@warlock.js/seal 4.15.0 → 5.0.0

package/CHANGELOG.md

@@ -1,30 +1,47 @@
-# Changelog — @warlock.js/seal
-
-All notable changes to `@warlock.js/seal` are documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
-
+# Changelog — @warlock.js/seal
+
+All notable changes to `@warlock.js/seal` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
+
+## 5.0.0 - 2026-08-25
+
+### Changed
+
+- IP validation no longer imports Node's `net` module, so the same IPv4 and IPv6 rules can run in browser bundles.
+- Optional validators now skip value rules only for absent values; present empty values such as `""` are validated instead of passing through with the wrong output type.
+
+## 4.16.0 - 2026-08-18
+
+### Security
+
+- **Renamed `safeHtmlMutator`/`.safeHtml()` to `stripTagsMutator`/`.stripTags()`.** The old name implied XSS safety it never provided — the implementation is a naive `<[^>]*>` regex, not an HTML parser, and can be defeated by malformed/nested markup or content re-introduced later in a pipeline. A developer building `v.string().safeHtml()` for user-supplied rich text was liable to treat the output as pre-sanitized and skip further output encoding, opening a stored/reflected XSS path. The new names and doc comments make clear this is tag-stripping only; use a real parser-based sanitizer (DOMPurify / sanitize-html) for untrusted rich text. `safeHtmlMutator` and `.safeHtml()` remain as deprecated aliases (same behavior, `@deprecated` JSDoc pointing at the new names) so existing callers do not break.
+
+### Dependencies
+
+- Bumped `@mongez/supportive-is` to `^2.1.4` (no breaking changes) and `@mongez/reinforcements` to `^4.0.1`. The reinforcements major makes `Random.string/nanoid/id/token/uuid` CSPRNG-backed (WebCrypto) and removes `Random.seed()` support — audited this package's source and tests for `Random.seed(` and for seeded/reproducible use of `Random.*`; none found, so no code changes were needed.
+
 ## 4.12.0
 
 ### Changed
 
 - Declares its own test runner and pins it to an exact version (`vitest@4.1.10`). The package is its own repository, so a runner resolved from a workspace root it may not be cloned with is a runner it cannot rely on. The pin is exact rather than a range because the version moved underneath the suite mid-development on an unrelated install — a suite whose runner can change without anyone choosing it proves less than it appears to
 
-## 4.9.2
-
-### Fixed
-
-- `v.literal("")` could never pass. Every validator is required by default and `required` rejects anything the empty-value check calls empty — which includes `""` — so a schema demanding an exact empty string reported "is required" for a field that was present. A literal set containing an empty value now uses `present` (the key must exist) instead of `required`, leaving the literal set to judge the value. Only the empty string was affected; `v.literal(0)` and `v.literal(false)` always worked
-- `v.literal("").optional()` silently disabled the literal check rather than fixing it, accepting `""`, `null` **and** a missing key alike. The literal rule now runs on empty values (`requiresValue: false`) while treating absence as the required/present rule's question, so `.optional()` means optional again and a present value must still match
-- a **failed** validation no longer returns the input it rejected. `object` returned the raw input — including the unknown keys it had just complained about — while `discriminatedUnion` returned `undefined`; the same call shape had two contracts. Validating an outbound DTO to keep internal fields out of a response, then reading `data` without branching on `isValid`, shipped every field the schema existed to exclude. `data` is now `undefined` whenever `isValid` is `false`
-- `v.number().toFixed(n)` could never produce a valid result — the mutator returned `Number(value).toFixed(n)`, a *string*, which the validator's own `number` type rule then rejected. It now yields a number (`3.14159` → `3.14`), so the method works where it lives. No working code can have depended on the old output, since every such validation failed; for a fixed-point *string*, format at the presentation edge rather than asking a number schema to emit one
-
-## 4.2.11
-
-### Changed
-
-- Bumped `@mongez/reinforcements` to 3.3.0
-
-## 4.1.15
-
-- Baseline — per-package changelog tracking starts at this version.
+## 4.9.2
+
+### Fixed
+
+- `v.literal("")` could never pass. Every validator is required by default and `required` rejects anything the empty-value check calls empty — which includes `""` — so a schema demanding an exact empty string reported "is required" for a field that was present. A literal set containing an empty value now uses `present` (the key must exist) instead of `required`, leaving the literal set to judge the value. Only the empty string was affected; `v.literal(0)` and `v.literal(false)` always worked
+- `v.literal("").optional()` silently disabled the literal check rather than fixing it, accepting `""`, `null` **and** a missing key alike. The literal rule now runs on empty values (`requiresValue: false`) while treating absence as the required/present rule's question, so `.optional()` means optional again and a present value must still match
+- a **failed** validation no longer returns the input it rejected. `object` returned the raw input — including the unknown keys it had just complained about — while `discriminatedUnion` returned `undefined`; the same call shape had two contracts. Validating an outbound DTO to keep internal fields out of a response, then reading `data` without branching on `isValid`, shipped every field the schema existed to exclude. `data` is now `undefined` whenever `isValid` is `false`
+- `v.number().toFixed(n)` could never produce a valid result — the mutator returned `Number(value).toFixed(n)`, a *string*, which the validator's own `number` type rule then rejected. It now yields a number (`3.14159` → `3.14`), so the method works where it lives. No working code can have depended on the old output, since every such validation failed; for a fixed-point *string*, format at the presentation edge rather than asking a number schema to emit one
+
+## 4.2.11
+
+### Changed
+
+- Bumped `@mongez/reinforcements` to 3.3.0
+
+## 4.1.15
+
+- Baseline — per-package changelog tracking starts at this version.

