schema-dsl 2.0.0 → 2.0.1

package/dist/index.js

@@ -130,7 +130,16 @@ var init_CacheManager = __esm({
         };
       }
       set options(opts) {
-        if (opts.maxSize !== void 0) this._maxSize = opts.maxSize;
+        if (opts.maxSize !== void 0 && opts.maxSize !== this._maxSize) {
+          this._maxSize = opts.maxSize;
+          const oldKeys = this._cache.keys();
+          const newCache = new MemoryCache({ maxEntries: this._maxSize });
+          for (const key of oldKeys) {
+            const val = this._cache.get(key);
+            if (val !== void 0) newCache.set(key, val);
+          }
+          this._cache = newCache;
+        }
         if (opts.ttl !== void 0) this._ttl = opts.ttl;
         if (opts.enabled !== void 0) this._enabled = opts.enabled;
         if (opts.statsEnabled !== void 0) this._statsEnabled = opts.statsEnabled;
@@ -3215,7 +3224,7 @@ var init_Validator = __esm({
 // package.json
 var package_default = {
   name: "schema-dsl",
-  version: "2.0.0",
+  version: "2.0.1",
   description: "A concise and powerful JSON Schema validation library - DSL syntax + String extensions + convenient validate API",
   main: "./dist/index.cjs",
   module: "./dist/index.js",
@@ -3399,6 +3408,7 @@ var JSONSchemaCore = class {
 init_DslParser();
 init_TypeRegistry();
 init_patterns();
+import safeRegex2 from "safe-regex";
 var PASSWORD_PATTERNS = {
   weak: /.{6,}/,
   medium: /^(?=.*[a-zA-Z])(?=.*\d).{8,}$/,
@@ -3557,7 +3567,15 @@ var DslBuilder = class _DslBuilder {
    * Add regex validation.
    */
   pattern(regex, message) {
-    this._baseSchema.pattern = regex instanceof RegExp ? regex.source : regex;
+    const source = regex instanceof RegExp ? regex.source : regex;
+    if (!safeRegex2(source)) {
+      throw new Error(`[schema-dsl] Unsafe regex pattern rejected (potential ReDoS): ${source}`);
+    }
+    return this._setPattern(source, message);
+  }
+  /** Internal: set pattern without safe-regex check (used by built-in validators with pre-approved patterns). */
+  _setPattern(source, message) {
+    this._baseSchema.pattern = source;
     if (message) {
       this._customMessages["string.pattern"] = message;
     }
@@ -3719,25 +3737,25 @@ var DslBuilder = class _DslBuilder {
   domain() {
     this._assertStringType("domain");
     const cfg = PATTERNS.common.domain;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String IP address validation (IPv4 or IPv6). */
   ip() {
     this._assertStringType("ip");
     const cfg = PATTERNS.common.ip;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String Base64 encoding validation. */
   base64() {
     this._assertStringType("base64");
     const cfg = PATTERNS.common.base64;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String JWT token validation. */
   jwt() {
     this._assertStringType("jwt");
     const cfg = PATTERNS.common.jwt;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   // ==================== Identity / Pattern Chain Methods ====================
   /** Phone number validation (auto-corrects number → string). */
@@ -3751,7 +3769,7 @@ var DslBuilder = class _DslBuilder {
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country: ${country}`);
     if (cfg.min !== void 0 && !this._baseSchema.minLength) this._baseSchema.minLength = cfg.min;
     if (cfg.max !== void 0 && !this._baseSchema.maxLength) this._baseSchema.maxLength = cfg.max;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** phone() alias (BC). */
   phoneNumber(country = "cn") {
@@ -3764,35 +3782,35 @@ var DslBuilder = class _DslBuilder {
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for idCard: ${country}`);
     if (cfg.min !== void 0 && !this._baseSchema.minLength) this._baseSchema.minLength = cfg.min;
     if (cfg.max !== void 0 && !this._baseSchema.maxLength) this._baseSchema.maxLength = cfg.max;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** URL slug validation. */
   slugChain() {
-    return this.pattern(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).messages({ pattern: "pattern.slug" });
