@orval/zod 8.32.0 → 8.34.0

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { ClientBuilder, ClientDependenciesBuilder, ClientGeneratorsBuilder, ContextSpec, GeneratorMutator, OpenApiParameterObject, OpenApiReferenceObject, OpenApiSchemaObject, PackageJson, ZodCoerceType, ZodVariantOption, ZodVersionOption } from "@orval/core";
+import { ClientBuilder, ClientDependenciesBuilder, ClientGeneratorsBuilder, ContextSpec, GeneratorMutator, GeneratorVerbOptions, OpenApiParameterObject, OpenApiReferenceObject, OpenApiSchemaObject, PackageJson, ZodCoerceType, ZodVariantOption, ZodVersionOption } from "@orval/core";
 //#region src/compatible-v4.d.ts
-declare const isZodVersionV4: (packageJson: PackageJson) => boolean;
+export declare const isZodVersionV4: (packageJson: PackageJson) => boolean;
 /**
  * Resolves whether to emit Zod 4-style output.
  *
@@ -11,13 +11,13 @@ declare const isZodVersionV4: (packageJson: PackageJson) => boolean;
  * still get the modern baseline. This keeps generation deterministic when a
  * target is pinned while preserving package-detection for `'auto'`.
  */
-declare const resolveIsZodV4: (version: ZodVersionOption | undefined, packageJson: PackageJson | undefined) => boolean;
-declare const assertZodTarget: ({ variant, isZodV4 }: {
+export declare const resolveIsZodV4: (version: ZodVersionOption | undefined, packageJson: PackageJson | undefined) => boolean;
+export declare const assertZodTarget: ({ variant, isZodV4 }: {
   variant: ZodVariantOption | undefined;
   isZodV4: boolean;
 }) => void;
-declare const getZodImportSource: (variant: ZodVariantOption | undefined) => "zod/mini" | "zod";
-declare const getZodTypeName: (variant: ZodVariantOption | undefined) => "ZodMiniType" | "ZodType";
+export declare const getZodImportSource: (variant: ZodVariantOption | undefined) => "zod/mini" | "zod";
+export declare const getZodTypeName: (variant: ZodVariantOption | undefined) => "ZodMiniType" | "ZodType";
 //#endregion
 //#region src/export-emitter.d.ts
 /**
@@ -70,12 +70,12 @@ interface ZodExportBlock {
  * or a recursive `zod.ZodType<X>` pin. See {@link ZodExportBlock} for what
  * this deliberately leaves to the caller.
  */
-declare const renderZodExport: (block: ZodExportBlock) => string;
+export declare const renderZodExport: (block: ZodExportBlock) => string;
 //#endregion
 //#region src/index.d.ts
-declare const getZodDependencies: ClientDependenciesBuilder;
-declare const predefinedZodFormats: Set<string>;
-interface ZodValidationSchemaDefinition {
+export declare const getZodDependencies: ClientDependenciesBuilder;
+export declare const predefinedZodFormats: Set<string>;
+export interface ZodValidationSchemaDefinition {
   functions: [string, unknown][];
   consts: string[];
 }
@@ -87,7 +87,7 @@ interface DateTimeOptions {
 interface TimeOptions {
   precision?: -1 | 0 | 1 | 2 | 3;
 }
-declare const generateZodValidationSchemaDefinition: (schema: OpenApiSchemaObject | OpenApiReferenceObject | undefined, context: ContextSpec, name: string, strict: boolean, isZodV4: boolean, rules?: {
+export declare const generateZodValidationSchemaDefinition: (schema: OpenApiSchemaObject | OpenApiReferenceObject | undefined, context: ContextSpec, name: string, strict: boolean, isZodV4: boolean, rules?: {
   required?: boolean;
   /**
    * Required keys inherited from sibling `allOf` members. Per JSON Schema /
@@ -138,7 +138,7 @@ declare const generateZodValidationSchemaDefinition: (schema: OpenApiSchemaObjec
  * every emitted validator. Exported so consumers can type their function with
  * `import type { ZodParamsContext } from 'orval'` instead of hand-writing it.
