@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/node_modules/zod/src/v4/core/tests/email-regex.test.ts

@@ -0,0 +1,140 @@
+import { expect, test } from "vitest";
+
+import { regexes } from "zod/v4/core";
+
+// the lookahead form `regexes.email` had before this rewrite
+const legacy = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+
+const table: [string, boolean][] = [
+  ["a@b.cc", true],
+  ["first.last@example.com", true],
+  ["a.b.c.d@b.cc", true],
+  ["'a@b.cc", true],
+  ["a'b@b.cc", true],
+  ["a+b@b.cc", true],
+  ["a-@b.cc", true],
+  ["a_@b.cc", true],
+  ["a@0b.cc", true],
+  ["a@b.c.dd", true],
+  ["a@b-.cc", true],
+  [".a@b.cc", false],
+  ["a.@b.cc", false],
+  ["a..b@b.cc", false],
+  ["....@b.cc", false],
+  ["a@b..cc", false],
+  ["a@.b.cc", false],
+  ["a@b.cc.", false],
+  ["a'@b.cc", false],
+  ["'@b.cc", false],
+  ["@b.cc", false],
+  ["a@b.c", false],
+  ["a@b.c0", false],
+  ["a@-b.cc", false],
+  ["a@b.cc@d.ee", false],
+  ["a b@b.cc", false],
+  ["café@b.cc", false],
+  ["😀@b.cc", false],
+  ["a\0@b.cc", false],
+  // `$` is not multiline, so no trailing terminator is tolerated
+  ["a@b.cc\n", false],
+  ["a@b.cc\r", false],
+  ["\na@b.cc", false],
+];
+
+test("boundary cases", () => {
+  for (const [input, expected] of table) {
+    expect([input, regexes.email.test(input)]).toEqual([input, expected]);
+    expect([input, legacy.test(input)]).toEqual([input, expected]);
+  }
+});
+
+// one representative per character class the two grammars can tell apart
+const classes = ["a", "0", "_", "'", "-", ".", "@", "!", "\n"];
+
+test("exhaustive agreement over every string of length <= 6 in the class alphabet", () => {
+  const idx: number[] = [];
+  let accepted = 0;
+  for (let len = 0; len <= 6; len++) {
+    idx.length = len;
+    idx.fill(0);
+    for (;;) {
+      let s = "";
+      for (let i = 0; i < len; i++) s += classes[idx[i]!];
+      const a = legacy.test(s);
+      if (a !== regexes.email.test(s)) expect.unreachable(`disagreement on ${JSON.stringify(s)}`);
+      if (a) accepted++;
+      let p = len - 1;
+      while (p >= 0 && ++idx[p]! === classes.length) idx[p--] = 0;
+      if (p < 0) break;
+    }
+  }
+  // 4 chars can precede `@`, 2 can open a domain label, 1 is a letter for the TLD
+  expect(accepted).toBe(8);
+});
+
+function rng(seed: number) {
+  let s = seed >>> 0;
+  return () => {
+    s = (s + 0x6d2b79f5) >>> 0;
+    let t = s;
+    t = Math.imul(t ^ (t >>> 15), t | 1);
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+const local = "abZ09_'+-.".split("");
+const domain = "abZ09-.".split("");
+const hostile = ["@", ".", "..", "...", "\n", "\r", "\0", "\t", " ", '"', "é", "😀", "\\", "<", ";", "/", "{"];
+const any = [...local, ...domain, ...hostile];
+
+function fuzz(r: () => number): string {
+  const pick = <T>(xs: T[]): T => xs[Math.floor(r() * xs.length)]!;
+  const run = (xs: string[], max: number) => {
+    let out = "";
+    for (let i = Math.floor(r() * max); i > 0; i--) out += pick(xs);
+    return out;
+  };
+  switch (Math.floor(r() * 8)) {
+    case 0:
+      return run(any, 40);
+    case 1:
+      return `${run(local, 24)}@${run(domain, 24)}`;
+    case 2:
+      return `${run(local, 8)}${".".repeat(1 + Math.floor(r() * 6))}${run(local, 8)}@${run(domain, 12)}`;
+    case 3:
+      return `${run(local, 8)}@${run(domain, 8)}${".".repeat(1 + Math.floor(r() * 6))}${run(domain, 8)}`;
+    case 4: {
+      // single-character mutation of a valid address
+      const base = `${run("abZ09_'+-".split(""), 10)}@example.com`;
+      const i = Math.floor(r() * base.length);
+      return Math.floor(r() * 3) === 0
+        ? base.slice(0, i) + pick(any) + base.slice(i)
+        : base.slice(0, i) + (Math.floor(r() * 2) ? pick(any) : "") + base.slice(i + 1);
+    }
+    case 5:
+      return (
+        "a".repeat(1 + Math.floor(r() * 60)) +
+        ".".repeat(Math.floor(r() * 4)) +
+        run(local, 4) +
+        (r() < 0.5 ? "@" : "") +
+        run(domain, 10)
+      );
+    case 6:
+      return `${run(local, 8)}@${run(domain, 6)}@${run(domain, 8)}`;
+    default:
+      return pick(["", "\n", " "]) + run(local, 8) + "@example.com" + pick(["", "\n", "\r\n", " ", "\0"]);
+  }
+}
+
+test("differential fuzz", () => {
+  const r = rng(0x5eed);
+  let accepted = 0;
+  for (let i = 0; i < 25_000; i++) {
+    const s = fuzz(r);
+    const a = legacy.test(s);
+    if (a !== regexes.email.test(s)) expect.unreachable(`disagreement on ${JSON.stringify(s)}`);
+    if (a) accepted++;
+  }
+  expect(accepted).toBeGreaterThan(500);
+});

