@rio-cloud/cdk-v2-constructs 9.0.0-alpha.8 → 9.0.0

package/lib/fargate/trace-sampling.d.ts

@@ -0,0 +1,87 @@
+import type * as constructs from 'constructs';
+/**
+ * The trace sampling strategy used by the Fargate Datadog integration.
+ */
+export declare enum TraceSamplingMode {
+    /**
+     * Use RIO's per-Agent head-sampling target of 5 traces/sec and an additional
+     * error-sampling budget of 10 local error trace chunks/sec.
+     * Target-per-second sampling is a practical default for both low- and
+     * high-traffic services.
+     */
+    DEFAULT = 0,
+    /** Do not set sampling environment variables; retain Datadog's defaults. */
+    DATADOG_DEFAULT = 1,
+    /** Set a fixed sampling rule on the application tracer. */
+    FIXED_RATE = 2,
+    /** Set a per-Agent target number of traces per second. */
+    TARGET_PER_SECOND = 3
+}
+/**
+ * Use RIO's default Datadog Agent sampling targets.
+ *
+ * This is also the default when `traceSampling` is omitted.
+ */
+export interface RioDefaultTraceSamplingOptions {
+    /**
+     * The sampling strategy. May be omitted to use the default.
+     *
+     * @defaultValue - `TraceSamplingMode.DEFAULT`
+     */
+    readonly mode?: TraceSamplingMode.DEFAULT;
+}
+/** Do not set sampling environment variables; retain Datadog's defaults. */
+export interface DatadogDefaultTraceSamplingOptions {
+    /** The sampling strategy. */
+    readonly mode: TraceSamplingMode.DATADOG_DEFAULT;
+}
+/** Configure a fixed application-tracer sampling rate. */
+export interface FixedRateTraceSamplingOptions {
+    /** The sampling strategy. */
+    readonly mode: TraceSamplingMode.FIXED_RATE;
+    /**
+     * The global tracer sampling-rule rate, from 0.0 to 1.0 inclusive.
+     * Datadog tracers additionally apply their built-in 100-traces-per-second
+     * rate limit when sampling rules are configured. This construct does not
+     * expose or override that per-instance safeguard.
+     */
+    readonly fixedRate: number;
+}
+/** Configure Datadog Agent target sampling. */
+export interface TargetPerSecondTraceSamplingOptions {
+    /** The sampling strategy. */
+    readonly mode: TraceSamplingMode.TARGET_PER_SECOND;
+    /**
+     * The average head-sampling target in traces per second for each Agent
+     * sidecar (and therefore each Fargate service instance). Traffic spikes
+     * can exceed this target; it is not a hard cap on total ingestion.
+     */
+    readonly targetTracesPerSecond: number;
+    /**
+     * The budget for additional local error trace chunks per second missed by
+     * head sampling, for each Agent sidecar (and therefore each Fargate service
+     * instance). This does not cap error traces already kept by head sampling.
+     */
+    readonly errorTracesPerSecond?: number;
+}
+/**
+ * Options for configuring Datadog APM trace sampling.
+ *
+ * This discriminated union makes mode-specific settings invalid in TypeScript
+ * before synthesis. Numeric ranges are checked during synthesis.
+ */
+export type TraceSamplingOptions = RioDefaultTraceSamplingOptions | DatadogDefaultTraceSamplingOptions | FixedRateTraceSamplingOptions | TargetPerSecondTraceSamplingOptions;
+export declare class TraceSamplingValidator implements constructs.IValidation {
+    private readonly traceSampling?;
+    constructor(traceSampling?: TraceSamplingOptions | undefined);
+    validate(): string[];
+}
+export declare function addTraceSamplingEnvironmentWarning(scope: constructs.Construct, environment: {
+    [key: string]: string;
+} | undefined): void;
+export declare function getApplicationTraceSamplingEnvironment(traceSampling?: TraceSamplingOptions): {
+    [key: string]: string;
+};
+export declare function getAgentTraceSamplingEnvironment(traceSampling?: TraceSamplingOptions): {
+    [key: string]: string;
+};

