@openclaw/openshell-sandbox 2026.9.3 → 2026.9.5

package/node_modules/zod/src/v4/classic/tests/object.test.ts

@@ -132,14 +132,12 @@ test("catchall inference", () => {
 test("catchall overrides strict", () => {
   const o1 = z.object({ first: z.string().optional() }).strict().catchall(z.number());
 
-  // should run fine
-  // setting a catchall overrides the unknownKeys behavior
+  // should run fine setting a catchall overrides the unknownKeys behavior
   o1.parse({
     asdf: 1234,
   });
 
-  // should only run catchall validation
-  // against unknown keys
+  // should only run catchall validation against unknown keys
   o1.parse({
     first: "asdf",
     asdf: 1234,
@@ -154,8 +152,7 @@ test("catchall overrides strict", () => {
     .strict()
     .catchall(z.number());
 
-  // should run fine
-  // setting a catchall overrides the unknownKeys behavior
+  // should run fine setting a catchall overrides the unknownKeys behavior
   o1.parse({
     first: "asdf",
     asdf: 1234,
@@ -670,10 +667,7 @@ test("safeExtend() on object with refinements should not throw", () => {
   expect(() => schema.safeExtend({ b: z.string() })).not.toThrow();
 });
 
-// __proto__ in input must not replace the prototype of the parsed object via
-// the assignment setter on the result {}.
-// https://github.com/colinhacks/zod/security/advisories/GHSA-r34p-xfmx-58wv
-// https://github.com/colinhacks/zod/security/advisories/GHSA-84jv-fqfx-wxhr
+// __proto__ in input must not replace the prototype of the parsed object via the assignment setter on the result {}.
 describe("__proto__ in object catchall paths", () => {
   const protoInput = () => JSON.parse('{"__proto__":{"isAdmin":true},"name":"alice"}');
 
@@ -709,9 +703,248 @@ describe("__proto__ in object catchall paths", () => {
     }
   });
 
