@socketsecurity/lib 5.19.0 → 5.20.1

package/dist/validation/validate-schema.d.ts

@@ -0,0 +1,124 @@
+/**
+ * @fileoverview Universal schema validation for Zod-style schemas (Zod v3,
+ * v4, and any `safeParse`-shaped duck type).
+ *
+ * Accepts a schema and returns a tagged result.
+ *   - `{ ok: true, value }`  — validation passed, `value` is typed as the
+ *     schema's inferred output (`z.infer<typeof S>`).
+ *   - `{ ok: false, errors }` — validation failed, `errors` is a normalized
+ *     list of `{ path, message }`.
+ *
+ * Zod is detected purely structurally via `.safeParse` — no runtime import of
+ * the `zod` package is required by socket-lib.
+ *
+ * @internal
+ * Socket-lib additionally recognizes TypeBox schemas for its own internal
+ * use (e.g. `src/ipc.ts`'s stub-file validation). That path is not a
+ * supported consumer API — callers should use Zod.
+ */
+import type { Schema } from './types';
+/**
+ * TypeBox's `Kind` symbol. We reference it structurally for schema detection
+ * rather than importing it from `@sinclair/typebox` — detection scans the
+ * schema's own-symbol keys for one whose description is `'TypeBox.Kind'`.
+ * The `Value` runtime is only loaded lazily when a TypeBox schema is seen.
+ */
+type TypeBoxKindSymbol = symbol & {
+    __typeBoxKindBrand?: never;
+};
+/**
+ * Structural minimum of a TypeBox `TSchema`. The phantom `static` field is
+ * the type TypeBox uses for inference (`Static<T> = T['static']`).
+ */
+interface TypeBoxLikeSchema {
+    [k: TypeBoxKindSymbol]: string;
+    static: unknown;
+}
+/**
+ * Structural shape of a Zod v4 schema — carries output type on `_zod.output`.
+ */
+interface ZodV4LikeSchema<O = unknown> {
+    _zod: {
+        output: O;
+    };
+    safeParse(data: unknown): unknown;
+}
+/**
+ * Structural shape of a Zod v3 schema — carries output type on `_output`.
+ */
+interface ZodV3LikeSchema<O = unknown> {
+    _output: O;
+    safeParse(data: unknown): unknown;
+}
+/**
+ * Any schema kind this helper accepts.
+ */
+export type AnySchema = TypeBoxLikeSchema | ZodV4LikeSchema<unknown> | ZodV3LikeSchema<unknown> | Schema<unknown>;
+/**
+ * Infer the validated output type from any supported schema kind.
+ *
+ * Order matters: TypeBox schemas also carry a phantom `static` field, so we
+ * check for TypeBox before falling through to Zod and the duck-type.
+ */
+export type Infer<S> = S extends {
+    static: infer Static;
+} ? Static : S extends {
+    _zod: {
+        output: infer O;
+    };
+} ? O : S extends {
+    _output: infer O;
+} ? O : S extends Schema<infer T> ? T : unknown;
+/**
+ * A single normalized validation error.
+ * - `path` is a dotted or slash-separated identifier locating the bad value.
+ * - `message` is human-readable.
+ */
+export interface ValidationIssue {
+    /** Array path into the value (e.g. `['user', 'age']`). */
+    path: Array<string | number>;
+    /** Human-readable description of the failure. */
+    message: string;
+}
+/**
+ * Tagged-union result of {@link validateSchema}. Callers narrow on `ok`.
+ */
+export type ValidateResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    errors: ValidationIssue[];
+};
+/**
+ * Validate `data` against a Zod-style `schema`. Non-throwing.
+ *
+ * Accepted schemas:
+ * - `zod` schemas, v3 and v4 (detected via `.safeParse` on the schema)
+ * - Any object conforming to {@link Schema} (the socket-lib duck type)
+ *
+ * The return type narrows `value` to {@link Infer | `Infer<S>`}, so callers
+ * get `z.infer<typeof S>` with no casts.
+ *
+ * @example
+ * ```ts
+ * import { z } from 'zod'
+ * const U = z.object({ name: z.string() })
+ * const r = validateSchema(U, data)
+ * if (r.ok) r.value.name // string
+ * ```
+ *
+ * Errors are normalized to {@link ValidationIssue}: `{ path, message }`.
+ */
+export declare function validateSchema<S>(schema: S, data: unknown): ValidateResult<Infer<S>>;
+/**
+ * Parse `data` against `schema` and return the validated value. Throws if
+ * validation fails. This is the throwing twin of {@link validateSchema}.
+ *
+ * Use when you want fail-fast semantics at a trust boundary. For recoverable
+ * validation (form input, external configs), prefer {@link validateSchema}.
+ *
+ * @throws {Error} When validation fails. The message lists all issues.
+ */
+export declare function parseSchema<S>(schema: S, data: unknown): Infer<S>;
+export {};