package/lib/fargate/trace-sampling.js

@@ -0,0 +1,123 @@
+"use strict";
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TraceSamplingValidator = exports.TraceSamplingMode = void 0;
+exports.addTraceSamplingEnvironmentWarning = addTraceSamplingEnvironmentWarning;
+exports.getApplicationTraceSamplingEnvironment = getApplicationTraceSamplingEnvironment;
+exports.getAgentTraceSamplingEnvironment = getAgentTraceSamplingEnvironment;
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const cdk = require("aws-cdk-lib");
+/**
+ * The trace sampling strategy used by the Fargate Datadog integration.
+ */
+var TraceSamplingMode;
+(function (TraceSamplingMode) {
+    /**
+     * Use RIO's per-Agent head-sampling target of 5 traces/sec and an additional
+     * error-sampling budget of 10 local error trace chunks/sec.
+     * Target-per-second sampling is a practical default for both low- and
+     * high-traffic services.
+     */
+    TraceSamplingMode[TraceSamplingMode["DEFAULT"] = 0] = "DEFAULT";
+    /** Do not set sampling environment variables; retain Datadog's defaults. */
+    TraceSamplingMode[TraceSamplingMode["DATADOG_DEFAULT"] = 1] = "DATADOG_DEFAULT";
+    /** Set a fixed sampling rule on the application tracer. */
+    TraceSamplingMode[TraceSamplingMode["FIXED_RATE"] = 2] = "FIXED_RATE";
+    /** Set a per-Agent target number of traces per second. */
+    TraceSamplingMode[TraceSamplingMode["TARGET_PER_SECOND"] = 3] = "TARGET_PER_SECOND";
+})(TraceSamplingMode || (exports.TraceSamplingMode = TraceSamplingMode = {}));
+class TraceSamplingValidator {
+    constructor(traceSampling) {
+        this.traceSampling = traceSampling;
+    }
+    validate() {
+        const options = this.traceSampling;
+        if (!options) {
+            return [];
+        }
+        // Keep validating the runtime shape: JavaScript consumers and TypeScript
+        // callers using a cast can bypass the discriminated union.
+        const values = options;
+        const mode = values.mode ?? TraceSamplingMode.DEFAULT;
+        const hasFixedRate = values.fixedRate !== undefined;
+        const hasTargetTps = values.targetTracesPerSecond !== undefined;
+        const hasErrorTps = values.errorTracesPerSecond !== undefined;
+        const errors = [];
+        const isNonNegativeInteger = (value) => value !== undefined && Number.isInteger(value) && value >= 0;
+        if (mode === TraceSamplingMode.DEFAULT || mode === TraceSamplingMode.DATADOG_DEFAULT) {
+            if (hasFixedRate || hasTargetTps || hasErrorTps) {
+                errors.push(`${TraceSamplingMode[mode]} does not accept fixedRate, targetTracesPerSecond, or errorTracesPerSecond.`);
+            }
+        }
+        else if (mode === TraceSamplingMode.FIXED_RATE) {
+            const fixedRate = values.fixedRate;
+            if (!hasFixedRate ||
+                fixedRate === undefined ||
+                !Number.isFinite(fixedRate) ||
+                fixedRate < 0.0 ||
+                fixedRate > 1.0) {
+                errors.push('FIXED_RATE requires fixedRate to be a number between 0 and 1 inclusive.');
+            }
+            if (hasTargetTps) {
+                errors.push('FIXED_RATE does not accept targetTracesPerSecond.');
+            }
+            if (hasErrorTps) {
+                errors.push('FIXED_RATE does not accept errorTracesPerSecond.');
+            }
+        }
+        else if (mode === TraceSamplingMode.TARGET_PER_SECOND) {
+            if (!isNonNegativeInteger(values.targetTracesPerSecond)) {
+                errors.push('TARGET_PER_SECOND requires targetTracesPerSecond to be a non-negative integer.');
+            }
+            if (hasFixedRate) {
+                errors.push('TARGET_PER_SECOND does not accept fixedRate.');
+            }
+            if (hasErrorTps && !isNonNegativeInteger(values.errorTracesPerSecond)) {
+                errors.push('TARGET_PER_SECOND errorTracesPerSecond must be a non-negative integer.');
+            }
+        }
+        else {
+            errors.push('traceSampling.mode must be a TraceSamplingMode value.');
+        }
+        return errors;
+    }
+}
+exports.TraceSamplingValidator = TraceSamplingValidator;
+_a = JSII_RTTI_SYMBOL_1;
+TraceSamplingValidator[_a] = { fqn: "@rio-cloud-internal/cdk-v2-constructs.TraceSamplingValidator", version: "0.0.0" };
+function addTraceSamplingEnvironmentWarning(scope, environment) {
