@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/zod/src/v4/classic/tests/object.test.ts

@@ -838,6 +838,62 @@ describe("__proto__ as a declared shape key", () => {
     expect(() => (schema[method] as any)(mask).shape).toThrow('Unrecognized key: "__proto__"');
   });
 
+  // the mask is checked against the source's declared keys, which reads without resolving them, so it throws where the mistake is
+  test.each(["pick", "omit", "partial", "required"] as const)("%s rejects an undeclared key at the call", (method) => {
+    const schema = z.object({ value: z.string() });
+
+    expect(() => (schema[method] as any)({ nope: true })).toThrow('Unrecognized key: "nope"');
+  });
+
+  // a derived shape is built key by key, and a plain assignment runs whatever setter answers to the key — `__proto__` always has one, and a polluted prototype can supply one for any name
+  test("an inherited setter cannot swallow a derived key", () => {
+    let swallowed: unknown;
+    Object.defineProperty(Object.prototype, "field", {
+      configurable: true,
+      set(v) {
+        swallowed = v;
+      },
+      get() {
+        return undefined;
+      },
+    });
+
+    try {
+      const derived = z.object({ field: z.string() }).extend({ extra: z.number() });
+
+      expect(Object.keys(derived.shape)).toEqual(["field", "extra"]);
+      expect(swallowed).toBeUndefined();
+      // the key is still validated; what a parse writes into its result is the ambient prototype's business, as it is without a builder
+      expect(derived.safeParse({ field: 123, extra: 1 }).success).toBe(false);
+      expect(derived.safeParse({ field: "a", extra: 1 }).success).toBe(true);
+    } finally {
+      delete (Object.prototype as any).field;
+    }
+  });
+
+  // a shape resolves by object spread, so a non-enumerable entry is no part of it and no builder may promote one into a derived shape
+  test("a non-enumerable shape entry stays out of every derived shape", () => {
+    const sym = Symbol("kept");
+    const hide = (target: Record<string, any>) =>
+      Object.defineProperty(target, "hidden", { value: z.string(), enumerable: false, configurable: true });
+    // each case needs a source whose shape is still unresolved, since resolving drops the entry on its own
+    const source = () => z.object(hide({ b: z.number(), [sym]: z.boolean() }) as any);
+
+    expect(Reflect.ownKeys(source().shape)).toEqual(["b", sym]);
+    expect(Reflect.ownKeys(source().extend({ c: z.boolean() }).shape)).toEqual(["b", "c", sym]);
+    expect(Reflect.ownKeys(source().partial().shape)).toEqual(["b", sym]);
+    expect(Reflect.ownKeys(source().merge(z.object({ c: z.boolean() })).shape)).toEqual(["b", "c", sym]);
+    expect(Object.keys(z.object({ b: z.number() }).extend(hide({}) as any).shape)).toEqual(["b"]);
+    expect(() => source().pick({ hidden: true } as any)).toThrow('Unrecognized key: "hidden"');
+
+    // promoting it would make a key the source ignores required
+    expect(
+      source()
+        .extend({ c: z.boolean() })
+        .safeParse({ b: 1, [sym]: true, c: true }).success
+    ).toBe(true);
+  });
+
   test("shape helpers preserve a declared key", () => {
     const shape = () =>
       Object.fromEntries([

package/node_modules/zod/src/v4/classic/tests/optin-ladder.test.ts

@@ -222,7 +222,8 @@ test("ladder: the rung values themselves", () => {
 
 test("exactOptional overrides the values and pattern optional installs", () => {
   expect(z.exactOptional(z.enum(["a", "b"]))._zod.values).toEqual(new Set(["a", "b"]));
-  expect(z.exactOptional(z.string().regex(/^abc$/))._zod.pattern).toEqual(/^abc$/);
+  // a format carries its pattern on its def; a chained `.regex()` no longer folds into the inner `_zod.pattern`, the template literal derives that itself
+  expect(z.exactOptional(z.stringFormat("abc", /^abc$/))._zod.pattern).toEqual(/^abc$/);
   expect(z.templateLiteral(["a", z.exactOptional(z.literal("b"))]).safeParse("a").success).toEqual(false);
 });
 
