@oxog/vld 2.0.3 → 2.1.0

package/dist/cjs/validators/file.cjs

@@ -0,0 +1,130 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+var locales_runtime = require('../locales/runtime.cjs');
+var errorsCore = require('../chunks/errors-core-DWxLFs2f.cjs');
+require('../registry.cjs');
+require('../locales/en.cjs');
+
+function createFileError(message) {
+    return new errorsCore.VldError([{ code: 'invalid_type', path: [], message }]);
+}
+/**
+ * Immutable file validator for file uploads
+ * Supports size and MIME type validation
+ */
+class VldFile extends validators_base.VldBase {
+    constructor(checks = []) {
+        super(validators_base.VLD_VALIDATOR_TYPES.FILE);
+        this.checks = checks;
+    }
+    /**
+     * Create a new file validator
+     */
+    static create() {
+        return new VldFile();
+    }
+    isFileLike(value) {
+        if (typeof value !== 'object' || value === null) {
+            return false;
+        }
+        if (typeof File !== 'undefined' && value instanceof File) {
+            return true;
+        }
+        return 'size' in value && 'type' in value;
+    }
+    /**
+     * Parse and validate a file value
+     */
+    parse(value) {
+        if (this.isFileLike(value)) {
+            return this.parseKnownFile(value);
+        }
+        if (typeof File === 'undefined') {
+            throw new Error(locales_runtime.getMessages().fileNotSupported || 'File API not supported in this environment');
+        }
+        throw new Error(locales_runtime.getMessages().invalidFile || 'Expected a File object');
+    }
+    /**
+     * Parse a value that has already passed the file-like type guard.
+     * @internal Used by object validators to avoid duplicate hot-path checks.
+     */
+    parseKnownFile(value) {
+        return this.runChecks(value);
+    }
+    /**
+     * Run all validation checks on the file
+     */
+    runChecks(file) {
+        const msgs = locales_runtime.getMessages();
+        for (const check of this.checks) {
+            switch (check.type) {
+                case 'min':
+                    if (file.size < check.value) {
+                        throw new Error(check.message ||
+                            (msgs.fileMinSize?.(check.value) || `File size must be at least ${check.value} bytes`));
+                    }
+                    break;
+                case 'max':
+                    if (file.size > check.value) {
+                        throw new Error(check.message ||
+                            (msgs.fileMaxSize?.(check.value) || `File size must not exceed ${check.value} bytes`));
+                    }
+                    break;
+                case 'mime':
+                    if (!check.value.includes(file.type)) {
+                        throw new Error(check.message ||
+                            (msgs.fileMimeType?.(check.value) || `Invalid file type. Expected: ${check.value.join(', ')}`));
+                    }
+                    break;
+            }
+        }
+        return file;
+    }
+    /**
+     * Safely parse and validate a file value
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: createFileError(error.message) };
+        }
+    }
+    /**
+     * Set minimum file size in bytes
+     */
+    min(bytes, message) {
+        return new VldFile([...this.checks, { type: 'min', value: bytes, message }]);
+    }
+    /**
+     * Set maximum file size in bytes
+     */
+    max(bytes, message) {
+        return new VldFile([...this.checks, { type: 'max', value: bytes, message }]);
+    }
+    /**
+     * Set allowed MIME types
+     */
+    mime(types, message) {
+        const typeArray = Array.isArray(types) ? types : [types];
+        return new VldFile([...this.checks, { type: 'mime', value: typeArray, message }]);
+    }
+    /**
+     * Set both minimum and maximum file size
+     */
+    size(min, max, message) {
+        return this.min(min, message).max(max, message);
+    }
+}
+/**
+ * Helper function to create file validators
+ * Usage: v.file().min(1024).max(10485760).mime(['image/jpeg', 'image/png'])
+ */
+function file() {
+    return VldFile.create();
+}
+
+exports.VldFile = VldFile;
+exports.file = file;