+    const samplingKeys = ['DD_TRACE_SAMPLING_RULES', 'DD_TRACE_SAMPLE_RATE', 'DD_APM_TARGET_TPS', 'DD_APM_ERROR_TPS'];
+    const configuredKeys = samplingKeys.filter(key => environment && key in environment);
+    if (configuredKeys.length > 0) {
+        cdk.Validations.of(scope).addWarning('@rio-cloud/cdk-v2-constructs:directTraceSamplingEnvironment', [
+            `Direct trace-sampling environment variable(s) detected: ${configuredKeys.join(', ')}.`,
+            'Recommended action: remove these variables to use the DEFAULT sampling policy.',
+            'To select a different policy, configure datadogOptions.traceSampling explicitly.',
+            'Direct sampling environment variables remain supported only for backwards compatibility. Users who choose them are responsible for their compatibility and maintenance.',
+        ].join('\n'));
+    }
+}
+function getApplicationTraceSamplingEnvironment(traceSampling) {
+    if (traceSampling?.mode === TraceSamplingMode.FIXED_RATE) {
+        const rules = [{ sample_rate: traceSampling.fixedRate }];
+        return { DD_TRACE_SAMPLING_RULES: JSON.stringify(rules) };
+    }
+    return {};
+}
+function getAgentTraceSamplingEnvironment(traceSampling) {
+    if (traceSampling?.mode === undefined || traceSampling.mode === TraceSamplingMode.DEFAULT) {
+        return { DD_APM_TARGET_TPS: '5', DD_APM_ERROR_TPS: '10' };
+    }
+    if (traceSampling?.mode === TraceSamplingMode.TARGET_PER_SECOND) {
+        const environment = {};
+        if (traceSampling.targetTracesPerSecond !== undefined) {
+            environment.DD_APM_TARGET_TPS = String(traceSampling.targetTracesPerSecond);
+        }
+        if (traceSampling.errorTracesPerSecond !== undefined) {
+            environment.DD_APM_ERROR_TPS = String(traceSampling.errorTracesPerSecond);
+        }
+        return environment;
+    }
+    return {};
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhY2Utc2FtcGxpbmcuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvZmFyZ2F0ZS90cmFjZS1zYW1wbGluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7O0FBZ0tBLGdGQWlCQztBQUVELHdGQVFDO0FBRUQsNEVBZUM7O0FBNU1ELG1DQUFtQztBQUduQzs7R0FFRztBQUNILElBQVksaUJBaUJYO0FBakJELFdBQVksaUJBQWlCO0lBQzNCOzs7OztPQUtHO0lBQ0gsK0RBQU8sQ0FBQTtJQUVQLDRFQUE0RTtJQUM1RSwrRUFBZSxDQUFBO0lBRWYsMkRBQTJEO0lBQzNELHFFQUFVLENBQUE7SUFFViwwREFBMEQ7SUFDMUQsbUZBQWlCLENBQUE7QUFDbkIsQ0FBQyxFQWpCVyxpQkFBaUIsaUNBQWpCLGlCQUFpQixRQWlCNUI7QUE0RUQsTUFBYSxzQkFBc0I7SUFDakMsWUFBNkIsYUFBb0M7UUFBcEMsa0JBQWEsR0FBYixhQUFhLENBQXVCO0lBQUcsQ0FBQztJQUVyRSxRQUFRO1FBQ04sTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQztRQUNuQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixPQUFPLEVBQUUsQ0FBQztRQUNaLENBQUM7UUFFRCx5RUFBeUU7UUFDekUsMkRBQTJEO1FBQzNELE1BQU0sTUFBTSxHQUFHLE9BQThCLENBQUM7UUFDOUMsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksSUFBSSxpQkFBaUIsQ0FBQyxPQUFPLENBQUM7UUFDdEQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUM7UUFDcEQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLHFCQUFxQixLQUFLLFNBQVMsQ0FBQztRQUNoRSxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsb0JBQW9CLEtBQUssU0FBUyxDQUFDO1FBQzlELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztRQUM1QixNQUFNLG9CQUFvQixHQUFHLENBQUMsS0FBeUIsRUFBRSxFQUFFLENBQ3pELEtBQUssS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDO1FBRS9ELElBQUksSUFBSSxLQUFLLGlCQUFpQixDQUFDLE9BQU8sSUFBSSxJQUFJLEtBQUssaUJBQWlCLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDckYsSUFBSSxZQUFZLElBQUksWUFBWSxJQUFJLFdBQVcsRUFBRSxDQUFDO2dCQUNoRCxNQUFNLENBQUMsSUFBSSxDQUNULEdBQUcsaUJBQWlCLENBQUMsSUFBSSxDQUFDLDZFQUE2RSxDQUN4RyxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7YUFBTSxJQUFJLElBQUksS0FBSyxpQkFBaUIsQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNqRCxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDO1lBQ25DLElBQ0UsQ0FBQyxZQUFZO2dCQUNiLFNBQVMsS0FBSyxTQUFTO2dCQUN2QixDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO2dCQUMzQixTQUFTLEdBQUcsR0FBRztnQkFDZixTQUFTLEdBQUcsR0FBRyxFQUNmLENBQUM7Z0JBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyx5RUFBeUUsQ0FBQyxDQUFDO1lBQ3pGLENBQUM7WUFDRCxJQUFJLFlBQVksRUFBRSxDQUFDO2dCQUNqQixNQUFNLENBQUMsSUFBSSxDQUFDLG1EQUFtRCxDQUFDLENBQUM7WUFDbkUsQ0FBQztZQUNELElBQUksV0FBVyxFQUFFLENBQUM7Z0JBQ2hCLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0RBQWtELENBQUMsQ0FBQztZQUNsRSxDQUFDO1FBQ0gsQ0FBQzthQUFNLElBQUksSUFBSSxLQUFLLGlCQUFpQixDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDeEQsSUFBSSxDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxxQkFBcUIsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0ZBQWdGLENBQUMsQ0FBQztZQUNoRyxDQUFDO1lBQ0QsSUFBSSxZQUFZLEVBQUUsQ0FBQztnQkFDakIsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1lBQzlELENBQUM7WUFDRCxJQUFJLFdBQVcsSUFBSSxDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztZQUN4RixDQUFDO1FBQ0gsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLENBQUMsSUFBSSxDQUFDLHVEQUF1RCxDQUFDLENBQUM7UUFDdkUsQ0FBQztRQUVELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7O0FBMURILHdEQTJEQzs7O0FBRUQsU0FBZ0Isa0NBQWtDLENBQ2hELEtBQTJCLEVBQzNCLFdBQWtEO0lBRWxELE1BQU0sWUFBWSxHQUFHLENBQUMseUJBQXlCLEVBQUUsc0JBQXNCLEVBQUUsbUJBQW1CLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztJQUNsSCxNQUFNLGNBQWMsR0FBRyxZQUFZLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsV0FBVyxJQUFJLEdBQUcsSUFBSSxXQUFXLENBQUMsQ0FBQztJQUNyRixJQUFJLGNBQWMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDOUIsR0FBRyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsVUFBVSxDQUNsQyw2REFBNkQsRUFDN0Q7WUFDRSwyREFBMkQsY0FBYyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRztZQUN2RixnRkFBZ0Y7WUFDaEYsa0ZBQWtGO1lBQ2xGLHlLQUF5SztTQUMxSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FDYixDQUFDO0lBQ0osQ0FBQztBQUNILENBQUM7QUFFRCxTQUFnQixzQ0FBc0MsQ0FBQyxhQUFvQztJQUd6RixJQUFJLGFBQWEsRUFBRSxJQUFJLEtBQUssaUJBQWlCLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDekQsTUFBTSxLQUFLLEdBQUcsQ0FBQyxFQUFFLFdBQVcsRUFBRSxhQUFhLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUN6RCxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0lBQzVELENBQUM7SUFDRCxPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUM7QUFFRCxTQUFnQixnQ0FBZ0MsQ0FBQyxhQUFvQztJQUNuRixJQUFJLGFBQWEsRUFBRSxJQUFJLEtBQUssU0FBUyxJQUFJLGFBQWEsQ0FBQyxJQUFJLEtBQUssaUJBQWlCLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDMUYsT0FBTyxFQUFFLGlCQUFpQixFQUFFLEdBQUcsRUFBRSxnQkFBZ0IsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUM1RCxDQUFDO0lBQ0QsSUFBSSxhQUFhLEVBQUUsSUFBSSxLQUFLLGlCQUFpQixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDaEUsTUFBTSxXQUFXLEdBQThCLEVBQUUsQ0FBQztRQUNsRCxJQUFJLGFBQWEsQ0FBQyxxQkFBcUIsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0RCxXQUFXLENBQUMsaUJBQWlCLEdBQUcsTUFBTSxDQUFDLGFBQWEsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxJQUFJLGFBQWEsQ0FBQyxvQkFBb0IsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNyRCxXQUFXLENBQUMsZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQzVFLENBQUM7UUFDRCxPQUFPLFdBQVcsQ0FBQztJQUNyQixDQUFDO0lBQ0QsT0FBTyxFQUFFLENBQUM7QUFDWixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB0eXBlICogYXMgY29uc3RydWN0cyBmcm9tICdjb25zdHJ1Y3RzJztcblxuLyoqXG4gKiBUaGUgdHJhY2Ugc2FtcGxpbmcgc3RyYXRlZ3kgdXNlZCBieSB0aGUgRmFyZ2F0ZSBEYXRhZG9nIGludGVncmF0aW9uLlxuICovXG5leHBvcnQgZW51bSBUcmFjZVNhbXBsaW5nTW9kZSB7XG4gIC8qKlxuICAgKiBVc2UgUklPJ3MgcGVyLUFnZW50IGhlYWQtc2FtcGxpbmcgdGFyZ2V0IG9mIDUgdHJhY2VzL3NlYyBhbmQgYW4gYWRkaXRpb25hbFxuICAgKiBlcnJvci1zYW1wbGluZyBidWRnZXQgb2YgMTAgbG9jYWwgZXJyb3IgdHJhY2UgY2h1bmtzL3NlYy5cbiAgICogVGFyZ2V0LXBlci1zZWNvbmQgc2FtcGxpbmcgaXMgYSBwcmFjdGljYWwgZGVmYXVsdCBmb3IgYm90aCBsb3ctIGFuZFxuICAgKiBoaWdoLXRyYWZmaWMgc2VydmljZXMuXG4gICAqL1xuICBERUZBVUxULFxuXG4gIC8qKiBEbyBub3Qgc2V0IHNhbXBsaW5nIGVudmlyb25tZW50IHZhcmlhYmxlczsgcmV0YWluIERhdGFkb2cncyBkZWZhdWx0cy4gKi9cbiAgREFUQURPR19ERUZBVUxULFxuXG4gIC8qKiBTZXQgYSBmaXhlZCBzYW1wbGluZyBydWxlIG9uIHRoZSBhcHBsaWNhdGlvbiB0cmFjZXIuICovXG4gIEZJWEVEX1JBVEUsXG5cbiAgLyoqIFNldCBhIHBlci1BZ2VudCB0YXJnZXQgbnVtYmVyIG9mIHRyYWNlcyBwZXIgc2Vjb25kLiAqL1xuICBUQVJHRVRfUEVSX1NFQ09ORCxcbn1cblxuLyoqXG4gKiBVc2UgUklPJ3MgZGVmYXVsdCBEYXRhZG9nIEFnZW50IHNhbXBsaW5nIHRhcmdldHMuXG4gKlxuICogVGhpcyBpcyBhbHNvIHRoZSBkZWZhdWx0IHdoZW4gYHRyYWNlU2FtcGxpbmdgIGlzIG9taXR0ZWQuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUmlvRGVmYXVsdFRyYWNlU2FtcGxpbmdPcHRpb25zIHtcbiAgLyoqXG4gICAqIFRoZSBzYW1wbGluZyBzdHJhdGVneS4gTWF5IGJlIG9taXR0ZWQgdG8gdXNlIHRoZSBkZWZhdWx0LlxuICAgKlxuICAgKiBAZGVmYXVsdFZhbHVlIC0gYFRyYWNlU2FtcGxpbmdNb2RlLkRFRkFVTFRgXG4gICAqL1xuICByZWFkb25seSBtb2RlPzogVHJhY2VTYW1wbGluZ01vZGUuREVGQVVMVDtcbn1cblxuLyoqIERvIG5vdCBzZXQgc2FtcGxpbmcgZW52aXJvbm1lbnQgdmFyaWFibGVzOyByZXRhaW4gRGF0YWRvZydzIGRlZmF1bHRzLiAqL1xuZXhwb3J0IGludGVyZmFjZSBEYXRhZG9nRGVmYXVsdFRyYWNlU2FtcGxpbmdPcHRpb25zIHtcbiAgLyoqIFRoZSBzYW1wbGluZyBzdHJhdGVneS4gKi9cbiAgcmVhZG9ubHkgbW9kZTogVHJhY2VTYW1wbGluZ01vZGUuREFUQURPR