@oxog/vld 2.0.3 → 2.1.0

package/dist/validators/intersection.js

@@ -0,0 +1,116 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+import { i as isDangerousKey } from '../chunks/security-B0Pd_vSY.js';
+import { getMessages } from '../locales/runtime.js';
+import { V as VldError } from '../chunks/errors-core-BeiFUtZM.js';
+
+/**
+ * Type guard to check if a value is a plain object
+ */
+function isPlainObject(obj) {
+    return (obj !== null &&
+        typeof obj === 'object' &&
+        obj.constructor === Object &&
+        Object.prototype.toString.call(obj) === '[object Object]');
+}
+/**
+ * Safely deep merge two objects without prototype pollution vulnerability
+ * Optimized for performance with minimal object allocations
+ * BUG-NEW-020 FIX: Use comprehensive dangerous key protection from shared utility
+ * @param target The target object
+ * @param source The source object to merge from
+ * @returns A new merged object
+ */
+function deepMerge(target, source) {
+    // Create a new object to avoid mutations (only once)
+    const result = { ...target };
+    // Get source keys directly for better performance
+    const sourceKeys = Object.keys(source);
+    for (let i = 0; i < sourceKeys.length; i++) {
+        const key = sourceKeys[i];
+        // Skip dangerous keys that could lead to prototype pollution
+        if (isDangerousKey(key)) {
+            continue;
+        }
+        // Only process own properties (redundant with Object.keys but safe)
+        if (!Object.prototype.hasOwnProperty.call(source, key)) {
+            continue;
+        }
+        const sourceValue = source[key];
+        const targetValue = target[key];
+        // If both values are plain objects, merge them recursively
+        if (isPlainObject(sourceValue) && isPlainObject(targetValue)) {
+            result[key] = deepMerge(targetValue, sourceValue);
+        }
+        else {
+            // Otherwise, use the source value (including undefined)
+            result[key] = sourceValue;
+        }
+    }
+    return result;
+}
+
+function createIntersectionError(message) {
+    return new VldError([{ code: 'invalid_type', path: [], message }]);
+}
+/**
+ * Immutable intersection validator for combining validators
+ */
+class VldIntersection extends VldBase {
+    /**
+     * Private constructor to enforce immutability
+     */
+    constructor(validatorA, validatorB) {
+        super(VLD_VALIDATOR_TYPES.INTERSECTION);
+        this.validatorA = validatorA;
+        this.validatorB = validatorB;
+    }
+    /**
+     * Create a new intersection validator
+     */
+    static create(validatorA, validatorB) {
+        return new VldIntersection(validatorA, validatorB);
+    }
+    /**
+     * Parse and validate a value against both validators
+     */
+    parse(value) {
+        try {
+            // Both validators must pass
+            const resultA = this.validatorA.parse(value);
+            const resultB = this.validatorB.parse(value);
+            // BUG-NEW-015 FIX: Check type consistency before merging
+            const aIsObject = isPlainObject(resultA);
+            const bIsObject = isPlainObject(resultB);
+            // Both are objects - safe to merge
+            if (aIsObject && bIsObject) {
+                return deepMerge(resultA, resultB);
+            }
+            // Neither are objects - must be identical primitives
+            if (!aIsObject && !bIsObject) {
+                if (resultA === resultB) {
+                    return resultA;
+                }
+                throw new Error('Values must be identical for intersection of primitive types');
+            }
+            // One is object, one is primitive - invalid intersection
+            throw new Error('Cannot create intersection of object and primitive types. ' +
+                'Both validators must produce the same type category.');
+        }
+        catch (error) {
+            throw new Error(getMessages().intersectionError(error.message));
+        }
+    }
+    /**
+     * Safely parse and validate a value against both validators
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: createIntersectionError(error.message) };
+        }
+    }
+}
+
+export { VldIntersection };

package/dist/validators/json.d.ts

@@ -1,4 +1,4 @@
-import { VldBase, ParseResult } from './base';
+import { VldBase, ParseResult } from './base.js';
 /**
  * Immutable JSON validator that validates and parses JSON strings
  * Accepts both strings (which are parsed) and already-parsed objects
@@ -23,4 +23,3 @@ export declare class VldJson<T = unknown> extends VldBase<unknown, T> {
      */
     withSchema<U>(schema: VldBase<unknown, U>): VldJson<U>;
 }
-//# sourceMappingURL=json.d.ts.map