@@ -230,5 +231,5 @@ test("exactOptional overrides the values and pattern optional installs", () => {
 test("exactOptional's override holds for later instances", () => {
   z.exactOptional(z.enum(["a", "b"]));
   expect(z.exactOptional(z.enum(["c", "d"]))._zod.values).toEqual(new Set(["c", "d"]));
-  expect(z.exactOptional(z.string().regex(/^xyz$/))._zod.pattern).toEqual(/^xyz$/);
+  expect(z.exactOptional(z.stringFormat("xyz", /^xyz$/))._zod.pattern).toEqual(/^xyz$/);
 });

package/node_modules/zod/src/v4/classic/tests/prefault.test.ts

@@ -1,6 +1,76 @@
 import { expect, expectTypeOf, test } from "vitest";
 import { z } from "zod/v4";
 
+test.each([false, true])("undefined prefault preserves object keys (jitless: %s)", async (jitless) => {
+  const previous = z.config().jitless;
+  z.config({ jitless });
+  try {
+    let calls = 0;
+    const field = z.union([z.string(), z.undefined()]).prefault(() => {
+      calls++;
+      return undefined;
+    });
+    const schema = z.object({ a: field });
+    expectTypeOf<z.output<typeof field>>().toEqualTypeOf<string | undefined>();
+    expectTypeOf<z.input<typeof schema>>().toEqualTypeOf<{ a?: string | undefined }>();
+    expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<{ a: string | undefined }>();
+    expect(schema.parse({})).toStrictEqual({ a: undefined });
+    expect(calls).toBe(1);
+    expect(schema.parse({ a: undefined })).toStrictEqual({ a: undefined });
+    expect(calls).toBe(2);
+    expect(await schema.parseAsync({})).toStrictEqual({ a: undefined });
+    expect(calls).toBe(3);
+    expect(schema.parse({ a: "value" })).toStrictEqual({ a: "value" });
+    expect(schema.safeParse({ a: 123 }).success).toBe(false);
+    expect(calls).toBe(3);
+
+    const literal = z.prefault(z.string().optional(), undefined);
+    expect(z.core.compileFn(z.object({ a: literal }))({})).toStrictEqual({ a: undefined });
+    for (const wrapped of [literal, literal.readonly(), literal.nullable(), z.lazy(() => literal)]) {
+      expect(z.object({ a: wrapped }).parse({})).toStrictEqual({ a: undefined });
+    }
+    expect(z.object({ a: literal.optional() }).parse({})).toStrictEqual({});
+    expect(z.object({ a: literal.optional() }).parse({ a: undefined })).toStrictEqual({ a: undefined });
+    expect(z.tuple([literal]).parse([])).toStrictEqual([undefined]);
+  } finally {
+    z.config({ jitless: previous });
+  }
+});
+
+test("prefault preserves transformed undefined output", async () => {
+  const field = z
+    .string()
+    .transform(() => undefined)
+    .prefault("fallback");
+  expectTypeOf<z.output<typeof field>>().toEqualTypeOf<undefined>();
+  expect(field.parse(undefined)).toBeUndefined();
+  const schema = z.object({ a: field, optional: z.string().optional() });
+  expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<{ a: undefined; optional?: string | undefined }>();
+  expect(schema.parse({})).toStrictEqual({ a: undefined });
+  expect(z.core.compileFn(schema)({})).toStrictEqual({ a: undefined });
+  expect(z.compile(schema).parse({})).toStrictEqual({ a: undefined });
+  expect(
+    await z
+      .object({
+        a: z
+          .string()
+          .transform(async () => undefined)
+          .prefault("fallback"),
+      })
+      .parseAsync({})
+  ).toStrictEqual({ a: undefined });
+  expect(
+    z
+      .object({
+        a: z
+          .string()
+          .prefault("fallback")
+          .transform(() => undefined),
+      })
+      .parse({})
+  ).toStrictEqual({ a: undefined });
+});
+
 test("basic prefault", () => {
   const a = z.prefault(z.string().trim(), "  default  ");
   expect(a).toBeInstanceOf(z.ZodPrefault);

