@oxog/vld 2.0.2 → 2.1.0

package/dist/validators/index.d.ts

@@ -1,44 +1,44 @@
 /**
  * Main entry point for all validators
  */
-export { VldBase, ParseResult, VldRefine, VldTransform, VldDefault, VldCatch, VldOptional, VldNullable, VldNullish, VldPipe, VldReadonly, VldBrand, SuperRefineContext, VldSuperRefine, VldPreprocess } from './base';
-export { VldString } from './string';
-export { VldNumber } from './number';
-export { VldBoolean } from './boolean';
-export { VldDate } from './date';
-export { VldStringBool } from './string-bool';
-export { VldArray } from './array';
-export { VldObject } from './object';
-export { VldUnion } from './union';
-export { VldIntersection } from './intersection';
-export { VldLiteral } from './literal';
-export { VldEnum } from './enum';
-export { VldTuple } from './tuple';
-export { VldRecord } from './record';
-export { VldSet } from './set';
-export { VldMap } from './map';
-export { VldBigInt } from './bigint';
-export { VldSymbol } from './symbol';
-export { VldAny } from './any';
-export { VldUnknown } from './unknown';
-export { VldVoid } from './void';
-export { VldNever } from './never';
-export { VldNull } from './null';
-export { VldUndefined } from './undefined';
-export { VldNan } from './nan';
-export { VldLazy } from './lazy';
-export { VldDiscriminatedUnion } from './discriminated-union';
-export { VldXor } from './xor';
-export { VldJson } from './json';
-export { VldTemplateLiteral, templateLiteral } from './template-literal';
-export { VldCustom, custom } from './custom';
-export type { CustomValidatorOptions } from './custom';
-export { VldFile, file } from './file';
-export type { VldFileValue } from './file';
-export { VldFunction, functionValidator } from './function';
-export { email, uuid, uuidv4, hostname, emoji, base64, base64url, hex, jwt, nanoid, cuid, cuid2, ulid, ipv4, ipv6, mac, cidrv4, e164, hash, iso, stringFormat, regexes } from './string-formats';
-import { VldBase } from './base';
+export { VldBase, ParseResult, VldRefine, VldTransform, VldDefault, VldCatch, VldOptional, VldExactOptional, VldNullable, VldNullish, VldPipe, VldReadonly, VldBrand, SuperRefineContext, VldSuperRefine, VldPreprocess } from './base.js';
+export { VldString } from './string.js';
+export { VldNumber } from './number.js';
+export { VldBoolean } from './boolean.js';
+export { VldDate } from './date.js';
+export { VldStringBool } from './string-bool.js';
+export { VldArray } from './array.js';
+export { VldObject } from './object.js';
+export { VldUnion } from './union.js';
+export { VldIntersection } from './intersection.js';
+export { VldLiteral } from './literal.js';
+export { VldEnum } from './enum.js';
+export { VldTuple } from './tuple.js';
+export { VldRecord } from './record.js';
+export { VldSet } from './set.js';
+export { VldMap } from './map.js';
+export { VldBigInt } from './bigint.js';
+export { VldSymbol } from './symbol.js';
+export { VldAny } from './any.js';
+export { VldUnknown } from './unknown.js';
+export { VldVoid } from './void.js';
+export { VldNever } from './never.js';
+export { VldNull } from './null.js';
+export { VldUndefined } from './undefined.js';
+export { VldNan } from './nan.js';
+export { VldLazy } from './lazy.js';
+export { VldDiscriminatedUnion } from './discriminated-union.js';
+export { VldXor } from './xor.js';
+export { VldJson } from './json.js';
+export { VldTemplateLiteral, templateLiteral } from './template-literal.js';
+export { VldCustom, custom } from './custom.js';
+export type { CustomValidatorOptions } from './custom.js';
+export { VldFile, file } from './file.js';
+export type { VldFileValue } from './file.js';
+export { VldFunction, functionValidator } from './function.js';
+export { VldPromise, promise } from './promise.js';
+export { email, uuid, uuidv4, hostname, emoji, base64, base64url, hex, jwt, nanoid, cuid, cuid2, ulid, ipv4, ipv6, mac, cidrv4, cidrv6, e164, hash, iso, stringFormat, regexes, xid, guid, httpUrl } from './string-formats.js';
+import { VldBase } from './base.js';
 export type Infer<T extends VldBase<any, any>> = T extends VldBase<any, infer U> ? U : never;
 export type Input<T extends VldBase<any, any>> = T extends VldBase<infer I, any> ? I : never;
 export type Output<T extends VldBase<any, any>> = T extends VldBase<any, infer O> ? O : never;
-//# sourceMappingURL=index.d.ts.map

