@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/zod/src/v4/core/tests/compile.test.ts

@@ -1,7 +1,15 @@
-import { expect, test } from "vitest";
+import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "../../index.js";
-import { ZodCompileAsyncError, ZodCompileUnsupportedError, compile } from "../compile.js";
+import {
+  INVALID,
+  ZodCompileAsyncError,
+  ZodCompileUnsupportedError,
+  compile,
+  compileFn,
+  withParser,
+} from "../compile.js";
+import { $ZodAsyncError } from "../core.js";
 
 // Differential helper: assert compiled schema matches the original on a value.
 function expectMatch(schema: z.ZodType, value: unknown) {
@@ -1350,6 +1358,29 @@ test("runtime island inside array element", () => {
   invalid(aot, ["a", true]);
 });
 
+test("an island thrown from inside an indented block leaves the indent level alone", () => {
+  // nullable opens an indented block, coerce throws inside it, and the property islands the pair — two of them so a leak compounds
+  const schema = z.object({ a: z.coerce.number().nullable(), b: z.coerce.number().nullable(), tail: z.string() });
+  expect(compileFn(schema, { debug: true }).code).toMatchInlineSnapshot(`
+    "// Constants: INVALID, c0, c1, c2
+    if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID;
+    const v0 = input["a"];
+    if (!("a" in input)) return INVALID;
+    const v1 = c1(c0, v0);
+    if (v1 === INVALID) return INVALID;
+    const v2 = input["b"];
+    if (!("b" in input)) return INVALID;
+    const v3 = c1(c2, v2);
+    if (v3 === INVALID) return INVALID;
+    const v4 = input["tail"];
+    if (typeof v4 !== "string") return INVALID;
+    const v5 = { "a": v1, "b": v3, "tail": v4 };
+    return v5;"
+  `);
+  expectMatch(schema, { a: "1", b: null, tail: "x" });
+  expectMatch(schema, { a: "nope", b: null, tail: "x" });
+});
+
 test("url string-format check never assigns to its accessor", () => {
   // const accessor (array element): previously emitted `elem = normalized`,
   // a TypeError on valid input.
@@ -1417,6 +1448,26 @@ test("xor and custom when-gated checks force runtime fallback", () => {
   expectMatch(z.object({ n: gated }), { n: 3 }); // runtime skips the gated check
 });
 
+test("compiled parse surfaces the interpreter's throws through the fallback", () => {
+  // an unmergeable intersection bails to INVALID, and the fallback it hands to raises the interpreter's own error
+  const unmergeable = compile(
+    z.intersection(
+      z.number(),
+      z.number().transform((x) => x + 1)
+    ),
+    { strict: true }
+  );
+  expect(() => unmergeable.parse(1234)).toThrowErrorMatchingInlineSnapshot(
+    `[Error: Unmergable intersection. Error path: []]`
+  );
+
+  // a when-gated check islands at codegen, and the island's INVALID for an async run reaches the same fallback
+  const gated = z.number().refine(() => Promise.resolve(true));
+  (gated._zod.def.checks![0]!._zod.def as { when?: unknown }).when = () => true;
+  const compiled = compile(z.object({ n: gated }), { strict: true });
+  expect(() => compiled.parse({ n: 3 })).toThrow($ZodAsyncError);
+});
+
 test("strict objects reject inherited enumerable keys like the runtime", () => {
   const schema = z.strictObject({ a: z.string() });
   expectMatch(schema, Object.assign(Object.create({ extra: 1 }), { a: "x" }));
@@ -1637,3 +1688,349 @@ test("strict is per-call, so a supported schema compiles either way", () => {
     invalid(aot, { a: 1, b: 1 });
   }
 });
+
+test("compiled records walk own enumerable keys without Reflect.ownKeys", () => {
+  // a getOwnPropertyNames snapshot plus a per-key recheck sees the same keys as the runtime's Reflect.ownKeys walk: inherited enumerables are skipped, symbols fail a string key schema but pass a symbol one, and the numeric-string retry still applies
