fix(validators): isSchemaKind no longer accepts inherited prototype keys

packages/validators/src/index.test.ts

@@ -2,7 +2,8 @@ import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
-import { parseDocument, validate } from "./index.js";
+import { assertSchemaKind, parseDocument, schemas, validate } from "./index.js";
+import { isSchemaKind } from "./schemas.js";
 
 describe("LogicSRC validators", () => {
   it("validates the task fixture", () => {
@@ -26,3 +27,19 @@ describe("LogicSRC validators", () => {
     expect(result.ok).toBe(false);
   });
 });
+
+describe("isSchemaKind / assertSchemaKind prototype safety", () => {
+  it("rejects inherited Object.prototype keys", () => {
+    for (const key of ["toString", "constructor", "valueOf", "hasOwnProperty"]) {
+      expect(isSchemaKind(key)).toBe(false);
+      expect(() => assertSchemaKind(key)).toThrow(/Unknown schema kind/);
+    }
+  });
+
+  it("still accepts every real schema kind", () => {
+    for (const key of Object.keys(schemas)) {
+      expect(isSchemaKind(key)).toBe(true);
+      expect(assertSchemaKind(key)).toBe(key);
+    }
+  });
+});

packages/validators/src/schemas.ts

@@ -27,5 +27,5 @@ export const schemas = {
 export type SchemaKind = keyof typeof schemas;
 
 export function isSchemaKind(value: string): value is SchemaKind {
-  return value in schemas;
+  return Object.hasOwn(schemas, value);
 }