@oxog/vld 2.1.0 → 2.2.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (228) hide show
  1. package/CHANGELOG.md +113 -0
  2. package/README.md +413 -1235
  3. package/dist/chunks/errors-core-CerMg2rq.js +1 -0
  4. package/dist/chunks/index-CkbfQQ4n.js +1 -0
  5. package/dist/chunks/index-yjpbvFgw.js +1 -0
  6. package/dist/chunks/ip-validation-g5LWgy9t.js +1 -0
  7. package/dist/chunks/security-Dy24T8N7.js +1 -0
  8. package/dist/cjs/chunks/errors-core-DrydF46s.cjs +1 -0
  9. package/dist/cjs/chunks/index-BEV9nG0N.cjs +1 -0
  10. package/dist/cjs/chunks/index-ZjHAxYdA.cjs +1 -0
  11. package/dist/cjs/chunks/ip-validation-BZqPamPC.cjs +1 -0
  12. package/dist/cjs/chunks/security-aXZVI7qW.cjs +1 -0
  13. package/dist/cjs/cli/bin.cjs +1 -505
  14. package/dist/cjs/cli/index.cjs +1 -209
  15. package/dist/cjs/codecs/index.cjs +1 -45
  16. package/dist/cjs/coercion/index.cjs +1 -588
  17. package/dist/cjs/compat/emitter.cjs +1 -184
  18. package/dist/cjs/compat/result.cjs +1 -189
  19. package/dist/cjs/errors.cjs +1 -180
  20. package/dist/cjs/index.cjs +1 -1894
  21. package/dist/cjs/kernel.cjs +1 -415
  22. package/dist/cjs/locales/af.cjs +1 -108
  23. package/dist/cjs/locales/ar.cjs +1 -108
  24. package/dist/cjs/locales/bn.cjs +1 -108
  25. package/dist/cjs/locales/da.cjs +1 -108
  26. package/dist/cjs/locales/de.cjs +1 -108
  27. package/dist/cjs/locales/en.cjs +1 -108
  28. package/dist/cjs/locales/es-MX.cjs +1 -107
  29. package/dist/cjs/locales/es.cjs +1 -96
  30. package/dist/cjs/locales/fi.cjs +1 -108
  31. package/dist/cjs/locales/fr.cjs +1 -96
  32. package/dist/cjs/locales/hi.cjs +1 -108
  33. package/dist/cjs/locales/id.cjs +1 -108
  34. package/dist/cjs/locales/index.cjs +1 -43
  35. package/dist/cjs/locales/it.cjs +1 -108
  36. package/dist/cjs/locales/ja.cjs +1 -108
  37. package/dist/cjs/locales/ko.cjs +1 -108
  38. package/dist/cjs/locales/lazy.cjs +1 -188
  39. package/dist/cjs/locales/nl.cjs +1 -108
  40. package/dist/cjs/locales/no.cjs +1 -108
  41. package/dist/cjs/locales/pl.cjs +1 -108
  42. package/dist/cjs/locales/pt-BR.cjs +1 -108
  43. package/dist/cjs/locales/pt.cjs +1 -108
  44. package/dist/cjs/locales/ru.cjs +1 -108
  45. package/dist/cjs/locales/runtime.cjs +1 -51
  46. package/dist/cjs/locales/sv.cjs +1 -108
  47. package/dist/cjs/locales/sw.cjs +1 -108
  48. package/dist/cjs/locales/th.cjs +1 -108
  49. package/dist/cjs/locales/tr.cjs +1 -108
  50. package/dist/cjs/locales/vi.cjs +1 -108
  51. package/dist/cjs/locales/zh.cjs +1 -108
  52. package/dist/cjs/mini.cjs +1 -242
  53. package/dist/cjs/pigment.cjs +1 -207
  54. package/dist/cjs/plugins/index.cjs +1 -12
  55. package/dist/cjs/registry.cjs +1 -37
  56. package/dist/cjs/v3/index.cjs +1 -425
  57. package/dist/cjs/v4/core/index.cjs +1 -894
  58. package/dist/cjs/v4/index.cjs +1 -425
  59. package/dist/cjs/v4/locales/index.cjs +1 -130
  60. package/dist/cjs/v4/mini/index.cjs +1 -509
  61. package/dist/cjs/v4-mini/index.cjs +1 -532
  62. package/dist/cjs/validators/any.cjs +1 -40
  63. package/dist/cjs/validators/array.cjs +1 -283
  64. package/dist/cjs/validators/base.cjs +1 -887
  65. package/dist/cjs/validators/base64.cjs +1 -73
  66. package/dist/cjs/validators/bigint.cjs +1 -232
  67. package/dist/cjs/validators/boolean.cjs +1 -146
  68. package/dist/cjs/validators/codec.cjs +1 -205
  69. package/dist/cjs/validators/custom.cjs +1 -71
  70. package/dist/cjs/validators/date.cjs +1 -278
  71. package/dist/cjs/validators/discriminated-union.cjs +1 -130
  72. package/dist/cjs/validators/enum.cjs +1 -154
  73. package/dist/cjs/validators/file.cjs +1 -130
  74. package/dist/cjs/validators/function.cjs +1 -63
  75. package/dist/cjs/validators/hex.cjs +1 -70
  76. package/dist/cjs/validators/index.cjs +1 -123
  77. package/dist/cjs/validators/intersection.cjs +1 -120
  78. package/dist/cjs/validators/json.cjs +1 -70
  79. package/dist/cjs/validators/lazy.cjs +1 -53
  80. package/dist/cjs/validators/literal.cjs +1 -64
  81. package/dist/cjs/validators/map.cjs +1 -218
  82. package/dist/cjs/validators/nan.cjs +1 -41
  83. package/dist/cjs/validators/never.cjs +1 -36
  84. package/dist/cjs/validators/null.cjs +1 -43
  85. package/dist/cjs/validators/number.cjs +1 -427
  86. package/dist/cjs/validators/object.cjs +1 -868
  87. package/dist/cjs/validators/promise.cjs +1 -115
  88. package/dist/cjs/validators/record.cjs +1 -262
  89. package/dist/cjs/validators/set.cjs +1 -203
  90. package/dist/cjs/validators/string-bool.cjs +1 -124
  91. package/dist/cjs/validators/string-formats.cjs +1 -168
