@openclaw/matrix 2026.9.3 → 2026.9.5

package/node_modules/zod/src/v4/classic/tests/string.test.ts

@@ -217,9 +217,7 @@ test("base64 validations", () => {
     "?QmFzZTY0IGVuY29kaW5nIGlzIGZ1bg==", // Invalid character '?'
     ".MTIzND2Nzg5MC4=", // Invalid character '.'
     "QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo", // Missing padding
-    // Whitespace is not part of canonical base64 (RFC 4648 §3.3) — atob() strips
-    // whitespace internally before validating, so the length check alone would
-    // accept "123 " etc.
+    // Whitespace is not part of canonical base64 (RFC 4648 §3.3) — atob() strips whitespace internally before validating, so the length check alone would accept "123 " etc.
     "123 ", // bypasses length-mod-4 via trailing whitespace
     "SGVsbG8gV29ybGQ= ", // trailing space
     " SGVsbG8gV29ybGQ=", // leading space
@@ -386,6 +384,44 @@ test("url trims whitespace", () => {
   expect(url.parse("https://example.com/path")).toBe("https://example.com/path");
 });
 
+test("url returns the string the parser validated", () => {
+  // The URL parser deletes ASCII tab, LF and CR instead of failing, so `new URL()` reports on a string that is not the one it was given. The host is the consequential case: this validated example.com and used to hand back a URL naming a different host.
+  expect(z.url().parse("https://exa\nmple.com")).toBe("https://example.com");
+  expect(z.url().parse("https://exa\tmple.com")).toBe("https://example.com");
+  expect(z.url().parse("https://exa\rmple.com")).toBe("https://example.com");
+  expect(z.httpUrl().parse("https://exa\nmple.com")).toBe("https://example.com");
+  expect(z.url({ hostname: /^a\.com$/ }).parse("https://a\n.com")).toBe("https://a.com");
+  expect(z.url().parse("https://example.com/a\nb?c=\td#e")).toBe("https://example.com/ab?c=d#e");
+
+  // Nothing that parsed before stops parsing, and normalize still wins where it applies.
+  expect(z.url().parse("https://example.com/path")).toBe("https://example.com/path");
+  expect(z.url({ normalize: true }).parse("https://exa\nmple.com")).toBe("https://example.com/");
+});
+
+test("ipv6 and cidrv6 reject anything outside the address alphabet", () => {
+  // `new URL("http://[...]")` parses an authority rather than an address, so a delimiter re-splits it and the parser validates something else entirely.
+  expect(z.ipv6().safeParse("::@1\\").success).toBe(false); // used to validate against the host 0.0.0.1
+  expect(z.ipv6().safeParse("::]/1").success).toBe(false);
+  expect(z.ipv6().safeParse("@[::1").success).toBe(false);
+  expect(z.cidrv6().safeParse("::@1\\/64").success).toBe(false);
+
+  for (const c of ["\t", "\n", "\r"]) {
+    expect(z.ipv6().safeParse(`2001:db8::${c}1`).success).toBe(false);
+    expect(z.ipv6().safeParse(`::1${c}`).success).toBe(false);
+    expect(z.cidrv6().safeParse(`::1${c}/64`).success).toBe(false);
+  }
+
+  // A rejection has to surface as an issue, not just success: false.
+  const result = z.ipv6().safeParse("::1\n");
+  expect(result.success).toBe(false);
+  expect(result.error!.issues[0]).toMatchObject({ code: "invalid_format", format: "ipv6" });
+
+  expect(z.ipv6().parse("2001:db8::1")).toBe("2001:db8::1");
+  expect(z.ipv6().parse("::ffff:192.0.2.1")).toBe("::ffff:192.0.2.1");
+  expect(z.ipv6().parse("2001:DB8::1")).toBe("2001:DB8::1");
+  expect(z.cidrv6().parse("::ffff:192.0.2.1/96")).toBe("::ffff:192.0.2.1/96");
+});
+
 test("url normalize flag", () => {
   const normalizeUrl = z.url({ normalize: true });
   const preserveUrl = z.url(); // normalize: false/undefined by default
@@ -430,7 +466,7 @@ test("httpurl", () => {
   const httpUrl = z.url({
     protocol: /^https?$/,
     hostname: z.regexes.domain,
-    // /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/
+    // /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/
   });
 
