@suveren/gateway 0.38.0 → 0.40.0

package/node_modules/zod/src/v4/core/parse.ts

@@ -4,27 +4,36 @@ import type * as schemas from "./schemas.js";
 import * as util from "./util.js";
 
 export type $ZodErrorClass = { new (issues: errors.$ZodIssue[]): errors.$ZodError };
+type $ParseParams = { callee?: util.AnyFunc; Err?: $ZodErrorClass | undefined };
+
+// Always both keys, so the `_params` read site in `_parse` sees one object shape rather than two.
+function finalizeParams(callee: util.AnyFunc, params: $ParseParams | undefined): $ParseParams {
+  return { callee: params?.callee ?? callee, Err: params?.Err };
+}
 
 ///////////        METHODS       ///////////
 export type $Parse = <T extends schemas.$ZodType>(
   schema: T,
   value: unknown,
   _ctx?: schemas.ParseContext<errors.$ZodIssue>,
-  _params?: { callee?: util.AnyFunc; Err?: $ZodErrorClass }
+  _params?: $ParseParams
 ) => core.output<T>;
 
-export const _parse: (_Err: $ZodErrorClass) => $Parse = (_Err) => (schema, value, _ctx, _params) => {
-  const ctx: schemas.ParseContextInternal = _ctx ? Object.assign(_ctx, { async: false }) : { async: false };
-  const result = schema._zod.run({ value, issues: [] }, ctx);
-  if (result instanceof Promise) {
-    throw new core.$ZodAsyncError();
-  }
-  if (result.issues.length) {
-    const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
-    util.captureStackTrace(e, _params?.callee);
-    throw e;
-  }
-  return result.value as core.output<typeof schema>;
+export const _parse: (_Err: $ZodErrorClass) => $Parse = (_Err) => {
+  const fn: $Parse = (schema, value, _ctx, _params) => {
+    const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: false } : { async: false };
+    const result = schema._zod.run({ value, issues: [] }, ctx);
+    if (result instanceof Promise) {
+      throw new core.$ZodAsyncError();
+    }
+    if (result.issues.length) {
+      const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
+      util.captureStackTrace(e, _params?.callee ?? fn);
+      throw e;
+    }
+    return result.value as core.output<typeof schema>;
+  };
+  return fn;
 };
 
 export const parse: $Parse = /* @__PURE__*/ _parse(errors.$ZodRealError);
@@ -33,19 +42,22 @@ export type $ParseAsync = <T extends schemas.$ZodType>(
   schema: T,
   value: unknown,
   _ctx?: schemas.ParseContext<errors.$ZodIssue>,
-  _params?: { callee?: util.AnyFunc; Err?: $ZodErrorClass }
+  _params?: $ParseParams
 ) => Promise<core.output<T>>;
 
-export const _parseAsync: (_Err: $ZodErrorClass) => $ParseAsync = (_Err) => async (schema, value, _ctx, params) => {
-  const ctx: schemas.ParseContextInternal = _ctx ? Object.assign(_ctx, { async: true }) : { async: true };
-  let result = schema._zod.run({ value, issues: [] }, ctx);
-  if (result instanceof Promise) result = await result;
-  if (result.issues.length) {
-    const e = new (params?.Err ?? _Err)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
-    util.captureStackTrace(e, params?.callee);
-    throw e;
-  }
-  return result.value as core.output<typeof schema>;
+export const _parseAsync: (_Err: $ZodErrorClass) => $ParseAsync = (_Err) => {
+  const fn: $ParseAsync = async (schema, value, _ctx, params) => {
+    const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: true } : { async: true };
+    let result = schema._zod.run({ value, issues: [] }, ctx);
+    if (result instanceof Promise) result = await result;
+    if (result.issues.length) {
+      const e = new (params?.Err ?? _Err)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
+      util.captureStackTrace(e, params?.callee ?? fn);
+      throw e;
+    }
+    return result.value as core.output<typeof schema>;
+  };
+  return fn;
 };
 
 export const parseAsync: $ParseAsync = /* @__PURE__*/ _parseAsync(errors.$ZodRealError);
@@ -63,15 +75,33 @@ export const _safeParse: (_Err: $ZodErrorClass) => $SafeParse = (_Err) => (schem
     throw new core.$ZodAsyncError();
   }
 
