@openclaw/openshell-sandbox 2026.9.4 → 2026.9.5

package/node_modules/zod/src/v4/classic/tests/partial.test.ts

@@ -156,10 +156,7 @@ test("catch/prefault/default", () => {
     f: z.string().prefault("prefault value"),
   });
 
-  // Catch (d) and default/prefault (b, c, e, f) handle absent keys gracefully.
-  // `a: catch().optional()` short-circuits to undefined when the original
-  // input was undefined, so the property is omitted from the output. All
-  // other catch/default/prefault keys produce their fallback values.
+  // Catch (d) and default/prefault (b, c, e, f) handle absent keys gracefully. `a: catch().optional()` short-circuits to undefined when the original input was undefined, so the property is omitted from the output. All other catch/default/prefault keys produce their fallback values.
   expect(mySchema.parse({})).toMatchInlineSnapshot(`
     {
       "b": "default value",
@@ -448,3 +445,53 @@ test("required - refinement is executed on required schema", () => {
   const validResult = requiredSchema.safeParse({ password: "abc", confirmPassword: "abc" });
   expect(validResult.success).toBe(true);
 });
+
+test("exactPartial - shallow inference", () => {
+  const shallow = nested.exactPartial();
+  type shallow = z.infer<typeof shallow>;
+  expectTypeOf<shallow>().toEqualTypeOf<{
+    name?: string;
+    age?: number;
+    outer?: { inner: string };
+    array?: { asdf: string }[];
+  }>();
+
+  // The point of exactPartial: unlike partial(), this matches TypeScript's Partial<> under exactOptionalPropertyTypes.
+  expectTypeOf<shallow>().toEqualTypeOf<Partial<z.infer<typeof nested>>>();
+});
+
+test("exactPartial - wraps fields in ZodExactOptional", () => {
+  const object = z.object({ name: z.string(), age: z.number() });
+  const exact = object.exactPartial();
+  expect(exact.shape.name).toBeInstanceOf(z.ZodExactOptional);
+  expect(exact.shape.age).toBeInstanceOf(z.ZodExactOptional);
+  expect(exact.shape.name.unwrap()).toBeInstanceOf(z.ZodString);
+});
+
+test("exactPartial - absent keys pass, explicit undefined rejected", () => {
+  const exact = z.object({ name: z.string(), age: z.number() }).exactPartial();
+  expect(exact.parse({})).toEqual({});
+  expect(exact.parse({ name: "asdf" })).toEqual({ name: "asdf" });
+  expect(exact.safeParse({ name: undefined }).success).toBe(false);
+});
+
+test("exactPartial with mask", () => {
+  const object = z.object({ name: z.string(), age: z.number(), country: z.string() });
+  const masked = object.exactPartial({ name: true, age: true });
+  expect(masked.shape.name).toBeInstanceOf(z.ZodExactOptional);
+  expect(masked.shape.age).toBeInstanceOf(z.ZodExactOptional);
+  expect(masked.shape.country).toBeInstanceOf(z.ZodString);
+
+  type masked = z.infer<typeof masked>;
+  expectTypeOf<masked>().toEqualTypeOf<{ name?: string; age?: number; country: string }>();
+
+  expect(masked.parse({ country: "US" })).toEqual({ country: "US" });
+  expect(masked.safeParse({ country: "US", name: undefined }).success).toBe(false);
+});
+
+test("exactPartial - throws on schema with refinements", () => {
+  const refined = z.object({ name: z.string() }).refine(() => true);
+  expect(() => refined.exactPartial()).toThrow(
+    ".exactPartial() cannot be used on object schemas containing refinements"
+  );
+});

package/node_modules/zod/src/v4/classic/tests/preprocess-types.test.ts

@@ -11,11 +11,11 @@ test("ZodPreprocess<B> assignable to ZodPipe<$ZodTransform, B>", () => {
 
 test("ZodPreprocess optin/optout defer to B", () => {
   const optionalInside = z.preprocess((v) => v, z.string().optional());
-  expectTypeOf<(typeof optionalInside)["_zod"]["optin"]>().toEqualTypeOf<"optional">();
+  expectTypeOf<(typeof optionalInside)["_zod"]["optin"]>().toEqualTypeOf<"optional" | "defaulted">();
   expectTypeOf<(typeof optionalInside)["_zod"]["optout"]>().toEqualTypeOf<"optional">();
 
   const required = z.preprocess((v) => v, z.string());
-  expectTypeOf<(typeof required)["_zod"]["optin"]>().toEqualTypeOf<"optional" | undefined>();
+  expectTypeOf<(typeof required)["_zod"]["optin"]>().toEqualTypeOf<"optional" | "defaulted" | undefined>();
   expectTypeOf<(typeof required)["_zod"]["optout"]>().toEqualTypeOf<"optional" | undefined>();
 });
 
