@oxog/vld 1.5.0 → 2.0.2

package/dist/chunks/index-CETyGkrv.js

@@ -0,0 +1,894 @@
+import { i as VldBase, t as getMessages, V as VldString, a as VldNumber, d as VldBigInt, c as VldDate, b as VldBoolean } from './bigint-DgsCr2dC.js';
+import { VldError, createIssue } from '../errors.js';
+import { V as VldUnknown } from './unknown-SLIH1VCf.js';
+
+/**
+ * Codec validator for bidirectional transformations
+ * Enables converting between different data representations
+ */
+class VldCodec extends VldBase {
+    constructor(inputValidator, outputValidator, codecTransform) {
+        super();
+        this.inputValidator = inputValidator;
+        this.outputValidator = outputValidator;
+        this.codecTransform = codecTransform;
+    }
+    /**
+     * Parse (decode) a value from input to output format
+     */
+    parse(value) {
+        const result = this.safeParse(value);
+        if (!result.success) {
+            throw result.error;
+        }
+        return result.data;
+    }
+    /**
+     * Safely parse (decode) a value from input to output format
+     */
+    safeParse(value) {
+        // First validate the input
+        const inputResult = this.inputValidator.safeParse(value);
+        if (!inputResult.success) {
+            return inputResult;
+        }
+        try {
+            // Then decode to output
+            const decoded = this.codecTransform.decode(inputResult.data);
+            // Handle async decode
+            if (decoded instanceof Promise) {
+                throw new VldError([
+                    createIssue('custom', [], getMessages().codecAsyncNotSupported)
+                ]);
+            }
+            // Validate the decoded output
+            return this.outputValidator.safeParse(decoded);
+        }
+        catch (error) {
+            if (error instanceof VldError) {
+                return { success: false, error };
+            }
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().codecDecodeFailed)
+                ])
+            };
+        }
+    }
+    /**
+     * Encode a value from output back to input format
+     */
+    encode(value) {
+        const result = this.safeEncode(value);
+        if (!result.success) {
+            throw result.error;
+        }
+        return result.data;
+    }
+    /**
+     * Safely encode a value from output back to input format
+     */
+    safeEncode(value) {
+        // First validate the output
+        const outputResult = this.outputValidator.safeParse(value);
+        if (!outputResult.success) {
+            return outputResult;
+        }
+        try {
+            // Then encode to input
+            const encoded = this.codecTransform.encode(outputResult.data);
+            // Handle async encode
+            if (encoded instanceof Promise) {
+                throw new VldError([
+                    createIssue('custom', [], getMessages().codecAsyncNotSupported)
+                ]);
+            }
+            // Validate the encoded input
+            return this.inputValidator.safeParse(encoded);
+        }
+        catch (error) {
+            if (error instanceof VldError) {
+                return { success: false, error };
+            }
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().codecEncodeFailed)
+                ])
+            };
+        }
+    }
+    /**
+     * Async version of parse (decode)
+     */
+    async parseAsync(value) {
+        const result = await this.safeParseAsync(value);
+        if (!result.success) {
+            throw result.error;
+        }
+        return result.data;
+    }
+    /**
+     * Async version of safeParse (decode)
+     */
+    async safeParseAsync(value) {
+        // First validate the input
+        const inputResult = this.inputValidator.safeParse(value);
+        if (!inputResult.success) {
+            return inputResult;
+        }
+        try {
+            // Then decode to output (supports async)
+            const decoded = await this.codecTransform.decode(inputResult.data);
+            // Validate the decoded output
+            return this.outputValidator.safeParse(decoded);