package/dist/validators/index.js

@@ -1,5 +1,35 @@
-export { i as VldBase, d as VldBigInt, b as VldBoolean, p as VldBrand, m as VldCatch, c as VldDate, l as VldDefault, f as VldNullable, g as VldNullish, a as VldNumber, e as VldOptional, n as VldPipe, h as VldPreprocess, o as VldReadonly, j as VldRefine, V as VldString, q as VldSuperRefine, k as VldTransform } from '../chunks/bigint-DgsCr2dC.js';
-export { n as VldAny, b as VldArray, j as VldDiscriminatedUnion, m as VldEnum, i as VldIntersection, u as VldJson, t as VldLazy, l as VldLiteral, g as VldMap, s as VldNan, p as VldNever, q as VldNull, c as VldObject, e as VldRecord, f as VldSet, a as VldStringBool, V as VldSymbol, d as VldTuple, r as VldUndefined, h as VldUnion, o as VldVoid, k as VldXor } from '../chunks/json-o20GFhTh.js';
-export { V as VldUnknown } from '../chunks/unknown-SLIH1VCf.js';
-export { A as VldCustom, B as VldFile, C as VldFunction, V as VldTemplateLiteral, o as base64, l as base64url, a as cidrv4, g as cuid, f as cuid2, z as custom, e as e164, w as email, p as emoji, y as file, x as functionValidator, h as hash, k as hex, q as hostname, d as ipv4, b as ipv6, i as iso, j as jwt, m as mac, n as nanoid, R as regexes, s as stringFormat, t as templateLiteral, u as ulid, v as uuid, r as uuidv4 } from '../chunks/index-BZqWZvVe.js';
-//# sourceMappingURL=index.js.map
+export { VldBase, VldBrand, VldCatch, VldDefault, VldExactOptional, VldNullable, VldNullish, VldOptional, VldPipe, VldPreprocess, VldReadonly, VldRefine, VldSuperRefine, VldTransform } from './base.js';
+export { V as VldString } from '../chunks/string-BJRQod3t.js';
+export { VldNumber } from './number.js';
+export { VldBoolean } from './boolean.js';
+export { VldDate } from './date.js';
+export { VldStringBool } from './string-bool.js';
+export { VldArray } from './array.js';
+export { VldObject } from './object.js';
+export { VldUnion } from './union.js';
+export { VldIntersection } from './intersection.js';
+export { VldLiteral } from './literal.js';
+export { VldEnum } from './enum.js';
+export { VldTuple } from './tuple.js';
+export { VldRecord } from './record.js';
+export { VldSet } from './set.js';
+export { VldMap } from './map.js';
+export { VldBigInt } from './bigint.js';
+export { VldSymbol } from './symbol.js';
+export { VldAny } from './any.js';
+export { VldUnknown } from './unknown.js';
+export { VldVoid } from './void.js';
+export { VldNever } from './never.js';
+export { VldNull } from './null.js';
+export { VldUndefined } from './undefined.js';
+export { VldNan } from './nan.js';
+export { VldLazy } from './lazy.js';
+export { VldDiscriminatedUnion } from './discriminated-union.js';
+export { VldXor } from './xor.js';
+export { VldJson } from './json.js';
+export { VldTemplateLiteral, templateLiteral } from './template-literal.js';
+export { VldCustom, custom } from './custom.js';
+export { VldFile, file } from './file.js';
+export { VldFunction, functionValidator } from './function.js';
+export { VldPromise, promise } from './promise.js';
+export { base64, base64url, cidrv4, cidrv6, cuid, cuid2, e164, email, emoji, guid, hash, hex, hostname, httpUrl, ipv4, ipv6, iso, jwt, mac, nanoid, regexes, stringFormat, ulid, uuid, uuidv4, xid } from './string-formats.js';

package/dist/validators/intersection.d.ts

@@ -1,4 +1,4 @@
-import { VldBase, ParseResult } from './base';
+import { VldBase, ParseResult } from './base.js';
 /**
  * Immutable intersection validator for combining validators
  */
@@ -22,4 +22,3 @@ export declare class VldIntersection<A, B> extends VldBase<unknown, A & B> {
      */
     safeParse(value: unknown): ParseResult<A & B>;
 }
-//# sourceMappingURL=intersection.d.ts.map