  92. package/dist/cjs/validators/string.cjs +1 -12
  93. package/dist/cjs/validators/symbol.cjs +1 -62
  94. package/dist/cjs/validators/template-literal.cjs +1 -108
  95. package/dist/cjs/validators/tuple.cjs +1 -187
  96. package/dist/cjs/validators/uint8array.cjs +1 -106
  97. package/dist/cjs/validators/undefined.cjs +1 -43
  98. package/dist/cjs/validators/union.cjs +1 -191
  99. package/dist/cjs/validators/unknown.cjs +1 -40
  100. package/dist/cjs/validators/void.cjs +1 -48
  101. package/dist/cjs/validators/xor.cjs +1 -69
  102. package/dist/cli/bin.js +1 -406
  103. package/dist/cli/index.js +1 -205
  104. package/dist/codecs/index.js +1 -11
  105. package/dist/coercion/index.js +1 -579
  106. package/dist/compat/emitter.js +1 -180
  107. package/dist/compat/result.js +1 -170
  108. package/dist/errors-core.d.ts +32 -2
  109. package/dist/errors.js +1 -171
  110. package/dist/index.d.ts +315 -361
  111. package/dist/index.js +1 -1534
  112. package/dist/kernel.js +1 -409
  113. package/dist/locales/af.js +1 -106
  114. package/dist/locales/ar.js +1 -106
  115. package/dist/locales/bn.js +1 -106
  116. package/dist/locales/da.js +1 -106
  117. package/dist/locales/de.js +1 -106
  118. package/dist/locales/en.js +1 -106
  119. package/dist/locales/es-MX.js +1 -105
  120. package/dist/locales/es.js +1 -94
  121. package/dist/locales/fi.js +1 -106
  122. package/dist/locales/fr.js +1 -94
  123. package/dist/locales/hi.js +1 -106
  124. package/dist/locales/id.js +1 -106
  125. package/dist/locales/index.js +1 -29
  126. package/dist/locales/it.js +1 -106
  127. package/dist/locales/ja.js +1 -106
  128. package/dist/locales/ko.js +1 -106
  129. package/dist/locales/lazy.js +1 -177
  130. package/dist/locales/nl.js +1 -106
  131. package/dist/locales/no.js +1 -106
  132. package/dist/locales/pl.js +1 -106
  133. package/dist/locales/pt-BR.js +1 -106
  134. package/dist/locales/pt.js +1 -106
  135. package/dist/locales/ru.js +1 -106
  136. package/dist/locales/runtime.js +1 -41
  137. package/dist/locales/sv.js +1 -106
  138. package/dist/locales/sw.js +1 -106
  139. package/dist/locales/th.js +1 -106
  140. package/dist/locales/tr.js +1 -106
  141. package/dist/locales/vi.js +1 -106
  142. package/dist/locales/zh.js +1 -106
  143. package/dist/mini.d.ts +3 -3
  144. package/dist/mini.js +1 -156
  145. package/dist/pigment.js +1 -180
  146. package/dist/plugins/index.js +1 -1
  147. package/dist/registry.js +1 -34
  148. package/dist/utils/json-schema.d.ts +10 -1
  149. package/dist/v3/index.js +1 -46
  150. package/dist/v4/core/index.d.ts +28 -16
  151. package/dist/v4/core/index.js +1 -277
  152. package/dist/v4/index.js +1 -50
  153. package/dist/v4/locales/index.d.ts +4 -0
  154. package/dist/v4/locales/index.js +1 -77
  155. package/dist/v4/mini/index.js +1 -47
  156. package/dist/v4-mini/index.d.ts +1 -1
  157. package/dist/v4-mini/index.js +1 -75
  158. package/dist/validators/any.js +1 -37
  159. package/dist/validators/array.d.ts +7 -0
  160. package/dist/validators/array.js +1 -279
  161. package/dist/validators/base.d.ts +210 -17
  162. package/dist/validators/base.js +1 -868
  163. package/dist/validators/base64.js +1 -68
  164. package/dist/validators/bigint.d.ts +7 -0
  165. package/dist/validators/bigint.js +1 -228
  166. package/dist/validators/boolean.js +1 -142
  167. package/dist/validators/codec.js +1 -200
  168. package/dist/validators/custom.d.ts +20 -10
  169. package/dist/validators/custom.js +1 -67
  170. package/dist/validators/date.d.ts +2 -0
  171. package/dist/validators/date.js +1 -274
  172. package/dist/validators/discriminated-union.d.ts +4 -2
  173. package/dist/validators/discriminated-union.js +1 -123
  174. package/dist/validators/enum.d.ts +8 -2
  175. package/dist/validators/enum.js +1 -150
  176. package/dist/validators/file.js +1 -125
  177. package/dist/validators/function.js +1 -58
  178. package/dist/validators/hex.js +1 -65
  179. package/dist/validators/index.d.ts +1 -1
  180. package/dist/validators/index.js +1 -35
  181. package/dist/validators/intersection.js +1 -116
  182. package/dist/validators/json.js +1 -66
  183. package/dist/validators/lazy.js +1 -50
  184. package/dist/validators/literal.d.ts +8 -3
  185. package/dist/validators/literal.js +1 -60
  186. package/dist/validators/map.d.ts +7 -0
  187. package/dist/validators/map.js +1 -214
  188. package/dist/validators/nan.js +1 -38
  189. package/dist/validators/never.js +1 -32
  190. package/dist/validators/null.js +1 -40
