@exodus/zod 3.24.1-rc.4 → 3.24.1-rc.6

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020 Colin McDonnell
+Copyright (c) 2025 Exodus Movement, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/lib/index.mjs

@@ -49,8 +49,9 @@ var objectUtil;
 (function (objectUtil) {
     objectUtil.mergeShapes = (first, second) => {
         return {
+            __proto__: null,
             ...first,
-            ...second, // second overwrites first
+            ...second,
         };
     };
 })(objectUtil || (objectUtil = {}));
@@ -152,7 +153,6 @@ class ZodError extends Error {
         super();
         const actualProto = new.target.prototype;
         if (Object.setPrototypeOf) {
-            // eslint-disable-next-line ban/ban
             Object.setPrototypeOf(this, actualProto);
         }
         else {
@@ -189,13 +189,6 @@ class ZodError extends Error {
                         const terminal = i === issue.path.length - 1;
                         if (!terminal) {
                             curr[el] = curr[el] || { _errors: [] };
-                            // if (typeof el === "string") {
-                            //   curr[el] = curr[el] || { _errors: [] };
-                            // } else if (typeof el === "number") {
-                            //   const errorArray: any = [];
-                            //   errorArray._errors = [];
-                            //   curr[el] = curr[el] || errorArray;
-                            // }
                         }
                         else {
                             curr[el] = curr[el] || { _errors: [] };
@@ -422,10 +415,10 @@ function addIssueToContext(ctx, issueData) {
         data: ctx.data,
         path: ctx.path,
         errorMaps: [
-            ctx.common.contextualErrorMap, // contextual error map is first priority
-            ctx.schemaErrorMap, // then schema-bound map if available
-            overrideMap, // then global override map
-            overrideMap === errorMap ? undefined : errorMap, // then global default map
+            ctx.common.contextualErrorMap,
+            ctx.schemaErrorMap,
+            overrideMap,
+            overrideMap === errorMap ? undefined : errorMap,
         ].filter((x) => !!x),
     });
     ctx.common.issues.push(issue);
@@ -475,7 +468,7 @@ class ParseStatus {
                 status.dirty();
             if (value.status === "dirty")
                 status.dirty();
-            if (key.value !== "__proto__" &&
+            if (!(key.value in Object.prototype) &&
                 (typeof value.value !== "undefined" || pair.alwaysSet)) {
                 finalObject[key.value] = value.value;
             }
@@ -543,9 +536,10 @@ const handleResult = (ctx, result) => {
         };
     }
 };
+const allowedChecks = new Set(["min", "max", "length", "email", "url", "uuid", "includes", "startsWith", "endsWith", "regex", "trim", "toLowerCase", "toUpperCase", "datetime", "date", "time", "ip", "base64"]);
 function processCreateParams(params) {
     if (!params)
-        return {};
+        return Object.create(null);
     const { errorMap, invalid_type_error, required_error, description } = params;
     if (errorMap && (invalid_type_error || required_error)) {
         throw new Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);
@@ -700,7 +694,6 @@ class ZodType {
             : Promise.resolve(maybeAsyncResult));
         return handleResult(ctx, result);
     }
-    /** Alias of safeParseAsync */
     spa = this.safeParseAsync;
     refine(check, message) {
         const getIssueProperties = (val) => {
@@ -872,52 +865,25 @@ class ZodType {
 const cuidRegex = /^c[^\s-]{8,}$/i;
 const cuid2Regex = /^[0-9a-z]+$/;
 const ulidRegex = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
-// const uuidRegex =
-//   /^([a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[a-f0-9]{4}-[a-f0-9]{12}|00000000-0000-0000-0000-000000000000)$/i;
 const uuidRegex = /^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i;
+const urlRegex = /^(?:[a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]{2,}(?:\:\d{1,5})?$/;
 const nanoidRegex = /^[a-z0-9_-]{21}$/i;
 const jwtRegex = /^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/;
 const durationRegex = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
-// from https://stackoverflow.com/a/46181/1550155
-// old version: too slow, didn't support unicode
-// const emailRegex = /^((([a-z]|\d|[!#\$%&'\*\+\-\/=\?\^_`{\|}~]|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])+(\.([a-z]|\d|[!#\$%&'\*\+\-\/=\?\^_`{\|}~]|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])+)*)|((\x22)((((\x20|\x09)*(\x0d\x0a))?(\x20|\x09)+)?(([\x01-\x08\x0b\x0c\x0e-\x1f\x7f]|\x21|[\x23-\x5b]|[\x5d-\x7e]|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(\\([\x01-\x09\x0b\x0c\x0d-\x7f]|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]))))*(((\x20|\x09)*(\x0d\x0a))?(\x20|\x09)+)?(\x22)))@((([a-z]|\d|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(([a-z]|\d|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])*([a-z]|\d|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])))\.)+(([a-z]|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])|(([a-z]|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])([a-z]|\d|-|\.|_|~|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])*([a-z]|[\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF])))$/i;