+        }
+        catch (error) {
+            if (error instanceof VldError) {
+                return { success: false, error };
+            }
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().codecDecodeFailed)
+                ])
+            };
+        }
+    }
+    /**
+     * Async version of encode
+     */
+    async encodeAsync(value) {
+        const result = await this.safeEncodeAsync(value);
+        if (!result.success) {
+            throw result.error;
+        }
+        return result.data;
+    }
+    /**
+     * Async version of safeEncode
+     */
+    async safeEncodeAsync(value) {
+        // First validate the output
+        const outputResult = this.outputValidator.safeParse(value);
+        if (!outputResult.success) {
+            return outputResult;
+        }
+        try {
+            // Then encode to input (supports async)
+            const encoded = await this.codecTransform.encode(outputResult.data);
+            // Validate the encoded input
+            return this.inputValidator.safeParse(encoded);
+        }
+        catch (error) {
+            if (error instanceof VldError) {
+                return { success: false, error };
+            }
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().codecEncodeFailed)
+                ])
+            };
+        }
+    }
+    /**
+     * Create a codec validator
+     */
+    static create(inputValidator, outputValidator, codecTransform) {
+        return new VldCodec(inputValidator, outputValidator, codecTransform);
+    }
+}
+
+/**
+ * Base64 string validator
+ */
+class VldBase64 extends VldBase {
+    constructor(urlSafe = false) {
+        super();
+        this.urlSafe = urlSafe;
+    }
+    parse(value) {
+        const result = this.safeParse(value);
+        if (!result.success) {
+            throw result.error;
+        }
+        return result.data;
+    }
+    safeParse(value) {
+        if (typeof value !== 'string') {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('invalid_type', [], getMessages().expectedString)
+                ])
+            };
+        }
+        // Check if it's a valid base64 string
+        const regex = this.urlSafe ? VldBase64.BASE64_URL_REGEX : VldBase64.BASE64_REGEX;
+        // Check basic format
+        if (!regex.test(value)) {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().invalidBase64)
+                ])
+            };
+        }
+        // For standard base64, check length is multiple of 4 (after padding)
+        // Empty strings are valid (decode to empty buffer)
+        // For URL-safe base64, padding is not required
+        if (!this.urlSafe && value.length > 0 && value.length % 4 !== 0) {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().invalidBase64)
+                ])
+            };
+        }
+        return { success: true, data: value };
+    }
+    /**
+     * Create a URL-safe base64 validator
+     */
+    urlSafeMode() {
+        return new VldBase64(true);
+    }
+    static create(urlSafe = false) {
+        return new VldBase64(urlSafe);
+    }
+}
+VldBase64.BASE64_REGEX = /^[A-Za-z0-9+/]*={0,2}$/;
+// Note: RFC 4648 specifies URL-safe base64 should omit padding, but we allow it for compatibility
+VldBase64.BASE64_URL_REGEX = /^[A-Za-z0-9_-]*={0,2}$/;
+
+/**
+ * Hexadecimal string validator
+ */
+class VldHex extends VldBase {
+    constructor(lowercase = false) {
+        super();
+        this.lowercase = lowercase;
+    }
+    parse(value) {
+        const result = this.safeParse(value);
+        if (!result.success) {
+            throw result.error;
+        }
+        return result.data;
+    }
+    safeParse(value) {
+        if (typeof value !== 'string') {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('invalid_type', [], getMessages().expectedString)
+                ])
+            };
+        }
+        // Check if it's a valid hex string
+        if (!VldHex.HEX_REGEX.test(value)) {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().invalidHex)
+                ])
+            };
+        }
+        // Check if even length (full bytes)
