@openclaw/diffs 2026.9.4 → 2026.9.6

package/node_modules/zod/src/v4/classic/tests/function.test.ts

@@ -358,3 +358,34 @@ test("extra parameters with rest", () => {
   const filteredList = ["apple", "orange", "pear", "banana", "strawberry"].filter(maxLength5);
   expect(filteredList.length).toEqual(2);
 });
+
+test("implement exposes the function schema at runtime", () => {
+  const schema = z.function({ input: [z.string()], output: z.number() });
+  const fn = schema.implement((s) => s.length);
+
+  // Deliberately absent from implement()'s return type: reaching `_zod` takes a cast, so an implemented function never reads as a schema to TypeScript even though it does at runtime.
+  type HasZod = "_zod" extends keyof typeof fn ? true : false;
+  expectTypeOf<HasZod>().toEqualTypeOf<false>();
+
+  expect((fn as any)._zod).toBe(schema._zod);
+  expect((fn as any)._zod.def.input).toBe(schema._def.input);
+  expect((fn as any)._zod.def.output).toBe(schema._def.output);
+  expect(Object.keys(fn)).toEqual([]);
+  expect(Object.getOwnPropertyDescriptor(fn, "_zod")).toMatchObject({ enumerable: false, writable: false });
+  expect(fn("asdf")).toBe(4);
+});
+
+test("implementAsync exposes the function schema at runtime", async () => {
+  const schema = z.function({ input: [z.string()], output: z.promise(z.number()) });
+  const fn = schema.implementAsync(async (s) => s.length);
+
+  expect((fn as any)._zod).toBe(schema._zod);
+  await expect(fn("asdf")).resolves.toBe(4);
+});
+
+test("parsing through a function schema exposes it the same way", () => {
+  const schema = z.function({ input: [z.string()], output: z.number() });
+  const { handler } = z.object({ handler: schema }).parse({ handler: (s: string) => s.length });
+
+  expect((handler as any)._zod).toBe(schema._zod);
+});

package/node_modules/zod/src/v4/classic/tests/global-config.test.ts

@@ -7,11 +7,7 @@ import * as core from "zod/v4/core";
 // bundled copies of Zod in a monorepo. This mirrors the existing
 // `globalRegistry` -> `globalThis.__zod_globalRegistry` treatment.
 //
-// See #5789 for the footgun this fixes: users with both CJS and ESM
-// instances of Zod loaded had to call `z.config({ jitless: true })`
-// twice — once per instance — because each module-scope `globalConfig`
-// was a different object. With this change, one call updates state seen
-// by every loaded copy.
+// See #5789 for the footgun this fixes: users with both CJS and ESM instances of Zod loaded had to call `z.config({ jitless: true })` twice — once per instance — because each module-scope `globalConfig` was a different object. With this change, one call updates state seen by every loaded copy.
 
 afterEach(() => {
   // Don't leak config mutations into other test files.
@@ -28,10 +24,7 @@ test("z.config writes are observed via globalThis.__zod_globalConfig", () => {
 });
 
 test("pre-set globalThis.__zod_globalConfig is preserved on import", () => {
-  // Object identity is preserved across reloads of the module: anyone who
-  // pre-populates `globalThis.__zod_globalConfig` before Zod loads (e.g.
-  // an inline script before the bundle) keeps that exact object as the
-  // source of truth. Mutating it directly is equivalent to z.config().
+  // Object identity is preserved across reloads of the module: anyone who pre-populates `globalThis.__zod_globalConfig` before Zod loads (e.g. an inline script before the bundle) keeps that exact object as the source of truth. Mutating it directly is equivalent to z.config().
   const direct = (globalThis as any).__zod_globalConfig;
   direct.jitless = true;
   expect(core.globalConfig.jitless).toBe(true);

package/node_modules/zod/src/v4/classic/tests/hash.test.ts

@@ -46,8 +46,7 @@ test("hash() API — types and runtime across all alg/enc combinations", async (
     expect(() => hash(alg, { enc: "base64" }).parse(hex)).toThrow();
     expect(() => hash(alg, { enc: "base64url" }).parse(base64)).toThrow();
 
