@zudojs/validation 1.0.0 → 1.0.2

package/README.md

@@ -2,6 +2,12 @@
 
 Schema validation with Zod integration, constraints, parsers, composers, circular detection, and depth/size checks.
 
+<!-- zudo-docs:start -->
+
+**Documentation:** [zudojs.oyinlola.site/docs/packages-validation](https://zudojs.oyinlola.site/docs/packages-validation) · **For AI agents:** [Markdown version](https://zudojs.oyinlola.site/docs/packages-validation.md), [llms.txt](https://zudojs.oyinlola.site/llms.txt)
+
+<!-- zudo-docs:end -->
+
 ## Installation
 
 ```bash
@@ -51,9 +57,21 @@ assertNoCircularReference(body);
   `test()` stateful and flip the answer on alternate calls.
 - Constraints carry an optional type guard, so wrong-typed input at a trust
   boundary reports as a validation failure rather than a `TypeError`.
-- The depth and size guards count a shared subtree once per occurrence, the way
-  a serializer expands it, and walk iteratively so deeply nested input cannot
-  exhaust the stack inside the check.
+- The size guard counts a shared subtree once per occurrence, the way a
+  serializer expands it, and measures what `toJSON()` returns when a value has
+  one. The cycle and depth guards walk a shared subtree once, so a small graph
+  of shared nodes cannot cost exponential time. All guards walk iteratively, so
+  deeply nested input cannot exhaust the stack inside the check, and handle
+  sparse arrays (a hole counts as `undefined`).
+- `ValidationError` and `ValidationResultError` extend `@zudojs/errors`'
+  `ValidationError`, so `instanceof` and `isValidationError()` from either
+  package catch them. Their `toJSON()` keeps the base class's redaction:
+  submitted issue values and sensitive `context` keys never reach the JSON.
+- `not(constraint)` fails closed: a wrong-typed value, or one that makes the
+  inner constraint throw, fails. `everyItem`/`someItem` read every index,
+  holes included.
+- A registry rule that declares both `schema` and `constraints` runs the schema,
+  then the constraints on the parsed value.
 
 ## Features
 

package/dist/validationComposer/validationComposer.combinators.js

@@ -34,16 +34,10 @@ export function any(...validators) {
                 return result;
             issues.push(...result.issues);
         }
-        return failure(issues.length > 0
-            ? issues
-            : [
-                {
-                    path: [],
-                    code: "no_validator_succeeded",
-                    message: "No validation rule accepted the value.",
-                    received: value,
-                },
-            ]);
+        // Never echo the rejected value: issues flow into a 400 response and
+        // into logs, so `received` would hand back the password or token that
+        // was just refused.
+        return failure(issues.length > 0 ? issues : [noValidatorSucceeded()]);
     };
 }
 /**

package/dist/validationConstraints/collection/validationConstraints.array.js

@@ -14,6 +14,18 @@ function itemHolds(constraint, value) {
         return false;
     }
 }
+/**
+ * Whether any item's constraint result equals `want`, reading every index.
+ * `Array.prototype.every`/`some` skip holes, so `new Array(3)` passed any
+ * `everyItem` constraint.
+ */
+function scanItems(values, constraint, want) {
+    for (let i = 0; i < values.length; i++) {
+        if (itemHolds(constraint, values[i]) === want)
+            return true;
+    }
+    return false;
+}
 /**
  * Requires an array to contain at least a given number of items.
  */
@@ -54,7 +66,7 @@ export function exactItems(length) {
  * Requires every array item to satisfy a constraint.
  */
 export function everyItem(constraint) {
-    return createConstraint((values) => values.every((value) => itemHolds(constraint, value)), {
+    return createConstraint((values) => !scanItems(values, constraint, false), {
         name: `every_${constraint.name}`,
         code: "item_constraint_failed",
         message: constraint.message,
@@ -65,7 +77,7 @@ export function everyItem(constraint) {
  * Requires at least one array item to satisfy a constraint.
