@openclaw/discord 2026.7.2-beta.3 → 2026.7.2-beta.4

package/node_modules/zod/src/v4/classic/tests/standard-schema.test.ts

@@ -55,3 +55,80 @@ test("length checks", async () => {
     }
   `);
 });
+
+test("schemas conform to StandardJSONSchemaV1", async () => {
+  const schema = z.codec(z.string(), z.number(), {
+    decode: (str) => Number.parseFloat(str),
+    encode: (num) => num.toString(),
+  });
+  expect(schema["~standard"].validate).toBeTypeOf("function");
+  expect(await schema["~standard"].validate("42")).toMatchInlineSnapshot(`
+		{
+		  "value": 42,
+		}
+	`);
+  expect(schema["~standard"].jsonSchema.input({ target: "draft-2020-12" })).toMatchInlineSnapshot(`
+		{
+		  "$schema": "https://json-schema.org/draft/2020-12/schema",
+		  "type": "string",
+		}
+	`);
+  expect(schema["~standard"].jsonSchema.output({ target: "draft-2020-12" })).toMatchInlineSnapshot(`
+		{
+		  "$schema": "https://json-schema.org/draft/2020-12/schema",
+		  "type": "number",
+		}
+	`);
+});
+
+test(".toJSONSchema() returns StandardJSONSchemaV1", async () => {
+  const codec = z.codec(z.string(), z.number(), {
+    decode: (str) => Number.parseFloat(str),
+    encode: (num) => num.toString(),
+  });
+  const result = codec.toJSONSchema();
+  expect(result["~standard"].validate).toBeTypeOf("function");
+  expect(await result["~standard"].validate("42")).toMatchInlineSnapshot(`
+		{
+		  "value": 42,
+		}
+	`);
+  expect(result["~standard"].jsonSchema.input({ target: "draft-2020-12" })).toMatchInlineSnapshot(`
+		{
+		  "$schema": "https://json-schema.org/draft/2020-12/schema",
+		  "type": "string",
+		}
+	`);
+  expect(result["~standard"].jsonSchema.output({ target: "draft-2020-12" })).toMatchInlineSnapshot(`
+		{
+		  "$schema": "https://json-schema.org/draft/2020-12/schema",
+		  "type": "number",
+		}
+	`);
+});
+
+test("z.toJSONSchema() returns StandardJSONSchemaV1", async () => {
+  const codec = z.codec(z.string(), z.number(), {
+    decode: (str) => Number.parseFloat(str),
+    encode: (num) => num.toString(),
+  });
+  const result = z.toJSONSchema(codec);
+  expect(result["~standard"].validate).toBeTypeOf("function");
+  expect(await result["~standard"].validate("42")).toMatchInlineSnapshot(`
+		{
+		  "value": 42,
+		}
+	`);
+  expect(result["~standard"].jsonSchema.input({ target: "draft-2020-12" })).toMatchInlineSnapshot(`
+		{
+		  "$schema": "https://json-schema.org/draft/2020-12/schema",
+		  "type": "string",
+		}
+	`);
+  expect(result["~standard"].jsonSchema.output({ target: "draft-2020-12" })).toMatchInlineSnapshot(`
+		{
+		  "$schema": "https://json-schema.org/draft/2020-12/schema",
+		  "type": "number",
+		}
+	`);
+});

package/node_modules/zod/src/v4/classic/tests/string-formats.test.ts

@@ -107,3 +107,19 @@ test("z.stringFormat", () => {
     `/\\^\\(\\?:\\\\d\\{14,19\\}\\|\\\\d\\{4\\}\\(\\?: \\\\d\\{3,6\\}\\)\\{2,4\\}\\|\\\\d\\{4\\}\\(\\?:-\\\\d\\{3,6\\}\\)\\{2,4\\}\\)\\$/u`
   );
 });
+
+test("z.hex", () => {
+  const hexSchema = z.hex();
+
+  // Valid hex strings
+  expect(hexSchema.safeParse("").success).toBe(true); // Empty string is valid hex
+  expect(hexSchema.safeParse("123abc").success).toBe(true);
+  expect(hexSchema.safeParse("DEADBEEF").success).toBe(true);
+  expect(hexSchema.safeParse("0123456789abcdefABCDEF").success).toBe(true);
+
+  // Invalid hex strings
+  expect(hexSchema.safeParse("xyz").success).toBe(false);
+  expect(hexSchema.safeParse("123g").success).toBe(false);
+  expect(hexSchema.safeParse("hello world").success).toBe(false);
+  expect(hexSchema.safeParse("123-abc").success).toBe(false);
+});

