@oxog/vld 2.0.2 → 2.1.0

package/dist/cjs/chunks/index-BkI37108.cjs

@@ -0,0 +1,538 @@
+'use strict';
+
+var validators_codec = require('../validators/codec.cjs');
+var validators_base64 = require('../validators/base64.cjs');
+var validators_hex = require('../validators/hex.cjs');
+var validators_uint8array = require('../validators/uint8array.cjs');
+var validators_string = require('./string-BKZrc4hs.cjs');
+var validators_number = require('../validators/number.cjs');
+var validators_bigint = require('../validators/bigint.cjs');
+var validators_boolean = require('../validators/boolean.cjs');
+var validators_date = require('../validators/date.cjs');
+var validators_unknown = require('../validators/unknown.cjs');
+
+/**
+ * Utility functions for codec transformations
+ */
+/**
+ * Convert a base64 string to Uint8Array
+ */
+function base64ToUint8Array(base64) {
+    // Handle URL-safe base64
+    const base64Clean = base64.replace(/-/g, '+').replace(/_/g, '/');
+    // Add padding if necessary
+    const padded = base64Clean.padEnd(base64Clean.length + (4 - base64Clean.length % 4) % 4, '=');
+    // Decode base64 to binary string
+    const binaryString = safeAtob(padded);
+    // Convert binary string to Uint8Array
+    const bytes = new Uint8Array(binaryString.length);
+    for (let i = 0; i < binaryString.length; i++) {
+        bytes[i] = binaryString.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Convert Uint8Array to base64 string
+ */
+function uint8ArrayToBase64(bytes) {
+    // Convert Uint8Array to binary string
+    let binaryString = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binaryString += String.fromCharCode(bytes[i]);
+    }
+    // Encode to base64
+    return safeBtoa(binaryString);
+}
+/**
+ * Convert Uint8Array to URL-safe base64 string
+ */
+function uint8ArrayToBase64Url(bytes) {
+    const base64 = uint8ArrayToBase64(bytes);
+    // Make URL-safe and remove padding
+    return base64
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Convert hex string to Uint8Array
+ */
+function hexToUint8Array(hex) {
+    // BUG-010 FIX: Add length validation to prevent memory exhaustion
+    // 20 million characters = 10MB of data (consistent with base64 limits)
+    if (hex.length > 20000000) {
+        throw new Error('Hex string is too large (max 10MB)');
+    }
+    // Remove any 0x prefix if present
+    const cleanHex = hex.startsWith('0x') ? hex.slice(2) : hex;
+    // BUG-NPM-006 FIX: Validate hex characters to prevent silent data corruption
+    // parseInt silently returns NaN for invalid hex, which becomes 0 in Uint8Array
+    const hexPattern = /^[0-9a-fA-F]*$/;
+    if (!hexPattern.test(cleanHex)) {
+        throw new Error('Invalid hex string: contains non-hexadecimal characters');
+    }
+    // Ensure even length
+    const paddedHex = cleanHex.length % 2 === 0 ? cleanHex : '0' + cleanHex;
+    const bytes = new Uint8Array(paddedHex.length / 2);
+    for (let i = 0; i < paddedHex.length; i += 2) {
+        bytes[i / 2] = parseInt(paddedHex.substring(i, i + 2), 16);
+    }
+    return bytes;
+}
+/**
+ * Convert Uint8Array to hex string
+ */
+function uint8ArrayToHex(bytes) {
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++) {
+        const byte = bytes[i].toString(16);
+        hex += byte.length === 1 ? '0' + byte : byte;
+    }
+    return hex;
+}
+/**
+ * Convert string to Uint8Array using UTF-8 encoding
+ * BUG-NEW-011 FIX: Add DoS protection with 10MB limit
+ */
+function stringToUint8Array(str) {
+    // Add DoS protection - limit to 10MB (consistent with base64 limit)
+    const MAX_STRING_LENGTH = 10000000; // 10 million characters (~10MB)
+    if (str.length > MAX_STRING_LENGTH) {
+        throw new Error(`String is too large for UTF-8 encoding (max ${MAX_STRING_LENGTH} characters)`);
+    }
+    const encoder = new TextEncoder();
+    return encoder.encode(str);
+}
+/**
+ * Convert Uint8Array to string using UTF-8 decoding
+ * BUG-NEW-012 FIX: Add DoS protection with 10MB limit
+ */
+function uint8ArrayToString(bytes) {
+    // Add DoS protection - limit to 10MB
+    const MAX_BYTES_LENGTH = 10000000; // 10 million bytes
+    if (bytes.length > MAX_BYTES_LENGTH) {
+        throw new Error(`Byte array is too large for UTF-8 decoding (max ${MAX_BYTES_LENGTH} bytes)`);
+    }
+    const decoder = new TextDecoder();
+    return decoder.decode(bytes);
+}
+/**
+ * Check if running in Node.js environment
+ */
