@openclaw/openshell-sandbox 2026.9.4 → 2026.9.5

package/node_modules/zod/src/v4/classic/tests/issue-schema.test.ts

@@ -0,0 +1,183 @@
+import { afterEach, expect, test } from "vitest";
+import * as z from "zod/v4";
+
+afterEach(() => {
+  z.config({ customError: undefined });
+});
+
+/** Collects the owning schema's registered metadata for every issue an error map sees. */
+function captureMeta(): { seen: (z.core.GlobalMeta | undefined)[] } {
+  const seen: (z.core.GlobalMeta | undefined)[] = [];
+  z.config({
+    customError: (issue) => {
+      seen.push(issue.schema && z.globalRegistry.get(issue.schema));
+      return undefined;
+    },
+  });
+  return { seen };
+}
+
+test("check-originated issues expose the owning schema", () => {
+  const { seen } = captureMeta();
+
+  z.object({ name: z.string().min(5).meta({ title: "Name" }) }).safeParse({ name: "ab" });
+  z.string().max(2).meta({ title: "Max" }).safeParse("abc");
+  z.email().meta({ title: "Email" }).safeParse("nope");
+  z.number().multipleOf(3).meta({ title: "Multiple" }).safeParse(4);
+  z.array(z.string()).min(2).meta({ title: "Array" }).safeParse([]);
+
+  expect(seen).toEqual([
+    { title: "Name" },
+    { title: "Max" },
+    { title: "Email" },
+    { title: "Multiple" },
+    { title: "Array" },
+  ]);
+});
+
+test("schema-originated issues expose the owning schema", () => {
+  const { seen } = captureMeta();
+
+  z.object({ name: z.string().min(5).meta({ title: "Name" }) }).safeParse({ name: 123 });
+  z.email().meta({ title: "Email" }).safeParse(123);
+
+  expect(seen).toEqual([{ title: "Name" }, { title: "Email" }]);
+});
+
+test("refinements attribute to the refined schema, not the internal check schema", () => {
+  const { seen } = captureMeta();
+
+  z.string()
+    .refine(() => false)
+    .meta({ title: "Refine" })
+    .safeParse("abc");
+  z.string()
+    .superRefine((_, ctx) => ctx.addIssue({ code: "custom", message: "" }))
+    .meta({ title: "SuperRefine" })
+    .safeParse("abc");
+
+  expect(seen).toEqual([{ title: "Refine" }, { title: "SuperRefine" }]);
+});
+
+test("the innermost schema owns the issue", () => {
+  const { seen } = captureMeta();
+
+  z.array(z.string().min(5).meta({ title: "Element" }))
+    .meta({ title: "Array" })
+    .safeParse(["ab"]);
+  z.string()
+    .pipe(z.string().min(5).meta({ title: "Target" }))
+    .meta({ title: "Pipe" })
+    .safeParse("ab");
+  z.looseObject({})
+    .check(z.property("a", z.string().meta({ title: "Property" })))
+    .meta({ title: "Object" })
+    .safeParse({ a: 1 });
+
+  expect(seen).toEqual([{ title: "Element" }, { title: "Target" }, { title: "Property" }]);
+});
+
+test("issues carrying no usable `inst` still get the owning schema", () => {
+  const { seen } = captureMeta();
+
+  // A hand-pushed issue may carry no inst at all, and ctx.addIssue(string) puts the check's def — not a Zod object — on inst.
+  z.string()
+    .check((payload) => {
+      payload.issues.push({ code: "custom", input: payload.value });
+    })
+    .meta({ title: "Bare" })
+    .safeParse("abc");
+  const shorthand = z
+    .string()
+    .superRefine((_, ctx) => ctx.addIssue("bad stuff"))
+    .meta({ title: "Shorthand" })
+    .safeParse("abc");
+
+  expect(seen).toEqual([{ title: "Bare" }]);
+  expect(shorthand.error!.issues[0].message).toEqual("bad stuff");
+});
+
+test("async checks expose the owning schema", async () => {
+  const { seen } = captureMeta();
+
+  await z
+    .string()
+    .refine(async () => false)
+    .meta({ title: "Async" })
+    .safeParseAsync("abc");
+
+  expect(seen).toEqual([{ title: "Async" }]);
+});
+
+test("the owning schema is the clone `.meta()` registered, not the pre-metadata schema", () => {
+  const bare = z.string().min(5);
+  const labeled = bare.meta({ title: "Labeled" });
+  const seen: unknown[] = [];
+  z.config({
+    customError: (issue) => {
+      seen.push(issue.schema === labeled);
+      return undefined;
+    },
+  });
+
+  labeled.safeParse("ab");
+
+  expect(seen).toEqual([true]);
+});
+
+test("`inst` keeps its meaning and `schema` stays off the finalized issue", () => {
+  const insts: string[] = [];
+  z.config({
+    customError: (issue) => {
+      insts.push(issue.inst!.constructor.name);
+      return undefined;
+    },
+  });
+
+  const tooSmall = z.string().min(5).safeParse("ab");
+  const wrongType = z.string().safeParse(123);
+
+  expect(insts).toEqual(["$ZodCheckMinLength", "ZodString"]);
+  expect(Object.keys(tooSmall.error!.issues[0])).not.toContain("schema");
+  expect(Object.keys(wrongType.error!.issues[0])).not.toContain("schema");
+});
+
+test("every error map kind receives the owning schema", () => {
+  const seen: Record<string, z.core.GlobalMeta | undefined> = {};
+  const capture = (key: string) => (issue: { schema?: z.core.$ZodType | undefined }) => {
+    seen[key] = issue.schema && z.globalRegistry.get(issue.schema);
+    return undefined;
+  };
+
+  z.string()
+    .min(5, { error: capture("check") })
+    .meta({ title: "Check" })
+    .safeParse("ab");
+
+  // A schema-bound map is only consulted for issues the schema itself raised, so this one needs a type error.
+  z.string({ error: capture("schema") })
+    .meta({ title: "Schema" })
+    .safeParse(123);
+
+  z.string()
+    .min(5)
+    .meta({ title: "Parse" })
+    .safeParse("ab", { error: capture("parse") });
+
+  z.config({ customError: capture("customError") });
+  z.string().min(5).meta({ title: "Custom" }).safeParse("ab");
+
+  // localeError carries the default English locale, so it is restored rather than cleared.
+  const localeError = z.config().localeError;
+  z.config({ customError: undefined, localeError: capture("localeError") });
+  z.string().min(5).meta({ title: "Locale" }).safeParse("ab");
+  z.config({ localeError });
+
+  expect(seen).toEqual({
+    check: { title: "Check" },
+    schema: { title: "Schema" },
+    parse: { title: "Parse" },
+    customError: { title: "Custom" },
+    localeError: { title: "Locale" },
+  });
+});