   httpUrl.parse("https://example.com");
@@ -464,6 +500,16 @@ test("httpurl", () => {
   ).toThrow();
   expect(() => httpUrl.parse("http://asdf.c")).toThrow();
   expect(() => httpUrl.parse("mailto:asdf@lckj.com")).toThrow();
+  // total host length over the RFC 1035 limit of 253 chars (built from valid-length labels)
+  const longHost = `${`${"a".repeat(50)}.`.repeat(5)}com`; // 5 * 51 + 3 = 258 chars
+  expect(longHost.length).toBeGreaterThan(253);
+  expect(() => httpUrl.parse(`http://${longHost}`)).toThrow();
+  // TLD over the 63-char label limit
+  expect(() => httpUrl.parse(`http://example.${"a".repeat(64)}`)).toThrow();
+  // a host at exactly the 253-char limit is still accepted, one char more is not
+  const maxHost = `${`${"a".repeat(61)}.`.repeat(4)}aaaaa`; // 4 * 62 + 5 = 253 chars
+  httpUrl.parse(`http://${maxHost}`);
+  expect(() => httpUrl.parse(`http://${maxHost}a`)).toThrow();
   // missing // after protocol
   expect(() => httpUrl.parse("http:example.com")).toThrow();
   expect(() => httpUrl.parse("https:example.com")).toThrow();
@@ -493,6 +539,7 @@ test("url error overrides", () => {
 test("emoji validations", () => {
   const emoji = z.string().emoji();
 
+  emoji.parse("🦰🦱🦲🦳"); // both Extended_Pictographic and Emoji_Component
   emoji.parse("👋👋👋👋");
   emoji.parse("🍺👩‍🚀🫡");
   emoji.parse("💚💙💜💛❤️");
@@ -614,6 +661,26 @@ test("bad guid", () => {
   }
 });
 
+test("nanoid custom length", () => {
+  const nanoid64 = z.nanoid({ length: 64 });
+  nanoid64.parse("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_");
+  expect(nanoid64.safeParse("lfNZluvAxMkf7Q8C5H-QS")).toMatchObject({ success: false });
+
+  // the deprecated method and the default length both still work
+  expect(z.string().nanoid({ length: 10 }).safeParse("IRFa-VaY2b")).toMatchObject({ success: true });
+  expect(z.nanoid().safeParse("lfNZluvAxMkf7Q8C5H-QS")).toMatchObject({ success: true });
+
+  expect(z.nanoid({ length: 64, error: "custom error" }).safeParse("abc").error!.issues[0].message).toEqual(
+    "custom error"
+  );
+});
+
+test("nanoid rejects a length that is not a positive integer", () => {
+  expect(() => z.nanoid({ length: 0 })).toThrow("Invalid nanoid length: 0");
+  expect(() => z.nanoid({ length: -1 })).toThrow("Invalid nanoid length: -1");
+  expect(() => z.nanoid({ length: 1.5 })).toThrow("Invalid nanoid length: 1.5");
+});
+
 test("cuid", () => {
   const cuid = z.string().cuid();
   cuid.parse("ckopqwooh000001la8mbi2im9");
@@ -683,6 +750,12 @@ test("ulid", () => {
   const caseInsensitive = ulid.safeParse("01arZ3nDeKTsV4RRffQ69G5FAV");
   expect(caseInsensitive.success).toEqual(true);
 
+  // first char is capped at 7: the spec's largest ULID is 7ZZZZZZZZZZZZZZZZZZZZZZZZZ, so 8-9 and every letter overflow 2^48-1
+  expect(ulid.safeParse("7ZZZZZZZZZZZZZZZZZZZZZZZZZ").success).toEqual(true);
+  for (const first of ["8", "9", "A", "Z", "z"]) {
+    expect(ulid.safeParse(`${first}AAAAAAAAAAAAAAAAAAAAAAAAA`).success).toEqual(false);
+  }
+
   expect(result.error!.issues[0].message).toEqual("Invalid ULID");
   expect(result.error).toMatchInlineSnapshot(`
     [ZodError: [
@@ -690,7 +763,7 @@ test("ulid", () => {
         "origin": "string",
         "code": "invalid_format",
         "format": "ulid",
-        "pattern": "/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/",
+        "pattern": "/^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/",
         "path": [],
         "message": "Invalid ULID"
       }
@@ -860,6 +933,47 @@ test("boundary cases with zero length", () => {
   expect(() => maxZero.parse("hello")).toThrow();
 });
 