+        if (value.length % 2 !== 0) {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().invalidHex)
+                ])
+            };
+        }
+        // Normalize case if required
+        const normalizedValue = this.lowercase ? value.toLowerCase() : value;
+        return { success: true, data: normalizedValue };
+    }
+    /**
+     * Require lowercase hex characters
+     */
+    lowercaseMode() {
+        return new VldHex(true);
+    }
+    static create(lowercase = false) {
+        return new VldHex(lowercase);
+    }
+}
+// BUG-008 FIX: Use * instead of + to allow empty hex strings (consistent with base64 validator)
+VldHex.HEX_REGEX = /^[0-9a-fA-F]*$/;
+
+/**
+ * Uint8Array validator with immutable configuration
+ * BUG-NEW-010 FIX: Refactored to follow immutability pattern
+ */
+class VldUint8Array extends VldBase {
+    /**
+     * Protected constructor to maintain immutability
+     */
+    constructor(config) {
+        super();
+        this.config = config || {};
+    }
+    parse(value) {
+        const result = this.safeParse(value);
+        if (!result.success) {
+            throw result.error;
+        }
+        return result.data;
+    }
+    safeParse(value) {
+        if (!(value instanceof Uint8Array)) {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('invalid_type', [], getMessages().expectedUint8Array)
+                ])
+            };
+        }
+        // Check exact length if specified
+        if (this.config.exactLength !== undefined && value.length !== this.config.exactLength) {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().uint8ArrayExactLength(this.config.exactLength))
+                ])
+            };
+        }
+        // Check minimum length
+        if (this.config.minLength !== undefined && value.length < this.config.minLength) {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().uint8ArrayMinLength(this.config.minLength))
+                ])
+            };
+        }
+        // Check maximum length
+        if (this.config.maxLength !== undefined && value.length > this.config.maxLength) {
+            return {
+                success: false,
+                error: new VldError([
+                    createIssue('custom', [], getMessages().uint8ArrayMaxLength(this.config.maxLength))
+                ])
+            };
+        }
+        return { success: true, data: value };
+    }
+    /**
+     * Set minimum byte length
+     * Returns new immutable validator instance
+     */
+    min(length) {
+        return new VldUint8Array({
+            ...this.config,
+            minLength: length
+        });
+    }
+    /**
+     * Set maximum byte length
+     * Returns new immutable validator instance
+     */
+    max(length) {
+        return new VldUint8Array({
+            ...this.config,
+            maxLength: length
+        });
+    }
+    /**
+     * Set exact byte length
+     * Returns new immutable validator instance
+     * Clears min/max when setting exact length
+     */
+    length(length) {
+        return new VldUint8Array({
+            exactLength: length,
+            // Clear min/max when exact length is set
+            minLength: undefined,
+            maxLength: undefined
+        });
+    }
+    static create() {
+        return new VldUint8Array();
+    }
+}
+
+/**
+ * Utility functions for codec transformations
+ */
+/**
+ * Convert a base64 string to Uint8Array
+ */
+function base64ToUint8Array(base64) {
+    // Handle URL-safe base64
+    const base64Clean = base64.replace(/-/g, '+').replace(/_/g, '/');
+    // Add padding if necessary
+    const padded = base64Clean.padEnd(base64Clean.length + (4 - base64Clean.length % 4) % 4, '=');
+    // Decode base64 to binary string
+    const binaryString = safeAtob(padded);
+    // Convert binary string to Uint8Array
+    const bytes = new Uint8Array(binaryString.length);
+    for (let i = 0; i < binaryString.length; i++) {
+        bytes[i] = binaryString.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Convert Uint8Array to base64 string
+ */
+function uint8ArrayToBase64(bytes) {