package/node_modules/zod/src/v4/core/tests/locales/el.test.ts

@@ -204,8 +204,7 @@ test("Greek locale - other error cases", () => {
 test("Greek locale - invalid_type with instanceof (class-name expected)", () => {
   z.config(el());
 
-  // When `expected` starts with a capital letter, render an `instanceof` message,
-  // matching the convention used by most other locales (de, es, fr, it, etc.).
+  // When `expected` starts with a capital letter, render an `instanceof` message, matching the convention used by most other locales (de, es, fr, it, etc.).
   const dateSchema = z.instanceof(Date);
   const dateResult = dateSchema.safeParse("not a date");
   expect(dateResult.success).toBe(false);

package/node_modules/zod/src/v4/core/tests/locales/es.test.ts

@@ -109,8 +109,7 @@ test("Spanish locale - type name translations in invalid_type errors", () => {
 test("Spanish locale - fallback for unknown type names", () => {
   z.config(es());
 
-  // Test with a type that's not in the TypeNames dictionary
-  // This will test the fallback behavior
+  // Test with a type that's not in the TypeNames dictionary. This will test the fallback behavior
   const dateSchema = z.date().min(new Date("2025-01-01"));
   const dateResult = dateSchema.safeParse(new Date("2024-01-01"));
   expect(dateResult.success).toBe(false);

package/node_modules/zod/src/v4/core/tests/locales/fr.test.ts

@@ -8,7 +8,7 @@ test("French locale - type name translations in too_small errors", () => {
   const stringResult = z.string().min(5).safeParse("abc");
   expect(stringResult.success).toBe(false);
   if (!stringResult.success) {
-    expect(stringResult.error.issues[0].message).toBe("Trop petit : chaîne doit avoir >=5 caractères");
+    expect(stringResult.error.issues[0].message).toBe("Trop petit : chaîne de caractères doit avoir >=5 caractères");
   }
 
   const numberResult = z.number().min(10).safeParse(5);
@@ -39,7 +39,7 @@ test("French locale - type name translations in too_big errors", () => {
   const stringResult = z.string().max(3).safeParse("abcde");
   expect(stringResult.success).toBe(false);
   if (!stringResult.success) {
-    expect(stringResult.error.issues[0].message).toBe("Trop grand : chaîne doit avoir <=3 caractères");
+    expect(stringResult.error.issues[0].message).toBe("Trop grand : chaîne de caractères doit avoir <=3 caractères");
   }
 