+test("length checks count Unicode code points, not UTF-16 code units", () => {
+  // "\u{1F600}" is one code point but two UTF-16 code units
+  const five = "\u{1F600}\u{1F600}\u{1F600}\u{1F600}\u{1F600}";
+  expect(z.string().max(5).safeParse(five).success).toBe(true);
+  expect(
+    z
+      .string()
+      .max(5)
+      .safeParse(five + "\u{1F600}").success
+  ).toBe(false);
+  expect(z.string().min(5).safeParse(five).success).toBe(true);
+  expect(z.string().min(5).safeParse("\u{1F600}\u{1F600}\u{1F600}\u{1F600}").success).toBe(false);
+  expect(z.string().length(5).safeParse(five).success).toBe(true);
+  expect(z.string().length(1).safeParse("\u{1F600}").success).toBe(true);
+  expect(z.string().nonempty().safeParse("\u{1F600}").success).toBe(true);
+
+  // code points, not graphemes: a combining mark and a ZWJ sequence each stay several
+  expect(z.string().length(2).safeParse("e\u0301").success).toBe(true);
+  expect(z.string().length(3).safeParse("\u{1F9D1}\u200D\u{1F37C}").success).toBe(true);
+
+  // an unpaired surrogate is its own code point
+  expect(z.string().length(1).safeParse("\uD83D").success).toBe(true);
+  expect(z.string().length(2).safeParse("\uDE00\uD83D").success).toBe(true);
+
+  // the reported bound is still the declared one
+  expect(
+    z
+      .string()
+      .max(5)
+      .safeParse(five + "\u{1F600}").error!.issues[0]
+  ).toMatchObject({
+    code: "too_big",
+    maximum: 5,
+    origin: "string",
+  });
+
+  // other lengthables keep counting elements
+  expect(z.array(z.string()).max(2).safeParse(["a", "b", "c"]).success).toBe(false);
+  expect(z.array(z.string()).length(2).safeParse(["\u{1F600}", "\u{1F600}"]).success).toBe(true);
+});
+
 test("trim", () => {
   expect(z.string().trim().min(2).parse(" 12 ")).toEqual("12");
 
@@ -1054,6 +1168,14 @@ test("CIDR v6 validation", () => {
   expect(cidrV6.safeParse("fe80::/10").success).toBe(true);
   expect(cidrV6.safeParse("::1/128").success).toBe(true);
   expect(cidrV6.safeParse("2001:0db8:85a3::/64").success).toBe(true);
+  expect(cidrV6.safeParse("2001:db8:1::/48").success).toBe(true);
+  expect(cidrV6.safeParse("2001:db8:85a3::8a2e:370:7334/64").success).toBe(true);
+  expect(cidrV6.safeParse("2001:db8:85a3:0:0:8a2e:370:7334/64").success).toBe(true);
+
+  const pattern = new RegExp(z.toJSONSchema(cidrV6).pattern as string);
+  for (const input of ["2001:db8::/32", "2001:db8:1::/48", "2001:0db8:85a3::/64", "fe80::/10", "::/0"]) {
+    expect(pattern.test(input)).toBe(true);
+  }
 
   // Invalid CIDR v6 addresses
   expect(cidrV6.safeParse("2001:db8::").success).toBe(false); // Missing prefix

package/node_modules/zod/src/v4/classic/tests/stringbool.test.ts

@@ -104,3 +104,21 @@ test("z.stringbool codec round trip", () => {
   const encodedFalse = z.encode(schema, decodedFalse);
   expect(encodedFalse).toEqual("disabled"); // First element of falsy array
 });
+
+test("z.stringbool exposes truthy/falsy/case via _zod.bag", () => {
+  const a = z.stringbool();
+  expect(a._zod.bag.truthy).toEqual(["true", "1", "yes", "on", "y", "enabled"]);
+  expect(a._zod.bag.falsy).toEqual(["false", "0", "no", "off", "n", "disabled"]);
+  expect(a._zod.bag.case).toEqual("insensitive");
+
+  // values are normalized when case-insensitive
+  const b = z.stringbool({ truthy: ["Y", "yes"], falsy: ["N"] });
+  expect(b._zod.bag.truthy).toEqual(["y", "yes"]);
+  expect(b._zod.bag.falsy).toEqual(["n"]);
+  expect(b._zod.bag.case).toEqual("insensitive");
+
+  const c = z.stringbool({ truthy: ["Y"], falsy: ["N"], case: "sensitive" });
+  expect(c._zod.bag.truthy).toEqual(["Y"]);
+  expect(c._zod.bag.falsy).toEqual(["N"]);
+  expect(c._zod.bag.case).toEqual("sensitive");
+});