+    // Convert Uint8Array to binary string
+    let binaryString = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binaryString += String.fromCharCode(bytes[i]);
+    }
+    // Encode to base64
+    return safeBtoa(binaryString);
+}
+/**
+ * Convert Uint8Array to URL-safe base64 string
+ */
+function uint8ArrayToBase64Url(bytes) {
+    const base64 = uint8ArrayToBase64(bytes);
+    // Make URL-safe and remove padding
+    return base64
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Convert hex string to Uint8Array
+ */
+function hexToUint8Array(hex) {
+    // BUG-010 FIX: Add length validation to prevent memory exhaustion
+    // 20 million characters = 10MB of data (consistent with base64 limits)
+    if (hex.length > 20000000) {
+        throw new Error('Hex string is too large (max 10MB)');
+    }
+    // Remove any 0x prefix if present
+    const cleanHex = hex.startsWith('0x') ? hex.slice(2) : hex;
+    // BUG-NPM-006 FIX: Validate hex characters to prevent silent data corruption
+    // parseInt silently returns NaN for invalid hex, which becomes 0 in Uint8Array
+    const hexPattern = /^[0-9a-fA-F]*$/;
+    if (!hexPattern.test(cleanHex)) {
+        throw new Error('Invalid hex string: contains non-hexadecimal characters');
+    }
+    // Ensure even length
+    const paddedHex = cleanHex.length % 2 === 0 ? cleanHex : '0' + cleanHex;
+    const bytes = new Uint8Array(paddedHex.length / 2);
+    for (let i = 0; i < paddedHex.length; i += 2) {
+        bytes[i / 2] = parseInt(paddedHex.substring(i, i + 2), 16);
+    }
+    return bytes;
+}
+/**
+ * Convert Uint8Array to hex string
+ */
+function uint8ArrayToHex(bytes) {
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++) {
+        const byte = bytes[i].toString(16);
+        hex += byte.length === 1 ? '0' + byte : byte;
+    }
+    return hex;
+}
+/**
+ * Convert string to Uint8Array using UTF-8 encoding
+ * BUG-NEW-011 FIX: Add DoS protection with 10MB limit
+ */
+function stringToUint8Array(str) {
+    // Add DoS protection - limit to 10MB (consistent with base64 limit)
+    const MAX_STRING_LENGTH = 10000000; // 10 million characters (~10MB)
+    if (str.length > MAX_STRING_LENGTH) {
+        throw new Error(`String is too large for UTF-8 encoding (max ${MAX_STRING_LENGTH} characters)`);
+    }
+    const encoder = new TextEncoder();
+    return encoder.encode(str);
+}
+/**
+ * Convert Uint8Array to string using UTF-8 decoding
+ * BUG-NEW-012 FIX: Add DoS protection with 10MB limit
+ */
+function uint8ArrayToString(bytes) {
+    // Add DoS protection - limit to 10MB
+    const MAX_BYTES_LENGTH = 10000000; // 10 million bytes
+    if (bytes.length > MAX_BYTES_LENGTH) {
+        throw new Error(`Byte array is too large for UTF-8 decoding (max ${MAX_BYTES_LENGTH} bytes)`);
+    }
+    const decoder = new TextDecoder();
+    return decoder.decode(bytes);
+}
+/**
+ * Check if running in Node.js environment
+ */
+function isNodeEnvironment() {
+    return typeof globalThis !== 'undefined' &&
+        typeof globalThis.process !== 'undefined' &&
+        globalThis.process.versions != null &&
+        globalThis.process.versions.node != null;
+}
+/**
+ * Validate and sanitize base64 input to prevent prototype pollution
+ */
+function validateBase64Input(encoded) {
+    // Check for null/undefined
+    if (encoded == null) {
+        throw new Error('Base64 input cannot be null or undefined');
+    }
+    // Ensure it's a string
+    if (typeof encoded !== 'string') {
+        throw new Error('Base64 input must be a string');
+    }
+    // Length validation - base64 strings should be reasonable length
+    if (encoded.length > 10000000) { // 10MB limit
+        throw new Error('Base64 input is too large');
+    }
+    // Base64 character validation - only allow valid base64 characters
+    const base64Regex = /^[A-Za-z0-9+/]*={0,2}$/;
+    if (!base64Regex.test(encoded)) {
+        throw new Error('Invalid base64 format');
+    }
+    // BUG-NEW-004 FIX: Correct base64 padding validation per RFC 4648
+    // Base64 only uses '=' or '==' as padding, never '==='
