@oxog/vld 2.1.0 → 2.2.5

package/dist/chunks/index-0R2ntSud.js

@@ -1,508 +0,0 @@
-import { VldCodec } from '../validators/codec.js';
-import { VldBase64 } from '../validators/base64.js';
-import { VldHex } from '../validators/hex.js';
-import { VldUint8Array } from '../validators/uint8array.js';
-import { V as VldString } from './string-BJRQod3t.js';
-import { VldNumber } from '../validators/number.js';
-import { VldBigInt } from '../validators/bigint.js';
-import { VldBoolean } from '../validators/boolean.js';
-import { VldDate } from '../validators/date.js';
-import { VldUnknown } from '../validators/unknown.js';
-
-/**
- * Utility functions for codec transformations
- */
-/**
- * Convert a base64 string to Uint8Array
- */
-function base64ToUint8Array(base64) {
-    // Handle URL-safe base64
-    const base64Clean = base64.replace(/-/g, '+').replace(/_/g, '/');
-    // Add padding if necessary
-    const padded = base64Clean.padEnd(base64Clean.length + (4 - base64Clean.length % 4) % 4, '=');
-    // Decode base64 to binary string
-    const binaryString = safeAtob(padded);
-    // Convert binary string to Uint8Array
-    const bytes = new Uint8Array(binaryString.length);
-    for (let i = 0; i < binaryString.length; i++) {
-        bytes[i] = binaryString.charCodeAt(i);
-    }
-    return bytes;
-}
-/**
- * Convert Uint8Array to base64 string
- */
-function uint8ArrayToBase64(bytes) {
-    // Convert Uint8Array to binary string
-    let binaryString = '';
-    for (let i = 0; i < bytes.length; i++) {
-        binaryString += String.fromCharCode(bytes[i]);
-    }
-    // Encode to base64
-    return safeBtoa(binaryString);
-}
-/**
- * Convert Uint8Array to URL-safe base64 string
- */
-function uint8ArrayToBase64Url(bytes) {
-    const base64 = uint8ArrayToBase64(bytes);
-    // Make URL-safe and remove padding
-    return base64
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=/g, '');
-}
-/**
- * Convert hex string to Uint8Array
- */
-function hexToUint8Array(hex) {
-    // BUG-010 FIX: Add length validation to prevent memory exhaustion
-    // 20 million characters = 10MB of data (consistent with base64 limits)
-    if (hex.length > 20000000) {
-        throw new Error('Hex string is too large (max 10MB)');
-    }
-    // Remove any 0x prefix if present
-    const cleanHex = hex.startsWith('0x') ? hex.slice(2) : hex;
-    // BUG-NPM-006 FIX: Validate hex characters to prevent silent data corruption
-    // parseInt silently returns NaN for invalid hex, which becomes 0 in Uint8Array
-    const hexPattern = /^[0-9a-fA-F]*$/;
-    if (!hexPattern.test(cleanHex)) {
-        throw new Error('Invalid hex string: contains non-hexadecimal characters');
-    }
-    // Ensure even length
-    const paddedHex = cleanHex.length % 2 === 0 ? cleanHex : '0' + cleanHex;
-    const bytes = new Uint8Array(paddedHex.length / 2);
-    for (let i = 0; i < paddedHex.length; i += 2) {
-        bytes[i / 2] = parseInt(paddedHex.substring(i, i + 2), 16);
-    }
-    return bytes;
-}
-/**
- * Convert Uint8Array to hex string
- */
-function uint8ArrayToHex(bytes) {
-    let hex = '';
-    for (let i = 0; i < bytes.length; i++) {
-        const byte = bytes[i].toString(16);
-        hex += byte.length === 1 ? '0' + byte : byte;
-    }
-    return hex;
-}
-/**
- * Convert string to Uint8Array using UTF-8 encoding
- * BUG-NEW-011 FIX: Add DoS protection with 10MB limit
- */
-function stringToUint8Array(str) {
-    // Add DoS protection - limit to 10MB (consistent with base64 limit)
-    const MAX_STRING_LENGTH = 10000000; // 10 million characters (~10MB)
-    if (str.length > MAX_STRING_LENGTH) {
-        throw new Error(`String is too large for UTF-8 encoding (max ${MAX_STRING_LENGTH} characters)`);
-    }
-    const encoder = new TextEncoder();
-    return encoder.encode(str);
-}
-/**
- * Convert Uint8Array to string using UTF-8 decoding
- * BUG-NEW-012 FIX: Add DoS protection with 10MB limit
- */
-function uint8ArrayToString(bytes) {
-    // Add DoS protection - limit to 10MB
-    const MAX_BYTES_LENGTH = 10000000; // 10 million bytes
-    if (bytes.length > MAX_BYTES_LENGTH) {
-        throw new Error(`Byte array is too large for UTF-8 decoding (max ${MAX_BYTES_LENGTH} bytes)`);
-    }
-    const decoder = new TextDecoder();
-    return decoder.decode(bytes);
-}
-/**
- * Check if running in Node.js environment
- */
-function isNodeEnvironment() {
-    return typeof globalThis !== 'undefined' &&