-    // Encoding-specific failures
-    // hex: uppercase allowed, wrong length should fail
+    // Encoding-specific failures hex: uppercase allowed, wrong length should fail
     hash(alg, { enc: "hex" }).parse(hex.toUpperCase());
     expect(() => hash(alg, { enc: "hex" }).parse(hex.slice(0, -1))).toThrow();
 

package/node_modules/zod/src/v4/classic/tests/iban.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, test } from "vitest";
+import * as z from "zod";
+
+describe("z.iban", () => {
+  const valid: [string, string][] = [
+    ["Norway (15, minimum)", "NO9386011117947"],
+    ["Belgium (16)", "BE68539007547034"],
+    ["Netherlands (18)", "NL91ABNA0417164300"],
+    ["Germany (22)", "DE89370400440532013000"],
+    ["Great Britain (22)", "GB29NWBK60161331926819"],
+    ["Turkey (26)", "TR610000100000000000000001"],
+    ["France (27)", "FR1420041010050500013M02606"],
+    ["Cyprus (28)", "CY17002001280000001200527600"],
+    ["Malta (31)", "MT84MALT011000012345MTLCAST001S"],
+    ["Maximum length (34)", "AA73AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"],
+    ["Maximum length mixed (34)", "ZZ560123456789ABCDEFGHIJKLMNOPQRST"],
+  ];
+
+  test.each(valid)("accepts %s", (_label, n) => {
+    expect(z.iban().parse(n)).toBe(n);
+  });
+
+  test("rejects lowercase characters", () => {
+    expect(() => z.iban().parse("no9386011117947")).toThrow();
+    expect(() => z.iban().parse("de89370400440532013000")).toThrow();
+    expect(() => z.iban().parse("FR1420041010050500013m02606")).toThrow();
+  });
+
+  test("rejects spaces and hyphens", () => {
+    expect(() => z.iban().parse("NO93 8601 1117 947")).toThrow();
+    expect(() => z.iban().parse(" DE89370400440532013000")).toThrow();
+    expect(() => z.iban().parse("DE89370400440532013000 ")).toThrow();
+    expect(() => z.iban().parse("NO93-8601-1117-947")).toThrow();
+    expect(() => z.iban().parse("DE89-3704-0044-0532-0130-00")).toThrow();
+  });
+
+  test("rejects special characters", () => {
+    expect(() => z.iban().parse("NO938601111794!")).toThrow();
+    expect(() => z.iban().parse("DE8937040044053201300@")).toThrow();
+    expect(() => z.iban().parse("")).toThrow();
+  });
+
+  test("rejects inputs outside length bounds (15-34)", () => {
+    expect(() => z.iban().parse("NO938601111794")).toThrow();
+    expect(() => z.iban().parse("AA73AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")).toThrow();
+  });
+
+  test("rejects invalid check digits (checksum failure)", () => {
+    expect(() => z.iban().parse("NO9386011117948")).toThrow();
+    expect(() => z.iban().parse("DE89370400440532013001")).toThrow();
+    expect(() => z.iban().parse("FR1420041010050500013M02607")).toThrow();
+  });
+
+  test("rejects check digits outside 02-98", () => {
+    // mod 97 alone accepts all three; `98 - remainder` can only ever emit 02-98
+    expect(() => z.iban().parse("DE00000000000000000066")).toThrow();
+    expect(() => z.iban().parse("DE01000000000000000048")).toThrow();
+    expect(() => z.iban().parse("DE99000000000000000030")).toThrow();
+  });
+
+  test("carries the shape regex as its JSON Schema pattern", () => {
+    expect(z.toJSONSchema(z.iban())).toMatchObject({
+      format: "iban",
+      pattern: z.regexes.iban.source,
+    });
+  });
+
+  test("round-trips through JSON Schema with the checksum intact", () => {
+    const schema = z.fromJSONSchema(z.toJSONSchema(z.iban()));
+    expect(schema.safeParse("DE89370400440532013000").success).toBe(true);
+    expect(schema.safeParse("DE89370400440532013001").success).toBe(false);
+  });
+
+  test("error message references IBAN", () => {
+    const result = z.iban().safeParse("not-an-iban");
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues[0]?.message).toMatch(/IBAN/i);
+    }
+  });
+});