package/dist/cjs/validators/function.cjs

@@ -0,0 +1,63 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+var locales_runtime = require('../locales/runtime.cjs');
+var errorsCore = require('../chunks/errors-core-DWxLFs2f.cjs');
+require('../registry.cjs');
+require('../locales/en.cjs');
+
+function createFunctionError(message) {
+    return new errorsCore.VldError([{ code: 'invalid_type', path: [], message }]);
+}
+/**
+ * Immutable function validator
+ * Validates that a value is a function
+ */
+class VldFunction extends validators_base.VldBase {
+    constructor() {
+        super(validators_base.VLD_VALIDATOR_TYPES.FUNCTION);
+    }
+    /**
+     * Create a new function validator
+     */
+    static create() {
+        return new VldFunction();
+    }
+    /**
+     * Parse and validate a function value
+     */
+    parse(value) {
+        if (typeof value !== 'function') {
+            throw new Error(locales_runtime.getMessages().invalidFunction || 'Expected a function');
+        }
+        return value;
+    }
+    /**
+     * Parse a value that has already passed the function type guard.
+     * @internal Used by object validators to avoid duplicate hot-path checks.
+     */
+    parseKnownFunction(value) {
+        return value;
+    }
+    /**
+     * Safely parse and validate a function value
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: createFunctionError(error.message) };
+        }
+    }
+}
+/**
+ * Helper function to create function validators
+ * Usage: v.function()
+ */
+function functionValidator() {
+    return VldFunction.create();
+}
+
+exports.VldFunction = VldFunction;
+exports.functionValidator = functionValidator;

package/dist/cjs/validators/hex.cjs

@@ -0,0 +1,70 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+var errors = require('../errors.cjs');
+var locales_runtime = require('../locales/runtime.cjs');
+var errorsCore = require('../chunks/errors-core-DWxLFs2f.cjs');
+require('../registry.cjs');
+require('../pigment.cjs');
+require('../locales/en.cjs');
+
+/**
+ * Hexadecimal string validator
+ */
+class VldHex extends validators_base.VldBase {
+    constructor(lowercase = false) {
+        super(validators_base.VLD_VALIDATOR_TYPES.HEX);
+        this.lowercase = lowercase;
+    }
+    parse(value) {
+        const result = this.safeParse(value);
+        if (!result.success) {
+            throw result.error;
+        }
+        return result.data;
+    }
+    safeParse(value) {
+        if (typeof value !== 'string') {
+            return {
+                success: false,
+                error: new errorsCore.VldError([
+                    errors.createIssue('invalid_type', [], locales_runtime.getMessages().expectedString)
+                ])
+            };
+        }
+        // Check if it's a valid hex string
+        if (!VldHex.HEX_REGEX.test(value)) {
+            return {
+                success: false,
+                error: new errorsCore.VldError([
+                    errors.createIssue('custom', [], locales_runtime.getMessages().invalidHex)
+                ])
+            };
+        }
+        // Check if even length (full bytes)
+        if (value.length % 2 !== 0) {
+            return {
+                success: false,
+                error: new errorsCore.VldError([
+                    errors.createIssue('custom', [], locales_runtime.getMessages().invalidHex)
+                ])
+            };
+        }
+        // Normalize case if required
+        const normalizedValue = this.lowercase ? value.toLowerCase() : value;
+        return { success: true, data: normalizedValue };
+    }
+    /**
+     * Require lowercase hex characters
+     */
+    lowercaseMode() {
+        return new VldHex(true);
+    }
+    static create(lowercase = false) {
+        return new VldHex(lowercase);
+    }
+}
+// BUG-008 FIX: Use * instead of + to allow empty hex strings (consistent with base64 validator)
+VldHex.HEX_REGEX = /^[0-9a-fA-F]*$/;
+
+exports.VldHex = VldHex;