package/dist/validators/intersection.js

@@ -0,0 +1,116 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+import { i as isDangerousKey } from '../chunks/security-B0Pd_vSY.js';
+import { getMessages } from '../locales/runtime.js';
+import { V as VldError } from '../chunks/errors-core-BeiFUtZM.js';
+
+/**
+ * Type guard to check if a value is a plain object
+ */
+function isPlainObject(obj) {
+    return (obj !== null &&
+        typeof obj === 'object' &&
+        obj.constructor === Object &&
+        Object.prototype.toString.call(obj) === '[object Object]');
+}
+/**
+ * Safely deep merge two objects without prototype pollution vulnerability
+ * Optimized for performance with minimal object allocations
+ * BUG-NEW-020 FIX: Use comprehensive dangerous key protection from shared utility
+ * @param target The target object
+ * @param source The source object to merge from
+ * @returns A new merged object
+ */
+function deepMerge(target, source) {
+    // Create a new object to avoid mutations (only once)
+    const result = { ...target };
+    // Get source keys directly for better performance
+    const sourceKeys = Object.keys(source);
+    for (let i = 0; i < sourceKeys.length; i++) {
+        const key = sourceKeys[i];
+        // Skip dangerous keys that could lead to prototype pollution
+        if (isDangerousKey(key)) {
+            continue;
+        }
+        // Only process own properties (redundant with Object.keys but safe)
+        if (!Object.prototype.hasOwnProperty.call(source, key)) {
+            continue;
+        }
+        const sourceValue = source[key];
+        const targetValue = target[key];
+        // If both values are plain objects, merge them recursively
+        if (isPlainObject(sourceValue) && isPlainObject(targetValue)) {
+            result[key] = deepMerge(targetValue, sourceValue);
+        }
+        else {
+            // Otherwise, use the source value (including undefined)
+            result[key] = sourceValue;
+        }
+    }
+    return result;
+}
+
+function createIntersectionError(message) {
+    return new VldError([{ code: 'invalid_type', path: [], message }]);
+}
+/**
+ * Immutable intersection validator for combining validators
+ */
+class VldIntersection extends VldBase {
+    /**
+     * Private constructor to enforce immutability
+     */
+    constructor(validatorA, validatorB) {
+        super(VLD_VALIDATOR_TYPES.INTERSECTION);
+        this.validatorA = validatorA;
+        this.validatorB = validatorB;
+    }
+    /**
+     * Create a new intersection validator
+     */
+    static create(validatorA, validatorB) {
+        return new VldIntersection(validatorA, validatorB);
+    }
+    /**
+     * Parse and validate a value against both validators
+     */
+    parse(value) {
+        try {
+            // Both validators must pass
+            const resultA = this.validatorA.parse(value);
+            const resultB = this.validatorB.parse(value);
+            // BUG-NEW-015 FIX: Check type consistency before merging
+            const aIsObject = isPlainObject(resultA);
+            const bIsObject = isPlainObject(resultB);
+            // Both are objects - safe to merge
+            if (aIsObject && bIsObject) {
+                return deepMerge(resultA, resultB);
+            }
+            // Neither are objects - must be identical primitives
+            if (!aIsObject && !bIsObject) {
+                if (resultA === resultB) {
+                    return resultA;
+                }
+                throw new Error('Values must be identical for intersection of primitive types');
+            }
+            // One is object, one is primitive - invalid intersection
+            throw new Error('Cannot create intersection of object and primitive types. ' +
+                'Both validators must produce the same type category.');
+        }
+        catch (error) {
+            throw new Error(getMessages().intersectionError(error.message));
+        }
+    }
+    /**
+     * Safely parse and validate a value against both validators
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: createIntersectionError(error.message) };
+        }
+    }
+}
+
+export { VldIntersection };

package/dist/validators/json.d.ts

@@ -1,4 +1,4 @@
-import { VldBase, ParseResult } from './base';
+import { VldBase, ParseResult } from './base.js';
 /**
  * Immutable JSON validator that validates and parses JSON strings
  * Accepts both strings (which are parsed) and already-parsed objects
@@ -23,4 +23,3 @@ export declare class VldJson<T = unknown> extends VldBase<unknown, T> {
      */
     withSchema<U>(schema: VldBase<unknown, U>): VldJson<U>;
 }
-//# sourceMappingURL=json.d.ts.map