+function isNodeEnvironment() {
+    return typeof globalThis !== 'undefined' &&
+        typeof globalThis.process !== 'undefined' &&
+        globalThis.process.versions != null &&
+        globalThis.process.versions.node != null;
+}
+/**
+ * Validate and sanitize base64 input to prevent prototype pollution
+ */
+function validateBase64Input(encoded) {
+    // Check for null/undefined
+    if (encoded == null) {
+        throw new Error('Base64 input cannot be null or undefined');
+    }
+    // Ensure it's a string
+    if (typeof encoded !== 'string') {
+        throw new Error('Base64 input must be a string');
+    }
+    // Length validation - base64 strings should be reasonable length
+    if (encoded.length > 10000000) { // 10MB limit
+        throw new Error('Base64 input is too large');
+    }
+    // Base64 character validation - only allow valid base64 characters
+    const base64Regex = /^[A-Za-z0-9+/]*={0,2}$/;
+    if (!base64Regex.test(encoded)) {
+        throw new Error('Invalid base64 format');
+    }
+    // BUG-NEW-004 FIX: Correct base64 padding validation per RFC 4648
+    // Base64 only uses '=' or '==' as padding, never '==='
+    const paddingIndex = encoded.indexOf('=');
+    if (paddingIndex !== -1) {
+        const padding = encoded.substring(paddingIndex);
+        // Only allow '=' or '==' as valid padding (RFC 4648 compliant)
+        if (!/^={1,2}$/.test(padding)) {
+            throw new Error('Invalid base64 padding');
+        }
+        // Padding should only be at the end
+        if (paddingIndex < encoded.length - 2) {
+            throw new Error('Base64 padding must be at the end');
+        }
+    }
+    // Additional security check: prevent potential encoded JavaScript
+    // by looking for suspicious patterns that might indicate malicious content
+    const suspiciousPatterns = [
+        /eval/i,
+        /function/i,
+        /javascript:/i,
+        /<script/i,
+        /on\w+\s*=/i,
+        /__proto__/i,
+        /constructor/i,
+        /prototype/i
+    ];
+    // Decode a small portion to check for suspicious content
+    try {
+        const sampleSize = Math.min(100, encoded.length);
+        const sample = encoded.substring(0, sampleSize);
+        const sampleDecoded = typeof atob !== 'undefined'
+            ? atob(sample)
+            : Buffer.from(sample, 'base64').toString('utf8', 0, 50); // Only decode first 50 chars
+        for (const pattern of suspiciousPatterns) {
+            if (pattern.test(sampleDecoded)) {
+                throw new Error('Suspicious content detected in base64 input');
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('Suspicious content')) {
+            throw error;
+        }
+        // If decoding fails, continue - it might be invalid base64 which will be caught later
+    }
+}
+/**
+ * Polyfill for atob in Node.js with proper input validation
+ */
+function safeAtob(encoded) {
+    // Input validation and sanitization
+    validateBase64Input(encoded);
+    if (typeof atob !== 'undefined') {
+        try {
+            return atob(encoded);
+        }
+        catch {
+            throw new Error('Failed to decode base64 data');
+        }
+    }
+    // Node.js fallback with additional validation
+    if (isNodeEnvironment()) {
+        try {
+            // Use Buffer with explicit error handling
+            const buffer = Buffer.from(encoded, 'base64');
+            // Additional validation: ensure the decoded data is reasonable size
+            if (buffer.length > 5000000) { // 5MB limit for decoded data
+                throw new Error('Decoded base64 data is too large');
+            }
+            return buffer.toString('binary');
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('Invalid base64')) {
+                throw new Error('Invalid base64 format');
+            }
+            throw new Error('Failed to decode base64 data in Node.js environment');
+        }
+    }
+    throw new Error('Base64 decoding not supported in this environment');
+}
+/**
+ * Polyfill for btoa in Node.js
+ */
+function safeBtoa(str) {
+    if (typeof btoa !== 'undefined') {
+        return btoa(str);
+    }
+    // Node.js fallback
+    if (isNodeEnvironment()) {
+        return Buffer.from(str, 'binary').toString('base64');
+    }
+    throw new Error('Base64 encoding not supported in this environment');
+}
+
+/**
+ * Invert a codec, swapping encode and decode directions.