  */
-interface ZodParamsContext {
+export interface ZodParamsContext {
   /** The OpenAPI `operationId`, or `''` for shared component schemas. */
   operationId: string;
   /** `'schema'` is used for shared component schemas with no owning operation. */
@@ -150,16 +150,16 @@ interface ZodParamsContext {
   /** The Zod method being emitted, e.g. `'string'`, `'min'`, `'email'`. */
   validator: string;
 }
-interface ZodParamsInjection extends Pick<ZodParamsContext, 'operationId' | 'location' | 'schemaName'> {
+export interface ZodParamsInjection extends Pick<ZodParamsContext, 'operationId' | 'location' | 'schemaName'> {
   mutator: GeneratorMutator;
 }
-interface ZodMetaArgs {
+export interface ZodMetaArgs {
   id?: string;
   title?: string;
   description?: string;
   deprecated?: boolean;
 }
-declare const parseZodValidationSchemaDefinition: (input: ZodValidationSchemaDefinition, context: ContextSpec, coerceTypes: boolean | ZodCoerceType[] | undefined, strict: boolean, isZodV4: boolean, preprocess?: GeneratorMutator, paramsInjection?: ZodParamsInjection, variant?: ZodVariantOption, exactOptional?: boolean) => {
+export declare const parseZodValidationSchemaDefinition: (input: ZodValidationSchemaDefinition, context: ContextSpec, coerceTypes: boolean | ZodCoerceType[] | undefined, strict: boolean, isZodV4: boolean, preprocess?: GeneratorMutator, paramsInjection?: ZodParamsInjection, variant?: ZodVariantOption, exactOptional?: boolean) => {
   zod: string;
   consts: string;
   usedRefs: Set<string>;
@@ -178,16 +178,23 @@ declare const parseZodValidationSchemaDefinition: (input: ZodValidationSchemaDef
  *  3. If resolved to a concrete schema, inline it (same as `$ref`).
  *  4. If unresolved, external, or a generic parameter → return `{}`.
  */
-declare const dereference: (schema: OpenApiSchemaObject | OpenApiReferenceObject, context: ContextSpec) => OpenApiSchemaObject;
+export declare const dereference: (schema: OpenApiSchemaObject | OpenApiReferenceObject, context: ContextSpec) => OpenApiSchemaObject;
 /**
  * Generate zod schema for form-data request body.
  * Handles file type detection for top-level properties based on encoding.contentType
  * and contentMediaType. Mirrors type gen's resolveFormDataRootObject.
  */
-declare const generateFormDataZodSchema: (schema: OpenApiSchemaObject, context: ContextSpec, name: string, strict: boolean, isZodV4: boolean, encoding?: Record<string, {
+export declare const generateFormDataZodSchema: (schema: OpenApiSchemaObject, context: ContextSpec, name: string, strict: boolean, isZodV4: boolean, encoding?: Record<string, {
   contentType?: string;
 }>, useReusableSchemas?: boolean) => ZodValidationSchemaDefinition;
-declare const parseParameters: ({ data, context, operationName, isZodV4, strict, generate, useReusableSchemas }: {
+/** The success response is emitted as a plain `zod.object(...)`. */
+export declare const isObjectResponseSchema: (verbOptions: Pick<GeneratorVerbOptions, "verb" | "pathRoute" | "override">, context: ContextSpec) => boolean;
+/**
+ * A `<Operation>Response` schema that can be converted to JSON Schema is
+ * emitted for the success response.
+ */
+export declare const hasResponseSchema: (verbOptions: Pick<GeneratorVerbOptions, "verb" | "pathRoute" | "override">, context: ContextSpec) => boolean;
+export declare const parseParameters: ({ data, context, operationName, isZodV4, strict, generate, useReusableSchemas }: {
   data: (OpenApiParameterObject | OpenApiReferenceObject)[] | undefined;
   context: ContextSpec;
   operationName: string;
@@ -212,8 +219,8 @@ declare const parseParameters: ({ data, context, operationName, isZodV4, strict,
   queryParams: ZodValidationSchemaDefinition;
   params: ZodValidationSchemaDefinition;
 };
-declare const generateZod: ClientBuilder;
-declare const builder: () => () => ClientGeneratorsBuilder;
+export declare const generateZod: ClientBuilder;
+export declare const builder: () => () => ClientGeneratorsBuilder;
 //#endregion
-export { type ZodExportBlock, ZodMetaArgs, ZodParamsContext, ZodParamsInjection, ZodValidationSchemaDefinition, assertZodTarget, builder, builder as default, dereference, generateFormDataZodSchema, generateZod, generateZodValidationSchemaDefinition, getZodDependencies, getZodImportSource, getZodTypeName, isZodVersionV4, parseParameters, parseZodValidationSchemaDefinition, predefinedZodFormats, renderZodExport, resolveIsZodV4 };
+export { type ZodExportBlock, builder as default };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -65,8 +65,37 @@ const getLooseObjectFunctionName = (isZodV4) => {
 //#region src/export-emitter.ts
 /** Marks a call as side-effect-free for bundlers' tree-shaking passes. */
 const PURE_COMMENT = "/*#__PURE__*/ ";
+/**
+* A dotted path of JavaScript identifiers — the only shape a Zod method name
+* may take. The dots are for zod v4's namespaced constructors (`iso.datetime`,
+* `iso.date`), which the emitters reach through this same path.