package/node_modules/zod/src/v4/classic/tests/string.test.ts

@@ -35,6 +35,27 @@ test("includes", () => {
   expect(() => includesFromIndex2.parse("XincludesXX")).toThrow();
 });
 
+test("includes with string error message", () => {
+  const schema = z.string().includes("test", "must contain test");
+  schema.parse("this is a test");
+
+  expect(schema.safeParse("this is invalid")).toMatchInlineSnapshot(`
+    {
+      "error": [ZodError: [
+      {
+        "origin": "string",
+        "code": "invalid_format",
+        "format": "includes",
+        "includes": "test",
+        "path": [],
+        "message": "must contain test"
+      }
+    ]],
+      "success": false,
+    }
+  `);
+});
+
 test("startswith/endswith", () => {
   startsWith.parse("startsWithX");
   endsWith.parse("XendsWith");
@@ -196,6 +217,16 @@ test("base64 validations", () => {
     "?QmFzZTY0IGVuY29kaW5nIGlzIGZ1bg==", // Invalid character '?'
     ".MTIzND2Nzg5MC4=", // Invalid character '.'
     "QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo", // Missing padding
+    // Whitespace is not part of canonical base64 (RFC 4648 §3.3) — atob() strips
+    // whitespace internally before validating, so the length check alone would
+    // accept "123 " etc.
+    "123 ", // bypasses length-mod-4 via trailing whitespace
+    "SGVsbG8gV29ybGQ= ", // trailing space
+    " SGVsbG8gV29ybGQ=", // leading space
+    "SGVsbG8gV29ybGQ=\n", // trailing newline
+    "SGVs bG8gV29ybGQ=", // internal space
+    "SGVs\nbG8gV29ybGQ=", // internal newline
+    "SGVs\tbG8gV29ybGQ=", // internal tab
   ];
 
   for (const str of invalidBase64Strings) {
@@ -318,6 +349,83 @@ test("url validations", () => {
   expect(() => url.parse("https://")).toThrow();
 });
 
