@oxog/vld 2.0.3 → 2.1.0

package/dist/codecs/index.js

@@ -1,4 +1,11 @@
-export { d as base64Json, e as base64ToBytes, g as base64UrlToBytes, h as base64urlToBytes, i as bytesToUtf8, j as epochMillisToDate, k as epochSecondsToDate, l as hexLowerToBytes, m as hexToBytes, o as isoDatetimeToDate, p as jsonCodec, q as jwtPayload, r as numberToBigInt, s as stringToBigInt, t as stringToBoolean, u as stringToHttpURL, v as stringToInt, w as stringToNumber, x as stringToURL, D as uriComponent, E as utf8ToBytes } from '../chunks/index-DO8CFMxD.js';
-import '../chunks/bigint-CRS0QVsy.js';
-import '../chunks/unknown-Dhzri_T-.js';
-//# sourceMappingURL=index.js.map
+import '../validators/codec.js';
+import '../validators/base64.js';
+import '../validators/hex.js';
+import '../validators/uint8array.js';
+import '../chunks/string-BJRQod3t.js';
+import '../validators/number.js';
+import '../validators/bigint.js';
+import '../validators/boolean.js';
+import '../validators/date.js';
+import '../validators/unknown.js';
+export { b as base64Json, a as base64ToBytes, d as base64UrlToBytes, e as base64urlToBytes, f as bytesToUtf8, g as epochMillisToDate, h as epochSecondsToDate, i as hexLowerToBytes, j as hexToBytes, l as invertCodec, m as isoDatetimeToDate, n as jsonCodec, o as jwtPayload, p as numberToBigInt, s as stringToBigInt, q as stringToBoolean, r as stringToHttpURL, t as stringToInt, u as stringToNumber, v as stringToURL, B as uriComponent, C as utf8ToBytes } from '../chunks/index-0R2ntSud.js';

package/dist/coercion/bigint.d.ts

@@ -1,5 +1,5 @@
-import { VldBigInt } from '../validators/bigint';
-import { ParseResult } from '../validators/base';
+import { VldBigInt } from '../validators/bigint.js';
+import { ParseResult } from '../validators/base.js';
 /**
  * BigInt coercion validator that attempts to convert values to bigint
  */
@@ -24,4 +24,3 @@ export declare class VldCoerceBigInt extends VldBigInt {
      */
     safeParse(value: unknown): ParseResult<bigint>;
 }
-//# sourceMappingURL=bigint.d.ts.map

package/dist/coercion/boolean.d.ts

@@ -1,5 +1,5 @@
-import { VldBoolean } from '../validators/boolean';
-import { ParseResult } from '../validators/base';
+import { VldBoolean } from '../validators/boolean.js';
+import { ParseResult } from '../validators/base.js';
 /**
  * Boolean coercion validator that attempts to convert values to booleans
  */
@@ -8,6 +8,7 @@ export declare class VldCoerceBoolean extends VldBoolean {
      * Create a new coerce boolean validator
      */
     static create(): VldCoerceBoolean;
+    constructor();
     /**
      * Parse and coerce a value to boolean
      */
@@ -17,4 +18,3 @@ export declare class VldCoerceBoolean extends VldBoolean {
      */
     safeParse(value: unknown): ParseResult<boolean>;
 }
-//# sourceMappingURL=boolean.d.ts.map

package/dist/coercion/date.d.ts

@@ -1,5 +1,5 @@
-import { VldDate } from '../validators/date';
-import { ParseResult } from '../validators/base';
+import { VldDate } from '../validators/date.js';
+import { ParseResult } from '../validators/base.js';
 /**
  * Date coercion validator that attempts to convert values to dates
  */
@@ -8,6 +8,7 @@ export declare class VldCoerceDate extends VldDate {
      * Create a new coerce date validator
      */
     static create(): VldCoerceDate;
+    constructor();
     /**
      * Parse and coerce a value to date
      */
@@ -17,4 +18,3 @@ export declare class VldCoerceDate extends VldDate {
      */
     safeParse(value: unknown): ParseResult<Date>;
 }
-//# sourceMappingURL=date.d.ts.map