package/dist/validation/validate-schema.js

@@ -0,0 +1,108 @@
+"use strict";
+/* Socket Lib - Built with esbuild */
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var validate_schema_exports = {};
+__export(validate_schema_exports, {
+  parseSchema: () => parseSchema,
+  validateSchema: () => validateSchema
+});
+module.exports = __toCommonJS(validate_schema_exports);
+function isTypeBoxSchema(schema) {
+  if (schema === null || typeof schema !== "object") {
+    return false;
+  }
+  for (const sym of Object.getOwnPropertySymbols(schema)) {
+    if (sym.description === "TypeBox.Kind") {
+      return typeof schema[sym] === "string";
+    }
+  }
+  return false;
+}
+function normalizeTypeBoxErrors(errors) {
+  const out = [];
+  for (const err of errors) {
+    const segs = err.path.split("/").filter(Boolean);
+    out.push({
+      path: segs.map((s) => {
+        const n = Number(s);
+        return Number.isInteger(n) && String(n) === s ? n : s;
+      }),
+      message: err.message
+    });
+  }
+  return out;
+}
+function normalizeZodError(err) {
+  if (err === null || typeof err !== "object") {
+    return [{ path: [], message: String(err) }];
+  }
+  const issues = err.issues;
+  if (!Array.isArray(issues)) {
+    return [{ path: [], message: "Unknown validation error" }];
+  }
+  return issues.map((issue) => {
+    const i = issue;
+    return {
+      path: Array.isArray(i.path) ? i.path : [],
+      message: typeof i.message === "string" ? i.message : "Invalid value"
+    };
+  });
+}
+function validateSchema(schema, data) {
+  if (isTypeBoxSchema(schema)) {
+    const { Value } = require("../external/@sinclair/typebox/value");
+    if (Value.Check(schema, data)) {
+      return { ok: true, value: data };
+    }
+    return {
+      ok: false,
+      errors: normalizeTypeBoxErrors(Value.Errors(schema, data))
+    };
+  }
+  if (schema !== null && typeof schema === "object" && typeof schema.safeParse === "function") {
+    const result = schema.safeParse(data);
+    if (result.success === true) {
+      return {
+        ok: true,
+        value: result.data
+      };
+    }
+    return {
+      ok: false,
+      errors: normalizeZodError(result.error)
+    };
+  }
+  throw new TypeError(
+    "validateSchema: unsupported schema kind. Expected a TypeBox schema, a Zod schema, or an object with a safeParse method."
+  );
+}
+function parseSchema(schema, data) {
+  const result = validateSchema(schema, data);
+  if (result.ok) {
+    return result.value;
+  }
+  const summary = result.errors.map((e) => `${e.path.join(".") || "(root)"}: ${e.message}`).join(", ");
+  throw new Error(`Validation failed: ${summary}`);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseSchema,
+  validateSchema
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "5.19.0",
+  "version": "5.20.1",
   "packageManager": "pnpm@11.0.0-rc.2",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
@@ -575,6 +575,10 @@
       "types": "./dist/ssri.d.ts",
       "default": "./dist/ssri.js"
     },
+    "./stdio/clear": {
+      "types": "./dist/stdio/clear.d.ts",
+      "default": "./dist/stdio/clear.js"
+    },
     "./stdio/divider": {
       "types": "./dist/stdio/divider.d.ts",
       "default": "./dist/stdio/divider.js"
@@ -587,6 +591,14 @@
       "types": "./dist/stdio/header.d.ts",
       "default": "./dist/stdio/header.js"
     },
+    "./stdio/progress": {
+      "types": "./dist/stdio/progress.d.ts",
+      "default": "./dist/stdio/progress.js"
+    },
+    "./stdio/prompts": {
+      "types": "./dist/stdio/prompts.d.ts",
+      "default": "./dist/stdio/prompts.js"
+    },
     "./stdio/stderr": {
       "types": "./dist/stdio/stderr.d.ts",
       "default": "./dist/stdio/stderr.js"
@@ -651,6 +663,10 @@
       "types": "./dist/validation/types.d.ts",
       "default": "./dist/validation/types.js"
     },
+    "./validation/validate-schema": {
+      "types": "./dist/validation/validate-schema.d.ts",
+      "default": "./dist/validation/validate-schema.js"
+    },
     "./versions": {
       "types": "./dist/versions.d.ts",
       "default": "./dist/versions.js"
@@ -659,10 +675,6 @@
       "types": "./dist/words.d.ts",
       "default": "./dist/words.js"
     },
-    "./zod": {
-      "types": "./dist/zod.d.ts",
-      "default": "./dist/zod.js"
-    },
     "./data/extensions.json": "./data/extensions.json",
     "./package.json": "./package.json",
     "./tsconfig.dts.json": "./tsconfig.dts.json",
@@ -699,13 +711,20 @@
     "@babel/parser": "7.28.4",
     "@babel/traverse": "7.28.4",
     "@babel/types": "7.28.4",
+    "@inquirer/checkbox": "5.1.3",
+    "@inquirer/confirm": "6.0.11",
+    "@inquirer/input": "5.0.11",
+    "@inquirer/password": "5.0.11",
+    "@inquirer/search": "4.1.7",
+    "@inquirer/select": "5.1.3",
     "@npmcli/arborist": "9.1.4",
     "@npmcli/package-json": "7.0.0",
     "@npmcli/promise-spawn": "8.0.3",
+    "@sinclair/typebox": "0.34.49",
     "@socketregistry/is-unicode-supported": "1.0.5",
     "@socketregistry/packageurl-js": "1.4.2",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.18.2",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.19.1",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20260415.1",
     "@vitest/coverage-v8": "4.0.3",