package/node_modules/zod/src/v4/classic/tests/properties.test.ts

@@ -0,0 +1,141 @@
+import { expect, expectTypeOf, test } from "vitest";
+import * as z from "zod/v4";
+
+test("z.properties is a check", () => {
+  const s = z.object({ a: z.string(), b: z.string() }).check(z.properties({ a: z.literal("x"), b: z.literal("y") }));
+
+  // asserts in place: extra keys pass, and every failing key reports
+  expect(s.safeParse({ a: "x", b: "y", extra: 1 }).success).toBe(true);
+  expect(s.safeParse({ a: "!", b: "!" }).error!.issues.map((i) => i.path)).toEqual([["a"], ["b"]]);
+
+  // the base already typed the value, so the properties are asserted on whatever it produced — a string's length, as z.property() does
+  const long = z.string().check(z.properties({ length: z.number().min(3) }));
+  expect(long.parse("abc")).toBe("abc");
+  expect(long.safeParse("ab").error!.issues.map((i) => i.path)).toEqual([["length"]]);
+  expect(
+    z
+      .compile(long)
+      .safeParse("ab")
+      .error!.issues.map((i) => i.path)
+  ).toEqual([["length"]]);
+
+  // not a schema
+  // @ts-expect-error a check has no parse of its own
+  z.properties({ a: z.string() }).parse;
+});
+
+test("z.properties discards transformed output", () => {
+  // asserts and never writes back, exactly as z.property() behaves; a nested object schema rebuilds its output even without transforms, so identity cannot distinguish the two
+  const s = z.any().check(z.properties({ a: z.string().transform((s) => s.toUpperCase()) }));
+  const input = { a: "hi" };
+  expect(s.parse(input)).toBe(input);
+  expect(input.a).toBe("hi");
+});
+
+test("z.instanceof().properties()", () => {
+  const httpsUrl = z.instanceof(URL).properties({ protocol: z.literal("https:") });
+  expectTypeOf<z.infer<typeof httpsUrl>>().toEqualTypeOf<URL & { protocol: "https:" }>();
+
+  const u = new URL("https://example.com");
+  expect(httpsUrl.parse(u)).toBe(u);
+  expect(httpsUrl.safeParse(new URL("http://example.com")).error!.issues.map((i) => i.path)).toEqual([["protocol"]]);
+
+  // chains, and each call narrows further
+  const chained = httpsUrl.properties({ port: z.literal("") });
+  expectTypeOf<z.infer<typeof chained>>().toEqualTypeOf<URL & { protocol: "https:" } & { port: "" }>();
+  expect(chained.safeParse(u).success).toBe(true);
+  expect(chained.safeParse(new URL("https://example.com:8443")).error!.issues.map((i) => i.path)).toEqual([["port"]]);
+
+  // nothing is written back, so the narrowing is over the shape's input side
+  const W = z.instanceof(URL).properties({ search: z.string().transform((s) => s.length) });
+  expectTypeOf<z.infer<typeof W>>().toEqualTypeOf<URL & { search: string }>();
+});
+
+test("z.instanceof().properties() constrains the shape to the instance type", () => {
+  const file = z.instanceof(File).properties({ name: z.string(), size: z.number().max(1024) });
+  expectTypeOf<z.infer<typeof file>>().toEqualTypeOf<File & { name: string; size: number }>();
+
+  // @ts-expect-error no such property on File
+  z.instanceof(File).properties({ nmae: z.string() });
+
+  // @ts-expect-error File["size"] is a number
+  z.instanceof(File).properties({ size: z.string() });
+
+  // methods are out of the shape, so an object literal's inherited toString can't collide with the constraint
+  // @ts-expect-error
+  z.instanceof(File).properties({ text: z.any() });
+
+  // a literal still narrows a wider property