-  test("strict does not surface __proto__ as unrecognized", () => {
+  test("strict surfaces __proto__ as unrecognized without copying it", () => {
     const schema = z.object({ name: z.string() }).strict();
     const result = schema.safeParse(protoInput());
-    expect(result.success).toBe(true);
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues[0].code).toBe("unrecognized_keys");
+      expect((result.error.issues[0] as any).keys).toEqual(["__proto__"]);
+    }
+  });
+
+  test("strict accepts but strips a __proto__ key the shape declares", () => {
+    const shape: any = { name: z.string() };
+    Object.defineProperty(shape, "__proto__", {
+      value: z.string(),
+      enumerable: true,
+      configurable: true,
+      writable: true,
+    });
+    const input = JSON.parse('{"name":"alice","__proto__":"hello"}');
+
+    for (const schema of [z.object(shape).strict(), z.object(shape).catchall(z.any()), z.object(shape)]) {
+      const result = schema.safeParse(input);
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(Object.keys(result.data)).toEqual(["name"]);
+        expect(Object.getPrototypeOf(result.data)).toBe(Object.prototype);
+      }
+    }
+  });
+
+  test("strictObject and jitless agree with .strict()", async () => {
+    for (const schema of [z.strictObject({ name: z.string() }), z.object({ name: z.string() }).strict()]) {
+      for (const result of [
+        schema.safeParse(protoInput()),
+        await schema.safeParseAsync(protoInput(), {
+          jitless: true,
+        } as any),
+      ]) {
+        expect(result.success).toBe(false);
+        if (!result.success) {
+          expect((result.error.issues[0] as any).keys).toEqual(["__proto__"]);
+        }
+      }
+    }
+  });
+});
+
+// Parsed objects always strip __proto__, including keys explicitly declared by the schema.
+describe("__proto__ as a declared shape key", () => {
+  const protoInput = () => JSON.parse('{"__proto__":{"isAdmin":true},"name":"alice"}');
+  const makeShape = () =>
+    Object.fromEntries([
+      ["__proto__", z.object({ isAdmin: z.boolean() })],
+      ["name", z.string()],
+    ]) as Record<string, any>;
+
+  const expectStripped = (parsed: any) => {
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+    expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+    expect((parsed as any).isAdmin).toBeUndefined();
+    expect(Object.keys(parsed)).toEqual(["name"]);
+  };
+
+  test("jit fastpass", () => {
+    expectStripped(z.object(makeShape()).parse(protoInput()));
+  });
+
+  test("jitless", () => {
+    expectStripped(z.object(makeShape()).parse(protoInput(), { jitless: true } as any));
+  });
+
+  test("async", async () => {
+    const shape = Object.fromEntries([
+      ["__proto__", z.object({ isAdmin: z.boolean() }).refine(async () => true)],
+      ["name", z.string()],
+    ]) as Record<string, any>;
+    expectStripped(await z.object(shape).parseAsync(protoInput()));
+  });
+
+  test("primitive value is stripped", () => {
+    const schema = z.object(Object.fromEntries([["__proto__", z.string()]]) as Record<string, any>);
+    const parsed: any = schema.parse(JSON.parse('{"__proto__":"hello"}'));
+    expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  });
+
+  test("declared key is not validated", () => {
+    const schema = z.object(Object.fromEntries([["__proto__", z.string()]]) as Record<string, any>);
+    expect(schema.parse(JSON.parse('{"__proto__":123}'))).toEqual({});
+  });
+
+  test("required, optional, and defaulted declarations are all stripped", () => {
+    const shape = (schema: z.ZodType) => Object.fromEntries([["__proto__", schema]]) as Record<string, any>;
+
+    for (const jitless of [false, true]) {
+      const ctx = { jitless } as any;
+      expect(z.object(shape(z.unknown())).parse({}, ctx)).toEqual({});
+      expect(z.object(shape(z.string().optional())).parse({}, ctx)).toEqual({});
+      expect(z.object(shape(z.string().default("fallback"))).parse({}, ctx)).toEqual({});
+    }
+  });
+
+  test("an own getter is not evaluated", () => {
+    let reads = 0;
+    const input = Object.defineProperty({}, "__proto__", {
+      get() {
+        reads++;
+        return "value";
+      },
+      enumerable: true,
+    });
+    const schema = z.object(Object.fromEntries([["__proto__", z.string()]]) as Record<string, any>);
+
+    expect(schema.parse(input)).toEqual({});
+    expect(reads).toBe(0);
+  });
+
+  test("pick keeps a declared key", () => {
+    const shape = Object.fromEntries([["__proto__", z.string()]]) as Record<string, any>;
+    const mask = Object.fromEntries([["__proto__", true]]) as Record<string, true>;
+    const picked = z.object(shape).pick(mask);
+
+    expect(Object.keys(picked.shape)).toEqual(["__proto__"]);
+    const parsed: any = picked.parse(Object.fromEntries([["__proto__", "value"]]));
+    expect(parsed).toEqual({});
+    expect(() => z.object({ value: z.string() }).pick(mask as any).shape).toThrow('Unrecognized key: "__proto__"');
+  });
+
+  test.each(["omit", "partial", "required"] as const)("%s rejects an undeclared key", (method) => {
+    const mask = Object.fromEntries([["__proto__", true]]);
+    const schema = z.object({ value: z.string() });
+
+    expect(() => (schema[method] as any)(mask).shape).toThrow('Unrecognized key: "__proto__"');