+    const paddingIndex = encoded.indexOf('=');
+    if (paddingIndex !== -1) {
+        const padding = encoded.substring(paddingIndex);
+        // Only allow '=' or '==' as valid padding (RFC 4648 compliant)
+        if (!/^={1,2}$/.test(padding)) {
+            throw new Error('Invalid base64 padding');
+        }
+        // Padding should only be at the end
+        if (paddingIndex < encoded.length - 2) {
+            throw new Error('Base64 padding must be at the end');
+        }
+    }
+    // Additional security check: prevent potential encoded JavaScript
+    // by looking for suspicious patterns that might indicate malicious content
+    const suspiciousPatterns = [
+        /eval/i,
+        /function/i,
+        /javascript:/i,
+        /<script/i,
+        /on\w+\s*=/i,
+        /__proto__/i,
+        /constructor/i,
+        /prototype/i
+    ];
+    // Decode a small portion to check for suspicious content
+    try {
+        const sampleSize = Math.min(100, encoded.length);
+        const sample = encoded.substring(0, sampleSize);
+        const sampleDecoded = typeof atob !== 'undefined'
+            ? atob(sample)
+            : Buffer.from(sample, 'base64').toString('utf8', 0, 50); // Only decode first 50 chars
+        for (const pattern of suspiciousPatterns) {
+            if (pattern.test(sampleDecoded)) {
+                throw new Error('Suspicious content detected in base64 input');
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('Suspicious content')) {
+            throw error;
+        }
+        // If decoding fails, continue - it might be invalid base64 which will be caught later
+    }
+}
+/**
+ * Polyfill for atob in Node.js with proper input validation
+ */
+function safeAtob(encoded) {
+    // Input validation and sanitization
+    validateBase64Input(encoded);
+    if (typeof atob !== 'undefined') {
+        try {
+            return atob(encoded);
+        }
+        catch (error) {
+            throw new Error('Failed to decode base64 data');
+        }
+    }
+    // Node.js fallback with additional validation
+    if (isNodeEnvironment()) {
+        try {
+            // Use Buffer with explicit error handling
+            const buffer = Buffer.from(encoded, 'base64');
+            // Additional validation: ensure the decoded data is reasonable size
+            if (buffer.length > 5000000) { // 5MB limit for decoded data
+                throw new Error('Decoded base64 data is too large');
+            }
+            return buffer.toString('binary');
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('Invalid base64')) {
+                throw new Error('Invalid base64 format');
+            }
+            throw new Error('Failed to decode base64 data in Node.js environment');
+        }
+    }
+    throw new Error('Base64 decoding not supported in this environment');
+}
+/**
+ * Polyfill for btoa in Node.js
+ */
+function safeBtoa(str) {
+    if (typeof btoa !== 'undefined') {
+        return btoa(str);
+    }
+    // Node.js fallback
+    if (isNodeEnvironment()) {
+        return Buffer.from(str, 'binary').toString('base64');
+    }
+    throw new Error('Base64 encoding not supported in this environment');
+}
+
+/**
+ * Predefined codecs for common transformations (Zod-compatible)
+ */
+// ===== STRING TO NUMBER CODECS =====
+/**
+ * String to number codec
+ */
+const stringToNumber = VldCodec.create(VldString.create(), VldNumber.create(), {
+    decode: (str) => {
+        const num = Number(str);
+        if (isNaN(num))
+            throw new Error('Invalid number');
+        return num;
+    },
+    encode: (num) => num.toString()
+});
+/**
+ * String to integer codec
+ */
+const stringToInt = VldCodec.create(VldString.create(), VldNumber.create().int(), {
+    decode: (str) => {
+        const num = parseInt(str, 10);
+        if (isNaN(num))
+            throw new Error('Invalid integer');
+        return num;
+    },
+    encode: (num) => Math.floor(num).toString()
+});
+/**
+ * String to BigInt codec
+ */
+const stringToBigInt = VldCodec.create(VldString.create(), VldBigInt.create(), {
+    decode: (str) => {