  191. package/dist/validators/number.d.ts +25 -1
  192. package/dist/validators/number.js +1 -423
  193. package/dist/validators/object.d.ts +18 -2
  194. package/dist/validators/object.js +1 -864
  195. package/dist/validators/promise.d.ts +6 -7
  196. package/dist/validators/promise.js +1 -111
  197. package/dist/validators/record.d.ts +13 -8
  198. package/dist/validators/record.js +1 -258
  199. package/dist/validators/set.d.ts +5 -0
  200. package/dist/validators/set.js +1 -199
  201. package/dist/validators/string-bool.js +1 -120
  202. package/dist/validators/string-formats.d.ts +58 -62
  203. package/dist/validators/string-formats.js +1 -135
  204. package/dist/validators/string.d.ts +49 -10
  205. package/dist/validators/string.js +1 -4
  206. package/dist/validators/symbol.js +1 -58
  207. package/dist/validators/template-literal.js +1 -103
  208. package/dist/validators/tuple.d.ts +17 -13
  209. package/dist/validators/tuple.js +1 -183
  210. package/dist/validators/uint8array.js +1 -101
  211. package/dist/validators/undefined.js +1 -40
  212. package/dist/validators/union.d.ts +1 -0
  213. package/dist/validators/union.js +1 -187
  214. package/dist/validators/unknown.js +1 -37
  215. package/dist/validators/void.js +1 -44
  216. package/dist/validators/xor.d.ts +2 -2
  217. package/dist/validators/xor.js +1 -66
  218. package/package.json +240 -238
  219. package/dist/chunks/errors-core-BeiFUtZM.js +0 -81
  220. package/dist/chunks/index-0R2ntSud.js +0 -508
  221. package/dist/chunks/index-BvH403Yy.js +0 -88
  222. package/dist/chunks/security-B0Pd_vSY.js +0 -35
  223. package/dist/chunks/string-BJRQod3t.js +0 -530
  224. package/dist/cjs/chunks/errors-core-DWxLFs2f.cjs +0 -83
  225. package/dist/cjs/chunks/index-BkI37108.cjs +0 -538
  226. package/dist/cjs/chunks/index-Cc3bjUMX.cjs +0 -91
  227. package/dist/cjs/chunks/security-Dc3Jh13T.cjs +0 -37
  228. package/dist/cjs/chunks/string-BKZrc4hs.cjs +0 -533
@@ -1,538 +0,0 @@
1
- 'use strict';
2
-
3
- var validators_codec = require('../validators/codec.cjs');
4
- var validators_base64 = require('../validators/base64.cjs');
5
- var validators_hex = require('../validators/hex.cjs');
6
- var validators_uint8array = require('../validators/uint8array.cjs');
7
- var validators_string = require('./string-BKZrc4hs.cjs');
8
- var validators_number = require('../validators/number.cjs');
9
- var validators_bigint = require('../validators/bigint.cjs');
10
- var validators_boolean = require('../validators/boolean.cjs');
11
- var validators_date = require('../validators/date.cjs');
12
- var validators_unknown = require('../validators/unknown.cjs');
13
-
14
- /**
15
- * Utility functions for codec transformations
16
- */
17
- /**
18
- * Convert a base64 string to Uint8Array
19
- */
20
- function base64ToUint8Array(base64) {
21
- // Handle URL-safe base64
22
- const base64Clean = base64.replace(/-/g, '+').replace(/_/g, '/');
23
- // Add padding if necessary
24
- const padded = base64Clean.padEnd(base64Clean.length + (4 - base64Clean.length % 4) % 4, '=');
25
- // Decode base64 to binary string
26
- const binaryString = safeAtob(padded);
27
- // Convert binary string to Uint8Array
28
- const bytes = new Uint8Array(binaryString.length);
29
- for (let i = 0; i < binaryString.length; i++) {
30
- bytes[i] = binaryString.charCodeAt(i);
31
- }
32
- return bytes;
33
- }
34
- /**
35
- * Convert Uint8Array to base64 string
36
- */
37
- function uint8ArrayToBase64(bytes) {
38
- // Convert Uint8Array to binary string
39
- let binaryString = '';
40
- for (let i = 0; i < bytes.length; i++) {
41
- binaryString += String.fromCharCode(bytes[i]);
42
- }
43
- // Encode to base64
44
- return safeBtoa(binaryString);
45
- }
46
- /**
47
- * Convert Uint8Array to URL-safe base64 string
48
- */
49
- function uint8ArrayToBase64Url(bytes) {
50
- const base64 = uint8ArrayToBase64(bytes);
51
- // Make URL-safe and remove padding
52
- return base64
53
- .replace(/\+/g, '-')
54
- .replace(/\//g, '_')
55
- .replace(/=/g, '');
56
- }
57
- /**
58
- * Convert hex string to Uint8Array
59
- */
60
- function hexToUint8Array(hex) {
61
- // BUG-010 FIX: Add length validation to prevent memory exhaustion
62
- // 20 million characters = 10MB of data (consistent with base64 limits)
63
- if (hex.length > 20000000) {
64
- throw new Error('Hex string is too large (max 10MB)');
65
- }
66
- // Remove any 0x prefix if present
67
- const cleanHex = hex.startsWith('0x') ? hex.slice(2) : hex;
68
- // BUG-NPM-006 FIX: Validate hex characters to prevent silent data corruption
69
