@ultimat3/schema 4.0.0 → 5.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/schema",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "Ultimate's validation seam: Standard Schema interface, the t namespace, JSON Schema output",
   "license": "MIT",
   "type": "module",

package/src/errors.ts

@@ -4,6 +4,31 @@
 
 import { formatIssues } from './standard';
 
+/**
+ * The same escape `@ultimat3/core`'s `singleLine` performs. **Keep in sync**, and read the reason
+ * there — briefly: the 3-line format is line-oriented, and a `cause` may hold a value the caller
+ * chose, so a newline in one writes a line an operator reads as a genuine framework message.
+ *
+ * Copied rather than imported for the same reason the brand symbol above is: `schema` and `core`
+ * are both tier 0, so `schema` may not import `core` (imports go DOWN, never sideways). A schema
+ * cause is the one most likely to carry a hostile string — it describes the value that failed
+ * validation, which is the request body.
+ */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: escaping them is the point.
+const CONTROL = /[\u0000-\u001f\u007f\u2028\u2029]/g;
+const ESCAPES: Readonly<Record<string, string>> = {
+  '\n': String.raw`\n`,
+  '\r': String.raw`\r`,
+  '\t': String.raw`\t`,
+  '\b': String.raw`\b`,
+  '\f': String.raw`\f`,
+};
+const singleLine = (text: string): string =>
+  text.replace(
+    CONTROL,
+    (char) => ESCAPES[char] ?? `\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}`,
+  );
+
 /** Same well-known symbol `@ultimat3/core` brands with. Keep in sync, never rename. */
 export const ULTIMATE_ERROR_BRAND: unique symbol = Symbol.for('ultimate.error');
 
@@ -71,16 +96,20 @@ export class SchemaError extends Error {
   readonly meta: Readonly<Record<string, unknown>> | undefined;
 
   constructor(init: SchemaErrorInit) {
-    const title = TITLES[init.code] ?? humanize(init.code);
-    super(`${init.code}: ${title}`, { cause: init.cause });
-    this.code = init.code;
+    // Escaped HERE, once, exactly as `UltimateError`'s constructor does — read the reason there.
+    // A schema cause is the one most likely to carry a hostile string: it describes the value that
+    // failed validation, which is the request body.
+    const code = singleLine(init.code);
+    const title = singleLine(TITLES[init.code] ?? humanize(init.code));
+    super(`${code}: ${title}`, { cause: singleLine(init.cause) });
+    this.code = code;
     this.title = title;
-    this.fix = init.fix;
-    this.docs = init.docs ?? `https://ultimate.dev/errors/${init.code}`;
+    this.fix = singleLine(init.fix);
+    this.docs = singleLine(init.docs ?? `https://ultimate.dev/errors/${init.code}`);
     this.meta = init.meta;
   }
 
-  /** The same 3-line rendering as `UltimateError.format()`. */
+  /** The same 3-line rendering as `UltimateError.format()`, escaped in the same place: neither. */
   format(): string {
     return [`${this.code}: ${this.title}`, `  cause: ${this.cause}`, `  fix:   ${this.fix}`].join(
       '\n',