+        try {
+            return BigInt(str);
+        }
+        catch {
+            throw new Error('Invalid BigInt');
+        }
+    },
+    encode: (bigint) => bigint.toString()
+});
+/**
+ * Number to BigInt codec
+ */
+const numberToBigInt = VldCodec.create(VldNumber.create().int(), VldBigInt.create(), {
+    decode: (num) => BigInt(Math.floor(num)),
+    encode: (bigint) => Number(bigint)
+});
+// ===== DATE CODECS =====
+/**
+ * ISO datetime string to Date codec
+ */
+const isoDatetimeToDate = VldCodec.create(VldString.create().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z?$/, 'Invalid ISO datetime format'), VldDate.create(), {
+    decode: (isoString) => {
+        const date = new Date(isoString);
+        if (isNaN(date.getTime()))
+            throw new Error('Invalid date');
+        return date;
+    },
+    encode: (date) => date.toISOString()
+});
+/**
+ * Epoch seconds to Date codec
+ */
+const epochSecondsToDate = VldCodec.create(VldNumber.create(), VldDate.create(), {
+    decode: (seconds) => new Date(seconds * 1000),
+    encode: (date) => Math.floor(date.getTime() / 1000)
+});
+/**
+ * Epoch milliseconds to Date codec
+ */
+const epochMillisToDate = VldCodec.create(VldNumber.create(), VldDate.create(), {
+    decode: (millis) => new Date(millis),
+    encode: (date) => date.getTime()
+});
+// ===== JSON CODEC =====
+/**
+ * JSON string codec for any type
+ */
+const jsonCodec = (schema) => {
+    const outputSchema = schema || VldUnknown.create();
+    return VldCodec.create(VldString.create(), outputSchema, {
+        decode: (jsonString) => {
+            try {
+                return JSON.parse(jsonString);
+            }
+            catch {
+                throw new Error('Invalid JSON');
+            }
+        },
+        encode: (data) => JSON.stringify(data)
+    });
+};
+// ===== URL CODECS =====
+/**
+ * String to URL codec
+ */
+const stringToURL = VldCodec.create(VldString.create().url(), VldUnknown.create(), // URL object
+{
+    decode: (urlString) => {
+        try {
+            return new URL(urlString);
+        }
+        catch {
+            throw new Error('Invalid URL');
+        }
+    },
+    encode: (url) => url.toString()
+});
+/**
+ * String to HTTP/HTTPS URL codec
+ */
+const stringToHttpURL = VldCodec.create(VldString.create().regex(/^https?:\/\//, 'Must be HTTP or HTTPS URL'), VldUnknown.create(), // URL object
+{
+    decode: (urlString) => {
+        try {
+            const url = new URL(urlString);
+            if (!['http:', 'https:'].includes(url.protocol)) {
+                throw new Error('Must be HTTP or HTTPS');
+            }
+            return url;
+        }
+        catch {
+            throw new Error('Invalid HTTP URL');
+        }
+    },
+    encode: (url) => url.toString()
+});
+/**
+ * URI component encode/decode codec
+ */
+const uriComponent = VldCodec.create(VldString.create(), VldString.create(), {
+    decode: (encoded) => {
+        try {
+            return decodeURIComponent(encoded);
+        }
+        catch {
+            throw new Error('Invalid URI component');
+        }
+    },
+    encode: (decoded) => encodeURIComponent(decoded)
+});
+/**
+ * String to boolean codec
+ */
+const stringToBoolean = VldCodec.create(VldString.create(), VldBoolean.create(), {
+    decode: (str) => {
+        const lower = str.toLowerCase();
+        if (lower === 'true' || lower === '1' || lower === 'yes' || lower === 'on')
+            return true;
+        if (lower === 'false' || lower === '0' || lower === 'no' || lower === 'off')
+            return false;
+        throw new Error('Invalid boolean string');
+    },
+    encode: (bool) => bool.toString()
+});
+// ===== EXISTING BYTE CODECS (updated) =====
+/**
+ * Base64 to Uint8Array codec
+ */
+const base64ToBytes = VldCodec.create(VldBase64.create(), VldUint8Array.create(), {
+    decode: base64ToUint8Array,
+    encode: uint8ArrayToBase64
+});
+/**
+ * URL-safe Base64 to Uint8Array codec
+ */
+const base64UrlToBytes = VldCodec.create(VldBase64.create().urlSafeMode(), VldUint8Array.create(), {