-//old email regex
-// const emailRegex = /^(([^<>()[\].,;:\s@"]+(\.[^<>()[\].,;:\s@"]+)*)|(".+"))@((?!-)([^<>()[\].,;:\s@"]+\.)+[^<>()[\].,;:\s@"]{1,})[^-<>()[\].,;:\s@"]$/i;
-// eslint-disable-next-line
-// const emailRegex =
-//   /^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[(((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2}))\.){3}((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2}))\])|(\[IPv6:(([a-f0-9]{1,4}:){7}|::([a-f0-9]{1,4}:){0,6}|([a-f0-9]{1,4}:){1}:([a-f0-9]{1,4}:){0,5}|([a-f0-9]{1,4}:){2}:([a-f0-9]{1,4}:){0,4}|([a-f0-9]{1,4}:){3}:([a-f0-9]{1,4}:){0,3}|([a-f0-9]{1,4}:){4}:([a-f0-9]{1,4}:){0,2}|([a-f0-9]{1,4}:){5}:([a-f0-9]{1,4}:){0,1})([a-f0-9]{1,4}|(((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2}))\.){3}((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2})))\])|([A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])*(\.[A-Za-z]{2,})+))$/;
-// const emailRegex =
-//   /^[a-zA-Z0-9\.\!\#\$\%\&\'\*\+\/\=\?\^\_\`\{\|\}\~\-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
-// const emailRegex =
-//   /^(?:[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-z0-9-]*[a-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])$/i;
 const emailRegex = /^(?!\.)(?!.*\.\.)([A-Z0-9_'+\-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i;
-// const emailRegex =
-//   /^[a-z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-z0-9-]+(?:\.[a-z0-9\-]+)*$/i;
-// from https://thekevinscott.com/emojis-in-javascript/#writing-a-regular-expression
 const _emojiRegex = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`;
 let emojiRegex;
-// faster, simpler, safer
 const ipv4Regex = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 const ipv4CidrRegex = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/(3[0-2]|[12]?[0-9])$/;
-// const ipv6Regex =
-// /^(([a-f0-9]{1,4}:){7}|::([a-f0-9]{1,4}:){0,6}|([a-f0-9]{1,4}:){1}:([a-f0-9]{1,4}:){0,5}|([a-f0-9]{1,4}:){2}:([a-f0-9]{1,4}:){0,4}|([a-f0-9]{1,4}:){3}:([a-f0-9]{1,4}:){0,3}|([a-f0-9]{1,4}:){4}:([a-f0-9]{1,4}:){0,2}|([a-f0-9]{1,4}:){5}:([a-f0-9]{1,4}:){0,1})([a-f0-9]{1,4}|(((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2}))\.){3}((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2})))$/;
 const ipv6Regex = /^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/;
 const ipv6CidrRegex = /^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
-// https://stackoverflow.com/questions/7860392/determine-if-string-is-in-base64-using-javascript
 const base64Regex = /^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/;
-// https://base64.guru/standards/base64url
 const base64urlRegex = /^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/;
-// simple
-// const dateRegexSource = `\\d{4}-\\d{2}-\\d{2}`;
-// no leap year validation
-// const dateRegexSource = `\\d{4}-((0[13578]|10|12)-31|(0[13-9]|1[0-2])-30|(0[1-9]|1[0-2])-(0[1-9]|1\\d|2\\d))`;
-// with leap year validation
 const dateRegexSource = `((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))`;
 const dateRegex = new RegExp(`^${dateRegexSource}$`);
 function timeRegexSource(args) {
-    // let regex = `\\d{2}:\\d{2}:\\d{2}`;
     let regex = `([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d`;
-    if (args.precision) {
+    if (args.precision && typeof args.precision === "number") {
         regex = `${regex}\\.\\d{${args.precision}}`;
     }
     else if (args.precision == null) {
@@ -928,7 +894,6 @@ function timeRegexSource(args) {
 function timeRegex(args) {
     return new RegExp(`^${timeRegexSource(args)}$`);
 }
-// Adapted from https://stackoverflow.com/a/3143231
 function datetimeRegex(args) {
     let regex = `${dateRegexSource}T${timeRegexSource(args)}`;
     const opts = [];
@@ -952,7 +917,6 @@ function isValidJWT(jwt, alg) {
         return false;
     try {
         const [header] = jwt.split(".");
-        // Convert base64url to base64
         const base64 = header
             .replace(/-/g, "+")
             .replace(/_/g, "/")
@@ -1135,7 +1099,10 @@ class ZodString extends ZodType {
             }
             else if (check.kind === "url") {
                 try {
-                    new URL(input.data);
+                    const parsed = new URL(input.data);
+                    if (!urlRegex.test(parsed.host)) {
+                        throw new Error();
+                    }
                 }
                 catch {
                     ctx = this._getOrReturnCtx(input, ctx);