package/dist/coercion/index.d.ts

@@ -3,9 +3,8 @@
  *
  * Validators that coerce values to the target type before validation.
  */
-export { VldCoerceString } from './string';
-export { VldCoerceNumber } from './number';
-export { VldCoerceBoolean } from './boolean';
-export { VldCoerceDate } from './date';
-export { VldCoerceBigInt } from './bigint';
-//# sourceMappingURL=index.d.ts.map
+export { VldCoerceString } from './string.js';
+export { VldCoerceNumber } from './number.js';
+export { VldCoerceBoolean } from './boolean.js';
+export { VldCoerceDate } from './date.js';
+export { VldCoerceBigInt } from './bigint.js';

package/dist/coercion/index.js

@@ -1,12 +1,481 @@
-export { a as VldCoerceBoolean, V as VldCoerceDate, b as VldCoerceNumber, c as VldCoerceString } from '../chunks/date-50JV_Mfj.js';
-import { V as VldBigInt, u as getMessages } from '../chunks/bigint-CRS0QVsy.js';
+import { V as VldString, i as isValidIPv6 } from '../chunks/string-BJRQod3t.js';
+import { VLD_VALIDATOR_TYPES } from '../validators/base.js';
+import { getMessages } from '../locales/runtime.js';
+import { VldNumber } from '../validators/number.js';
+import { VldBoolean } from '../validators/boolean.js';
+import { VldDate } from '../validators/date.js';
+import { VldBigInt } from '../validators/bigint.js';
+
+// BUG-NEW-001 FIX: IPv6 validation moved to shared utility (src/utils/ip-validation.ts)
+// to eliminate code duplication between string.ts and coercion/string.ts
+/**
+ * String coercion validator that attempts to convert values to strings
+ */
+class VldCoerceString extends VldString {
+    constructor(config) {
+        // Pass COERCE_STRING type to base class instead of STRING
+        super({ ...config, validatorType: VLD_VALIDATOR_TYPES.COERCE_STRING });
+    }
+    /**
+     * Create a new coerce string validator
+     */
+    static create() {
+        return new VldCoerceString();
+    }
+    // Override all chain methods to return VldCoerceString instances
+    min(length, message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => v.length >= length],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringMin(length)
+        });
+    }
+    max(length, message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => v.length <= length],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringMax(length)
+        });
+    }
+    length(length, message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => v.length === length],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringLength(length)
+        });
+    }
+    email(message) {
+        // BUG-007 FIX: Use simpler, ReDoS-safe regex (consistent with VldString)
+        const FAST_EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => FAST_EMAIL_REGEX.test(v)],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringEmail
+        });
+    }
+    url(message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => /^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&//=]*)$/.test(v)],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringUrl
+        });
+    }
+    uuid(message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(v)],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringUuid
+        });
+    }
+    regex(pattern, message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => pattern.test(v)],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringRegex
+        });
+    }
+    trim() {
+        return new VldCoerceString({
+            checks: this.config.checks,
+            transforms: [...this.config.transforms, (v) => v.trim()],
+            errorMessage: this.config.errorMessage
+        });
+    }
+    toLowerCase() {
+        return new VldCoerceString({
+            checks: this.config.checks,
+            transforms: [...this.config.transforms, (v) => v.toLowerCase()],
+            errorMessage: this.config.errorMessage
+        });
+    }
+    toUpperCase() {
+        return new VldCoerceString({
+            checks: this.config.checks,
+            transforms: [...this.config.transforms, (v) => v.toUpperCase()],
+            errorMessage: this.config.errorMessage
+        });
+    }
+    startsWith(str, message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => v.startsWith(str)],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringStartsWith(str)
+        });
+    }
+    endsWith(str, message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => v.endsWith(str)],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringEndsWith(str)
+        });
+    }
+    includes(str, message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => v.includes(str)],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringIncludes(str)
+        });
+    }
+    ip(message) {
+        const ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => {
+                    // Prevent ReDoS: Check length before validation
+                    if (v.length > 100)
+                        return false;
+                    return ipv4.test(v) || isValidIPv6(v);
+                }],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringIp
+        });
+    }
+    ipv4(message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => /^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/.test(v)],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringIpv4