package/node_modules/zod/src/v4/classic/tests/in-out.test.ts

@@ -0,0 +1,159 @@
+import { describe, expect, test } from "vitest";
+import * as z from "zod";
+
+describe("z.input / z.output", () => {
+  test("flat codec: input/output give the right side", () => {
+    const c = z.codec(z.string(), z.bigint(), {
+      decode: (s) => BigInt(s),
+      encode: (n) => n.toString(),
+    });
+    expect(z.input(c).parse("1")).toBe("1");
+    expect(z.output(c).parse(1n)).toBe(1n);
+  });
+
+  test("codec nested in object: output works recursively (regression #5224)", () => {
+    const c = z.codec(z.string(), z.bigint(), {
+      decode: (s) => BigInt(s),
+      encode: (n) => n.toString(),
+    });
+    const obj = z.object({ b: c });
+
+    const decoded = z.output(obj);
+    expect(decoded.parse({ b: 1n })).toEqual({ b: 1n });
+
+    const encoded = z.input(obj);
+    expect(encoded.parse({ b: "1" })).toEqual({ b: "1" });
+  });
+
+  test("nested across record / map: matches the use case in #5224", () => {
+    const keyCodec = z.codec(z.string(), z.enum(["a", "b"]), {
+      decode: (s) => (s === "a" || s === "b" ? s : z.NEVER),
+      encode: (s) => s,
+    });
+    const valueObject = z.object({
+      n: z.codec(z.string(), z.bigint(), { decode: (s) => BigInt(s), encode: (n) => n.toString() }),
+    });
+
+    const fullCodec = z.codec(
+      z.record(z.input(keyCodec), z.input(valueObject)),
+      z.map(z.output(keyCodec), z.output(valueObject)),
+      {
+        decode: (input) => {
+          const m = new Map<"a" | "b", { n: bigint }>();
+          for (const [k, v] of Object.entries(input)) {
+            m.set(keyCodec.decode(k), valueObject.decode(v));
+          }
+          return m;
+        },
+        encode: (input) => {
+          const out: Record<string, { n: string }> = {};
+          for (const [k, v] of input.entries()) {
+            out[keyCodec.encode(k)] = valueObject.encode(v);
+          }
+          return out;
+        },
+      }
+    );
+
+    expect(fullCodec.decode({ a: { n: "1" } })).toEqual(new Map([["a", { n: 1n }]]));
+    expect(fullCodec.encode(new Map([["b", { n: 2n }]]))).toEqual({ b: { n: "2" } });
+  });
+
+  test("schema without pipes is returned with identity (no clone)", () => {
+    const s = z.object({ a: z.string() });
+    expect(z.input(s)).toBe(s);
+    expect(z.output(s)).toBe(s);
+  });
+
+  test("z.output carries checks attached to a pipe", () => {
+    const c = z
+      .codec(z.string(), z.number().int(), { decode: Number, encode: String })
+      .refine((n) => n > 10, { error: "gt10" });
+    const obj = z.object({ list: z.array(c) });
+    const decoded = z.output(obj);
+
+    expect(decoded.parse({ list: [50] })).toEqual({ list: [50] });
+    // The pipe's own check and the one already on its out side both survive, in that order.
+    expect(() => decoded.parse({ list: [5] })).toThrow("gt10");
+    expect(() => decoded.parse({ list: [50.5] })).toThrow();
+    // A pipe's checks run on the decoded value in both directions, so encode enforces them too.
+    expect(() => decoded.encode({ list: [5] })).toThrow("gt10");
+    // Carrying them clones the out side rather than mutating it.
+    expect(c._zod.def.out._zod.def.checks).toHaveLength(1);
+  });
+
+  test("z.input drops a pipe's checks, which constrain a value the input side never produces", () => {
+    const c = z.codec(z.string(), z.number(), { decode: Number, encode: String }).refine((n) => n > 10);
+    expect(z.input(c).parse("5")).toBe("5");
+
+    // Control: a check that isn't attached to a pipe is left alone.
+    expect(() => z.input(z.object({ s: z.string().min(2) })).parse({ s: "a" })).toThrow();
+  });
+