package/dist/cjs/validators/index.cjs

@@ -0,0 +1,123 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+var validators_string = require('../chunks/string-BKZrc4hs.cjs');
+var validators_number = require('./number.cjs');
+var validators_boolean = require('./boolean.cjs');
+var validators_date = require('./date.cjs');
+var validators_stringBool = require('./string-bool.cjs');
+var validators_array = require('./array.cjs');
+var validators_object = require('./object.cjs');
+var validators_union = require('./union.cjs');
+var validators_intersection = require('./intersection.cjs');
+var validators_literal = require('./literal.cjs');
+var validators_enum = require('./enum.cjs');
+var validators_tuple = require('./tuple.cjs');
+var validators_record = require('./record.cjs');
+var validators_set = require('./set.cjs');
+var validators_map = require('./map.cjs');
+var validators_bigint = require('./bigint.cjs');
+var validators_symbol = require('./symbol.cjs');
+var validators_any = require('./any.cjs');
+var validators_unknown = require('./unknown.cjs');
+var validators_void = require('./void.cjs');
+var validators_never = require('./never.cjs');
+var validators_null = require('./null.cjs');
+var validators_undefined = require('./undefined.cjs');
+var validators_nan = require('./nan.cjs');
+var validators_lazy = require('./lazy.cjs');
+var validators_discriminatedUnion = require('./discriminated-union.cjs');
+var validators_xor = require('./xor.cjs');
+var validators_json = require('./json.cjs');
+var validators_templateLiteral = require('./template-literal.cjs');
+var validators_custom = require('./custom.cjs');
+var validators_file = require('./file.cjs');
+var validators_function = require('./function.cjs');
+var validators_promise = require('./promise.cjs');
+var validators_stringFormats = require('./string-formats.cjs');
+require('../registry.cjs');
+require('../locales/runtime.cjs');
+require('../locales/en.cjs');
+require('../chunks/errors-core-DWxLFs2f.cjs');
+require('../chunks/security-Dc3Jh13T.cjs');
+
+
+
+exports.VldBase = validators_base.VldBase;
+exports.VldBrand = validators_base.VldBrand;
+exports.VldCatch = validators_base.VldCatch;
+exports.VldDefault = validators_base.VldDefault;
+exports.VldExactOptional = validators_base.VldExactOptional;
+exports.VldNullable = validators_base.VldNullable;
+exports.VldNullish = validators_base.VldNullish;
+exports.VldOptional = validators_base.VldOptional;
+exports.VldPipe = validators_base.VldPipe;
+exports.VldPreprocess = validators_base.VldPreprocess;
+exports.VldReadonly = validators_base.VldReadonly;
+exports.VldRefine = validators_base.VldRefine;
+exports.VldSuperRefine = validators_base.VldSuperRefine;
+exports.VldTransform = validators_base.VldTransform;
+exports.VldString = validators_string.VldString;
+exports.VldNumber = validators_number.VldNumber;
+exports.VldBoolean = validators_boolean.VldBoolean;
+exports.VldDate = validators_date.VldDate;
+exports.VldStringBool = validators_stringBool.VldStringBool;