+  const sym = Symbol("s");
+  const bare = compile(z.record(z.string(), z.number()));
+  const inherited = Object.assign(Object.create({ proto: 1 }), { a: 1 });
+  expect(bare.parse(inherited)).toEqual({ a: 1 });
+  const symbolic = { a: 1, [sym]: 2 };
+  expect(bare.safeParse(symbolic).error!.issues).toEqual(
+    z.record(z.string(), z.number()).safeParse(symbolic).error!.issues
+  );
+  expect(bare.safeParse({ a: 1, b: "x" }).error!.issues).toEqual(
+    z.record(z.string(), z.number()).safeParse({ a: 1, b: "x" }).error!.issues
+  );
+  const symKeys = compile(z.record(z.symbol(), z.number()));
+  expect(symKeys.parse({ [sym]: 2 })).toEqual({ [sym]: 2 });
+  expect(symKeys.safeParse({ a: 1 }).success).toBe(false);
+  const emailKeys = compile(z.record(z.email(), z.number()));
+  expect(emailKeys.parse({ "a@b.co": 1 })).toEqual({ "a@b.co": 1 });
+  expect(emailKeys.safeParse({ "a@b.co": 1, [sym]: 2 }).success).toBe(false);
+  expect(compile(z.record(z.number(), z.string())).parse({ 1: "a" })).toEqual({ 1: "a" });
+  // keys are snapshotted before any value is read and rechecked when visited, like the runtime's Reflect.ownKeys walk: a getter that adds a key mid-walk is not visited, one that hides a later key skips it
+  const mutating = (effect: (o: Record<PropertyKey, unknown>) => void) => {
+    const o: Record<PropertyKey, unknown> = {};
+    Object.defineProperty(o, "a", {
+      enumerable: true,
+      get() {
+        effect(o);
+        return 1;
+      },
+    });
+    o.b = 2;
+    return o;
+  };
+  const both = z.record(z.union([z.string(), z.symbol()]), z.number());
+  for (const [schema, effect] of [
+    [
+      both,
+      (o: Record<PropertyKey, unknown>) => {
+        o[sym] = 2;
+      },
+    ],
+    [
+      z.record(z.string(), z.number()),
+      (o: Record<PropertyKey, unknown>) => {
+        o[sym] = "bad";
+      },
+    ],
+    [
+      z.record(z.string(), z.number()),
+      (o: Record<PropertyKey, unknown>) => {
+        o.z = "bad";
+      },
+    ],
+    [
+      z.record(z.string(), z.number()),
+      (o: Record<PropertyKey, unknown>) => Object.defineProperty(o, "b", { enumerable: false }),
+    ],
+  ] as const) {
+    const expected = schema.safeParse(mutating(effect));
+    const actual = compile(schema).safeParse(mutating(effect));
+    expect(actual.success).toBe(expected.success);
+    if (expected.success)
+      expect(Reflect.ownKeys(actual.data as object)).toEqual(Reflect.ownKeys(expected.data as object));
+    else expect(actual.error!.issues).toEqual(expected.error!.issues);
+  }
+  // a getter that defines an own key under an inherited enumerable name mid-walk: the snapshot predates it, so neither walk visits it, and a union that accepts the record cannot be corrected by a fallback
+  const shadowing = () => {
+    const o = Object.create({ z: 0 });
+    Object.defineProperty(o, "a", {
+      enumerable: true,
+      get() {
+        Object.defineProperty(o, "z", { value: 2, enumerable: true });
+        return 1;
+      },
+    });
+    return o;
+  };
+  const inUnion = z.union([z.record(z.string(), z.number()), z.any()]);
+  expect(compile(inUnion).parse(shadowing())).toStrictEqual(inUnion.parse(shadowing()));
+  expect(compile(inUnion).parse(shadowing())).toStrictEqual({ a: 1 });
+  // a key that is non-enumerable at snapshot time and revealed by an earlier getter is in the snapshot and passes the recheck, like the runtime
+  const revealing = () => {
+    const o: Record<string, unknown> = {};
+    Object.defineProperty(o, "a", {
+      enumerable: true,
+      get() {
+        Object.defineProperty(o, "b", { enumerable: true });
+        return 1;