+  });
+
+  test("shape helpers preserve a declared key", () => {
+    const shape = () =>
+      Object.fromEntries([
+        ["__proto__", z.string()],
+        ["value", z.string()],
+      ]) as Record<string, any>;
+    const protoMask = Object.fromEntries([["__proto__", true]]);
+    const valueMask = { value: true } as const;
+    const shapes = [
+      z.object(shape()).omit(valueMask).shape,
+      z.object(shape()).partial(protoMask as any).shape,
+      z.object(shape()).required(protoMask as any).shape,
+    ];
+
+    for (const next of shapes) {
+      expect(Object.getPrototypeOf(next)).toBe(Object.prototype);
+      expect(Object.prototype.hasOwnProperty.call(next, "__proto__")).toBe(true);
+    }
+  });
+
+  test("Object.prototype is untouched", () => {
+    z.object(makeShape()).parse(protoInput());
+    expect(({} as any).isAdmin).toBeUndefined();
+  });
+});
+
+test("object parsing still reads ordinary inherited properties", () => {
+  const input = Object.create({ value: "inherited" });
+  const schema = z.object({ value: z.string() });
+
+  expect(schema.parse(input)).toEqual({ value: "inherited" });
+  expect(schema.parse(input, { jitless: true } as any)).toEqual({ value: "inherited" });
+});
+
+describe("symbol keys in object shape", () => {
+  const SYM = Symbol("sym");
+  const OTHER = Symbol("other");
+
+  test("parses and validates a declared symbol key", () => {
+    const schema = z.object({ name: z.string(), [SYM]: z.number() });
+    expectTypeOf<z.infer<typeof schema>>().toEqualTypeOf<{ name: string; [SYM]: number }>();
+
+    for (const params of [undefined, { jitless: true } as any]) {
+      expect(schema.parse({ name: "alice", [SYM]: 42 }, params)).toEqual({ name: "alice", [SYM]: 42 });
+      expect(schema.safeParse({ name: "alice", [SYM]: "nope" }, params).success).toBe(false);
+      expect(schema.safeParse({ name: "alice" }, params).success).toBe(false);
+    }
+  });
+
+  test("reports an invalid symbol value at the symbol's own path", () => {
+    const schema = z.object({ [SYM]: z.number() });
+    const result = schema.safeParse({ [SYM]: "nope" });
+    expect(result.error!.issues[0].path).toEqual([SYM]);
+  });
+
+  test("honours optionality and defaults on a symbol key", () => {
+    expect(z.object({ [SYM]: z.number().optional() }).parse({})).toEqual({});
+    expect(z.object({ [SYM]: z.number().default(7) }).parse({})).toEqual({ [SYM]: 7 });
+  });
+
+  test("a declared symbol key survives strict and loose", () => {
+    expect(z.strictObject({ [SYM]: z.number() }).safeParse({ [SYM]: 1 }).success).toBe(true);
+    expect(z.strictObject({ [SYM]: z.number() }).safeParse({ [SYM]: 1, extra: 1 }).success).toBe(false);
+    expect(z.looseObject({ [SYM]: z.number() }).parse({ [SYM]: 1, extra: "e" })).toEqual({ [SYM]: 1, extra: "e" });
+  });
+
+  // Deliberate: hunting each input for undeclared symbols costs a `getOwnPropertySymbols` call on every parse of every strict/loose/catchall object, which measured +16-44% on `z.strictObject`. Declared keys are static and cost nothing, so only they are supported.
+  test("an undeclared symbol key is ignored, not passed through or flagged", () => {
+    expect(z.looseObject({ name: z.string() }).parse({ name: "a", [OTHER]: "x" })).toEqual({ name: "a" });
+    expect(z.strictObject({ name: z.string() }).safeParse({ name: "a", [OTHER]: "x" }).success).toBe(true);
+  });
+
+  test("builder methods reach symbol keys", () => {
+    const base = z.object({ a: z.string(), [SYM]: z.number() });
+    expect(base.partial().safeParse({ a: "x" }).success).toBe(true);
+    expect(base.partial().required().safeParse({ a: "x" }).success).toBe(false);
+    expect(Reflect.ownKeys(base.pick({ [SYM]: true }).shape)).toEqual([SYM]);
+    expect(Reflect.ownKeys(base.omit({ [SYM]: true }).shape)).toEqual(["a"]);
+    expect(Reflect.ownKeys(z.object({ a: z.string() }).extend({ [SYM]: z.number() }).shape)).toEqual(["a", SYM]);
+  });
+
+  test("a cycle through a symbol key is detected like a string-keyed one", () => {
+    const A: any = z.object({
+      name: z.string(),
+      get [SYM]() {
+        return A.optional();
+      },
+    });
+    const input: any = { name: "root" };
+    input[SYM] = input;
+    expect(A.safeParse(input).success).toBe(true);
+    expect(() => z.compile(A, { strict: true })).toThrow(/does not support/);
+  });
+
+  test("extend's refinement-overlap guard sees symbol keys", () => {
+    const refined = z.object({ a: z.string(), [SYM]: z.number() }).refine(() => true);
+    expect(() => refined.extend({ a: z.string() })).toThrow(/Cannot overwrite keys/);
+    expect(() => refined.extend({ [SYM]: z.string() })).toThrow(/Cannot overwrite keys/);
+  });
+
+  test("a symbol key is unrepresentable in JSON Schema", () => {
+    const schema = z.object({ a: z.string(), [SYM]: z.number() });
+    expect(() => z.toJSONSchema(schema)).toThrow(/Symbol keys cannot be represented/);
+    expect(z.toJSONSchema(schema, { unrepresentable: "any" })).toMatchObject({ properties: { a: { type: "string" } } });
+  });
+
+  test("rejects a non-schema value under a symbol key", () => {
+    expect(() => z.object({ [SYM]: 123 as any }).parse({})).toThrow(/Invalid element at key "Symbol\(sym\)"/);
   });
 });