package/dist/validators/json.js

@@ -0,0 +1,66 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+import { getMessages } from '../locales/runtime.js';
+
+/**
+ * Immutable JSON validator that validates and parses JSON strings
+ * Accepts both strings (which are parsed) and already-parsed objects
+ */
+class VldJson extends VldBase {
+    constructor(schema) {
+        super(VLD_VALIDATOR_TYPES.JSON);
+        this.schema = schema;
+    }
+    /**
+     * Create a new JSON validator
+     */
+    static create(schema) {
+        return new VldJson(schema);
+    }
+    /**
+     * Parse and validate a JSON value
+     */
+    parse(value) {
+        let parsed;
+        // If it's a string, try to parse it as JSON first
+        if (typeof value === 'string') {
+            try {
+                parsed = JSON.parse(value);
+            }
+            catch {
+                throw new Error(getMessages().invalidJson);
+            }
+        }
+        else {
+            // Not a string - assume it's already parsed
+            parsed = value;
+        }
+        // If we have a schema, validate against it
+        if (this.schema) {
+            return this.schema.parse(parsed);
+        }
+        // No schema - just return the parsed value
+        return parsed;
+    }
+    /**
+     * Safely parse and validate a JSON value
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error
+            };
+        }
+    }
+    /**
+     * Create a new JSON validator with a schema for validation
+     */
+    withSchema(schema) {
+        return new VldJson(schema);
+    }
+}
+
+export { VldJson };

package/dist/validators/lazy.d.ts

@@ -3,25 +3,22 @@
  * Part of Zod 4 API parity implementation
  * Allows schemas that reference themselves (e.g., tree structures, nested categories)
  */
-import { VldBase } from './base';
-import type { ParseResult } from './base';
+import { VldBase } from './base.js';
+import type { ParseResult } from './base.js';
 /**
  * Lazy validator - defers schema evaluation until runtime
  * Essential for recursive and self-referencing types
  *
- * MEMORY OPTIMIZATION: Uses WeakRef for the cached schema to allow garbage collection
- * when the validator is no longer in use. This prevents memory leaks in long-running
- * applications with dynamically created schemas.
+ * Caches the resolved schema after first use. This keeps recursive schemas stable
+ * and avoids re-running the schema getter on hot parse paths.
  */
 export declare class VldLazy<TInput, TOutput> extends VldBase<TInput, TOutput> {
     private readonly _schemaGetter;
-    private _cachedSchemaRef;
-    private _strongRef;
+    private _cachedSchema;
     private constructor();
     static create<TInput, TOutput>(schemaGetter: () => VldBase<TInput, TOutput>): VldLazy<TInput, TOutput>;
     /**
      * Get the actual schema, caching it after first retrieval
-     * Uses WeakRef to allow garbage collection when validator is not in use
      */
     private _getSchema;
     /**
@@ -32,4 +29,3 @@ export declare class VldLazy<TInput, TOutput> extends VldBase<TInput, TOutput> {
     parse(value: unknown): TOutput;
     safeParse(value: unknown): ParseResult<TOutput>;
 }
-//# sourceMappingURL=lazy.d.ts.map

package/dist/validators/lazy.js

@@ -0,0 +1,50 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+
+/**
+ * VldLazy - Lazy evaluation for recursive schemas
+ * Part of Zod 4 API parity implementation
+ * Allows schemas that reference themselves (e.g., tree structures, nested categories)
+ */
+/**
+ * Lazy validator - defers schema evaluation until runtime
+ * Essential for recursive and self-referencing types
+ *
+ * Caches the resolved schema after first use. This keeps recursive schemas stable
+ * and avoids re-running the schema getter on hot parse paths.
+ */
+class VldLazy extends VldBase {
+    constructor(_schemaGetter) {
+        super(VLD_VALIDATOR_TYPES.LAZY);
+        this._schemaGetter = _schemaGetter;
+        this._cachedSchema = null;
+    }
+    static create(schemaGetter) {
+        return new VldLazy(schemaGetter);
+    }
+    /**
+     * Get the actual schema, caching it after first retrieval
+     */
+    _getSchema() {
+        if (this._cachedSchema) {
+            return this._cachedSchema;
+        }
+        const schema = this._schemaGetter();
+        this._cachedSchema = schema;
+        return schema;
+    }
+    /**
+     * Get the inner schema (unwrap)
+     * Returns a strong reference that will keep the schema alive
+     */
+    unwrap() {
+        return this._getSchema();
+    }
+    parse(value) {
+        return this._getSchema().parse(value);
+    }
+    safeParse(value) {
+        return this._getSchema().safeParse(value);
+    }
+}
+
+export { VldLazy };