package/dist/validators/json.js

@@ -0,0 +1,66 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+import { getMessages } from '../locales/runtime.js';
+
+/**
+ * Immutable JSON validator that validates and parses JSON strings
+ * Accepts both strings (which are parsed) and already-parsed objects
+ */
+class VldJson extends VldBase {
+    constructor(schema) {
+        super(VLD_VALIDATOR_TYPES.JSON);
+        this.schema = schema;
+    }
+    /**
+     * Create a new JSON validator
+     */
+    static create(schema) {
+        return new VldJson(schema);
+    }
+    /**
+     * Parse and validate a JSON value
+     */
+    parse(value) {
+        let parsed;
+        // If it's a string, try to parse it as JSON first
+        if (typeof value === 'string') {
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch {
+                throw new Error(getMessages().invalidJson);
+            }
+        }
+        else {
+            // Not a string - assume it's already parsed
+            parsed = value;
+        }
+        // If we have a schema, validate against it
+        if (this.schema) {
+            return this.schema.parse(parsed);
+        }
+        // No schema - just return the parsed value
+        return parsed;
+    }
+    /**
+     * Safely parse and validate a JSON value
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error
+            };
+        }
+    }
+    /**
+     * Create a new JSON validator with a schema for validation
+     */
+    withSchema(schema) {
+        return new VldJson(schema);
+    }
+}
+
+export { VldJson };

package/dist/validators/lazy.d.ts

@@ -3,25 +3,22 @@
  * Part of Zod 4 API parity implementation
  * Allows schemas that reference themselves (e.g., tree structures, nested categories)
  */
-import { VldBase } from './base';
-import type { ParseResult } from './base';
+import { VldBase } from './base.js';
+import type { ParseResult } from './base.js';
 /**
  * Lazy validator - defers schema evaluation until runtime
  * Essential for recursive and self-referencing types
  *
- * MEMORY OPTIMIZATION: Uses WeakRef for the cached schema to allow garbage collection
- * when the validator is no longer in use. This prevents memory leaks in long-running
- * applications with dynamically created schemas.
+ * Caches the resolved schema after first use. This keeps recursive schemas stable
+ * and avoids re-running the schema getter on hot parse paths.
  */
 export declare class VldLazy<TInput, TOutput> extends VldBase<TInput, TOutput> {
     private readonly _schemaGetter;
-    private _cachedSchemaRef;
-    private _strongRef;
+    private _cachedSchema;
     private constructor();
     static create<TInput, TOutput>(schemaGetter: () => VldBase<TInput, TOutput>): VldLazy<TInput, TOutput>;
     /**
      * Get the actual schema, caching it after first retrieval
-     * Uses WeakRef to allow garbage collection when validator is not in use
      */
     private _getSchema;
     /**
@@ -32,4 +29,3 @@ export declare class VldLazy<TInput, TOutput> extends VldBase<TInput, TOutput> {
     parse(value: unknown): TOutput;
     safeParse(value: unknown): ParseResult<TOutput>;
 }
-//# sourceMappingURL=lazy.d.ts.map

package/dist/validators/lazy.js

@@ -0,0 +1,50 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+
+/**
+ * VldLazy - Lazy evaluation for recursive schemas
+ * Part of Zod 4 API parity implementation
+ * Allows schemas that reference themselves (e.g., tree structures, nested categories)
+ */
+/**
+ * Lazy validator - defers schema evaluation until runtime
+ * Essential for recursive and self-referencing types
+ *
+ * Caches the resolved schema after first use. This keeps recursive schemas stable
+ * and avoids re-running the schema getter on hot parse paths.
+ */
+class VldLazy extends VldBase {
+    constructor(_schemaGetter) {
+        super(VLD_VALIDATOR_TYPES.LAZY);
+        this._schemaGetter = _schemaGetter;
+        this._cachedSchema = null;
+    }
+    static create(schemaGetter) {
+        return new VldLazy(schemaGetter);
+    }
+    /**
+     * Get the actual schema, caching it after first retrieval
+     */
+    _getSchema() {
+        if (this._cachedSchema) {
+            return this._cachedSchema;
+        }
+        const schema = this._schemaGetter();
+        this._cachedSchema = schema;
+        return schema;
+    }
+    /**
+     * Get the inner schema (unwrap)
+     * Returns a strong reference that will keep the schema alive
+     */
+    unwrap() {
+        return this._getSchema();
+    }
+    parse(value) {
+        return this._getSchema().parse(value);
+    }
+    safeParse(value) {
+        return this._getSchema().safeParse(value);
+    }
+}
+
+export { VldLazy };