  */
 export function someItem(constraint) {
-    return createConstraint((values) => values.some((value) => itemHolds(constraint, value)), {
+    return createConstraint((values) => scanItems(values, constraint, true), {
         name: `some_${constraint.name}`,
         code: "some_item_constraint_failed",
         message: `At least one item must satisfy ${constraint.name}.`,

package/dist/validationConstraints/scalar/validationConstraints.string.d.ts

@@ -30,6 +30,9 @@ export declare function matches(pattern: RegExp, message?: string): ValidationCo
  *
  * Deliberately structural, not a full RFC 5322 parser: it rejects the shapes
  * that are certainly wrong and leaves deliverability to a verification step.
+ * Uses `ValidationPattern.EMAIL` from `@zudojs/constants`, the monorepo's one
+ * acceptance set (shared with `isEmail` in `@zudojs/types`). The 254-character
+ * bound is checked first so an oversized value is rejected without a scan.
  */
 export declare const email: ValidationConstraint<string>;
 /**

package/dist/validationConstraints/scalar/validationConstraints.string.js

@@ -1,3 +1,4 @@
+import { ValidationLength, ValidationPattern } from "@zudojs/constants";
 import { createConstraint, assertNonNegativeInteger, } from "../validationConstraints.base.js";
 /** Counts Unicode code points rather than UTF-16 code units. */
 function characterLength(value) {
@@ -77,8 +78,12 @@ export function matches(pattern, message = "Value has an invalid format.") {
  *
  * Deliberately structural, not a full RFC 5322 parser: it rejects the shapes
  * that are certainly wrong and leaves deliverability to a verification step.
+ * Uses `ValidationPattern.EMAIL` from `@zudojs/constants`, the monorepo's one
+ * acceptance set (shared with `isEmail` in `@zudojs/types`). The 254-character
+ * bound is checked first so an oversized value is rejected without a scan.
  */
-export const email = createConstraint((value) => /^[^\s@,;<>"[\]\\]+@[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/iu.test(value) && !value.includes(".."), {
+export const email = createConstraint((value) => value.length <= ValidationLength.EMAIL &&
+    ValidationPattern.EMAIL.test(value), {
     name: "email",
     code: "invalid_email",
     message: "Value must be a valid email address.",

package/dist/validationConstraints/structure/validationConstraints.children.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @zudojs/validation — Child enumeration for the structural guards.
+ */
+/** Whether a value has children worth descending into. */
+export declare function isContainer(value: unknown): value is object;
+/**
+ * The child values of a container, as [pathSegment, value] pairs.
+ *
+ * Arrays are read by index. `Array.prototype.map` skips holes and returns a
+ * sparse result, so `[1, , 3]` used to yield an `undefined` pair that crashed
+ * every guard with a raw TypeError; a hole is now an `undefined` child, which
+ * is also how `JSON.stringify` writes it (as `null`).
+ */
+export declare function childrenOf(value: object): Array<[string, unknown]>;
+//# sourceMappingURL=validationConstraints.children.d.ts.map

package/dist/validationConstraints/structure/validationConstraints.children.js

@@ -0,0 +1,41 @@
+/**
+ * @zudojs/validation — Child enumeration for the structural guards.
+ */
+/** Whether a value has children worth descending into. */
+export function isContainer(value) {
+    return (typeof value === "object" && value !== null && !ArrayBuffer.isView(value));
+}
+/**
+ * The child values of a container, as [pathSegment, value] pairs.
+ *
+ * Arrays are read by index. `Array.prototype.map` skips holes and returns a
+ * sparse result, so `[1, , 3]` used to yield an `undefined` pair that crashed
+ * every guard with a raw TypeError; a hole is now an `undefined` child, which
+ * is also how `JSON.stringify` writes it (as `null`).