- // parseInt silently returns NaN for invalid hex, which becomes 0 in Uint8Array
70
- const hexPattern = /^[0-9a-fA-F]*$/;
71
- if (!hexPattern.test(cleanHex)) {
72
- throw new Error('Invalid hex string: contains non-hexadecimal characters');
73
- }
74
- // Ensure even length
75
- const paddedHex = cleanHex.length % 2 === 0 ? cleanHex : '0' + cleanHex;
76
- const bytes = new Uint8Array(paddedHex.length / 2);
77
- for (let i = 0; i < paddedHex.length; i += 2) {
78
- bytes[i / 2] = parseInt(paddedHex.substring(i, i + 2), 16);
79
- }
80
- return bytes;
81
- }
82
- /**
83
- * Convert Uint8Array to hex string
84
- */
85
- function uint8ArrayToHex(bytes) {
86
- let hex = '';
87
- for (let i = 0; i < bytes.length; i++) {
88
- const byte = bytes[i].toString(16);
89
- hex += byte.length === 1 ? '0' + byte : byte;
90
- }
91
- return hex;
92
- }
93
- /**
94
- * Convert string to Uint8Array using UTF-8 encoding
95
- * BUG-NEW-011 FIX: Add DoS protection with 10MB limit
96
- */
97
- function stringToUint8Array(str) {
98
- // Add DoS protection - limit to 10MB (consistent with base64 limit)
99
- const MAX_STRING_LENGTH = 10000000; // 10 million characters (~10MB)
100
- if (str.length > MAX_STRING_LENGTH) {
101
- throw new Error(`String is too large for UTF-8 encoding (max ${MAX_STRING_LENGTH} characters)`);
102
- }
103
- const encoder = new TextEncoder();
104
- return encoder.encode(str);
105
- }
106
- /**
107
- * Convert Uint8Array to string using UTF-8 decoding
108
- * BUG-NEW-012 FIX: Add DoS protection with 10MB limit
109
- */
110
- function uint8ArrayToString(bytes) {
111
- // Add DoS protection - limit to 10MB
112
- const MAX_BYTES_LENGTH = 10000000; // 10 million bytes
113
- if (bytes.length > MAX_BYTES_LENGTH) {
114
- throw new Error(`Byte array is too large for UTF-8 decoding (max ${MAX_BYTES_LENGTH} bytes)`);
115
- }
116
- const decoder = new TextDecoder();
117
- return decoder.decode(bytes);
118
- }
119
- /**
120
- * Check if running in Node.js environment
121
- */
122
- function isNodeEnvironment() {
123
- return typeof globalThis !== 'undefined' &&
124
- typeof globalThis.process !== 'undefined' &&
125
- globalThis.process.versions != null &&
126
- globalThis.process.versions.node != null;
127
- }
128
- /**
129
- * Validate and sanitize base64 input to prevent prototype pollution
130
- */
131
- function validateBase64Input(encoded) {
132
- // Check for null/undefined
133
- if (encoded == null) {
134
- throw new Error('Base64 input cannot be null or undefined');
135
- }
136
- // Ensure it's a string
137
- if (typeof encoded !== 'string') {
138
- throw new Error('Base64 input must be a string');
139
- }
140
- // Length validation - base64 strings should be reasonable length
141
- if (encoded.length > 10000000) { // 10MB limit
142
- throw new Error('Base64 input is too large');
143
- }
144
- // Base64 character validation - only allow valid base64 characters
145
- const base64Regex = /^[A-Za-z0-9+/]*={0,2}$/;
146
- if (!base64Regex.test(encoded)) {
147
- throw new Error('Invalid base64 format');
148
- }
149
- // BUG-NEW-004 FIX: Correct base64 padding validation per RFC 4648
150
- // Base64 only uses '=' or '==' as padding, never '==='
151
- const paddingIndex = encoded.indexOf('=');
152
- if (paddingIndex !== -1) {
153
- const padding = encoded.substring(paddingIndex);
154
- // Only allow '=' or '==' as valid padding (RFC 4648 compliant)
155
- if (!/^={1,2}$/.test(padding)) {
156
- throw new Error('Invalid base64 padding');
157
- }
158
- // Padding should only be at the end
159
- if (paddingIndex < encoded.length - 2) {
160
- throw new Error('Base64 padding must be at the end');
161
- }
162
- }
163
- // Additional security check: prevent potential encoded JavaScript
164
- // by looking for suspicious patterns that might indicate malicious content
165
- const suspiciousPatterns = [
166
- /eval/i,
167
- /function/i,
168
- /javascript:/i,
169
- /<script/i,
170
- /on\w+\s*=/i,
171
- /__proto__/i,
172
- /constructor/i,
173
- /prototype/i
174
- ];
175
- // Decode a small portion to check for suspicious content
176
- try {
177
- const sampleSize = Math.min(100, encoded.length);
178
- const sample = encoded.substring(0, sampleSize);
179
- const sampleDecoded = typeof atob !== 'undefined'
180
- ? atob(sample)
181
- : Buffer.from(sample, 'base64').toString('utf8', 0, 50); // Only decode first 50 chars
182
- for (const pattern of suspiciousPatterns) {
183
- if (pattern.test(sampleDecoded)) {
184
- throw new Error('Suspicious content detected in base64 input');
185
- }
186