-        typeof globalThis.process !== 'undefined' &&
-        globalThis.process.versions != null &&
-        globalThis.process.versions.node != null;
-}
-/**
- * Validate and sanitize base64 input to prevent prototype pollution
- */
-function validateBase64Input(encoded) {
-    // Check for null/undefined
-    if (encoded == null) {
-        throw new Error('Base64 input cannot be null or undefined');
-    }
-    // Ensure it's a string
-    if (typeof encoded !== 'string') {
-        throw new Error('Base64 input must be a string');
-    }
-    // Length validation - base64 strings should be reasonable length
-    if (encoded.length > 10000000) { // 10MB limit
-        throw new Error('Base64 input is too large');
-    }
-    // Base64 character validation - only allow valid base64 characters
-    const base64Regex = /^[A-Za-z0-9+/]*={0,2}$/;
-    if (!base64Regex.test(encoded)) {
-        throw new Error('Invalid base64 format');
-    }
-    // BUG-NEW-004 FIX: Correct base64 padding validation per RFC 4648
-    // Base64 only uses '=' or '==' as padding, never '==='
-    const paddingIndex = encoded.indexOf('=');
-    if (paddingIndex !== -1) {
-        const padding = encoded.substring(paddingIndex);
-        // Only allow '=' or '==' as valid padding (RFC 4648 compliant)
-        if (!/^={1,2}$/.test(padding)) {
-            throw new Error('Invalid base64 padding');
-        }
-        // Padding should only be at the end
-        if (paddingIndex < encoded.length - 2) {
-            throw new Error('Base64 padding must be at the end');
-        }
-    }
-    // Additional security check: prevent potential encoded JavaScript
-    // by looking for suspicious patterns that might indicate malicious content
-    const suspiciousPatterns = [
-        /eval/i,
-        /function/i,
-        /javascript:/i,
-        /<script/i,
-        /on\w+\s*=/i,
-        /__proto__/i,
-        /constructor/i,
-        /prototype/i
-    ];
-    // Decode a small portion to check for suspicious content
-    try {
-        const sampleSize = Math.min(100, encoded.length);
-        const sample = encoded.substring(0, sampleSize);
-        const sampleDecoded = typeof atob !== 'undefined'
-            ? atob(sample)
-            : Buffer.from(sample, 'base64').toString('utf8', 0, 50); // Only decode first 50 chars
-        for (const pattern of suspiciousPatterns) {
-            if (pattern.test(sampleDecoded)) {
-                throw new Error('Suspicious content detected in base64 input');
-            }
-        }
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.includes('Suspicious content')) {
-            throw error;
-        }
-        // If decoding fails, continue - it might be invalid base64 which will be caught later
-    }
-}
-/**
- * Polyfill for atob in Node.js with proper input validation
- */
-function safeAtob(encoded) {
-    // Input validation and sanitization
-    validateBase64Input(encoded);
-    if (typeof atob !== 'undefined') {
-        try {
-            return atob(encoded);
-        }
-        catch {
-            throw new Error('Failed to decode base64 data');
-        }
-    }
-    // Node.js fallback with additional validation
-    if (isNodeEnvironment()) {
-        try {
-            // Use Buffer with explicit error handling
-            const buffer = Buffer.from(encoded, 'base64');
-            // Additional validation: ensure the decoded data is reasonable size
-            if (buffer.length > 5000000) { // 5MB limit for decoded data
-                throw new Error('Decoded base64 data is too large');
-            }
-            return buffer.toString('binary');
-        }
-        catch (error) {
-            if (error instanceof Error && error.message.includes('Invalid base64')) {
-                throw new Error('Invalid base64 format');
-            }
-            throw new Error('Failed to decode base64 data in Node.js environment');
-        }
-    }
-    throw new Error('Base64 decoding not supported in this environment');
-}
-/**
- * Polyfill for btoa in Node.js
- */
-function safeBtoa(str) {
-    if (typeof btoa !== 'undefined') {
-        return btoa(str);
-    }
-    // Node.js fallback
-    if (isNodeEnvironment()) {
-        return Buffer.from(str, 'binary').toString('base64');
-    }
-    throw new Error('Base64 encoding not supported in this environment');
-}
-
-/**
- * Invert a codec, swapping encode and decode directions.