@@ -24,3 +24,21 @@ test("ZodPreprocess input/output inference", () => {
   expectTypeOf<z.output<typeof pre>>().toEqualTypeOf<number | undefined>();
   expectTypeOf<z.input<typeof pre>>().toEqualTypeOf<unknown>();
 });
+
+test("ZodPreprocess narrows input from an annotated preprocessor arg", () => {
+  const trimmed = z.preprocess((val: string | null | undefined) => val?.trim() ?? "", z.string());
+  expectTypeOf<z.input<typeof trimmed>>().toEqualTypeOf<string | null | undefined>();
+  expectTypeOf<z.output<typeof trimmed>>().toEqualTypeOf<string>();
+
+  const obj = z.object({ a: z.preprocess((v: string | number) => String(v), z.string()) });
+  expectTypeOf<z.input<typeof obj>>().toEqualTypeOf<{ a: string | number }>();
+  expectTypeOf<z.output<typeof obj>>().toEqualTypeOf<{ a: string }>();
+});
+
+// The narrowing must ride on the transform's input only. Binding its output too makes $ZodPipeDef's codec-only `transform?` field contravariant in the preprocessor's return type, which drops the bare-type assignability below.
+test("narrowed ZodPreprocess still assignable to the bare type", () => {
+  const pre = z.preprocess((v: string) => v.length, z.number());
+  const _bare: z.ZodPreprocess<z.ZodNumber> = pre;
+  const _bareCore: z.core.$ZodPreprocess = pre;
+  expectTypeOf<(typeof pre)["_zod"]["optin"]>().toEqualTypeOf<"optional" | "defaulted" | undefined>();
+});

package/node_modules/zod/src/v4/classic/tests/readonly.test.ts

@@ -50,74 +50,6 @@ test("flat inference", () => {
   expectTypeOf<typeof readonlyPromise._output>().toEqualTypeOf<Promise<string>>();
 });
 
-// test("deep inference", () => {
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[0]>>().toEqualTypeOf<string>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[1]>>().toEqualTypeOf<number>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[2]>>().toEqualTypeOf<number>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[3]>>().toEqualTypeOf<bigint>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[4]>>().toEqualTypeOf<boolean>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[5]>>().toEqualTypeOf<Date>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[6]>>().toEqualTypeOf<undefined>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[7]>>().toEqualTypeOf<null>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[8]>>().toEqualTypeOf<any>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[9]>
-//   >().toEqualTypeOf<Readonly<unknown>>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[10]>>().toEqualTypeOf<void>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[11]>
-//   >().toEqualTypeOf<(args_0: string, args_1: number, ...args_2: unknown[]) => unknown>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[12]>
-//   >().toEqualTypeOf<readonly string[]>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[13]>
-//   >().toEqualTypeOf<readonly [string, number]>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[14]>
-//   >().toEqualTypeOf<ReadonlyMap<string, Date>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[15]>
-//   >().toEqualTypeOf<ReadonlySet<Promise<string>>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[16]>
-//   >().toEqualTypeOf<Readonly<Record<string, string>>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[17]>
-//   >().toEqualTypeOf<Readonly<Record<string, number>>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[18]>
-//   >().toEqualTypeOf<{ readonly a: string; readonly 1: number }>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[19]>
-//   >().toEqualTypeOf<Readonly<testEnum>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[20]>
-//   >().toEqualTypeOf<Promise<string>>();
-
-//   expectTypeOf<
-//     z.infer<typeof crazyDeepReadonlySchema>
-//   >().toEqualTypeOf<ReadonlyMap<
-//     ReadonlySet<readonly [string, number]>,
-//     {
-//       readonly a: {
-//         readonly [x: string]: readonly any[];
-//       };
-//       readonly b: {
-//         readonly c: {
-//           readonly d: {
-//             readonly e: {
-//               readonly f: {
-//                 readonly g?: {};
-//               };
-//             };
-//           };
-//         };
-//       };
-//     }
-//   >>();
-// });
-
 test("object freezing", async () => {
   expect(Object.isFrozen(z.array(z.string()).readonly().parse(["a"]))).toBe(true);
   expect(Object.isFrozen(z.tuple([z.string(), z.number()]).readonly().parse(["a", 1]))).toBe(true);