+  test("z.input resolves past a preprocess transform, which is not a real input side", () => {
+    const p = z.preprocess((v) => String(v), z.string().min(5));
+    const encoded = z.input(p);
+
+    expect(encoded.parse("abcde")).toBe("abcde");
+    // The bare transform used to come back here: it validated nothing and re-ran the preprocessor.
+    expect(() => encoded.parse(1)).toThrow();
+    expect(() => encoded.parse("abc")).toThrow();
+    // The same resolution the JSON Schema emitter already makes for this schema.
+    expect(z.toJSONSchema(p, { io: "input" })).toMatchObject({ type: "string", minLength: 5 });
+
+    // A check on the pipe itself travels with whichever side wins.
+    const checked = z.preprocess((v) => String(v), z.string()).refine((s) => s.startsWith("ok"));
+    expect(z.input(checked).parse("okay")).toBe("okay");
+    expect(() => z.input(checked).parse("nope")).toThrow();
+
+    // Control: a codec has two real sides, so its input side is still `in`, by identity.
+    const c = z.codec(z.string(), z.number(), { decode: Number, encode: String });
+    expect(z.input(c)).toBe(c._zod.def.in);
+  });
+
+  test("a wrapper's stored value survives only on the side it belongs to", () => {
+    const c = z.codec(z.string(), z.number(), { decode: Number, encode: String });
+
+    // A default and a catch hold output-side values, so the input projection sheds them.
+    expect(z.input(c.default(7)).parse(undefined)).toBe(undefined);
+    expect(z.input(c.default(7)).parse("1")).toBe("1");
+    expect(() => z.input(c.catch(9)).parse(123 as any)).toThrow();
+    expect(z.input(c.catch(9)).parse("1")).toBe("1");
+    expect(z.output(c.default(7)).parse(undefined)).toBe(7);
+    expect(z.output(c.catch(9)).parse("zz" as any)).toBe(9);
+
+    // A prefault is fed through the schema, so it is input-side and the output projection sheds it.
+    expect(z.input(c.prefault("5")).parse(undefined)).toBe("5");
+    expect(() => z.output(c.prefault("5")).parse(undefined as any)).toThrow();
+    expect(z.output(c.prefault("5")).parse(3)).toBe(3);
+  });
+
+  test("a wrapper over a pipe-free schema keeps both its value and its identity", () => {
+    const d = z.string().default("x");
+    const k = z.string().catch("y");
+    const f = z.string().prefault("z");
+
+    expect(z.input(d)).toBe(d);
+    expect(z.input(d).parse(undefined)).toBe("x");
+    expect(z.input(k)).toBe(k);
+    expect(z.output(f)).toBe(f);
+
+    const obj = z.object({ a: z.string().default("q") });
+    expect(z.input(obj)).toBe(obj);
+    expect(z.input(obj).parse({})).toEqual({ a: "q" });
+  });
+
+  test("runtime `z.input` agrees with type-level `z.input<T>`", () => {
+    const c = z.codec(z.string(), z.bigint(), {
+      decode: (s) => BigInt(s),
+      encode: (n) => n.toString(),
+    });
+    const obj = z.object({ b: c });
+
+    // Runtime: parse the input shape.
+    const parsed = z.input(obj).parse({ b: "1" });
+    // Type: matches the declared input type.
+    const asType: z.input<typeof obj> = parsed;
+    expect(asType).toEqual({ b: "1" });
+  });
+});

package/node_modules/zod/src/v4/classic/tests/index.test.ts

@@ -653,8 +653,7 @@ test("z.custom check", () => {
 });
 
 test("z.check", () => {
-  // this is a more flexible version of z.custom that accepts an arbitrary _parse logic
-  // the function should return base.$ZodResult
+  // this is a more flexible version of z.custom that accepts an arbitrary _parse logic the function should return base.$ZodResult
   const a = z.any().check(
     z.check<string>((ctx) => {
       if (typeof ctx.value === "string") return;
@@ -736,6 +735,26 @@ test("z.refine", () => {
   expect(() => z.parse(a, "hi")).toThrow();
 });
 