+exports.VldArray = validators_array.VldArray;
+exports.VldObject = validators_object.VldObject;
+exports.VldUnion = validators_union.VldUnion;
+exports.VldIntersection = validators_intersection.VldIntersection;
+exports.VldLiteral = validators_literal.VldLiteral;
+exports.VldEnum = validators_enum.VldEnum;
+exports.VldTuple = validators_tuple.VldTuple;
+exports.VldRecord = validators_record.VldRecord;
+exports.VldSet = validators_set.VldSet;
+exports.VldMap = validators_map.VldMap;
+exports.VldBigInt = validators_bigint.VldBigInt;
+exports.VldSymbol = validators_symbol.VldSymbol;
+exports.VldAny = validators_any.VldAny;
+exports.VldUnknown = validators_unknown.VldUnknown;
+exports.VldVoid = validators_void.VldVoid;
+exports.VldNever = validators_never.VldNever;
+exports.VldNull = validators_null.VldNull;
+exports.VldUndefined = validators_undefined.VldUndefined;
+exports.VldNan = validators_nan.VldNan;
+exports.VldLazy = validators_lazy.VldLazy;
+exports.VldDiscriminatedUnion = validators_discriminatedUnion.VldDiscriminatedUnion;
+exports.VldXor = validators_xor.VldXor;
+exports.VldJson = validators_json.VldJson;
+exports.VldTemplateLiteral = validators_templateLiteral.VldTemplateLiteral;
+exports.templateLiteral = validators_templateLiteral.templateLiteral;
+exports.VldCustom = validators_custom.VldCustom;
+exports.custom = validators_custom.custom;
+exports.VldFile = validators_file.VldFile;
+exports.file = validators_file.file;
+exports.VldFunction = validators_function.VldFunction;
+exports.functionValidator = validators_function.functionValidator;
+exports.VldPromise = validators_promise.VldPromise;
+exports.promise = validators_promise.promise;
+exports.base64 = validators_stringFormats.base64;
+exports.base64url = validators_stringFormats.base64url;
+exports.cidrv4 = validators_stringFormats.cidrv4;
+exports.cidrv6 = validators_stringFormats.cidrv6;
+exports.cuid = validators_stringFormats.cuid;
+exports.cuid2 = validators_stringFormats.cuid2;
+exports.e164 = validators_stringFormats.e164;
+exports.email = validators_stringFormats.email;
+exports.emoji = validators_stringFormats.emoji;
+exports.guid = validators_stringFormats.guid;
+exports.hash = validators_stringFormats.hash;
+exports.hex = validators_stringFormats.hex;
+exports.hostname = validators_stringFormats.hostname;
+exports.httpUrl = validators_stringFormats.httpUrl;
+exports.ipv4 = validators_stringFormats.ipv4;
+exports.ipv6 = validators_stringFormats.ipv6;
+exports.iso = validators_stringFormats.iso;
+exports.jwt = validators_stringFormats.jwt;
+exports.mac = validators_stringFormats.mac;
+exports.nanoid = validators_stringFormats.nanoid;
+exports.regexes = validators_stringFormats.regexes;
+exports.stringFormat = validators_stringFormats.stringFormat;
+exports.ulid = validators_stringFormats.ulid;
+exports.uuid = validators_stringFormats.uuid;
+exports.uuidv4 = validators_stringFormats.uuidv4;
+exports.xid = validators_stringFormats.xid;