- */
-function invertCodec(codec) {
-    return codec.invert();
-}
-// ===== STRING TO NUMBER CODECS =====
-/**
- * String to number codec
- */
-const stringToNumber = VldCodec.create(VldString.create(), VldNumber.create(), {
-    decode: (str) => {
-        const num = Number(str);
-        if (isNaN(num))
-            throw new Error('Invalid number');
-        return num;
-    },
-    encode: (num) => num.toString()
-});
-/**
- * String to integer codec
- */
-const stringToInt = VldCodec.create(VldString.create(), VldNumber.create().int(), {
-    decode: (str) => {
-        const num = parseInt(str, 10);
-        if (isNaN(num))
-            throw new Error('Invalid integer');
-        return num;
-    },
-    encode: (num) => Math.floor(num).toString()
-});
-/**
- * String to BigInt codec
- */
-const stringToBigInt = VldCodec.create(VldString.create(), VldBigInt.create(), {
-    decode: (str) => {
-        try {
-            return BigInt(str);
-        }
-        catch {
-            throw new Error('Invalid BigInt');
-        }
-    },
-    encode: (bigint) => bigint.toString()
-});
-/**
- * Number to BigInt codec
- */
-const numberToBigInt = VldCodec.create(VldNumber.create().int(), VldBigInt.create(), {
-    decode: (num) => BigInt(Math.floor(num)),
-    encode: (bigint) => Number(bigint)
-});
-// ===== DATE CODECS =====
-/**
- * ISO datetime string to Date codec
- */
-const isoDatetimeToDate = VldCodec.create(VldString.create().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z?$/, 'Invalid ISO datetime format'), VldDate.create(), {
-    decode: (isoString) => {
-        const date = new Date(isoString);
-        if (isNaN(date.getTime()))
-            throw new Error('Invalid date');
-        return date;
-    },
-    encode: (date) => date.toISOString()
-});
-/**
- * Epoch seconds to Date codec
- */
-const epochSecondsToDate = VldCodec.create(VldNumber.create(), VldDate.create(), {
-    decode: (seconds) => new Date(seconds * 1000),
-    encode: (date) => Math.floor(date.getTime() / 1000)
-});
-/**
- * Epoch milliseconds to Date codec
- */
-const epochMillisToDate = VldCodec.create(VldNumber.create(), VldDate.create(), {
-    decode: (millis) => new Date(millis),
-    encode: (date) => date.getTime()
-});
-// ===== JSON CODEC =====
-/**
- * JSON string codec for any type
- */
-const jsonCodec = (schema) => {
-    const outputSchema = schema || VldUnknown.create();
-    return VldCodec.create(VldString.create(), outputSchema, {
-        decode: (jsonString) => {
-            try {
-                return JSON.parse(jsonString);
-            }
-            catch {
-                throw new Error('Invalid JSON');
-            }
-        },
-        encode: (data) => JSON.stringify(data)
-    });
-};
-// ===== URL CODECS =====
-/**
- * String to URL codec
- */
-const stringToURL = VldCodec.create(VldString.create().url(), VldUnknown.create(), // URL object
-{
-    decode: (urlString) => {
-        try {
-            return new URL(urlString);
-        }
-        catch {
-            throw new Error('Invalid URL');
-        }
-    },
-    encode: (url) => url.toString()
-});
-/**
- * String to HTTP/HTTPS URL codec
- */
-const stringToHttpURL = VldCodec.create(VldString.create().regex(/^https?:\/\//, 'Must be HTTP or HTTPS URL'), VldUnknown.create(), // URL object
-{
-    decode: (urlString) => {
-        try {
-            const url = new URL(urlString);