+      },
+    });
+    Object.defineProperty(o, "b", { value: 2, enumerable: false, configurable: true });
+    return o;
+  };
+  const plain = z.record(z.string(), z.number());
+  expect(compile(plain).parse(revealing())).toStrictEqual(plain.parse(revealing()));
+  expect(compile(plain).parse(revealing())).toStrictEqual({ a: 1, b: 2 });
+});
+
+test("validate honors custom checks composed with format traits", () => {
+  const postProcessor = z.core.globalConfig.postProcessor;
+  z.core.globalConfig.postProcessor = undefined;
+  try {
+    const CustomEmail = z.core.$constructor<z.core.$ZodEmail>("CustomEmail", (inst, def) => {
+      inst._zod.check = (payload) => {
+        if (payload.value !== "custom") payload.issues.push({ code: "custom", input: payload.value });
+      };
+      z.core.$ZodEmail.init(inst, def);
+    });
+    const schema = new CustomEmail({ type: "string", format: "email", check: "string_format" });
+    for (const [input, valid] of [
+      ["custom", true],
+      ["test@example.com", false],
+      [42, false],
+    ] as const) {
+      expect(z.safeParse(schema, input).success).toBe(valid);
+      expect(z.validate(schema, input)).toBe(valid);
+    }
+  } finally {
+    z.core.globalConfig.postProcessor = postProcessor;
+  }
+});
+
+test("validate honors standalone format checks", () => {
+  const cases = [
+    [z.iso.datetime(), "2021-01-01T00:00:00Z"],
+    [z.iso.date(), "2021-01-01"],
+    [z.iso.time(), "00:00:00"],
+    [z.iso.duration(), "P1Y2M3DT4H5M6S"],
+    [z.email(), "test@example.com"],
+    [z.uuid(), "20354d7a-e4fe-47af-8ff6-187bca92f3f9"],
+    [z.ipv4(), "192.168.0.1"],
+  ] as const;
+
+  for (const [schema, valid] of cases) {
+    expect(schema._zod.traits.has("$ZodStringFormat")).toBe(true);
+    expect(schema instanceof z.core.$ZodStringFormat).toBe(true);
+    expect(z.validate(schema, valid)).toBe(true);
+    expect(z.validate(schema, "invalid")).toBe(false);
+    expect(z.validate(schema, 1)).toBe(false);
+  }
+
+  const source = z.email();
+  const refined = source.refine((value) => value.startsWith("x"));
+  const asyncRefined = source.refine(async () => true);
+  const coercedDef = Object.assign(Object.create({ coerce: true }), source._zod.def);
+  const coerced = source.clone(coercedDef);
+  const checkedDef = Object.assign(Object.create({ checks: refined._zod.def.checks }), source._zod.def);
+  const inheritedChecked = source.clone(checkedDef);
+  expect(z.validate(refined, "test@example.com")).toBe(false);
+  expect(z.validate(refined, "x@example.com")).toBe(true);
+  expect(z.validate(inheritedChecked, "test@example.com")).toBe(false);
+  expect(() => z.validate(asyncRefined, "test@example.com")).toThrow($ZodAsyncError);
+  expect(z.validate(coerced, { toString: () => "test@example.com" })).toBe(true);
+});
+
+test("runtime validate preserves contexts, getters, errors, and regex state", () => {
+  const postProcessor = z.core.globalConfig.postProcessor;
+  z.core.globalConfig.postProcessor = undefined;
+  try {
+    const source = z.email();
+    expect(z.validate(source, "invalid", { skipChecks: true } as any)).toBe(true);
+
+    let whenReads = 0;
+    const whenProto = Object.defineProperty({}, "when", {
+      enumerable: true,
+      get() {
+        whenReads++;
+        return () => false;
+      },
+    });
+    const whenDef = Object.assign(Object.create(whenProto), source._zod.def);
+    const gated = source.clone(whenDef as typeof source._zod.def);
+    expect(whenReads).toBe(0);
+    expect(z.validate(gated, "invalid")).toBe(true);
+    expect(whenReads).toBeGreaterThan(0);
+
+    let errorReads = 0;
+    const errorDef = Object.defineProperties({}, Object.getOwnPropertyDescriptors(source._zod.def));