+ */
+function invertCodec(codec) {
+    return codec.invert();
+}
+// ===== STRING TO NUMBER CODECS =====
+/**
+ * String to number codec
+ */
+const stringToNumber = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_number.VldNumber.create(), {
+    decode: (str) => {
+        const num = Number(str);
+        if (isNaN(num))
+            throw new Error('Invalid number');
+        return num;
+    },
+    encode: (num) => num.toString()
+});
+/**
+ * String to integer codec
+ */
+const stringToInt = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_number.VldNumber.create().int(), {
+    decode: (str) => {
+        const num = parseInt(str, 10);
+        if (isNaN(num))
+            throw new Error('Invalid integer');
+        return num;
+    },
+    encode: (num) => Math.floor(num).toString()
+});
+/**
+ * String to BigInt codec
+ */
+const stringToBigInt = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_bigint.VldBigInt.create(), {
+    decode: (str) => {
+        try {
+            return BigInt(str);
+        }
+        catch {
+            throw new Error('Invalid BigInt');
+        }
+    },
+    encode: (bigint) => bigint.toString()
+});
+/**
+ * Number to BigInt codec
+ */
+const numberToBigInt = validators_codec.VldCodec.create(validators_number.VldNumber.create().int(), validators_bigint.VldBigInt.create(), {
+    decode: (num) => BigInt(Math.floor(num)),
+    encode: (bigint) => Number(bigint)
+});
+// ===== DATE CODECS =====
+/**
+ * ISO datetime string to Date codec
+ */
+const isoDatetimeToDate = validators_codec.VldCodec.create(validators_string.VldString.create().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z?$/, 'Invalid ISO datetime format'), validators_date.VldDate.create(), {
+    decode: (isoString) => {
+        const date = new Date(isoString);
+        if (isNaN(date.getTime()))
+            throw new Error('Invalid date');
+        return date;
+    },
+    encode: (date) => date.toISOString()
+});
+/**
+ * Epoch seconds to Date codec
+ */
+const epochSecondsToDate = validators_codec.VldCodec.create(validators_number.VldNumber.create(), validators_date.VldDate.create(), {
+    decode: (seconds) => new Date(seconds * 1000),
+    encode: (date) => Math.floor(date.getTime() / 1000)
+});
+/**
+ * Epoch milliseconds to Date codec
+ */
+const epochMillisToDate = validators_codec.VldCodec.create(validators_number.VldNumber.create(), validators_date.VldDate.create(), {
+    decode: (millis) => new Date(millis),
+    encode: (date) => date.getTime()
+});
+// ===== JSON CODEC =====
+/**
+ * JSON string codec for any type
+ */
+const jsonCodec = (schema) => {
+    const outputSchema = schema || validators_unknown.VldUnknown.create();
+    return validators_codec.VldCodec.create(validators_string.VldString.create(), outputSchema, {
+        decode: (jsonString) => {
+            try {
+                return JSON.parse(jsonString);
+            }
+            catch {
+                throw new Error('Invalid JSON');
+            }
+        },
+        encode: (data) => JSON.stringify(data)
+    });
+};
+// ===== URL CODECS =====
+/**
+ * String to URL codec
+ */
+const stringToURL = validators_codec.VldCodec.create(validators_string.VldString.create().url(), validators_unknown.VldUnknown.create(), // URL object
+{
+    decode: (urlString) => {
+        try {
+            return new URL(urlString);
+        }
+        catch {
+            throw new Error('Invalid URL');
+        }
+    },
+    encode: (url) => url.toString()
+});
+/**
+ * String to HTTP/HTTPS URL codec
+ */
+const stringToHttpURL = validators_codec.VldCodec.create(validators_string.VldString.create().regex(/^https?:\/\//, 'Must be HTTP or HTTPS URL'), validators_unknown.VldUnknown.create(), // URL object
+{
+    decode: (urlString) => {
+        try {
+            const url = new URL(urlString);
+            if (!['http:', 'https:'].includes(url.protocol)) {
+                throw new Error('Must be HTTP or HTTPS');