+test("url preserves original input", () => {
+  const url = z.string().url();
+
+  // Test the specific case from the user report
+  const input = "https://example.com?key=NUXOmHqWNVTapJkJJHw8BfD155AuqhH_qju_5fNmQ4ZHV7u8";
+  const output = url.parse(input);
+  expect(output).toBe(input); // Should preserve the original input exactly
+
+  // Test other cases where URL constructor would normalize
+  expect(url.parse("https://example.com?foo=bar")).toBe("https://example.com?foo=bar");
+  expect(url.parse("http://example.com?test=123")).toBe("http://example.com?test=123");
+  expect(url.parse("https://sub.example.com?param=value&other=data")).toBe(
+    "https://sub.example.com?param=value&other=data"
+  );
+
+  // Test cases with trailing slashes are preserved
+  expect(url.parse("https://example.com/")).toBe("https://example.com/");
+  expect(url.parse("https://example.com/path/")).toBe("https://example.com/path/");
+
+  // Test cases with paths and query parameters
+  expect(url.parse("https://example.com/path?query=param")).toBe("https://example.com/path?query=param");
+});
+
+test("url trims whitespace", () => {
+  const url = z.string().url();
+
+  // Test trimming whitespace from URLs
+  expect(url.parse("  https://example.com  ")).toBe("https://example.com");
+  expect(url.parse("  https://example.com/path?query=param  ")).toBe("https://example.com/path?query=param");
+  expect(url.parse("\t\nhttps://example.com\t\n")).toBe("https://example.com");
+  expect(url.parse("   https://example.com?key=value   ")).toBe("https://example.com?key=value");
+
+  // Test that URLs without extra whitespace are unchanged
+  expect(url.parse("https://example.com")).toBe("https://example.com");
+  expect(url.parse("https://example.com/path")).toBe("https://example.com/path");
+});
+
+test("url normalize flag", () => {
+  const normalizeUrl = z.url({ normalize: true });
+  const preserveUrl = z.url(); // normalize: false/undefined by default
+
+  // Test that normalize flag causes URL normalization
+  expect(normalizeUrl.parse("https://example.com?key=value")).toBe("https://example.com/?key=value");
+  expect(normalizeUrl.parse("http://example.com?test=123")).toBe("http://example.com/?test=123");
+
+  // Test with already normalized URLs
+  expect(normalizeUrl.parse("https://example.com/")).toBe("https://example.com/");
+  expect(normalizeUrl.parse("https://example.com/path?query=param")).toBe("https://example.com/path?query=param");
+
+  // Test complex URLs with normalization
+  expect(normalizeUrl.parse("https://example.com/../?key=value")).toBe("https://example.com/?key=value");
+  expect(normalizeUrl.parse("https://example.com/./path?key=value")).toBe("https://example.com/path?key=value");
+
+  // Compare with non-normalize behavior
+  expect(preserveUrl.parse("https://example.com?key=value")).toBe("https://example.com?key=value");
+  expect(preserveUrl.parse("http://example.com?test=123")).toBe("http://example.com?test=123");
+
+  // Test trimming with normalize
+  expect(normalizeUrl.parse("  https://example.com?key=value  ")).toBe("https://example.com/?key=value");
+  expect(preserveUrl.parse("  https://example.com?key=value  ")).toBe("https://example.com?key=value");
+});
+
+test("url normalize with hostname and protocol constraints", () => {
+  const constrainedNormalizeUrl = z.url({
+    normalize: true,
+    protocol: /^https$/,
+    hostname: /^example\.com$/,
+  });
+
+  // Test that normalization works with constraints
+  expect(constrainedNormalizeUrl.parse("https://example.com?key=value")).toBe("https://example.com/?key=value");
+
+  // Test that constraints are still enforced
+  expect(() => constrainedNormalizeUrl.parse("http://example.com?key=value")).toThrow();
+  expect(() => constrainedNormalizeUrl.parse("https://other.com?key=value")).toThrow();
+});
+
 test("httpurl", () => {
   const httpUrl = z.url({
     protocol: /^https?$/,
@@ -356,6 +464,12 @@ test("httpurl", () => {
   ).toThrow();
   expect(() => httpUrl.parse("http://asdf.c")).toThrow();
   expect(() => httpUrl.parse("mailto:asdf@lckj.com")).toThrow();
+  // missing // after protocol
+  expect(() => httpUrl.parse("http:example.com")).toThrow();
+  expect(() => httpUrl.parse("https:example.com")).toThrow();
+  // missing one /
+  expect(() => httpUrl.parse("https:/www.google.com")).toThrow();
+  expect(() => httpUrl.parse("http:/example.com")).toThrow();
 });
 
 test("url error overrides", () => {
@@ -450,6 +564,7 @@ test("good uuid", () => {
     "9491d710-3185-5e06-8ea0-6a2f275345e0",
     "9491d710-3185-5e06-9ea0-6a2f275345e0",
     "00000000-0000-0000-0000-000000000000",
+    "ffffffff-ffff-ffff-ffff-ffffffffffff",
   ];
 