+    Object.defineProperty(errorDef, "error", {
+      enumerable: true,
+      get() {
+        errorReads++;
+        return () => "custom";
+      },
+    });
+    const customError = source.clone(errorDef as typeof source._zod.def);
+    expect(z.validate(customError, "invalid")).toBe(false);
+    expect(errorReads).toBe(0);
+    const result = customError.safeParse("invalid");
+    expect(errorReads).toBe(0);
+    if (result.success) expect.unreachable();
+    expect(result.error.issues[0]?.message).toBe("custom");
+    expect(errorReads).toBeGreaterThan(0);
+
+    const pattern = /^a$/g;
+    const cloned = source.clone({ ...source._zod.def, pattern });
+    for (let i = 0; i < 3; i++) expect(z.validate(cloned, "a")).toBe(true);
+    expect(z.validate(cloned, "b")).toBe(false);
+    expect(pattern.lastIndex).toBe(0);
+    const replacement = /^b$/g;
+    cloned._zod.def.pattern = replacement;
+    expect(z.validate(cloned, "a")).toBe(false);
+    expect(z.validate(cloned, "b")).toBe(true);
+  } finally {
+    z.core.globalConfig.postProcessor = postProcessor;
+  }
+});
+
+test("validate preserves live pattern accessor reads", () => {
+  const postProcessor = z.core.globalConfig.postProcessor;
+  z.core.globalConfig.postProcessor = undefined;
+  try {
+    const schema = z.email();
+    let reads = 0;
+    Object.defineProperty(schema.def, "pattern", {
+      get: () => (++reads % 2 === 1 ? /^a$/ : /^b$/),
+    });
+    expect(schema.safeParse("b").success).toBe(true);
+    expect(reads).toBe(2);
+    reads = 0;
+    expect(z.validate(schema, "b")).toBe(true);
+    expect(reads).toBe(2);
+  } finally {
+    z.core.globalConfig.postProcessor = postProcessor;
+  }
+});
+
+test.each(["when", "coerce"] as const)("runtime validate honors live %s options", (option) => {
+  const postProcessor = z.core.globalConfig.postProcessor;
+  z.core.globalConfig.postProcessor = undefined;
+  try {
+    for (const inherited of [false, true]) {
+      const schema = z.email();
+      const input = option === "when" ? "invalid" : { toString: () => "test@example.com" };
+      expect(z.validate(schema, input)).toBe(false);
+
+      const target = inherited ? Object.create(Object.getPrototypeOf(schema.def)) : schema.def;
+      let reads = 0;
+      Object.defineProperty(target, option, {
+        get() {
+          reads++;
+          return option === "when" ? () => false : true;
+        },
+      });
+      if (inherited) Object.setPrototypeOf(schema.def, target);
+      expect(reads).toBe(0);
+      expect(z.validate(schema, input)).toBe(true);
+      expect(reads).toBeGreaterThan(0);
+      expect(schema.safeParse(input).success).toBe(true);
+    }
+  } finally {
+    z.core.globalConfig.postProcessor = postProcessor;
+  }
+});
+
+test("validate uses compiled validators and runtime fallbacks", () => {
+  const compiled = compile(z.email());
+  expect((compiled._zod.bag as { validator?: unknown }).validator).toBeTypeOf("function");
+  expect(z.validate(compiled, "test@example.com")).toBe(true);
+  expect(z.validate(compiled, "invalid")).toBe(false);
+  expect(z.validate(compiled, "invalid", { skipChecks: true } as any)).toBe(true);
+
+  const source = z.email();
+  const installed = withParser(source, () => INVALID);
+  const bag = installed._zod.bag as { fallbackRun: typeof source._zod.run };
+  const originalRun = bag.fallbackRun;
+  let fallbackRuns = 0;
+  bag.fallbackRun = (payload, ctx) => {
+    fallbackRuns++;
+    return originalRun(payload, ctx);
+  };
+  expect(z.validate(installed, "invalid")).toBe(false);
+  expect(fallbackRuns).toBeGreaterThan(0);
+});
+
+// withParser: a parser Zod did not generate, installed on the same wrapper compile() uses.