   const numberResult = z.number().max(10).safeParse(15);
@@ -61,7 +61,7 @@ test("French locale - type name translations in invalid_type errors", () => {
   const stringResult = z.string().safeParse(123);
   expect(stringResult.success).toBe(false);
   if (!stringResult.success) {
-    expect(stringResult.error.issues[0].message).toBe("Entrée invalide : chaîne attendu, nombre reçu");
+    expect(stringResult.error.issues[0].message).toBe("Entrée invalide : chaîne de caractères attendu, nombre reçu");
   }
 
   const arrayResult = z.array(z.string()).safeParse({});

package/node_modules/zod/src/v4/core/tests/locales/parity.test.ts

@@ -0,0 +1,42 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { expect, test } from "vitest";
+import { z } from "../../../../index.js";
+
+// Every locale must carry an entry for each key `en` translates. Four keys have drifted this way already — `credit_card` (#5931), `mac` (#5440), `Sizable.map` (#5316) and Hebrew's `uuidv4`/`uuidv6`/`template_literal` — each shipped in `en` and left the rest behind, so the gap only surfaced as a raw key in a user's error message.
+//
+// The key lists are read out of `en.ts` rather than hardcoded, so adding a format to `en` extends this test automatically. That is the whole point: a hand-maintained list here would miss the next one exactly the way the last four were missed.
+
+const enSource = readFileSync(fileURLToPath(new URL("../../../locales/en.ts", import.meta.url)), "utf8");
+
+function keysOf(block: string): string[] {
+  const body = enSource.match(new RegExp(`const ${block}[^=]*= \\{([\\s\\S]*?)\\n  \\};`))?.[1];
+  if (!body) throw new Error(`could not read ${block} out of en.ts`);
+  return [...body.matchAll(/^\s{4}([a-z_0-9]+):/gm)].map((m) => m[1]!);
+}
+
+const locales = z.locales as unknown as Record<string, () => { localeError: z.core.$ZodErrorMap }>;
+const names = Object.keys(locales).filter((k) => typeof locales[k] === "function");
+const SENTINEL = "zzsentinelzz";
+
+/** True when the locale has no entry for `key`: the message is what the sentinel produces. */
+function fallsThrough(locale: string, key: string, build: (k: string) => unknown): boolean {
+  const map = locales[locale]!().localeError as (iss: unknown) => string | undefined;
+  const real = String(map(build(key)) ?? "");
+  const sentinel = String(map(build(SENTINEL)) ?? "");
+  return real === sentinel.split(SENTINEL).join(key);
+}
+
+const asFormat = (k: string) => ({ code: "invalid_format", format: k, input: "x", path: [] });
+const asSize = (k: string) => ({ code: "too_small", origin: k, minimum: 2, inclusive: true, input: null, path: [] });
+
+test.each([
+  ["FormatDictionary", keysOf("FormatDictionary"), asFormat],
+  ["Sizable", keysOf("Sizable"), asSize],
+] as const)("every locale translates each %s key that en translates", (_block, keys, build) => {
+  // A key `en` maps to its own name (emoji, nanoid, cuid, cuid2) renders identically whether or not a locale defines it, so omitting it is not drift.
+  const required = keys.filter((k) => !fallsThrough("en", k, build));
+  const gaps = required.flatMap((k) => names.filter((n) => fallsThrough(n, k, build)).map((n) => `${n}.${k}`));
+
+  expect(gaps).toEqual([]);
+});