+    return this._setPattern(/^[a-z0-9]+(?:-[a-z0-9]+)*$/.source).messages({ pattern: "pattern.slug" });
   }
   /** Credit card number validation. */
   creditCard(type = "visa") {
     const cfg = PATTERNS.creditCard[type.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported credit card type: ${type}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Vehicle license plate validation. */
   licensePlate(country = "cn") {
     const cfg = PATTERNS.licensePlate[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for licensePlate: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Postal code validation. */
   postalCode(country = "cn") {
     const cfg = PATTERNS.postalCode[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for postalCode: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Passport number validation. */
   passport(country = "cn") {
     const cfg = PATTERNS.passport[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for passport: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /**
    * Username validation.
@@ -3834,7 +3852,7 @@ var DslBuilder = class _DslBuilder {
     } else {
       pat += "[a-zA-Z]*$";
     }
-    return this.pattern(new RegExp(pat)).messages({ pattern: "pattern.username" });
+    return this._setPattern(pat).messages({ pattern: "pattern.username" });
   }
   /**
    * Password strength validation.
@@ -3845,7 +3863,7 @@ var DslBuilder = class _DslBuilder {
     if (!pat) throw new Error(`[schema-dsl] Invalid password strength: ${strength}`);
     if (!this._baseSchema.minLength) this._baseSchema.minLength = PASSWORD_MIN_LENGTHS[strength];
     if (!this._baseSchema.maxLength) this._baseSchema.maxLength = 64;
-    return this.pattern(pat).messages({ pattern: `pattern.password.${strength}` });
+    return this._setPattern(pat.source).messages({ pattern: `pattern.password.${strength}` });
   }
   // ==================== Number Chain Methods ====================
   /** Number decimal places limit. */
@@ -4936,7 +4954,7 @@ var TypeConverter = class {
       case "array":
         return "JSON";
       case "null":
-        return "NULL";
+        return "TEXT";
       default:
         return "VARCHAR(255)";
     }
@@ -4964,7 +4982,7 @@ var TypeConverter = class {
       case "array":
         return "JSONB";
       case "null":
-        return "NULL";
+        return "TEXT";
       default:
         return "TEXT";
     }
@@ -5218,6 +5236,7 @@ var MySQLExporter = class _MySQLExporter extends BaseExporter {
     if (value === null) return "NULL";
     if (type === "string") return `'${this._escapeString(String(value))}'`;
     if (type === "boolean") return value ? "1" : "0";
+    if (typeof value === "object" && value !== null) return `'${this._escapeString(JSON.stringify(value))}'`;
     return String(value);
   }
 };
@@ -5363,7 +5382,7 @@ COMMENT ON TABLE ${fullTableName} IS '${this._escapeString(jsonSchema.descriptio
     if (value === null) return "NULL";
     if (type === "string") return `'${this._escapeString(String(value))}'`;
     if (type === "boolean") return value ? "TRUE" : "FALSE";
-    if (type === "object" || type === "array") return `'${JSON.stringify(value)}'::JSONB`;
+    if (type === "object" || type === "array") return `'${this._escapeString(JSON.stringify(value))}'::JSONB`;
     return String(value);
   }
   _generateColumnComments(_fullTableName, tableName, schema) {
@@ -5987,6 +6006,10 @@ var SchemaUtils = class _SchemaUtils {
   }
   /**
    * Batch validate using a pre-compiled Ajv validate function.
+   *
+   * Note: the schema is compiled once per call but not cached between calls.
+   * For repeated batch validation of the same schema, prefer `Validator.validateBatch()`
+   * which benefits from the built-in compile cache and returns typed `ValidationResult[]`.
    */
   static validateBatch(schema, dataArray, ajvInstance) {
     const startTime = Date.now();
@@ -6024,20 +6047,21 @@ var SchemaUtils = class _SchemaUtils {
       md += "|-------|------|----------|-------------|\n";
       for (const [key, prop] of Object.entries(schema.properties)) {