+
+// tags its output so a test fails loudly if the runtime ran instead of the supplied parser
+function taggedParser(input: unknown) {
+  if (typeof input !== "object" || input === null) return INVALID;
+  const o = input as Record<string, unknown>;
+  if (typeof o.a !== "string") return INVALID;
+  return { a: o.a, tag: "supplied" };
+}
+
+const withParserSchema = z.object({ a: z.string() });
+
+test("withParser installs the supplied parser", () => {
+  const installed = withParser(withParserSchema, taggedParser);
+  expect(installed.parse({ a: "x" })).toStrictEqual({ a: "x", tag: "supplied" });
+  // the clone is a new schema; the original keeps the runtime
+  expect(installed).not.toBe(withParserSchema);
+  expect(withParserSchema.parse({ a: "x" })).toStrictEqual({ a: "x" });
+});
+
+test("withParser hands INVALID to the runtime and gets a real ZodError", () => {
+  const installed = withParser(withParserSchema, taggedParser);
+  const result = installed.safeParse({ a: 1 });
+  expect(result.success).toBe(false);
+  expect(result.error!.issues).toEqual(withParserSchema.safeParse({ a: 1 }).error!.issues);
+});
+
+test("withParser answers validate with the supplied parser", () => {
+  const installed = withParser(withParserSchema, taggedParser);
+  expect(z.validate(installed, { a: "x" })).toBe(true);
+  expect(z.validate(installed, { a: 1 })).toBe(false);
+});
+
+test("withParser bypasses the fast path on async, like compile()", async () => {
+  const installed = withParser(withParserSchema, taggedParser);
+  // async runs on the runtime, so the tag is absent
+  await expect(installed.parseAsync({ a: "x" })).resolves.toStrictEqual({ a: "x" });
+});
+
+test("withParser reaches a parse it does not own the call site of", () => {
+  const installed = withParser(withParserSchema, taggedParser);
+  // installing on _zod.run rather than wrapping a call site is the whole point: a framework holding the schema gets the supplied parser through Standard Schema, and so does z.parse
+  expect((installed["~standard"].validate({ a: "x" }) as { value: unknown }).value).toStrictEqual({
+    a: "x",
+    tag: "supplied",
+  });
+  expect(z.parse(installed, { a: "x" })).toStrictEqual({ a: "x", tag: "supplied" });
+});
+
+test("withParser refuses a recursive schema", () => {
+  type Node = { next: Node | null };
+  const Node: z.ZodType<Node> = z.object({ next: z.lazy(() => z.nullable(Node)) });
+  expect(() => withParser(Node, () => INVALID)).toThrow(ZodCompileUnsupportedError);
+});
+
+test("withParser leaves encode on the runtime", () => {
+  const codec = z.codec(z.string(), z.number(), {
+    decode: (s) => Number(s),
+    encode: (n) => String(n),
+  });
+  const installed = withParser(codec, () => INVALID);
+  expect(z.encode(installed, 5)).toBe("5");
+});
+
+test("withParser rejects a parser whose output contradicts the schema", () => {
+  // the returned schema still claims T, so a parser that succeeds with something else would make parse() lie about its own type
+  // @ts-expect-error a number is not the output of z.string()
+  withParser(z.string(), () => 123);
