the value to validate and copy
a dotted path used in error messages, e.g. "metadata"
The nesting ceiling is fixed, not an option: this function takes no
limits argument, so a caller cannot raise or disable it. The refusal's
context.limitName reads "maximumDepth" to match parseUntrustedJson's
vocabulary — it names the kind of limit, not a knob reachable from here.
a frozen deep copy
TypeError if the value is not representable JSON — a Date, a
Map, undefined, a function, a non-finite number, or a __proto__ own key
FourError UNTRUSTED_INPUT_REJECTED if the value nests deeper than
the fixed ceiling. This one is not a TypeError, so catch (e) { if (e instanceof TypeError) … } does not cover it; use isFourError or
catch both. (Measured 2026-09-19 from an installed tarball: the depth refusal
reports instanceof TypeError === false, while the Date refusal above
reports true.)
Validates a value as JSON and returns a deep-frozen copy of it.
Values are copied rather than referenced because a caller usually hands over a live object; a document that kept the reference would not be a snapshot.
-0is normalized to0. A__proto__own key is refused — see the module note for why copying one would re-parent the copy instead of storing a key.