-  return result.issues.length
-    ? {
-        success: false,
-        error: new (_Err ?? errors.$ZodError)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config()))),
-      }
-    : ({ success: true, data: result.value } as any);
+  return result.issues.length ? failure(_Err, result.issues, ctx) : ({ success: true, data: result.value } as any);
 };
 export const safeParse: $SafeParse = /* @__PURE__*/ _safeParse(errors.$ZodRealError);
 
+// the error is built on the first read of `error`: finalizing the issues and constructing the instance is most of a failing parse, and a caller that only branches on `success` never pays it. a getter in the literal keeps this small; the alternative, one shared accessor descriptor plus a hidden state slot, reads ~15% faster but costs ~75 B gzipped in every bundle
+function failure(Err: $ZodErrorClass, issues: errors.$ZodRawIssue[], ctx: schemas.ParseContextInternal): any {
+  let error: errors.$ZodError | undefined;
+  return {
+    success: false,
+    get error() {
+      if (!error) {
+        error = new Err(issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
+        // finalizeIssue drops `input`, so the built error holds nothing; keeping the raw issues past this point pins the parsed value for the life of the result
+        issues = undefined as any;
+        ctx = undefined as any;
+      }
+      return error;
+    },
+    set error(e: errors.$ZodError) {
+      error = e;
+      // a replacement makes the getter's branch unreachable, so the captures have to go here too
+      issues = undefined as any;
+      ctx = undefined as any;
+    },
+  };
+}
+
 export type $SafeParseAsync = <T extends schemas.$ZodType>(
   schema: T,
   value: unknown,
@@ -79,16 +109,201 @@ export type $SafeParseAsync = <T extends schemas.$ZodType>(
 ) => Promise<util.SafeParseResult<core.output<T>>>;
 
 export const _safeParseAsync: (_Err: $ZodErrorClass) => $SafeParseAsync = (_Err) => async (schema, value, _ctx) => {
-  const ctx: schemas.ParseContextInternal = _ctx ? Object.assign(_ctx, { async: true }) : { async: true };
+  const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: true } : { async: true };
   let result = schema._zod.run({ value, issues: [] }, ctx);
   if (result instanceof Promise) result = await result;
 
-  return result.issues.length
-    ? {
-        success: false,
-        error: new _Err(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config()))),
-      }
-    : ({ success: true, data: result.value } as any);
+  return result.issues.length ? failure(_Err, result.issues, ctx) : ({ success: true, data: result.value } as any);
 };
 