package/node_modules/zod/src/v4/classic/tests/template-literal.test.ts

@@ -64,6 +64,9 @@ const measurement = z.templateLiteral([
   z.number().finite(),
   z.enum(["px", "em", "rem", "vh", "vw", "vmin", "vmax"]).optional(),
 ]);
+const decimalEnum = z.templateLiteral(["", z.enum({ A: 1.2 })]);
+// String(1e21) is "1e+21" — the `+` needs escaping too, or the pattern rejects its own enum value
+const exponentEnum = z.templateLiteral(["", z.enum({ A: 1e21 })]);
 
 const connectionString = z.templateLiteral([
   "mongodb://",
@@ -559,7 +562,7 @@ test("regexes", () => {
   expect(cuidZZZ._zod.pattern.source).toMatchInlineSnapshot(`"^[cC][0-9a-z]{6,}ZZZ$"`);
   expect(cuid2._zod.pattern.source).toMatchInlineSnapshot(`"^[0-9a-z]+$"`);
   expect(datetime._zod.pattern.source).toMatchInlineSnapshot(
-    `"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"`
+    `"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"`
   );
   expect(email._zod.pattern.source).toMatchInlineSnapshot(
     `"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"`
@@ -576,7 +579,7 @@ test("regexes", () => {
   expect(mac._zod.pattern.source).toMatchInlineSnapshot(
     `"^(?:[0-9A-F]{2}:){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}:){5}[0-9a-f]{2}$"`
   );
-  expect(ulid._zod.pattern.source).toMatchInlineSnapshot(`"^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$"`);
+  expect(ulid._zod.pattern.source).toMatchInlineSnapshot(`"^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$"`);
   expect(uuid._zod.pattern.source).toMatchInlineSnapshot(
     `"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"`
   );
@@ -590,6 +593,8 @@ test("regexes", () => {
   expect(brandedString._zod.pattern.source).toMatchInlineSnapshot(`"^[\\s\\S]{1,}$"`);
   expect(url._zod.pattern.source).toMatchInlineSnapshot(`"^https:\\/\\/\\w+\\.(com|net)$"`);
   expect(measurement._zod.pattern.source).toMatchInlineSnapshot(`"^-?\\d+(?:\\.\\d+)?((px|em|rem|vh|vw|vmin|vmax))?$"`);
+  expect(decimalEnum._zod.pattern.source).toMatchInlineSnapshot(`"^(1\\.2)$"`);
+  expect(exponentEnum._zod.pattern.source).toMatchInlineSnapshot(`"^(1e\\+21)$"`);
   expect(connectionString._zod.pattern.source).toMatchInlineSnapshot(
     `"^mongodb:\\/\\/(\\w+:\\w+@)?\\w+:-?\\d+(\\/(\\w+)?(\\?(\\w+=\\w+(&\\w+=\\w+)*)?)?)?$"`
   );
@@ -599,6 +604,8 @@ test("template literal parsing - success - complex cases", () => {
   url.parse("https://example.com");
   url.parse("https://speedtest.net");
 
+  exponentEnum.parse("1e+21");
+
   // measurement.parse(1);
   // measurement.parse(1.1);
   // measurement.parse(0);
@@ -675,6 +682,8 @@ test("template literal parsing - failure - complex cases", () => {
   expect(() => measurement.parse("-Infinity")).toThrow();
   expect(() => measurement.parse("NaN")).toThrow();
   expect(() => measurement.parse("1%")).toThrow();
+  expect(() => decimalEnum.parse("1x2")).toThrow();
+  expect(() => exponentEnum.parse("1e21")).toThrow();
 
   expect(() => connectionString.parse("mongod://host:1234")).toThrow();
   expect(() => connectionString.parse("mongodb://:1234")).toThrow();