+  const png = z.instanceof(File).properties({ type: z.literal("image/png") });
+  expectTypeOf<z.infer<typeof png>>().toEqualTypeOf<File & { type: "image/png" }>();
+});
+
+test("z.properties spreads into .check()", () => {
+  // the 4.5 array call sites: the check yields itself from Symbol.iterator
+  const p = z.properties({ a: z.literal("x") });
+  expect([...p]).toEqual([p]);
+
+  const s = z.object({ a: z.string() }).check(...z.properties({ a: z.literal("x") }));
+  expect(s.safeParse({ a: "x" }).success).toBe(true);
+  expect(s.safeParse({ a: "!" }).error!.issues.map((i) => i.path)).toEqual([["a"]]);
+});
+
+test("z.properties compiles inside a container", () => {
+  const outer = z.compile(z.object({ url: z.instanceof(URL).properties({ protocol: z.literal("https:") }) }));
+  expect(outer.safeParse({ url: new URL("http://example.com") }).error!.issues.map((i) => i.path)).toEqual([
+    ["url", "protocol"],
+  ]);
+});
+
+test("z.properties async", async () => {
+  const s = z.any().check(z.properties({ a: z.string().refine(async (s) => s.length > 1) }));
+  const ok = { a: "hi" };
+  await expect(s.parseAsync(ok)).resolves.toBe(ok);
+  const bad = await s.safeParseAsync({ a: "!" });
+  expect(bad.error!.issues.map((i) => i.path)).toEqual([["a"]]);
+});
+
+test("z.properties validates symbol keys", () => {
+  const sym = Symbol("tag");
+  const s = z.any().check(z.properties({ [sym]: z.string() }));
+  expect(s.safeParse({ [sym]: "ok" }).success).toBe(true);
+  expect(s.safeParse({ [sym]: 123 }).error!.issues.map((i) => i.path)).toEqual([[sym]]);
+  expect(
+    z
+      .compile(s)
+      .safeParse({ [sym]: 123 })
+      .error!.issues.map((i) => i.path)
+  ).toEqual([[sym]]);
+});
+
+test("z.properties compiled and interpreted agree on a nullish value", () => {
+  // a base that permits null reaches the check with one; the compiled property read must not throw where the runtime reports an issue
+  const s = z.any().check(...z.properties({ a: z.string() }));
+  const expected = [["invalid_type", []]];
+  expect(s.safeParse(null).error!.issues.map((i) => [i.code, i.path])).toEqual(expected);
+  expect(
+    z
+      .compile(s)
+      .safeParse(null)
+      .error!.issues.map((i) => [i.code, i.path])
+  ).toEqual(expected);
+});
+
+test("z.properties with a custom when refuses to compile", () => {
+  // `when` is not publicly settable, since it gates the assertion inside the run loop. A hand-built def can still carry one, and compiling it must refuse rather than run the shape unconditionally: a union branch compiles to its own IIFE, so a wrong rejection is absorbed as a branch failure with no fallback.
+  const p = new z.core.$ZodCheckProperties({ check: "properties", shape: { a: z.literal("x") }, when: () => false });
+  const s = z.union([z.any().check(p), z.object({ b: z.string() })]);
+  const input = { a: "wrong", b: "hello" };
+  expect(z.compile(s).safeParse(input)).toEqual(s.safeParse(input));
+});
+
+test("z.properties survives shape mutation", () => {
+  // key and schema are snapshotted together; caching one and reading the other live paired a stale key with a missing schema
+  const shape: Record<string, z.ZodType> = { a: z.string() };
+  const s = z.any().check(z.properties(shape));
+  expect(s.safeParse({ a: "x" }).success).toBe(true);
+  delete shape.a;
+  expect(s.safeParse({ a: "x" }).success).toBe(true);
+  shape.b = z.string();
+  expect(s.safeParse({ a: "x" }).success).toBe(true);
+});