package/cjs/index.cjs

@@ -30,7 +30,6 @@ let _mongez_reinforcements = require("@mongez/reinforcements");
 let _mongez_supportive_is = require("@mongez/supportive-is");
 let dayjs = require("dayjs");
 dayjs = __toESM(dayjs, 1);
-let net = require("net");
 
 //#region ../seal/src/standard-schema/json-schema.ts
 /**
@@ -935,9 +934,10 @@ var BaseValidator = class {
 		let isValid = true;
 		const isFirstErrorOnly = context.configurations?.firstErrorOnly ?? true;
 		const isEmpty = isEmptyValue(valueForRules);
+		const skipEmptyRules = this.isOptional ? valueForRules === void 0 : isEmpty;
 		const rulesToRun = this.requiredRule ? [this.requiredRule, ...this.rules] : this.rules;
 		for (const rule of rulesToRun) {
-			if ((rule.requiresValue ?? true) && isEmpty) continue;
+			if ((rule.requiresValue ?? true) && skipEmptyRules) continue;
 			this.setRuleAttributesList(rule);
 			const result = await rule.validate(mutatedData, context);
 			if (result.isValid === false) {
@@ -1354,10 +1354,24 @@ const stringifyMutator = async (value) => {
 const trimMutator = async (value, context) => {
 	return (0, _mongez_reinforcements.trim)(value?.toString(), context?.options?.needle ?? " ");
 };
-/** Remove HTML tags (safe HTML) */
-const safeHtmlMutator = async (value) => {
+/**
+* Strip HTML tags with a naive `<...>` regex.
+*
+* This is a **tag stripper, not an XSS sanitizer**: it is not a parser, so
+* malformed/nested markup, attribute payloads, or content re-introduced
+* later in a pipeline can defeat it. Do not rely on this alone to make
+* untrusted rich text safe to render — use a real parser-based sanitizer
+* (e.g. DOMPurify / sanitize-html) for that.
+*/
+const stripTagsMutator = async (value) => {
 	return value?.toString().replace(/<[^>]*>?/gm, "");
 };
+/**
+* @deprecated Renamed to {@link stripTagsMutator} — the old name implied
+* XSS safety this tag-stripping regex does not provide. Kept as an alias
+* for backward compatibility; switch to `stripTagsMutator`.
+*/
+const safeHtmlMutator = stripTagsMutator;
 /** HTML escape */
 const htmlEscapeMutator = async (value) => {
 	return value?.toString().replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
@@ -1755,13 +1769,38 @@ const nanoidRule = {
 //#endregion
 //#region ../seal/src/rules/string/ip.ts
 /**
+* Pure, dependency-free re-implementation of Node's `net.isIP`/`isIPv4`/`isIPv6`.
+* Mirrors the exact regex Node uses internally (lib/internal/net.js) so that
+* behavior stays identical while remaining runnable in the browser (no `net` import).
+*/
+const v4Seg = "(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])";
+const v4Str = `(${v4Seg}[.]){3}${v4Seg}`;
+const IPv4Reg = new RegExp(`^${v4Str}$`);
+const v6Seg = "(?:[0-9a-fA-F]{1,4})";
+const IPv6Reg = new RegExp(`^((?:${v6Seg}:){7}(?:${v6Seg}|:)|(?:${v6Seg}:){6}(?:${v4Str}|:${v6Seg}|:)|(?:${v6Seg}:){5}(?::${v4Str}|(:${v6Seg}){1,2}|:)|(?:${v6Seg}:){4}(?:(:${v6Seg}){0,1}:${v4Str}|(:${v6Seg}){1,3}|:)|(?:${v6Seg}:){3}(?:(:${v6Seg}){0,2}:${v4Str}|(:${v6Seg}){1,4}|:)|(?:${v6Seg}:){2}(?:(:${v6Seg}){0,3}:${v4Str}|(:${v6Seg}){1,5}|:)|(?:${v6Seg}:){1}(?:(:${v6Seg}){0,4}:${v4Str}|(:${v6Seg}){1,6}|:)|(?::((?::${v6Seg}){0,5}:${v4Str}|(?::${v6Seg}){1,7}|:)))(%[0-9a-zA-Z-.:]{1,})?\$`);