package/node_modules/zod/src/v4/classic/tests/optin-ladder.test.ts

@@ -0,0 +1,234 @@
+import { expect, expectTypeOf, test } from "vitest";
+import { z } from "zod/v4";
+
+/* ------------------------------------------------------------------ *
+ * TYPE-LEVEL — the dangerous half. Defaults must stay OPTIONAL in
+ * z.input and REQUIRED in z.output, exactly as before the ladder.
+ * ------------------------------------------------------------------ */
+test("ladder: z.input / z.output unchanged by the extra rung", () => {
+  const objDefault = z.object({ a: z.string().default("D"), b: z.number() });
+  expectTypeOf<z.input<typeof objDefault>>().toEqualTypeOf<{ a?: string | undefined; b: number }>();
+  expectTypeOf<z.output<typeof objDefault>>().toEqualTypeOf<{ a: string; b: number }>();
+
+  const objPrefault = z.object({ a: z.string().prefault("P"), b: z.number() });
+  expectTypeOf<z.input<typeof objPrefault>>().toEqualTypeOf<{ a?: string | undefined; b: number }>();
+  expectTypeOf<z.output<typeof objPrefault>>().toEqualTypeOf<{ a: string; b: number }>();
+
+  const objOptional = z.object({ a: z.string().optional() });
+  expectTypeOf<z.input<typeof objOptional>>().toEqualTypeOf<{ a?: string | undefined }>();
+
+  const objTransform = z.object({
+    a: z
+      .string()
+      .default("")
+      .transform((v) => v.length),
+  });
+  expectTypeOf<z.input<typeof objTransform>>().toEqualTypeOf<{ a?: string | undefined }>();
+  expectTypeOf<z.output<typeof objTransform>>().toEqualTypeOf<{ a: number }>();
+
+  const standalone = z.string().default("D");
+  expectTypeOf<z.input<typeof standalone>>().toEqualTypeOf<string | undefined>();
+  expectTypeOf<z.output<typeof standalone>>().toEqualTypeOf<string>();
+
+  // a trailing defaulted tuple slot stays optional in the input tuple
+  const tup = z.tuple([z.string(), z.number().default(1)]);
+  expectTypeOf<z.input<typeof tup>>().toEqualTypeOf<[string, (number | undefined)?]>();
+
+  const partialed = objDefault.partial();
+  expectTypeOf<z.input<typeof partialed>>().toEqualTypeOf<{ a?: string | undefined; b?: number | undefined }>();
+});
+
+/* ------------------------------------------------------------------ *
+ * RUNTIME
+ * ------------------------------------------------------------------ */
+test("ladder: the #6321 regression is fixed", () => {
+  const arr = z
+    .string()
+    .default("")
+    .transform((v) => (v ? v.split(",") : []));
+  expect(z.object({ a: arr }).partial().parse({})).toEqual({ a: [] });
+  expect(z.object({ a: arr }).partial().parse({ a: undefined })).toEqual({ a: [] });
+  expect(z.object({ a: arr }).partial().parse({ a: "x,y" })).toEqual({ a: ["x", "y"] });
+  expect(arr.optional().parse(undefined)).toEqual([]);
+  expect(
+    z
+      .string()
+      .prefault("hi")
+      .transform((v) => v.length)
+      .optional()
+      .parse(undefined)
+  ).toBe(2);
+});
+
+test("ladder: key-level admissibility across every rung", () => {
+  expect(z.object({ a: z.string().default("D") }).parse({})).toEqual({ a: "D" });
+  expect(z.object({ a: z.string().prefault("P") }).parse({})).toEqual({ a: "P" });
+  expect(z.object({ a: z.string().optional() }).parse({})).toEqual({});
+  expect(z.object({ a: z.transform(() => "T") }).parse({})).toEqual({ a: "T" });
+  expect(z.object({ a: z.string().catch("C") }).parse({})).toEqual({ a: "C" });
+  expect(z.object({ a: z.string() }).safeParse({}).success).toBe(false);
+});
+
+test("ladder: exactOptional keeps its distinct meaning", () => {
+  expect(z.object({ a: z.string().exactOptional() }).parse({})).toEqual({});
+  expect(z.object({ a: z.string().exactOptional() }).safeParse({ a: undefined }).success).toBe(false);