19ERUZBVUxUO1xufVxuXG4vKiogQ29uZmlndXJlIGEgZml4ZWQgYXBwbGljYXRpb24tdHJhY2VyIHNhbXBsaW5nIHJhdGUuICovXG5leHBvcnQgaW50ZXJmYWNlIEZpeGVkUmF0ZVRyYWNlU2FtcGxpbmdPcHRpb25zIHtcbiAgLyoqIFRoZSBzYW1wbGluZyBzdHJhdGVneS4gKi9cbiAgcmVhZG9ubHkgbW9kZTogVHJhY2VTYW1wbGluZ01vZGUuRklYRURfUkFURTtcblxuICAvKipcbiAgICogVGhlIGdsb2JhbCB0cmFjZXIgc2FtcGxpbmctcnVsZSByYXRlLCBmcm9tIDAuMCB0byAxLjAgaW5jbHVzaXZlLlxuICAgKiBEYXRhZG9nIHRyYWNlcnMgYWRkaXRpb25hbGx5IGFwcGx5IHRoZWlyIGJ1aWx0LWluIDEwMC10cmFjZXMtcGVyLXNlY29uZFxuICAgKiByYXRlIGxpbWl0IHdoZW4gc2FtcGxpbmcgcnVsZXMgYXJlIGNvbmZpZ3VyZWQuIFRoaXMgY29uc3RydWN0IGRvZXMgbm90XG4gICAqIGV4cG9zZSBvciBvdmVycmlkZSB0aGF0IHBlci1pbnN0YW5jZSBzYWZlZ3VhcmQuXG4gICAqL1xuICByZWFkb25seSBmaXhlZFJhdGU6IG51bWJlcjtcbn1cblxuLyoqIENvbmZpZ3VyZSBEYXRhZG9nIEFnZW50IHRhcmdldCBzYW1wbGluZy4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgVGFyZ2V0UGVyU2Vjb25kVHJhY2VTYW1wbGluZ09wdGlvbnMge1xuICAvKiogVGhlIHNhbXBsaW5nIHN0cmF0ZWd5LiAqL1xuICByZWFkb25seSBtb2RlOiBUcmFjZVNhbXBsaW5nTW9kZS5UQVJHRVRfUEVSX1NFQ09ORDtcblxuICAvKipcbiAgICogVGhlIGF2ZXJhZ2UgaGVhZC1zYW1wbGluZyB0YXJnZXQgaW4gdHJhY2VzIHBlciBzZWNvbmQgZm9yIGVhY2ggQWdlbnRcbiAgICogc2lkZWNhciAoYW5kIHRoZXJlZm9yZSBlYWNoIEZhcmdhdGUgc2VydmljZSBpbnN0YW5jZSkuIFRyYWZmaWMgc3Bpa2VzXG4gICAqIGNhbiBleGNlZWQgdGhpcyB0YXJnZXQ7IGl0IGlzIG5vdCBhIGhhcmQgY2FwIG9uIHRvdGFsIGluZ2VzdGlvbi5cbiAgICovXG4gIHJlYWRvbmx5IHRhcmdldFRyYWNlc1BlclNlY29uZDogbnVtYmVyO1xuXG4gIC8qKlxuICAgKiBUaGUgYnVkZ2V0IGZvciBhZGRpdGlvbmFsIGxvY2FsIGVycm9yIHRyYWNlIGNodW5rcyBwZXIgc2Vjb25kIG1pc3NlZCBieVxuICAgKiBoZWFkIHNhbXBsaW5nLCBmb3IgZWFjaCBBZ2VudCBzaWRlY2FyIChhbmQgdGhlcmVmb3JlIGVhY2ggRmFyZ2F0ZSBzZXJ2aWNlXG4gICAqIGluc3RhbmNlKS4gVGhpcyBkb2VzIG5vdCBjYXAgZXJyb3IgdHJhY2VzIGFscmVhZHkga2VwdCBieSBoZWFkIHNhbXBsaW5nLlxuICAgKi9cbiAgcmVhZG9ubHkgZXJyb3JUcmFjZXNQZXJTZWNvbmQ/OiBudW1iZXI7XG59XG5cbi8qKlxuICogT3B0aW9ucyBmb3IgY29uZmlndXJpbmcgRGF0YWRvZyBBUE0gdHJhY2Ugc2FtcGxpbmcuXG4gKlxuICogVGhpcyBkaXNjcmltaW5hdGVkIHVuaW9uIG1ha2VzIG1vZGUtc3BlY2lmaWMgc2V0dGluZ3MgaW52YWxpZCBpbiBUeXBlU2NyaXB0XG4gKiBiZWZvcmUgc3ludGhlc2lzLiBOdW1lcmljIHJhbmdlcyBhcmUgY2hlY2tlZCBkdXJpbmcgc3ludGhlc2lzLlxuICovXG5leHBvcnQgdHlwZSBUcmFjZVNhbXBsaW5nT3B0aW9ucyA9XG4gIHwgUmlvRGVmYXVsdFRyYWNlU2FtcGxpbmdPcHRpb25zXG4gIHwgRGF0YWRvZ0RlZmF1bHRUcmFjZVNhbXBsaW5nT3B0aW9uc1xuICB8IEZpeGVkUmF0ZVRyYWNlU2FtcGxpbmdPcHRpb25zXG4gIHwgVGFyZ2V0UGVyU2Vjb25kVHJhY2VTYW1wbGluZ09wdGlvbnM7XG5cbi8qKiBUaGUgdW50cnVzdGVkIHJ1bnRpbWUgc2hhcGUgdXNlZCBieSBzeW50aGVzaXMtdGltZSB2YWxpZGF0aW9uLiAqL1xudHlwZSBUcmFjZVNhbXBsaW5nVmFsdWVzID0ge1xuICByZWFkb25seSBtb2RlPzogVHJhY2VTYW1wbGluZ01vZGU7XG4gIHJlYWRvbmx5IGZpeGVkUmF0ZT86IG51bWJlcjtcbiAgcmVhZG9ubHkgdGFyZ2V0VHJhY2VzUGVyU2Vjb25kPzogbnVtYmVyO1xuICByZWFkb25seSBlcnJvclRyYWNlc1BlclNlY29uZD86IG51bWJlcjtcbn07XG5cbmV4cG9ydCBjbGFzcyBUcmFjZVNhbXBsaW5nVmFsaWRhdG9yIGltcGxlbWVudHMgY29uc3RydWN0cy5JVmFsaWRhdGlvbiB7XG4gIGNvbnN0cnVjdG9yKHByaXZhdGUgcmVhZG9ubHkgdHJhY2VTYW1wbGluZz86IFRyYWNlU2FtcGxpbmdPcHRpb25zKSB7fVxuXG4gIHZhbGlkYXRlKCk6IHN0cmluZ1tdIHtcbiAgICBjb25zdCBvcHRpb25zID0gdGhpcy50cmFjZVNhbXBsaW5nO1xuICAgIGlmICghb3B0aW9ucykge1xuICAgICAgcmV0dXJuIFtdO1xuICAgIH1cblxuICAgIC8vIEtlZXAgdmFsaWRhdGluZyB0aGUgcnVudGltZSBzaGFwZTogSmF2YVNjcmlwdCBjb25zdW1lcnMgYW5kIFR5cGVTY3JpcHRcbiAgICAvLyBjYWxsZXJzIHVzaW5nIGEgY2FzdCBjYW4gYnlwYXNzIHRoZSBkaXNjcmltaW5hdGVkIHVuaW9uLlxuICAgIGNvbnN0IHZhbHVlcyA9IG9wdGlvbnMgYXMgVHJhY2VTYW1wbGluZ1ZhbHVlcztcbiAgICBjb25zdCBtb2RlID0gdmFsdWVzLm1vZGUgPz8gVHJhY2VTYW1wbGluZ01vZGUuREVGQVVMVDtcbiAgICBjb25zdCBoYXNGaXhlZFJhdGUgPSB2YWx1ZXMuZml4ZWRSYXRlICE9PSB1bmRlZmluZWQ7XG4gICAgY29uc3QgaGFzVGFyZ2V0VHBzID0gdmFsdWVzLnRhcmdldFRyYWNlc1BlclNlY29uZCAhPT0gdW5kZWZpbmVkO1xuICAgIGNvbnN0IGhhc0Vycm9yVHBzID0gdmFsdWVzLmVycm9yVHJhY2VzUGVyU2Vjb25kICE9PSB1bmRlZmluZWQ7XG4gICAgY29uc3QgZXJyb3JzOiBzdHJpbmdbXSA9IFtdO1xuICAgIGNvbnN0IGlzTm9uTmVnYXRpdmVJbnRlZ2VyID0gKHZhbHVlOiBudW1iZXIgfCB1bmRlZmluZWQpID0+XG4gICAgICB2YWx1ZSAhPT0gdW5kZWZpbmVkICYmIE51bWJlci5pc0ludGVnZXIodmFsdWUpICYmIHZhbHVlID49IDA7XG5cbiAgICBpZiAobW9kZSA9PT0gVHJhY2VTYW1wbGluZ01vZGUuREVGQVVMVCB8fCBtb2RlID09PSBUcmFjZVNhbXBsaW5nTW9kZS5EQVRBRE9HX0RFRkFVTFQpIHtcbiAgICAgIGlmIChoYXNGaXhlZFJhdGUgfHwgaGFzVGFyZ2V0VHBzIHx8IGhhc0Vycm9yVHBzKSB7XG4gICAgICAgIGVycm9ycy5wdXNoKFxuICAgICAgICAgIGAke1RyYWNlU2FtcGxpbmdNb2RlW21vZGVdfSBkb2VzIG5vdCBhY2NlcHQgZml4ZWRSYXRlLCB0YXJnZXRUcmFjZXNQZXJTZWNvbmQsIG9yIGVycm9yVHJhY2VzUGVyU2Vjb25kLmBcbiAgICAgICAgKTtcbiAgICAgIH1cbiAgICB9IGVsc2UgaWYgKG1vZGUgPT09IFRyYWNlU2FtcGxpbmdNb2RlLkZJWEVEX1JBVEUpIHtcbiAgICAgIGNvbnN0IGZpeGVkUmF0ZSA9IHZhbHVlcy5maXhlZFJhdGU7XG4gICAgICBpZiAoXG4gICAgICAgICFoYXNGaXhlZFJhdGUgfHxcbiAgICAgICAgZml4ZWRSYXRlID09PSB1bmRlZmluZWQgfHxcbiAgICAgICAgIU51bWJlci5pc0Zpbml0ZShmaXhlZFJhdGUpIHx8XG4gICAgICAgIGZpeGVkUmF0ZSA8IDAuMCB8fFxuICAgICAgICBmaXhlZFJhdGUgPiAxLjBcbiAgICAgICkge1xuICAgICAgICBlcnJvcnMucHVzaCgnRklYRURfUkFURSByZXF1aXJlcyBmaXhlZFJhdGUgdG8gYmUgYSBudW1iZXIgYmV0d2VlbiAwIGFuZCAxIGluY2x1c2l2ZS4nKTtcbiAgICAgIH1cbiAgICAgIGlmIChoYXNUYXJnZXRUcHMpIHtcbiAgICAgICAgZXJyb3JzLnB1c2goJ0ZJWEVEX1JBVEUgZG9lcyBub3QgYWNjZXB0IHRhcmdldFRyYWNlc1BlclNlY29uZC4nKTtcbiAgICAgIH1cbiAgICAgIGlmIChoYXNFcnJvclRwcykge1xuICAgICAgICBlcnJvcnMucHVzaCgnRklYRURfUkFURSBkb2VzIG5vdCBhY2NlcHQgZXJyb3JUcmFjZXNQZXJTZWNvbmQuJyk7XG4gICAgICB9XG4gICAgfSBlbHNlIGlmIChtb2RlID09PSBUcmFjZVNhbXBsaW5nTW9kZS5UQVJHRVRfUEVSX1NFQ09ORCkge1xuICAgICAgaWYgKCFpc05vbk5lZ2F0aXZlSW50ZWdlcih2YWx1ZXMudGFyZ2V0VHJhY2VzUGVyU2Vjb25kKSkge1xuICAgICAgICBlcnJvcnMucHVzaCgnVEFSR0VUX1BFUl9TRUNPTkQgcmVxdWlyZXMgdGFyZ2V0VHJhY2VzUGVyU2Vjb25kIHRvIGJlIGEgbm9uLW5lZ2F0aXZlIGludGVnZXIuJyk7XG4gICAgICB9XG4gICAgICBpZiAoaGFzRml4ZWRSYXRlKSB7XG4gICAgICAgIGVycm9ycy5wdXNoKCdUQVJHRVRfUEVSX1NFQ09ORCBkb2VzIG5vdCBhY2NlcHQgZml4ZWRSYXRlLicpO1xuICAgICAgfVxuICAgICAgaWYgKGhhc0Vycm9yVHBzICYmICFpc05vbk5lZ2F0aXZlSW50ZWdlcih2YWx1ZXMuZXJyb3JUcmFjZXNQZXJTZWNvbmQpKSB7XG4gICAgICAgIGVycm9ycy5wdXNoKCdUQVJHRVRfUEVSX1NFQ09ORCBlcnJvclRyYWNlc1BlclNlY29uZCBtdXN0IGJlIGEgbm9uLW5lZ2F0aXZlIGludGVnZXIuJyk7XG4gICAgICB9XG4gICAgfSBlbHNlIHtcbiAgICAgIGVycm9ycy5wdXNoKCd0cmFjZVNhbXBsaW5nLm1vZGUgbXVzdCBiZSBhIFRyYWNlU2FtcGxpbmdNb2RlIHZhbHVlLicpO1xuICAgIH1cblxuICAgIHJldHVybiBlcnJvcnM7XG4gIH1cbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGFkZFRyYWNlU2FtcGxpbmdFbnZpcm9ubWVudFdhcm5pbmcoXG4gIHNjb3BlOiBjb25zdHJ1Y3RzLkNvbnN0cnVjdCxcbiAgZW52aXJvbm1lbnQ6IHsgW2tleTogc3RyaW5nXTogc3RyaW5nIH0gfCB1bmRlZmluZWRcbik6IHZvaWQge1xuICBjb25zdCBzYW1wbGluZ0tleXMgPSBbJ0REX1RSQUNFX1NBTVBMSU5HX1JVTEVTJywgJ0REX1RSQUNFX1NBTVBMRV9SQVRFJywgJ0REX0FQTV9UQVJHRVRfVFBTJywgJ0REX0FQTV9FUlJPUl9UUFMnXTtcbiAgY29uc3QgY29uZmlndXJlZEtleXMgPSBzYW1wbGluZ0tleXMuZmlsdGVyKGtleSA9PiBlbnZpcm9ubWVudCAmJiBrZXkgaW4gZW52aXJvbm1lbnQpO1xuICBpZiAoY29uZmlndXJlZEtleXMubGVuZ3RoID4gMCkge1xuICAgIGNkay5WYWxpZGF0aW9ucy5vZihzY29wZSkuYWRkV2FybmluZyhcbiAgICAgICdAcmlvLWNsb3VkL2Nkay12Mi1jb25zdHJ1Y3RzOmRpcmVjdFRyYWNlU2FtcGxpbmdFbnZpcm9ubWVudCcsXG4gICAgICBbXG4gICAgICAgIGBEaXJlY3QgdHJhY2Utc2FtcGxpbmcgZW52aXJvbm1lbnQgdmFyaWFibGUocykgZGV0ZWN0ZWQ6ICR7Y29uZmlndXJlZEtleXMuam9pbignLCAnKX0uYCxcbiAgICAgICAgJ1JlY29tbWVuZGVkIGFjdGlvbjogcmVtb3ZlIHRoZXNlIHZhcmlhYmxlcyB0byB1c2UgdGhlIERFRkFVTFQgc2FtcGxpbmcgcG9saWN5LicsXG4gICAgICAgICdUbyBzZWxlY3QgYSBkaWZmZXJlbnQgcG9saWN5LCBjb25maWd1cmUgZGF0YWRvZ09wdGlvbnMudHJhY2VTYW1wbGluZyBleHBsaWNpdGx5LicsXG4gICAgICAgICdEaXJlY3Qgc2FtcGxpbmcgZW52aXJvbm1lbnQgdmFyaWFibGVzIHJlbWFpbiBzdXBwb3J0ZWQgb25seSBmb3IgYmFja3dhcmRzIGNvbXBhdGliaWxpdHkuIFVzZXJzIHdobyBjaG9vc2UgdGhlbSBhcmUgcmVzcG9uc2libGUgZm9yIHRoZWlyIGNvbXBhdGliaWxpdHkgYW5kIG1haW50ZW5hbmNlLicsXG4gICAgICBdLmpvaW4oJ1xcbicpXG4gICAgKTtcbiAgfVxufVxuXG5leHBvcnQgZnVuY3Rpb24gZ2V0QXBwbGljYXRpb25UcmFjZVNhbXBsaW5nRW52aXJvbm1lbnQodHJhY2VTYW1wbGluZz86IFRyYWNlU2FtcGxpbmdPcHRpb25zKToge1xuICBba2V5OiBzdHJpbmddOiBzdHJpbmc7XG59IHtcbiAgaWYgKHRyYWNlU2FtcGxpbmc/Lm1vZGUgPT09IFRyYWNlU2FtcGxpbmdNb2RlLkZJWEVEX1JBVEUpIHtcbiAgICBjb25zdCBydWxlcyA9IFt7IHNhbXBsZV9yYXRlOiB0cmFjZVNhbXBsaW5nLmZpeGVkUmF0ZSB9XTtcbiAgICByZXR1cm4geyBERF9UUkFDRV9TQU1QTElOR19SVUxFUzogSlNPTi5zdHJpbmdpZnkocnVsZXMpIH07XG4gIH1cbiAgcmV0dXJuIHt9O1xufVxuXG5leHBvcnQgZnVuY3Rpb24gZ2V0QWdlbnRUcmFjZVNhbXBsaW5nRW52aXJvbm1lbnQodHJhY2VTYW1wbGluZz86IFRyYWNlU2FtcGxpbmdPcHRpb25zKTogeyBba2V5OiBzdHJpbmddOiBzdHJpbmcgfSB7XG4gIGlmICh0cmFjZVNhbXBsaW5nPy5tb2RlID09PSB1bmRlZmluZWQgfHwgdHJhY2VTYW1wbGluZy5tb2RlID09PSBUcmFjZVNhbXBsaW5nTW9kZS5ERUZBVUxUKSB7XG4gICAgcmV0dXJuIHsgRERfQVBNX1RBUkdFVF9UUFM6ICc1JywgRERfQVBNX0VSUk9SX1RQUzogJzEwJyB9O1xuICB9XG4gIGlmICh0cmFjZVNhbXBsaW5nPy5tb2RlID09PSBUcmFjZVNhbXBsaW5nTW9kZS5UQVJHRVRfUEVSX1NFQ09ORCkge1xuICAgIGNvbnN0IGVudmlyb25tZW50OiB7IFtrZXk6IHN0cmluZ106IHN0cmluZyB9ID0ge307XG4gICAgaWYgKHRyYWNlU2FtcGxpbmcudGFyZ2V0VHJhY2VzUGVyU2Vjb25kICE9PSB1bmRlZmluZWQpIHtcbiAgICAgIGVudmlyb25tZW50LkREX0FQTV9UQVJHRVRfVFBTID0gU3RyaW5nKHRyYWNlU2FtcGxpbmcudGFyZ2V0VHJhY2VzUGVyU2Vjb25kKTtcbiAgICB9XG4gICAgaWYgKHRyYWNlU2FtcGxpbmcuZXJyb3JUcmFjZXNQZXJTZWNvbmQgIT09IHVuZGVmaW5lZCkge1xuICAgICAgZW52aXJvbm1lbnQuRERfQVBNX0VSUk9SX1RQUyA9IFN0cmluZyh0cmFjZVNhbXBsaW5nLmVycm9yVHJhY2VzUGVyU2Vjb25kKTtcbiAgICB9XG4gICAgcmV0dXJuIGVudmlyb25tZW50O1xuICB9XG4gIHJldHVybiB7fTtcbn1cbiJdfQ==