+function isIPv4(value) {
+	return IPv4Reg.test(value);
+}
+function isIPv6(value) {
+	return IPv6Reg.test(value);
+}
+/**
+* Returns 4 or 6 when `value` is a valid IPv4/IPv6 address, otherwise 0.
+* Signature mirrors Node's `net.isIP` for drop-in behavior parity.
+*/
+function isIP(value) {
+	if (isIPv4(value)) return 4;
+	if (isIPv6(value)) return 6;
+	return 0;
+}
+/**
 * IP rule - validates IP address (v4 or v6)
 */
 const ipRule = {
 	name: "ip",
 	defaultErrorMessage: "The :input must be a valid IP address",
 	async validate(value, context) {
-		if ((0, net.isIP)(value)) return VALID_RULE;
+		if (isIP(value)) return VALID_RULE;
 		return invalidRule(this, context);
 	}
 };
@@ -1772,7 +1811,7 @@ const ip4Rule = {
 	name: "ip4",
 	defaultErrorMessage: "The :input must be a valid IPv4 address",
 	async validate(value, context) {
-		if ((0, net.isIP)(value) === 4) return VALID_RULE;
+		if (isIP(value) === 4) return VALID_RULE;
 		return invalidRule(this, context);
 	}
 };
@@ -1783,7 +1822,7 @@ const ip6Rule = {
 	name: "ip6",
 	defaultErrorMessage: "The :input must be a valid IPv6 address",
 	async validate(value, context) {
-		if ((0, net.isIP)(value) === 6) return VALID_RULE;
+		if (isIP(value) === 6) return VALID_RULE;
 		return invalidRule(this, context);
 	}
 };
@@ -7985,9 +8024,25 @@ var StringValidator = class extends PrimitiveValidator {
 			char
 		});
 	}
-	/** Remove HTML tags (safe HTML) */
+	/**
+	* Strip HTML tags with a naive `<...>` regex.
+	*
+	* This is a **tag stripper, not an XSS sanitizer**: it is not a parser,
+	* so malformed/nested markup or content re-introduced later in a
+	* pipeline can defeat it. Do not rely on this alone to make untrusted
+	* rich text safe to render — use a real parser-based sanitizer (e.g.
+	* DOMPurify / sanitize-html) for that.
+	*/
+	stripTags() {
+		return this.addMutator(stripTagsMutator);
+	}
+	/**
+	* @deprecated Renamed to {@link StringValidator.stripTags} — the old
+	* name implied XSS safety this tag-stripping regex does not provide.
+	* Kept as an alias for backward compatibility; switch to `.stripTags()`.
+	*/
 	safeHtml() {
-		return this.addMutator(safeHtmlMutator);
+		return this.stripTags();
 	}
 	/** HTML escape special characters */
 	htmlEscape() {
@@ -8781,6 +8836,9 @@ exports.ip6Rule = ip6Rule;
 exports.ipRule = ipRule;
 exports.isCreditCardRule = isCreditCardRule;
 exports.isDateValue = isDateValue;
+exports.isIP = isIP;
+exports.isIPv4 = isIPv4;
+exports.isIPv6 = isIPv6;
 exports.isNumericRule = isNumericRule;
 exports.jsonMutator = jsonMutator;
 exports.kebabCaseMutator = kebabCaseMutator;
@@ -8900,6 +8958,7 @@ exports.startsWithRule = startsWithRule;
 exports.stringMutator = stringMutator;
 exports.stringRule = stringRule;
 exports.stringifyMutator = stringifyMutator;
+exports.stripTagsMutator = stripTagsMutator;
 exports.stripUnknownMutator = stripUnknownMutator;
 exports.strongPasswordRule = strongPasswordRule;
 exports.titleCaseMutator = titleCaseMutator;