package/dist/cjs/validators/intersection.cjs

@@ -0,0 +1,120 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+var security = require('../chunks/security-Dc3Jh13T.cjs');
+var locales_runtime = require('../locales/runtime.cjs');
+var errorsCore = require('../chunks/errors-core-DWxLFs2f.cjs');
+require('../registry.cjs');
+require('../locales/en.cjs');
+
+/**
+ * Type guard to check if a value is a plain object
+ */
+function isPlainObject(obj) {
+    return (obj !== null &&
+        typeof obj === 'object' &&
+        obj.constructor === Object &&
+        Object.prototype.toString.call(obj) === '[object Object]');
+}
+/**
+ * Safely deep merge two objects without prototype pollution vulnerability
+ * Optimized for performance with minimal object allocations
+ * BUG-NEW-020 FIX: Use comprehensive dangerous key protection from shared utility
+ * @param target The target object
+ * @param source The source object to merge from
+ * @returns A new merged object
+ */
+function deepMerge(target, source) {
+    // Create a new object to avoid mutations (only once)
+    const result = { ...target };
+    // Get source keys directly for better performance
+    const sourceKeys = Object.keys(source);
+    for (let i = 0; i < sourceKeys.length; i++) {
+        const key = sourceKeys[i];
+        // Skip dangerous keys that could lead to prototype pollution
+        if (security.isDangerousKey(key)) {
+            continue;
+        }
+        // Only process own properties (redundant with Object.keys but safe)
+        if (!Object.prototype.hasOwnProperty.call(source, key)) {
+            continue;
+        }
+        const sourceValue = source[key];
+        const targetValue = target[key];
+        // If both values are plain objects, merge them recursively
+        if (isPlainObject(sourceValue) && isPlainObject(targetValue)) {
+            result[key] = deepMerge(targetValue, sourceValue);
+        }
+        else {
+            // Otherwise, use the source value (including undefined)
+            result[key] = sourceValue;
+        }
+    }
+    return result;
+}
+
+function createIntersectionError(message) {
+    return new errorsCore.VldError([{ code: 'invalid_type', path: [], message }]);
+}
+/**
+ * Immutable intersection validator for combining validators
+ */
+class VldIntersection extends validators_base.VldBase {
+    /**
+     * Private constructor to enforce immutability
+     */
+    constructor(validatorA, validatorB) {
+        super(validators_base.VLD_VALIDATOR_TYPES.INTERSECTION);
+        this.validatorA = validatorA;
+        this.validatorB = validatorB;
+    }
+    /**
+     * Create a new intersection validator
+     */
+    static create(validatorA, validatorB) {
+        return new VldIntersection(validatorA, validatorB);
+    }
+    /**
+     * Parse and validate a value against both validators
+     */
+    parse(value) {
+        try {
+            // Both validators must pass
+            const resultA = this.validatorA.parse(value);
+            const resultB = this.validatorB.parse(value);
+            // BUG-NEW-015 FIX: Check type consistency before merging
+            const aIsObject = isPlainObject(resultA);
+            const bIsObject = isPlainObject(resultB);
+            // Both are objects - safe to merge
+            if (aIsObject && bIsObject) {
+                return deepMerge(resultA, resultB);
+            }
+            // Neither are objects - must be identical primitives
+            if (!aIsObject && !bIsObject) {
+                if (resultA === resultB) {
+                    return resultA;
+                }
+                throw new Error('Values must be identical for intersection of primitive types');
+            }
+            // One is object, one is primitive - invalid intersection
+            throw new Error('Cannot create intersection of object and primitive types. ' +
+                'Both validators must produce the same type category.');
+        }
+        catch (error) {
+            throw new Error(locales_runtime.getMessages().intersectionError(error.message));
+        }
+    }
+    /**
+     * Safely parse and validate a value against both validators
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: createIntersectionError(error.message) };
+        }
+    }
+}
+
+exports.VldIntersection = VldIntersection;

package/dist/cjs/validators/json.cjs

@@ -0,0 +1,70 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+var locales_runtime = require('../locales/runtime.cjs');
+require('../registry.cjs');
+require('../locales/en.cjs');
+
+/**
+ * Immutable JSON validator that validates and parses JSON strings
+ * Accepts both strings (which are parsed) and already-parsed objects
+ */
+class VldJson extends validators_base.VldBase {
+    constructor(schema) {
+        super(validators_base.VLD_VALIDATOR_TYPES.JSON);
+        this.schema = schema;
+    }
+    /**
+     * Create a new JSON validator
+     */
+    static create(schema) {
+        return new VldJson(schema);
+    }
+    /**
+     * Parse and validate a JSON value
+     */
+    parse(value) {
+        let parsed;
+        // If it's a string, try to parse it as JSON first
+        if (typeof value === 'string') {
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch {
+                throw new Error(locales_runtime.getMessages().invalidJson);
+            }
+        }
+        else {
+            // Not a string - assume it's already parsed
+            parsed = value;
+        }
+        // If we have a schema, validate against it
+        if (this.schema) {
+            return this.schema.parse(parsed);
+        }
+        // No schema - just return the parsed value
+        return parsed;
+    }
+    /**
+     * Safely parse and validate a JSON value
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error
+            };
+        }
+    }
+    /**
+     * Create a new JSON validator with a schema for validation
+     */
+    withSchema(schema) {
+        return new VldJson(schema);
+    }
+}
+
+exports.VldJson = VldJson;