package/lib/sbom-catalog/lambda/handler.cjs

@@ -38779,6 +38779,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -39298,6 +39299,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d5 = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d5.check))
+      break;
+    const max = d5.maximum ?? d5.length ?? d5.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a4;
   for (let i5 = start; i5 < issues.length; i5++) {
@@ -40219,7 +40232,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -40727,6 +40740,29 @@ var $ZodNever = /* @__PURE__ */ $constructor("$ZodNever", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c5) => c5[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n3 = size(payload.value);
+    if (n3 > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n3 > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -40770,6 +40806,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;

package/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.6.5",
+  "version": "4.6.7",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",

package/node_modules/zod/src/v4/classic/tests/array.test.ts

@@ -140,6 +140,33 @@ test("continue parsing despite array size error", () => {
   `);
 });
 
+test("an upper size bound fails before any element is parsed", () => {
+  let parsed = 0;
+  const el = z.string().refine(() => ++parsed);
+  let refined = 0;
+  const schema = z
+    .array(el)
+    .max(2, "too many")
+    .refine(() => ++refined);
+  expect(schema.safeParse([1, 2, 3]).error!.issues).toMatchObject([{ code: "too_big", path: [], message: "too many" }]);
+  expect(z.array(el).length(2).safeParse(["a", "b", "c"]).error!.issues).toMatchObject([
+    { code: "too_big", exact: true },
+  ]);
+  expect(z.object({ a: z.array(el).max(1) }).safeParse({ a: [1, 2] }).error!.issues).toMatchObject([
+    { code: "too_big", path: ["a"] },
+  ]);
+  expect([parsed, refined]).toEqual([0, 0]);
+
+  // a check that may rewrite the value ends the gate
+  expect(
+    z
+      .array(z.number())
+      .overwrite((a) => a.slice(0, 2))
+      .max(2)
+      .parse([1, 2, 3])
+  ).toEqual([1, 2]);
+});
+
 test("parse should fail given sparse array", () => {
   const schema = z.array(z.string()).nonempty().min(1).max(3);
   const result = schema.safeParse(new Array(3));

package/node_modules/zod/src/v4/classic/tests/map.test.ts

@@ -97,6 +97,13 @@ test("failing when map is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  const bad = new Map([
+    [1, 1],
+    [2, 2],
+  ]);
+  const capped = z.map(z.string(), z.string()).max(1);
+  expect(capped.safeParse(bad).error!.issues).toMatchObject([{ code: "too_big" }]);
+  expect(capped.safeParse(new Set([1, 2])).error!.issues[0]).toMatchObject({ code: "invalid_type", expected: "map" });
 });
 
 test("failing when map does not match size() ", () => {

package/node_modules/zod/src/v4/classic/tests/set.test.ts

@@ -83,6 +83,12 @@ test("failing when set is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  expect(
+    z
+      .set(z.string())
+      .max(1)
+      .safeParse(new Set([1, 2])).error!.issues
+  ).toMatchObject([{ code: "too_big" }]);
 });
 
 test("failing when set does not match size() ", () => {

package/node_modules/zod/src/v4/core/compile.ts

@@ -1551,6 +1551,12 @@ function generateNullableCheck(
   return outputVar;
 }
 
+function generateSizeGate(doc: Doc, schema: SomeType, size: string): void {
+  for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+  }
+}
+
 function generateArrayCheck(
   doc: Doc,
   ctx: CompileContext,
@@ -1560,6 +1566,7 @@ function generateArrayCheck(
 ): string | null {
   const def = schema._zod.def as unknown as { element: SomeType };
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
 
   // Build a new array with validated/transformed elements.
   const outputVar = buildsValue ? newVar(ctx) : null;
@@ -2094,6 +2101,7 @@ function generateMapCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acces
   const def = schema._zod.def as unknown as { keyType: SomeType; valueType: SomeType };
 
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
 
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
@@ -2115,6 +2123,7 @@ function generateSetCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acces
   const def = schema._zod.def as unknown as { valueType: SomeType };
 
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
 
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);

package/node_modules/zod/src/v4/core/schemas.ts

@@ -1844,6 +1844,34 @@ export interface $ZodArrayInternals<T extends SomeType = $ZodType> extends _$Zod
 
 export interface $ZodArray<T extends SomeType = $ZodType> extends $ZodType<any, any, $ZodArrayInternals<T>> {}
 