- }
187
- }
188
- catch (error) {
189
- if (error instanceof Error && error.message.includes('Suspicious content')) {
190
- throw error;
191
- }
192
- // If decoding fails, continue - it might be invalid base64 which will be caught later
193
- }
194
- }
195
- /**
196
- * Polyfill for atob in Node.js with proper input validation
197
- */
198
- function safeAtob(encoded) {
199
- // Input validation and sanitization
200
- validateBase64Input(encoded);
201
- if (typeof atob !== 'undefined') {
202
- try {
203
- return atob(encoded);
204
- }
205
- catch {
206
- throw new Error('Failed to decode base64 data');
207
- }
208
- }
209
- // Node.js fallback with additional validation
210
- if (isNodeEnvironment()) {
211
- try {
212
- // Use Buffer with explicit error handling
213
- const buffer = Buffer.from(encoded, 'base64');
214
- // Additional validation: ensure the decoded data is reasonable size
215
- if (buffer.length > 5000000) { // 5MB limit for decoded data
216
- throw new Error('Decoded base64 data is too large');
217
- }
218
- return buffer.toString('binary');
219
- }
220
- catch (error) {
221
- if (error instanceof Error && error.message.includes('Invalid base64')) {
222
- throw new Error('Invalid base64 format');
223
- }
224
- throw new Error('Failed to decode base64 data in Node.js environment');
225
- }
226
- }
227
- throw new Error('Base64 decoding not supported in this environment');
228
- }
229
- /**
230
- * Polyfill for btoa in Node.js
231
- */
232
- function safeBtoa(str) {
233
- if (typeof btoa !== 'undefined') {
234
- return btoa(str);
235
- }
236
- // Node.js fallback
237
- if (isNodeEnvironment()) {
238
- return Buffer.from(str, 'binary').toString('base64');
239
- }
240
- throw new Error('Base64 encoding not supported in this environment');
241
- }
242
-
243
- /**
244
- * Invert a codec, swapping encode and decode directions.
245
- */
246
- function invertCodec(codec) {
247
- return codec.invert();
248
- }
249
- // ===== STRING TO NUMBER CODECS =====
250
- /**
251
- * String to number codec
252
- */
253
- const stringToNumber = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_number.VldNumber.create(), {
254
- decode: (str) => {
255
- const num = Number(str);
256
- if (isNaN(num))
257
- throw new Error('Invalid number');
258
- return num;
259
- },
260
- encode: (num) => num.toString()
261
- });
262
- /**
263
- * String to integer codec
264
- */
265
- const stringToInt = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_number.VldNumber.create().int(), {
266
- decode: (str) => {
267
- const num = parseInt(str, 10);
268
- if (isNaN(num))
269
- throw new Error('Invalid integer');
270
- return num;
271
- },
272
- encode: (num) => Math.floor(num).toString()
273
- });
274
- /**
275
- * String to BigInt codec
276
- */
277
- const stringToBigInt = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_bigint.VldBigInt.create(), {
278
- decode: (str) => {
279
- try {
280
- return BigInt(str);
281
- }
282
- catch {
283
- throw new Error('Invalid BigInt');
284
- }
285
- },
286
- encode: (bigint) => bigint.toString()
287
- });
288
- /**
289
- * Number to BigInt codec
290
- */
291
- const numberToBigInt = validators_codec.VldCodec.create(validators_number.VldNumber.create().int(), validators_bigint.VldBigInt.create(), {
292
- decode: (num) => BigInt(Math.floor(num)),
293
- encode: (bigint) => Number(bigint)
294
- });
295
- // ===== DATE CODECS =====
296
- /**
297
- * ISO datetime string to Date codec
298
- */
299
- const isoDatetimeToDate = validators_codec.VldCodec.create(validators_string.VldString.create().regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{3})?Z?$/, 'Invalid ISO datetime format'), validators_date.VldDate.create(), {
300
- decode: (isoString) => {
301
- const date = new Date(isoString);
302
- if (isNaN(date.getTime()))
303
- throw new Error('Invalid date');
304
- return date;
305
- },
306
- encode: (date) => date.toISOString()
307
- });
308
- /**
309
- * Epoch seconds to Date codec
310
- */
311
- const epochSecondsToDate = validators_codec.VldCodec.create(validators_number.VldNumber.create(), validators_date.VldDate.create(), {
312
- decode: (seconds) => new Date(seconds * 1000),
313
- encode: (date) => Math.floor(date.getTime() / 1000)
314
- });
315
- /**
316
- * Epoch milliseconds to Date codec
317
- */
318
- const epochMillisToDate = validators_codec.VldCodec.create(validators_number.VldNumber.create(), validators_date.VldDate.create(), {
319
- decode: (millis) => new Date(millis),
320
- encode: (date) => date.getTime()
321
- });