   for (const goodUuid of goodUuids) {
@@ -464,11 +579,10 @@ test(`bad uuid`, () => {
     "9491d710-3185-0e06-bea0-6a2f275345e0",
     "9491d710-3185-5e06-0ea0-6a2f275345e0",
     "d89e7b01-7598-ed11-9d7a-0022489382fd", // new sequential id
-    "b3ce60f8-e8b9-40f5-1150-172ede56ff74", // Variant 0 - RFC 4122: Reserved, NCS backward compatibility
-    "92e76bf9-28b3-4730-cd7f-cb6bc51f8c09", // Variant 2 - RFC 4122: Reserved, Microsoft Corporation backward compatibility
+    "b3ce60f8-e8b9-40f5-1150-172ede56ff74", // Variant 0 - RFC 9562/4122: Reserved, NCS backward compatibility
+    "92e76bf9-28b3-4730-cd7f-cb6bc51f8c09", // Variant 2 - RFC 9562/4122: Reserved, Microsoft Corporation backward compatibility
     "invalid uuid",
     "9491d710-3185-4e06-bea0-6a2f275345e0X",
-    "ffffffff-ffff-ffff-ffff-ffffffffffff",
   ]) {
     const result = uuid.safeParse(badUuid);
     expect(result).toMatchObject({ success: false });
@@ -481,8 +595,8 @@ test("good guid", () => {
   for (const goodGuid of [
     "9491d710-3185-4e06-bea0-6a2f275345e0",
     "d89e7b01-7598-ed11-9d7a-0022489382fd", // new sequential id
-    "b3ce60f8-e8b9-40f5-1150-172ede56ff74", // Variant 0 - RFC 4122: Reserved, NCS backward compatibility
-    "92e76bf9-28b3-4730-cd7f-cb6bc51f8c09", // Variant 2 - RFC 4122: Reserved, Microsoft Corporation backward compatibility
+    "b3ce60f8-e8b9-40f5-1150-172ede56ff74", // Variant 0 - RFC 9562/4122: Reserved, NCS backward compatibility
+    "92e76bf9-28b3-4730-cd7f-cb6bc51f8c09", // Variant 2 - RFC 9562/4122: Reserved, Microsoft Corporation backward compatibility
     "00000000-0000-0000-0000-000000000000",
     "ffffffff-ffff-ffff-ffff-ffffffffffff",
   ]) {
@@ -513,12 +627,26 @@ test("cuid", () => {
         "origin": "string",
         "code": "invalid_format",
         "format": "cuid",
-        "pattern": "/^[cC][^\\\\s-]{8,}$/",
+        "pattern": "/^[cC][0-9a-z]{6,}$/",
         "path": [],
         "message": "Invalid cuid"
       }
     ]]
   `);
+
+  // Strings containing non-base36 characters that the old denylist regex
+  // (/^[cC][^\s-]{8,}$/) accepted. The new regex restricts the body to
+  // [0-9a-z], matching the actual CUID v1 base36 format. See #3621.
+  const previouslyAcceptedNonCuids = [
+    "cly63t164000245zw008pggon';select1;", // SQLi-shaped (no whitespace, no hyphen)
+    "c<script>alert(1)</script>aaaaaa", // XSS-shaped
+    "c{};alert(1)//", // bracket / curly chars
+    "C0123_45678", // underscore is not base36
+    "cAAAAAAAAA", // uppercase letters in body are not base36 (CUIDs are lowercase)
+  ];
+  for (const s of previouslyAcceptedNonCuids) {
+    expect(cuid.safeParse(s).success).toBe(false);
+  }
 });
 
 test("cuid2", () => {
@@ -698,6 +826,8 @@ test("format", () => {
   expect(z.string().date().format).toEqual("date");
   expect(z.string().time().format).toEqual("time");
   expect(z.string().duration().format).toEqual("duration");
+
+  expect(z.mac().format).toEqual("mac");
 });
 
 test("min max getters", () => {
@@ -711,6 +841,25 @@ test("min max getters", () => {
   expect(z.string().maxLength).toEqual(null);
 });
 
+test("boundary cases with zero length", () => {
+  // Test length(0) - only empty string should pass
+  const lengthZero = z.string().length(0);
+  expect(lengthZero.parse("")).toEqual("");
+  expect(() => lengthZero.parse("a")).toThrow();
+
+  // Test min(0) - all strings including empty should pass
+  const minZero = z.string().min(0);
+  expect(minZero.parse("")).toEqual("");
+  expect(minZero.parse("a")).toEqual("a");
+  expect(minZero.parse("hello")).toEqual("hello");
+
+  // Test max(0) - only empty string should pass
+  const maxZero = z.string().max(0);
+  expect(maxZero.parse("")).toEqual("");
+  expect(() => maxZero.parse("a")).toThrow();
+  expect(() => maxZero.parse("hello")).toThrow();
+});
+
 test("trim", () => {
   expect(z.string().trim().min(2).parse(" 12 ")).toEqual("12");
 