+        });
+    }
+    ipv6(message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => {
+                    // Use safe IPv6 validation to prevent ReDoS attacks
+                    return isValidIPv6(v);
+                }],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringIpv6
+        });
+    }
+    nonempty(message) {
+        return new VldCoerceString({
+            checks: [...this.config.checks, (v) => v.length > 0],
+            transforms: this.config.transforms,
+            errorMessage: message || getMessages().stringEmpty
+        });
+    }
+    /**
+     * Parse and coerce a value to string
+     */
+    parse(value) {
+        // If it's already a string, apply security controls first
+        if (typeof value === 'string') {
+            // Enforce length limits to prevent DoS
+            if (value.length > 1000000) {
+                throw new Error(getMessages().coercionFailed('string', value));
+            }
+            // Sanitize control characters for security
+            // Remove characters that could cause issues in logs, databases, or UI
+            // eslint-disable-next-line no-control-regex -- Intentional removal of control characters for security
+            const sanitized = value.replace(/[\x00-\x1F\x7F]/g, '');
+            // Use parent validation with sanitized string
+            return super.parse(sanitized);
+        }
+        // Safe type coercion with security measures
+        let coerced;
+        if (typeof value === 'number') {
+            // Numbers: safe conversion
+            coerced = String(value);
+        }
+        else if (typeof value === 'boolean') {
+            // Booleans: safe conversion
+            coerced = value ? 'true' : 'false';
+        }
+        else if (typeof value === 'bigint') {
+            // BigInt: safe conversion
+            coerced = value.toString();
+        }
+        else if (typeof value === 'symbol') {
+            // Symbols: String() matches Zod coercion semantics without throwing.
+            coerced = String(value);
+        }
+        else if (typeof value === 'object') {
+            // Objects: only allow specific safe object types
+            if (value instanceof Date) {
+                // Dates: convert to ISO string
+                coerced = value.toISOString();
+            }
+            else if (Array.isArray(value)) {
+                // Arrays: convert to comma-separated string (original behavior)
+                coerced = value.join(',');
+            }
+            else if (value instanceof RegExp) {
+                // RegExp: convert to string representation
+                coerced = value.toString();
+            }
+            else if (value instanceof Error) {
+                // Errors: use message property (safe)
+                coerced = value.message || value.toString();
+            }
+            else {
+                // For plain objects, use the original String() behavior for backwards compatibility
+                coerced = String(value);
+            }
+        }
+        else {
+            // Fallback for other types
+            coerced = String(value);
+        }
+        // Apply security controls
+        // Enforce length limits to prevent DoS
+        if (coerced.length > 1000000) {
+            throw new Error(getMessages().coercionFailed('string', value));
+        }
+        // Sanitize control characters for security
+        // Remove characters that could cause issues in logs, databases, or UI
+        // eslint-disable-next-line no-control-regex -- Intentional removal of control characters for security
+        const sanitized = coerced.replace(/[\x00-\x1F\x7F]/g, '');
+        // Use parent validation with sanitized value
+        return super.parse(sanitized);
+    }
+    /**
+     * Safely parse and coerce a value to string
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: error };
+        }
+    }
+}
+
+/**
+ * Number coercion validator that attempts to convert values to numbers
+ */
+class VldCoerceNumber extends VldNumber {
+    constructor(config) {
+        super({ ...config, validatorType: VLD_VALIDATOR_TYPES.COERCE_NUMBER });
+    }
+    /**
+     * Create a new coerce number validator
+     */
+    static create() {
+        return new VldCoerceNumber();
+    }
+    // Override all chain methods to return VldCoerceNumber instances
+    min(value, message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => v >= value],
+            errorMessage: message || getMessages().numberMin(value)
+        });
+    }
+    max(value, message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => v <= value],
+            errorMessage: message || getMessages().numberMax(value)
+        });
+    }
+    int(message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => Number.isInteger(v)],
+            errorMessage: message || getMessages().numberInt
+        });
+    }
+    positive(message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => v > 0],
+            errorMessage: message || getMessages().numberPositive
+        });
+    }
+    negative(message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => v < 0],