package/node_modules/zod/src/v4/classic/tests/jitless-allows-eval.test.ts

@@ -10,23 +10,16 @@ const { allowsEval } = core.util;
 // `securitypolicyviolation` report on strict-CSP pages (no 'unsafe-eval')
 // that Chrome DevTools surfaces as an Issue.
 //
-// The fix: when `globalConfig.jitless` is true, `allowsEval.value`
-// returns `false` without triggering the probe. This test lives in its
-// own file because vitest isolates ESM graphs per file, so the cached
-// `allowsEval.value` is fresh and is never accessed before the config
-// mutation below.
+// The fix: when `globalConfig.jitless` is true, `allowsEval.value` returns `false` without triggering the probe. This test lives in its own file because vitest isolates ESM graphs per file, so the cached `allowsEval.value` is fresh and is never accessed before the config mutation below.
 
 test("globalConfig.jitless=true short-circuits the allowsEval probe", () => {
-  // Set BEFORE first access to allowsEval.value — the getter is memoised
-  // via `cached()`, so the contract is "configure at app entry".
+  // Set BEFORE first access to allowsEval.value — the getter is memoised via `cached()`, so the contract is "configure at app entry".
   z.config({ jitless: true });
 
   // Sanity: config is wired
   expect(core.globalConfig.jitless).toBe(true);
 
-  // Spy: if the probe were still attempted, `new Function("")` would be
-  // called. Swap the global `Function` constructor with a throwing stub
-  // and verify the stub is NEVER invoked.
+  // Spy: if the probe were still attempted, `new Function("")` would be called. Swap the global `Function` constructor with a throwing stub and verify the stub is NEVER invoked.
   const origFunction = globalThis.Function;
   let probeAttempted = false;
   // @ts-expect-error assigning a stub to the Function global for the test

package/node_modules/zod/src/v4/classic/tests/lazy.test.ts

@@ -42,7 +42,7 @@ test("opt passthrough", () => {
   expect(z.lazy(() => z.string().optional())._zod.optin).toEqual("optional");
   expect(z.lazy(() => z.string().optional())._zod.optout).toEqual("optional");
 
