feat(schema): implement Phase 12 String Format Schemas

[viniciusdacal]

Summary

• 16 format schemas: email, uuid, url, hostname, ipv4, ipv6, base64, hex, jwt, cuid, ulid, nanoid, iso.date, iso.time, iso.datetime, iso.duration
• FormatSchema base class extracted by code simplifier — shared _parse, _toJSONSchema, and _clone logic. Subclasses only implement _validate(), _errorMessage, and optionally _jsonSchemaExtra()
• Code review fixes: ISO date validation now uses Date constructor for proper calendar validation (rejects Feb 31, non-leap-year Feb 29). IPv4 rejects leading zeros in octets
• 228 tests passing (47 new)

Test plan

• Email: valid/invalid, StringSchema inheritance, JSON Schema format
• UUID: valid v4, invalid, JSON Schema format
• URL: valid http/https, invalid, JSON Schema format "uri"
• Hostname: valid, invalid (leading dash), JSON Schema format
• IPv4: valid (0.0.0.0, 255.255.255.255), out-of-range, leading zeros rejected
• IPv6: full, abbreviated, ::1, invalid
• Base64: valid, length % 4 check, contentEncoding
• Hex: valid, non-hex rejected
• JWT: valid 3-segment, invalid
• CUID: valid c-prefix, invalid
• ULID: valid 26-char Crockford, invalid
• Nanoid: valid 21-char, invalid
• ISO date: valid, month/day range, impossible dates (Feb 31, non-leap Feb 29)
• ISO time: valid, hour/minute/second range
• ISO datetime: valid with timezone, invalid
• ISO duration: valid, bare P rejected
• Email ReDoS: adversarial input completes < 100ms
• Full test suite: 228 tests passing

🤖 Generated with Claude Code

[viniciusdacal]

Code Review — Phase 12: String Format Schemas

Overview

Adds 16 format schema validators with a shared FormatSchema base class. All extend StringSchema and add format-specific validation.

Architecture

• FormatSchema base (format-schema.ts) — excellent extraction. Subclasses only need _validate(), _errorMessage, and optionally _jsonSchemaExtra(). The generic _clone() using this.constructor eliminates boilerplate across all 16 schemas.
• Each format file is 11-17 lines. Clean separation of concerns.

Validation Quality

• Email: RFC 5322 simplified regex, tested for ReDoS — completes adversarial input in < 100ms
• UUID: Case-insensitive, standard format
• URL: Native URL constructor — safe, standards-compliant
• IPv4: Regex with octet range check AND leading zero rejection (fixed during review)
• IPv6: Comprehensive regex covering full, abbreviated, link-local, and mapped-IPv4 forms
• ISO dates: Proper calendar validation using Date constructor (fixed during review — rejects Feb 31, non-leap Feb 29)
• Base64: Regex + length % 4 check
• ID formats (cuid, ulid, nanoid): Correct character sets and lengths

Issues Fixed During Review

1. ISO date accepted impossible dates (Feb 31, Apr 31) — fixed with Date constructor validation
2. IPv4 accepted leading zeros (001.002.003.004) — fixed with stricter regex

No remaining blocking issues.

Verdict: Approve ✅