@@ -1149,8 +1116,7 @@ class ZodString extends ZodType {
             }
             else if (check.kind === "regex") {
                 check.regex.lastIndex = 0;
-                const testResult = check.regex.test(input.data);
-                if (!testResult) {
+                if (!(check.regex instanceof RegExp) || !check.regex.test(input.data)) {
                     ctx = this._getOrReturnCtx(input, ctx);
                     addIssueToContext(ctx, {
                         validation: "regex",
@@ -1204,7 +1170,9 @@ class ZodString extends ZodType {
             }
             else if (check.kind === "datetime") {
                 const regex = datetimeRegex(check);
-                if (!regex.test(input.data)) {
+                const isoDatetime = new Date(input.data);
+                const valid = isoDatetime.toISOString() === input.data;
+                if (!valid || !regex.test(input.data)) {
                     ctx = this._getOrReturnCtx(input, ctx);
                     addIssueToContext(ctx, {
                         code: ZodIssueCode.invalid_string,
@@ -1216,7 +1184,10 @@ class ZodString extends ZodType {
             }
             else if (check.kind === "date") {
                 const regex = dateRegex;
-                if (!regex.test(input.data)) {
+                const date = new Date(input.data);
+                const isoDateOnly = date.toISOString().split('T')[0];
+                const valid = isoDateOnly === input.data;
+                if (!valid || !regex.test(input.data)) {
                     ctx = this._getOrReturnCtx(input, ctx);
                     addIssueToContext(ctx, {
                         code: ZodIssueCode.invalid_string,
@@ -1318,6 +1289,9 @@ class ZodString extends ZodType {
         });
     }
     _addCheck(check) {
+        if (!allowedChecks.has(check.kind)) {
+            throw new Error(`Check type "${check.kind}" is disabled. Reach out to AppSec if you need it.`);
+        }
         return new ZodString({
             ...this._def,
             checks: [...this._def.checks, check],
@@ -1351,7 +1325,6 @@ class ZodString extends ZodType {
         return this._addCheck({ kind: "base64", ...errorUtil.errToObj(message) });
     }
     base64url(message) {
-        // base64url encoding is a modification of base64 that can safely be used in URLs and filenames
         return this._addCheck({
             kind: "base64url",
             ...errorUtil.errToObj(message),
@@ -1454,9 +1427,6 @@ class ZodString extends ZodType {
             ...errorUtil.errToObj(message),
         });
     }
-    /**
-     * Equivalent to `.min(1)`
-     */
     nonempty(message) {
         return this.min(1, errorUtil.errToObj(message));
     }
@@ -1487,46 +1457,21 @@ class ZodString extends ZodType {
     get isTime() {
         return !!this._def.checks.find((ch) => ch.kind === "time");
     }
-    get isDuration() {
-        return !!this._def.checks.find((ch) => ch.kind === "duration");
-    }
     get isEmail() {
         return !!this._def.checks.find((ch) => ch.kind === "email");
     }
     get isURL() {
         return !!this._def.checks.find((ch) => ch.kind === "url");
     }
-    get isEmoji() {
-        return !!this._def.checks.find((ch) => ch.kind === "emoji");
-    }
     get isUUID() {
         return !!this._def.checks.find((ch) => ch.kind === "uuid");
     }
-    get isNANOID() {
-        return !!this._def.checks.find((ch) => ch.kind === "nanoid");
-    }
-    get isCUID() {
-        return !!this._def.checks.find((ch) => ch.kind === "cuid");
-    }
-    get isCUID2() {
-        return !!this._def.checks.find((ch) => ch.kind === "cuid2");
-    }
-    get isULID() {
-        return !!this._def.checks.find((ch) => ch.kind === "ulid");
-    }
     get isIP() {
         return !!this._def.checks.find((ch) => ch.kind === "ip");
     }
-    get isCIDR() {
-        return !!this._def.checks.find((ch) => ch.kind === "cidr");
-    }
     get isBase64() {
         return !!this._def.checks.find((ch) => ch.kind === "base64");
     }
-    get isBase64url() {
-        // base64url encoding is a modification of base64 that can safely be used in URLs and filenames
-        return !!this._def.checks.find((ch) => ch.kind === "base64url");
-    }
     get minLength() {
         let min = null;
         for (const ch of this._def.checks) {
@@ -1556,7 +1501,6 @@ class ZodString extends ZodType {
         });
     };
 }
-// https://stackoverflow.com/questions/3966484/why-does-modulus-operator-return-fractional-number-in-javascript/31711034#31711034
 function floatSafeRemainder(val, step) {
     const valDecCount = (val.toString().split(".")[1] || "").length;
     const stepDecCount = (step.toString().split(".")[1] || "").length;
@@ -2185,7 +2129,6 @@ class ZodNull extends ZodType {
     };
 }
 class ZodAny extends ZodType {
-    // to prevent instances of other classes from extending ZodAny. this causes issues with catchall in ZodObject.
