC TSHEG (RFC 5892 section 2.6 PVALID)
+  '\u200C', // ZERO WIDTH NON-JOINER (CONTEXTJ, checked separately)
+  '\u200D', // ZERO WIDTH JOINER (CONTEXTJ, checked separately)
+]);
+
+const isDisallowedCodePoint = (char: string): boolean =>
+  DISALLOWED_CATEGORY_REGEX.test(char) && !DISALLOWED_CATEGORY_WHITELIST.has(char);
+
+// CONTEXTJ (RFC 5892 Appendix A.1) support for ZERO WIDTH NON-JOINER.
+const TRANSPARENT_MARK_REGEX = /\p{Mn}/u;
+const ARABIC_SCRIPT_REGEX = /\p{Script=Arabic}/u;
+const ARABIC_INDIC_DIGITS_REGEX = /[\u0660-\u0669\u06F0-\u06F9]/;
+
+// Approximates Joining_Type {L, D, R} as "an Arabic-script letter" (excluding the
+// Arabic-Indic digit ranges, which are not letters).
+const isArabicJoiningLetter = (char: string | undefined): boolean =>
+  char !== undefined && ARABIC_SCRIPT_REGEX.test(char) && !ARABIC_INDIC_DIGITS_REGEX.test(char);
+
+// ZWNJ at `idx` is valid if it sits between two joining letters, skipping over any
+// Transparent (combining-mark) code points on either side.
+const hasZwnjJoiningContext = (label: string, idx: number): boolean => {
+  let before = idx - 1;
+  while (before >= 0 && TRANSPARENT_MARK_REGEX.test(label[before])) {
+    before--;
+  }
+  let after = idx + 1;
+  while (after < label.length && TRANSPARENT_MARK_REGEX.test(label[after])) {
+    after++;
+  }
+  return isArabicJoiningLetter(label[before]) && isArabicJoiningLetter(label[after]);
+};
+
+// RFC 5893 Bidi rule. Bidi_Class is approximated from Script / General_Category.
+type BidiClass = 'AL' | 'AN' | 'EN' | 'L' | 'NSM' | 'ON' | 'R';
+
+const BIDI_NSM_REGEX = /[\p{Mn}\p{Me}]/u;
+const BIDI_ARABIC_INDIC_DIGIT_REGEX = /[\u0660-\u0669]/; // Bidi_Class AN
+const BIDI_EXTENDED_ARABIC_INDIC_DIGIT_REGEX = /[\u06F0-\u06F9]/; // Bidi_Class EN (NOT AN)
+const BIDI_HEBREW_SCRIPT_REGEX = /\p{Script=Hebrew}/u; // Bidi_Class R
+const BIDI_AL_SCRIPT_REGEX = /[\p{Script=Arabic}\p{Script=Syriac}\p{Script=Thaana}]/u; // Bidi_Class AL
+const BIDI_ASCII_DIGIT_REGEX = /[0-9]/; // Bidi_Class EN
+const BIDI_LETTER_REGEX = /\p{L}/u;
+
+const classifyBidi = (char: string): BidiClass => {
+  if (BIDI_NSM_REGEX.test(char)) {
+    return 'NSM';
+  }
+  if (BIDI_ARABIC_INDIC_DIGIT_REGEX.test(char)) {
+    return 'AN';
+  }
+  if (BIDI_EXTENDED_ARABIC_INDIC_DIGIT_REGEX.test(char)) {
+    return 'EN';
+  }
+  if (BIDI_HEBREW_SCRIPT_REGEX.test(char)) {
+    return 'R';
+  }
+  if (BIDI_AL_SCRIPT_REGEX.test(char)) {
+    return 'AL';
+  }
+  if (BIDI_ASCII_DIGIT_REGEX.test(char)) {
+    return 'EN';
+  }
+  if (BIDI_LETTER_REGEX.test(char)) {
+    return 'L';
+  }
+  return 'ON';
+};
+
+// A domain is "Bidi" (and thus subject to the Bidi rule) if any label contains an
+// R, AL, or AN character. Iterated by code point so surrogate pairs stay intact.
+const isLabelBidiTriggering = (label: string): boolean => {
+  for (const char of label) {
+    const bidiClass = classifyBidi(char);
+    if (bidiClass === 'R' || bidiClass === 'AL' || bidiClass === 'AN') {
+      return true;
+    }
+  }
+  return false;
+};
+
+const isLabelBidiRuleValid = (label: string): boolean => {
+  const classes: BidiClass[] = [];
+  for (const char of label) {
+    classes.push(classifyBidi(char));
+  }
+  if (classes.length === 0) {
+    return false;
+  }
+
+  const first = classes[0];
+  // Rule 1: the first character must be L, R, or AL.
+  if (first !== 'L' && first !== 'R' && first !== 'AL') {
+    return false;
+  }
+
+  // The "last" character check ignores trailing NSM marks.
+  let lastIdx = classes.length - 1;
+  while (lastIdx > 0 && classes[lastIdx] === 'NSM') {
+    lastIdx--;
+  }
+  const last = classes[lastIdx];
+
+  if (first === 'R' || first === 'AL') {
+    // Rule 2: RTL label.
+    let hasEN = false;
+    let hasAN = false;
+    for (let i = 0; i < classes.length; i++) {
+      const c = classes[i];
+      if (c !== 'R' && c !== 'AL' && c !== 'AN' && c !== 'EN' && c !== 'NSM' && c !== 'ON') {
+        return false;
+      }
+      if (c === 'EN') {
+        hasEN = true;
+      } else if (c === 'AN') {
+        hasAN = true;
+      }
+    }
+    if (hasEN && hasAN) {
+      return false;
+    }
+    return last === 'R' || last === 'AL' || last === 'EN' || last === 'AN';
+  }
+
+  // Rule 3: LTR label.
+  for (let i = 0; i < classes.length; i++) {
+    const c = classes[i];
+    if (c !== 'L' && c !== 'EN' && c !== 'NSM' && c !== 'ON') {
+      return false;
+    }
+  }
+  return last === 'L' || last === 'EN';
+};
+
+const isDomainBidiValid = (unicodeLabels: string[]): boolean => {
+  let isBidiDomain = false;
+  for (let i = 0; i < unicodeLabels.length; i++) {
+    if (isLabelBidiTriggering(unicodeLabels[i])) {
+      isBidiDomain = true;
+      break;
+    }
+  }
+  if (!isBidiDomain) {
+    return true;
+  }
+  for (let i = 0; i < unicodeLabels.length; i++) {
+    if (!isLabelBidiRuleValid(unicodeLabels[i])) {
+      return false;
+    }
+  }
+  return true;
+};
 