+            }
+            return url;
+        }
+        catch {
+            throw new Error('Invalid HTTP URL');
+        }
+    },
+    encode: (url) => url.toString()
+});
+/**
+ * URI component encode/decode codec
+ */
+const uriComponent = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_string.VldString.create(), {
+    decode: (encoded) => {
+        try {
+            return decodeURIComponent(encoded);
+        }
+        catch {
+            throw new Error('Invalid URI component');
+        }
+    },
+    encode: (decoded) => encodeURIComponent(decoded)
+});
+/**
+ * String to boolean codec
+ */
+const stringToBoolean = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_boolean.VldBoolean.create(), {
+    decode: (str) => {
+        const lower = str.toLowerCase();
+        if (lower === 'true' || lower === '1' || lower === 'yes' || lower === 'on')
+            return true;
+        if (lower === 'false' || lower === '0' || lower === 'no' || lower === 'off')
+            return false;
+        throw new Error('Invalid boolean string');
+    },
+    encode: (bool) => bool.toString()
+});
+// ===== EXISTING BYTE CODECS (updated) =====
+/**
+ * Base64 to Uint8Array codec
+ */
+const base64ToBytes = validators_codec.VldCodec.create(validators_base64.VldBase64.create(), validators_uint8array.VldUint8Array.create(), {
+    decode: base64ToUint8Array,
+    encode: uint8ArrayToBase64
+});
+/**
+ * URL-safe Base64 to Uint8Array codec
+ */
+const base64UrlToBytes = validators_codec.VldCodec.create(validators_base64.VldBase64.create().urlSafeMode(), validators_uint8array.VldUint8Array.create(), {
+    decode: base64ToUint8Array,
+    encode: uint8ArrayToBase64Url
+});
+/**
+ * Hexadecimal to Uint8Array codec
+ */
+const hexToBytes = validators_codec.VldCodec.create(validators_hex.VldHex.create(), validators_uint8array.VldUint8Array.create(), {
+    decode: hexToUint8Array,
+    encode: uint8ArrayToHex
+});
+/**
+ * Lowercase hexadecimal to Uint8Array codec
+ */
+const hexLowerToBytes = validators_codec.VldCodec.create(validators_hex.VldHex.create().lowercaseMode(), validators_uint8array.VldUint8Array.create(), {
+    decode: hexToUint8Array,
+    encode: (bytes) => uint8ArrayToHex(bytes).toLowerCase()
+});
+/**
+ * UTF-8 string to Uint8Array codec
+ */
+const utf8ToBytes = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_uint8array.VldUint8Array.create(), {
+    decode: stringToUint8Array,
+    encode: uint8ArrayToString
+});
+/**
+ * Uint8Array to UTF-8 string codec (reverse of utf8ToBytes)
+ */
+const bytesToUtf8 = validators_codec.VldCodec.create(validators_uint8array.VldUint8Array.create(), validators_string.VldString.create(), {
+    decode: uint8ArrayToString,
+    encode: stringToUint8Array
+});
+/**
+ * Base64URL to Uint8Array codec (updated)
+ */
+const base64urlToBytes = validators_codec.VldCodec.create(validators_base64.VldBase64.create().urlSafeMode(), validators_uint8array.VldUint8Array.create(), {
+    decode: base64ToUint8Array,
+    encode: uint8ArrayToBase64Url
+});
+/**
+ * Base64 encoded JSON codec (updated)
+ */
+const base64Json = (schema) => {
+    const outputSchema = schema || validators_unknown.VldUnknown.create();
+    return validators_codec.VldCodec.create(validators_base64.VldBase64.create(), outputSchema, {
+        decode: (base64) => {
+            // BUG-NPM-005 FIX: Add error handling for JSON parsing
+            try {
+                const jsonString = uint8ArrayToString(base64ToUint8Array(base64));
+                return JSON.parse(jsonString);
+            }
+            catch (error) {
+                throw new Error(`Failed to parse base64 JSON: ${error.message}`);
+            }
+        },
+        encode: (data) => {
+            const jsonString = JSON.stringify(data);
+            return uint8ArrayToBase64(stringToUint8Array(jsonString));
+        }
+    });
+};
+/**
+ * JWT payload decoder (base64url encoded JSON) - updated
+ */