     _any = true;
     _parse(input) {
         return OK(input.data);
@@ -2198,7 +2141,6 @@ class ZodAny extends ZodType {
     };
 }
 class ZodUnknown extends ZodType {
-    // required
     _unknown = true;
     _parse(input) {
         return OK(input.data);
@@ -2446,14 +2388,12 @@ class ZodObject extends ZodType {
             }
         }
         else {
-            // run catchall validation
             const catchall = this._def.catchall;
             for (const key of extraKeys) {
                 const value = ctx.data[key];
                 pairs.push({
                     key: { status: "valid", value: key },
-                    value: catchall._parse(new ParseInputLazyPath(ctx, value, ctx.path, key) //, ctx.child(key), value, getParsedType(value)
-                    ),
+                    value: catchall._parse(new ParseInputLazyPath(ctx, value, ctx.path, key)),
                     alwaysSet: key in ctx.data,
                 });
             }
@@ -2502,7 +2442,7 @@ class ZodObject extends ZodType {
                         };
                     },
                 }
-                : {}),
+                : Object.create(null)),
         });
     }
     strip() {
@@ -2517,28 +2457,7 @@ class ZodObject extends ZodType {
             unknownKeys: "passthrough",
         });
     }
-    /**
-     * @deprecated In most cases, this is no longer needed - unknown properties are now silently stripped.
-     * If you want to pass through unknown properties, use `.passthrough()` instead.
-     */
     nonstrict = this.passthrough;
-    // const AugmentFactory =
-    //   <Def extends ZodObjectDef>(def: Def) =>
-    //   <Augmentation extends ZodRawShape>(
-    //     augmentation: Augmentation
-    //   ): ZodObject<
-    //     extendShape<ReturnType<Def["shape"]>, Augmentation>,
-    //     Def["unknownKeys"],
-    //     Def["catchall"]
-    //   > => {
-    //     return new ZodObject({
-    //       ...def,
-    //       shape: () => ({
-    //         ...def.shape(),
-    //         ...augmentation,
-    //       }),
-    //     }) as any;
-    //   };
     extend(augmentation) {
         return new ZodObject({
             ...this._def,
@@ -2548,48 +2467,7 @@ class ZodObject extends ZodType {
             }),
         });
     }
-    // extend<
-    //   Augmentation extends ZodRawShape,
-    //   NewOutput extends util.flatten<{
-    //     [k in keyof Augmentation | keyof Output]: k extends keyof Augmentation
-    //       ? Augmentation[k]["_output"]
-    //       : k extends keyof Output
-    //       ? Output[k]
-    //       : never;
-    //   }>,
-    //   NewInput extends util.flatten<{
-    //     [k in keyof Augmentation | keyof Input]: k extends keyof Augmentation
-    //       ? Augmentation[k]["_input"]
-    //       : k extends keyof Input
-    //       ? Input[k]
-    //       : never;
-    //   }>
-    // >(
-    //   augmentation: Augmentation
-    // ): ZodObject<
-    //   extendShape<T, Augmentation>,
-    //   UnknownKeys,
-    //   Catchall,
-    //   NewOutput,
-    //   NewInput
-    // > {
-    //   return new ZodObject({
-    //     ...this._def,
-    //     shape: () => ({
-    //       ...this._def.shape(),
-    //       ...augmentation,
-    //     }),
-    //   }) as any;
-    // }
-    /**
-     * @deprecated Use `.extend` instead
-     *  */
     augment = this.extend;
-    /**
-     * Prior to zod@1.0.12 there was a bug in the
-     * inferred type of merged objects. Please
-     * upgrade if you are experiencing issues.