 const splitHostnameLabels = (hostname: string): string[] | null => {
   if (hostname.length === 0 || hostname.length > 255) {
@@ -12,8 +192,11 @@ const splitHostnameLabels = (hostname: string): string[] | null => {
     return null;
   }
   const labels = hostname.split('.');
-  if (labels.some((label) => label.length === 0 || label.length > 63)) {
-    return null;
+  for (let i = 0; i < labels.length; i++) {
+    const len = labels[i].length;
+    if (len === 0 || len > 63) {
+      return null;
+    }
   }
   return labels;
 };
@@ -28,12 +211,12 @@ const hasCjkKanaOrHan = (input: string): boolean =>
   /[\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Han}]/u.test(input);
 
 const toUnicodeLabel = (label: string): string | null => {
-  if (!/^xn--/i.test(label)) {
+  if (!XN_LABEL_REGEX.test(label)) {
     return label;
   }
   try {
     return punycode.toUnicode(label.toLowerCase());
-  } catch (_e) {
+  } catch {
     return null;
   }
 };
@@ -43,7 +226,7 @@ const isValidIdnUnicodeLabel = (label: string): boolean => {
     return false;
   }
 
-  if (label.length >= 4 && label[2] === '-' && label[3] === '-' && !/^xn--/i.test(label)) {
+  if (label.length >= 4 && label[2] === '-' && label[3] === '-' && !XN_LABEL_REGEX.test(label)) {
     return false;
   }
 
@@ -51,44 +234,54 @@ const isValidIdnUnicodeLabel = (label: string): boolean => {
     return false;
   }
 
-  if (/[\u302e\u302f\u0640\u07fa]/u.test(label)) {
+  if (/[\u302E\u302F\u0640\u07FA]/u.test(label)) {
     return false;
   }
 
   for (let idx = 0; idx < label.length; idx++) {
     const char = label[idx];
 
-    if (char === '\u00b7') {
-      if (idx === 0 || idx === label.length - 1 || label[idx - 1] !== 'l' || label[idx + 1] !== 'l') {
-        return false;
-      }
+    if (
+      char === '\u00B7' &&
+      (idx === 0 || idx === label.length - 1 || label[idx - 1] !== 'l' || label[idx + 1] !== 'l')
+    ) {
+      return false;
     }
 