+*/
+const ZOD_METHOD_NAME_PATTERN = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/;
+/**
+* Refuses a Zod method name that is not a plain (optionally dotted) identifier.
+*
+* Method names are interpolated unquoted into generated source (`zod.<fn>()`,
+* `.<fn>(...)`), so anything else there is executable code rather than a call.
+* Every name reaching an emitter is generator-chosen, so this only fires when a
+* spec-derived string has leaked into a code position — which is exactly how a
+* schema's scalar `type` became import-time RCE.
+*
+* Called at each interpolation site rather than once up front: a definition
+* tuple's name is not always a method name. The discriminator path smuggles
+* `oneOf::discriminator::<property>` through the same field, and the branches
+* that consume those decode them instead of emitting them.
+*
+* @see GHSA-v263-cp2v-vrrx
+*/
+const assertZodMethodName = (fn) => {
+	if (ZOD_METHOD_NAME_PATTERN.test(fn)) return;
+	throw new Error(`orval: refusing to generate a Zod schema with "${fn}" as a method name — it is not a plain identifier. This value would otherwise be emitted verbatim into generated source.`);
+};
 /** Renders a Zod Mini functional call, e.g. `zod.minLength(1)`, with the pure-call comment. */
-const zodMiniCall = (fn, args = "") => `${PURE_COMMENT}zod.${fn}(${args})`;
+const zodMiniCall = (fn, args = "") => {
+	assertZodMethodName(fn);
+	return `${PURE_COMMENT}zod.${fn}(${args})`;
+};
 const renderArrayWithBounds = (itemName, variant, rules) => {
 	if (variant === "mini") {
 		const checks = [...rules?.min ? [zodMiniCall("minLength", `${rules.min}`)] : [], ...rules?.max ? [zodMiniCall("maxLength", `${rules.max}`)] : []];
@@ -145,7 +174,7 @@ const resolveZodType = (schema) => {
 		if (type === "array" && "prefixItems" in schema) return "tuple";
 		return type;
 	}
-	const type = isString(schemaTypeValue) ? schemaTypeValue : void 0;
+	const type = isString(schemaTypeValue) && possibleSchemaTypes.has(schemaTypeValue) ? schemaTypeValue : void 0;
 	if (schema.type === "array" && "prefixItems" in schema) return "tuple";
 	if (!type && "const" in schema) {
 		const constValue = schema.const;
@@ -163,7 +192,10 @@ const COERCIBLE_TYPES = /* @__PURE__ */ new Set([
 	"bigint",
 	"date"
 ]);
-const zodMiniCoerceCall = (fn, args = "") => `${PURE_COMMENT}zod.coerce.${fn}(${args})`;
+const zodMiniCoerceCall = (fn, args = "") => {
+	assertZodMethodName(fn);
+	return `${PURE_COMMENT}zod.coerce.${fn}(${args})`;
+};
 const hasUnicodePropertyEscape = (pattern) => /(^|[^\\])(?:\\\\)*\\[pP]\{/.test(pattern);
 const buildRegExpLiteral = (pattern) => {
 	const innerPattern = pattern.slice(pattern.startsWith("/") ? 1 : 0, pattern.endsWith("/") ? -1 : void 0);
@@ -1251,8 +1283,12 @@ ${Object.entries(objectArgs).map(([key, schema]) => {
 			if (shouldCoerce("number")) return `.coerce.number(${numberArgs}).int(${combinedArgs})`;
 			if (!isZodV4) return `.number(${numberArgs}).int(${combinedArgs})`;
 		}
-		if (fn !== "date" && shouldCoerceType || fn === "date" && shouldCoerceType && context.output.override.useDates) return `.coerce.${fn}(${combinedArgs})`;
+		if (fn !== "date" && shouldCoerceType || fn === "date" && shouldCoerceType && context.output.override.useDates) {
+			assertZodMethodName(fn);
+			return `.coerce.${fn}(${combinedArgs})`;
+		}
 		if (exactOptional && isZodV4 && fn === "optional") return ".exactOptional()";
+		assertZodMethodName(fn);
 		return `.${fn}(${combinedArgs})`;
 	};
 	appendConstsChunk(input.consts.join("\n"));
