@rio-cloud/cdk-v2-constructs 9.0.0-alpha.9 → 9.0.0

package/docs/AGENTS_DOCUMENTATION.md

@@ -28,260 +28,36 @@ Use `lib/**/*.d.ts` for generated type information and JSDoc-derived annotations
 
 Prefer `import * as rio from '@rio-cloud-internal/cdk-v2-constructs';` unless an exported subpath is explicitly available in the installed `package.json`.
 
-## Breaking migration to the internal npm namespace
-
-Starting with `9.0.0`, this package is published as
-`@rio-cloud-internal/cdk-v2-constructs` in the RIO CodeArtifact `internal`
-repository. This is a package and installation breaking change for consumers:
-
-- Replace the dependency and every import/subpath reference from
-  `@rio-cloud/cdk-v2-constructs` with `@rio-cloud-internal/cdk-v2-constructs`.
-  Preserve any subpath after the package name.
-- Authenticate npm before installing dependencies. Run the login command in
-  the consuming workspace before `npm ci` or `npm install`:
-
-  ```bash
-  aws codeartifact login --region eu-west-1 --tool npm --domain rio \
-    --domain-owner 577146897785 --repository internal \
-    --namespace @rio-cloud-internal
-  npm ci
-  ```
-
-- In CodeBuild or CodePipeline, run the same login command immediately before
-  the dependency installation in every relevant synth, branch, and auxiliary
-  build step. The build role must be allowed to call
-  `codeartifact:GetAuthorizationToken`, `codeartifact:GetRepositoryEndpoint`,
-  `codeartifact:ReadFromRepository`, and
-  `sts:GetServiceBearerToken` for the RIO `internal` repository. Do not commit
-  the generated npm credentials or an authentication token.
-
-  For a CDK `CodeBuildStep`, the relevant permissions are equivalent to:
-
-  ```typescript
-  new iam.PolicyStatement({
-    actions: ['codeartifact:GetAuthorizationToken'],
-    resources: ['arn:aws:codeartifact:eu-west-1:577146897785:domain/rio'],
-  });
-  new iam.PolicyStatement({
-    actions: ['sts:GetServiceBearerToken'],
-    resources: ['*'],
-    conditions: {
-      StringEquals: { 'sts:AWSServiceName': 'codeartifact.amazonaws.com' },
-    },
-  });
-  new iam.PolicyStatement({
-    actions: ['codeartifact:GetRepositoryEndpoint', 'codeartifact:ReadFromRepository'],
-    resources: ['arn:aws:codeartifact:eu-west-1:577146897785:repository/rio/internal'],
-  });
-  ```
-
-  Ensure these statements are attached to the actual CodeBuild synth or build
-  role. Adding only the npm login command is insufficient.
-- Regenerate the lockfile after authenticating. Do not reuse the integrity hash
-  from the public npm tarball when the resolved URL changes to CodeArtifact.
-
-For example, the package dependency and root import change as follows:
-
-```diff
--"@rio-cloud/cdk-v2-constructs": "..."
-+"@rio-cloud-internal/cdk-v2-constructs": "..."
-
--import * as rio from '@rio-cloud/cdk-v2-constructs';
-+import * as rio from '@rio-cloud-internal/cdk-v2-constructs';
-```
-
-The old public package name is not an alias for the internal package. A
-consumer that keeps the old name, or runs `npm ci` before CodeArtifact login,
-will fail to resolve the migrated package.
-
-Read the relevant declaration comments and examples before writing or changing infrastructure code.
-
-## Migration guidance for `9.0.0`
-
-This section applies when upgrading a consuming project to `9.0.0` or
-later. Confirm the installed package version and its `package.json` exports
-before applying it. The guidance below is based on the implementation and
-tests in this release; it intentionally does not prescribe replacements for
-environment variables for which this wrapper exposes no one-to-one prop.
-
-### Datadog Lambda instrumentation: Datadog v5 environment handling
-
-`DatadogLambdaInstrumentation` now uses `datadog-cdk-constructs-v2` v5. Before
-calling `addLambdaFunctions()`, the construct rejects a Lambda whose CDK
-environment already contains any of these variables:
-
-```text
-DD_TRACE_ENABLED
-DD_MERGE_XRAY_TRACES
-DD_LOGS_INJECTION
-DD_SERVERLESS_LOGS_ENABLED
-DD_CAPTURE_LAMBDA_PAYLOAD
-DD_TRACE_CLOUD_REQUEST_PAYLOAD_TAGGING
-DD_TRACE_CLOUD_RESPONSE_PAYLOAD_TAGGING
-DD_LOG_LEVEL
-DD_APPSEC_ENABLED
-DD_SERVERLESS_APPSEC_ENABLED
-AWS_LAMBDA_EXEC_WRAPPER
-DD_TAGS
-```
+## Versioned migration guides
 