         const required = schema.required?.includes(key) ? "\u2705" : "\u274C";
-        const type = prop.type ?? "any";
+        const type = _SchemaUtils._escapeMdCell(prop.type ?? "any");
         const p = prop;
-        const label = p["_label"] ?? key;
-        md += `| ${key} | ${type} | ${required} | ${label} |
+        const label = _SchemaUtils._escapeMdCell(p["_label"] ?? key);
+        const escapedKey = _SchemaUtils._escapeMdCell(key);
+        md += `| ${escapedKey} | ${type} | ${required} | ${label} |
 `;
         const constraints = [];
         if (prop.minLength) constraints.push(`minLength: ${prop.minLength}`);
         if (prop.maxLength) constraints.push(`maxLength: ${prop.maxLength}`);
         if (prop.minimum !== void 0) constraints.push(`minimum: ${prop.minimum}`);
         if (prop.maximum !== void 0) constraints.push(`maximum: ${prop.maximum}`);
-        if (prop.pattern) constraints.push(`pattern: \`${prop.pattern}\``);
+        if (prop.pattern) constraints.push(`pattern: \`${_SchemaUtils._escapeMdCell(String(prop.pattern))}\``);
         if (prop.enum) constraints.push(`enum: ${prop.enum.join(", ")}`);
         if (constraints.length > 0) {
-          md += `| | | | ${constraints.join("; ")} |
+          md += `| | | | ${_SchemaUtils._escapeMdCell(constraints.join("; "))} |
 `;
         }
       }
@@ -6052,21 +6076,22 @@ var SchemaUtils = class _SchemaUtils {
    */
   static toHTML(schema, options = {}) {
     const { title = "Schema Documentation" } = options;
+    const safeTitle = _SchemaUtils._escapeHtml(title);
     let html = `<!DOCTYPE html>
 <html>
-<head><meta charset="utf-8"><title>${title}</title></head>
+<head><meta charset="utf-8"><title>${safeTitle}</title></head>
 <body>
-<h1>${title}</h1>
+<h1>${safeTitle}</h1>
 `;
     if (schema.properties) {
       html += '<table border="1" cellpadding="4">\n';
       html += "<tr><th>Field</th><th>Type</th><th>Required</th><th>Description</th></tr>\n";
       for (const [key, prop] of Object.entries(schema.properties)) {
         const required = schema.required?.includes(key) ? "\u2705" : "\u274C";
-        const type = prop.type ?? "any";
+        const type = _SchemaUtils._escapeHtml(prop.type ?? "any");
         const p = prop;
-        const label = p["_label"] ?? key;
-        html += `<tr><td>${key}</td><td>${type}</td><td>${required}</td><td>${label}</td></tr>
+        const label = _SchemaUtils._escapeHtml(p["_label"] ?? key);
+        html += `<tr><td>${_SchemaUtils._escapeHtml(key)}</td><td>${type}</td><td>${required}</td><td>${label}</td></tr>
 `;
       }
       html += "</table>\n";
@@ -6075,6 +6100,12 @@ var SchemaUtils = class _SchemaUtils {
     return html;
   }
   // ==================== Private Utilities ====================
+  static _escapeMdCell(str) {
+    return str.replace(/\|/g, "\\|").replace(/\r\n|\r|\n/g, "<br>");
+  }
+  static _escapeHtml(str) {
+    return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
+  }
   static _mergeProperties(base, ext) {
     const result = { ...base };
     for (const [key, extVal] of Object.entries(ext)) {
@@ -6429,10 +6460,25 @@ function _getDefaultValidator() {
 function resetDefaultValidator() {
   _defaultValidator = null;
 }
+var _INITIAL_PATTERN_KEYS = {
+  phone: new Set(Object.keys(PATTERNS.phone)),
+  idCard: new Set(Object.keys(PATTERNS.idCard)),
+  creditCard: new Set(Object.keys(PATTERNS.creditCard))
+};
 function resetRuntimeState() {
   resetDefaultValidator();
   DslBuilder.clearCustomTypes();
   Locale.reset();
+  TypeRegistry.setStrict(false);
+  for (const key of Object.keys(PATTERNS.phone)) {
+    if (!_INITIAL_PATTERN_KEYS.phone.has(key)) delete PATTERNS.phone[key];
+  }
+  for (const key of Object.keys(PATTERNS.idCard)) {
+    if (!_INITIAL_PATTERN_KEYS.idCard.has(key)) delete PATTERNS.idCard[key];
+  }
+  for (const key of Object.keys(PATTERNS.creditCard)) {
+    if (!_INITIAL_PATTERN_KEYS.creditCard.has(key)) delete PATTERNS.creditCard[key];
+  }
 }
 function validate(schema, data, options = {}) {
   const normalizedSchema = _normalizeSchemaInput(schema);