+ */
+export function childrenOf(value) {
+    if (Array.isArray(value)) {
+        const children = [];
+        for (let index = 0; index < value.length; index++) {
+            children.push([`[${index}]`, value[index]]);
+        }
+        return children;
+    }
+    if (value instanceof Map) {
+        const children = [];
+        let index = 0;
+        for (const [key, entry] of value) {
+            children.push([`.key(${index})`, key], [`[${String(key)}]`, entry]);
+            index++;
+        }
+        return children;
+    }
+    if (value instanceof Set) {
+        return [...value].map((entry, index) => [`.item(${index})`, entry]);
+    }
+    if (value instanceof Date || value instanceof RegExp)
+        return [];
+    const record = value;
+    return Object.keys(record).map((key) => [`.${key}`, record[key]]);
+}
+//# sourceMappingURL=validationConstraints.children.js.map

package/dist/validationConstraints/structure/validationConstraints.size.js

@@ -43,6 +43,24 @@ function chargeFor(value) {
         keys.reduce((total, key) => total + key.length + 4, 0) +
         Math.max(0, keys.length - 1));
 }
+/**
+ * What `JSON.stringify` will actually write for a node: the result of its
+ * `toJSON()` when it has one. Measuring the object's own keys instead let a
+ * class whose `toJSON` returns megabytes estimate at a dozen bytes. Dates and
+ * binary views keep their existing flat and byte-length charges.
+ */
+function resolveToJson(value) {
+    if (typeof value !== "object" ||
+        value === null ||
+        value instanceof Date ||
+        ArrayBuffer.isView(value)) {
+        return value;
+    }
+    const toJSON = value.toJSON;
+    return typeof toJSON === "function"
+        ? toJSON.call(value, "")
+        : value;
+}
 /**
  * Estimate the byte size of a value as JSON without allocating a string.
  *
@@ -61,6 +79,7 @@ export function estimateSerializedSize(value, maxBytes = Number.POSITIVE_INFINIT
             maxDepth: MAX_MEASURABLE_DEPTH,
             maxCost: maxBytes,
             charge: chargeFor,
+            resolve: resolveToJson,
         }).cost;
     }
     catch (error) {
@@ -86,6 +105,7 @@ export function assertSizeWithinLimit(value, maxSize) {
             maxDepth: MAX_MEASURABLE_DEPTH,
             maxCost: maxSize,
             charge: chargeFor,
+            resolve: resolveToJson,
         });
     }
     catch (error) {

package/dist/validationConstraints/structure/validationConstraints.traverse.d.ts

@@ -17,15 +17,12 @@
  * exactly the deeply nested input the depth guard exists to reject, so the
  * check would fail inside itself before it could report anything.
  */
-/** Why a traversal stopped early. */
-export type TraversalHalt = "depth" | "budget" | "cycle";
-/** Signals that a traversal hit one of its bounds. */
-export declare class TraversalLimitError extends Error {
-    readonly halt: TraversalHalt;
-    readonly path: string;
-    readonly observed: number;
-    constructor(halt: TraversalHalt, path: string, observed: number);
-}
+/**
+ * The halt signal is owned by `@zudojs/errors` (round 10 VAL-05/CV-02) and
+ * re-exported here, so the depth, size and circular guards keep importing
+ * it from this module.
+ */
+export { TraversalLimitError, type TraversalHalt } from "@zudojs/errors";
 /** What the caller wants from each node. */
 export interface TraversalVisitor {
     /** Maximum nesting depth to descend before halting. */
@@ -36,6 +33,11 @@ export interface TraversalVisitor {
     readonly failOnCycle?: boolean;
     /** Cost contributed by a single node, excluding its children. */
     charge?(value: unknown): number;
+    /**
+     * Maps a node to the value actually walked in its place, e.g. the result
+     * of `toJSON()` when measuring what `JSON.stringify` will write.
+     */
+    resolve?(value: unknown): unknown;
 }
 /** What a completed traversal observed. */
 export interface TraversalReport {

package/dist/validationConstraints/structure/validationConstraints.traverse.js

@@ -17,45 +17,14 @@
  * exactly the deeply nested input the depth guard exists to reject, so the
  * check would fail inside itself before it could report anything.