+});
+
+// An absent key never materializes a value from a schema that only claims the middle rung, however that schema answers `undefined`. The top rung still substitutes, and an explicitly present `undefined` still runs the inner.
+test.each([true, false])("ladder: an absent key stays absent on the middle rung (jitless=%s)", (jitless) => {
+  const opts = { jitless };
+  expect(z.object({ a: z.coerce.string().exactOptional() }).parse({}, opts)).toStrictEqual({});
+  expect(z.object({ a: z.string().catch("C").exactOptional() }).parse({}, opts)).toStrictEqual({});
+  expect(z.object({ a: z.preprocess((v) => v ?? "X", z.string()).exactOptional() }).parse({}, opts)).toStrictEqual({});
+  expect(z.object({ a: z.union([z.coerce.string(), z.string().optional()]) }).parse({}, opts)).toStrictEqual({});
+
+  expect(z.object({ a: z.string().default("D").exactOptional() }).parse({}, opts)).toStrictEqual({ a: "D" });
+  expect(z.object({ a: z.string().prefault("P").exactOptional() }).parse({}, opts)).toStrictEqual({ a: "P" });
+  expect(z.object({ a: z.coerce.string().exactOptional() }).parse({ a: undefined }, opts)).toStrictEqual({
+    a: "undefined",
+  });
+  expect(z.object({ a: z.coerce.string() }).parse({ a: undefined }, opts)).toStrictEqual({ a: "undefined" });
+});
+
+test("ladder: an absent tuple slot on the middle rung truncates the tail", () => {
+  expect(z.tuple([z.string(), z.coerce.string().exactOptional()]).parse(["x"])).toStrictEqual(["x"]);
+  expect(z.tuple([z.string(), z.string().catch("C").exactOptional()]).parse(["x"])).toStrictEqual(["x"]);
+  expect(z.tuple([z.string(), z.string().default("D").exactOptional()]).parse(["x"])).toStrictEqual(["x", "D"]);
+});
+
+// z.compile() assembles its own output, so the gate has to be mirrored there or compile mode silently keeps the invented value.
+test("ladder: compile mode agrees with the interpreted and JIT paths on absent middle-rung slots", () => {
+  const objects = [
+    [z.object({ a: z.coerce.string().exactOptional() }), {}],
+    [z.object({ a: z.string().catch("C").exactOptional() }), {}],
+    [z.object({ a: z.string().default("D").exactOptional() }), { a: "D" }],
+    [z.object({ a: z.string().catch("C") }), { a: "C" }],
+  ] as const;
+  for (const [schema, expected] of objects) {
+    expect(z.compile(schema).parse({})).toStrictEqual(expected);
+    expect(schema.parse({}, { jitless: true })).toStrictEqual(expected);
+    expect(schema.parse({})).toStrictEqual(expected);
+  }
+
+  const tuples = [
+    [z.tuple([z.string(), z.coerce.string().exactOptional()]), ["x"]],
+    [z.tuple([z.string(), z.string().default("D").exactOptional()]), ["x", "D"]],
+  ] as const;
+  for (const [schema, expected] of tuples) {
+    expect(z.compile(schema).parse(["x"])).toStrictEqual(expected);
+    expect(schema.parse(["x"], { jitless: true })).toStrictEqual(expected);
+  }
+});
+
+test("ladder: tuple minimum length respects every rung", () => {
+  expect(z.tuple([z.string().default("D")]).parse([])).toEqual(["D"]);
+  expect(z.tuple([z.string().prefault("P")]).parse([])).toEqual(["P"]);
+  expect(z.tuple([z.string().optional()]).parse([])).toEqual([]);
+  expect(z.tuple([z.string()]).safeParse([]).success).toBe(false);
+  expect(z.tuple([z.string(), z.number().default(1)]).parse(["x"])).toEqual(["x", 1]);
+});
+
+test("ladder: the #5941 / #5939 clobber invariants still hold", () => {
+  expect(
+    z
+      .preprocess((v) => v ?? "X", z.string())
+      .optional()
+      .parse(undefined)
+  ).toBeUndefined();
+  expect(z.string().catch("X").optional().parse(undefined)).toBeUndefined();
+  expect(
+    z
+      .string()
+      .catch("X")