-Datadog v4 read existing values differently. With v5, values configured
-before instrumentation can be overwritten, so remove these settings from the
-Lambda constructor and from any `addEnvironment()` call made before
-`addLambdaFunctions()`.
-
-Use the instrumentation props for settings that have a corresponding public
-prop. The direct mappings established by this package are:
-
-| Lambda environment variable | `DatadogLambdaInstrumentation` prop |
-| --- | --- |
-| `DD_TRACE_ENABLED` | `enableDatadogTracing` |
-| `DD_MERGE_XRAY_TRACES` | `enableMergeXrayTraces` |
-| `DD_LOGS_INJECTION` | `injectLogContext` |
-| `DD_SERVERLESS_LOGS_ENABLED` | `enableDatadogLogs` |
-| `DD_CAPTURE_LAMBDA_PAYLOAD` | `captureLambdaPayload` |
-| `DD_LOG_LEVEL` | `logLevel` |
-| `DD_TAGS` | `tags` |
-
-The wrapper also exposes `enableDatadogASM` and `datadogAppSecMode`, but the
-repository does not document a mechanical mapping for every AppSec-related
-environment variable. Do not invent one; inspect the installed declarations
-and the Datadog v5 behavior for the desired AppSec configuration. The same
-applies to the two cloud-payload-tagging variables and
-`AWS_LAMBDA_EXEC_WRAPPER`, for which this wrapper has no same-named prop.
-
-If a per-function override is intentional, apply it only after instrumentation:
+For the breaking namespace migration and all `9.0.0` upgrade guidance, read
+the [migration guide for `9.0.0`](./migration_guide.md).
 
-```typescript
-datadog.addLambdaFunctions([handler]);
-handler.addEnvironment('DD_LOG_LEVEL', 'debug');
-```
-
-An override of `DD_TAGS` at that point replaces all tags generated by the
-construct, including Git metadata added through `addGitCommitMetadata()`.
-`addLambdaFunctions()` validates the complete batch before changing any of its
-functions. The validation covers the underlying CDK `Function` environment,
-including `SingletonFunction` and values added with `addEnvironment()`; it
-does not inspect `CfnFunction` escape-hatch overrides.
+## Usage Guidance
 
-Source-code integration is enabled by default and can change generated
-`DD_TAGS`. For snapshot tests that must disable it, set this exact context key
-on the test `App` to either boolean `false` or string `"false"`:
+### General
 
-```typescript
-const app = new App({
-  context: {
-    '@rio-cloud-internal/cdk-v2-constructs:enableSourceCodeIntegration': false,
-  },
-});
-```
+Prefer RIO constructs over raw AWS CDK constructs when the use case matches. These constructs encode RIO infrastructure defaults, Datadog tags, shared secrets, team and account SSM parameters, and monitoring conventions.
 
-Do not substitute the unrelated `datadog-cdk-constructs-v2` context key. Layer
-version props remain required; choose versions compatible with the installed
-Datadog Lambda Node and extension layer releases rather than copying stale
-values from tests.
+Do not set construct attributes explicitly when the value you plan to set is already the construct default. Prefer relying on defaults unless you are intentionally changing behavior and that intent is clear in the code.
 
-### Pipeline license-checker prerequisite
+Preserve the target repository's existing stack boundaries and scripts when maintaining an existing project.
 
-Before upgrading a project that uses the Team Transport pipeline, add
-`@rio-cloud/rio-license-checker` as a direct dev dependency and commit the
-corresponding lockfile:
+### Observability
 
-```bash
-npm install --save-dev @rio-cloud/rio-license-checker
-```
+Watchful is RIO's monitoring and alerting abstraction. Prefer `rio.watchfulv2.Watchful` and `rio.datadogv2`. Use legacy `watchful` or `datadog` only when maintaining existing code that already depends on those APIs.
 