+test("z.superRefine preserves explicit nullish issue input", () => {
+  const schema = z.string().check(
+    z.superRefine((_, ctx) => {
+      ctx.addIssue({ code: "custom", message: "default" });
+      ctx.addIssue({ code: "custom", message: "null", input: null });
+      ctx.addIssue({ code: "custom", message: "undefined", input: undefined });
+    })
+  );
+
+  const result = z.safeParse(schema, "sensitive", { reportInput: true });
+  expect(result.success).toEqual(false);
+  if (!result.success) {
+    expect(result.error.issues).toHaveLength(3);
+    expect(result.error.issues[0].input).toEqual("sensitive");
+    expect(result.error.issues[1].input).toEqual(null);
+    expect(result.error.issues[2]).toHaveProperty("input");
+    expect(result.error.issues[2].input).toEqual(undefined);
+  }
+});
+
 // test("z.superRefine", () => {
 //   const a = z.number([
 //     z.superRefine((val, ctx) => {

package/node_modules/zod/src/v4/classic/tests/instance-footprint.test.ts

@@ -0,0 +1,319 @@
+import { expect, test } from "vitest";
+
+import * as zm from "zod/mini";
+import * as z from "zod/v4";
+import * as core from "zod/v4/core";
+
+// V8 sizes an instance's property backing store in steps, and schema instances get no in-object slots (their constructor assigns nothing itself): 12 own properties cost 128 bytes, 13 cost 848, 21 cost 1616. Methods therefore live on the prototype and materialize per instance on first read. These bounds are what keeps a schema graph small; crossing one silently multiplies its memory by 6x.
+const MAX_OWN_PROPS = 12;
+
+test("schema instances stay under V8's property-count step", () => {
+  const cases: Array<[string, object]> = [
+    ["string", z.string()],
+    ["number", z.number()],
+    ["bigint", z.bigint()],
+    ["boolean", z.boolean()],
+    ["date", z.date()],
+    ["enum", z.enum(["a", "b"])],
+    ["array", z.array(z.string())],
+    ["object", z.object({ a: z.string() })],
+    ["record", z.record(z.string(), z.string())],
+    ["map", z.map(z.string(), z.string())],
+    ["set", z.set(z.string())],
+    ["union", z.union([z.string(), z.number()])],
+    ["optional", z.string().optional()],
+    ["pipe", z.string().pipe(z.string())],
+    ["email", z.email()],
+    ["mini string", zm.string()],
+    ["mini object", zm.object({ a: zm.string() })],
+  ];
+
+  const over = cases
+    .map(([name, schema]) => [name, Reflect.ownKeys(schema).length] as const)
+    .filter(([, count]) => count > MAX_OWN_PROPS);
+
+  expect(over).toEqual([]);
+});
+
+test("prototype-installed members survive detaching", () => {
+  const schema = z.string();
+  const { parse, safeParse, spa } = schema;
+
+  expect(parse("hi")).toEqual("hi");
+  expect(safeParse("hi").success).toEqual(true);
+  expect(["a", "b"].map((v) => parse(v))).toEqual(["a", "b"]);
+  expect(spa).toBe(schema.safeParseAsync);
+
+  const email = schema.email;
+  expect(email().safeParse("a@b.co").success).toEqual(true);
+});
+
+test("prototype-installed members can be overwritten per instance", () => {
+  const schema: any = z.string();
+  schema.parse = () => "overridden";
+
+  expect(schema.parse("anything")).toEqual("overridden");
+  expect(z.string().parse("untouched")).toEqual("untouched");
+});
+
+test("~standard is lazy but complete", () => {
+  const schema = z.string();
+
+  expect(Object.prototype.hasOwnProperty.call(schema, "~standard")).toEqual(false);
+  expect(schema["~standard"].vendor).toEqual("zod");
+  expect(schema["~standard"].version).toEqual(1);
+  expect(schema["~standard"].validate("hi")).toEqual({ value: "hi" });
+  expect((schema["~standard"] as any).jsonSchema.input()).toMatchObject({ type: "string" });