package/dist/validators/literal.d.ts

@@ -1,4 +1,4 @@
-import { VldBase, ParseResult } from './base';
+import { VldBase, ParseResult } from './base.js';
 /**
  * Immutable literal validator for exact value matching
  */
@@ -13,6 +13,7 @@ export declare class VldLiteral<T extends string | number | boolean | null | und
      * Get the literal value
      */
     get literal(): T;
+    get isSimple(): boolean;
     /**
      * Create a new literal validator
      */
@@ -26,4 +27,3 @@ export declare class VldLiteral<T extends string | number | boolean | null | und
      */
     safeParse(value: unknown): ParseResult<T>;
 }
-//# sourceMappingURL=literal.d.ts.map

package/dist/validators/literal.js

@@ -0,0 +1,60 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+import { getMessages } from '../locales/runtime.js';
+import { V as VldError } from '../chunks/errors-core-BeiFUtZM.js';
+
+function createLiteralError(message) {
+    return new VldError([{ code: 'invalid_literal', path: [], message }]);
+}
+/**
+ * Immutable literal validator for exact value matching
+ */
+class VldLiteral extends VldBase {
+    /**
+     * Private constructor to enforce immutability
+     */
+    constructor(_literal, errorMessage) {
+        super(VLD_VALIDATOR_TYPES.LITERAL);
+        this._literal = _literal;
+        this.errorMessage = errorMessage;
+    }
+    /**
+     * Get the literal value
+     */
+    get literal() {
+        return this._literal;
+    }
+    get isSimple() {
+        return true;
+    }
+    /**
+     * Create a new literal validator
+     */
+    static create(literal) {
+        return new VldLiteral(literal);
+    }
+    /**
+     * Parse and validate a literal value
+     */
+    parse(value) {
+        if (value !== this._literal) {
+            throw new Error(this.errorMessage ||
+                getMessages().literalExpected(JSON.stringify(this._literal), JSON.stringify(value)));
+        }
+        return this._literal;
+    }
+    /**
+     * Safely parse and validate a literal value
+     */
+    safeParse(value) {
+        if (value === this._literal) {
+            return { success: true, data: this._literal };
+        }
+        return {
+            success: false,
+            error: createLiteralError(this.errorMessage ||
+                getMessages().literalExpected(JSON.stringify(this._literal), JSON.stringify(value)))
+        };
+    }
+}
+
+export { VldLiteral };

package/dist/validators/map.d.ts

@@ -1,4 +1,4 @@
-import { VldBase, ParseResult } from './base';
+import { VldBase, ParseResult } from './base.js';
 /**
  * Immutable Map validator
  */
@@ -10,17 +10,30 @@ export declare class VldMap<K, V> extends VldBase<unknown, Map<K, V>> {
      * Private constructor to enforce immutability
      */
     private constructor();
+    private readonly _simpleKeyMode;
+    private readonly _simpleValueMode;
+    private readonly _simpleKeyValue;
+    private readonly _simpleValueValue;
+    get keySchema(): VldBase<unknown, K>;
+    get valueSchema(): VldBase<unknown, V>;
     /**
      * Create a new Map validator
      */
     static create<K, V>(keyValidator: VldBase<unknown, K>, valueValidator: VldBase<unknown, V>): VldMap<K, V>;
+    private getSimpleItemMode;
+    private getSimpleItemError;
+    private parseSimpleItem;
     /**
      * Parse and validate a Map value
      */
     parse(value: unknown): Map<K, V>;
+    /**
+     * Parse a value that has already passed the Map instance guard.
+     * @internal Used by object validators to avoid duplicate hot-path checks.
+     */
+    parseKnownMap(value: Map<unknown, unknown>): Map<K, V>;
     /**
      * Safely parse and validate a Map value
      */
     safeParse(value: unknown): ParseResult<Map<K, V>>;
 }
-//# sourceMappingURL=map.d.ts.map