-The generated buildspecs call `npx rio-license-checker` after `npm ci`; the
-construct no longer supplies this package transitively. Add it to the package
-whose `npm ci` precedes the call:
-
-| Generated pipeline feature | Workspace in which the checker is invoked | Package that needs the dev dependency |
-| --- | --- | --- |
-| Infrastructure synth | `infrastructure/` | `infrastructure/package.json` |
-| `gradleBuild` | repository root | root `package.json` |
-| `npmBuild` | repository root | root `package.json` |
-
-If a project enables more than one of these generated build paths, make the
-checker available in each corresponding workspace. A custom main/branch or
-vulnerability buildspec is loaded instead of the generated one, so inspect
-that file separately for its own license-check command and install location.
-The package's release notes link to the internal [RIO license-check
-guidance](https://confluence.collaboration-man.com/spaces/RIOSHIPPER/pages/448924008/License+Checks).
-
-### Contribution imports and package dependencies
-
-Contribution constructs are no longer exported from the package root. Use the
-owner-level subpaths that are present in the installed package's `exports` map:
-
-| Owner | Internal import path in `9.0.0` |
-| --- | --- |
-| Team Claid | `@rio-cloud-internal/cdk-v2-constructs/contributions/team-claid` |
-| Team Outbound Order Book | `@rio-cloud-internal/cdk-v2-constructs/contributions/team-outbound-order-book` |
-| Team Shipper Inbound Blue | `@rio-cloud-internal/cdk-v2-constructs/contributions/team-shipper-inbound-blue` |
-| Smart Route / GitLab Runner | `@rio-cloud-internal/cdk-v2-constructs/contributions/smart-route` |
-| Team Transport | `@rio-cloud-internal/cdk-v2-constructs/contributions/team-transport` |
-| CoP Frontend | `@rio-cloud-internal/cdk-v2-constructs/contributions/cop-frontend` |
-
-For example, change a root import while keeping the named imports:
-
-```diff
--import { PipelineStack, PipelineType } from '@rio-cloud-internal/cdk-v2-constructs';
-+import { PipelineStack, PipelineType } from '@rio-cloud-internal/cdk-v2-constructs/contributions/team-transport';
-```
+Do not add raw CloudWatch metrics, alarms, or monitoring resources for agent-generated changes. Use RIO monitoring constructs and Datadog-based abstractions for observability.
 
-Team Transport was renamed from `team-transport-two` to `team-transport`.
-Import its pipeline, Datadog, and synthetics constructs from the single
-owner-level path above. Do not infer additional public subpaths from the
-source directory layout; the installed `package.json` `exports` map is the
-authority.
+Treat `rio.SesObservability` logs as PII. Do not forward those logs to third-party services and do not extend retention beyond the construct default.
 
-GitLab Runner consumers must also install
-`@pepperize/cdk-autoscaling-gitlab-runner` as a direct project dependency:
+### RIO Infrastructure Defaults
 
-```bash
-npm install @pepperize/cdk-autoscaling-gitlab-runner
-```
+RIO infrastructure defaults are the baseline VPC, hosted zone, and team/account values provided by the RIO environment. Use `rio.RioLandingZone` helpers for default VPC, hosted zone, team name, team identifier, team email, team alert Slack channel, and account name. Avoid hard-coded VPC IDs, hosted-zone IDs, or parameter names when a helper exists.
 
-It is an optional peer dependency of this package, not a regular dependency
-that a consuming project can obtain transitively. This additional dependency
-is required only by projects importing the Smart Route GitLab Runner
-constructs.
-
-### TypeScript resolver required for contribution subpaths
-
-The contribution imports depend on Node package export maps. A legacy
-`moduleResolution: "node"` configuration does not resolve these imports
-reliably. Use a resolver that honors `exports` and keep the `module` and
-`moduleResolution` settings compatible. For example, a CommonJS-oriented
-project can use:
-
-```json
-{
-  "compilerOptions": {
-    "module": "Node16",
-    "moduleResolution": "node16"
-  }
-}
-```
+### Services
 