+  // Reading it caches on the instance, so the getter runs once.
+  expect(Object.prototype.hasOwnProperty.call(schema, "~standard")).toEqual(true);
+});
+
+test("caching a lazy member preserves its original enumerability", () => {
+  const schema = z.string();
+
+  // Methods were enumerable own properties before they moved to the prototype, so touching one still surfaces it to `Object.keys`.
+  void schema.parse;
+  void schema.optional;
+  expect(Object.keys(schema)).toContain("parse");
+  expect(Object.keys(schema)).toContain("optional");
+
+  // `~standard` never was an own data property, so caching it must not add it to `Object.keys` or to `JSON.stringify` of a schema.
+  void schema["~standard"];
+  expect(Object.keys(schema)).not.toContain("~standard");
+  expect(JSON.stringify(schema)).not.toContain("~standard");
+
+  // An explicit assignment behaves like one, as before.
+  const other: any = z.string();
+  other["~standard"] = { vendor: "x" };
+  expect(Object.keys(other)).toContain("~standard");
+});
+
+test("_def stays read-only", () => {
+  expect(() => {
+    (z.string() as any)._def = {};
+  }).toThrow(TypeError);
+  expect(() => {
+    (z.function({ input: [z.string()], output: z.number() }) as any)._def = {};
+  }).toThrow(TypeError);
+  const schema = z.string();
+  expect(schema._def).toBe(schema._zod.def);
+  expect(z.object({ a: z.string() })._def.type).toEqual("object");
+});
+
+test("deferred initializers are released after construction", () => {
+  expect(z.string()._zod.deferred).toEqual(undefined);
+  expect(z.object({ a: z.string() })._zod.deferred).toEqual(undefined);
+});
+
+test("trait initializers run once per instance across repeated entry", () => {
+  const calls: string[] = [];
+  const Base: core.$constructor<any> = core.$constructor<any>("CountedBase", () => calls.push("base"));
+  const Child: core.$constructor<any> = core.$constructor<any>("CountedChild", (inst, def) => {
+    calls.push("child");
+    Base.init(inst, def);
+    Base.init(inst, def);
+  });
+  const constructed = new Child({});
+  Child.init(constructed, {});
+  const direct = Object.create({});
+  Child.init(direct, {});
+  Child.init(direct, {});
+  expect(calls).toEqual(["child", "base", "child", "base"]);
+  for (const inst of [constructed, direct]) {
+    expect([...inst._zod.traits]).toEqual(["CountedChild", "CountedBase"]);
+    expect(inst instanceof Base).toBe(true);
+    expect(inst instanceof Child).toBe(true);
+  }
+  expect(constructed._zod.traits).not.toBe(direct._zod.traits);
+});
+
+test("a trait initializer called directly still installs its members", () => {
+  // a direct `init` installs onto the receiver's own prototype, since it is not below the constructor's
+  z.string();
+
+  const proto = {};
+  const inst = Object.create(proto) as z.ZodString;
+  z.ZodString.init(inst, { type: "string" });
+
+  expect(typeof inst.email).toBe("function");
+  expect(typeof inst.optional).toBe("function");
+  expect(Object.prototype.hasOwnProperty.call(proto, "email")).toBe(true);
+});
+
+test("a nested init during a repeat construction still installs its members", () => {
+  // the install used to read a module-level flag the outer construction set, so a nested `init` on an unrelated receiver inherited an answer that was not about it
+  const seen: string[] = [];
+
+  // an assertion signature needs the call target explicitly annotated
+  const Nested: core.$constructor<any> = core.$constructor<any>("Nested", () => {}, {
+    tag() {
+      return "nested";
+    },
+  });
+  const Outer = core.$constructor<any>("Outer", (_inst, def) => {
+    if (!def.nest) return;