+const jwtPayload = (schema) => {
+    const outputSchema = schema || validators_unknown.VldUnknown.create();
+    return validators_codec.VldCodec.create(validators_string.VldString.create().refine(s => s.split('.').length === 3, 'Invalid JWT format'), outputSchema, {
+        decode: (jwt) => {
+            // BUG-NPM-004 FIX: Add comprehensive error handling for JWT parsing
+            try {
+                const parts = jwt.split('.');
+                if (parts.length !== 3) {
+                    throw new Error('JWT must have exactly 3 parts');
+                }
+                const payloadBase64 = parts[1];
+                if (!payloadBase64) {
+                    throw new Error('JWT payload is empty');
+                }
+                // Convert base64url to base64
+                const base64 = payloadBase64
+                    .replace(/-/g, '+')
+                    .replace(/_/g, '/')
+                    .padEnd(payloadBase64.length + (4 - payloadBase64.length % 4) % 4, '=');
+                const jsonString = uint8ArrayToString(base64ToUint8Array(base64));
+                return JSON.parse(jsonString);
+            }
+            catch (error) {
+                throw new Error(`Failed to decode JWT payload: ${error.message}`);
+            }
+        },
+        encode: () => {
+            throw new Error('JWT encoding not supported - use a proper JWT library');
+        }
+    });
+};
+
+exports.base64Json = base64Json;
+exports.base64ToBytes = base64ToBytes;
+exports.base64ToUint8Array = base64ToUint8Array;
+exports.base64UrlToBytes = base64UrlToBytes;
+exports.base64urlToBytes = base64urlToBytes;
+exports.bytesToUtf8 = bytesToUtf8;
+exports.epochMillisToDate = epochMillisToDate;
+exports.epochSecondsToDate = epochSecondsToDate;
+exports.hexLowerToBytes = hexLowerToBytes;
+exports.hexToBytes = hexToBytes;
+exports.hexToUint8Array = hexToUint8Array;
+exports.invertCodec = invertCodec;
+exports.isoDatetimeToDate = isoDatetimeToDate;
+exports.jsonCodec = jsonCodec;
+exports.jwtPayload = jwtPayload;
+exports.numberToBigInt = numberToBigInt;
+exports.stringToBigInt = stringToBigInt;
+exports.stringToBoolean = stringToBoolean;
+exports.stringToHttpURL = stringToHttpURL;
+exports.stringToInt = stringToInt;
+exports.stringToNumber = stringToNumber;
+exports.stringToURL = stringToURL;
+exports.stringToUint8Array = stringToUint8Array;
+exports.uint8ArrayToBase64 = uint8ArrayToBase64;
+exports.uint8ArrayToBase64Url = uint8ArrayToBase64Url;
+exports.uint8ArrayToHex = uint8ArrayToHex;
+exports.uint8ArrayToString = uint8ArrayToString;
+exports.uriComponent = uriComponent;
+exports.utf8ToBytes = utf8ToBytes;

package/dist/cjs/chunks/index-Cc3bjUMX.cjs

@@ -0,0 +1,91 @@
+'use strict';
+
+var locales_runtime = require('../locales/runtime.cjs');
+var locales_en = require('../locales/en.cjs');
+var locales_tr = require('../locales/tr.cjs');
+var locales_es = require('../locales/es.cjs');
+var locales_fr = require('../locales/fr.cjs');
+var locales_de = require('../locales/de.cjs');
+var locales_it = require('../locales/it.cjs');
+var locales_pt = require('../locales/pt.cjs');
+var locales_ru = require('../locales/ru.cjs');
+var locales_ja = require('../locales/ja.cjs');
+var locales_ko = require('../locales/ko.cjs');
+var locales_zh = require('../locales/zh.cjs');
+var locales_ar = require('../locales/ar.cjs');
+var locales_hi = require('../locales/hi.cjs');
+var locales_nl = require('../locales/nl.cjs');
+var locales_pl = require('../locales/pl.cjs');
+var locales_da = require('../locales/da.cjs');
+var locales_sv = require('../locales/sv.cjs');
+var locales_no = require('../locales/no.cjs');
+var locales_fi = require('../locales/fi.cjs');
+var locales_th = require('../locales/th.cjs');
+var locales_vi = require('../locales/vi.cjs');
+var locales_id = require('../locales/id.cjs');
+var locales_bn = require('../locales/bn.cjs');
+var locales_sw = require('../locales/sw.cjs');