package/node_modules/zod/src/v4/classic/tests/record.test.ts

@@ -76,6 +76,37 @@ test("enum exhaustiveness", () => {
   `);
 });
 
+test("optional-in value type", () => {
+  const defaulted = z.record(z.enum(["Tuna", "Salmon"]), z.string().default("unknown"));
+  expectTypeOf<z.input<typeof defaulted>>().toEqualTypeOf<Partial<Record<"Tuna" | "Salmon", string | undefined>>>();
+  expectTypeOf<z.output<typeof defaulted>>().toEqualTypeOf<Record<"Tuna" | "Salmon", string>>();
+  expect(defaulted.parse({ Tuna: "asdf" })).toEqual({ Tuna: "asdf", Salmon: "unknown" });
+
+  const prefaulted = z.record(z.enum(["Tuna", "Salmon"]), z.string().prefault("unknown"));
+  expectTypeOf<z.input<typeof prefaulted>>().toEqualTypeOf<Partial<Record<"Tuna" | "Salmon", string | undefined>>>();
+  expect(prefaulted.parse({ Tuna: "asdf" })).toEqual({ Tuna: "asdf", Salmon: "unknown" });
+
+  const optional = z.record(z.enum(["Tuna", "Salmon"]), z.string().optional());
+  expectTypeOf<z.input<typeof optional>>().toEqualTypeOf<Partial<Record<"Tuna" | "Salmon", string | undefined>>>();
+  // toStrictEqual, not toEqual: an exhaustive record assigns every key, and toEqual cannot tell an absent key from one holding undefined.
+  expect(optional.parse({ Tuna: "asdf" })).toStrictEqual({ Tuna: "asdf", Salmon: undefined });
+
+  // A value that needs a slot keeps the key required, and a non-enumerable key stays an index signature either way.
+  const required = z.record(z.enum(["Tuna", "Salmon"]), z.string());
+  expectTypeOf<z.input<typeof required>>().toEqualTypeOf<Record<"Tuna" | "Salmon", string>>();
+  const indexed = z.record(z.string(), z.string().default("unknown"));
+  expectTypeOf<z.input<typeof indexed>>().toEqualTypeOf<Record<string, string | undefined>>();
+
+  // A catch and a preprocess pipe declare no static optin, so the key stays required even where the parser can fill it. The static predicate and the one the JSON Schema emitter uses resolve these differently, and the two have to keep agreeing.
+  const caught = z.record(z.enum(["Tuna", "Salmon"]), z.string().catch("unknown"));
+  expectTypeOf<z.input<typeof caught>>().toEqualTypeOf<Record<"Tuna" | "Salmon", string>>();
+  const preprocessed = z.record(
+    z.enum(["Tuna", "Salmon"]),
+    z.preprocess((v) => v, z.string())
+  );
+  expectTypeOf<z.input<typeof preprocessed>>().toEqualTypeOf<Record<"Tuna" | "Salmon", unknown>>();
+});
+
 test("typescript enum exhaustiveness", () => {
   enum BigFish {
     Tuna = 0,
@@ -402,6 +433,44 @@ test("is not vulnerable to prototype pollution", async () => {
   }
 });
 