-            if (!['http:', 'https:'].includes(url.protocol)) {
-                throw new Error('Must be HTTP or HTTPS');
-            }
-            return url;
-        }
-        catch {
-            throw new Error('Invalid HTTP URL');
-        }
-    },
-    encode: (url) => url.toString()
-});
-/**
- * URI component encode/decode codec
- */
-const uriComponent = VldCodec.create(VldString.create(), VldString.create(), {
-    decode: (encoded) => {
-        try {
-            return decodeURIComponent(encoded);
-        }
-        catch {
-            throw new Error('Invalid URI component');
-        }
-    },
-    encode: (decoded) => encodeURIComponent(decoded)
-});
-/**
- * String to boolean codec
- */
-const stringToBoolean = VldCodec.create(VldString.create(), VldBoolean.create(), {
-    decode: (str) => {
-        const lower = str.toLowerCase();
-        if (lower === 'true' || lower === '1' || lower === 'yes' || lower === 'on')
-            return true;
-        if (lower === 'false' || lower === '0' || lower === 'no' || lower === 'off')
-            return false;
-        throw new Error('Invalid boolean string');
-    },
-    encode: (bool) => bool.toString()
-});
-// ===== EXISTING BYTE CODECS (updated) =====
-/**
- * Base64 to Uint8Array codec
- */
-const base64ToBytes = VldCodec.create(VldBase64.create(), VldUint8Array.create(), {
-    decode: base64ToUint8Array,
-    encode: uint8ArrayToBase64
-});
-/**
- * URL-safe Base64 to Uint8Array codec
- */
-const base64UrlToBytes = VldCodec.create(VldBase64.create().urlSafeMode(), VldUint8Array.create(), {
-    decode: base64ToUint8Array,
-    encode: uint8ArrayToBase64Url
-});
-/**
- * Hexadecimal to Uint8Array codec
- */
-const hexToBytes = VldCodec.create(VldHex.create(), VldUint8Array.create(), {
-    decode: hexToUint8Array,
-    encode: uint8ArrayToHex
-});
-/**
- * Lowercase hexadecimal to Uint8Array codec
- */
-const hexLowerToBytes = VldCodec.create(VldHex.create().lowercaseMode(), VldUint8Array.create(), {
-    decode: hexToUint8Array,
-    encode: (bytes) => uint8ArrayToHex(bytes).toLowerCase()
-});
-/**
- * UTF-8 string to Uint8Array codec
- */
-const utf8ToBytes = VldCodec.create(VldString.create(), VldUint8Array.create(), {
-    decode: stringToUint8Array,
-    encode: uint8ArrayToString
-});
-/**
- * Uint8Array to UTF-8 string codec (reverse of utf8ToBytes)
- */
-const bytesToUtf8 = VldCodec.create(VldUint8Array.create(), VldString.create(), {
-    decode: uint8ArrayToString,
-    encode: stringToUint8Array
-});
-/**
- * Base64URL to Uint8Array codec (updated)
- */
-const base64urlToBytes = VldCodec.create(VldBase64.create().urlSafeMode(), VldUint8Array.create(), {
-    decode: base64ToUint8Array,
-    encode: uint8ArrayToBase64Url
-});
-/**
- * Base64 encoded JSON codec (updated)
- */
-const base64Json = (schema) => {
-    const outputSchema = schema || VldUnknown.create();
-    return VldCodec.create(VldBase64.create(), outputSchema, {
-        decode: (base64) => {
-            // BUG-NPM-005 FIX: Add error handling for JSON parsing
-            try {
-                const jsonString = uint8ArrayToString(base64ToUint8Array(base64));
-                return JSON.parse(jsonString);
-            }
-            catch (error) {
-                throw new Error(`Failed to parse base64 JSON: ${error.message}`);
-            }
-        },
-        encode: (data) => {