package/dist/plugins/custom-format.cjs

@@ -845,7 +845,16 @@ var init_CacheManager = __esm({
         };
       }
       set options(opts) {
-        if (opts.maxSize !== void 0) this._maxSize = opts.maxSize;
+        if (opts.maxSize !== void 0 && opts.maxSize !== this._maxSize) {
+          this._maxSize = opts.maxSize;
+          const oldKeys = this._cache.keys();
+          const newCache = new import_cache_hub.MemoryCache({ maxEntries: this._maxSize });
+          for (const key of oldKeys) {
+            const val = this._cache.get(key);
+            if (val !== void 0) newCache.set(key, val);
+          }
+          this._cache = newCache;
+        }
         if (opts.ttl !== void 0) this._ttl = opts.ttl;
         if (opts.enabled !== void 0) this._enabled = opts.enabled;
         if (opts.statsEnabled !== void 0) this._statsEnabled = opts.statsEnabled;
@@ -3146,6 +3155,7 @@ module.exports = __toCommonJS(custom_format_exports);
 init_DslParser();
 init_TypeRegistry();
 init_patterns();
+var import_safe_regex2 = __toESM(require("safe-regex"), 1);
 var PASSWORD_PATTERNS = {
   weak: /.{6,}/,
   medium: /^(?=.*[a-zA-Z])(?=.*\d).{8,}$/,
@@ -3304,7 +3314,15 @@ var DslBuilder = class _DslBuilder {
    * Add regex validation.
    */
   pattern(regex, message) {
-    this._baseSchema.pattern = regex instanceof RegExp ? regex.source : regex;
+    const source = regex instanceof RegExp ? regex.source : regex;
+    if (!(0, import_safe_regex2.default)(source)) {
+      throw new Error(`[schema-dsl] Unsafe regex pattern rejected (potential ReDoS): ${source}`);
+    }
+    return this._setPattern(source, message);
+  }
+  /** Internal: set pattern without safe-regex check (used by built-in validators with pre-approved patterns). */
+  _setPattern(source, message) {
+    this._baseSchema.pattern = source;
     if (message) {
       this._customMessages["string.pattern"] = message;
     }
@@ -3466,25 +3484,25 @@ var DslBuilder = class _DslBuilder {
   domain() {
     this._assertStringType("domain");
     const cfg = PATTERNS.common.domain;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String IP address validation (IPv4 or IPv6). */
   ip() {
     this._assertStringType("ip");
     const cfg = PATTERNS.common.ip;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String Base64 encoding validation. */
   base64() {
     this._assertStringType("base64");
     const cfg = PATTERNS.common.base64;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String JWT token validation. */
   jwt() {
     this._assertStringType("jwt");
     const cfg = PATTERNS.common.jwt;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   // ==================== Identity / Pattern Chain Methods ====================
   /** Phone number validation (auto-corrects number → string). */
@@ -3498,7 +3516,7 @@ var DslBuilder = class _DslBuilder {
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country: ${country}`);
     if (cfg.min !== void 0 && !this._baseSchema.minLength) this._baseSchema.minLength = cfg.min;
     if (cfg.max !== void 0 && !this._baseSchema.maxLength) this._baseSchema.maxLength = cfg.max;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** phone() alias (BC). */
   phoneNumber(country = "cn") {
@@ -3511,35 +3529,35 @@ var DslBuilder = class _DslBuilder {
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for idCard: ${country}`);
     if (cfg.min !== void 0 && !this._baseSchema.minLength) this._baseSchema.minLength = cfg.min;
     if (cfg.max !== void 0 && !this._baseSchema.maxLength) this._baseSchema.maxLength = cfg.max;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** URL slug validation. */
   slugChain() {
-    return this.pattern(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).messages({ pattern: "pattern.slug" });
+    return this._setPattern(/^[a-z0-9]+(?:-[a-z0-9]+)*$/.source).messages({ pattern: "pattern.slug" });
   }
   /** Credit card number validation. */
   creditCard(type = "visa") {
     const cfg = PATTERNS.creditCard[type.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported credit card type: ${type}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Vehicle license plate validation. */
   licensePlate(country = "cn") {
     const cfg = PATTERNS.licensePlate[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for licensePlate: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Postal code validation. */
   postalCode(country = "cn") {
     const cfg = PATTERNS.postalCode[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for postalCode: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Passport number validation. */
   passport(country = "cn") {
     const cfg = PATTERNS.passport[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for passport: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /**
    * Username validation.
@@ -3581,7 +3599,7 @@ var DslBuilder = class _DslBuilder {
     } else {
       pat += "[a-zA-Z]*$";
     }
-    return this.pattern(new RegExp(pat)).messages({ pattern: "pattern.username" });
+    return this._setPattern(pat).messages({ pattern: "pattern.username" });
   }
   /**
    * Password strength validation.
@@ -3592,7 +3610,7 @@ var DslBuilder = class _DslBuilder {
     if (!pat) throw new Error(`[schema-dsl] Invalid password strength: ${strength}`);
     if (!this._baseSchema.minLength) this._baseSchema.minLength = PASSWORD_MIN_LENGTHS[strength];
     if (!this._baseSchema.maxLength) this._baseSchema.maxLength = 64;
-    return this.pattern(pat).messages({ pattern: `pattern.password.${strength}` });
+    return this._setPattern(pat.source).messages({ pattern: `pattern.password.${strength}` });
   }
   // ==================== Number Chain Methods ====================
   /** Number decimal places limit. */
@@ -3780,10 +3798,8 @@ var customFormatPlugin = {
     const ajv = getAjvLike(core);
     const dslBuilder = getDslBuilderLike(core);
     this.addCustomFormats(ajv, dslBuilder);
-    console.log("[Plugin] custom-format v2.0.0 installed (with DSL type registration)");
   },
   uninstall() {
-    console.log("[Plugin] custom-format uninstalled");
   },
   addCustomFormats(ajv, dslBuilder) {
     for (const [name, config] of Object.entries(FORMATS)) {