-    if (char === '\u0375') {
-      if (idx === label.length - 1 || !isGreek(label[idx + 1])) {
-        return false;
-      }
+    if (char === '\u0375' && (idx === label.length - 1 || !isGreek(label[idx + 1]))) {
+      return false;
     }
 
-    if (char === '\u05f3' || char === '\u05f4') {
-      if (idx === 0 || !isHebrew(label[idx - 1])) {
-        return false;
-      }
+    if ((char === '\u05F3' || char === '\u05F4') && (idx === 0 || !isHebrew(label[idx - 1]))) {
+      return false;
     }
 
-    if (char === '\u200d') {
-      if (idx === 0 || label[idx - 1] !== '\u094d') {
-        return false;
-      }
+    if (char === '\u200D' && (idx === 0 || label[idx - 1] !== '\u094D')) {
+      return false;
+    }
+
+    // ZERO WIDTH NON-JOINER (CONTEXTJ, RFC 5892 Appendix A.1): valid only when
+    // preceded by a Virama, or when it sits in a joining context.
+    if (char === '\u200C' && (idx === 0 || (label[idx - 1] !== '\u094D' && !hasZwnjJoiningContext(label, idx)))) {
+      return false;
+    }
+  }
+
+  // Reject IDNA2008-DISALLOWED code points (Punctuation/Symbol/Separator/Other,
+  // minus the RFC 5892 section 2.6 / contextual exceptions). Iterated by code point so a
+  // surrogate pair is not mistaken for a lone \p{Cs} half.
+  for (const char of label) {
+    if (isDisallowedCodePoint(char)) {
+      return false;
     }
   }
 
-  if (label.includes('\u30fb') && !hasCjkKanaOrHan(label.replace(/\u30fb/g, ''))) {
+  if (label.includes('\u30FB') && !hasCjkKanaOrHan(label.replaceAll('・', ''))) {
     return false;
   }
 
   const hasArabicIndic = /[\u0660-\u0669]/.test(label);
-  const hasExtendedArabicIndic = /[\u06f0-\u06f9]/.test(label);
+  const hasExtendedArabicIndic = /[\u06F0-\u06F9]/.test(label);
   if (hasArabicIndic && hasExtendedArabicIndic) {
     return false;
   }
@@ -129,7 +322,7 @@ const isValidIdnUnicodeLabel = (label: string): boolean => {
 */
 export const isValidHostname = (hostname: string): boolean => {
   // eslint-disable-next-line no-control-regex
-  if (IDN_SEPARATOR_TEST_REGEX.test(hostname) || /[^\x00-\x7F]/.test(hostname)) {
+  if (IDN_SEPARATOR_TEST_REGEX.test(hostname) || /[^\u0000-\u007F]/.test(hostname)) {
     return false;
   }
 
@@ -142,13 +335,14 @@ export const isValidHostname = (hostname: string): boolean => {
     return false;
   }
 
-  for (const label of labels) {
+  for (let i = 0; i < labels.length; i++) {
+    const label = labels[i];
     if (!isAsciiHostnameLabel(label)) {
       return false;
     }
 
     // Punycode (A-label) hostnames encode IDN labels, so validate the decoded Unicode form
-    if (/^xn--/i.test(label)) {
+    if (XN_LABEL_REGEX.test(label)) {
       const unicodeLabel = toUnicodeLabel(label);
       if (unicodeLabel === null || !isValidIdnUnicodeLabel(unicodeLabel)) {
         return false;
@@ -166,12 +360,44 @@ export const isValidIdnHostname = (hostname: string): boolean => {
     return false;
   }
 
-  for (const label of labels) {
+  const unicodeLabels: string[] = [];
+  let totalLength = labels.length - 1; // separator dots between labels
+
+  for (let i = 0; i < labels.length; i++) {
+    const label = labels[i];
     const unicodeLabel = toUnicodeLabel(label);
     if (unicodeLabel === null || !isValidIdnUnicodeLabel(unicodeLabel)) {
       return false;
     }
+
+    let aLabel: string;
+    try {
+      aLabel = punycode.toASCII(unicodeLabel);
+    } catch {
+      return false;
+    }
+
+    // An A-label (xn-- input) must be canonical Punycode: re-encoding its decoded
+    // U-label must reproduce the original A-label. This also rejects an A-label
+    // that decodes to pure ASCII, since such a label never re-encodes to an "xn--"
+    // form (RFC 5890 §2.3.2.1, RFC 5891 §5.4).
+    if (XN_LABEL_REGEX.test(label) && aLabel.toLowerCase() !== label.toLowerCase()) {
+      return false;
+    }
+
+    // RFC 5890 §2.3.2.1 — the A-label form of any label must not exceed 63 octets.
+    if (aLabel.length > 63) {
+      return false;
+    }
+
+    totalLength += aLabel.length;
+    unicodeLabels.push(unicodeLabel);
   }
 