  */
-/** Signals that a traversal hit one of its bounds. */
-export class TraversalLimitError extends Error {
-    halt;
-    path;
-    observed;
-    constructor(halt, path, observed) {
-        super(`Traversal halted (${halt}) at ${path}`);
-        this.halt = halt;
-        this.path = path;
-        this.observed = observed;
-        this.name = "TraversalLimitError";
-    }
-}
-/** Whether a value has children worth descending into. */
-function isContainer(value) {
-    return (typeof value === "object" && value !== null && !ArrayBuffer.isView(value));
-}
-/** The child values of a container, as [pathSegment, value] pairs. */
-function childrenOf(value) {
-    if (Array.isArray(value)) {
-        return value.map((child, index) => [`[${index}]`, child]);
-    }
-    if (value instanceof Map) {
-        const children = [];
-        let index = 0;
-        for (const [key, entry] of value) {
-            children.push([`.key(${index})`, key], [`[${String(key)}]`, entry]);
-            index++;
-        }
-        return children;
-    }
-    if (value instanceof Set) {
-        return [...value].map((entry, index) => [`.item(${index})`, entry]);
-    }
-    if (value instanceof Date || value instanceof RegExp)
-        return [];
-    const record = value;
-    return Object.keys(record).map((key) => [`.${key}`, record[key]]);
-}
+import { TraversalLimitError } from "@zudojs/errors";
+import { childrenOf, isContainer } from "./validationConstraints.children.js";
+/**
+ * The halt signal is owned by `@zudojs/errors` (round 10 VAL-05/CV-02) and
+ * re-exported here, so the depth, size and circular guards keep importing
+ * it from this module.
+ */
+export { TraversalLimitError } from "@zudojs/errors";
 /**
  * Walk a value graph within explicit depth and cost bounds.
  *
@@ -68,6 +37,12 @@ function childrenOf(value) {
 export function traverse(root, visitor, rootPath = "root") {
     const maxCost = visitor.maxCost ?? Number.POSITIVE_INFINITY;
     const onPath = new Set();
+    // Without a per-node charge, a subtree already walked from some depth need
+    // not be walked again from the same depth or a shallower one: it holds no
+    // cycle (the walk would have halted) and cannot reach deeper than before.
+    // Re-walking it made a DAG of n shared `[node, node]` pairs cost 2^n.
+    // Only cost accounting must expand every occurrence, as a serializer does.
+    const walkedAt = visitor.charge ? undefined : new Map();
     const stack = [{ value: root, depth: 0, path: rootPath }];
     let cost = 0;
     let deepest = 0;
@@ -77,7 +52,8 @@ export function traverse(root, visitor, rootPath = "root") {
             onPath.delete(frame.leave);
             continue;
         }
-        const { value, depth, path } = frame;
+        const { depth, path } = frame;
+        const value = visitor.resolve ? visitor.resolve(frame.value) : frame.value;
         cost += visitor.charge?.(value) ?? 0;
         if (cost > maxCost)
             throw new TraversalLimitError("budget", path, cost);
@@ -85,15 +61,26 @@ export function traverse(root, visitor, rootPath = "root") {
             deepest = depth;
         if (!isContainer(value))
             continue;
+        // A container occupies the level below the one it sits at, so an empty
+        // `{}` at depth d reaches d + 1 — the same level at which the depth
+        // guard below refuses to descend into it. Reporting only leaf depths
+        // made `getSerializationDepth({})` 0 while `assertDepthWithinLimit({},
+        // 0)` threw.
+        if (depth + 1 > deepest)
+            deepest = depth + 1;
         if (onPath.has(value)) {
             if (visitor.failOnCycle) {
                 throw new TraversalLimitError("cycle", path, depth);
             }
             continue;
         }
+        const previous = walkedAt?.get(value);
+        if (previous !== undefined && depth <= previous)
+            continue;
         if (depth >= visitor.maxDepth) {
             throw new TraversalLimitError("depth", path, depth + 1);
         }
+        walkedAt?.set(value, depth);
         onPath.add(value);
         stack.push({ value: undefined, depth, path, leave: value });
         const children = childrenOf(value);

package/dist/validationConstraints/validationConstraints.base.js

@@ -88,10 +88,23 @@ export function combineConstraints(...constraints) {
  * Creates a negated constraint.