package/node_modules/zod/src/v4/classic/tests/recursive-types.test.ts

@@ -1,6 +1,51 @@
 import { expect, expectTypeOf, test } from "vitest";
 import { z } from "zod/v4";
 
+test("recursive object schema type aliases", () => {
+  type ObjectField = z.ZodObject<{ [k: string]: ObjectField }>;
+  type MixedField = z.ZodString | z.ZodObject<{ [k: string]: MixedField }>;
+  expectTypeOf<ObjectField>().toExtend<z.ZodType>();
+  expectTypeOf<MixedField>().toExtend<z.ZodType>();
+
+  type ObjectValue = { [k: string]: ObjectValue };
+  type MixedValue = string | { [k: string]: MixedValue };
+  expectTypeOf<z.input<ObjectField>>().toEqualTypeOf<ObjectValue>();
+  expectTypeOf<z.output<ObjectField>>().toEqualTypeOf<ObjectValue>();
+  expectTypeOf<z.input<MixedField>>().toEqualTypeOf<MixedValue>();
+  expectTypeOf<z.output<MixedField>>().toEqualTypeOf<MixedValue>();
+
+  const schema: MixedField = z.object({ name: z.string(), nested: z.object({ name: z.string() }) });
+  expect(schema.parse({ name: "a", nested: { name: "b", extra: true } })).toEqual({
+    name: "a",
+    nested: { name: "b" },
+  });
+  expect(schema.safeParse({ name: "a", nested: { name: 123 } }).success).toBe(false);
+
+  type CoreField = z.core.$ZodString<string> | z.core.$ZodObject<{ [k: string]: CoreField }>;
+  expectTypeOf<z.input<CoreField>>().toEqualTypeOf<MixedValue>();
+  expectTypeOf<z.output<CoreField>>().toEqualTypeOf<MixedValue>();
+});
+
+test("recursive object aliases preserve distinct input and output", () => {
+  type Field = z.ZodPipe<z.ZodString, z.ZodTransform<number, string>> | z.ZodObject<{ [k: string]: Field }>;
+  type Input = string | { [k: string]: Input };
+  type Output = number | { [k: string]: Output };
+  expectTypeOf<z.input<Field>>().toEqualTypeOf<Input>();
+  expectTypeOf<z.output<Field>>().toEqualTypeOf<Output>();
+  const schema: Field = z.object({ nested: z.object({ length: z.string().transform((s) => s.length) }) });
+  expect(schema.parse({ nested: { length: "abc" } })).toEqual({ nested: { length: 3 } });
+  expect(schema.safeParse({ nested: { length: 3 } }).success).toBe(false);
+});
+
+test("indexed object inference preserves string keys", () => {
+  type Indexed = z.ZodObject<Record<string, z.ZodString>>;
+  type Recursive = z.ZodObject<Record<string, Recursive>>;
+  expectTypeOf<keyof z.input<Indexed>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.output<Indexed>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.input<Recursive>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.output<Recursive>>().toEqualTypeOf<string>();
+});
+
 test("recursion with z.lazy", () => {
   const data = {
     name: "I",
@@ -556,7 +601,7 @@ test("recursive object with .check()", () => {
   expect(() => Category.parse(invalidData)).toThrow();
 });
 
-// biome-ignore lint: sadf
+// biome-ignore lint/suspicious/noExportsInTest: unexported it trips noUnusedVariables instead
 export type RecursiveA = z.ZodUnion<
   [
     z.ZodObject<{

package/node_modules/zod/src/v4/classic/tests/standard-schema.test.ts

@@ -132,3 +132,22 @@ test("z.toJSONSchema() returns StandardJSONSchemaV1", async () => {
 		}
 	`);
 });
+
+test("a failing validate reports the same issues as safeParse, without a ZodError", async () => {
+  const schema = z.object({ name: z.string().min(3), age: z.number().refine(async (n) => n > 0) });
+  const input = { name: "ab", age: -1 };
+  const result = (await schema["~standard"].validate(input)) as { issues: unknown[] };
+  expect(result.issues).toEqual((await schema.safeParseAsync(input)).error!.issues);
+  expect(result).not.toHaveProperty("error");
+  const sync = z.string().min(3)["~standard"].validate("ab") as { issues: unknown[] };
+  expect(sync.issues).toEqual(z.string().min(3).safeParse("ab").error!.issues);
+});
+
+test("a synchronously throwing check rejects through ~standard instead of throwing", async () => {
+  const schema = z.string().refine(() => {
+    throw new Error("boom");
+  });
+  const result = schema["~standard"].validate("abc");
+  expect(result).toBeInstanceOf(Promise);
+  await expect(result as Promise<unknown>).rejects.toThrow("boom");
+});

package/node_modules/zod/src/v4/classic/tests/string.test.ts

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { expect, test } from "vitest";
+import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
@@ -12,6 +12,63 @@ const includesFromIndex2 = z.string().includes("includes", { position: 2 });
 const startsWith = z.string().startsWith("startsWith");
 const endsWith = z.string().endsWith("endsWith");
 