package/dist/plugins/custom-format.d.cts

@@ -1,5 +1,5 @@
 import { P as Plugin } from '../plugin-CIKtTMtS.cjs';
-import { D as DslBuilder } from '../DslBuilder-DQDN0ZxZ.cjs';
+import { D as DslBuilder } from '../DslBuilder-CjHTucNQ.cjs';
 
 declare const customFormatPlugin: Plugin & {
     addCustomFormats: (ajv: {

package/dist/plugins/custom-format.d.ts

@@ -1,5 +1,5 @@
 import { P as Plugin } from '../plugin-CIKtTMtS.js';
-import { D as DslBuilder } from '../DslBuilder-DkLaOo9Q.js';
+import { D as DslBuilder } from '../DslBuilder-BIgQOAXp.js';
 
 declare const customFormatPlugin: Plugin & {
     addCustomFormats: (ajv: {

package/dist/plugins/custom-format.js

@@ -823,7 +823,16 @@ var init_CacheManager = __esm({
         };
       }
       set options(opts) {
-        if (opts.maxSize !== void 0) this._maxSize = opts.maxSize;
+        if (opts.maxSize !== void 0 && opts.maxSize !== this._maxSize) {
+          this._maxSize = opts.maxSize;
+          const oldKeys = this._cache.keys();
+          const newCache = new MemoryCache({ maxEntries: this._maxSize });
+          for (const key of oldKeys) {
+            const val = this._cache.get(key);
+            if (val !== void 0) newCache.set(key, val);
+          }
+          this._cache = newCache;
+        }
         if (opts.ttl !== void 0) this._ttl = opts.ttl;
         if (opts.enabled !== void 0) this._enabled = opts.enabled;
         if (opts.statsEnabled !== void 0) this._statsEnabled = opts.statsEnabled;
@@ -3116,6 +3125,7 @@ var init_Validator = __esm({
 init_DslParser();
 init_TypeRegistry();
 init_patterns();
+import safeRegex2 from "safe-regex";
 var PASSWORD_PATTERNS = {
   weak: /.{6,}/,
   medium: /^(?=.*[a-zA-Z])(?=.*\d).{8,}$/,
@@ -3274,7 +3284,15 @@ var DslBuilder = class _DslBuilder {
    * Add regex validation.
    */
   pattern(regex, message) {
-    this._baseSchema.pattern = regex instanceof RegExp ? regex.source : regex;
+    const source = regex instanceof RegExp ? regex.source : regex;
+    if (!safeRegex2(source)) {
+      throw new Error(`[schema-dsl] Unsafe regex pattern rejected (potential ReDoS): ${source}`);
+    }
+    return this._setPattern(source, message);
+  }
+  /** Internal: set pattern without safe-regex check (used by built-in validators with pre-approved patterns). */
+  _setPattern(source, message) {
+    this._baseSchema.pattern = source;
     if (message) {
       this._customMessages["string.pattern"] = message;
     }
@@ -3436,25 +3454,25 @@ var DslBuilder = class _DslBuilder {
   domain() {
     this._assertStringType("domain");
     const cfg = PATTERNS.common.domain;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String IP address validation (IPv4 or IPv6). */
   ip() {
     this._assertStringType("ip");
     const cfg = PATTERNS.common.ip;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String Base64 encoding validation. */
   base64() {
     this._assertStringType("base64");
     const cfg = PATTERNS.common.base64;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** String JWT token validation. */
   jwt() {
     this._assertStringType("jwt");
     const cfg = PATTERNS.common.jwt;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   // ==================== Identity / Pattern Chain Methods ====================
   /** Phone number validation (auto-corrects number → string). */
@@ -3468,7 +3486,7 @@ var DslBuilder = class _DslBuilder {
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country: ${country}`);