  */
 export function not(constraint, options = {}) {
-    return createConstraint((value) => !runConstraint(constraint, value), {
+    // Negation must not fail open. A value of the wrong type, or one that makes
+    // the inner check throw, used to count as "does not satisfy" and pass, so
+    // `not(matches(/<script/))` accepted `["<script>"]`. The inner guard is
+    // carried over and a throw is a failure.
+    const guard = options.guard ?? constraint.guard;
+    return createConstraint((value) => {
+        try {
+            return !constraint.validate(value);
+        }
+        catch {
+            return false;
+        }
+    }, {
         name: options.name ?? `not_${constraint.name}`,
         code: options.code ?? "negated_constraint_failed",
         message: options.message ?? `Value must not satisfy ${constraint.name}.`,
+        ...(guard ? { guard } : {}),
     });
 }
 /**

package/dist/validationErrors/validationError.base.d.ts

@@ -2,7 +2,7 @@
  * Base validation error and error codes.
  */
 import type { ValidationIssue } from "../validationResult/validationResult.type.js";
-import { BaseError, ErrorCategory, ErrorSeverity, type ErrorMetadata } from "@zudojs/errors";
+import { ValidationError as SharedValidationError, ErrorCategory, ErrorSeverity, type ErrorMetadata } from "@zudojs/errors";
 /** Error codes used by the validation package. */
 export declare enum ValidationErrorCode {
     INVALID_INPUT = "VALIDATION_INVALID_INPUT",
@@ -20,8 +20,15 @@ export interface ValidationErrorOptions {
     readonly cause?: unknown;
     readonly context?: Readonly<Record<string, unknown>>;
 }
-/** Base error for validation failures. */
-export declare class ValidationError extends BaseError {
+/**
+ * Base error for validation failures.
+ *
+ * A thin subclass of `@zudojs/errors`' `ValidationError`, so a consumer that
+ * catches the shared class (or calls its `isValidationError`) also catches
+ * errors thrown by this package. It used to extend `BaseError` directly and
+ * was an unrelated class with the same name.
+ */
+export declare class ValidationError extends SharedValidationError {
     readonly validationCode: ValidationErrorCode;
     readonly issues: readonly ValidationIssue[];
     readonly context?: Readonly<Record<string, unknown>>;
@@ -31,6 +38,11 @@ export declare class ValidationError extends BaseError {
     get fieldErrors(): Readonly<Record<string, string>>;
     /** Returns a formatted representation of all issues. */
     get formattedIssues(): string;
+    /**
+     * Serializes the error. `issues` and `context` come from the base
+     * `toJSON()`, which redacts submitted issue values and sensitive metadata
+     * keys; re-adding the raw fields here used to undo that redaction.
+     */
     toJSON(): {
         code: string;
         category: ErrorCategory;
@@ -38,14 +50,14 @@ export declare class ValidationError extends BaseError {
         statusCode: number;
         expose: boolean;
         isOperational: boolean;
-        metadata: Readonly<ErrorMetadata>;
+        metadata: Readonly<import("@zudojs/errors").ErrorMetadata>;
         stack?: string;
         cause?: import("@zudojs/errors").SerializedBaseError | unknown;
+        issues: readonly import("@zudojs/errors").ValidationIssue[];
         name: string;
         validationCode: ValidationErrorCode;
         message: string;
-        issues: readonly ValidationIssue[];
-        context?: Readonly<Record<string, unknown>> | undefined;
+        context?: Readonly<ErrorMetadata> | undefined;
         timestamp: number;
     };
 }

package/dist/validationErrors/validationError.base.js

@@ -2,7 +2,7 @@
  * Base validation error and error codes.
  */
 import { formatIssues, toFieldErrors, } from "../validationResult/validationResult.type.js";
-import { BaseError, ErrorCode, ErrorCategory, ErrorSeverity, } from "@zudojs/errors";
+import { ValidationError as SharedValidationError, ErrorCode, ErrorCategory, ErrorSeverity, } from "@zudojs/errors";
 /**
  * Maps a package-specific validation code to the shared error registry code.