+            errorMessage: message || getMessages().numberNegative
+        });
+    }
+    nonnegative(message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => v >= 0],
+            errorMessage: message || getMessages().numberNonnegative
+        });
+    }
+    nonpositive(message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => v <= 0],
+            errorMessage: message || getMessages().numberNonpositive
+        });
+    }
+    finite(message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => Number.isFinite(v)],
+            errorMessage: message || getMessages().numberFinite
+        });
+    }
+    safe(message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => Number.isSafeInteger(v)],
+            errorMessage: message || getMessages().numberSafe
+        });
+    }
+    multipleOf(value, message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => {
+                    // BUG-004 FIX: Use epsilon comparison for floating point precision (consistent with VldNumber)
+                    const remainder = Math.abs(v % value);
+                    return remainder < Number.EPSILON || Math.abs(remainder - Math.abs(value)) < Number.EPSILON;
+                }],
+            errorMessage: message || getMessages().numberMultipleOf(value)
+        });
+    }
+    step(value, message) {
+        return this.multipleOf(value, message);
+    }
+    between(min, max, message) {
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => v >= min && v <= max],
+            errorMessage: message || `Number must be between ${min} and ${max}`
+        });
+    }
+    even(message) {
+        // BUG-NEW-007 FIX: Add integer check before even/odd validation
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => {
+                    if (!Number.isInteger(v)) {
+                        return false;
+                    }
+                    return v % 2 === 0;
+                }],
+            errorMessage: message || 'Number must be even'
+        });
+    }
+    odd(message) {
+        // BUG-NEW-007 FIX: Add integer check before even/odd validation
+        return new VldCoerceNumber({
+            checks: [...this.config.checks, (v) => {
+                    if (!Number.isInteger(v)) {
+                        return false;
+                    }
+                    return v % 2 !== 0;
+                }],
+            errorMessage: message || 'Number must be odd'
+        });
+    }
+    /**
+     * Parse and coerce a value to number
+     */
+    parse(value) {
+        // If it's already a valid number, use parent validation directly
+        if (typeof value === 'number' && !isNaN(value)) {
+            if (this.config.checks.length === 0) {
+                return value;
+            }
+            return super.parse(value);
+        }
+        let coerced;
+        try {
+            coerced = Number(value);
+        }
+        catch {
+            throw new Error(getMessages().coercionFailed('number', value));
+        }
+        if (isNaN(coerced)) {
+            throw new Error(getMessages().coercionFailed('number', value));
+        }
+        if (this.config.checks.length === 0) {
+            return coerced;
+        }
+        // Use parent validation with coerced value
+        return super.parse(coerced);
+    }
+    /**
+     * Safely parse and coerce a value to number
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: error };
+        }
+    }
+}
+
+/**
+ * Boolean coercion validator that attempts to convert values to booleans
+ */
+class VldCoerceBoolean extends VldBoolean {
+    /**
+     * Create a new coerce boolean validator
+     */
+    static create() {
+        return new VldCoerceBoolean();
+    }
+    constructor() {
+        super(undefined, VLD_VALIDATOR_TYPES.COERCE_BOOLEAN);
+    }
+    /**
+     * Parse and coerce a value to boolean
+     */
+    parse(value) {
+        return Boolean(value);
+    }
+    /**
+     * Safely parse and coerce a value to boolean
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: error };
+        }
+    }
+}
+
+/**
+ * Date coercion validator that attempts to convert values to dates
+ */
+class VldCoerceDate extends VldDate {
+    /**
+     * Create a new coerce date validator
+     */
+    static create() {
+        return new VldCoerceDate();
+    }
+    constructor() {
+        super({ validatorType: VLD_VALIDATOR_TYPES.COERCE_DATE });
+    }
+    /**
+     * Parse and coerce a value to date
+     */
+    parse(value) {
+        try {
+            if (value instanceof Date) {
+                return super.parse(value);
+            }
+            const date = new Date(value);
+            if (isNaN(date.getTime())) {
+                throw new Error(getMessages().coercionFailed('date', value));
+            }
+            return super.parse(date);
+        }
+        catch (error) {
+            if (error.message.includes('Cannot coerce')) {
+                throw error;
+            }
+            throw new Error(getMessages().coercionFailed('date', value));
+        }
+    }
+    /**
+     * Safely parse and coerce a value to date
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: error };
+        }
+    }
+}
 