+test("key schema cannot normalize an input key into __proto__", async () => {
+  const value = z.object({ a: z.string() });
+  const payload = { a: "evil" };
+  const wire = (key: string) => JSON.parse(JSON.stringify({ [key]: payload }));
+
+  const cases = [
+    [z.record(z.string().toLowerCase(), value), wire("__PROTO__")],
+    [z.record(z.string().trim(), value), wire(" __proto__ ")],
+    [z.record(z.string().normalize("NFKC"), value), wire("＿＿ｐｒｏｔｏ＿＿")],
+    [
+      z.record(
+        z.string().transform((s) => s.slice(2)),
+        value
+      ),
+      wire("x:__proto__"),
+    ],
+  ] as const;
+
+  for (const [schema, data] of cases) {
+    const result = schema.parse(data);
+    expect(Object.getPrototypeOf(result)).toBe(Object.prototype);
+    expect(Object.keys(result)).toEqual([]);
+    expect((result as any).a).toBeUndefined();
+
+    expect(Object.getPrototypeOf(await schema.parseAsync(data))).toBe(Object.prototype);
+  }
+
+  // an async value schema takes the promise write path
+  const asyncValue = z.record(
+    z.string().toLowerCase(),
+    value.refine(async () => true)
+  );
+  expect(Object.getPrototypeOf(await asyncValue.parseAsync(wire("__PROTO__")))).toBe(Object.prototype);
+
+  // ordinary normalization still lands as an own key
+  expect(z.record(z.string().toLowerCase(), value).parse({ KEY: payload })).toEqual({ key: payload });
+});
+
 test("dont remove undefined values", () => {
   const result1 = z.record(z.string(), z.any()).parse({ foo: undefined });
 
@@ -523,24 +592,12 @@ test("partialRecord with z.literal([key, ...])", () => {
     {
       "error": [ZodError: [
       {
-        "code": "invalid_key",
-        "origin": "record",
-        "issues": [
-          {
-            "code": "invalid_value",
-            "values": [
-              "id",
-              "name",
-              "email"
-            ],
-            "path": [],
-            "message": "Invalid option: expected one of \\"id\\"|\\"name\\"|\\"email\\""
-          }
-        ],
-        "path": [
+        "code": "unrecognized_keys",
+        "keys": [
           "foo"
         ],
-        "message": "Invalid key in record"
+        "path": [],
+        "message": "Unrecognized key: \\"foo\\""
       }
     ]],
       "success": false,
@@ -593,6 +650,45 @@ test("looseRecord passes through non-matching keys", () => {
   expect(schema.parse({ other: "value" })).toEqual({ other: "value" });
 });
 
+test("looseRecord with closed key schema passes through unrecognized keys", () => {
+  const enumSchema = z.looseRecord(z.enum(["foo", "bar"]), z.any());
+  expect(enumSchema.parse({ foo: 123, bar: {}, baz: null })).toEqual({
+    foo: 123,
+    bar: {},
+    baz: null,
+  });
+
+  const literalSchema = z.looseRecord(z.literal(["foo", "bar"]), z.any());
+  expect(literalSchema.parse({ foo: 123, bar: {}, baz: null })).toEqual({
+    foo: 123,
+    bar: {},
+    baz: null,
+  });
+
+  // Recognized keys are still validated
+  const validated = z.looseRecord(z.enum(["foo", "bar"]), z.string());
+  expect(validated.parse({ foo: "ok", bar: "ok", baz: 123 })).toEqual({
+    foo: "ok",
+    bar: "ok",
+    baz: 123,
+  });
+  expect(() => validated.parse({ foo: 123 })).toThrow();
+});
+
+test("record with closed key schema still rejects unrecognized keys", () => {
+  const schema = z.record(z.enum(["foo", "bar"]), z.any());
+  expect(schema.safeParse({ foo: 123, bar: {}, baz: null }).success).toBe(false);
+});
+
+// __proto__ in input must not replace the prototype of the parsed object via the assignment setter on the result {}. https://github.com/colinhacks/zod/security/advisories/GHSA-r34p-xfmx-58wv
+test("looseRecord with closed key schema drops __proto__", () => {
+  const schema = z.looseRecord(z.enum(["foo", "bar"]), z.any());
+  const parsed = schema.parse(JSON.parse('{"foo":1,"bar":2,"__proto__":{"isAdmin":true}}'));
+  expect(Object.keys(parsed)).toEqual(["foo", "bar"]);
+  expect((parsed as any).isAdmin).toBeUndefined();
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+});
+
 test("intersection of loose records", () => {
   const schema = z.intersection(
     z.object({ name: z.string() }).passthrough(),
@@ -706,8 +802,7 @@ test("v3-compat single-arg form: z.record(valueType)", () => {
   expect(withMessage.keyType._zod.def.type).toEqual("string");
   expect(withMessage.valueType._zod.def.type).toEqual("number");
 