  *
@@ -42,10 +42,16 @@ export var ValidationErrorCode;
     ValidationErrorCode["SCHEMA_FAILED"] = "VALIDATION_SCHEMA_FAILED";
     ValidationErrorCode["UNKNOWN"] = "VALIDATION_UNKNOWN";
 })(ValidationErrorCode || (ValidationErrorCode = {}));
-/** Base error for validation failures. */
-export class ValidationError extends BaseError {
+/**
+ * Base error for validation failures.
+ *
+ * A thin subclass of `@zudojs/errors`' `ValidationError`, so a consumer that
+ * catches the shared class (or calls its `isValidationError`) also catches
+ * errors thrown by this package. It used to extend `BaseError` directly and
+ * was an unrelated class with the same name.
+ */
+export class ValidationError extends SharedValidationError {
     validationCode;
-    issues;
     context;
     timestamp;
     constructor(message, issues = [], options = {}) {
@@ -57,10 +63,10 @@ export class ValidationError extends BaseError {
             expose: true,
             cause: options.cause,
             metadata: { ...options.context },
+            issues,
         });
         this.name = "ValidationError";
         this.validationCode = options.code ?? ValidationErrorCode.UNKNOWN;
-        this.issues = Object.freeze([...issues]);
         this.context = options.context;
         this.timestamp = Date.now();
     }
@@ -72,14 +78,19 @@ export class ValidationError extends BaseError {
     get formattedIssues() {
         return formatIssues(this.issues);
     }
+    /**
+     * Serializes the error. `issues` and `context` come from the base
+     * `toJSON()`, which redacts submitted issue values and sensitive metadata
+     * keys; re-adding the raw fields here used to undo that redaction.
+     */
     toJSON() {
+        const base = super.toJSON();
         return {
-            ...super.toJSON(),
+            ...base,
             name: this.name,
             validationCode: this.validationCode,
             message: this.message,
-            issues: this.issues,
-            ...(this.context ? { context: this.context } : {}),
+            ...(this.context ? { context: base.metadata } : {}),
             timestamp: this.timestamp,
         };
     }

package/dist/validationRegistry/validationRegistry.core.d.ts

@@ -39,7 +39,9 @@ export declare class ValidationRegistry {
      * Constraints receive whatever the caller passed, which at a trust boundary
      * is arbitrary JSON. `checkConstraints` guards and catches internally, so a
      * wrong-typed value reports as a validation failure rather than escaping as
-     * a `TypeError` and turning a 400 into a 500.
+     * a `TypeError` and turning a 400 into a 500. A rule with both `schema`
+     * and `constraints` runs the schema first, then the constraints on its
+     * parsed output.
      */
     validate<T>(name: string, value: unknown): ValidationResult<T>;
     clone(): ValidationRegistry;

package/dist/validationRegistry/validationRegistry.core.js

@@ -66,14 +66,23 @@ export class ValidationRegistry {
      * Constraints receive whatever the caller passed, which at a trust boundary
      * is arbitrary JSON. `checkConstraints` guards and catches internally, so a
      * wrong-typed value reports as a validation failure rather than escaping as
-     * a `TypeError` and turning a 400 into a 500.
+     * a `TypeError` and turning a 400 into a 500. A rule with both `schema`
+     * and `constraints` runs the schema first, then the constraints on its
+     * parsed output.
      */
     validate(name, value) {
         const rule = this.require(name);
-        if (rule.schema)
-            return validate(rule.schema, value);
-        if (rule.constraints && rule.constraints.length > 0)
-            return checkConstraints(rule.constraints, value);
+        const constraints = rule.constraints ?? [];
+        // A rule may declare both. The constraints used to be skipped whenever a
+        // schema was present; now they run on the schema's parsed output.
