@oxog/vld 2.0.3 → 2.2.5

package/CHANGELOG.md

@@ -5,6 +5,125 @@ All notable changes to VLD will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- Added repository policy and contribution scaffolding: `SECURITY.md`, `CODE_OF_CONDUCT.md`, and GitHub issue templates for bug reports and feature requests.
+- Added `.nvmrc` (Node 24) and `.npmrc` (lockfile-exact installs, `ignore-scripts=true`) so local installs match the CI matrix.
+
+### Changed
+
+- Rewrote `.gitignore` into labelled sections and extended it to cover build metadata (`*.tsbuildinfo`, `.rollup.cache/`), packaging artifacts (`*.tgz`), test and gate scratch output (`test-results/`, `junit.xml`, `.nyc_output/`), tool caches (`.eslintcache`, `.cache/`), OS junk (`Thumbs.db`, `desktop.ini`), and local agent state. `.wrongstack/project.json` stays tracked while the rest of that directory stays ignored.
+
+### Removed
+
+- Removed `.npmignore`. The `files` field in `package.json` already scopes the published tarball, and `npm pack --dry-run` produces the same 299-file, 246.1 kB artifact with the file gone, so it was inert configuration carrying a broken `\!dist/*.d.ts` negation that would have stripped type declarations if it had ever taken effect.
+- Removed `fix-locale.js`, a one-off locale repair script from the v1.x era that depended on a `glob` package the project no longer installs.
+
+## [2.2.1] - 2026-08-17
+
+### Added
+
+- Added `creditCard()` string format (regex plus Luhn checksum) with `ZodCreditCard`, `ZodMiniCreditCard`, and `$ZodCreditCard` aliases, and localized messages across the locale set.
+- Added `deepPartial()`, `input()`, and `output()` root helpers backed by a children-first schema walker that mirrors Zod's `visit.js` ordering. Wrappers rebuild around the walked inner schema and cycles stay safe through `VldLazy` deferral.
+- Added `v4/core` parity shims: `_creditCard`, `isValidCreditCard`, `standardProps`, `handleUnrepresentable`, `$ZodCyclicError`, `attachMemoizer`, and `isBackEdge`.
+- Added `tests/canary-parity.test.ts` covering credit card validation, `deepPartial` across objects, arrays, records, maps, sets, tuples, unions, discriminated unions, intersections, pipes, lazy cycles, and wrappers, plus `input`/`output` pipe replacement and the new core utilities.
+- Added `.github/workflows/ci.yml`: lint, typecheck, the full test suite, build, and every verify gate on a Node 20/22/24 matrix, with benchmark guards on a single lane and a Windows lane for the path-sensitive gates.
+- Added `.github/workflows/release.yml`: publish on a `v*.*.*` tag push with OIDC provenance through the existing `prepublishOnly`/`release:check` hooks, tag/version and changelog guards, changelog-extracted GitHub Release notes, and a dry-run lane.
+
+### Changed
+
+- Release builds are now minified by default through terser (opt out with `VLD_MINIFY=0`). Mangling preserves `/^Vld/` class names because `json-schema.ts` dispatches roughly 41 conversions on `schema.constructor.name` with no fallback, which silently broke `toJSONSchema()` in minified artifacts while the unminified Jest suite stayed green.
+- The Zod canary parity lane is now non-blocking (`continue-on-error: true`). The stable `latest` lane remains blocking; canary stays an early-warning signal.
+
+### Fixed
+
+- Fixed `handleUnrepresentable` to shallow-clone the consumer-supplied fragment before merging it into the JSON Schema output, so a later mutation of the returned object can no longer corrupt emitted JSON.
+- Fixed `verify-bundle` probe imports to use relative forward-slash specifiers. Absolute Windows paths embedded backslashes that ESM consumed as escape sequences, and `file://` URLs made Rollup externalize the probe, turning the check into a vacuous pass.
+- Fixed the drop-in verification gap for minified output: `verify-drop-in` now asserts name-dispatched composites against the built CJS bundle (union emits `anyOf`, optional unwraps, nullable emits a type array).
+- Fixed a `VldCoerceDate` array-coercion test that depended on the local timezone.
+- Synced the `package-lock.json` root version with `package.json`. The version bump left the lockfile at 2.2.0, which failed the `verify:package` gate and therefore blocked `release:check`.
+
+### Security
+
+- Resolved high-severity advisories in the development dependency tree by pinning `brace-expansion` 2.1.4 and `js-yaml` 4.3.1 through `overrides`. Runtime dependencies remain at zero.
+
+### Verified
+
+- 88 test suites and 2502 tests passing with 100% statement, branch, function, and line coverage.
+- Runtime performance guard green against Zod 4.4.3: 8/8 guarded cases pass with a 7.16x average ratio (floors are 1.2x per case and 3x average).
+- Startup guard green: import 0.95x, total 1.03x, warm parse 2.56x versus Zod (floors are 0.85x, 0.9x, and 1.25x).
+- `verify:package` green: 299 files, ~243 KiB tarball and ~1.1 MiB unpacked, inside the configured budgets.
+- `verify:ascii` and `verify:docs` green: 221 files scanned, 7 package specifiers and 56 named README imports resolved against the built package.
+
+## [2.2.0] - 2026-07-29
+
+### Added
+
+- Added Zod 4-compatible structured error issues across all primitive and collection validators.