-  return true;
+  // RFC 1035 §3.1 — the domain name (in A-label form) must not exceed 253 octets.
+  if (totalLength > 253) {
+    return false;
+  }
+
+  return isDomainBidiValid(unicodeLabels);
 };

package/src/utils/json.ts

@@ -6,6 +6,8 @@ interface AreEqualOptions {
   maxDepth?: number;
 }
 
+export const sortedKeys = (obj: Record<string, unknown>): string[] => Object.keys(obj).sort();
+
 export const areEqual = (json1: unknown, json2: unknown, options?: AreEqualOptions, _depth = 0): boolean => {
   const caseInsensitiveComparison = options?.caseInsensitiveComparison || false;
   const maxDepth = options?.maxDepth ?? DEFAULT_MAX_RECURSION_DEPTH;
@@ -21,7 +23,7 @@ export const areEqual = (json1: unknown, json2: unknown, options?: AreEqualOptio
     return true;
   }
   if (
-    caseInsensitiveComparison === true &&
+    caseInsensitiveComparison &&
     typeof json1 === 'string' &&
     typeof json2 === 'string' &&
     json1.toUpperCase() === json2.toUpperCase()
@@ -75,16 +77,21 @@ export const areEqual = (json1: unknown, json2: unknown, options?: AreEqualOptio
   return false;
 };
 
-export const decodeJSONPointer = (str: string) => {
-  // http://tools.ietf.org/html/draft-ietf-appsawg-json-pointer-07#section-3
-  return decodeURIComponent(str).replace(/~[0-1]/g, (x) => (x === '~1' ? '/' : '~'));
-};
+export const decodeJSONPointer = (str: string) =>
+  decodeURIComponent(str).replaceAll(/~[0-1]/g, (x) => (x === '~1' ? '/' : '~'));
 
-export const sortedKeys = (obj: Record<string, unknown>): string[] => Object.keys(obj).sort();
-
-export const get = (obj: any, path: string | Array<string | number>): any => {
+export const get = (obj: unknown, path: string | Array<string | number>): unknown => {
   if (typeof path === 'string') {
     path = path.split('.');
   }
-  return path.reduce((acc, key) => (acc && acc[key] !== undefined ? acc[key] : undefined), obj);
+  let acc: unknown = obj;
+  for (let i = 0; i < path.length; i++) {
+    const key = path[i];
+    if (acc && (acc as Record<string | number, unknown>)[key] !== undefined) {
+      acc = (acc as Record<string | number, unknown>)[key];
+    } else {
+      return undefined;
+    }
+  }
+  return acc;
 };

package/src/utils/properties.ts

@@ -1,7 +1,7 @@
-export function copyProp(from: object, to: object, key: string | number | symbol, fn?: <T>(obj: T) => T) {
+export function copyProp(from: object, to: object, key: string | number | symbol, fn?: (value: unknown) => unknown) {
   if (Object.hasOwn(from, key)) {
     Object.defineProperty(to, key, {
-      value: fn ? fn((from as any)[key]) : (from as any)[key],
+      value: fn ? fn((from as Record<PropertyKey, unknown>)[key]) : (from as Record<PropertyKey, unknown>)[key],
       enumerable: true,
       writable: true,
       configurable: true,

package/src/utils/schema-regex.ts

@@ -40,12 +40,12 @@ export function compileSchemaRegex(
     try {
       const re = new RegExp(pattern, 'u');
       return { ok: true, value: re };
-    } catch (e: any) {
+    } catch (error: unknown) {
       return {
         ok: false,
         error: {
           pattern,
-          message: e && e.message ? e.message : 'Invalid regular expression',
+          message: error instanceof Error ? error.message : 'Invalid regular expression',
         },
       };
     }
@@ -53,12 +53,12 @@ export function compileSchemaRegex(
     try {
       const re = new RegExp(pattern);
       return { ok: true, value: re };
-    } catch (e: any) {
+    } catch (error: unknown) {
       return {
         ok: false,
         error: {
           pattern,
-          message: e && e.message ? e.message : 'Invalid regular expression',
+          message: error instanceof Error ? error.message : 'Invalid regular expression',
         },
       };
     }