+        if (rule.schema) {
+            const parsed = validate(rule.schema, value);
+            if (!parsed.success || constraints.length === 0)
+                return parsed;
+            return checkConstraints(constraints, parsed.data);
+        }
+        if (constraints.length > 0)
+            return checkConstraints(constraints, value);
         throw new TypeError(`Validation rule "${name}" has no validation implementation.`);
     }
     clone() {

package/dist/validationResult/validationResult.type.d.ts

@@ -1,7 +1,7 @@
 /**
  * Validation result types and helpers.
  */
-import { BaseError, ErrorCategory, ErrorSeverity } from "@zudojs/errors";
+import { ValidationError as SharedValidationError, ErrorCategory, ErrorSeverity } from "@zudojs/errors";
 /** A single validation issue. */
 export interface ValidationIssue {
     readonly path: readonly (string | number)[];
@@ -58,10 +58,14 @@ export declare function map<T, U>(result: ValidationResult<T>, fn: (data: T) =>
 export declare function combine<T extends readonly unknown[]>(results: {
     [K in keyof T]: ValidationResult<T[K]>;
 }): ValidationResult<T>;
-/** Error thrown when attempting to unwrap a failed validation result. */
-export declare class ValidationResultError extends BaseError {
+/**
+ * Error thrown when attempting to unwrap a failed validation result.
+ * Extends `@zudojs/errors`' `ValidationError`.
+ */
+export declare class ValidationResultError extends SharedValidationError {
     readonly issues: readonly ValidationIssue[];
     constructor(issues: readonly ValidationIssue[]);
+    /** Serializes the error; `issues` keep the base class's value redaction. */
     toJSON(): {
         code: string;
         category: ErrorCategory;
@@ -72,9 +76,9 @@ export declare class ValidationResultError extends BaseError {
         metadata: Readonly<import("@zudojs/errors").ErrorMetadata>;
         stack?: string;
         cause?: import("@zudojs/errors").SerializedBaseError | unknown;
+        issues: readonly import("@zudojs/errors").ValidationIssue[];
         name: string;
         message: string;
-        issues: readonly ValidationIssue[];
     };
 }
 //# sourceMappingURL=validationResult.type.d.ts.map

package/dist/validationResult/validationResult.type.js

@@ -1,7 +1,7 @@
 /**
  * Validation result types and helpers.
  */
-import { BaseError, ErrorCode, ErrorCategory, ErrorSeverity, } from "@zudojs/errors";
+import { ValidationError as SharedValidationError, ErrorCode, ErrorCategory, ErrorSeverity, } from "@zudojs/errors";
 /** Formats validation issues into a human-readable string. */
 export function formatIssues(issues) {
     if (issues.length === 0)
@@ -96,9 +96,11 @@ export function combine(results) {
         ? failure(failures)
         : success(data);
 }
-/** Error thrown when attempting to unwrap a failed validation result. */
-export class ValidationResultError extends BaseError {
-    issues;
+/**
+ * Error thrown when attempting to unwrap a failed validation result.
+ * Extends `@zudojs/errors`' `ValidationError`.
+ */
+export class ValidationResultError extends SharedValidationError {
     constructor(issues) {
         super(formatIssues(issues) || "Validation failed.", {
             code: ErrorCode.VALIDATION_FAILED,
@@ -107,16 +109,16 @@ export class ValidationResultError extends BaseError {
             statusCode: 400,
             expose: true,
             metadata: { issueCount: issues.length },
+            issues,
         });
         this.name = "ValidationResultError";
-        this.issues = Object.freeze([...issues]);
     }
+    /** Serializes the error; `issues` keep the base class's value redaction. */
     toJSON() {
         return {
             ...super.toJSON(),
             name: this.name,
             message: this.message,
-            issues: this.issues,
         };
     }
 }

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@zudojs/validation",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Schema validation with Zod integration, constraints, parsers, composers, circular detection, and depth/size checks.",
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -21,8 +25,9 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "zod": "^4.4.3",
-    "@zudojs/errors": "1.0.0"
+    "@zudojs/constants": "1.1.0",
+    "@zudojs/errors": "1.1.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "typescript": "7.0.2",