 export const safeParseAsync: $SafeParseAsync = /* @__PURE__*/ _safeParseAsync(errors.$ZodRealError);
+
+// registry mirrors of the compiler's sentinels, so this module never imports the compiler
+const COMPILE_INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
+const COMPILE_FALLBACK = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
+
+interface CompiledBag {
+  validator?: ((input: unknown) => unknown) & { definite?: boolean | undefined };
+  fallbackRun?: (payload: schemas.ParsePayload, ctx: schemas.ParseContextInternal) => unknown;
+}
+
+export type $Validate = <T extends schemas.$ZodType>(
+  schema: T,
+  value: unknown,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+) => value is core.input<T>;
+
+// Deliberately tiny, because v8 will not inline a body carrying the fallback's object literals and throw. Everything that is not the compiled happy path lives in validateFallback, and that split is worth ~35% on a compiled schema.
+export const validate: $Validate = ((
+  schema: schemas.$ZodType,
+  value: unknown,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+): boolean => {
+  const validator = (schema._zod.bag as CompiledBag).validator;
+  if (validator !== undefined) {
+    if (validator(value) !== COMPILE_INVALID) return true;
+    // a definite sentinel means the runtime would reject, so skip the re-parse; a ctx can still change the answer
+    if (validator.definite === true && _ctx === undefined) return false;
+  }
+  return validateFallback(schema, value, _ctx);
+}) as $Validate;
+
+function validateFallback(
+  schema: schemas.$ZodType,
+  value: unknown,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+): boolean {
+  const ctx: schemas.ParseContextInternal = _ctx
+    ? { ..._ctx, async: false, abortEarly: true }
+    : { async: false, abortEarly: true };
+  const fallbackRun = (schema._zod.bag as CompiledBag).fallbackRun;
+  let result: unknown;
+  if (fallbackRun) {
+    // skip nested fast paths on the fallback, so user callbacks keep the at-most-twice bound
+    (ctx as Record<symbol, unknown>)[COMPILE_FALLBACK] = true;
+    result = fallbackRun({ value, issues: [] }, ctx);
+  } else {
+    result = schema._zod.run({ value, issues: [] }, ctx);
+  }
+  if (result instanceof Promise) {
+    throw new core.$ZodAsyncError();
+  }
+  return (result as schemas.ParsePayload).issues.length === 0;
+}
+
+export type $ValidateAsync = <T extends schemas.$ZodType>(
+  schema: T,
+  value: unknown,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+) => Promise<boolean>;
+
+// no fast path: the compiler keeps async parses on the runtime, because a promise-returning callback that is not declared async compiles to a throw
+export const validateAsync: $ValidateAsync = async (schema, value, _ctx) => {
+  const ctx: schemas.ParseContextInternal = _ctx
+    ? { ..._ctx, async: true, abortEarly: true }
+    : { async: true, abortEarly: true };
+  let result: unknown = schema._zod.run({ value, issues: [] }, ctx);
+  if (result instanceof Promise) result = await result;
+  return (result as schemas.ParsePayload).issues.length === 0;
+};
+
+// Codec functions
+export type $Encode = <T extends schemas.$ZodType>(
+  schema: T,
+  value: core.output<T>,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>,
+  _params?: $ParseParams
+) => core.input<T>;
+
+export const _encode: (_Err: $ZodErrorClass) => $Encode = (_Err) => {
+  const parse = _parse(_Err);
+  const fn: $Encode = (schema, value, _ctx, _params) => {
+    const ctx = _ctx ? { ..._ctx, direction: "backward" as const } : { direction: "backward" as const };
+    return parse(schema, value, ctx as any, finalizeParams(fn, _params)) as any;
+  };
+  return fn;
+};
+
+export const encode: $Encode = /* @__PURE__*/ _encode(errors.$ZodRealError);
+
+export type $Decode = <T extends schemas.$ZodType>(
+  schema: T,