-     */
     merge(merging) {
         const merged = new ZodObject({
             unknownKeys: merging._def.unknownKeys,
@@ -2602,65 +2480,9 @@ class ZodObject extends ZodType {
         });
         return merged;
     }
-    // merge<
-    //   Incoming extends AnyZodObject,
-    //   Augmentation extends Incoming["shape"],
-    //   NewOutput extends {
-    //     [k in keyof Augmentation | keyof Output]: k extends keyof Augmentation
-    //       ? Augmentation[k]["_output"]
-    //       : k extends keyof Output
-    //       ? Output[k]
-    //       : never;
-    //   },
-    //   NewInput extends {
-    //     [k in keyof Augmentation | keyof Input]: k extends keyof Augmentation
-    //       ? Augmentation[k]["_input"]
-    //       : k extends keyof Input
-    //       ? Input[k]
-    //       : never;
-    //   }
-    // >(
-    //   merging: Incoming
-    // ): ZodObject<
-    //   extendShape<T, ReturnType<Incoming["_def"]["shape"]>>,
-    //   Incoming["_def"]["unknownKeys"],
-    //   Incoming["_def"]["catchall"],
-    //   NewOutput,
-    //   NewInput
-    // > {
-    //   const merged: any = new ZodObject({
-    //     unknownKeys: merging._def.unknownKeys,
-    //     catchall: merging._def.catchall,
-    //     shape: () =>
-    //       objectUtil.mergeShapes(this._def.shape(), merging._def.shape()),
-    //     typeName: ZodFirstPartyTypeKind.ZodObject,
-    //   }) as any;
-    //   return merged;
-    // }
     setKey(key, schema) {
-        return this.augment({ [key]: schema });
-    }
-    // merge<Incoming extends AnyZodObject>(
-    //   merging: Incoming
-    // ): //ZodObject<T & Incoming["_shape"], UnknownKeys, Catchall> = (merging) => {
-    // ZodObject<
-    //   extendShape<T, ReturnType<Incoming["_def"]["shape"]>>,
-    //   Incoming["_def"]["unknownKeys"],
-    //   Incoming["_def"]["catchall"]
-    // > {
-    //   // const mergedShape = objectUtil.mergeShapes(
-    //   //   this._def.shape(),
-    //   //   merging._def.shape()
-    //   // );
-    //   const merged: any = new ZodObject({
-    //     unknownKeys: merging._def.unknownKeys,
-    //     catchall: merging._def.catchall,
-    //     shape: () =>
-    //       objectUtil.mergeShapes(this._def.shape(), merging._def.shape()),
-    //     typeName: ZodFirstPartyTypeKind.ZodObject,
-    //   }) as any;
-    //   return merged;
-    // }
+        return this.augment(Object.assign(Object.create(null), { [key]: schema }));
+    }
     catchall(index) {
         return new ZodObject({
             ...this._def,
@@ -2691,9 +2513,6 @@ class ZodObject extends ZodType {
             shape: () => shape,
         });
     }
-    /**
-     * @deprecated
-     */
     deepPartial() {
         return deepPartialify(this);
     }
@@ -2769,7 +2588,6 @@ class ZodUnion extends ZodType {
         const { ctx } = this._processInputParams(input);
         const options = this._def.options;
         function handleResults(results) {
-            // return first issue-free validation if it exists
             for (const result of results) {
                 if (result.result.status === "valid") {
                     return result.result;
@@ -2777,12 +2595,10 @@ class ZodUnion extends ZodType {
             }
             for (const result of results) {
                 if (result.result.status === "dirty") {
-                    // add issues from dirty option
                     ctx.common.issues.push(...result.ctx.common.issues);
                     return result.result;
                 }
             }
-            // return invalid
             const unionErrors = results.map((result) => new ZodError(result.ctx.common.issues));
             addIssueToContext(ctx, {
                 code: ZodIssueCode.invalid_union,
@@ -2860,13 +2676,6 @@ class ZodUnion extends ZodType {
         });
     };
 }
-/////////////////////////////////////////////////////
-/////////////////////////////////////////////////////
-//////////                                 //////////
-//////////      ZodDiscriminatedUnion      //////////
-//////////                                 //////////
-/////////////////////////////////////////////////////
-/////////////////////////////////////////////////////
 const getDiscriminator = (type) => {
     if (type instanceof ZodLazy) {
         return getDiscriminator(type.schema);
@@ -2881,7 +2690,6 @@ const getDiscriminator = (type) => {
         return type.options;
     }
     else if (type instanceof ZodNativeEnum) {
-        // eslint-disable-next-line ban/ban
         return util.objectValues(type.enum);
     }
     else if (type instanceof ZodDefault) {
@@ -2958,18 +2766,8 @@ class ZodDiscriminatedUnion extends ZodType {
     get optionsMap() {
         return this._def.optionsMap;
     }
-    /**
-     * The constructor of the discriminated union schema. Its behaviour is very similar to that of the normal z.union() constructor.
-     * However, it only allows a union of objects, all of which need to share a discriminator property. This property must
-     * have a different value for each object in the union.