-A bundler-managed project can instead use the corresponding `bundler`
-resolution mode with its existing bundler-compatible module setting. Do not
-change only `moduleResolution` in a configuration whose `module` setting is
-incompatible; preserve the consuming project's module model and verify it with
-the project's typecheck and synth commands.
-
-### Team Transport CodeBuild runtime options
-
-This is an alpha.4 pipeline feature rather than a breaking migration, but it
-is relevant when updating pipeline code. Generated main, branch, and
-vulnerability buildspecs continue to use Node.js 24 by default. To require an
-exact toolchain, set `codeBuildOptions.nodejsVersion` and/or
-`codeBuildOptions.npmVersion` to an exact `major.minor.patch` value. The
-generated install phase checks the selected versions before installing project
-dependencies; it does not install npm globally. These options affect only
-generated buildspecs. A custom buildspec supplied through
-`partialBuildSpecPath` or `vulnerabilityPartialBuildSpecPath` is responsible
-for its own runtime and version checks.
+Use `rio.RioFargateService` for ECS/Fargate services when possible.
 
 ### CloudFront certificates added in v9
 
@@ -309,31 +85,6 @@ certificate. Use `certificateArn` only for integrations that require a string
 ARN. Changing the domain or hosted zone replaces the certificate; validation
 CNAME records are retained for renewal.
 
-## Usage Guidance
-
-### General
-
-Prefer RIO constructs over raw AWS CDK constructs when the use case matches. These constructs encode RIO infrastructure defaults, Datadog tags, shared secrets, team and account SSM parameters, and monitoring conventions.
-
-Do not set construct attributes explicitly when the value you plan to set is already the construct default. Prefer relying on defaults unless you are intentionally changing behavior and that intent is clear in the code.
-
-Preserve the target repository's existing stack boundaries and scripts when maintaining an existing project.
-
-### Observability
-
-Watchful is RIO's monitoring and alerting abstraction. Prefer `rio.watchfulv2.Watchful` and `rio.datadogv2`. Use legacy `watchful` or `datadog` only when maintaining existing code that already depends on those APIs.
-
-Do not add raw CloudWatch metrics, alarms, or monitoring resources for agent-generated changes. Use RIO monitoring constructs and Datadog-based abstractions for observability.
-
-Treat `rio.SesObservability` logs as PII. Do not forward those logs to third-party services and do not extend retention beyond the construct default.
-
-### RIO Infrastructure Defaults
-
-RIO infrastructure defaults are the baseline VPC, hosted zone, and team/account values provided by the RIO environment. Use `rio.RioLandingZone` helpers for default VPC, hosted zone, team name, team identifier, team email, team alert Slack channel, and account name. Avoid hard-coded VPC IDs, hosted-zone IDs, or parameter names when a helper exists.
-
-### Services
-
-Use `rio.RioFargateService` for ECS/Fargate services when possible.
 ### Kafka
 
 Use `rio.KafkaTopicV4` for new Kafka topics. Set audience and recovery policy deliberately.

package/lib/sbom-catalog/lambda/handler.cjs

@@ -38779,6 +38779,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -39298,6 +39299,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d5 = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d5.check))
+      break;
+    const max = d5.maximum ?? d5.length ?? d5.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a4;
   for (let i5 = start; i5 < issues.length; i5++) {
@@ -40219,7 +40232,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -40727,6 +40740,29 @@ var $ZodNever = /* @__PURE__ */ $constructor("$ZodNever", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c5) => c5[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n3 = size(payload.value);
+    if (n3 > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n3 > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -40770,6 +40806,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;

package/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.6.5",
+  "version": "4.6.7",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",

package/node_modules/zod/src/v4/classic/tests/array.test.ts

@@ -140,6 +140,33 @@ test("continue parsing despite array size error", () => {
   `);
 });
 
+test("an upper size bound fails before any element is parsed", () => {
+  let parsed = 0;
+  const el = z.string().refine(() => ++parsed);
+  let refined = 0;
+  const schema = z
+    .array(el)
+    .max(2, "too many")
+    .refine(() => ++refined);
+  expect(schema.safeParse([1, 2, 3]).error!.issues).toMatchObject([{ code: "too_big", path: [], message: "too many" }]);
+  expect(z.array(el).length(2).safeParse(["a", "b", "c"]).error!.issues).toMatchObject([
+    { code: "too_big", exact: true },
+  ]);
+  expect(z.object({ a: z.array(el).max(1) }).safeParse({ a: [1, 2] }).error!.issues).toMatchObject([
+    { code: "too_big", path: ["a"] },
+  ]);
+  expect([parsed, refined]).toEqual([0, 0]);
+
+  // a check that may rewrite the value ends the gate
+  expect(
+    z
+      .array(z.number())
+      .overwrite((a) => a.slice(0, 2))
+      .max(2)
+      .parse([1, 2, 3])
+  ).toEqual([1, 2]);
+});
+
 test("parse should fail given sparse array", () => {
   const schema = z.array(z.string()).nonempty().min(1).max(3);
   const result = schema.safeParse(new Array(3));

