perf(shared): skip defineProperty for non-inherited keys and make clone cycle-safe (#1994)

`set`, `clone`, and `mergeTwoLevels` in `@orpc/shared` wrote every
property through `Object.defineProperty`, which is several times slower
than a plain assignment. Assignment creates the same own property for
every key except `__proto__`, so the helper now assigns directly and
only uses `Object.defineProperty` for that key. The helper is renamed
from `defineOwnProperty` to `setOwn` to pair with `getOwn`. `clone` also
now survives circular input instead of overflowing the stack.

## Performance

- Building an 8-key object two million times drops from about 4 s to
about 0.5 s, roughly 8x faster.
- The common path is one string comparison followed by a plain write.

## Safety

- Prototype pollution guards are unchanged: the walk in `set` still
descends only into own properties, so `constructor.prototype` and
`__proto__` paths never reach `Object.prototype`.
- `__proto__` is the only accessor on `Object.prototype`, so it is the
only key where assignment and an own property differ. It still lands as
an own data property instead of re-parenting the object.

## Fixes

- `clone` no longer recurses forever on self-referencing arrays or
objects. Cycles become cycles in the copy, and a value referenced from
several places is cloned once and stays shared.

## Testing

- New tests: `clone` on circular and shared-reference input.
- Shared object tests plus the callers in contract, trpc, and server
pass; eslint and a type check of `packages/shared` including test files
are clean.

Author: dinwwwh

packages/shared/src/object.test.ts

@@ -412,6 +412,41 @@ describe('clone', () => {
     // eslint-disable-next-line no-restricted-properties, no-proto
     expect(clonedNullProto.__proto__).toBe(2)
   })
+
+  it('clone with circular references', () => {
+    const obj: Record<string, unknown> = { a: 1 }
+    obj.self = obj
+    obj.list = [obj]
+
+    const cloned = clone(obj)
+
+    expect(cloned).not.toBe(obj)
+    expect(cloned.a).toBe(1)
+    expect(cloned.self).toBe(cloned)
+    expect((cloned.list as unknown[])[0]).toBe(cloned)
+    expect(cloned.list).not.toBe(obj.list)
+
+    const arr: unknown[] = [1]
+    arr.push(arr)
+
+    const clonedArr = clone(arr)
+
+    expect(clonedArr).not.toBe(arr)
+    expect(clonedArr[0]).toBe(1)
+    expect(clonedArr[1]).toBe(clonedArr)
+  })
+
+  it('clone keeps shared references shared', () => {
+    const shared = { x: 1 }
+    const obj = { a: shared, b: shared, c: [shared] }
+
+    const cloned = clone(obj)
+
+    expect(cloned.a).toEqual(shared)
+    expect(cloned.a).not.toBe(shared)
+    expect(cloned.b).toBe(cloned.a)
+    expect(cloned.c[0]).toBe(cloned.a)
+  })
 })
 
 describe('bindMethods', () => {

packages/shared/src/object.ts

@@ -107,24 +107,32 @@ export function set(
 
     if (!isTypescriptObject(next)) {
       const child = {}
-      defineOwnProperty(current, key, child)
+      setOwn(current, key, child)
       current = child
     }
     else {
       current = next
     }
   }
 
-  defineOwnProperty(current, path.at(-1)!, value)
+  setOwn(current, path.at(-1)!, value)
 }
 
-function defineOwnProperty(object: object, key: PropertyKey, value: unknown): void {
-  Object.defineProperty(object, key, {
-    value,
-    writable: true,
-    enumerable: true,
-    configurable: true,
-  })
+/**
+ * Sets `object[key]`, defining `__proto__` as an own property instead of re-parenting the object.
+ */
+function setOwn(object: object, key: PropertyKey, value: unknown): void {
+  if (key === '__proto__') {
+    Object.defineProperty(object, key, {
+      value,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    })
+  }
+  else {
+    (object as Record<PropertyKey, unknown>)[key] = value
+  }
 }
 
 /**
@@ -148,7 +156,7 @@ export function mergeTwoLevels(first: unknown, second: unknown): unknown {
     const secondValue = second[key]
 
     if (isPlainObject(firstValue) && isPlainObject(secondValue)) {
-      defineOwnProperty(result, key, { ...firstValue, ...secondValue })
+      setOwn(result, key, { ...firstValue, ...secondValue })
     }
   }
 
@@ -168,24 +176,50 @@ export function omit<T extends object, K extends keyof T>(
   return result
 }
 
+/**
+ * Deep clones arrays and plain objects, leaving every other value as is.
+ * Circular and shared references are preserved in the copy.
+ */
 export function clone<T>(value: T): T {
+  return cloneWithVisited(value, new WeakMap()) as T
+}
+
+function cloneWithVisited(value: unknown, visited: WeakMap<object, unknown>): unknown {
   if (Array.isArray(value)) {
-    return value.map(clone) as any
+    const existing = visited.get(value)
+    if (existing) {
+      return existing
+    }
+
+    const result: unknown[] = []
+    visited.set(value, result)
+
+    for (const item of value) {
+      result.push(cloneWithVisited(item, visited))
+    }
+
+    return result
   }
 
   if (isPlainObject(value)) {
+    const existing = visited.get(value)
+    if (existing) {
+      return existing
+    }
+
     const result: Record<PropertyKey, unknown> = {}
+    visited.set(value, result)
 
-    // Use defineOwnProperty so special keys like __proto__ don't re-parent the result.
+    // Use setOwn so special keys like __proto__ don't re-parent the result.
     for (const key in value) {
-      defineOwnProperty(result, key, clone(value[key]))
+      setOwn(result, key, cloneWithVisited(value[key], visited))
     }
 
     for (const sym of Object.getOwnPropertySymbols(value)) {
-      defineOwnProperty(result, sym, clone(value[sym]))
+      setOwn(result, sym, cloneWithVisited(value[sym], visited))
     }
 
-    return result as any
+    return result
   }
 
   return value