@oxog/vld 2.1.0 → 2.2.7

package/CHANGELOG.md

@@ -5,6 +5,119 @@ All notable changes to VLD will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [2.2.6] - 2026-08-17
+
+### Added
+
+- Added complete 100% Zod 4 API and property parity across all schemas, instance methods, and root/namespace exports.
+- Added `namespace z` and top-level `ZodSchema`, `ZodType`, `ZodTypeAny`, `ZodTypeDef`, `ZodIssue` type exports for 100% drop-in replacement with `z.infer<typeof S>`, `z.input<typeof S>`, and `z.output<typeof S>`.
+- Added schema introspection getters: `type`, `_def`, `def`, `_zod` on all validators (`VldBase`).
+- Added schema-specific getters: `minLength`/`maxLength` (`VldString`), `minValue`/`maxValue`/`isInt`/`isFinite`/`format` (`VldNumber`), `minDate`/`maxDate` (`VldDate`), `minValue`/`maxValue`/`format` (`VldBigInt`), `options`/`enum` (`VldEnum`), `value` (`VldLiteral`), `options`/`discriminator` (`VldUnion`/`VldDiscriminatedUnion`), `keyType`/`valueType` (`VldRecord`/`VldMap`).
+- Added `min`, `max`, `size`, `nonempty` method chaining on `VldMap` and `VldSet`.
+- Added zero-argument `z.custom()`, predicate `z.custom((v) => ...)`, and options `z.custom({ parse: ... })` overloads.
+- Added `.errors` alias, `.isEmpty`, `.addIssue()`, `.addIssues()`, `.format()`, and `.flatten()` directly on `VldError` / `ZodError` instances.
+- Added `{ message?: string, path?: (string | number)[], params?: object }` config overload and custom message function `(val) => { message, path }` support to `.refine()` and `.check()`.
+- Added `{ code, path, message, fatal }` support to `ctx.addIssue()` in `.superRefine()` with path preservation.
+
+### Fixed
+
+- Fixed `safeParse` error shape across all validators and refinements to always return a `VldError` instance exposing `.issues` (`result.error.issues.map(...)`).
+- Fixed `VldPromise` to extend `VldBase` so all standard base methods (`refine`, `transform`, `optional`, `nullable`, `meta`, `describe`, etc.) are supported on promises while preserving asynchronous parsing semantics.
+
+## [2.2.5] - 2026-08-17
+
+### Added
+
+- Added modern documentation website and live playground deployed at [vld.oxog.dev](https://vld.oxog.dev).
+- Added in-browser live VLD execution engine in the playground for real-time schema validation, issue inspection, and execution timing.
+- Added GitHub Pages SPA routing decoder and `404.html` fallback for direct subpath navigation and page refresh.
+- Added cross-platform documentation synchronization script (`scripts/sync-docs.js`).
+- Added repository policy and contribution scaffolding: `SECURITY.md`, `CODE_OF_CONDUCT.md`, and GitHub issue templates for bug reports and feature requests.
+- Added `.nvmrc` (Node 24) and `.npmrc` (lockfile-exact installs, `ignore-scripts=true`) so local installs match the CI matrix.
+
+### Changed
+
+- Updated website pages (Home, Docs, API Reference, Benchmarks, Examples) to reflect latest `v2.2.5` APIs and release-gate benchmarks.
+- Rewrote `.gitignore` into labelled sections and extended it to cover build metadata (`*.tsbuildinfo`, `.rollup.cache/`), packaging artifacts (`*.tgz`), test and gate scratch output (`test-results/`, `junit.xml`, `.nyc_output/`), tool caches (`.eslintcache`, `.cache/`), OS junk (`Thumbs.db`, `desktop.ini`), and local agent state. `.wrongstack/project.json` stays tracked while the rest of that directory stays ignored.
+
+### Removed
+
+- Removed `.npmignore`. The `files` field in `package.json` already scopes the published tarball, and `npm pack --dry-run` produces the same 299-file, 246.1 kB artifact with the file gone, so it was inert configuration carrying a broken `\!dist/*.d.ts` negation that would have stripped type declarations if it had ever taken effect.
+- Removed `fix-locale.js`, a one-off locale repair script from the v1.x era that depended on a `glob` package the project no longer installs.
+
+## [2.2.1] - 2026-08-17
+
+### Added
+
+- Added `creditCard()` string format (regex plus Luhn checksum) with `ZodCreditCard`, `ZodMiniCreditCard`, and `$ZodCreditCard` aliases, and localized messages across the locale set.
+- Added `deepPartial()`, `input()`, and `output()` root helpers backed by a children-first schema walker that mirrors Zod's `visit.js` ordering. Wrappers rebuild around the walked inner schema and cycles stay safe through `VldLazy` deferral.
+- Added `v4/core` parity shims: `_creditCard`, `isValidCreditCard`, `standardProps`, `handleUnrepresentable`, `$ZodCyclicError`, `attachMemoizer`, and `isBackEdge`.
+- Added `tests/canary-parity.test.ts` covering credit card validation, `deepPartial` across objects, arrays, records, maps, sets, tuples, unions, discriminated unions, intersections, pipes, lazy cycles, and wrappers, plus `input`/`output` pipe replacement and the new core utilities.
+- Added `.github/workflows/ci.yml`: lint, typecheck, the full test suite, build, and every verify gate on a Node 20/22/24 matrix, with benchmark guards on a single lane and a Windows lane for the path-sensitive gates.
+- Added `.github/workflows/release.yml`: publish on a `v*.*.*` tag push with OIDC provenance through the existing `prepublishOnly`/`release:check` hooks, tag/version and changelog guards, changelog-extracted GitHub Release notes, and a dry-run lane.
+
+### Changed
+