package/dist/validators/map.js

@@ -0,0 +1,214 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+import { getMessages } from '../locales/runtime.js';
+import { V as VldError } from '../chunks/errors-core-BeiFUtZM.js';
+
+function createMapError(message) {
+    return new VldError([{ code: 'invalid_type', path: [], message }]);
+}
+/**
+ * Immutable Map validator
+ */
+class VldMap extends VldBase {
+    /**
+     * Private constructor to enforce immutability
+     */
+    constructor(keyValidator, valueValidator, errorMessage) {
+        super(VLD_VALIDATOR_TYPES.MAP);
+        this.keyValidator = keyValidator;
+        this.valueValidator = valueValidator;
+        this.errorMessage = errorMessage;
+        this._simpleKeyMode = this.getSimpleItemMode(keyValidator);
+        this._simpleValueMode = this.getSimpleItemMode(valueValidator);
+        this._simpleKeyValue = this._simpleKeyMode === 'literal' ? keyValidator.literal : undefined;
+        this._simpleValueValue = this._simpleValueMode === 'literal' ? valueValidator.literal : undefined;
+    }
+    get keySchema() {
+        return this.keyValidator;
+    }
+    get valueSchema() {
+        return this.valueValidator;
+    }
+    /**
+     * Create a new Map validator
+     */
+    static create(keyValidator, valueValidator) {
+        return new VldMap(keyValidator, valueValidator);
+    }
+    getSimpleItemMode(validator) {
+        if (validator.isSimple !== true) {
+            return undefined;
+        }
+        switch (validator.validatorType) {
+            case VLD_VALIDATOR_TYPES.STRING:
+                return 'string';
+            case VLD_VALIDATOR_TYPES.NUMBER:
+                return 'number';
+            case VLD_VALIDATOR_TYPES.BOOLEAN:
+                return 'boolean';
+            case VLD_VALIDATOR_TYPES.BIGINT:
+                return 'bigint';
+            case VLD_VALIDATOR_TYPES.SYMBOL:
+                return 'symbol';
+            case VLD_VALIDATOR_TYPES.NULL:
+                return 'null';
+            case VLD_VALIDATOR_TYPES.UNDEFINED:
+            case VLD_VALIDATOR_TYPES.VOID:
+                return 'undefinedValue';
+            case VLD_VALIDATOR_TYPES.LITERAL:
+                return 'literal';
+            case VLD_VALIDATOR_TYPES.ANY:
+            case VLD_VALIDATOR_TYPES.UNKNOWN:
+                return 'passthrough';
+            default:
+                return undefined;
+        }
+    }
+    getSimpleItemError(mode, expected, received) {
+        switch (mode) {
+            case 'string':
+                return getMessages().invalidString;
+            case 'number':
+                return getMessages().invalidNumber;
+            case 'boolean':
+                return getMessages().invalidBoolean;
+            case 'bigint':
+                return getMessages().invalidBigint;
+            case 'symbol':
+                return getMessages().invalidSymbol;
+            case 'null':
+                return `Expected null, received ${typeof received}`;
+            case 'undefinedValue':
+                return getMessages().expectedUndefined;
+            case 'literal':
+                return getMessages().literalExpected(JSON.stringify(expected), JSON.stringify(received));
+            default:
+                return getMessages().invalidMap;
+        }
+    }
+    parseSimpleItem(mode, expected, value) {
+        switch (mode) {
+            case 'string':
+                if (typeof value !== 'string') {
+                    throw new Error(this.getSimpleItemError(mode, expected, value));
+                }
+                return value;
+            case 'number':
+                if (typeof value !== 'number' || isNaN(value)) {
+                    throw new Error(this.getSimpleItemError(mode, expected, value));
+                }
+                return value;
+            case 'boolean':
+                if (typeof value !== 'boolean') {
+                    throw new Error(this.getSimpleItemError(mode, expected, value));
+                }
+                return value;
+            case 'bigint':
+                if (typeof value !== 'bigint') {
+                    throw new Error(this.getSimpleItemError(mode, expected, value));
+                }
+                return value;
+            case 'symbol':
+                if (typeof value !== 'symbol') {
+                    throw new Error(this.getSimpleItemError(mode, expected, value));
+                }
+                return value;
+            case 'null':
+                if (value !== null) {
+                    throw new Error(this.getSimpleItemError(mode, expected, value));
+                }
+                return null;
+            case 'undefinedValue':
+                if (value !== undefined) {
+                    throw new Error(this.getSimpleItemError(mode, expected, value));
+                }
+                return undefined;
+            case 'literal':
+                if (value !== expected) {
+                    throw new Error(this.getSimpleItemError(mode, expected, value));
+                }
+                return expected;
+            case 'passthrough':
+                return value;
+        }
+    }
+    /**
+     * Parse and validate a Map value
+     */
+    parse(value) {
+        if (!(value instanceof Map)) {
+            throw new Error(this.errorMessage || getMessages().invalidMap);
+        }
+        return this.parseKnownMap(value);
+    }
+    /**
+     * Parse a value that has already passed the Map instance guard.
+     * @internal Used by object validators to avoid duplicate hot-path checks.
+     */
+    parseKnownMap(value) {
+        const result = new Map();
+        const simpleKeyMode = this._simpleKeyMode;
+        const simpleValueMode = this._simpleValueMode;
+        if (simpleKeyMode === 'string' && simpleValueMode === 'number') {
+            for (const [key, val] of value) {
+                if (typeof key !== 'string') {
+                    throw new Error(this.getSimpleItemError(simpleKeyMode, this._simpleKeyValue, key));
+                }
+                if (typeof val !== 'number' || isNaN(val)) {
+                    throw new Error(this.getSimpleItemError(simpleValueMode, this._simpleValueValue, val));
+                }
+                result.set(key, val);
+            }
+            return result;
+        }
+        if (simpleKeyMode === 'string' && simpleValueMode === 'string') {
+            for (const [key, val] of value) {
+                if (typeof key !== 'string') {
+                    throw new Error(this.getSimpleItemError(simpleKeyMode, this._simpleKeyValue, key));
+                }
+                if (typeof val !== 'string') {
+                    throw new Error(this.getSimpleItemError(simpleValueMode, this._simpleValueValue, val));
+                }
+                result.set(key, val);
+            }
+            return result;
+        }
+        if (simpleKeyMode !== undefined && simpleValueMode !== undefined) {
+            const keyMode = simpleKeyMode;
+            const valueMode = simpleValueMode;
+            for (const [key, val] of value) {
+                const validKey = this.parseSimpleItem(keyMode, this._simpleKeyValue, key);
+                const validValue = this.parseSimpleItem(valueMode, this._simpleValueValue, val);
+                result.set(validKey, validValue);
+            }
+            return result;
+        }
+        for (const [key, val] of value) {
+            try {
+                const validKey = simpleKeyMode === undefined
+                    ? this.keyValidator.parse(key)
+                    : this.parseSimpleItem(simpleKeyMode, this._simpleKeyValue, key);
+                const validValue = simpleValueMode === undefined
+                    ? this.valueValidator.parse(val)
+                    : this.parseSimpleItem(simpleValueMode, this._simpleValueValue, val);
+                result.set(validKey, validValue);
+            }
+            catch (error) {
+                throw new Error(error.message);
+            }
+        }
+        return result;
+    }
+    /**
+     * Safely parse and validate a Map value
+     */
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: createMapError(error.message) };
+        }
+    }
+}
+
+export { VldMap };