package/node_modules/zod/src/v4/core/tests/locales/tg.test.ts

@@ -0,0 +1,85 @@
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+
+test("locales - tg", () => {
+  z.config(z.locales.tg());
+
+  const invalidType = z.number().safeParse("a");
+  expect(invalidType.error!.issues[0].code).toBe("invalid_type");
+  expect(invalidType.error!.issues[0].message).toBe("Вуруди нодуруст: рақам интизор мерафт, сатр гирифта шуд");
+
+  const invalidType2 = z.string().safeParse(1);
+  expect(invalidType2.error!.issues[0].code).toBe("invalid_type");
+  expect(invalidType2.error!.issues[0].message).toBe("Вуруди нодуруст: сатр интизор мерафт, рақам гирифта шуд");
+
+  const invalidValue = z.enum(["a", "b"]).safeParse(1);
+  expect(invalidValue.error!.issues[0].code).toBe("invalid_value");
+  expect(invalidValue.error!.issues[0].message).toBe('Интихоби нодуруст: яке аз "a"|"b" интизор мерафт');
+
+  const tooBig = z.number().max(10).safeParse(15);
+  expect(tooBig.error!.issues[0].code).toBe("too_big");
+  expect(tooBig.error!.issues[0].message).toBe("Хеле калон: number бояд <=10 бошад");
+
+  const tooSmall = z.number().min(10).safeParse(5);
+  expect(tooSmall.error!.issues[0].code).toBe("too_small");
+  expect(tooSmall.error!.issues[0].message).toBe("Хеле хурд: number бояд >=10 бошад");
+
+  // singular units after numerals in Tajik
+  const tooShort = z.string().min(5).safeParse("hi");
+  expect(tooShort.error!.issues[0].message).toBe("Хеле хурд: string бояд >=5 аломат дошта бошад");
+
+  const tooFewItems = z.array(z.number()).min(2).safeParse([1]);
+  expect(tooFewItems.error!.issues[0].message).toBe("Хеле хурд: array бояд >=2 унсур дошта бошад");
+
+  const invalidEmail = z.string().email().safeParse("nope");
+  expect(invalidEmail.error!.issues[0].code).toBe("invalid_format");
+  expect(invalidEmail.error!.issues[0].message).toBe("суроғаи email-и нодуруст");
+
+  const invalidStart = z.string().startsWith("ab").safeParse("xy");
+  expect(invalidStart.error!.issues[0].message).toBe('Сатри нодуруст: бояд бо "ab" оғоз шавад');
+
+  const invalidRegex = z.string().regex(/abcd/).safeParse("xy");
+  expect(invalidRegex.error!.issues[0].message).toContain("мувофиқат кунад");
+
+  const notMultipleOf = z.number().multipleOf(5).safeParse(7);
+  expect(notMultipleOf.error!.issues[0].message).toBe("Рақами нодуруст: бояд ба 5 бе бақия тақсим шавад");
+
+  const oneUnknownKey = z.strictObject({ a: z.string() }).safeParse({ a: "x", b: 1 });
+  expect(oneUnknownKey.error!.issues[0].message).toBe('Калиди номаълум: "b"');
+
+  const twoUnknownKeys = z.strictObject({ a: z.string() }).safeParse({ a: "x", b: 1, c: 2 });
+  expect(twoUnknownKeys.error!.issues[0].message).toBe('Калидҳои номаълум: "b", "c"');
+
+  const cases: [z.ZodType, unknown, string][] = [
+    [z.literal("a"), "b", 'Вуруди нодуруст: "a" интизор мерафт'],
+    [z.boolean(), null, "Вуруди нодуруст: boolean интизор мерафт, null гирифта шуд"],
+    [z.number(), Number.NaN, "Вуруди нодуруст: рақам интизор мерафт, NaN гирифта шуд"],
+    [z.number().lt(10), 10, "Хеле калон: number бояд <10 бошад"],
+    [z.number().gt(10), 10, "Хеле хурд: number бояд >10 бошад"],
+    [z.string().max(1), "ab", "Хеле калон: string бояд <=1 аломат дошта бошад"],
+    [z.set(z.string()).min(1), new Set(), "Хеле хурд: set бояд >=1 унсур дошта бошад"],
+    [z.map(z.string(), z.number()).min(1), new Map(), "Хеле хурд: map бояд >=1 сабт дошта бошад"],
+    [z.file().min(1), new File([], "empty"), "Хеле хурд: file бояд >=1 байт дошта бошад"],
+    [z.string().endsWith("ab"), "xy", 'Сатри нодуруст: бояд бо "ab" анҷом ёбад'],
+    [z.string().includes("ab"), "xy", 'Сатри нодуруст: бояд "ab"-ро дар бар гирад'],
+    [z.stringFormat("custom", () => false), "xy", "custom-и нодуруст"],
+    [z.union([z.string(), z.number()]), null, "Вуруди нодуруст"],
+    [
+      z.discriminatedUnion("kind", [z.object({ kind: z.literal("a") }), z.object({ kind: z.literal("b") })]),
+      { kind: "c" },
+      "Қимати нодурусти дискриминатор: 'a' | 'b' интизор мерафт",
+    ],
+    [z.record(z.string().min(2), z.number()), { a: 1 }, "Калиди нодуруст дар record"],
+    [z.map(z.string(), z.number()), new Map([[{}, 1]]), "Калиди нодуруст дар map"],
+    [z.map(z.object({}), z.number()), new Map([[{}, "a"]]), "Қимати нодуруст дар map"],
+    [z.custom(() => false), "a", "Вуруди нодуруст"],
+  ];
+  for (const [schema, input, message] of cases) {
+    expect(schema.safeParse(input).error!.issues[0].message).toBe(message);
+  }
+
+  expect(z.object({ name: z.string().min(1), age: z.number().min(0) }).parse({ name: "Ali", age: 30 })).toEqual({
+    name: "Ali",
+    age: 30,
+  });
+});