+    decode: base64ToUint8Array,
+    encode: uint8ArrayToBase64Url
+});
+/**
+ * Hexadecimal to Uint8Array codec
+ */
+const hexToBytes = VldCodec.create(VldHex.create(), VldUint8Array.create(), {
+    decode: hexToUint8Array,
+    encode: uint8ArrayToHex
+});
+/**
+ * Lowercase hexadecimal to Uint8Array codec
+ */
+const hexLowerToBytes = VldCodec.create(VldHex.create().lowercaseMode(), VldUint8Array.create(), {
+    decode: hexToUint8Array,
+    encode: (bytes) => uint8ArrayToHex(bytes).toLowerCase()
+});
+/**
+ * UTF-8 string to Uint8Array codec
+ */
+const utf8ToBytes = VldCodec.create(VldString.create(), VldUint8Array.create(), {
+    decode: stringToUint8Array,
+    encode: uint8ArrayToString
+});
+/**
+ * Uint8Array to UTF-8 string codec (reverse of utf8ToBytes)
+ */
+const bytesToUtf8 = VldCodec.create(VldUint8Array.create(), VldString.create(), {
+    decode: uint8ArrayToString,
+    encode: stringToUint8Array
+});
+/**
+ * Base64URL to Uint8Array codec (updated)
+ */
+const base64urlToBytes = VldCodec.create(VldBase64.create().urlSafeMode(), VldUint8Array.create(), {
+    decode: base64ToUint8Array,
+    encode: uint8ArrayToBase64Url
+});
+/**
+ * Base64 encoded JSON codec (updated)
+ */
+const base64Json = (schema) => {
+    const outputSchema = schema || VldUnknown.create();
+    return VldCodec.create(VldBase64.create(), outputSchema, {
+        decode: (base64) => {
+            // BUG-NPM-005 FIX: Add error handling for JSON parsing
+            try {
+                const jsonString = uint8ArrayToString(base64ToUint8Array(base64));
+                return JSON.parse(jsonString);
+            }
+            catch (error) {
+                throw new Error(`Failed to parse base64 JSON: ${error.message}`);
+            }
+        },
+        encode: (data) => {
+            const jsonString = JSON.stringify(data);
+            return uint8ArrayToBase64(stringToUint8Array(jsonString));
+        }
+    });
+};
+/**
+ * JWT payload decoder (base64url encoded JSON) - updated
+ */
+const jwtPayload = (schema) => {
+    const outputSchema = schema || VldUnknown.create();
+    return VldCodec.create(VldString.create().refine(s => s.split('.').length === 3, 'Invalid JWT format'), outputSchema, {
+        decode: (jwt) => {
+            // BUG-NPM-004 FIX: Add comprehensive error handling for JWT parsing
+            try {
+                const parts = jwt.split('.');
+                if (parts.length !== 3) {
+                    throw new Error('JWT must have exactly 3 parts');
+                }
+                const payloadBase64 = parts[1];
+                if (!payloadBase64) {
+                    throw new Error('JWT payload is empty');
+                }
+                // Convert base64url to base64
+                const base64 = payloadBase64
+                    .replace(/-/g, '+')
+                    .replace(/_/g, '/')
+                    .padEnd(payloadBase64.length + (4 - payloadBase64.length % 4) % 4, '=');
+                const jsonString = uint8ArrayToString(base64ToUint8Array(base64));
+                return JSON.parse(jsonString);
+            }
+            catch (error) {
+                throw new Error(`Failed to decode JWT payload: ${error.message}`);
+            }
+        },
+        encode: () => {
+            throw new Error('JWT encoding not supported - use a proper JWT library');
+        }
+    });
+};
+
+export { hexLowerToBytes as A, utf8ToBytes as B, bytesToUtf8 as C, base64Json as D, jwtPayload as E, VldCodec as V, VldUint8Array as a, VldHex as b, VldBase64 as c, base64ToUint8Array as d, uint8ArrayToBase64Url as e, uint8ArrayToHex as f, uint8ArrayToString as g, hexToUint8Array as h, stringToNumber as i, stringToInt as j, stringToBigInt as k, stringToBoolean as l, isoDatetimeToDate as m, numberToBigInt as n, epochSecondsToDate as o, epochMillisToDate as p, jsonCodec as q, stringToURL as r, stringToUint8Array as s, stringToHttpURL as t, uint8ArrayToBase64 as u, uriComponent as v, base64ToBytes as w, base64UrlToBytes as x, base64urlToBytes as y, hexToBytes as z };
+//# sourceMappingURL=index-CETyGkrv.js.map