+      .transform((s) => `${s}!`)
+      .optional()
+      .parse(undefined)
+  ).toBeUndefined();
+  expect(
+    z
+      .transform(() => "T")
+      .optional()
+      .parse(undefined)
+  ).toBeUndefined();
+  expect(
+    z
+      .union([z.preprocess((v) => v ?? "X", z.string()), z.number()])
+      .optional()
+      .parse(undefined)
+  ).toBeUndefined();
+  expect(z.object({ a: z.preprocess((v) => v ?? "X", z.string()) }).parse({})).toEqual({ a: "X" });
+});
+
+test("ladder: the top rung survives every wrapper order", () => {
+  expect(z.string().default("D").optional().parse(undefined)).toBe("D");
+  expect(z.string().default("D").optional().optional().parse(undefined)).toBe("D");
+  expect(z.string().default("D").nullable().optional().parse(undefined)).toBe("D");
+  expect(z.string().default("D").readonly().optional().parse(undefined)).toBe("D");
+  expect(z.string().default("D").catch("C").optional().parse(undefined)).toBe("D");
+  expect(z.string().default("D").pipe(z.string()).optional().parse(undefined)).toBe("D");
+  expect(
+    z
+      .union([z.string().default("D"), z.number()])
+      .optional()
+      .parse(undefined)
+  ).toBe("D");
+  expect(
+    z
+      .lazy(() => z.string().default("D"))
+      .optional()
+      .parse(undefined)
+  ).toBe("D");
+});
+
+test("ladder: record and catchall paths that read optin", () => {
+  expect(z.record(z.string(), z.string().default("D")).parse({ k: undefined })).toEqual({ k: "D" });
+  expect(z.object({}).catchall(z.string().default("D")).parse({ x: undefined })).toEqual({ x: "D" });
+});
+
+test("ladder: async parity", async () => {
+  const a = z
+    .string()
+    .default("")
+    .transform(async (v) => (v ? v.split(",") : []));
+  expect((await a.optional().safeParseAsync(undefined)).data).toEqual([]);
+  expect((await z.object({ a }).partial().safeParseAsync({})).data).toEqual({ a: [] });
+  expect(
+    (
+      await z
+        .preprocess(async (v) => v ?? "X", z.string())
+        .optional()
+        .safeParseAsync(undefined)
+    ).data
+  ).toBeUndefined();
+});
+
+test("ladder: the rung values themselves", () => {
+  expect(z.string()._zod.optin).toBeUndefined();
+  expect(z.string().optional()._zod.optin).toBe("optional");
+  expect(z.transform(() => 1)._zod.optin).toBe("optional");
+  expect(z.string().catch("C")._zod.optin).toBe("optional");
+  expect(z.string().default("D")._zod.optin).toBe("defaulted");
+  expect(z.string().prefault("P")._zod.optin).toBe("defaulted");
+  expect(
+    z
+      .string()
+      .default("D")
+      .transform((v) => v)._zod.optin
+  ).toBe("defaulted");
+  expect(z.string().default("D").optional()._zod.optin).toBe("defaulted");
+  expect(z.union([z.string().default("D"), z.number()])._zod.optin).toBe("defaulted");
+  expect(z.union([z.string().optional(), z.number()])._zod.optin).toBe("optional");
+});
+
+test("exactOptional overrides the values and pattern optional installs", () => {
+  expect(z.exactOptional(z.enum(["a", "b"]))._zod.values).toEqual(new Set(["a", "b"]));
+  expect(z.exactOptional(z.string().regex(/^abc$/))._zod.pattern).toEqual(/^abc$/);
+  expect(z.templateLiteral(["a", z.exactOptional(z.literal("b"))]).safeParse("a").success).toEqual(false);
+});
+
+// The override is installed once, on a prototype every instance of the type shares, so it has to hold for instances built after the first.
+test("exactOptional's override holds for later instances", () => {
+  z.exactOptional(z.enum(["a", "b"]));
+  expect(z.exactOptional(z.enum(["c", "d"]))._zod.values).toEqual(new Set(["c", "d"]));
+  expect(z.exactOptional(z.string().regex(/^xyz$/))._zod.pattern).toEqual(/^xyz$/);
+});