+test("string factory checks", async () => {
+  const schema = z.string({ checks: [z.minLength(1), z.maxLength(3)] as const });
+  const chained = z.string().min(1).max(3);
+  expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<string>();
+  for (const value of ["", "ab", "abcd", 1, undefined]) {
+    expect(z.validate(schema, value)).toBe(z.validate(chained, value));
+    expect(schema.safeParse(value)).toEqual(chained.safeParse(value));
+  }
+  expect(z.toJSONSchema(schema)).toEqual(z.toJSONSchema(chained));
+  expect(schema.minLength).toBe(1);
+  expect(schema.maxLength).toBe(3);
+  expect(schema._zod.parent).toBeUndefined();
+  expect([...schema._zod.traits]).toEqual([...chained._zod.traits]);
+  const extended = schema.max(2);
+  expect(extended._zod.parent).toBe(schema);
+  expect(z.validate(schema, "abc")).toBe(true);
+  expect(z.validate(extended, "abc")).toBe(false);
+  const coerce = z.coerce.string({ checks: [z.minLength(2)] });
+  expect(coerce.parse(12)).toBe("12");
+  expect(z.validate(coerce, 1)).toBe(false);
+  const asyncSchema = z.string({
+    checks: [
+      z.check<string>(async (ctx) => {
+        if (ctx.value !== "ok") ctx.issues.push({ code: "custom", input: ctx.value });
+      }),
+    ],
+  });
+  expect(await asyncSchema.safeParseAsync("ok")).toEqual({ success: true, data: "ok" });
+  expect((await asyncSchema.safeParseAsync("bad")).success).toBe(false);
+  // @ts-expect-error numeric checks cannot validate strings
+  z.string({ checks: [z.gte(1)] });
+});
+
+test("factory checks snapshot caller arrays", () => {
+  for (const factory of [z.string, z.coerce.string]) {
+    for (const initial of [[], [z.minLength(1)]]) {
+      const schema = factory({ checks: initial });
+      let reads = 0;
+      const getterSchema = factory({
+        get checks() {
+          if (++reads > 1) throw new Error("checks read twice");
+          return initial;
+        },
+      });
+      expect(reads).toBe(1);
+      expect(z.validate(getterSchema, "long")).toBe(true);
+      const before = z.toJSONSchema(schema);
+      initial.push(z.minLength(10));
+      expect(schema._zod.def.checks).not.toBe(initial);
+      expect(z.validate(schema, "long")).toBe(true);
+      expect(z.validate(z.compile(schema), "long")).toBe(true);
+      expect(z.toJSONSchema(schema)).toEqual(before);
+      expect(z.validate(schema.check(z.minLength(2)), "long")).toBe(true);
+    }
+  }
+});
+
 test("length checks", () => {
   minFive.parse("12345");
   minFive.parse("123456");
@@ -264,6 +321,7 @@ test("base64url validations", () => {
 
   const invalidBase64URLStrings = [
     "w7/Dv8O+w74K", // Has + and / characters (is base64)
+    "A", // Invalid length (1 mod 4 carries no whole byte)
     "12345", // Invalid length (not a multiple of 4 characters when adding allowed number of padding characters)
     "12345===", // Not padded correctly
     "!UGF0aWVuY2UgaXMgdGhlIGtleSB0byBzdWNjZXNz", // Invalid character '!'
@@ -291,6 +349,18 @@ test("big base64 and base64url", () => {
   z.base64().parse(bigbase64);
   const bigbase64url = randomBytes(1024 * 1024 * 10).toString("base64url");
   z.base64url().parse(bigbase64url);
+
+  // template literals compose def.pattern and test it on every parse; the quantified block forms overflowed the regex stack here
+  expect(z.templateLiteral(["id-", z.base64()]).safeParse(`id-${bigbase64}`).success).toBe(true);
+  expect(z.templateLiteral(["id-", z.base64url()]).safeParse(`id-${bigbase64url}`).success).toBe(true);
+});
+
+test("template literal composes base64 without alternation leaks", () => {
+  // the ^$| alternation in regexes.base64 used to leak: "AAAA" matched with the prefix dropped and "id-AAAA" was rejected
+  const tl = z.templateLiteral(["id-", z.base64()]);
+  expect(tl.safeParse("id-AAAA").success).toBe(true);
+  expect(tl.safeParse("id-").success).toBe(true);
+  expect(tl.safeParse("AAAA").success).toBe(false);
 });
 
 function makeJwt(header: object, payload: object) {
@@ -552,6 +622,18 @@ test("emoji validations", () => {
   expect(() => emoji.parse("😀 is an emoji")).toThrow();
   expect(() => emoji.parse("😀stuff")).toThrow();
   expect(() => emoji.parse("stuff😀")).toThrow();
+
+  emoji.parse("1\u{FE0F}\u{20E3}"); // keycap sequences stay valid
+  emoji.parse("#\u{FE0F}\u{20E3}");
+
+  // `\p{Emoji_Component}` alone covers ASCII digits, "#", "*", ZWJ, variation selectors and skin tone modifiers; none is an emoji without a base, so a component-only string is not one either
+  expect(() => emoji.parse("123")).toThrow();
+  expect(() => emoji.parse("#")).toThrow();
+  expect(() => emoji.parse("*")).toThrow();
+  expect(() => emoji.parse("\u{200D}")).toThrow();
+  expect(() => emoji.parse("\u{FE0F}")).toThrow();
+  expect(() => emoji.parse("\u{1F3FD}")).toThrow();
+  expect(() => emoji.parse("1\u{FE0F}")).toThrow();
 });
 
 test("nanoid", () => {
@@ -1264,6 +1346,18 @@ test("hostname", () => {
   expect(() => hostname.parse("example..com")).toThrow();
 });
 