 /**
  * BigInt coercion validator that attempts to convert values to bigint
  */
 class VldCoerceBigInt extends VldBigInt {
     constructor(config) {
-        super(config);
+        super({ ...config, validatorType: VLD_VALIDATOR_TYPES.COERCE_BIGINT });
     }
     /**
      * Create a new coerce bigint validator
@@ -107,5 +576,4 @@ class VldCoerceBigInt extends VldBigInt {
     }
 }
 
-export { VldCoerceBigInt };
-//# sourceMappingURL=index.js.map
+export { VldCoerceBigInt, VldCoerceBoolean, VldCoerceDate, VldCoerceNumber, VldCoerceString };

package/dist/coercion/number.d.ts

@@ -1,5 +1,5 @@
-import { VldNumber } from '../validators/number';
-import { ParseResult } from '../validators/base';
+import { VldNumber } from '../validators/number.js';
+import { ParseResult } from '../validators/base.js';
 /**
  * Number coercion validator that attempts to convert values to numbers
  */
@@ -32,4 +32,3 @@ export declare class VldCoerceNumber extends VldNumber {
      */
     safeParse(value: unknown): ParseResult<number>;
 }
-//# sourceMappingURL=number.d.ts.map

package/dist/coercion/string.d.ts

@@ -1,5 +1,5 @@
-import { VldString } from '../validators/string';
-import { ParseResult } from '../validators/base';
+import { VldString } from '../validators/string.js';
+import { ParseResult } from '../validators/base.js';
 /**
  * String coercion validator that attempts to convert values to strings
  */
@@ -35,4 +35,3 @@ export declare class VldCoerceString extends VldString {
      */
     safeParse(value: unknown): ParseResult<string>;
 }
-//# sourceMappingURL=string.d.ts.map

package/dist/compat/emitter.d.ts

@@ -70,4 +70,3 @@ export declare function createEventBus<TEvents extends EventMap>(): Emitter<TEve
     };
 };
 export type { EventHandler as VldEventHandler };
-//# sourceMappingURL=emitter.d.ts.map

package/dist/compat/emitter.js

@@ -178,4 +178,3 @@ function createEventBus() {
 }
 
 export { createEmitter, createEventBus, withEmitter };
-//# sourceMappingURL=emitter.js.map

package/dist/compat/index.d.ts

@@ -8,8 +8,7 @@
  * - Result pattern (@oxog/types compatibility)
  * - Event emitter (@oxog/emitter compatibility)
  */
-export type { Result, VldResult } from './result';
-export { Ok, Err, success, failure, isOk, isErr, isResult, unwrap, unwrapOr, map, mapErr, flatMap, match, tryCatch, tryCatchAsync, all, fromNullable, ResultUtils } from './result';
-export type { EventMap, EventHandler, ListenerOptions, Emitter, VldEventHandler } from './emitter';
-export { createEmitter, createEventBus, withEmitter } from './emitter';
-//# sourceMappingURL=index.d.ts.map
+export type { Result, VldResult } from './result.js';
+export { Ok, Err, success, failure, isOk, isErr, isResult, unwrap, unwrapOr, map, mapErr, flatMap, match, tryCatch, tryCatchAsync, all, fromNullable, ResultUtils } from './result.js';
+export type { EventMap, EventHandler, ListenerOptions, Emitter, VldEventHandler } from './emitter.js';
+export { createEmitter, createEventBus, withEmitter } from './emitter.js';

package/dist/compat/result.d.ts

@@ -4,7 +4,7 @@
  * This module provides a Result type for functional error handling,
  * compatible with @oxog/types when available.
  */
-import type { VldError } from '../errors';
+import type { VldError } from '../errors.js';
 /**
  * Success result type
  */
@@ -125,4 +125,3 @@ export declare const ResultUtils: {
     all: typeof all;
     fromNullable: typeof fromNullable;
 };
-//# sourceMappingURL=result.d.ts.map

package/dist/compat/result.js

@@ -168,4 +168,3 @@ const ResultUtils = {
 };
 
 export { Err, Ok, ResultUtils, all, failure, flatMap, fromNullable, isErr, isOk, isResult, map, mapErr, match, success, tryCatch, tryCatchAsync, unwrap, unwrapOr };
-//# sourceMappingURL=result.js.map