@@ -1501,6 +1537,64 @@ const getSingleResponse = (responses) => {
 	const otherSuccess = Object.entries(responses).find(([code]) => code.startsWith("2") && code !== "204" && code !== "205")?.[1];
 	return responses["200"] ?? responses["2XX"] ?? responses["2xx"] ?? otherSuccess ?? responses["204"] ?? responses["205"];
 };
+const parseResponseSchema = ({ verb, pathRoute, override }, context) => {
+	const isZodV4 = resolveIsZodV4(context.output.override.zod.version, context.output.packageJson);
+	return {
+		isZodV4,
+		...parseBodyAndResponse({
+			data: getSingleResponse(context.spec.paths?.[pathRoute]?.[verb]?.responses),
+			context,
+			name: "response",
+			strict: override.zod.strict.response,
+			generate: override.zod.generate.response,
+			isZodV4,
+			parseType: "response"
+		})
+	};
+};
+/** The success response is emitted as a plain `zod.object(...)`. */
+const isObjectResponseSchema = (verbOptions, context) => {
+	if (context.output.override.zod.generateEachHttpStatus) return false;
+	const { input, isArray, isZodV4 } = parseResponseSchema(verbOptions, context);
+	const [root, ...modifiers] = input.functions;
+	if (isArray || root === void 0) return false;
+	if (verbOptions.override.zod.preprocess?.response || verbOptions.override.zod.useBrandedTypes && !isZodV4) return false;
+	const objectRoots = /* @__PURE__ */ new Set([
+		"object",
+		"looseObject",
+		"strictObject"
+	]);
+	const objectModifiers = /* @__PURE__ */ new Set([
+		"strict",
+		"passthrough",
+		"describe"
+	]);
+	return objectRoots.has(root[0]) && modifiers.every(([fn]) => objectModifiers.has(fn));
+};
+/**
+* A `<Operation>Response` schema that can be converted to JSON Schema is
+* emitted for the success response.
+*/
+const hasResponseSchema = (verbOptions, context) => {
+	if (context.output.override.zod.generateEachHttpStatus) return false;
+	const { input, isArray } = parseResponseSchema(verbOptions, context);
+	if (!isArray && input.functions.length === 0) return false;
+	const unsupportedTypes = /* @__PURE__ */ new Set([
+		"allOf",
+		"date",
+		"instanceof"
+	]);
+	const containsUnsupported = (value) => {
+		if (Array.isArray(value)) return value.some(containsUnsupported);
+		if (!isObject(value)) return false;
+		if (Array.isArray(value.functions)) {
+			const functions = value.functions;
+			return functions[0] !== void 0 && unsupportedTypes.has(functions[0][0]) || functions.some(([, args]) => containsUnsupported(args));
+		}
+		return Object.values(value).some(containsUnsupported);
+	};
+	return !containsUnsupported(input);
+};
 const parseParameters = ({ data, context, operationName, isZodV4, strict, generate, useReusableSchemas }) => {
 	if (!data) return {
 		headers: {
@@ -1824,6 +1918,6 @@ const zodClientBuilder = {
 };
 const builder = () => () => zodClientBuilder;
 //#endregion
-export { assertZodTarget, builder, builder as default, dereference, generateFormDataZodSchema, generateZod, generateZodValidationSchemaDefinition, getZodDependencies, getZodImportSource, getZodTypeName, isZodVersionV4, parseParameters, parseZodValidationSchemaDefinition, predefinedZodFormats, renderZodExport, resolveIsZodV4 };
+export { assertZodTarget, builder, builder as default, dereference, generateFormDataZodSchema, generateZod, generateZodValidationSchemaDefinition, getZodDependencies, getZodImportSource, getZodTypeName, hasResponseSchema, isObjectResponseSchema, isZodVersionV4, parseParameters, parseZodValidationSchemaDefinition, predefinedZodFormats, renderZodExport, resolveIsZodV4 };
 
 //# sourceMappingURL=index.mjs.map