package/node_modules/zod/src/v4/classic/tests/map.test.ts

@@ -97,6 +97,13 @@ test("failing when map is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  const bad = new Map([
+    [1, 1],
+    [2, 2],
+  ]);
+  const capped = z.map(z.string(), z.string()).max(1);
+  expect(capped.safeParse(bad).error!.issues).toMatchObject([{ code: "too_big" }]);
+  expect(capped.safeParse(new Set([1, 2])).error!.issues[0]).toMatchObject({ code: "invalid_type", expected: "map" });
 });
 
 test("failing when map does not match size() ", () => {

package/node_modules/zod/src/v4/classic/tests/set.test.ts

@@ -83,6 +83,12 @@ test("failing when set is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  expect(
+    z
+      .set(z.string())
+      .max(1)
+      .safeParse(new Set([1, 2])).error!.issues
+  ).toMatchObject([{ code: "too_big" }]);
 });
 
 test("failing when set does not match size() ", () => {

package/node_modules/zod/src/v4/core/compile.ts

@@ -1551,6 +1551,12 @@ function generateNullableCheck(
   return outputVar;
 }
 
+function generateSizeGate(doc: Doc, schema: SomeType, size: string): void {
+  for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+  }
+}
+
 function generateArrayCheck(
   doc: Doc,
   ctx: CompileContext,
@@ -1560,6 +1566,7 @@ function generateArrayCheck(
 ): string | null {
   const def = schema._zod.def as unknown as { element: SomeType };
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
 
   // Build a new array with validated/transformed elements.
   const outputVar = buildsValue ? newVar(ctx) : null;
@@ -2094,6 +2101,7 @@ function generateMapCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acces
   const def = schema._zod.def as unknown as { keyType: SomeType; valueType: SomeType };
 
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
 
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
@@ -2115,6 +2123,7 @@ function generateSetCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acces
   const def = schema._zod.def as unknown as { valueType: SomeType };
 
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
 
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);

package/node_modules/zod/src/v4/core/schemas.ts

@@ -1844,6 +1844,34 @@ export interface $ZodArrayInternals<T extends SomeType = $ZodType> extends _$Zod
 
 export interface $ZodArray<T extends SomeType = $ZodType> extends $ZodType<any, any, $ZodArrayInternals<T>> {}
 
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst: $ZodType, size: (input: any) => number): void {
+  const caps = util.sizeCaps(inst._zod.def.checks);
+  if (!caps.length) return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when!(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload as ParsePayload<never>);
+          // the value is still the raw input, so no later check may read it
+          (payload.issues[start] as { continue?: boolean }).continue = false;
+          util.attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+
+const arraySize = (input: unknown): number => (Array.isArray(input) ? input.length : -1);
+const mapSize = (input: unknown): number => (input instanceof Map ? input.size : -1);
+const setSize = (input: unknown): number => (input instanceof Set ? input.size : -1);
+
 function handleArrayResult(result: ParsePayload<any>, final: ParsePayload<any[]>, index: number) {
   if (result.issues.length) {
     final.issues.push(...util.prefixIssues(index, result.issues));
@@ -1899,6 +1927,7 @@ export const $ZodArray: core.$constructor<$ZodArray> = /*@__PURE__*/ core.$const
 
     return payload; //handleArrayResultsAsync(parseResults, final);
   };
+  capSize(inst, arraySize);
 });
 