package/node_modules/zod/src/v4/classic/tests/optional.test.ts

@@ -27,7 +27,7 @@ test("optionality", () => {
   expect(b._zod.optout).toEqual("optional");
 
   const c = z.string().default("asdf");
-  expect(c._zod.optin).toEqual("optional");
+  expect(c._zod.optin).toEqual("defaulted");
   expect(c._zod.optout).toEqual(undefined);
 
   const d = z.string().optional().nullable();
@@ -35,27 +35,27 @@ test("optionality", () => {
   expect(d._zod.optout).toEqual("optional");
 
   const e = z.string().default("asdf").nullable();
-  expect(e._zod.optin).toEqual("optional");
+  expect(e._zod.optin).toEqual("defaulted");
   expect(e._zod.optout).toEqual(undefined);
 
   // z.undefined should NOT be optional
   const f = z.undefined();
   expect(f._zod.optin).toEqual(undefined);
   expect(f._zod.optout).toEqual(undefined);
-  expectTypeOf<typeof f._zod.optin>().toEqualTypeOf<"optional" | undefined>();
+  expectTypeOf<typeof f._zod.optin>().toEqualTypeOf<"optional" | "defaulted" | undefined>();
   expectTypeOf<typeof f._zod.optout>().toEqualTypeOf<"optional" | undefined>();
 
   // z.union should be optional if any of the types are optional
   const g = z.union([z.string(), z.undefined()]);
   expect(g._zod.optin).toEqual(undefined);
   expect(g._zod.optout).toEqual(undefined);
-  expectTypeOf<typeof g._zod.optin>().toEqualTypeOf<"optional" | undefined>();
+  expectTypeOf<typeof g._zod.optin>().toEqualTypeOf<"optional" | "defaulted" | undefined>();
   expectTypeOf<typeof g._zod.optout>().toEqualTypeOf<"optional" | undefined>();
 
   const h = z.union([z.string(), z.optional(z.string())]);
   expect(h._zod.optin).toEqual("optional");
   expect(h._zod.optout).toEqual("optional");
-  expectTypeOf<typeof h._zod.optin>().toEqualTypeOf<"optional">();
+  expectTypeOf<typeof h._zod.optin>().toEqualTypeOf<"optional" | "defaulted">();
   expectTypeOf<typeof h._zod.optout>().toEqualTypeOf<"optional">();
 });
 
@@ -64,7 +64,7 @@ test("pipe optionality", () => {
   const a = z.string().optional().pipe(z.string());
   expect(a._zod.optin).toEqual("optional");
   expect(a._zod.optout).toEqual(undefined);
-  expectTypeOf<typeof a._zod.optin>().toEqualTypeOf<"optional">();
+  expectTypeOf<typeof a._zod.optin>().toEqualTypeOf<"optional" | "defaulted">();
   expectTypeOf<typeof a._zod.optout>().toEqualTypeOf<"optional" | undefined>();
 
   const b = z
@@ -73,11 +73,11 @@ test("pipe optionality", () => {
     .pipe(z.string().optional());
   expect(b._zod.optin).toEqual(undefined);
   expect(b._zod.optout).toEqual("optional");
-  expectTypeOf<typeof b._zod.optin>().toEqualTypeOf<"optional" | undefined>();
+  expectTypeOf<typeof b._zod.optin>().toEqualTypeOf<"optional" | "defaulted" | undefined>();
   expectTypeOf<typeof b._zod.optout>().toEqualTypeOf<"optional">();
 
   const c = z.string().default("asdf").pipe(z.string());
-  expect(c._zod.optin).toEqual("optional");
+  expect(c._zod.optin).toEqual("defaulted");
   expect(c._zod.optout).toEqual(undefined);
 
   const d = z
@@ -202,7 +202,7 @@ test("exactOptional optionality", () => {
   const a = z.string().exactOptional();
   expect(a._zod.optin).toEqual("optional");
   expect(a._zod.optout).toEqual("optional");
-  expectTypeOf<typeof a._zod.optin>().toEqualTypeOf<"optional">();
+  expectTypeOf<typeof a._zod.optin>().toEqualTypeOf<"optional" | "defaulted">();
   expectTypeOf<typeof a._zod.optout>().toEqualTypeOf<"optional">();
 });
 