package/node_modules/zod/src/v4/core/tests/locales/tk.test.ts

@@ -0,0 +1,69 @@
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+import { parsedType } from "../../util.js";
+
+test("parsedType", () => {
+  expect(parsedType("string")).toBe("string");
+  expect(parsedType(1)).toBe("number");
+  expect(parsedType(true)).toBe("boolean");
+  expect(parsedType(null)).toBe("null");
+  expect(parsedType(undefined)).toBe("undefined");
+  expect(parsedType([])).toBe("array");
+  expect(parsedType({})).toBe("object");
+  expect(parsedType(new Date())).toBe("Date");
+  expect(parsedType(new Map())).toBe("Map");
+  expect(parsedType(new Set())).toBe("Set");
+  expect(parsedType(new Error())).toBe("Error");
+
+  const nullPrototype = Object.create(null);
+  expect(parsedType(nullPrototype)).toBe("object");
+
+  const doubleNullPrototype = Object.create(Object.create(null));
+  expect(parsedType(doubleNullPrototype)).toBe("object");
+
+  expect(parsedType(Number.NaN)).toBe("nan");
+});
+
+test("locales - tk", () => {
+  z.config(z.locales.tk());
+
+  const invalidType = z.number().safeParse("a");
+  expect(invalidType.error!.issues[0].code).toBe("invalid_type");
+  expect(invalidType.error!.issues[0].message).toBe("Nädogry baha: garaşylan number ýerine string alyndy");
+
+  const invalidType2 = z.string().safeParse(1);
+  expect(invalidType2.error!.issues[0].code).toBe("invalid_type");
+  expect(invalidType2.error!.issues[0].message).toBe("Nädogry baha: garaşylan string ýerine number alyndy");
+
+  const invalidValue = z.enum(["a", "b"]).safeParse(1);
+  expect(invalidValue.error!.issues[0].code).toBe("invalid_value");
+  expect(invalidValue.error!.issues[0].message).toBe('Nädogry saýlaw: aşakdakylardan biri bolmaly: "a"|"b"');
+
+  const tooBig = z.number().max(10).safeParse(15);
+  expect(tooBig.error!.issues[0].code).toBe("too_big");
+  expect(tooBig.error!.issues[0].message).toBe("Has uly: garaşylýan number <= 10");
+
+  const tooSmall = z.number().min(10).safeParse(5);
+  expect(tooSmall.error!.issues[0].code).toBe("too_small");
+  expect(tooSmall.error!.issues[0].message).toBe("Has kiçi: garaşylýan number >= 10");
+
+  const invalidFormatRegex = z.string().regex(/abcd/).safeParse("invalid-string");
+  expect(invalidFormatRegex.error!.issues[0].code).toBe("invalid_format");
+  expect(invalidFormatRegex.error!.issues[0].message).toBe("Nädogry setir: /abcd/ nusga laýyk bolmaly");
+
+  const invalidFormatStartsWith = z.string().startsWith("abcd").safeParse("invalid-string");
+  expect(invalidFormatStartsWith.error!.issues[0].code).toBe("invalid_format");
+  expect(invalidFormatStartsWith.error!.issues[0].message).toBe('Nädogry setir: "abcd" bilen başlamaly');
+
+  const notMultipleOf = z.number().multipleOf(3).safeParse(10);
+  expect(notMultipleOf.error!.issues[0].code).toBe("not_multiple_of");
+  expect(notMultipleOf.error!.issues[0].message).toBe("Nädogry san: 3 bilen galyndysyz bölünmeli");
+
+  const unrecognizedKeys = z.object({ a: z.string(), b: z.number() }).strict().safeParse({ a: "a", b: 1, c: 2 });
+  expect(unrecognizedKeys.error!.issues[0].code).toBe("unrecognized_keys");
+  expect(unrecognizedKeys.error!.issues[0].message).toBe('Tanalmaýan açar: "c"');
+
+  const invalidUnion = z.union([z.string(), z.number()]).safeParse(true);
+  expect(invalidUnion.error!.issues[0].code).toBe("invalid_union");
+  expect(invalidUnion.error!.issues[0].message).toBe("Nädogry baha");
+});