+  expectTypeOf(withParser(z.string(), () => "ok")).toEqualTypeOf<z.ZodString>();
+});

package/node_modules/zod/src/v4/core/tests/email-regex.test.ts

@@ -0,0 +1,140 @@
+import { expect, test } from "vitest";
+
+import { regexes } from "zod/v4/core";
+
+// the lookahead form `regexes.email` had before this rewrite
+const legacy = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+
+const table: [string, boolean][] = [
+  ["a@b.cc", true],
+  ["first.last@example.com", true],
+  ["a.b.c.d@b.cc", true],
+  ["'a@b.cc", true],
+  ["a'b@b.cc", true],
+  ["a+b@b.cc", true],
+  ["a-@b.cc", true],
+  ["a_@b.cc", true],
+  ["a@0b.cc", true],
+  ["a@b.c.dd", true],
+  ["a@b-.cc", true],
+  [".a@b.cc", false],
+  ["a.@b.cc", false],
+  ["a..b@b.cc", false],
+  ["....@b.cc", false],
+  ["a@b..cc", false],
+  ["a@.b.cc", false],
+  ["a@b.cc.", false],
+  ["a'@b.cc", false],
+  ["'@b.cc", false],
+  ["@b.cc", false],
+  ["a@b.c", false],
+  ["a@b.c0", false],
+  ["a@-b.cc", false],
+  ["a@b.cc@d.ee", false],
+  ["a b@b.cc", false],
+  ["café@b.cc", false],
+  ["😀@b.cc", false],
+  ["a\0@b.cc", false],
+  // `$` is not multiline, so no trailing terminator is tolerated
+  ["a@b.cc\n", false],
+  ["a@b.cc\r", false],
+  ["\na@b.cc", false],
+];
+
+test("boundary cases", () => {
+  for (const [input, expected] of table) {
+    expect([input, regexes.email.test(input)]).toEqual([input, expected]);
+    expect([input, legacy.test(input)]).toEqual([input, expected]);
+  }
+});
+
+// one representative per character class the two grammars can tell apart
+const classes = ["a", "0", "_", "'", "-", ".", "@", "!", "\n"];
+
+test("exhaustive agreement over every string of length <= 6 in the class alphabet", () => {
+  const idx: number[] = [];
+  let accepted = 0;
+  for (let len = 0; len <= 6; len++) {
+    idx.length = len;
+    idx.fill(0);
+    for (;;) {
+      let s = "";
+      for (let i = 0; i < len; i++) s += classes[idx[i]!];
+      const a = legacy.test(s);
+      if (a !== regexes.email.test(s)) expect.unreachable(`disagreement on ${JSON.stringify(s)}`);
+      if (a) accepted++;
+      let p = len - 1;
+      while (p >= 0 && ++idx[p]! === classes.length) idx[p--] = 0;
+      if (p < 0) break;
+    }
+  }
+  // 4 chars can precede `@`, 2 can open a domain label, 1 is a letter for the TLD
+  expect(accepted).toBe(8);
+});
+
+function rng(seed: number) {
+  let s = seed >>> 0;
+  return () => {
+    s = (s + 0x6d2b79f5) >>> 0;
+    let t = s;
+    t = Math.imul(t ^ (t >>> 15), t | 1);
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+}
+
+const local = "abZ09_'+-.".split("");
+const domain = "abZ09-.".split("");
+const hostile = ["@", ".", "..", "...", "\n", "\r", "\0", "\t", " ", '"', "é", "😀", "\\", "<", ";", "/", "{"];
+const any = [...local, ...domain, ...hostile];
+
+function fuzz(r: () => number): string {
+  const pick = <T>(xs: T[]): T => xs[Math.floor(r() * xs.length)]!;
+  const run = (xs: string[], max: number) => {
+    let out = "";
+    for (let i = Math.floor(r() * max); i > 0; i--) out += pick(xs);
+    return out;
+  };