@@ -268,10 +268,7 @@ test("exactOptional vs optional comparison", () => {
   expect(exactOptionalSchema.safeParse({ a: undefined }).success).toEqual(false);
 });
 
-// Defensive inference coverage: every schema that propagates `optout` participates
-// in object-key optionality inference. If anyone ever changes the set of values that
-// `optout` can take (or how OptionalOutSchema matches them), these assertions must
-// continue to hold or downstream `z.infer<typeof obj>` types silently flip required keys.
+// Defensive inference coverage: every schema that propagates `optout` participates in object-key optionality inference. If anyone ever changes the set of values that `optout` can take (or how OptionalOutSchema matches them), these assertions must continue to hold or downstream `z.infer<typeof obj>` types silently flip required keys.
 test("object key optionality through optout propagation", () => {
   const direct = z.object({ k: z.string().optional() });
   expectTypeOf<z.infer<typeof direct>>().toEqualTypeOf<{ k?: string | undefined }>();
@@ -317,9 +314,7 @@ test("object key optionality through optout propagation", () => {
   }>();
 });
 
-// Defensive: tuple optional-tail inference also reads optout. The PR that introduced
-// `"includeUndefined"` had to update TupleOutputTypeWithOptionals; pin the result so
-// any future flag change has to keep this contract.
+// Defensive: tuple optional-tail inference also reads optout. The PR that introduced `"includeUndefined"` had to update TupleOutputTypeWithOptionals; pin the result so any future flag change has to keep this contract.
 test("tuple tail optionality through optout propagation", () => {
   const trailingOptional = z.tuple([z.string(), z.number().optional()]);
   expectTypeOf<z.output<typeof trailingOptional>>().toEqualTypeOf<[string, (number | undefined)?]>();
@@ -331,3 +326,41 @@ test("tuple tail optionality through optout propagation", () => {
   const interiorOptional = z.tuple([z.string(), z.number().optional(), z.string()]);
   expectTypeOf<z.output<typeof interiorOptional>>().toEqualTypeOf<[string, number | undefined, string]>();
 });
+
+// An absent optional key whose check fails has its issue swallowed; the value the check wrote must go with it, on the JIT fastpass as well as the interpreted path.
+test("swallowed issue on an absent optional key drops its value", async () => {
+  const schema = z.object({
+    a: z
+      .string()
+      .optional()
+      .superRefine((_v, ctx) => {
+        ctx.addIssue({ code: "custom", message: "bad" });
+        ctx.value = "leaked";
+      }),
+  });
+
+  for (const result of [
+    schema.safeParse({}),
+    schema.safeParse({}, { jitless: true }),
+    await schema.safeParseAsync({}),
+  ]) {
+    expect(result.success).toEqual(true);
+    expect("a" in result.data!).toEqual(false);
+  }
+
+  // A present key keeps both the issue and its value.
+  expect(schema.safeParse({ a: "x" }).success).toEqual(false);
+  expect(schema.safeParse({ a: "x" }, { jitless: true }).success).toEqual(false);
+});
+
+test("optional does not swallow an issue it did not cause", () => {
+  // A pipe hands its `out` schema the caller's issues array so an unrecognized key can survive to an enclosing intersection. A defaulted inner substituting for absence must not read that as its own failing and drop it.
+  const result = z
+    .strictObject({ a: z.string() })
+    .transform((): number | undefined => undefined)
+    .pipe(z.number().default(5).optional())
+    .safeParse({ a: "x", extra: 1 });
+
+  expect(result.success).toBe(false);
+  expect(result.error!.issues.map((i) => i.code)).toEqual(["unrecognized_keys"]);
+});