-     * @param discriminator the name of the discriminator property
-     * @param types an array of object schemas
-     * @param params
-     */
     static create(discriminator, options, params) {
-        // Get all the valid discriminator values
         const optionsMap = new Map();
-        // try {
         for (const type of options) {
             const discriminatorValues = getDiscriminator(type.shape[discriminator]);
             if (!discriminatorValues.length) {
@@ -3002,7 +2800,7 @@ function mergeValues(a, b) {
         const sharedKeys = util
             .objectKeys(a)
             .filter((key) => bKeys.indexOf(key) !== -1);
-        const newObj = { ...a, ...b };
+        const newObj = { __proto__: null, ...a, ...b };
         for (const key of sharedKeys) {
             const sharedValue = mergeValues(a[key], b[key]);
             if (!sharedValue.valid) {
@@ -3130,7 +2928,7 @@ class ZodTuple extends ZodType {
                 return null;
             return schema._parse(new ParseInputLazyPath(ctx, item, ctx.path, itemIndex));
         })
-            .filter((x) => !!x); // filter nulls
+            .filter((x) => !!x);
         if (ctx.common.async) {
             return Promise.all(items).then((results) => {
                 return ParseStatus.mergeArray(status, results);
@@ -3414,9 +3212,6 @@ class ZodFunction extends ZodType {
         const params = { errorMap: ctx.common.contextualErrorMap };
         const fn = ctx.data;
         if (this._def.returns instanceof ZodPromise) {
-            // Would love a way to avoid disabling this rule, but we need
-            // an alias (using an arrow function was what caused 2651).
-            // eslint-disable-next-line @typescript-eslint/no-this-alias
             const me = this;
             return OK(async function (...args) {
                 const error = new ZodError([]);
@@ -3437,9 +3232,6 @@ class ZodFunction extends ZodType {
             });
         }
         else {
-            // Would love a way to avoid disabling this rule, but we need
-            // an alias (using an arrow function was what caused 2651).
-            // eslint-disable-next-line @typescript-eslint/no-this-alias
             const me = this;
             return OK(function (...args) {
                 const parsedArgs = me._def.args.safeParse(args, params);
@@ -3765,7 +3557,6 @@ class ZodEffects extends ZodType {
                     return INVALID;
                 if (inner.status === "dirty")
                     status.dirty();
-                // return value is ignored
                 executeRefinement(inner.value);
                 return { status: status.value, value: inner.value };
             }
@@ -3895,7 +3686,6 @@ class ZodDefault extends ZodType {
 class ZodCatch extends ZodType {
     _parse(input) {
         const { ctx } = this._processInputParams(input);
-        // newCtx is used to not collect issues from inner types in ctx
         const newCtx = {
             ...ctx,
             common: {
@@ -4069,18 +3859,7 @@ class ZodReadonly extends ZodType {
         return this._def.innerType;
     }
 }
-function custom(check, params = Object.create(null), 
-/**
- * @deprecated
- *
- * Pass `fatal` into the params object instead:
- *
- * ```ts
- * z.string().custom((val) => val.length > 5, { fatal: false })
- * ```
- *
- */
-fatal) {
+function custom(check, params = Object.create(null), fatal) {
     if (check)
         return ZodAny.create().superRefine((data, ctx) => {
             if (!check(data)) {
@@ -4138,9 +3917,7 @@ var ZodFirstPartyTypeKind;
     ZodFirstPartyTypeKind["ZodPipeline"] = "ZodPipeline";
     ZodFirstPartyTypeKind["ZodReadonly"] = "ZodReadonly";
 })(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
-const instanceOfType = (
-// const instanceOfType = <T extends new (...args: any[]) => any>(
-cls, params = {
+const instanceOfType = (cls, params = {
     message: `Input not instance of ${cls.name}`,
 }) => custom((data) => data instanceof cls, params);
 const stringType = ZodString.create;

package/lib/standard-schema.d.ts

@@ -1,102 +1,33 @@
-/**
- * The Standard Schema interface.
- */
 export type StandardSchemaV1<Input = unknown, Output = Input> = {
-    /**
-     * The Standard Schema properties.
-     */
     readonly "~standard": StandardSchemaV1.Props<Input, Output>;
 };
 export declare namespace StandardSchemaV1 {
-    /**
-     * The Standard Schema properties interface.
-     */
     export interface Props<Input = unknown, Output = Input> {
-        /**
-         * The version number of the standard.
-         */
         readonly version: 1;
-        /**
-         * The vendor name of the schema library.
-         */
         readonly vendor: string;
-        /**
-         * Validates unknown input values.
-         */
         readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
-        /**
-         * Inferred types associated with the schema.
-         */
         readonly types?: Types<Input, Output> | undefined;
     }
-    /**
-     * The result interface of the validate function.
-     */
     export type Result<Output> = SuccessResult<Output> | FailureResult;
-    /**
-     * The result interface if validation succeeds.
-     */
     export interface SuccessResult<Output> {
-        /**
-         * The typed output value.
-         */
         readonly value: Output;
-        /**
-         * The non-existent issues.
-         */
         readonly issues?: undefined;
     }
-    /**
-     * The result interface if validation fails.
-     */
     export interface FailureResult {
-        /**
-         * The issues of failed validation.
-         */
         readonly issues: ReadonlyArray<Issue>;
     }
-    /**
-     * The issue interface of the failure output.