@@ -724,6 +873,24 @@ test("lowerCase", () => {
   expect(z.string().toUpperCase().parse("asdf")).toEqual("ASDF");
 });
 
+test("slugify", () => {
+  expect(z.string().slugify().parse("Hello World")).toEqual("hello-world");
+  expect(z.string().slugify().parse("  Hello   World  ")).toEqual("hello-world");
+  expect(z.string().slugify().parse("Hello@World#123")).toEqual("helloworld123");
+  expect(z.string().slugify().parse("Hello-World")).toEqual("hello-world");
+  expect(z.string().slugify().parse("Hello_World")).toEqual("hello-world");
+  expect(z.string().slugify().parse("---Hello---World---")).toEqual("hello-world");
+  expect(z.string().slugify().parse("Hello  World")).toEqual("hello-world");
+  expect(z.string().slugify().parse("Hello!@#$%^&*()World")).toEqual("helloworld");
+
+  // can be used with check
+  expect(z.string().check(z.slugify()).parse("Hello World")).toEqual("hello-world");
+
+  // can be chained with other methods
+  expect(z.string().slugify().min(5).parse("Hello World")).toEqual("hello-world");
+  expect(() => z.string().slugify().min(20).parse("Hello World")).toThrow();
+});
+
 // test("IP validation", () => {
 //   const ipSchema = z.string().ip();
 
@@ -808,6 +975,58 @@ test("IPv6 validation", () => {
   expect(() => ipv6.parse("254.164.77.1")).toThrow();
 });
 
+test("MAC validation", () => {
+  const mac = z.mac();
+
+  // Valid MAC addresses
+  expect(mac.safeParse("00:1A:2B:3C:4D:5E").success).toBe(true);
+  expect(mac.safeParse("FF:FF:FF:FF:FF:FF").success).toBe(true);
+  expect(mac.safeParse("00:11:22:33:44:55").success).toBe(true);
+  expect(mac.safeParse("A1:B2:C3:D4:E5:F6").success).toBe(true);
+  expect(mac.safeParse("10:20:30:40:50:60").success).toBe(true);
+  expect(mac.safeParse("0a:1b:2c:3d:4e:5f").success).toBe(true);
+  expect(mac.safeParse("12:34:56:78:9A:BC").success).toBe(true);
+
+  // Invalid MAC addresses
+  expect(mac.safeParse("00:1A-2B:3C-4D:5E").success).toBe(false);
+  expect(mac.safeParse("00:1A:2B:3C:4D").success).toBe(false);
+  expect(mac.safeParse("00:1A:2B:3C:4D").success).toBe(false);
+  expect(mac.safeParse("00-1A-2B-3C-4D").success).toBe(false);
+  expect(mac.safeParse("01-23-45-67-89-AB").success).toBe(false); // Dash delimiter not accepted by default
+  expect(mac.safeParse("AA-BB-CC-DD-EE-FF").success).toBe(false); // Dash delimiter not accepted by default
+  expect(mac.safeParse("DE-AD-BE-EF-00-01").success).toBe(false); // Dash delimiter not accepted by default
+  expect(mac.safeParse("98-76-54-32-10-FF").success).toBe(false); // Dash delimiter not accepted by default
+  expect(mac.safeParse("00:1A:2B:3C:4D:GZ").success).toBe(false);
+  expect(mac.safeParse("00:1A:2B:3C:4D:5E:GG").success).toBe(false);
+  expect(mac.safeParse("123:45:67:89:AB:CD").success).toBe(false);
+  expect(mac.safeParse("00--1A:2B:3C:4D:5E").success).toBe(false);
+  expect(mac.safeParse("00:1A::2B:3C:4D:5E").success).toBe(false);
+  expect(mac.safeParse("00:1A:2B:3C:3C:2B:1A:00").success).toBe(false); // Disallow EUI-64
+  expect(mac.safeParse("00:1a:2B:3c:4D:5e").success).toBe(false); // Disallow mixed-case
+
+  // MAC formats that are nonstandard but occassionally referenced, ex. https://www.postgresql.org/docs/17/datatype-net-types.html#DATATYPE-MACADDR
+  expect(mac.safeParse("00:1A:2B:3C:4D:5E:FF").success).toBe(false);
+  expect(mac.safeParse("001A2B:3C4D5E").success).toBe(false);
+  expect(mac.safeParse("001A:2B3C:4D5E").success).toBe(false);
+  expect(mac.safeParse("001A.2B3C.4D5E").success).toBe(false);
+  expect(mac.safeParse("001A2B3C4D5E").success).toBe(false);
+  expect(mac.safeParse("00.1A.2B.3C.4D.5E").success).toBe(false);
+});
+
+test("MAC validation with custom delimiter", () => {
+  const colonMac = z.mac({ delimiter: ":" });
+  expect(colonMac.safeParse("00:1A:2B:3C:4D:5E").success).toBe(true);
+  expect(colonMac.safeParse("00-1A-2B-3C-4D-5E").success).toBe(false);
+
+  const dashMac = z.mac({ delimiter: "-" });
+  expect(dashMac.safeParse("00-1A-2B-3C-4D-5E").success).toBe(true);
+  expect(dashMac.safeParse("00:1A:2B:3C:4D:5E").success).toBe(false);
+
+  const colonOnlyMac = z.mac({ delimiter: ":" });
+  expect(colonOnlyMac.safeParse("00:1A:2B:3C:4D:5E").success).toBe(true);
+  expect(colonOnlyMac.safeParse("00-1A-2B-3C-4D-5E").success).toBe(false);
+});
+
 test("CIDR v4 validation", () => {
   const cidrV4 = z.string().cidrv4();
 