-            const jsonString = JSON.stringify(data);
-            return uint8ArrayToBase64(stringToUint8Array(jsonString));
-        }
-    });
-};
-/**
- * JWT payload decoder (base64url encoded JSON) - updated
- */
-const jwtPayload = (schema) => {
-    const outputSchema = schema || VldUnknown.create();
-    return VldCodec.create(VldString.create().refine(s => s.split('.').length === 3, 'Invalid JWT format'), outputSchema, {
-        decode: (jwt) => {
-            // BUG-NPM-004 FIX: Add comprehensive error handling for JWT parsing
-            try {
-                const parts = jwt.split('.');
-                if (parts.length !== 3) {
-                    throw new Error('JWT must have exactly 3 parts');
-                }
-                const payloadBase64 = parts[1];
-                if (!payloadBase64) {
-                    throw new Error('JWT payload is empty');
-                }
-                // Convert base64url to base64
-                const base64 = payloadBase64
-                    .replace(/-/g, '+')
-                    .replace(/_/g, '/')
-                    .padEnd(payloadBase64.length + (4 - payloadBase64.length % 4) % 4, '=');
-                const jsonString = uint8ArrayToString(base64ToUint8Array(base64));
-                return JSON.parse(jsonString);
-            }
-            catch (error) {
-                throw new Error(`Failed to decode JWT payload: ${error.message}`);
-            }
-        },
-        encode: () => {
-            throw new Error('JWT encoding not supported - use a proper JWT library');
-        }
-    });
-};
-
-export { uint8ArrayToString as A, uriComponent as B, utf8ToBytes as C, base64ToBytes as a, base64Json as b, base64ToUint8Array as c, base64UrlToBytes as d, base64urlToBytes as e, bytesToUtf8 as f, epochMillisToDate as g, epochSecondsToDate as h, hexLowerToBytes as i, hexToBytes as j, hexToUint8Array as k, invertCodec as l, isoDatetimeToDate as m, jsonCodec as n, jwtPayload as o, numberToBigInt as p, stringToBoolean as q, stringToHttpURL as r, stringToBigInt as s, stringToInt as t, stringToNumber as u, stringToURL as v, stringToUint8Array as w, uint8ArrayToBase64 as x, uint8ArrayToBase64Url as y, uint8ArrayToHex as z };

package/dist/chunks/index-BvH403Yy.js

@@ -1,88 +0,0 @@
-import { registerLocale, registerFallbackLocale, setLocale, getLocale, getMessages, getMessagesForLocale, getSupportedLocales, isLocaleLoaded, isLocaleSupported } from '../locales/runtime.js';
-import { en } from '../locales/en.js';
-import { tr } from '../locales/tr.js';
-import { es } from '../locales/es.js';
-import { fr } from '../locales/fr.js';
-import { de } from '../locales/de.js';
-import { it } from '../locales/it.js';
-import { pt } from '../locales/pt.js';
-import { ru } from '../locales/ru.js';
-import { ja } from '../locales/ja.js';
-import { ko } from '../locales/ko.js';
-import { zh } from '../locales/zh.js';
-import { ar } from '../locales/ar.js';
-import { hi } from '../locales/hi.js';
-import { nl } from '../locales/nl.js';
-import { pl } from '../locales/pl.js';
-import { da } from '../locales/da.js';
-import { sv } from '../locales/sv.js';
-import { no } from '../locales/no.js';
-import { fi } from '../locales/fi.js';
-import { th } from '../locales/th.js';
-import { vi } from '../locales/vi.js';
-import { id } from '../locales/id.js';
-import { bn } from '../locales/bn.js';