-  // toJSONSchema should produce a well-formed schema (regression: previously produced
-  // additionalProperties from undefined valueType, crashing process())
+  // toJSONSchema should produce a well-formed schema (regression: previously produced additionalProperties from undefined valueType, crashing process())
   const json = z.toJSONSchema(schema);
   expect(json).toMatchObject({
     type: "object",
@@ -715,3 +810,76 @@ test("v3-compat single-arg form: z.record(valueType)", () => {
     additionalProperties: { type: "number" },
   });
 });
+
+test("__proto__ in a finite key set is stripped", () => {
+  const data = JSON.parse('{"__proto__":{"a":"declared"},"b":{"a":"good"}}');
+
+  for (const schema of [
+    z.record(z.enum(["__proto__", "b"]), z.object({ a: z.string() })),
+    z.record(z.literal(["__proto__", "b"]), z.object({ a: z.string() })),
+  ]) {
+    const parsed: any = schema.parse(data);
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+    expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+    expect(Object.keys(parsed)).toEqual(["b"]);
+    expect(parsed.a).toBeUndefined();
+  }
+
+  expect(({} as any).a).toBeUndefined();
+});
+
+test("a raw __proto__ input key stays skipped in loose mode", () => {
+  const parsed: any = z.looseRecord(z.iso.datetime(), z.unknown()).parse(JSON.parse('{"__proto__":{"a":1}}'));
+
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+});
+
+test("partialRecord strips a declared __proto__ key", () => {
+  const schema = z.partialRecord(z.enum(["__proto__", "b"]), z.string());
+  const parsed: any = schema.parse(Object.fromEntries([["__proto__", "declared"]]));
+
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+  expect(parsed).toEqual({});
+  expect(schema.parse({})).toEqual({});
+  expect(schema.safeParse({ other: "x" }).success).toBe(false);
+});
+
+test("partialRecord strips a declared __proto__ key in loose mode", () => {
+  const key = z.enum(["__proto__"]).refine(() => false);
+  const schema = z.partialRecord(key, z.unknown(), { mode: "loose" });
+  const value = { marker: true };
+  const parsed: any = schema.parse(Object.fromEntries([["__proto__", value]]));
+
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+  expect(parsed).toEqual({});
+  expect(parsed.marker).toBeUndefined();
+});
+
+test("partial is internal to partialRecord", () => {
+  // @ts-expect-error partial is not a public record parameter
+  z.record(z.enum(["a"]), z.string(), { partial: true });
+
+  const schema = z.partialRecord(z.enum(["a"]), z.string(), { partial: false } as any);
+  expect(schema.parse({})).toEqual({});
+});
+
+test("partialRecord strips a declared __proto__ key before transforms", () => {
+  const schema = z.partialRecord(
+    z.literal("__proto__").transform(() => "safe" as const),
+    z.string()
+  );
+
+  expect(schema.parse(Object.fromEntries([["__proto__", "value"]]))).toEqual({});
+});
+
+test("a finite __proto__ key is ignored whether present or missing", () => {
+  const schema = z.record(z.enum(["__proto__"]), z.string());
+  const parsed: any = schema.parse({});
+
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+  expect(schema.parse(Object.fromEntries([["__proto__", 123]]))).toEqual({});
+});

package/node_modules/zod/src/v4/classic/tests/recursive-types.test.ts

@@ -135,8 +135,7 @@ test("pick and omit with getter", () => {
   }
   expectTypeOf<Category>().toEqualTypeOf<_Category>();
 
-  // Shape should not surface `readonly` modifiers from getter-defined keys.
-  // object/strictObject/looseObject all pass shape through util.Writeable<T>.
+  // Shape should not surface `readonly` modifiers from getter-defined keys. object/strictObject/looseObject all pass shape through util.Writeable<T>.
   type Shape = (typeof Category)["shape"];
   expectTypeOf<Shape>().toEqualTypeOf<{ name: z.ZodString; subcategories: z.ZodArray<typeof Category> }>();
 