 //////////////////////////////////////////
@@ -3218,8 +3247,11 @@ export type $InferZodRecordInput<
     : Record<core.input<Key> & PropertyKey, core.input<Value>>;
 
 export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType>
-  extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+  extends $ZodTypeInternals {
   def: $ZodRecordDef<Key, Value>;
+  // members rather than base type arguments, which TypeScript 7.1 reports as circular for `z.json()`
+  output: $InferZodRecordOutput<Key, Value>;
+  input: $InferZodRecordInput<Key, Value>;
   isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
   optin?: "optional" | undefined;
   optout?: "optional" | undefined;
@@ -3480,6 +3512,7 @@ export const $ZodMap: core.$constructor<$ZodMap> = /*@__PURE__*/ core.$construct
     if (proms.length) return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 
 function handleMapResult(
@@ -3582,6 +3615,7 @@ export const $ZodSet: core.$constructor<$ZodSet> = /*@__PURE__*/ core.$construct
     if (proms.length) return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 
 function handleSetResult(result: ParsePayload, final: ParsePayload<Set<any>>) {

package/node_modules/zod/src/v4/core/util.ts

@@ -935,6 +935,19 @@ export function unwrapMessage(message: string | { message: string } | undefined
 }
 
 /* A check holds no link back to the schema it is attached to — the same check instance is shared by every clone of that schema — so the owner is stamped onto the issues a check just raised, at the only point where both are in scope. Runs on the failure path only; `start` is the issue count from before the check ran. */
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+export function sizeCaps(defChecks: checks.$ZodCheck<never>[] | undefined): [number, checks.$ZodCheck<never>][] {
+  const caps: [number, checks.$ZodCheck<never>][] = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def as any;
+    // a later check may rewrite the value
+    if (!/_(length|size)$|_equals$/.test(d.check)) break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0) caps.push([max, ch]);
+  }
+  return caps;
+}
+
 export function attachSchema(issues: errors.$ZodRawIssue[], start: number, inst: schemas.$ZodType): void {
   for (let i = start; i < issues.length; i++) {
     (issues[i] as any).schema ??= inst;

package/node_modules/zod/src/v4/core/versions.ts

@@ -1,5 +1,5 @@
 export const version = {
   major: 4,
   minor: 6,
-  patch: 5 as number,
+  patch: 7 as number,
 } as const;

package/node_modules/zod/v4/core/compile.cjs

@@ -1241,9 +1241,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
     doc.write(`}`);
     return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+    for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+    }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
     const def = schema._zod.def;
     doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.length`);
     // Build a new array with validated/transformed elements.
     const outputVar = buildsValue ? newVar(ctx) : null;
     const iVar = newVar(ctx);
@@ -1707,6 +1713,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const kVar = newVar(ctx);
     const valVar = newVar(ctx);
@@ -1723,6 +1730,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const valVar = newVar(ctx);
     doc.write(`const ${outputVar} = new Set();`);

package/node_modules/zod/v4/core/compile.js

@@ -1210,9 +1210,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
     doc.write(`}`);
     return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+    for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+    }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
     const def = schema._zod.def;
     doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.length`);
     // Build a new array with validated/transformed elements.
     const outputVar = buildsValue ? newVar(ctx) : null;
     const iVar = newVar(ctx);
@@ -1676,6 +1682,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const kVar = newVar(ctx);
     const valVar = newVar(ctx);
@@ -1692,6 +1699,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const valVar = newVar(ctx);
     doc.write(`const ${outputVar} = new Set();`);

package/node_modules/zod/v4/core/schemas.cjs

@@ -860,6 +860,33 @@ exports.$ZodDate = core.$constructor("$ZodDate", (inst, def) => {
         return payload;
     };
 });
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst, size) {
+    const caps = util.sizeCaps(inst._zod.def.checks);
+    if (!caps.length)
+        return;
+    const cap = Math.min(...caps.map((c) => c[0]));
+    const parse = inst._zod.parse;
+    inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+            for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+                if (n > max && ch._zod.def.when(payload)) {
+                    const start = payload.issues.length;
+                    ch._zod.check(payload);
+                    // the value is still the raw input, so no later check may read it
+                    payload.issues[start].continue = false;
+                    util.attachSchema(payload.issues, start, inst);
+                    return payload;
+                }
+            }
+        }
+        return parse(payload, ctx);
+    };
+}
+const arraySize = (input) => (Array.isArray(input) ? input.length : -1);
+const mapSize = (input) => (input instanceof Map ? input.size : -1);
+const setSize = (input) => (input instanceof Set ? input.size : -1);
 function handleArrayResult(result, final, index) {
     if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -905,6 +932,7 @@ exports.$ZodArray = core.$constructor("$ZodArray", (inst, def) => {
         }
         return payload; //handleArrayResultsAsync(parseResults, final);
     };
+    capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
     const isPresent = key in input;
@@ -1942,6 +1970,7 @@ exports.$ZodMap = core.$constructor("$ZodMap", (inst, def) => {
             return Promise.all(proms).then(() => payload);
         return payload;
     };
+    capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
     if (keyResult.issues.length) {
@@ -2011,6 +2040,7 @@ exports.$ZodSet = core.$constructor("$ZodSet", (inst, def) => {
             return Promise.all(proms).then(() => payload);
         return payload;
     };
+    capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
     if (result.issues.length) {