     if (cfg.min !== void 0 && !this._baseSchema.minLength) this._baseSchema.minLength = cfg.min;
     if (cfg.max !== void 0 && !this._baseSchema.maxLength) this._baseSchema.maxLength = cfg.max;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** phone() alias (BC). */
   phoneNumber(country = "cn") {
@@ -3481,35 +3499,35 @@ var DslBuilder = class _DslBuilder {
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for idCard: ${country}`);
     if (cfg.min !== void 0 && !this._baseSchema.minLength) this._baseSchema.minLength = cfg.min;
     if (cfg.max !== void 0 && !this._baseSchema.maxLength) this._baseSchema.maxLength = cfg.max;
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** URL slug validation. */
   slugChain() {
-    return this.pattern(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).messages({ pattern: "pattern.slug" });
+    return this._setPattern(/^[a-z0-9]+(?:-[a-z0-9]+)*$/.source).messages({ pattern: "pattern.slug" });
   }
   /** Credit card number validation. */
   creditCard(type = "visa") {
     const cfg = PATTERNS.creditCard[type.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported credit card type: ${type}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Vehicle license plate validation. */
   licensePlate(country = "cn") {
     const cfg = PATTERNS.licensePlate[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for licensePlate: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Postal code validation. */
   postalCode(country = "cn") {
     const cfg = PATTERNS.postalCode[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for postalCode: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /** Passport number validation. */
   passport(country = "cn") {
     const cfg = PATTERNS.passport[country.toLowerCase()];
     if (!cfg) throw new Error(`[schema-dsl] Unsupported country for passport: ${country}`);
-    return this.pattern(cfg.pattern).messages({ pattern: cfg.key });
+    return this._setPattern(cfg.pattern.source).messages({ pattern: cfg.key });
   }
   /**
    * Username validation.
@@ -3551,7 +3569,7 @@ var DslBuilder = class _DslBuilder {
     } else {
       pat += "[a-zA-Z]*$";
     }
-    return this.pattern(new RegExp(pat)).messages({ pattern: "pattern.username" });
+    return this._setPattern(pat).messages({ pattern: "pattern.username" });
   }
   /**
    * Password strength validation.
@@ -3562,7 +3580,7 @@ var DslBuilder = class _DslBuilder {
     if (!pat) throw new Error(`[schema-dsl] Invalid password strength: ${strength}`);
     if (!this._baseSchema.minLength) this._baseSchema.minLength = PASSWORD_MIN_LENGTHS[strength];
     if (!this._baseSchema.maxLength) this._baseSchema.maxLength = 64;
-    return this.pattern(pat).messages({ pattern: `pattern.password.${strength}` });
+    return this._setPattern(pat.source).messages({ pattern: `pattern.password.${strength}` });
   }
   // ==================== Number Chain Methods ====================
   /** Number decimal places limit. */
@@ -3750,10 +3768,8 @@ var customFormatPlugin = {
     const ajv = getAjvLike(core);
     const dslBuilder = getDslBuilderLike(core);
     this.addCustomFormats(ajv, dslBuilder);
-    console.log("[Plugin] custom-format v2.0.0 installed (with DSL type registration)");
   },
   uninstall() {
-    console.log("[Plugin] custom-format uninstalled");
   },
   addCustomFormats(ajv, dslBuilder) {
     for (const [name, config] of Object.entries(FORMATS)) {