+  switch (Math.floor(r() * 8)) {
+    case 0:
+      return run(any, 40);
+    case 1:
+      return `${run(local, 24)}@${run(domain, 24)}`;
+    case 2:
+      return `${run(local, 8)}${".".repeat(1 + Math.floor(r() * 6))}${run(local, 8)}@${run(domain, 12)}`;
+    case 3:
+      return `${run(local, 8)}@${run(domain, 8)}${".".repeat(1 + Math.floor(r() * 6))}${run(domain, 8)}`;
+    case 4: {
+      // single-character mutation of a valid address
+      const base = `${run("abZ09_'+-".split(""), 10)}@example.com`;
+      const i = Math.floor(r() * base.length);
+      return Math.floor(r() * 3) === 0
+        ? base.slice(0, i) + pick(any) + base.slice(i)
+        : base.slice(0, i) + (Math.floor(r() * 2) ? pick(any) : "") + base.slice(i + 1);
+    }
+    case 5:
+      return (
+        "a".repeat(1 + Math.floor(r() * 60)) +
+        ".".repeat(Math.floor(r() * 4)) +
+        run(local, 4) +
+        (r() < 0.5 ? "@" : "") +
+        run(domain, 10)
+      );
+    case 6:
+      return `${run(local, 8)}@${run(domain, 6)}@${run(domain, 8)}`;
+    default:
+      return pick(["", "\n", " "]) + run(local, 8) + "@example.com" + pick(["", "\n", "\r\n", " ", "\0"]);
+  }
+}
+
+test("differential fuzz", () => {
+  const r = rng(0x5eed);
+  let accepted = 0;
+  for (let i = 0; i < 25_000; i++) {
+    const s = fuzz(r);
+    const a = legacy.test(s);
+    if (a !== regexes.email.test(s)) expect.unreachable(`disagreement on ${JSON.stringify(s)}`);
+    if (a) accepted++;
+  }
+  expect(accepted).toBeGreaterThan(500);
+});

package/node_modules/zod/src/v4/core/tests/locales/tg.test.ts

@@ -0,0 +1,85 @@
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+
+test("locales - tg", () => {
+  z.config(z.locales.tg());
+
+  const invalidType = z.number().safeParse("a");
+  expect(invalidType.error!.issues[0].code).toBe("invalid_type");
+  expect(invalidType.error!.issues[0].message).toBe("Вуруди нодуруст: рақам интизор мерафт, сатр гирифта шуд");
+
+  const invalidType2 = z.string().safeParse(1);
+  expect(invalidType2.error!.issues[0].code).toBe("invalid_type");
+  expect(invalidType2.error!.issues[0].message).toBe("Вуруди нодуруст: сатр интизор мерафт, рақам гирифта шуд");
+
+  const invalidValue = z.enum(["a", "b"]).safeParse(1);
+  expect(invalidValue.error!.issues[0].code).toBe("invalid_value");
+  expect(invalidValue.error!.issues[0].message).toBe('Интихоби нодуруст: яке аз "a"|"b" интизор мерафт');
+
+  const tooBig = z.number().max(10).safeParse(15);
+  expect(tooBig.error!.issues[0].code).toBe("too_big");
+  expect(tooBig.error!.issues[0].message).toBe("Хеле калон: number бояд <=10 бошад");
+
+  const tooSmall = z.number().min(10).safeParse(5);
+  expect(tooSmall.error!.issues[0].code).toBe("too_small");
+  expect(tooSmall.error!.issues[0].message).toBe("Хеле хурд: number бояд >=10 бошад");
+
+  // singular units after numerals in Tajik
+  const tooShort = z.string().min(5).safeParse("hi");
+  expect(tooShort.error!.issues[0].message).toBe("Хеле хурд: string бояд >=5 аломат дошта бошад");
+
+  const tooFewItems = z.array(z.number()).min(2).safeParse([1]);