-import { sw } from '../locales/sw.js';
-import { af } from '../locales/af.js';
-import { ptBR } from '../locales/pt-BR.js';
-import { esMX } from '../locales/es-MX.js';
-
-const translatedLocaleCodes = [
-    'en', 'tr', 'es', 'fr', 'de', 'it', 'pt', 'ru', 'ja', 'ko', 'zh', 'ar', 'hi', 'nl', 'pl',
-    'da', 'sv', 'no', 'fi',
-    'th', 'vi', 'id', 'bn',
-    'sw', 'af',
-    'pt-BR', 'es-MX'
-];
-const fallbackLocaleCodes = [
-    'is', 'cs', 'sk', 'hu', 'ro', 'bg', 'hr', 'sl', 'lv', 'lt', 'et',
-    'el', 'mk', 'sq', 'sr', 'bs', 'me', 'mt', 'ga', 'cy', 'eu', 'ca',
-    'ms', 'tl', 'ur', 'fa', 'he', 'ka', 'am', 'hy', 'az', 'kk', 'ky',
-    'uz', 'tg', 'mn', 'my', 'km', 'lo', 'si', 'ta', 'te', 'ml', 'kn',
-    'gu', 'pa', 'or', 'as', 'ne', 'mr', 'sd', 'dv',
-    'ha', 'yo', 'ig', 'zu', 'xh', 'st', 'tn', 'ts', 've', 'nr', 'ss',
-    'es-AR', 'fr-CA', 'qu', 'gn', 'ay'
-];
-const translatedLocales = {
-    // Base languages
-    en, tr, es, fr, de, it, pt, ru, ja, ko, zh, ar, hi, nl, pl,
-    // Major European Languages
-    da, sv, no, fi,
-    // Major Asian Languages  
-    th, vi, id, bn,
-    // African Languages
-    sw, af,
-    // American Languages
-    'pt-BR': ptBR,
-    'es-MX': esMX,
-};
-for (const locale of translatedLocaleCodes) {
-    registerLocale(locale, translatedLocales[locale]);
-}
-for (const locale of fallbackLocaleCodes) {
-    registerFallbackLocale(locale);
-}
-/**
- * Set the current locale asynchronously.
- *
- * The eager locale entrypoint already bundles translated locales and English
- * fallbacks, so this mirrors setLocale() while preserving async API parity.
- */
-async function setLocaleAsync(locale) {
-    setLocale(locale);
-}
-
-var localeNamespace = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    getLocale: getLocale,
-    getMessages: getMessages,
-    getMessagesForLocale: getMessagesForLocale,
-    getSupportedLocales: getSupportedLocales,
-    isLocaleLoaded: isLocaleLoaded,
-    isLocaleSupported: isLocaleSupported,
-    registerLocale: registerLocale,
-    setLocale: setLocale,
-    setLocaleAsync: setLocaleAsync
-});
-
-export { localeNamespace as l, setLocaleAsync as s };

package/dist/chunks/security-B0Pd_vSY.js

@@ -1,35 +0,0 @@
-/**
- * Security utilities for prototype pollution protection
- */
-/**
- * Keys that, when written via `obj[key] = ...`, can mutate Object.prototype
- * or alter property accessor behavior across the program.
- *
- * `__proto__`, `constructor`, `prototype` are the canonical prototype-pollution
- * sinks. The `__define*Getter__` / `__lookup*Getter__` family installs accessors
- * on the prototype chain in legacy engines.
- *
- * Note: keys such as `toString`, `valueOf`, or `hasOwnProperty` are NOT
- * blocked. Those are legitimate property names that appear in real payloads
- * (localization tables, custom widget config, generic key/value stores).
- * Silently dropping them causes data loss; a validation library must not do
- * that.
- */
-const DANGEROUS_KEYS = new Set([
-    '__proto__',
-    'constructor',
-    'prototype',
-    '__defineGetter__',
-    '__defineSetter__',
-    '__lookupGetter__',
-    '__lookupSetter__',
-]);
-/**
- * Return true if a property key would, if assigned, mutate the prototype
- * chain or accessor behavior of the target object.
- */
-function isDangerousKey(key) {
-    return DANGEROUS_KEYS.has(key);
-}
-
-export { isDangerousKey as i };