@@ -629,3 +628,35 @@ test("recursive type with `id` meta", () => {
     },
   });
 });
+
+test("mutual recursion through discriminatedUnion getter", () => {
+  const variantA = z.object({
+    kind: z.literal("a"),
+    get child() {
+      return tree.optional();
+    },
+  });
+
+  const variantB = z.object({
+    kind: z.literal("b"),
+    get sibling() {
+      return tree.optional();
+    },
+  });
+
+  const tree = z.discriminatedUnion("kind", [variantA, variantB]);
+
+  type _Tree = { kind: "a"; child?: _Tree | undefined } | { kind: "b"; sibling?: _Tree | undefined };
+
+  const treeUnion = z.union([variantA, variantB]);
+
+  expectTypeOf<z.input<typeof tree>>().toEqualTypeOf<_Tree>();
+  expectTypeOf<z.input<typeof tree>>().not.toBeAny();
+  expectTypeOf<z.input<typeof tree>>().toEqualTypeOf<z.input<typeof treeUnion>>();
+
+  expect(tree.parse({ kind: "a", child: { kind: "b", sibling: { kind: "a" } } })).toEqual({
+    kind: "a",
+    child: { kind: "b", sibling: { kind: "a" } },
+  });
+  expect(() => tree.parse({ kind: "c" })).toThrow();
+});

package/node_modules/zod/src/v4/classic/tests/redos.test.ts

@@ -0,0 +1,68 @@
+import { checkSync } from "recheck";
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+
+const { regexes } = z.core;
+
+/** Every pattern `core/regexes.ts` ships, with the parameterized ones materialized across their argument space. */
+function allPatterns(): [string, RegExp][] {
+  const patterns: [string, RegExp][] = [];
+  for (const [name, value] of Object.entries(regexes)) {
+    if (value instanceof RegExp) patterns.push([name, value]);
+  }
+
+  patterns.push(
+    ["emoji()", regexes.emoji()],
+    ["mac()", regexes.mac()],
+    ["mac('-')", regexes.mac("-")],
+    ["uuid()", regexes.uuid()],
+    ["string()", regexes.string()],
+    ["string({min,max})", regexes.string({ minimum: 1, maximum: 10 })]
+  );
+  for (const version of [1, 2, 3, 4, 5, 6, 7, 8]) patterns.push([`uuid(${version})`, regexes.uuid(version)]);
+  for (const precision of [null, -1, 0, 3, 6]) {
+    patterns.push([`time(${precision})`, regexes.time({ precision })]);
+    for (const local of [false, true]) {
+      for (const offset of [false, true]) {
+        patterns.push([`datetime(${precision},${local},${offset})`, regexes.datetime({ precision, local, offset })]);
+      }
+    }
+  }
+  return patterns;
+}
+
+test("no built-in pattern is ReDoS-vulnerable", () => {
+  const patterns = allPatterns();
+  // Guards against the reflection above silently going empty if the module layout changes.
+  expect(patterns.length).toBeGreaterThan(80);
+
+  const vulnerable: string[] = [];
+  for (const [name, pattern] of patterns) {
+    // Flags are load-bearing. Without "u" the checker reads `\p{...}` as a literal `p{...}` and reports an exponential pattern as safe.
+    const result = checkSync(pattern.source, pattern.flags);
+    // "unknown" means the checker gave up, not that the pattern is vulnerable.
+    if (result.status !== "vulnerable") continue;
+    // The fuzz checker derives "vulnerable" from how long an attack string runs, so CPU contention from parallel test files can flip a safe pattern. Confirm with a budget large enough that only real backtracking can exhaust it.
+    const confirmed = checkSync(pattern.source, pattern.flags, { attackTimeout: 10_000 });
+    if (confirmed.status === "vulnerable") vulnerable.push(`${name}: ${pattern.source}`);
+  }
+  expect(vulnerable).toEqual([]);
+}, 60000);
+
+test("emoji rejects a backtracking payload in linear time", () => {
+  // U+1F9B0-U+1F9B3 are the only code points in both \p{Extended_Pictographic} and \p{Emoji_Component}. A failing match over them used to backtrack exponentially: 26 of them took ~1.9s, and each additional character roughly doubled it.
+  const schema = z.emoji();
+  const payload = `${"🦰".repeat(26)} `;
+
+  // Warm up first, then take the best of three: a cold first call is dominated by JIT and can cost hundreds of times the steady-state match on a loaded machine.
+  expect(schema.safeParse(payload).success).toBe(false);
+  let best = Number.POSITIVE_INFINITY;
+  for (let i = 0; i < 3; i++) {
+    const start = performance.now();
+    schema.safeParse(payload);
+    best = Math.min(best, performance.now() - start);
+  }
+
+  // The linear pattern matches in well under a millisecond, so this budget leaves three orders of magnitude of headroom for CPU contention while still catching the exponential regression.
+  expect(best).toBeLessThan(500);
+});

package/node_modules/zod/src/v4/classic/tests/refine.test.ts

@@ -338,6 +338,66 @@ describe("superRefine functionality", () => {
     }
   });
 