-  expect(z.lazy(() => z.string().default("asdf"))._zod.optin).toEqual("optional");
+  expect(z.lazy(() => z.string().default("asdf"))._zod.optin).toEqual("defaulted");
   expect(z.lazy(() => z.string().default("asdf"))._zod.optout).toEqual(undefined);
 });
 
@@ -225,3 +225,38 @@ test("lazy initialization", () => {
     subcategories: z.lazy(() => categorySchema.array()),
   });
 });
+
+test("derived internals resolve on self-referential lazy", () => {
+  const optional: any = z.lazy(() => optional.optional());
+  const pipe: any = z.lazy(() => z.pipe(z.string(), pipe));
+
+  expect(optional._zod.optin).toEqual("optional");
+  expect(optional._zod.optout).toEqual("optional");
+  expect(pipe._zod.optin).toEqual(undefined);
+  expect(pipe._zod.optout).toEqual(undefined);
+});
+
+test("a cycle-broken internal is not memoized", () => {
+  const lazyRef: any = z.lazy(() => Rec);
+  const Rec: any = z.union([z.string().optional(), lazyRef]);
+
+  // Reading the outer node first resolves `lazyRef`'s own `optin` through the cycle.
+  expect(Rec._zod.optin).toEqual("optional");
+  expect(lazyRef._zod.optin).toEqual("optional");
+  expect(z.object({ x: Rec, y: lazyRef }).safeParse({ x: "a" }).success).toEqual(true);
+});
+
+test("an internal computed without a cycle break is memoized", () => {
+  // `undefined` is the legitimate answer here and still has to cache: these getters are read per parse, so recomputing them is a parse-path cost.
+  const union = z.union([z.string(), z.number()]);
+  expect(union._zod.optin).toEqual(undefined);
+  expect(Object.getOwnPropertyNames(union._zod)).toContain("optin");
+});
+
+// A compute that throws must memoize nothing, or the second read answers undefined for a schema whose internals were never derived.
+test("a throwing lazy internal throws on every read", () => {
+  const schema = z.discriminatedUnion("type", [z.string() as any]) as any;
+  for (let i = 0; i < 3; i++) {
+    expect(() => schema._zod.propValues).toThrow();
+  }
+});

package/node_modules/zod/src/v4/classic/tests/literal.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
@@ -115,3 +115,14 @@ test("literal pattern", () => {
     }
   `);
 });
+
+test("empty literal matches nothing", () => {
+  const empty = z.literal([]);
+  expectTypeOf<z.infer<typeof empty>>().toEqualTypeOf<never>();
+  expect(empty.safeParse("").success).toEqual(false);
+  expect(empty.safeParse(undefined).success).toEqual(false);
+  expect(z.templateLiteral(["", empty]).safeParse("").success).toEqual(false);
+  expect(z.toJSONSchema(empty)).toMatchObject({ not: {} });
+
+  expect(z.literal("").safeParse("").success).toEqual(true);
+});

package/node_modules/zod/src/v4/classic/tests/map.test.ts

@@ -99,6 +99,18 @@ test("failing when map is bigger than max() ", () => {
   expect(result.error!.issues[0].code).toEqual("too_big");
 });
 
+test("failing when map does not match size() ", () => {
+  expect(justTwo.safeParse(new Map([["a", "b"]])).error!.issues[0].message).toEqual(
+    "Too small: expected map to have exactly 2 entries"
+  );
+  const tooBig = new Map([
+    ["a", "b"],
+    ["c", "d"],
+    ["e", "f"],
+  ]);
+  expect(justTwo.safeParse(tooBig).error!.issues[0].message).toEqual("Too big: expected map to have exactly 2 entries");
+});
+
 test("valid parse async", async () => {
   const asyncMap = z.map(
     z.string().refine(async () => false, "bad key"),

package/node_modules/zod/src/v4/classic/tests/number.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
@@ -22,7 +22,7 @@ test("Infinity validation", () => {
         "code": "invalid_type",
         "received": "Infinity",
         "path": [],
-        "message": "Invalid input: expected number, received number"
+        "message": "Invalid input: expected number, received Infinity"
       }
     ]],
       "success": false,
@@ -34,9 +34,9 @@ test("Infinity validation", () => {
       {
         "expected": "number",
         "code": "invalid_type",
-        "received": "Infinity",
+        "received": "-Infinity",
         "path": [],
-        "message": "Invalid input: expected number, received number"
+        "message": "Invalid input: expected number, received -Infinity"
       }
     ]],
       "success": false,
@@ -137,6 +137,16 @@ test("multipleOf", () => {
   expect(() => schemas.schema7.parse(numbers.number8)).toThrow();
 });
 