322
- // ===== JSON CODEC =====
323
- /**
324
- * JSON string codec for any type
325
- */
326
- const jsonCodec = (schema) => {
327
- const outputSchema = schema || validators_unknown.VldUnknown.create();
328
- return validators_codec.VldCodec.create(validators_string.VldString.create(), outputSchema, {
329
- decode: (jsonString) => {
330
- try {
331
- return JSON.parse(jsonString);
332
- }
333
- catch {
334
- throw new Error('Invalid JSON');
335
- }
336
- },
337
- encode: (data) => JSON.stringify(data)
338
- });
339
- };
340
- // ===== URL CODECS =====
341
- /**
342
- * String to URL codec
343
- */
344
- const stringToURL = validators_codec.VldCodec.create(validators_string.VldString.create().url(), validators_unknown.VldUnknown.create(), // URL object
345
- {
346
- decode: (urlString) => {
347
- try {
348
- return new URL(urlString);
349
- }
350
- catch {
351
- throw new Error('Invalid URL');
352
- }
353
- },
354
- encode: (url) => url.toString()
355
- });
356
- /**
357
- * String to HTTP/HTTPS URL codec
358
- */
359
- const stringToHttpURL = validators_codec.VldCodec.create(validators_string.VldString.create().regex(/^https?:\/\//, 'Must be HTTP or HTTPS URL'), validators_unknown.VldUnknown.create(), // URL object
360
- {
361
- decode: (urlString) => {
362
- try {
363
- const url = new URL(urlString);
364
- if (!['http:', 'https:'].includes(url.protocol)) {
365
- throw new Error('Must be HTTP or HTTPS');
366
- }
367
- return url;
368
- }
369
- catch {
370
- throw new Error('Invalid HTTP URL');
371
- }
372
- },
373
- encode: (url) => url.toString()
374
- });
375
- /**
376
- * URI component encode/decode codec
377
- */
378
- const uriComponent = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_string.VldString.create(), {
379
- decode: (encoded) => {
380
- try {
381
- return decodeURIComponent(encoded);
382
- }
383
- catch {
384
- throw new Error('Invalid URI component');
385
- }
386
- },
387
- encode: (decoded) => encodeURIComponent(decoded)
388
- });
389
- /**
390
- * String to boolean codec
391
- */
392
- const stringToBoolean = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_boolean.VldBoolean.create(), {
393
- decode: (str) => {
394
- const lower = str.toLowerCase();
395
- if (lower === 'true' || lower === '1' || lower === 'yes' || lower === 'on')
396
- return true;
397
- if (lower === 'false' || lower === '0' || lower === 'no' || lower === 'off')
398
- return false;
399
- throw new Error('Invalid boolean string');
400
- },
401
- encode: (bool) => bool.toString()
402
- });
403
- // ===== EXISTING BYTE CODECS (updated) =====
404
- /**
405
- * Base64 to Uint8Array codec
406
- */
407
- const base64ToBytes = validators_codec.VldCodec.create(validators_base64.VldBase64.create(), validators_uint8array.VldUint8Array.create(), {
408
- decode: base64ToUint8Array,
409
- encode: uint8ArrayToBase64
410
- });
411
- /**
412
- * URL-safe Base64 to Uint8Array codec
413
- */
414
- const base64UrlToBytes = validators_codec.VldCodec.create(validators_base64.VldBase64.create().urlSafeMode(), validators_uint8array.VldUint8Array.create(), {
415
- decode: base64ToUint8Array,
416
- encode: uint8ArrayToBase64Url
417
- });
418
- /**
419
- * Hexadecimal to Uint8Array codec
420
- */
421
- const hexToBytes = validators_codec.VldCodec.create(validators_hex.VldHex.create(), validators_uint8array.VldUint8Array.create(), {
422
- decode: hexToUint8Array,
423
- encode: uint8ArrayToHex
424
- });
425
- /**
426
- * Lowercase hexadecimal to Uint8Array codec
427
- */
428
- const hexLowerToBytes = validators_codec.VldCodec.create(validators_hex.VldHex.create().lowercaseMode(), validators_uint8array.VldUint8Array.create(), {
429
- decode: hexToUint8Array,
430
- encode: (bytes) => uint8ArrayToHex(bytes).toLowerCase()
431
- });
432
- /**
433
- * UTF-8 string to Uint8Array codec
434
- */
435
- const utf8ToBytes = validators_codec.VldCodec.create(validators_string.VldString.create(), validators_uint8array.VldUint8Array.create(), {
436
- decode: stringToUint8Array,
437
- encode: uint8ArrayToString
438
- });
439
- /**
440
- * Uint8Array to UTF-8 string codec (reverse of utf8ToBytes)
441
- */
442
- const bytesToUtf8 = validators_codec.VldCodec.create(validators_uint8array.VldUint8Array.create(), validators_string.VldString.create(), {
443
- decode: uint8ArrayToString,
444
- encode: stringToUint8Array
445
- });
446
- /**
447
- * Base64URL to Uint8Array codec (updated)
448
- */
449
- const base64urlToBytes = validators_codec.VldCodec.create(validators_base64.VldBase64.create().urlSafeMode(), validators_uint8array.VldUint8Array.create(), {