+test("currency code", () => {
+  const currency = z.currencyCode();
+  for (const code of ["USD", "EUR", "XXX", "XCG", "XAD"]) expect(currency.parse(code)).toBe(code);
+  for (const input of ["", "usd", "US", "USDX", " USD", "ANG", "BGN"])
+    expect(currency.safeParse(input).success).toBe(false);
+  expect(currency.safeParse("usd").error!.issues[0]).toMatchObject({
+    code: "invalid_format",
+    format: "currency_code",
+    message: "Invalid currency code",
+  });
+});
+
 test("hash validation", () => {
   // MD5 tests
   const md5hex = z.hash("md5");

package/node_modules/zod/src/v4/classic/tests/template-literal.test.ts

@@ -565,7 +565,7 @@ test("regexes", () => {
     `"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"`
   );
   expect(email._zod.pattern.source).toMatchInlineSnapshot(
-    `"^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"`
+    `"^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"`
   );
   // expect(ip._zod.pattern.source).toMatchInlineSnapshot(
   //   `"^(^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$)|(^(([a-fA-F0-9]{1,4}:){7}|::([a-fA-F0-9]{1,4}:){0,6}|([a-fA-F0-9]{1,4}:){1}:([a-fA-F0-9]{1,4}:){0,5}|([a-fA-F0-9]{1,4}:){2}:([a-fA-F0-9]{1,4}:){0,4}|([a-fA-F0-9]{1,4}:){3}:([a-fA-F0-9]{1,4}:){0,3}|([a-fA-F0-9]{1,4}:){4}:([a-fA-F0-9]{1,4}:){0,2}|([a-fA-F0-9]{1,4}:){5}:([a-fA-F0-9]{1,4}:){0,1})([a-fA-F0-9]{1,4}|(((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2}))\\.){3}((25[0-5])|(2[0-4][0-9])|(1[0-9]{2})|([0-9]{1,2})))$)$"`
@@ -778,3 +778,35 @@ test("template literal parsing - failure - issue format", () => {
     }
   `);
 });
+
+test("part patterns fold checks through wrappers and unions", () => {
+  // a constrained string keeps its bounds under a wrapper and inside a union
+  const wrapped = z.templateLiteral(["a-", z.string().min(2).max(3).optional()]);
+  expect(wrapped.safeParse("a-").success).toBe(true);
+  expect(wrapped.safeParse("a-xy").success).toBe(true);
+  expect(wrapped.safeParse("a-x").success).toBe(false);
+  expect(wrapped.safeParse("a-wxyz").success).toBe(false);
+
+  const union = z.templateLiteral(["", z.union([z.string().regex(/^[a-c]+$/), z.number().int()])]);
+  expect(union.safeParse("abc").success).toBe(true);
+  expect(union.safeParse("12").success).toBe(true);
+  expect(union.safeParse("xyz").success).toBe(false);
+  expect(union.safeParse("1.5").success).toBe(false);
+
+  // an empty length range matches nothing rather than building an invalid quantifier
+  const empty = z.templateLiteral(["", z.string().min(8).length(5)]);
+  expect(empty.safeParse("abcde").success).toBe(false);
+
+  // lazy resolves its inner schema on the internals, not the def
+  const lazy = z.templateLiteral(["", z.lazy(() => z.string().min(2)).optional()]);
+  expect(lazy.safeParse("x").success).toBe(false);
+  expect(lazy.safeParse("xy").success).toBe(true);
+});
+
+test("an embedded email does not constrain the other parts", () => {
+  const schema = z.templateLiteral([z.email(), "|", z.string()]);
+  expect(schema.safeParse("a@b.cc|a..b").success).toBe(true);
+  expect(schema.safeParse("a@b.cc|xy").success).toBe(true);
+  expect(schema.safeParse("a..b@b.cc|xy").success).toBe(false);
+  expect(schema.safeParse(".a@b.cc|xy").success).toBe(false);
+});