package/dist/cjs/validators/lazy.cjs

@@ -0,0 +1,53 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+require('../registry.cjs');
+
+/**
+ * VldLazy - Lazy evaluation for recursive schemas
+ * Part of Zod 4 API parity implementation
+ * Allows schemas that reference themselves (e.g., tree structures, nested categories)
+ */
+/**
+ * Lazy validator - defers schema evaluation until runtime
+ * Essential for recursive and self-referencing types
+ *
+ * Caches the resolved schema after first use. This keeps recursive schemas stable
+ * and avoids re-running the schema getter on hot parse paths.
+ */
+class VldLazy extends validators_base.VldBase {
+    constructor(_schemaGetter) {
+        super(validators_base.VLD_VALIDATOR_TYPES.LAZY);
+        this._schemaGetter = _schemaGetter;
+        this._cachedSchema = null;
+    }
+    static create(schemaGetter) {
+        return new VldLazy(schemaGetter);
+    }
+    /**
+     * Get the actual schema, caching it after first retrieval
+     */
+    _getSchema() {
+        if (this._cachedSchema) {
+            return this._cachedSchema;
+        }
+        const schema = this._schemaGetter();
+        this._cachedSchema = schema;
+        return schema;
+    }
+    /**
+     * Get the inner schema (unwrap)
+     * Returns a strong reference that will keep the schema alive
+     */
+    unwrap() {
+        return this._getSchema();
+    }
+    parse(value) {
+        return this._getSchema().parse(value);
+    }
+    safeParse(value) {
+        return this._getSchema().safeParse(value);
+    }
+}
+
+exports.VldLazy = VldLazy;

package/dist/cjs/validators/literal.cjs

@@ -0,0 +1,64 @@
+'use strict';
+
+var validators_base = require('./base.cjs');
+var locales_runtime = require('../locales/runtime.cjs');
+var errorsCore = require('../chunks/errors-core-DWxLFs2f.cjs');
+require('../registry.cjs');
+require('../locales/en.cjs');
+
+function createLiteralError(message) {
+    return new errorsCore.VldError([{ code: 'invalid_literal', path: [], message }]);
+}
+/**
+ * Immutable literal validator for exact value matching
+ */
+class VldLiteral extends validators_base.VldBase {
+    /**
+     * Private constructor to enforce immutability
+     */
+    constructor(_literal, errorMessage) {
+        super(validators_base.VLD_VALIDATOR_TYPES.LITERAL);
+        this._literal = _literal;
+        this.errorMessage = errorMessage;
+    }
+    /**
+     * Get the literal value
+     */
+    get literal() {
+        return this._literal;
+    }
+    get isSimple() {
+        return true;
+    }
+    /**
+     * Create a new literal validator
+     */
+    static create(literal) {
+        return new VldLiteral(literal);
+    }
+    /**
+     * Parse and validate a literal value
+     */
+    parse(value) {
+        if (value !== this._literal) {
+            throw new Error(this.errorMessage ||
+                locales_runtime.getMessages().literalExpected(JSON.stringify(this._literal), JSON.stringify(value)));
+        }
+        return this._literal;
+    }
+    /**
+     * Safely parse and validate a literal value
+     */
+    safeParse(value) {
+        if (value === this._literal) {
+            return { success: true, data: this._literal };
+        }
+        return {
+            success: false,
+            error: createLiteralError(this.errorMessage ||
+                locales_runtime.getMessages().literalExpected(JSON.stringify(this._literal), JSON.stringify(value)))
+        };
+    }
+}
+
+exports.VldLiteral = VldLiteral;