package/dist/validators/literal.d.ts

@@ -1,4 +1,4 @@
-import { VldBase, ParseResult } from './base';
+import { VldBase, ParseResult } from './base.js';
 /**
  * Immutable literal validator for exact value matching
  */
@@ -13,6 +13,7 @@ export declare class VldLiteral<T extends string | number | boolean | null | und
      * Get the literal value
      */
     get literal(): T;
+    get isSimple(): boolean;
     /**
      * Create a new literal validator
      */
@@ -26,4 +27,3 @@ export declare class VldLiteral<T extends string | number | boolean | null | und
      */
     safeParse(value: unknown): ParseResult<T>;
 }
-//# sourceMappingURL=literal.d.ts.map

package/dist/validators/literal.js

@@ -0,0 +1,60 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+import { getMessages } from '../locales/runtime.js';
+import { V as VldError } from '../chunks/errors-core-BeiFUtZM.js';
+
+function createLiteralError(message) {
+    return new VldError([{ code: 'invalid_literal', path: [], message }]);
+}
+/**
+ * Immutable literal validator for exact value matching
+ */
+class VldLiteral extends VldBase {
+    /**
+     * Private constructor to enforce immutability
+     */
+    constructor(_literal, errorMessage) {
+        super(VLD_VALIDATOR_TYPES.LITERAL);
+        this._literal = _literal;
+        this.errorMessage = errorMessage;
+    }
+    /**
+     * Get the literal value
+     */
+    get literal() {
+        return this._literal;
+    }
+    get isSimple() {
+        return true;
+    }
+    /**
+     * Create a new literal validator
+     */
+    static create(literal) {
+        return new VldLiteral(literal);
+    }
+    /**
+     * Parse and validate a literal value
+     */
+    parse(value) {
+        if (value !== this._literal) {
+            throw new Error(this.errorMessage ||
+                getMessages().literalExpected(JSON.stringify(this._literal), JSON.stringify(value)));
+        }
+        return this._literal;
+    }
+    /**
+     * Safely parse and validate a literal value
+     */
+    safeParse(value) {
+        if (value === this._literal) {
+            return { success: true, data: this._literal };
+        }
+        return {
+            success: false,
+            error: createLiteralError(this.errorMessage ||
+                getMessages().literalExpected(JSON.stringify(this._literal), JSON.stringify(value)))
+        };
+    }
+}
+
+export { VldLiteral };

package/dist/validators/map.d.ts

@@ -1,4 +1,4 @@
-import { VldBase, ParseResult } from './base';
+import { VldBase, ParseResult } from './base.js';
 /**
  * Immutable Map validator
  */
@@ -10,17 +10,30 @@ export declare class VldMap<K, V> extends VldBase<unknown, Map<K, V>> {
      * Private constructor to enforce immutability
      */
     private constructor();
+    private readonly _simpleKeyMode;
+    private readonly _simpleValueMode;
+    private readonly _simpleKeyValue;
+    private readonly _simpleValueValue;
+    get keySchema(): VldBase<unknown, K>;
+    get valueSchema(): VldBase<unknown, V>;
     /**
      * Create a new Map validator
      */
     static create<K, V>(keyValidator: VldBase<unknown, K>, valueValidator: VldBase<unknown, V>): VldMap<K, V>;
+    private getSimpleItemMode;
+    private getSimpleItemError;
+    private parseSimpleItem;
     /**
      * Parse and validate a Map value
      */
     parse(value: unknown): Map<K, V>;
+    /**
+     * Parse a value that has already passed the Map instance guard.
+     * @internal Used by object validators to avoid duplicate hot-path checks.
+     */
+    parseKnownMap(value: Map<unknown, unknown>): Map<K, V>;
     /**
      * Safely parse and validate a Map value
      */
     safeParse(value: unknown): ParseResult<Map<K, V>>;
 }
-//# sourceMappingURL=map.d.ts.map