@@ -842,6 +1061,9 @@ test("CIDR v6 validation", () => {
   expect(cidrV6.safeParse("2001:db8::/abc").success).toBe(false); // Invalid prefix format
   expect(cidrV6.safeParse("not a cidr").success).toBe(false); // Invalid format
   expect(cidrV6.safeParse("192.168.0.0/24").success).toBe(false); // IPv4 CIDR in v6 validation
+  expect(cidrV6.safeParse("2001:0db8:85a3::/64/whatever-after").success).toBe(false);
+  expect(cidrV6.safeParse("22d9:f4a8:6a90:f3bf:dcaa:2beb:5fba:0000/112").success).toBe(true);
+  expect(cidrV6.safeParse("22d9:f4a8:6a90:f3bf:dcaa:2beb:5fba:0000/112/268").success).toBe(false);
 });
 
 test("E.164 validation", () => {
@@ -871,6 +1093,8 @@ test("E.164 validation", () => {
     "+1 555 555 555", // space after plus sign
     "+1555 555 555", // space between numbers
     "+1555+555", // multiple plus signs
+    "+0000000", // leading zero country code
+    "+0123456789", // leading zero with more digits
     "+1555555555555555", // too long
     "+115abc55", // non numeric characters in number part
     "+1555555 ", // space after number
@@ -879,3 +1103,122 @@ test("E.164 validation", () => {
   expect(validE164Numbers.every((number) => e164Number.safeParse(number).success)).toBe(true);
   expect(invalidE164Numbers.every((number) => e164Number.safeParse(number).success === false)).toBe(true);
 });
+
+test("hostname", () => {
+  const hostname = z.hostname();
+
+  // Valid hostnames
+  hostname.parse("localhost");
+  hostname.parse("example.com");
+  hostname.parse("sub.example.com");
+  hostname.parse("a-b-c.example.com");
+  hostname.parse("123.example.com");
+  hostname.parse("example-123.com");
+  hostname.parse("example-123.1234");
+  hostname.parse("developer.mozilla.org");
+  hostname.parse("hello.world.example.com");
+  hostname.parse("www.google.com");
+  hostname.parse("192.168.1.1");
+  hostname.parse("xn--d1acj3b.com");
+  hostname.parse("xn--d1acj3b.org");
+  hostname.parse("xn--d1acj3b");
+
+  // Invalid hostnames
+  expect(() => hostname.parse("")).toThrow();
+  expect(() => hostname.parse("example..com")).toThrow();
+  expect(() => hostname.parse("example-.com")).toThrow();
+  expect(() => hostname.parse("-example.com")).toThrow();
+  expect(() => hostname.parse("example.com-")).toThrow();
+  expect(() => hostname.parse("example_com")).toThrow();
+  expect(() => hostname.parse("example.com:8080")).toThrow();
+  expect(() => hostname.parse("http://example.com")).toThrow();
+  expect(() => hostname.parse("ht!tp://invalid.com")).toThrow();
+
+  expect(() => hostname.parse("xn--d1acj3b..com")).toThrow();
+  expect(() => hostname.parse("ex@mple.com")).toThrow();
+  expect(() => hostname.parse("[2001:db8::zzzz]")).toThrow();
+  expect(() => hostname.parse("exa mple.com")).toThrow();
+  expect(() => hostname.parse("-example.com")).toThrow();
+  expect(() => hostname.parse("example..com")).toThrow();
+});
+
+test("hash validation", () => {
+  // MD5 tests
+  const md5hex = z.hash("md5");
+  const md5base64 = z.hash("md5", { enc: "base64" });
+  const md5base64url = z.hash("md5", { enc: "base64url" });
+
+  // Valid MD5 hashes
+  expect(md5hex.parse("5d41402abc4b2a76b9719d911017c592")).toBe("5d41402abc4b2a76b9719d911017c592");
+  expect(md5hex.parse("5D41402ABC4B2A76B9719D911017C592")).toBe("5D41402ABC4B2A76B9719D911017C592"); // uppercase