-     */
     export interface Issue {
-        /**
-         * The error message of the issue.
-         */
         readonly message: string;
-        /**
-         * The path of the issue, if any.
-         */
         readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
     }
-    /**
-     * The path segment interface of the issue.
-     */
     export interface PathSegment {
-        /**
-         * The key representing a path segment.
-         */
         readonly key: PropertyKey;
     }
-    /**
-     * The Standard Schema types interface.
-     */
     export interface Types<Input = unknown, Output = Input> {
-        /**
-         * The input type of the schema.
-         */
         readonly input: Input;
-        /**
-         * The output type of the schema.
-         */
         readonly output: Output;
     }
-    /**
-     * Infers the input type of a Standard Schema.
-     */
     export type InferInput<Schema extends StandardSchemaV1> = NonNullable<Schema["~standard"]["types"]>["input"];
-    /**
-     * Infers the output type of a Standard Schema.
-     */
     export type InferOutput<Schema extends StandardSchemaV1> = NonNullable<Schema["~standard"]["types"]>["output"];
     export {};
 }

package/lib/types.d.ts

@@ -66,7 +66,6 @@ export declare abstract class ZodType<Output = any, Def extends ZodTypeDef = Zod
     "~validate"(data: unknown): StandardSchemaV1.Result<Output> | Promise<StandardSchemaV1.Result<Output>>;
     parseAsync(data: unknown, params?: Partial<ParseParams>): Promise<Output>;
     safeParseAsync(data: unknown, params?: Partial<ParseParams>): Promise<SafeParseReturnType<Input, Output>>;
-    /** Alias of safeParseAsync */
     spa: (data: unknown, params?: Partial<ParseParams>) => Promise<SafeParseReturnType<Input, Output>>;
     refine<RefinedOutput extends Output>(check: (arg: Output) => arg is RefinedOutput, message?: string | CustomErrorParams | ((arg: Output) => CustomErrorParams)): ZodEffects<this, RefinedOutput, Input>;
     refine(check: (arg: Output) => unknown | Promise<unknown>, message?: string | CustomErrorParams | ((arg: Output) => CustomErrorParams)): ZodEffects<this, Output, Input>;
@@ -255,9 +254,6 @@ export declare class ZodString extends ZodType<string, ZodStringDef, string> {
     min(minLength: number, message?: errorUtil.ErrMessage): ZodString;
     max(maxLength: number, message?: errorUtil.ErrMessage): ZodString;
     length(len: number, message?: errorUtil.ErrMessage): ZodString;
-    /**
-     * Equivalent to `.min(1)`
-     */
     nonempty(message?: errorUtil.ErrMessage): ZodString;
     trim(): ZodString;
     toLowerCase(): ZodString;
@@ -265,19 +261,11 @@ export declare class ZodString extends ZodType<string, ZodStringDef, string> {
     get isDatetime(): boolean;
     get isDate(): boolean;
     get isTime(): boolean;
-    get isDuration(): boolean;
     get isEmail(): boolean;
     get isURL(): boolean;
-    get isEmoji(): boolean;
     get isUUID(): boolean;
-    get isNANOID(): boolean;
-    get isCUID(): boolean;
-    get isCUID2(): boolean;
-    get isULID(): boolean;
     get isIP(): boolean;
-    get isCIDR(): boolean;
     get isBase64(): boolean;
-    get isBase64url(): boolean;
     get minLength(): number | null;
     get maxLength(): number | null;
     static create: (params?: RawCreateParams & {
@@ -537,21 +525,9 @@ export declare class ZodObject<T extends ZodRawShape, UnknownKeys extends Unknow
     strict(message?: errorUtil.ErrMessage): ZodObject<T, "strict", Catchall>;
     strip(): ZodObject<T, "strip", Catchall>;
     passthrough(): ZodObject<T, "passthrough", Catchall>;
-    /**
-     * @deprecated In most cases, this is no longer needed - unknown properties are now silently stripped.
-     * If you want to pass through unknown properties, use `.passthrough()` instead.
-     */
     nonstrict: () => ZodObject<T, "passthrough", Catchall>;
     extend<Augmentation extends ZodRawShape>(augmentation: Augmentation): ZodObject<objectUtil.extendShape<T, Augmentation>, UnknownKeys, Catchall>;
-    /**
-     * @deprecated Use `.extend` instead
-     *  */
     augment: <Augmentation extends ZodRawShape>(augmentation: Augmentation) => ZodObject<objectUtil.extendShape<T, Augmentation>, UnknownKeys, Catchall>;
-    /**
-     * Prior to zod@1.0.12 there was a bug in the
-     * inferred type of merged objects. Please
-     * upgrade if you are experiencing issues.