+  value: core.input<T>,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>,
+  _params?: $ParseParams
+) => core.output<T>;
+
+export const _decode: (_Err: $ZodErrorClass) => $Decode = (_Err) => {
+  const parse = _parse(_Err);
+  const fn: $Decode = (schema, value, _ctx, _params) => {
+    return parse(schema, value, _ctx, finalizeParams(fn, _params));
+  };
+  return fn;
+};
+
+export const decode: $Decode = /* @__PURE__*/ _decode(errors.$ZodRealError);
+
+export type $EncodeAsync = <T extends schemas.$ZodType>(
+  schema: T,
+  value: core.output<T>,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>,
+  _params?: $ParseParams
+) => Promise<core.input<T>>;
+
+export const _encodeAsync: (_Err: $ZodErrorClass) => $EncodeAsync = (_Err) => {
+  const parseAsync = _parseAsync(_Err);
+  const fn: $EncodeAsync = async (schema, value, _ctx, _params) => {
+    const ctx = _ctx ? { ..._ctx, direction: "backward" as const } : { direction: "backward" as const };
+    return (await parseAsync(schema, value, ctx as any, finalizeParams(fn, _params))) as any;
+  };
+  return fn;
+};
+
+export const encodeAsync: $EncodeAsync = /* @__PURE__*/ _encodeAsync(errors.$ZodRealError);
+
+export type $DecodeAsync = <T extends schemas.$ZodType>(
+  schema: T,
+  value: core.input<T>,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>,
+  _params?: $ParseParams
+) => Promise<core.output<T>>;
+
+export const _decodeAsync: (_Err: $ZodErrorClass) => $DecodeAsync = (_Err) => {
+  const parseAsync = _parseAsync(_Err);
+  const fn: $DecodeAsync = async (schema, value, _ctx, _params) => {
+    return await parseAsync(schema, value, _ctx, finalizeParams(fn, _params));
+  };
+  return fn;
+};
+
+export const decodeAsync: $DecodeAsync = /* @__PURE__*/ _decodeAsync(errors.$ZodRealError);
+
+export type $SafeEncode = <T extends schemas.$ZodType>(
+  schema: T,
+  value: core.output<T>,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+) => util.SafeParseResult<core.input<T>>;
+
+export const _safeEncode: (_Err: $ZodErrorClass) => $SafeEncode = (_Err) => (schema, value, _ctx) => {
+  const ctx = _ctx ? { ..._ctx, direction: "backward" as const } : { direction: "backward" as const };
+  return _safeParse(_Err)(schema, value, ctx as any) as any;
+};
+
+export const safeEncode: $SafeEncode = /* @__PURE__*/ _safeEncode(errors.$ZodRealError);
+
+export type $SafeDecode = <T extends schemas.$ZodType>(
+  schema: T,
+  value: core.input<T>,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+) => util.SafeParseResult<core.output<T>>;
+
+export const _safeDecode: (_Err: $ZodErrorClass) => $SafeDecode = (_Err) => (schema, value, _ctx) => {
+  return _safeParse(_Err)(schema, value, _ctx);
+};
+
+export const safeDecode: $SafeDecode = /* @__PURE__*/ _safeDecode(errors.$ZodRealError);
+
+export type $SafeEncodeAsync = <T extends schemas.$ZodType>(
+  schema: T,
+  value: core.output<T>,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+) => Promise<util.SafeParseResult<core.input<T>>>;
+
+export const _safeEncodeAsync: (_Err: $ZodErrorClass) => $SafeEncodeAsync = (_Err) => async (schema, value, _ctx) => {
+  const ctx = _ctx ? { ..._ctx, direction: "backward" as const } : { direction: "backward" as const };
+  return _safeParseAsync(_Err)(schema, value, ctx as any) as any;
+};
+
+export const safeEncodeAsync: $SafeEncodeAsync = /* @__PURE__*/ _safeEncodeAsync(errors.$ZodRealError);
+
+export type $SafeDecodeAsync = <T extends schemas.$ZodType>(
+  schema: T,
+  value: core.input<T>,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+) => Promise<util.SafeParseResult<core.output<T>>>;
+
+export const _safeDecodeAsync: (_Err: $ZodErrorClass) => $SafeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
+  return _safeParseAsync(_Err)(schema, value, _ctx);
+};
+
+export const safeDecodeAsync: $SafeDecodeAsync = /* @__PURE__*/ _safeDecodeAsync(errors.$ZodRealError);