package/node_modules/zod/v4/core/schemas.d.cts

@@ -834,8 +834,10 @@ export type $InferZodRecordOutput<Key extends $ZodRecordKey = $ZodRecordKey, Val
 export type $InferZodRecordInput<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> = Key extends $partial ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : [
     Value
 ] extends [OptionalInSchema] ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : Record<core.input<Key> & PropertyKey, core.input<Value>>;
-export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals {
     def: $ZodRecordDef<Key, Value>;
+    output: $InferZodRecordOutput<Key, Value>;
+    input: $InferZodRecordInput<Key, Value>;
     isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
     optin?: "optional" | undefined;
     optout?: "optional" | undefined;

package/node_modules/zod/v4/core/schemas.d.ts

@@ -834,8 +834,10 @@ export type $InferZodRecordOutput<Key extends $ZodRecordKey = $ZodRecordKey, Val
 export type $InferZodRecordInput<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> = Key extends $partial ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : [
     Value
 ] extends [OptionalInSchema] ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : Record<core.input<Key> & PropertyKey, core.input<Value>>;
-export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals {
     def: $ZodRecordDef<Key, Value>;
+    output: $InferZodRecordOutput<Key, Value>;
+    input: $InferZodRecordInput<Key, Value>;
     isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
     optin?: "optional" | undefined;
     optout?: "optional" | undefined;

package/node_modules/zod/v4/core/schemas.js

@@ -816,6 +816,33 @@ export const $ZodDate = /*@__PURE__*/ core.$constructor("$ZodDate", (inst, def)
         return payload;
     };
 });
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst, size) {
+    const caps = util.sizeCaps(inst._zod.def.checks);
+    if (!caps.length)
+        return;
+    const cap = Math.min(...caps.map((c) => c[0]));
+    const parse = inst._zod.parse;
+    inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+            for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+                if (n > max && ch._zod.def.when(payload)) {
+                    const start = payload.issues.length;
+                    ch._zod.check(payload);
+                    // the value is still the raw input, so no later check may read it
+                    payload.issues[start].continue = false;
+                    util.attachSchema(payload.issues, start, inst);
+                    return payload;
+                }
+            }
+        }
+        return parse(payload, ctx);
+    };
+}
+const arraySize = (input) => (Array.isArray(input) ? input.length : -1);
+const mapSize = (input) => (input instanceof Map ? input.size : -1);
+const setSize = (input) => (input instanceof Set ? input.size : -1);
 function handleArrayResult(result, final, index) {
     if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -861,6 +888,7 @@ export const $ZodArray = /*@__PURE__*/ core.$constructor("$ZodArray", (inst, def
         }
         return payload; //handleArrayResultsAsync(parseResults, final);
     };
+    capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
     const isPresent = key in input;
@@ -1898,6 +1926,7 @@ export const $ZodMap = /*@__PURE__*/ core.$constructor("$ZodMap", (inst, def) =>
             return Promise.all(proms).then(() => payload);
         return payload;
     };
+    capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
     if (keyResult.issues.length) {
@@ -1967,6 +1996,7 @@ export const $ZodSet = /*@__PURE__*/ core.$constructor("$ZodSet", (inst, def) =>
             return Promise.all(proms).then(() => payload);
         return payload;
     };
+    capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
     if (result.issues.length) {