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst: $ZodType, size: (input: any) => number): void {
+  const caps = util.sizeCaps(inst._zod.def.checks);
+  if (!caps.length) return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when!(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload as ParsePayload<never>);
+          // the value is still the raw input, so no later check may read it
+          (payload.issues[start] as { continue?: boolean }).continue = false;
+          util.attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+
+const arraySize = (input: unknown): number => (Array.isArray(input) ? input.length : -1);
+const mapSize = (input: unknown): number => (input instanceof Map ? input.size : -1);
+const setSize = (input: unknown): number => (input instanceof Set ? input.size : -1);
+
 function handleArrayResult(result: ParsePayload<any>, final: ParsePayload<any[]>, index: number) {
   if (result.issues.length) {
     final.issues.push(...util.prefixIssues(index, result.issues));
@@ -1899,6 +1927,7 @@ export const $ZodArray: core.$constructor<$ZodArray> = /*@__PURE__*/ core.$const
 
     return payload; //handleArrayResultsAsync(parseResults, final);
   };
+  capSize(inst, arraySize);
 });
 
 //////////////////////////////////////////
@@ -3218,8 +3247,11 @@ export type $InferZodRecordInput<
     : Record<core.input<Key> & PropertyKey, core.input<Value>>;
 
 export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType>
-  extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+  extends $ZodTypeInternals {
   def: $ZodRecordDef<Key, Value>;
+  // members rather than base type arguments, which TypeScript 7.1 reports as circular for `z.json()`
+  output: $InferZodRecordOutput<Key, Value>;
+  input: $InferZodRecordInput<Key, Value>;
   isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
   optin?: "optional" | undefined;
   optout?: "optional" | undefined;
@@ -3480,6 +3512,7 @@ export const $ZodMap: core.$constructor<$ZodMap> = /*@__PURE__*/ core.$construct
     if (proms.length) return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 
 function handleMapResult(
@@ -3582,6 +3615,7 @@ export const $ZodSet: core.$constructor<$ZodSet> = /*@__PURE__*/ core.$construct
     if (proms.length) return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 
 function handleSetResult(result: ParsePayload, final: ParsePayload<Set<any>>) {

package/node_modules/zod/src/v4/core/util.ts

@@ -935,6 +935,19 @@ export function unwrapMessage(message: string | { message: string } | undefined
 }
 
 /* A check holds no link back to the schema it is attached to — the same check instance is shared by every clone of that schema — so the owner is stamped onto the issues a check just raised, at the only point where both are in scope. Runs on the failure path only; `start` is the issue count from before the check ran. */
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+export function sizeCaps(defChecks: checks.$ZodCheck<never>[] | undefined): [number, checks.$ZodCheck<never>][] {
+  const caps: [number, checks.$ZodCheck<never>][] = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def as any;
+    // a later check may rewrite the value
+    if (!/_(length|size)$|_equals$/.test(d.check)) break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0) caps.push([max, ch]);
+  }
+  return caps;
+}
+
 export function attachSchema(issues: errors.$ZodRawIssue[], start: number, inst: schemas.$ZodType): void {
   for (let i = start; i < issues.length; i++) {
     (issues[i] as any).schema ??= inst;

package/node_modules/zod/src/v4/core/versions.ts

@@ -1,5 +1,5 @@
 export const version = {
   major: 4,
   minor: 6,
-  patch: 5 as number,
+  patch: 7 as number,
 } as const;

package/node_modules/zod/v4/core/compile.cjs

@@ -1241,9 +1241,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
     doc.write(`}`);
     return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+    for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+    }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
     const def = schema._zod.def;
     doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.length`);
     // Build a new array with validated/transformed elements.
     const outputVar = buildsValue ? newVar(ctx) : null;
     const iVar = newVar(ctx);
@@ -1707,6 +1713,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const kVar = newVar(ctx);
     const valVar = newVar(ctx);
@@ -1723,6 +1730,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const valVar = newVar(ctx);
     doc.write(`const ${outputVar} = new Set();`);

package/node_modules/zod/v4/core/compile.js

@@ -1210,9 +1210,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
     doc.write(`}`);
     return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+    for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+    }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
     const def = schema._zod.def;
     doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.length`);
     // Build a new array with validated/transformed elements.
     const outputVar = buildsValue ? newVar(ctx) : null;
     const iVar = newVar(ctx);
@@ -1676,6 +1682,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const kVar = newVar(ctx);
     const valVar = newVar(ctx);
@@ -1692,6 +1699,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const valVar = newVar(ctx);
     doc.write(`const ${outputVar} = new Set();`);

package/node_modules/zod/v4/core/schemas.cjs

@@ -860,6 +860,33 @@ exports.$ZodDate = core.$constructor("$ZodDate", (inst, def) => {
         return payload;
     };
 });
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst, size) {
+    const caps = util.sizeCaps(inst._zod.def.checks);
+    if (!caps.length)
+        return;
+    const cap = Math.min(...caps.map((c) => c[0]));
+    const parse = inst._zod.parse;
+    inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+            for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+                if (n > max && ch._zod.def.when(payload)) {
+                    const start = payload.issues.length;
+                    ch._zod.check(payload);
+                    // the value is still the raw input, so no later check may read it
+                    payload.issues[start].continue = false;
+                    util.attachSchema(payload.issues, start, inst);
+                    return payload;
+                }
+            }
+        }
+        return parse(payload, ctx);
+    };
+}
+const arraySize = (input) => (Array.isArray(input) ? input.length : -1);
+const mapSize = (input) => (input instanceof Map ? input.size : -1);
+const setSize = (input) => (input instanceof Set ? input.size : -1);
 function handleArrayResult(result, final, index) {
     if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -905,6 +932,7 @@ exports.$ZodArray = core.$constructor("$ZodArray", (inst, def) => {
         }
         return payload; //handleArrayResultsAsync(parseResults, final);
     };
+    capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
     const isPresent = key in input;
@@ -1942,6 +1970,7 @@ exports.$ZodMap = core.$constructor("$ZodMap", (inst, def) => {
             return Promise.all(proms).then(() => payload);
         return payload;
     };
+    capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
     if (keyResult.issues.length) {
@@ -2011,6 +2040,7 @@ exports.$ZodSet = core.$constructor("$ZodSet", (inst, def) => {
             return Promise.all(proms).then(() => payload);
         return payload;
     };
+    capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
     if (result.issues.length) {

package/node_modules/zod/v4/core/schemas.d.cts

@@ -834,8 +834,10 @@ export type $InferZodRecordOutput<Key extends $ZodRecordKey = $ZodRecordKey, Val
 export type $InferZodRecordInput<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> = Key extends $partial ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : [
     Value
 ] extends [OptionalInSchema] ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : Record<core.input<Key> & PropertyKey, core.input<Value>>;
-export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals {
     def: $ZodRecordDef<Key, Value>;
+    output: $InferZodRecordOutput<Key, Value>;
+    input: $InferZodRecordInput<Key, Value>;
     isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
     optin?: "optional" | undefined;
     optout?: "optional" | undefined;