+  - Type mismatches now produce `invalid_type` issues with `expected` and `received` fields using Zod's `"Invalid input: expected X, received Y"` message format.
+  - Constraint failures produce `too_small` / `too_big` issues with `minimum`, `maximum`, `origin`, and `inclusive` fields.
+  - String format failures produce `invalid_format` issues with `format`, `origin`, and `pattern` fields.
+  - Enum and literal failures produce `invalid_value` issues with a `values` array.
+- Added `getTypeName()` and `createInvalidTypeIssue()` helpers to `src/errors-core.ts` for consistent type naming across all validators.
+- Added `origin`, `format`, `values`, and `pattern` fields to the `VldIssue` interface and its JSON serialization.
+- Added new error codes: `invalid_format`, `invalid_value`, and `not_multiple_of`.
+- Added `tests/validators/zod4-error-parity.test.ts` with 80+ tests covering all Zod 4 error issue paths.
+- Added current Zod array-based factory signatures, two-schema records, multi-value literals, empty objects, and per-schema encode/decode methods.
+- Added transformed record keys, structured `invalid_key` issues, direct prefaults, and shallow-cloned collection defaults.
+- Added a Zod 4.4.3 differential behavior suite to the release gate and a maintained compatibility policy.
+- Added schema-instance composition methods, tuple rest schemas, nested object/array/tuple codec encoding, current string format methods, and boolean `fromJSONSchema()` support.
+- Added full nested `regexes`/`iso` parity, UUID v1-v8 options, WHATWG URL filters/normalization, and precision-aware ISO date-time formats.
+- Added a daily Zod parity workflow with a blocking `latest` contract and a separate `canary` early-warning lane.
+
+### Changed
+
+- **Breaking (error shape):** `parse()` now throws `VldError` (not plain `Error`) for all validators, matching Zod's `ZodError` throw behavior. Code using `try/catch` around `parse()` should check for `VldError` or `Error` interchangeably since `VldError extends Error`.
+- **Breaking (number validation):** `v.number()` now rejects `Infinity`, `-Infinity`, and `NaN` by default, matching Zod 4 behavior. Use `.finite()` explicitly if Infinity acceptance is needed.
+- JSON Schema now defaults to Draft 2020-12 and Zod-compatible handling of unrepresentable types; VLD extensions remain available through `{ unrepresentable: "vld" }`.
+- npm provenance is enforced for published packages.
+- Security audit now checks runtime dependencies only (`--omit=dev`), since VLD has zero runtime dependencies.
+
+### Verified
+
+- 87 test suites and 2473 tests passing with 100% statement, branch, line, and function coverage.
+- Zod parity verified against both `zod@4.4.3` (latest) and `zod@4.5.0-canary` (canary): 240 exports checked, 0 missing, 0 behavioral mismatches.
+- Runtime guard average 11.46x faster, startup total 1.35x faster, and 4.66x less retained heap than Zod 4.4.3.
+- Root string tree-shaken probe is 112.5 KiB versus Zod's 119.6 KiB; VLD mini is 63.9 KiB.
+
+## [2.1.0] - 2026-06-16
+
+### Added
+
+- Added first-class Zod drop-in package subpaths:
+  - `@oxog/vld/v3`
+  - `@oxog/vld/v4`
+  - `@oxog/vld/v4-mini`
+  - `@oxog/vld/v4/mini`
+  - `@oxog/vld/v4/core`
+  - `@oxog/vld/v4/locales`
+  - `@oxog/vld/v4/locales/*`
+- Added Zod-style mini aliases and helpers for `v4-mini` and `v4/mini`, including `ZodMini*` class aliases, `pick`, `omit`, `partial`, `required`, `extend`, `safeExtend`, `merge`, `catchall`, `minimum`, `maximum`, and `_default`.
+- Added Zod-style `v4/locales` named locale functions.
+- Added `v4/core` compatibility exports for the full Zod core export-name/type surface, plus common Zod core factory calling conventions.
+- Added `verify:drop-in`, a real TypeScript fixture app that compiles and runs once with `zod` and once with built VLD, then compares normalized runtime output.
+- Added release guards for Zod latest parity, package exports, published types, install smoke tests, package budgets, bundle budgets, drop-in fixture behavior, runtime performance, startup, and memory.
+
+### Changed
+
+- Strengthened `release:check` to include `verify:drop-in`.
+- Updated package metadata and budgets for the broader drop-in compatibility surface.
+- Kept validator `safeParse` failures aligned with public `VldError` formatting helpers across primitive, collection, scalar, and special validators.
+
+### Verified
+
+- Tested against npm latest `zod@4.4.3`.
+- 82 test suites and 2160 tests passing.
+- 100% statement, branch, and line coverage.
+- Zod subpath export parity has zero missing exports and zero type mismatches for `zod/v4`, `zod/v4-mini`, `zod/v4/mini`, `zod/v4/core`, and `zod/v4/locales`.
+- Latest release gate snapshot: runtime guard average 11.81x faster than Zod, startup total 1.50x faster, and 4.77x less retained heap.
+
 ## [2.0.3] - 2026-05-08
 
 ### 🐛 Bug Fixes
@@ -541,4 +660,4 @@ VLD continues to outperform Zod across all benchmarks:
 
 ---
 
-For more details, see the [GitHub Releases](https://github.com/ersinkoc/vld/releases)
+For more details, see the [GitHub Releases](https://github.com/ersinkoc/vld/releases)