package/node_modules/zod/src/v4/core/tests/polyfill-collision.test.ts

@@ -0,0 +1,46 @@
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { build, transform } from "esbuild";
+import { expect, test } from "vitest";
+import * as core from "zod/v4/core";
+
+// Browser polyfills for node globals land as raw text in the bundle's top scope — an esbuild `banner`, a scope-unaware injector — so the bundler never sees the collision and the browser is the first thing to read both declarations. zod must therefore declare none of these names at module scope. The JSON Schema pass shipped an `export function process` for three minors before #6397 reported the white screen it caused.
+const INJECTED = ["process", "Buffer", "global", "__dirname", "__filename"];
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const CLASSIC = path.resolve(here, "../../../index.ts");
+const MINI = path.resolve(here, "../../../mini/index.ts");
+
+const polyfills = INJECTED.map((name) => `const ${name} = {};`).join("\n");
+
+// toJSONSchema has to be reachable: a bundle that only parses a schema tree-shakes the offending module away and would pass no matter what it declares. `z.core.process` is the pre-rename export name, read as a namespace property so the entry itself declares no `process` binding.
+const ENTRY = `import * as z from "%ENTRY%";\nglobalThis.__out = [z.toJSONSchema(z.string()), z.core.process];`;
+
+test.each([
+  ["classic", CLASSIC],
+  ["mini", MINI],
+])(
+  "a %s bundle reaching toJSONSchema parses beside polyfilled node globals",
+  async (_flavor, entrypoint) => {
+    const result = await build({
+      stdin: { contents: ENTRY.replace("%ENTRY%", entrypoint), loader: "ts", resolveDir: here },
+      bundle: true,
+      format: "esm",
+      target: "es2020",
+      write: false,
+      logLevel: "silent",
+      banner: { js: polyfills },
+    });
+    const out = result.outputFiles[0]!.text;
+
+    expect(out).toContain("https://json-schema.org/draft/2020-12/schema");
+
+    // the banner is appended after esbuild has already renamed its own symbols, so this second pass is where a duplicate surfaces: `The symbol "process" has already been declared`
+    await expect(transform(out, { loader: "js", format: "esm" })).resolves.toBeTruthy();
+  },
+  30000
+);
+
+test("the pre-rename `process` export still resolves to the helper", () => {
+  expect(core.process).toBe(core.processSchema);
+});