+  expect(md5base64.parse("XUFAKrxLKna5cZ2REBfFkg==")).toBe("XUFAKrxLKna5cZ2REBfFkg==");
+  expect(md5base64url.parse("XUFAKrxLKna5cZ2REBfFkg")).toBe("XUFAKrxLKna5cZ2REBfFkg");
+
+  // Invalid MD5 hashes
+  expect(() => md5hex.parse("5d41402abc4b2a76b9719d911017c59")).toThrow(); // too short
+  expect(() => md5hex.parse("5d41402abc4b2a76b9719d911017c592x")).toThrow(); // too long
+  expect(() => md5base64.parse("XUFAKrxLKna5cZ2REBfFkg=")).toThrow(); // wrong padding
+  expect(() => md5base64url.parse("XUFAKrxLKna5cZ2REBfFkg=")).toThrow(); // has padding
+
+  // SHA1 tests
+  const sha1hex = z.hash("sha1");
+  const sha1base64 = z.hash("sha1", { enc: "base64" });
+  const sha1base64url = z.hash("sha1", { enc: "base64url" });
+
+  // Valid SHA1 hashes
+  expect(sha1hex.parse("aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d")).toBe("aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d");
+  expect(sha1base64.parse("qvTGHdzF6KLavt4PO0gs2a6pQ00=")).toBe("qvTGHdzF6KLavt4PO0gs2a6pQ00=");
+  expect(sha1base64url.parse("qvTGHdzF6KLavt4PO0gs2a6pQ00")).toBe("qvTGHdzF6KLavt4PO0gs2a6pQ00");
+
+  // SHA256 tests
+  const sha256hex = z.hash("sha256");
+  const sha256base64 = z.hash("sha256", { enc: "base64" });
+  const sha256base64url = z.hash("sha256", { enc: "base64url" });
+
+  // Valid SHA256 hashes
+  expect(sha256hex.parse("2cf24dba4f21d4288094c4a2e2c2d6c6b0c3e0c8f0e0c8f0e0c8f0e0c8f0e0c8")).toBe(
+    "2cf24dba4f21d4288094c4a2e2c2d6c6b0c3e0c8f0e0c8f0e0c8f0e0c8f0e0c8"
+  );
+  expect(sha256base64.parse("LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ=")).toBe(
+    "LPJNul+wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ="
+  );
+  expect(sha256base64url.parse("LPJNul-wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ")).toBe(
+    "LPJNul-wow4m6DsqxbninhsWHlwfp0JecwQzYpOLmCQ"
+  );
+
+  // SHA384 tests (no padding in base64)
+  const sha384hex = z.hash("sha384");
+  const sha384base64 = z.hash("sha384", { enc: "base64" });
+
+  expect(
+    sha384hex.parse("59e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f")
+  ).toBe("59e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f");
+  expect(sha384base64.parse("WeF0h3dEjGneawDXozO7+5/xtGPkQ1TDVTvNucZm+pASWjx5+QOXvfX2oT3oKGhP")).toBe(
+    "WeF0h3dEjGneawDXozO7+5/xtGPkQ1TDVTvNucZm+pASWjx5+QOXvfX2oT3oKGhP"
+  );
+
+  // SHA512 tests
+  const sha512hex = z.hash("sha512");
+  const sha512base64 = z.hash("sha512", { enc: "base64" });
+
+  expect(
+    sha512hex.parse(
+      "9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043"
+    )
+  ).toBe(
+    "9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043"
+  );
+  expect(
+    sha512base64.parse("m3HSJL1i83hdltRq0+o9czGb+8KJDKra4t/3JRlnPKcjI8PZm6XBHXx6zG4UuMXaDEZjR1wuXDre9G9zvN7AQw==")
+  ).toBe("m3HSJL1i83hdltRq0+o9czGb+8KJDKra4t/3JRlnPKcjI8PZm6XBHXx6zG4UuMXaDEZjR1wuXDre9G9zvN7AQw==");
+
+  // Test default encoding (hex)
+  const defaultHash = z.hash("sha256");
+  expect(defaultHash.parse("2cf24dba4f21d4288094c4a2e2c2d6c6b0c3e0c8f0e0c8f0e0c8f0e0c8f0e0c8")).toBe(
+    "2cf24dba4f21d4288094c4a2e2c2d6c6b0c3e0c8f0e0c8f0e0c8f0e0c8f0e0c8"
+  );
+
+  // Test with custom error message
+  const hashWithMessage = z.hash("md5", { message: "Invalid MD5 hash" });
+  expect(() => hashWithMessage.parse("invalid")).toThrow("Invalid MD5 hash");
+});