+test(".multipleOf() accepts exact decimal multiples", () => {
+  // 2.03 === 29 * 0.07, but the quotient lands 2 ULP below 29, so the old tolerance rejected it while the neighbouring multiples 1.96 and 2.10 passed.
+  const schema = z.number().multipleOf(0.07);
+  expect(schema.safeParse(2.03).success).toBe(true);
+  expect(schema.safeParse(4.06).success).toBe(true);
+  expect(schema.safeParse(8.54).success).toBe(true);
+  // genuine non-multiples must still be rejected
+  expect(schema.safeParse(2.04).success).toBe(false);
+});
+
 test(".multipleOf() with positive divisor", () => {
   const schema = z.number().multipleOf(5);
   expect(schema.parse(15)).toEqual(15);
@@ -154,8 +164,7 @@ test(".multipleOf() with negative divisor", () => {
 });
 
 test(".multipleOf() with scientific notation (multi-digit exponents)", () => {
-  // Regression test for https://github.com/colinhacks/zod/pull/5687
-  // The regex was using \d? which only matches single-digit exponents
+  // Regression test for https://github.com/colinhacks/zod/pull/5687 — the regex was using \d? which only matches single-digit exponents
   const schema = z.number().multipleOf(1e-10);
 
   // These should all pass - they are valid multiples of 1e-10
@@ -208,7 +217,7 @@ test(".finite() validation", () => {
         "code": "invalid_type",
         "received": "Infinity",
         "path": [],
-        "message": "Invalid input: expected number, received number"
+        "message": "Invalid input: expected number, received Infinity"
       }
     ]],
       "success": false,
@@ -220,9 +229,9 @@ test(".finite() validation", () => {
       {
         "expected": "number",
         "code": "invalid_type",
-        "received": "Infinity",
+        "received": "-Infinity",
         "path": [],
-        "message": "Invalid input: expected number, received number"
+        "message": "Invalid input: expected number, received -Infinity"
       }
     ]],
       "success": false,
@@ -323,3 +332,31 @@ test("error customization", () => {
   z.number().gte(5, { error: (iss) => "Min: " + iss.minimum.valueOf() });
   z.number().lte(5, { error: (iss) => "Max: " + iss.maximum.valueOf() });
 });
+
+test("number formats are distinct at the type level", () => {
+  expectTypeOf(z.int()._zod.def.format).toEqualTypeOf<"safeint">();
+  expectTypeOf(z.int32()._zod.def.format).toEqualTypeOf<"int32">();
+  expectTypeOf(z.uint32()._zod.def.format).toEqualTypeOf<"uint32">();
+  expectTypeOf(z.float32()._zod.def.format).toEqualTypeOf<"float32">();
+  expectTypeOf(z.float64()._zod.def.format).toEqualTypeOf<"float64">();
+
+  z.int() satisfies z.ZodNumberFormat;
+  z.int() satisfies z.ZodNumber;
+
+  // @ts-expect-error a float32 schema is not a ZodInt
+  z.float32() satisfies z.ZodInt;
+  // @ts-expect-error a uint32 schema is not a ZodInt32
+  z.uint32() satisfies z.ZodInt32;
+
+  // the point of the distinction: dispatching on the schema type in a conditional type
+  type Sql<T> = T extends z.ZodUInt32
+    ? "BIGINT"
+    : T extends z.ZodInt32
+      ? "INTEGER"
+      : T extends z.ZodFloat32
+        ? "REAL"
+        : never;
+  expectTypeOf<Sql<z.ZodUInt32>>().toEqualTypeOf<"BIGINT">();
+  expectTypeOf<Sql<z.ZodInt32>>().toEqualTypeOf<"INTEGER">();
+  expectTypeOf<Sql<z.ZodFloat32>>().toEqualTypeOf<"REAL">();
+});