450
- decode: base64ToUint8Array,
451
- encode: uint8ArrayToBase64Url
452
- });
453
- /**
454
- * Base64 encoded JSON codec (updated)
455
- */
456
- const base64Json = (schema) => {
457
- const outputSchema = schema || validators_unknown.VldUnknown.create();
458
- return validators_codec.VldCodec.create(validators_base64.VldBase64.create(), outputSchema, {
459
- decode: (base64) => {
460
- // BUG-NPM-005 FIX: Add error handling for JSON parsing
461
- try {
462
- const jsonString = uint8ArrayToString(base64ToUint8Array(base64));
463
- return JSON.parse(jsonString);
464
- }
465
- catch (error) {
466
- throw new Error(`Failed to parse base64 JSON: ${error.message}`);
467
- }
468
- },
469
- encode: (data) => {
470
- const jsonString = JSON.stringify(data);
471
- return uint8ArrayToBase64(stringToUint8Array(jsonString));
472
- }
473
- });
474
- };
475
- /**
476
- * JWT payload decoder (base64url encoded JSON) - updated
477
- */
478
- const jwtPayload = (schema) => {
479
- const outputSchema = schema || validators_unknown.VldUnknown.create();
480
- return validators_codec.VldCodec.create(validators_string.VldString.create().refine(s => s.split('.').length === 3, 'Invalid JWT format'), outputSchema, {
481
- decode: (jwt) => {
482
- // BUG-NPM-004 FIX: Add comprehensive error handling for JWT parsing
483
- try {
484
- const parts = jwt.split('.');
485
- if (parts.length !== 3) {
486
- throw new Error('JWT must have exactly 3 parts');
487
- }
488
- const payloadBase64 = parts[1];
489
- if (!payloadBase64) {
490
- throw new Error('JWT payload is empty');
491
- }
492
- // Convert base64url to base64
493
- const base64 = payloadBase64
494
- .replace(/-/g, '+')
495
- .replace(/_/g, '/')
496
- .padEnd(payloadBase64.length + (4 - payloadBase64.length % 4) % 4, '=');
497
- const jsonString = uint8ArrayToString(base64ToUint8Array(base64));
498
- return JSON.parse(jsonString);
499
- }
500
- catch (error) {
501
- throw new Error(`Failed to decode JWT payload: ${error.message}`);
502
- }
503
- },
504
- encode: () => {
505
- throw new Error('JWT encoding not supported - use a proper JWT library');
506
- }
507
- });
508
- };
509
-
510
- exports.base64Json = base64Json;
511
- exports.base64ToBytes = base64ToBytes;
512
- exports.base64ToUint8Array = base64ToUint8Array;
513
- exports.base64UrlToBytes = base64UrlToBytes;
514
- exports.base64urlToBytes = base64urlToBytes;
515
- exports.bytesToUtf8 = bytesToUtf8;
516
- exports.epochMillisToDate = epochMillisToDate;
517
- exports.epochSecondsToDate = epochSecondsToDate;
518
- exports.hexLowerToBytes = hexLowerToBytes;
519
- exports.hexToBytes = hexToBytes;
520
- exports.hexToUint8Array = hexToUint8Array;
521
- exports.invertCodec = invertCodec;
522
- exports.isoDatetimeToDate = isoDatetimeToDate;
523
- exports.jsonCodec = jsonCodec;
524
- exports.jwtPayload = jwtPayload;
525
- exports.numberToBigInt = numberToBigInt;
526
- exports.stringToBigInt = stringToBigInt;
527
- exports.stringToBoolean = stringToBoolean;
528
- exports.stringToHttpURL = stringToHttpURL;
529
- exports.stringToInt = stringToInt;
530
- exports.stringToNumber = stringToNumber;
531
- exports.stringToURL = stringToURL;
532
- exports.stringToUint8Array = stringToUint8Array;
533
- exports.uint8ArrayToBase64 = uint8ArrayToBase64;
534
- exports.uint8ArrayToBase64Url = uint8ArrayToBase64Url;
535
- exports.uint8ArrayToHex = uint8ArrayToHex;
536
- exports.uint8ArrayToString = uint8ArrayToString;
537
- exports.uriComponent = uriComponent;
538
- exports.utf8ToBytes = utf8ToBytes;
@@ -1,91 +0,0 @@
1
- 'use strict';
2
-
3
- var locales_runtime = require('../locales/runtime.cjs');
4
- var locales_en = require('../locales/en.cjs');
5
- var locales_tr = require('../locales/tr.cjs');
6
- var locales_es = require('../locales/es.cjs');
7
- var locales_fr = require('../locales/fr.cjs');
8
- var locales_de = require('../locales/de.cjs');
9
- var locales_it = require('../locales/it.cjs');
10
- var locales_pt = require('../locales/pt.cjs');
11
- var locales_ru = require('../locales/ru.cjs');
12
- var locales_ja = require('../locales/ja.cjs');
13
- var locales_ko = require('../locales/ko.cjs');
14
- var locales_zh = require('../locales/zh.cjs');
15
- var locales_ar = require('../locales/ar.cjs');
16
- var locales_hi = require('../locales/hi.cjs');
17
- var locales_nl = require('../locales/nl.cjs');
18
- var locales_pl = require('../locales/pl.cjs');
19
- var locales_da = require('../locales/da.cjs');
20
- var locales_sv = require('../locales/sv.cjs');