package/node_modules/zod/src/v4/core/regexes.ts

@@ -1,9 +1,19 @@
-export const cuid: RegExp = /^[cC][^\s-]{8,}$/;
+import * as util from "./util.js";
+
+/**
+ * @deprecated CUID v1 is deprecated by its authors due to information leakage
+ * (timestamps embedded in the id). Use {@link cuid2} instead.
+ * See https://github.com/paralleldrive/cuid.
+ */
+export const cuid: RegExp = /^[cC][0-9a-z]{6,}$/;
 export const cuid2: RegExp = /^[0-9a-z]+$/;
-export const ulid: RegExp = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;
+export const ulid: RegExp = /^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/;
 export const xid: RegExp = /^[0-9a-vA-V]{20}$/;
 export const ksuid: RegExp = /^[A-Za-z0-9]{27}$/;
 export const nanoid: RegExp = /^[a-zA-Z0-9_-]{21}$/;
+export function nanoidOfLength(length: number): RegExp {
+  return new RegExp(`^[a-zA-Z0-9_-]{${length}}$`);
+}
 
 /** ISO 8601-1 duration regex. Does not support the 8601-2 extensions like negative durations or fractional/negative components. */
 export const duration: RegExp =
@@ -16,12 +26,12 @@ export const extendedDuration: RegExp =
 /** A regex for any UUID-like identifier: 8-4-4-4-12 hex pattern */
 export const guid: RegExp = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
 
-/** Returns a regex for validating an RFC 4122 UUID.
+/** Returns a regex for validating an RFC 9562/4122 UUID.
  *
  * @param version Optionally specify a version 1-8. If no version is specified, all versions are supported. */
 export const uuid = (version?: number | undefined): RegExp => {
   if (!version)
-    return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000)$/;
+    return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
   return new RegExp(
     `^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`
   );
@@ -32,7 +42,7 @@ export const uuid7: RegExp = /*@__PURE__*/ uuid(7);
 
 /** Practical email validation */
 export const email: RegExp =
-  /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
+  /^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/;
 
 /** Equivalent to the HTML5 input[type=email] validation implemented by browsers. Source: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/email */
 export const html5Email: RegExp =
@@ -44,12 +54,14 @@ export const rfc5322Email =
 
 /** A loose regex that allows Unicode characters, enforces length limits, and that's about it. */
 export const unicodeEmail = /^[^\s@"]{1,64}@[^\s@]{1,255}$/u;
+export const idnEmail = unicodeEmail;
 
 export const browserEmail: RegExp =
   /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
 // from https://thekevinscott.com/emojis-in-javascript/#writing-a-regular-expression
 
-export const _emoji = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`;
+// Single character class, not an alternation: the two properties overlap (U+1F9B0-U+1F9B3), so `(A|B)+` backtracks exponentially on a failed match. The leading lookahead then demands one anchor — a pictograph, a regional indicator, or the enclosing keycap — because `\p{Emoji_Component}` on its own covers ASCII digits, `#`, `*`, ZWJ, variation selectors and skin tone modifiers, none of which is an emoji without a base.
+const _emoji: string = `^(?=[\\s\\S]*[\\p{Extended_Pictographic}\\p{Regional_Indicator}\\u20E3])[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`;
 export function emoji(): RegExp {
   return new RegExp(_emoji, "u");
 }
@@ -57,31 +69,54 @@ export function emoji(): RegExp {
 export const ipv4: RegExp =
   /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 export const ipv6: RegExp =
-  /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})$/;
-
+  /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
+export const mac = (delimiter?: string): RegExp => {
+  const escapedDelim = util.escapeRegex(delimiter ?? ":");
+  return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
+};
 export const cidrv4: RegExp =
   /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
 export const cidrv6: RegExp =
-  /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
+  /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 
 // https://stackoverflow.com/questions/7860392/determine-if-string-is-in-base64-using-javascript
 export const base64: RegExp = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
-export const base64url: RegExp = /^[A-Za-z0-9_-]*$/;
+export const base64url: RegExp = /^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2,3})?$/;
 
 // based on https://stackoverflow.com/questions/106179/regular-expression-to-match-dns-hostname-or-ip-address
-// export const hostname: RegExp =
-//   /^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)+([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9])$/;
-export const hostname: RegExp = /^([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/;
-export const domain: RegExp = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
+// export const hostname: RegExp = /^([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/;
+export const hostname: RegExp =
+  /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+
+export const domain: RegExp = /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/;
+
+export const httpProtocol: RegExp = /^https?$/;
 