+var locales_af = require('../locales/af.cjs');
+var locales_ptBR = require('../locales/pt-BR.cjs');
+var locales_esMX = require('../locales/es-MX.cjs');
+
+const translatedLocaleCodes = [
+    'en', 'tr', 'es', 'fr', 'de', 'it', 'pt', 'ru', 'ja', 'ko', 'zh', 'ar', 'hi', 'nl', 'pl',
+    'da', 'sv', 'no', 'fi',
+    'th', 'vi', 'id', 'bn',
+    'sw', 'af',
+    'pt-BR', 'es-MX'
+];
+const fallbackLocaleCodes = [
+    'is', 'cs', 'sk', 'hu', 'ro', 'bg', 'hr', 'sl', 'lv', 'lt', 'et',
+    'el', 'mk', 'sq', 'sr', 'bs', 'me', 'mt', 'ga', 'cy', 'eu', 'ca',
+    'ms', 'tl', 'ur', 'fa', 'he', 'ka', 'am', 'hy', 'az', 'kk', 'ky',
+    'uz', 'tg', 'mn', 'my', 'km', 'lo', 'si', 'ta', 'te', 'ml', 'kn',
+    'gu', 'pa', 'or', 'as', 'ne', 'mr', 'sd', 'dv',
+    'ha', 'yo', 'ig', 'zu', 'xh', 'st', 'tn', 'ts', 've', 'nr', 'ss',
+    'es-AR', 'fr-CA', 'qu', 'gn', 'ay'
+];
+const translatedLocales = {
+    // Base languages
+    en: locales_en.en, tr: locales_tr.tr, es: locales_es.es, fr: locales_fr.fr, de: locales_de.de, it: locales_it.it, pt: locales_pt.pt, ru: locales_ru.ru, ja: locales_ja.ja, ko: locales_ko.ko, zh: locales_zh.zh, ar: locales_ar.ar, hi: locales_hi.hi, nl: locales_nl.nl, pl: locales_pl.pl,
+    // Major European Languages
+    da: locales_da.da, sv: locales_sv.sv, no: locales_no.no, fi: locales_fi.fi,
+    // Major Asian Languages  
+    th: locales_th.th, vi: locales_vi.vi, id: locales_id.id, bn: locales_bn.bn,
+    // African Languages
+    sw: locales_sw.sw, af: locales_af.af,
+    // American Languages
+    'pt-BR': locales_ptBR.ptBR,
+    'es-MX': locales_esMX.esMX,
+};
+for (const locale of translatedLocaleCodes) {
+    locales_runtime.registerLocale(locale, translatedLocales[locale]);
+}
+for (const locale of fallbackLocaleCodes) {
+    locales_runtime.registerFallbackLocale(locale);
+}
+/**
+ * Set the current locale asynchronously.
+ *
+ * The eager locale entrypoint already bundles translated locales and English
+ * fallbacks, so this mirrors setLocale() while preserving async API parity.
+ */
+async function setLocaleAsync(locale) {
+    locales_runtime.setLocale(locale);
+}
+
+var localeNamespace = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    getLocale: locales_runtime.getLocale,
+    getMessages: locales_runtime.getMessages,
+    getMessagesForLocale: locales_runtime.getMessagesForLocale,
+    getSupportedLocales: locales_runtime.getSupportedLocales,
+    isLocaleLoaded: locales_runtime.isLocaleLoaded,
+    isLocaleSupported: locales_runtime.isLocaleSupported,
+    registerLocale: locales_runtime.registerLocale,
+    setLocale: locales_runtime.setLocale,
+    setLocaleAsync: setLocaleAsync
+});
+
+exports.localeNamespace = localeNamespace;
+exports.setLocaleAsync = setLocaleAsync;

package/dist/cjs/chunks/security-Dc3Jh13T.cjs

@@ -0,0 +1,37 @@
+'use strict';
+
+/**
+ * Security utilities for prototype pollution protection
+ */
+/**
+ * Keys that, when written via `obj[key] = ...`, can mutate Object.prototype
+ * or alter property accessor behavior across the program.
+ *
+ * `__proto__`, `constructor`, `prototype` are the canonical prototype-pollution
+ * sinks. The `__define*Getter__` / `__lookup*Getter__` family installs accessors
+ * on the prototype chain in legacy engines.
+ *
+ * Note: keys such as `toString`, `valueOf`, or `hasOwnProperty` are NOT
+ * blocked. Those are legitimate property names that appear in real payloads
+ * (localization tables, custom widget config, generic key/value stores).
+ * Silently dropping them causes data loss; a validation library must not do
+ * that.
+ */
+const DANGEROUS_KEYS = new Set([
+    '__proto__',
+    'constructor',
+    'prototype',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+]);
+/**
+ * Return true if a property key would, if assigned, mutate the prototype
+ * chain or accessor behavior of the target object.
+ */
+function isDangerousKey(key) {
+    return DANGEROUS_KEYS.has(key);
+}
+
+exports.isDangerousKey = isDangerousKey;