package/node_modules/zod/src/v4/classic/tests/stringbool.test.ts

@@ -64,3 +64,43 @@ test("z.stringbool with custom error messages", () => {
 
   expect(() => a.parse("")).toThrowError("wrong!");
 });
+
+test("z.stringbool codec encoding", () => {
+  const schema = z.stringbool();
+
+  // Test encoding with default values
+  expect(z.encode(schema, true)).toEqual("true");
+  expect(z.encode(schema, false)).toEqual("false");
+});
+
+test("z.stringbool codec encoding with custom values", () => {
+  const schema = z.stringbool({
+    truthy: ["yes", "on", "1"],
+    falsy: ["no", "off", "0"],
+  });
+
+  // Should return first element of custom arrays
+  expect(z.encode(schema, true)).toEqual("yes");
+  expect(z.encode(schema, false)).toEqual("no");
+});
+
+test("z.stringbool codec round trip", () => {
+  const schema = z.stringbool({
+    truthy: ["enabled", "active"],
+    falsy: ["disabled", "inactive"],
+  });
+
+  // Test round trip: string -> boolean -> string
+  const decoded = z.decode(schema, "enabled");
+  expect(decoded).toEqual(true);
+
+  const encoded = z.encode(schema, decoded);
+  expect(encoded).toEqual("enabled"); // First element of truthy array
+
+  // Test with falsy value
+  const decodedFalse = z.decode(schema, "inactive");
+  expect(decodedFalse).toEqual(false);
+
+  const encodedFalse = z.encode(schema, decodedFalse);
+  expect(encodedFalse).toEqual("disabled"); // First element of falsy array
+});