package/node_modules/zod/src/v4/core/tests/treeshake.test.ts

@@ -0,0 +1,51 @@
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { build } from "esbuild";
+import { expect, test } from "vitest";
+
+// These declarations are unreachable from a minimal schema, but esbuild only drops them because of details that read as noise: `@__PURE__` annotations, and the `anchor()` helper in regexes.ts that exists solely because esbuild will not drop an annotated call whose argument interpolates a variable. Inlining the helper or deleting an annotation silently puts them back with no other test going red.
+//
+// Rollup drops all of these regardless, so a rollup fixture would report no difference and prove nothing. This has to run under esbuild.
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const MINI = path.resolve(here, "../../../mini/index.ts");
+const CLASSIC = path.resolve(here, "../../../index.ts");
+
+async function bundle(entrypoint: string, source: string): Promise<string> {
+  const result = await build({
+    stdin: {
+      contents: source.replace("%ENTRY%", entrypoint),
+      loader: "ts",
+      resolveDir: here,
+    },
+    bundle: true,
+    minify: true,
+    format: "esm",
+    target: "es2020",
+    treeShaking: true,
+    write: false,
+    logLevel: "silent",
+  });
+  return result.outputFiles[0]!.text;
+}
+
+test("a minimal zod/mini schema drops the declarations it cannot reach", async () => {
+  const out = await bundle(MINI, `import * as z from "%ENTRY%";\nconsole.log(z.boolean().parse(true));`);
+
+  // Sanity check: the schema itself is present, so an empty bundle cannot pass this test.
+  expect(out).toContain("boolean");
+
+  expect(out, "core.ts `$brand` lost its @__PURE__ annotation").not.toContain("zod_brand");
+  expect(out, "util.ts `NUMBER_FORMAT_RANGES` escaped its @__PURE__ IIFE").not.toContain("MAX_SAFE_INTEGER");
+  expect(out, "regexes.ts `date` is pinned again — was `anchor()` inlined?").not.toContain("02-29");
+}, 30000);
+
+// `registries.ts` is dropped from the mini module graph entirely, so its two symbols are absent there before and after. Classic is the entrypoint that exercises them.
+test("a minimal classic schema drops the registry symbols", async () => {
+  const out = await bundle(CLASSIC, `import * as z from "%ENTRY%";\nconsole.log(z.boolean().parse(true));`);
+
+  expect(out).toContain("boolean");
+
+  expect(out, "registries.ts `$output` lost its @__PURE__ annotation").not.toContain("ZodOutput");
+  expect(out, "registries.ts `$input` lost its @__PURE__ annotation").not.toContain("ZodInput");
+}, 30000);