21
- var locales_no = require('../locales/no.cjs');
22
- var locales_fi = require('../locales/fi.cjs');
23
- var locales_th = require('../locales/th.cjs');
24
- var locales_vi = require('../locales/vi.cjs');
25
- var locales_id = require('../locales/id.cjs');
26
- var locales_bn = require('../locales/bn.cjs');
27
- var locales_sw = require('../locales/sw.cjs');
28
- var locales_af = require('../locales/af.cjs');
29
- var locales_ptBR = require('../locales/pt-BR.cjs');
30
- var locales_esMX = require('../locales/es-MX.cjs');
31
-
32
- const translatedLocaleCodes = [
33
- 'en', 'tr', 'es', 'fr', 'de', 'it', 'pt', 'ru', 'ja', 'ko', 'zh', 'ar', 'hi', 'nl', 'pl',
34
- 'da', 'sv', 'no', 'fi',
35
- 'th', 'vi', 'id', 'bn',
36
- 'sw', 'af',
37
- 'pt-BR', 'es-MX'
38
- ];
39
- const fallbackLocaleCodes = [
40
- 'is', 'cs', 'sk', 'hu', 'ro', 'bg', 'hr', 'sl', 'lv', 'lt', 'et',
41
- 'el', 'mk', 'sq', 'sr', 'bs', 'me', 'mt', 'ga', 'cy', 'eu', 'ca',
42
- 'ms', 'tl', 'ur', 'fa', 'he', 'ka', 'am', 'hy', 'az', 'kk', 'ky',
43
- 'uz', 'tg', 'mn', 'my', 'km', 'lo', 'si', 'ta', 'te', 'ml', 'kn',
44
- 'gu', 'pa', 'or', 'as', 'ne', 'mr', 'sd', 'dv',
45
- 'ha', 'yo', 'ig', 'zu', 'xh', 'st', 'tn', 'ts', 've', 'nr', 'ss',
46
- 'es-AR', 'fr-CA', 'qu', 'gn', 'ay'
47
- ];
48
- const translatedLocales = {
49
- // Base languages
50
- en: locales_en.en, tr: locales_tr.tr, es: locales_es.es, fr: locales_fr.fr, de: locales_de.de, it: locales_it.it, pt: locales_pt.pt, ru: locales_ru.ru, ja: locales_ja.ja, ko: locales_ko.ko, zh: locales_zh.zh, ar: locales_ar.ar, hi: locales_hi.hi, nl: locales_nl.nl, pl: locales_pl.pl,
51
- // Major European Languages
52
- da: locales_da.da, sv: locales_sv.sv, no: locales_no.no, fi: locales_fi.fi,
53
- // Major Asian Languages
54
- th: locales_th.th, vi: locales_vi.vi, id: locales_id.id, bn: locales_bn.bn,
55
- // African Languages
56
- sw: locales_sw.sw, af: locales_af.af,
57
- // American Languages
58
- 'pt-BR': locales_ptBR.ptBR,
59
- 'es-MX': locales_esMX.esMX,
60
- };
61
- for (const locale of translatedLocaleCodes) {
62
- locales_runtime.registerLocale(locale, translatedLocales[locale]);
63
- }
64
- for (const locale of fallbackLocaleCodes) {
65
- locales_runtime.registerFallbackLocale(locale);
66
- }
67
- /**
68
- * Set the current locale asynchronously.
69
- *
70
- * The eager locale entrypoint already bundles translated locales and English
71
- * fallbacks, so this mirrors setLocale() while preserving async API parity.
72
- */
73
- async function setLocaleAsync(locale) {
74
- locales_runtime.setLocale(locale);
75
- }
76
-
77
- var localeNamespace = /*#__PURE__*/Object.freeze({
78
- __proto__: null,
79
- getLocale: locales_runtime.getLocale,
80
- getMessages: locales_runtime.getMessages,
81
- getMessagesForLocale: locales_runtime.getMessagesForLocale,
82
- getSupportedLocales: locales_runtime.getSupportedLocales,
83
- isLocaleLoaded: locales_runtime.isLocaleLoaded,
84
- isLocaleSupported: locales_runtime.isLocaleSupported,
85
- registerLocale: locales_runtime.registerLocale,
86
- setLocale: locales_runtime.setLocale,
87
- setLocaleAsync: setLocaleAsync
88
- });
89
-
90
- exports.localeNamespace = localeNamespace;
91
- exports.setLocaleAsync = setLocaleAsync;
@@ -1,37 +0,0 @@
1
- 'use strict';
2
-
3
- /**
4
- * Security utilities for prototype pollution protection
5
- */
6
- /**
7
- * Keys that, when written via `obj[key] = ...`, can mutate Object.prototype
8
- * or alter property accessor behavior across the program.
9
- *
10
- * `__proto__`, `constructor`, `prototype` are the canonical prototype-pollution
11
- * sinks. The `__define*Getter__` / `__lookup*Getter__` family installs accessors
12
- * on the prototype chain in legacy engines.
13
- *
14
- * Note: keys such as `toString`, `valueOf`, or `hasOwnProperty` are NOT
15
- * blocked. Those are legitimate property names that appear in real payloads
16
- * (localization tables, custom widget config, generic key/value stores).
17
- * Silently dropping them causes data loss; a validation library must not do
18
- * that.
19
- */
20
- const DANGEROUS_KEYS = new Set([
21
- '__proto__',
22
- 'constructor',
23
- 'prototype',
24
- '__defineGetter__',
25
- '__defineSetter__',
26
- '__lookupGetter__',
27
- '__lookupSetter__',
28
- ]);
29
- /**
30
- * Return true if a property key would, if assigned, mutate the prototype
31
- * chain or accessor behavior of the target object.
32
- */
33
- function isDangerousKey(key) {
34
- return DANGEROUS_KEYS.has(key);
35
- }
36
-
37
- exports.isDangerousKey = isDangerousKey;