+- Release builds are now minified by default through terser (opt out with `VLD_MINIFY=0`). Mangling preserves `/^Vld/` class names because `json-schema.ts` dispatches roughly 41 conversions on `schema.constructor.name` with no fallback, which silently broke `toJSONSchema()` in minified artifacts while the unminified Jest suite stayed green.
+- The Zod canary parity lane is now non-blocking (`continue-on-error: true`). The stable `latest` lane remains blocking; canary stays an early-warning signal.
+
+### Fixed
+
+- Fixed `handleUnrepresentable` to shallow-clone the consumer-supplied fragment before merging it into the JSON Schema output, so a later mutation of the returned object can no longer corrupt emitted JSON.
+- Fixed `verify-bundle` probe imports to use relative forward-slash specifiers. Absolute Windows paths embedded backslashes that ESM consumed as escape sequences, and `file://` URLs made Rollup externalize the probe, turning the check into a vacuous pass.
+- Fixed the drop-in verification gap for minified output: `verify-drop-in` now asserts name-dispatched composites against the built CJS bundle (union emits `anyOf`, optional unwraps, nullable emits a type array).
+- Fixed a `VldCoerceDate` array-coercion test that depended on the local timezone.
+- Synced the `package-lock.json` root version with `package.json`. The version bump left the lockfile at 2.2.0, which failed the `verify:package` gate and therefore blocked `release:check`.
+
+### Security
+
+- Resolved high-severity advisories in the development dependency tree by pinning `brace-expansion` 2.1.4 and `js-yaml` 4.3.1 through `overrides`. Runtime dependencies remain at zero.
+
+### Verified
+
+- 88 test suites and 2502 tests passing with 100% statement, branch, function, and line coverage.
+- Runtime performance guard green against Zod 4.4.3: 8/8 guarded cases pass with a 7.16x average ratio (floors are 1.2x per case and 3x average).
+- Startup guard green: import 0.95x, total 1.03x, warm parse 2.56x versus Zod (floors are 0.85x, 0.9x, and 1.25x).
+- `verify:package` green: 299 files, ~243 KiB tarball and ~1.1 MiB unpacked, inside the configured budgets.
+- `verify:ascii` and `verify:docs` green: 221 files scanned, 7 package specifiers and 56 named README imports resolved against the built package.
+
+## [2.2.0] - 2026-07-29
+
+### Added
+
+- Added Zod 4-compatible structured error issues across all primitive and collection validators.
+  - Type mismatches now produce `invalid_type` issues with `expected` and `received` fields using Zod's `"Invalid input: expected X, received Y"` message format.
+  - Constraint failures produce `too_small` / `too_big` issues with `minimum`, `maximum`, `origin`, and `inclusive` fields.
+  - String format failures produce `invalid_format` issues with `format`, `origin`, and `pattern` fields.
+  - Enum and literal failures produce `invalid_value` issues with a `values` array.
+- Added `getTypeName()` and `createInvalidTypeIssue()` helpers to `src/errors-core.ts` for consistent type naming across all validators.
+- Added `origin`, `format`, `values`, and `pattern` fields to the `VldIssue` interface and its JSON serialization.
+- Added new error codes: `invalid_format`, `invalid_value`, and `not_multiple_of`.
+- Added `tests/validators/zod4-error-parity.test.ts` with 80+ tests covering all Zod 4 error issue paths.
+- Added current Zod array-based factory signatures, two-schema records, multi-value literals, empty objects, and per-schema encode/decode methods.
+- Added transformed record keys, structured `invalid_key` issues, direct prefaults, and shallow-cloned collection defaults.
+- Added a Zod 4.4.3 differential behavior suite to the release gate and a maintained compatibility policy.
+- Added schema-instance composition methods, tuple rest schemas, nested object/array/tuple codec encoding, current string format methods, and boolean `fromJSONSchema()` support.
+- Added full nested `regexes`/`iso` parity, UUID v1-v8 options, WHATWG URL filters/normalization, and precision-aware ISO date-time formats.
+- Added a daily Zod parity workflow with a blocking `latest` contract and a separate `canary` early-warning lane.
+
+### Changed
+
+- **Breaking (error shape):** `parse()` now throws `VldError` (not plain `Error`) for all validators, matching Zod's `ZodError` throw behavior. Code using `try/catch` around `parse()` should check for `VldError` or `Error` interchangeably since `VldError extends Error`.
+- **Breaking (number validation):** `v.number()` now rejects `Infinity`, `-Infinity`, and `NaN` by default, matching Zod 4 behavior. Use `.finite()` explicitly if Infinity acceptance is needed.
+- JSON Schema now defaults to Draft 2020-12 and Zod-compatible handling of unrepresentable types; VLD extensions remain available through `{ unrepresentable: "vld" }`.
+- npm provenance is enforced for published packages.
+- Security audit now checks runtime dependencies only (`--omit=dev`), since VLD has zero runtime dependencies.
+
+### Verified
+
+- 87 test suites and 2473 tests passing with 100% statement, branch, line, and function coverage.
+- Zod parity verified against both `zod@4.4.3` (latest) and `zod@4.5.0-canary` (canary): 240 exports checked, 0 missing, 0 behavioral mismatches.
+- Runtime guard average 11.46x faster, startup total 1.35x faster, and 4.66x less retained heap than Zod 4.4.3.
+- Root string tree-shaken probe is 112.5 KiB versus Zod's 119.6 KiB; VLD mini is 63.9 KiB.
+
 ## [2.1.0] - 2026-06-16
 
 ### Added