+    // not a plain `{}`: the install target would resolve to `Object.prototype` and leak `tag` into every object the worker touches
+    const plain: any = Object.create({});
+    Nested.init(plain, {});
+    seen.push(typeof plain.tag);
+  });
+
+  new Outer({ nest: false });
+  new Outer({ nest: true });
+
+  expect(seen).toEqual(["function"]);
+});
+
+test("a derived trait's members win over the ones it composes", () => {
+  // Classic installs a richer `~standard` over core's. Trait dedupe is what orders them: core's initializer runs once, at the first `init` that reaches it, so classic's always lands second.
+  expect(typeof (z.string()["~standard"] as any).jsonSchema.input).toBe("function");
+});
+
+test("a live member keeps the descriptor a prototype member had", () => {
+  // An object literal's getter is enumerable; the `defineProperty` it replaced was not. `for..in` over a schema is public surface, and the construction path walks the prototype with it.
+  const proto = Object.getPrototypeOf(z.string());
+  expect(Object.getOwnPropertyDescriptor(proto, "description")?.enumerable).toBe(false);
+  expect(Object.getOwnPropertyDescriptor(proto, "_def")?.enumerable).toBe(false);
+  // a derived member installs like a literal's accessor: not enumerable, still configurable
+  expect(Object.getOwnPropertyDescriptor(proto, "minLength")).toMatchObject({ enumerable: false, configurable: true });
+
+  // the derived metadata members live on the prototype and shadow as own data on first read
+  const schema = z.string();
+  const keys: string[] = [];
+  for (const k in schema) keys.push(k);
+  expect(keys).toEqual(["def", "type"]);
+  expect(schema.minLength).toBe(null);
+  expect(Object.keys(schema)).toContain("minLength");
+});
+
+test("a live member is not cached per instance", () => {
+  const schema = z.string();
+
+  expect(schema.description).toBe(undefined);
+  core.globalRegistry.add(schema, { description: "later" });
+  expect(schema.description).toBe("later");
+  expect(Object.prototype.hasOwnProperty.call(schema, "description")).toBe(false);
+});
+
+test("constructing through a subclass does not strip the base prototype", () => {
+  // `super(def)` gives `this` a prototype of `new.target.prototype`, so a constructor can complete a construction without having built its own prototype.
+  const MyString: new (def: { type: "string" }) => z.ZodString = class extends (z.ZodString as any) {} as any;
+  new MyString({ type: "string" });
+
+  const plain = z.string();
+  expect(plain.parse("x")).toBe("x");
+  expect(typeof plain.email).toBe("function");
+  expect(typeof new MyString({ type: "string" }).email).toBe("function");
+});
+
+test("a subclass's own members survive the install", () => {
+  // The members go on the prototype of the constructor that built the instance, so a subclass's own prototype keeps what it declared. `z.symbol()` is constructed nowhere else here, which puts the subclass before its base — the ordering the install has to get right. Asserted rather than assumed, so warming it elsewhere fails the test instead of hollowing it out.
+  expect(Object.prototype.hasOwnProperty.call((z.ZodSymbol as any).prototype, "parse")).toBe(false);
+  const First = class extends (z.ZodSymbol as any) {
+    parse() {
+      return "PARSE";
+    }
+    optional() {
+      return "OPTIONAL";
+    }
+  } as any;
+  const first = new First({ type: "symbol" });
+  expect(first.parse(Symbol())).toBe("PARSE");
+  expect(first.optional()).toBe("OPTIONAL");
+  const sym = Symbol();
+  expect(z.symbol().parse(sym)).toBe(sym);
+
+  // and the other way round, with the base prototype already built by one of the `z.number()` calls above. Asserted for the same reason: warm it nowhere and this block quietly becomes a second copy of the cold case.