package/node_modules/zod/v4/core/util.cjs

@@ -46,6 +46,7 @@ exports.aborted = aborted;
 exports.explicitlyAborted = explicitlyAborted;
 exports.prefixIssues = prefixIssues;
 exports.unwrapMessage = unwrapMessage;
+exports.sizeCaps = sizeCaps;
 exports.attachSchema = attachSchema;
 exports.finalizeIssue = finalizeIssue;
 exports.getSizableOrigin = getSizableOrigin;
@@ -620,6 +621,20 @@ function unwrapMessage(message) {
     return typeof message === "string" ? message : message?.message;
 }
 /* A check holds no link back to the schema it is attached to — the same check instance is shared by every clone of that schema — so the owner is stamped onto the issues a check just raised, at the only point where both are in scope. Runs on the failure path only; `start` is the issue count from before the check ran. */
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+function sizeCaps(defChecks) {
+    const caps = [];
+    for (const ch of defChecks ?? []) {
+        const d = ch._zod.def;
+        // a later check may rewrite the value
+        if (!/_(length|size)$|_equals$/.test(d.check))
+            break;
+        const max = d.maximum ?? d.length ?? d.size;
+        if (max >= 0)
+            caps.push([max, ch]);
+    }
+    return caps;
+}
 function attachSchema(issues, start, inst) {
     var _a;
     for (let i = start; i < issues.length; i++) {

package/node_modules/zod/v4/core/util.d.cts

@@ -221,6 +221,8 @@ export declare function prefixIssues(path: PropertyKey, issues: errors.$ZodRawIs
 export declare function unwrapMessage(message: string | {
     message: string;
 } | undefined | null): string | undefined;
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+export declare function sizeCaps(defChecks: checks.$ZodCheck<never>[] | undefined): [number, checks.$ZodCheck<never>][];
 export declare function attachSchema(issues: errors.$ZodRawIssue[], start: number, inst: schemas.$ZodType): void;
 export declare function finalizeIssue(iss: errors.$ZodRawIssue, ctx: schemas.ParseContextInternal | undefined, config: $ZodConfig): errors.$ZodIssue;
 export declare function getSizableOrigin(input: any): "set" | "map" | "file" | "unknown";

package/node_modules/zod/v4/core/util.d.ts

@@ -221,6 +221,8 @@ export declare function prefixIssues(path: PropertyKey, issues: errors.$ZodRawIs
 export declare function unwrapMessage(message: string | {
     message: string;
 } | undefined | null): string | undefined;
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+export declare function sizeCaps(defChecks: checks.$ZodCheck<never>[] | undefined): [number, checks.$ZodCheck<never>][];
 export declare function attachSchema(issues: errors.$ZodRawIssue[], start: number, inst: schemas.$ZodType): void;
 export declare function finalizeIssue(iss: errors.$ZodRawIssue, ctx: schemas.ParseContextInternal | undefined, config: $ZodConfig): errors.$ZodIssue;
 export declare function getSizableOrigin(input: any): "set" | "map" | "file" | "unknown";

package/node_modules/zod/v4/core/util.js

@@ -550,6 +550,20 @@ export function unwrapMessage(message) {
     return typeof message === "string" ? message : message?.message;
 }
 /* A check holds no link back to the schema it is attached to — the same check instance is shared by every clone of that schema — so the owner is stamped onto the issues a check just raised, at the only point where both are in scope. Runs on the failure path only; `start` is the issue count from before the check ran. */
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+export function sizeCaps(defChecks) {
+    const caps = [];
+    for (const ch of defChecks ?? []) {
+        const d = ch._zod.def;
+        // a later check may rewrite the value
+        if (!/_(length|size)$|_equals$/.test(d.check))
+            break;
+        const max = d.maximum ?? d.length ?? d.size;
+        if (max >= 0)
+            caps.push([max, ch]);
+    }
+    return caps;
+}
 export function attachSchema(issues, start, inst) {
     var _a;
     for (let i = start; i < issues.length; i++) {

package/node_modules/zod/v4/core/versions.cjs

@@ -4,7 +4,7 @@ exports.version = void 0;
 exports.version = {
     major: 4,
     minor: 6,
-    patch: 5,
+    patch: 7,
 };
 
 // seal-cjs-exports

package/node_modules/zod/v4/core/versions.js

@@ -1,5 +1,5 @@
 export const version = {
     major: 4,
     minor: 6,
-    patch: 5,
+    patch: 7,
 };

package/package.json

@@ -15,7 +15,7 @@
   ],
   "main": "lib/index.js",
   "license": "Apache-2.0",
-  "version": "9.0.0-alpha.9",
+  "version": "9.0.0",
   "types": "lib/index.d.ts",
   "stability": "stable",
   "exports": {

package/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "9.0.0-alpha.9"
+  "version": "9.0.0"
 }