+  expect(tooFewItems.error!.issues[0].message).toBe("Хеле хурд: array бояд >=2 унсур дошта бошад");
+
+  const invalidEmail = z.string().email().safeParse("nope");
+  expect(invalidEmail.error!.issues[0].code).toBe("invalid_format");
+  expect(invalidEmail.error!.issues[0].message).toBe("суроғаи email-и нодуруст");
+
+  const invalidStart = z.string().startsWith("ab").safeParse("xy");
+  expect(invalidStart.error!.issues[0].message).toBe('Сатри нодуруст: бояд бо "ab" оғоз шавад');
+
+  const invalidRegex = z.string().regex(/abcd/).safeParse("xy");
+  expect(invalidRegex.error!.issues[0].message).toContain("мувофиқат кунад");
+
+  const notMultipleOf = z.number().multipleOf(5).safeParse(7);
+  expect(notMultipleOf.error!.issues[0].message).toBe("Рақами нодуруст: бояд ба 5 бе бақия тақсим шавад");
+
+  const oneUnknownKey = z.strictObject({ a: z.string() }).safeParse({ a: "x", b: 1 });
+  expect(oneUnknownKey.error!.issues[0].message).toBe('Калиди номаълум: "b"');
+
+  const twoUnknownKeys = z.strictObject({ a: z.string() }).safeParse({ a: "x", b: 1, c: 2 });
+  expect(twoUnknownKeys.error!.issues[0].message).toBe('Калидҳои номаълум: "b", "c"');
+
+  const cases: [z.ZodType, unknown, string][] = [
+    [z.literal("a"), "b", 'Вуруди нодуруст: "a" интизор мерафт'],
+    [z.boolean(), null, "Вуруди нодуруст: boolean интизор мерафт, null гирифта шуд"],
+    [z.number(), Number.NaN, "Вуруди нодуруст: рақам интизор мерафт, NaN гирифта шуд"],
+    [z.number().lt(10), 10, "Хеле калон: number бояд <10 бошад"],
+    [z.number().gt(10), 10, "Хеле хурд: number бояд >10 бошад"],
+    [z.string().max(1), "ab", "Хеле калон: string бояд <=1 аломат дошта бошад"],
+    [z.set(z.string()).min(1), new Set(), "Хеле хурд: set бояд >=1 унсур дошта бошад"],
+    [z.map(z.string(), z.number()).min(1), new Map(), "Хеле хурд: map бояд >=1 сабт дошта бошад"],
+    [z.file().min(1), new File([], "empty"), "Хеле хурд: file бояд >=1 байт дошта бошад"],
+    [z.string().endsWith("ab"), "xy", 'Сатри нодуруст: бояд бо "ab" анҷом ёбад'],
+    [z.string().includes("ab"), "xy", 'Сатри нодуруст: бояд "ab"-ро дар бар гирад'],
+    [z.stringFormat("custom", () => false), "xy", "custom-и нодуруст"],
+    [z.union([z.string(), z.number()]), null, "Вуруди нодуруст"],
+    [
+      z.discriminatedUnion("kind", [z.object({ kind: z.literal("a") }), z.object({ kind: z.literal("b") })]),
+      { kind: "c" },
+      "Қимати нодурусти дискриминатор: 'a' | 'b' интизор мерафт",
+    ],
+    [z.record(z.string().min(2), z.number()), { a: 1 }, "Калиди нодуруст дар record"],
+    [z.map(z.string(), z.number()), new Map([[{}, 1]]), "Калиди нодуруст дар map"],
+    [z.map(z.object({}), z.number()), new Map([[{}, "a"]]), "Қимати нодуруст дар map"],
+    [z.custom(() => false), "a", "Вуруди нодуруст"],
+  ];
+  for (const [schema, input, message] of cases) {
+    expect(schema.safeParse(input).error!.issues[0].message).toBe(message);
+  }
+
+  expect(z.object({ name: z.string().min(1), age: z.number().min(0) }).parse({ name: "Ali", age: 30 })).toEqual({
+    name: "Ali",
+    age: 30,
+  });
+});