+  test("should preserve explicit nullish issue input", () => {
+    const schema = z.string().superRefine((_, ctx) => {
+      ctx.addIssue({ code: "custom", message: "default" });
+      ctx.addIssue({ code: "custom", message: "null", input: null });
+      ctx.addIssue({ code: "custom", message: "undefined", input: undefined });
+    });
+
+    const result = schema.safeParse("sensitive", { reportInput: true });
+    expect(result.success).toEqual(false);
+    if (!result.success) {
+      expect(result.error.issues).toHaveLength(3);
+      expect(result.error.issues[0].input).toEqual("sensitive");
+      expect(result.error.issues[1].input).toEqual(null);
+      expect(result.error.issues[2]).toHaveProperty("input");
+      expect(result.error.issues[2].input).toEqual(undefined);
+    }
+  });
+
+  test("should keep issue input aligned with the issue path", () => {
+    const nested = z.object({ a: z.string().nullable() }).superRefine((val, ctx) => {
+      if (val.a === null) ctx.addIssue({ code: "custom", path: ["a"], input: val.a, message: "no null" });
+    });
+
+    const direct = nested.safeParse({ a: null }, { reportInput: true });
+    expect(direct.success).toEqual(false);
+    if (!direct.success) {
+      expect(direct.error.issues[0].path).toEqual(["a"]);
+      expect(direct.error.issues[0].input).toEqual(null);
+    }
+
+    // Forwarding a nested parse's issues must not overwrite their input with the outer payload.
+    const inner = z.object({ x: z.string() });
+    const forwarding = z.unknown().superRefine((val, ctx) => {
+      const result = inner.safeParse(val, { reportInput: true });
+      if (!result.success) {
+        for (const iss of result.error.issues) {
+          ctx.addIssue({ code: "custom", path: iss.path, input: iss.input, message: iss.message });
+        }
+      }
+    });
+
+    const forwarded = forwarding.safeParse({}, { reportInput: true });
+    expect(forwarded.success).toEqual(false);
+    if (!forwarded.success) {
+      expect(forwarded.error.issues[0].path).toEqual(["x"]);
+      expect(forwarded.error.issues[0]).toHaveProperty("input");
+      expect(forwarded.error.issues[0].input).toEqual(undefined);
+    }
+  });
+
+  test("should surface an explicit undefined input to the error map", () => {
+    const schema = z.object({ a: z.string().optional() }).superRefine((val, ctx) => {
+      if (!val.a) ctx.addIssue({ code: "custom", path: ["a"], input: val.a });
+    });
+
+    const result = schema.safeParse({}, { error: (iss) => (iss.input === undefined ? "Required" : "Invalid") });
+    expect(result.success).toEqual(false);
+    if (!result.success) expect(result.error.issues[0].message).toEqual("Required");
+  });
+
   test("should respect fatal flag in superRefine", () => {
     const schema = z
       .string()

package/node_modules/zod/src/v4/classic/tests/set.test.ts

@@ -85,6 +85,15 @@ test("failing when set is bigger than max() ", () => {
   expect(result.error!.issues[0].code).toEqual("too_big");
 });
 
+test("failing when set does not match size() ", () => {
+  expect(justTwo.safeParse(new Set(["one"])).error!.issues[0].message).toEqual(
+    "Too small: expected set to have exactly 2 items"
+  );
+  expect(justTwo.safeParse(new Set(["one", "two", "three"])).error!.issues[0].message).toEqual(
+    "Too big: expected set to have exactly 2 items"
+  );
+});
+
 test("doesn’t throw when an empty set is given", () => {
   const result = stringSet.safeParse(new Set([]));
   expect(result.success).toEqual(true);