package/dist/validators/nan.d.ts

@@ -2,8 +2,8 @@
  * VldNan - Validates that a value is NaN (Not a Number)
  * Part of Zod 4 API parity implementation
  */
-import { VldBase } from './base';
-import type { ParseResult } from './base';
+import { VldBase } from './base.js';
+import type { ParseResult } from './base.js';
 /**
  * NaN validator - validates that a value is NaN
  * Note: Uses Number.isNaN() which is more strict than global isNaN()
@@ -14,4 +14,3 @@ export declare class VldNan extends VldBase<unknown, number> {
     parse(value: unknown): number;
     safeParse(value: unknown): ParseResult<number>;
 }
-//# sourceMappingURL=nan.d.ts.map

package/dist/validators/nan.js

@@ -0,0 +1,38 @@
+import { VldBase, VLD_VALIDATOR_TYPES } from './base.js';
+import { V as VldError } from '../chunks/errors-core-BeiFUtZM.js';
+
+/**
+ * VldNan - Validates that a value is NaN (Not a Number)
+ * Part of Zod 4 API parity implementation
+ */
+function createNanError(message) {
+    return new VldError([{ code: 'invalid_number', path: [], message }]);
+}
+/**
+ * NaN validator - validates that a value is NaN
+ * Note: Uses Number.isNaN() which is more strict than global isNaN()
+ */
+class VldNan extends VldBase {
+    constructor() {
+        super(VLD_VALIDATOR_TYPES.NAN);
+    }
+    static create() {
+        return new VldNan();
+    }
+    parse(value) {
+        if (typeof value !== 'number' || !Number.isNaN(value)) {
+            throw new Error(`Expected NaN, received ${typeof value === 'number' ? 'a valid number' : typeof value}`);
+        }
+        return value;
+    }
+    safeParse(value) {
+        try {
+            return { success: true, data: this.parse(value) };
+        }
+        catch (error) {
+            return { success: false, error: createNanError(error.message) };
+        }
+    }
+}
+
+export { VldNan };

package/dist/validators/never.d.ts

@@ -1,4 +1,4 @@
-import { VldBase, ParseResult } from './base';
+import { VldBase, ParseResult } from './base.js';
 /**
  * Validator that never succeeds
  */
@@ -16,4 +16,3 @@ export declare class VldNever extends VldBase<never, never> {
      */
     safeParse(_value: unknown): ParseResult<never>;
 }
-//# sourceMappingURL=never.d.ts.map