+  expect(Object.prototype.hasOwnProperty.call((z.ZodNumber as any).prototype, "parse")).toBe(true);
+  const Second = class extends (z.ZodNumber as any) {
+    parse() {
+      return "SECOND";
+    }
+  } as any;
+  expect(new Second({ type: "number" }).parse(1)).toBe("SECOND");
+
+  // two levels deep: neither prototype takes a copy, so the inherited member is one function
+  const Third = class extends (Second as any) {} as any;
+  new Third({ type: "number" });
+  expect(Second.prototype.parse).toBe(Third.prototype.parse);
+});
+
+test("a hand-written getter member accepts assignment", () => {
+  // Every member was an accessor with a setter before they moved onto `proto`, so a getter written by hand needs one too.
+  const schema: any = z.string();
+  schema.spa = () => "SPA";
+  schema.toJSONSchema = () => "JSON";
+  expect(schema.spa()).toBe("SPA");
+  expect(schema.toJSONSchema()).toBe("JSON");
+
+  const mini: any = zm.string();
+  mini.with = () => "WITH";
+  expect(mini.with()).toBe("WITH");
+
+  // a derived metadata member accepts assignment before its first read, as it did as an own property
+  const derived = z.number().min(2);
+  derived.minValue = 99;
+  expect(derived.minValue).toBe(99);
+  expect(Object.keys(derived)).toContain("minValue");
+
+  // and, like every prototype member, recomputes after deletion rather than staying absent
+  delete (derived as any).minValue;
+  expect(derived.minValue).toBe(2);
+});
+
+test("shape is lazy and stays out of Object.keys", () => {
+  const schema = z.object({ a: z.string() });
+
+  expect(Object.prototype.hasOwnProperty.call(schema, "shape")).toEqual(false);
+  expect("shape" in schema).toEqual(true);
+  expect(Object.keys(schema)).not.toContain("shape");
+  expect({ ...schema }).not.toHaveProperty("shape");
+
+  expect(Object.keys(schema.shape)).toEqual(["a"]);
+
+  // Reading caches a non-enumerable own data property. An own accessor here would put every later object schema into V8 dictionary mode.
+  expect(Object.prototype.hasOwnProperty.call(schema, "shape")).toEqual(true);
+  expect(Object.getOwnPropertyDescriptor(schema, "shape")).toMatchObject({
+    writable: true,
+    enumerable: false,
+    configurable: true,
+  });
+  expect(Object.keys(schema)).not.toContain("shape");
+
+  const mini = zm.object({ a: zm.string() });
+  expect(Object.prototype.hasOwnProperty.call(mini, "shape")).toEqual(false);
+  expect(Object.keys(mini.shape)).toEqual(["a"]);
+  expect(Object.keys(mini)).not.toContain("shape");
+});
+
+test("shape accepts repeated assignment and recomputes after deletion", () => {
+  const schema: any = z.object({ a: z.string() });
+
+  schema.shape = { b: z.number() };
+  expect(Object.keys(schema.shape)).toEqual(["b"]);
+  // The cached property stays writable, so a second assignment does not throw in strict mode.
+  schema.shape = { c: z.boolean() };
+  expect(Object.keys(schema.shape)).toEqual(["c"]);
+
+  // Deleting clears the memo rather than removing the property, since the accessor lives on the prototype.
+  delete schema.shape;
+  expect(Object.keys(schema.shape)).toEqual(["a"]);
+});
+
+test("a self-referential shape getter breaks the cycle instead of recursing", () => {
+  const Self: any = z.object({
+    a: z.string(),
+    get b() {
+      return z.array(z.object(Self.shape));
+    },
+  });
+  expect(Object.keys(Self.shape)).toEqual(["a", "b"]);
+
+  const Mini: any = zm.object({
+    a: zm.string(),
+    get b() {
+      return zm.array(zm.object(Mini.shape));
+    },
+  });
+  expect(Object.keys(Mini.shape)).toEqual(["a", "b"]);
+});