@ultimat3/schema - npm Package Compare versions

Comparing version 4.0.0 to 4.1.0

package.json

 {
   "name": "@ultimat3/schema",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "description": "Ultimate's validation seam: Standard Schema interface, the t namespace, JSON Schema output",
@@ -5,0 +5,0 @@ "license": "MIT",

src/errors.ts

@@ -7,2 +7,27 @@ // Single responsibility: this package's error codes. `@ultimat3/schema` is tier 0 and may not
 
+/**
+ * The same escape `@ultimat3/core`'s `singleLine` performs. **Keep in sync**, and read the reason
+ * there — briefly: the 3-line format is line-oriented, and a `cause` may hold a value the caller
+ * chose, so a newline in one writes a line an operator reads as a genuine framework message.
+ *
+ * Copied rather than imported for the same reason the brand symbol above is: `schema` and `core`
+ * are both tier 0, so `schema` may not import `core` (imports go DOWN, never sideways). A schema
+ * cause is the one most likely to carry a hostile string — it describes the value that failed
+ * validation, which is the request body.
+ */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: escaping them is the point.
+const CONTROL = /[\u0000-\u001f\u007f\u2028\u2029]/g;
+const ESCAPES: Readonly<Record<string, string>> = {
+  '\n': String.raw`\n`,
+  '\r': String.raw`\r`,
+  '\t': String.raw`\t`,
+  '\b': String.raw`\b`,
+  '\f': String.raw`\f`,
+};
+const singleLine = (text: string): string =>
+  text.replace(
+    CONTROL,
+    (char) => ESCAPES[char] ?? `\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}`,
+  );
+
 /** Same well-known symbol `@ultimat3/core` brands with. Keep in sync, never rename. */
@@ -86,5 +111,7 @@ export const ULTIMATE_ERROR_BRAND: unique symbol = Symbol.for('ultimate.error');
   format(): string {
-    return [`${this.code}: ${this.title}`, `  cause: ${this.cause}`, `  fix:   ${this.fix}`].join(
-      '\n',
-    );
+    return [
+      `${singleLine(this.code)}: ${singleLine(this.title)}`,
+      `  cause: ${singleLine(this.cause)}`,
+      `  fix:   ${singleLine(this.fix)}`,
+    ].join('\n');
   }
@@ -91,0 +118,0 @@

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

105777

1.13%

Lines of code

2038

1.29%

No dependency changes