-     */
     merge<Incoming extends AnyZodObject, Augmentation extends Incoming["shape"]>(merging: Incoming): ZodObject<objectUtil.extendShape<T, Augmentation>, Incoming["_def"]["unknownKeys"], Incoming["_def"]["catchall"]>;
     setKey<Key extends string, Schema extends ZodTypeAny>(key: Key, schema: Schema): ZodObject<T & {
         [k in Key]: Schema;
@@ -563,9 +539,6 @@ export declare class ZodObject<T extends ZodRawShape, UnknownKeys extends Unknow
     omit<Mask extends util.Exactly<{
         [k in keyof T]?: true;
     }, Mask>>(mask: Mask): ZodObject<Omit<T, keyof Mask>, UnknownKeys, Catchall>;
-    /**
-     * @deprecated
-     */
     deepPartial(): partialUtil.DeepPartial<this>;
     partial(): ZodObject<{
         [k in keyof T]: ZodOptional<T[k]>;
@@ -617,14 +590,6 @@ export declare class ZodDiscriminatedUnion<Discriminator extends string, Options
     get discriminator(): Discriminator;
     get options(): Options;
     get optionsMap(): Map<Primitive, ZodDiscriminatedUnionOption<any>>;
-    /**
-     * The constructor of the discriminated union schema. Its behaviour is very similar to that of the normal z.union() constructor.
-     * However, it only allows a union of objects, all of which need to share a discriminator property. This property must
-     * have a different value for each object in the union.
-     * @param discriminator the name of the discriminator property
-     * @param types an array of object schemas
-     * @param params
-     */
     static create<Discriminator extends string, Types extends readonly [
         ZodDiscriminatedUnionOption<Discriminator>,
         ...ZodDiscriminatedUnionOption<Discriminator>[]
@@ -935,18 +900,7 @@ export declare class ZodReadonly<T extends ZodTypeAny> extends ZodType<MakeReado
 type CustomParams = CustomErrorParams & {
     fatal?: boolean;
 };
-export declare function custom<T>(check?: (data: any) => any, params?: string | CustomParams | ((input: any) => CustomParams), 
-/**
- * @deprecated
- *
- * Pass `fatal` into the params object instead:
- *
- * ```ts
- * z.string().custom((val) => val.length > 5, { fatal: false })
- * ```
- *
- */
-fatal?: boolean): ZodType<T, ZodTypeDef, T>;
+export declare function custom<T>(check?: (data: any) => any, params?: string | CustomParams | ((input: any) => CustomParams), fatal?: boolean): ZodType<T, ZodTypeDef, T>;
 export { ZodType as Schema, ZodType as ZodSchema };
 export declare const late: {
     object: <T extends ZodRawShape>(shape: () => T, params?: RawCreateParams) => ZodObject<T, "strip">;

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@exodus/zod",
-  "version": "3.24.1-rc.4",
-  "author": "Colin McDonnell <colin@colinhacks.com>",
+  "version": "3.24.1-rc.6",
+  "author": "Exodus Movement, Inc.",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/colinhacks/zod.git"
+    "url": "git+https://github.com/ExodusMovement/zod.git"
   },
   "type": "module",
   "module": "./lib/index.mjs",
@@ -23,8 +23,6 @@
     "@typescript-eslint/eslint-plugin": "^5.15.0",
     "@typescript-eslint/parser": "^5.15.0",
     "babel-jest": "^29.5.0",
-    "benchmark": "^2.1.4",
-    "dependency-cruiser": "^9.19.0",
     "eslint": "^8.11.0",
     "eslint-config-prettier": "^8.5.0",
     "eslint-plugin-ban": "^1.6.0",
@@ -55,7 +53,7 @@
     "./package.json": "./package.json"
   },
   "bugs": {
-    "url": "https://github.com/colinhacks/zod/issues"
+    "url": "https://github.com/ExodusMovement/zod/issues"
   },
   "description": "TypeScript-first schema declaration and validation library with static type inference",
   "files": [
@@ -63,8 +61,6 @@
     "/index.d.ts",
     "!/lib/benchmarks"
   ],
-  "funding": "https://github.com/sponsors/colinhacks",
-  "homepage": "https://zod.dev",
   "keywords": [
     "typescript",
     "schema",
@@ -101,12 +97,7 @@
     "test:vitest": "npx vitest --config ./configs/vitest.config.ts",
     "test:ts-jest": "npx jest --config ./configs/ts-jest.config.json",
     "test:swc": "npx jest --config ./configs/swc-jest.config.json",
-    "prepublishOnly": "npm run test && npm run build",
-    "play": "nodemon -e ts -w . -x tsx playground.ts",
-    "depcruise": "depcruise -c .dependency-cruiser.js src",
-    "benchmark": "tsx src/benchmarks/index.ts",
-    "prepare": "husky install",
-    "docs": "netlify dev"
+    "prepublishOnly": "npm run test && npm run build"
   },
   "sideEffects": false,
   "support": {