package/node_modules/zod/src/v4/core/tests/url-no-canparse.test.ts

@@ -0,0 +1,133 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
+
+const URLDescriptor = Object.getOwnPropertyDescriptor(globalThis, "URL")!;
+const NativeURL = globalThis.URL;
+const canParseDescriptor = Object.getOwnPropertyDescriptor(NativeURL, "canParse")!;
+const parseDescriptor = Object.getOwnPropertyDescriptor(NativeURL, "parse")!;
+
+function restoreURL() {
+  Object.defineProperty(globalThis, "URL", URLDescriptor);
+  Object.defineProperty(NativeURL, "canParse", canParseDescriptor);
+  Object.defineProperty(NativeURL, "parse", parseDescriptor);
+}
+
+describe("URL parser fallbacks", () => {
+  beforeEach(() => {
+    restoreURL();
+    vi.resetModules();
+  });
+
+  afterEach(restoreURL);
+
+  test("uses the boolean and object APIs on modern runtimes", async () => {
+    const canParse = vi.spyOn(NativeURL, "canParse");
+    const URLStatic = NativeURL as typeof URL & { parse: (input: string) => URL | null };
+    const parse = vi.spyOn(URLStatic, "parse");
+    const z = await import("../../index.js");
+
+    expect(z.validate(z.url(), "https://example.com")).toBe(true);
+    expect(canParse).toHaveBeenCalledOnce();
+    expect(parse).not.toHaveBeenCalled();
+
+    canParse.mockClear();
+    expect(z.validate(z.url({ normalize: true }), "https://example.com")).toBe(true);
+    expect(parse).toHaveBeenCalledOnce();
+    expect(canParse).not.toHaveBeenCalled();
+
+    parse.mockClear();
+    expect(z.validate(z.ipv6(), "2001:db8::1")).toBe(true);
+    expect(canParse).toHaveBeenCalledOnce();
+    expect(parse).not.toHaveBeenCalled();
+  });
+
+  test("URL fast-path selection preserves live option getter reads", async () => {
+    const z = await import("../../index.js");
+    const postProcessor = z.core.globalConfig.postProcessor;
+    z.core.globalConfig.postProcessor = undefined;
+    try {
+      for (const inherited of [false, true]) {
+        const schema = z.url();
+        const target = inherited ? Object.create(Object.getPrototypeOf(schema.def)) : schema.def;
+        let reads = 0;
+        Object.defineProperty(target, "hostname", {
+          get: () => (++reads === 1 ? /^example\.com$/ : undefined),
+        });
+        if (inherited) Object.setPrototypeOf(schema.def, target);
+        expect(z.validate(schema, "https://example.com")).toBe(false);
+        expect(reads).toBe(2);
+        reads = 0;
+        expect(schema.safeParse("https://example.com").success).toBe(false);
+        expect(reads).toBe(2);
+      }
+    } finally {
+      z.core.globalConfig.postProcessor = postProcessor;
+    }
+  });
+
+  test("the exported object parser still returns a URL", async () => {
+    const { parseURLObject } = await import("../schemas.js");
+    const result = parseURLObject("https://example.com", {});
+    expect(result).toBeInstanceOf(NativeURL);
+    if (typeof result === "number") expect.unreachable();
+    expect(result.hostname).toBe("example.com");
+    expect(parseURLObject("invalid", {})).toBe(2);
+  });
+
+  test("falls back when URL.canParse is absent", async () => {
+    Reflect.deleteProperty(NativeURL, "canParse");
+    const z = await import("../../index.js");
+    const cases = [
+      [z.url(), "https://example.com", "not a url"],
+      [z.ipv6(), "2001:db8::1", "not-an-ip"],
+      [z.cidrv6(), "2001:db8::/32", "not-an-ip/32"],
+    ] as const;
+
+    for (const [schema, valid, invalid] of cases) {
+      for (const subject of [schema, z.compile(schema)]) {
+        expect(z.validate(subject, valid)).toBe(true);
+        expect(z.validate(subject, invalid)).toBe(false);
+        expect(subject.safeParse(valid).success).toBe(true);
+        expect(subject.safeParse(invalid).success).toBe(false);
+      }
+    }
+  });
+
+  test("falls back when URL.parse is absent", async () => {
+    Reflect.deleteProperty(NativeURL, "parse");
+    const z = await import("../../index.js");
+    const cases = [
+      [z.url({ normalize: true }), "https://example.com", "not a url"],
+      [z.url({ hostname: /^example\.com$/ }), "https://example.com", "https://other.com"],
+      [z.httpUrl(), "https://example.com", "mailto:a@example.com"],
+    ] as const;
+
+    for (const [schema, valid, invalid] of cases) {
+      for (const subject of [schema, z.compile(schema)]) {
+        expect(z.validate(subject, valid)).toBe(true);
+        expect(z.validate(subject, invalid)).toBe(false);
+        expect(subject.safeParse(valid).success).toBe(true);
+        expect(subject.safeParse(invalid).success).toBe(false);
+      }
+    }
+  });
+
+  test("rejects without a global URL constructor", async () => {
+    const z = await import("../../index.js");
+    const cases = [
+      [z.url(), "https://example.com"],
+      [z.url({ normalize: true }), "https://example.com"],
+      [z.ipv6(), "2001:db8::1"],
+      [z.cidrv6(), "2001:db8::/32"],
+    ] as const;
+    const subjects = cases.flatMap(([schema, input]) => [
+      [schema, input] as const,
+      [z.compile(schema), input] as const,
+    ]);
+    Object.defineProperty(globalThis, "URL", { configurable: true, value: undefined });
+
+    for (const [schema, input] of subjects) {
+      expect(z.validate(schema, input)).toBe(false);
+      expect(schema.safeParse(input).success).toBe(false);
+    }
+  });
+});