-// https://blog.stevenlevithan.com/archives/validate-phone-number#r4-3 (regex sans spaces)
-export const e164: RegExp = /^\+(?:[0-9]){6,14}[0-9]$/;
+// https://blog.stevenlevithan.com/archives/validate-phone-number#r4-3 (regex sans spaces) E.164: leading digit must be 1-9; total digits (excluding '+') between 7-15
+export const e164: RegExp = /^\+[1-9]\d{6,14}$/;
+
+// Credit card shape: 12–19 digits, optionally separated by single spaces or single hyphens. ISO/IEC 7812 caps the PAN at 19 digits; 12 is the shortest issued length (Maestro).
+export const creditCard: RegExp = /^\d(?:[ -]?\d){11,18}$/;
+
+// ISO 4217 alpha codes from the SIX list, regenerated by scripts/update-iso-4217.ts
+export const currencyCode: RegExp =
+  /^(?:AED|AFN|ALL|AMD|AOA|ARS|AUD|AWG|AZN|BAM|BBD|BDT|BHD|BIF|BMD|BND|BOB|BOV|BRL|BSD|BTN|BWP|BYN|BZD|CAD|CDF|CHE|CHF|CHW|CLF|CLP|CNY|COP|COU|CRC|CUP|CVE|CZK|DJF|DKK|DOP|DZD|EGP|ERN|ETB|EUR|FJD|FKP|GBP|GEL|GHS|GIP|GMD|GNF|GTQ|GYD|HKD|HNL|HTG|HUF|IDR|ILS|INR|IQD|IRR|ISK|JMD|JOD|JPY|KES|KGS|KHR|KMF|KPW|KRW|KWD|KYD|KZT|LAK|LBP|LKR|LRD|LSL|LYD|MAD|MDL|MGA|MKD|MMK|MNT|MOP|MRU|MUR|MVR|MWK|MXN|MXV|MYR|MZN|NAD|NGN|NIO|NOK|NPR|NZD|OMR|PAB|PEN|PGK|PHP|PKR|PLN|PYG|QAR|RON|RSD|RUB|RWF|SAR|SBD|SCR|SDG|SEK|SGD|SHP|SLE|SOS|SRD|SSP|STN|SVC|SYP|SZL|THB|TJS|TMT|TND|TOP|TRY|TTD|TWD|TZS|UAH|UGX|USD|USN|UYI|UYU|UYW|UZS|VED|VES|VND|VUV|WST|XAD|XAF|XAG|XAU|XBA|XBB|XBC|XBD|XCD|XCG|XDR|XOF|XPD|XPF|XPT|XSU|XTS|XUA|XXX|YER|ZAR|ZMW|ZWG)$/;
+
+// iban electronic format: 2-letter country, check digits 02-98 (the only values `98 - remainder` can produce), 11-30 bban characters
+export const iban: RegExp = /^[A-Z]{2}(?!00|01|99)\d{2}[A-Z0-9]{11,30}$/;
 
-// const dateSource = `((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))`;
 const dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
-export const date: RegExp = /*@__PURE__*/ new RegExp(`^${dateSource}$`);
 
-function timeSource(args: { precision?: number | null | undefined }) {
+/** Anchors a pattern source. The interpolation lives here rather than at the call site because
+ * esbuild will not drop a `@__PURE__` call whose own argument interpolates a variable, but it
+ * will drop `anchor(dateSource)`. Keeping it inline pinned `date` into every bundle. */
+function anchor(source: string): RegExp {
+  return new RegExp(`^${source}$`);
+}
+
+export const date: RegExp = /*@__PURE__*/ anchor(dateSource);
+
+function timeSource(args: { precision?: number | null | undefined; seconds?: boolean }) {
   const hhmm = `(?:[01]\\d|2[0-3]):[0-5]\\d`;
   const regex =
     typeof args.precision === "number"
@@ -90,7 +125,9 @@ function timeSource(args: { precision?: number | null | undefined }) {
         : args.precision === 0
           ? `${hhmm}:[0-5]\\d`
           : `${hhmm}:[0-5]\\d\\.\\d{${args.precision}}`
-      : `${hhmm}(?::[0-5]\\d(?:\\.\\d+)?)?`;
+      : args.seconds
+        ? `${hhmm}:[0-5]\\d(?:\\.\\d+)?`
+        : `${hhmm}(?::[0-5]\\d(?:\\.\\d+)?)?`;
   return regex;
 }
 export function time(args: {
@@ -106,30 +143,75 @@ export function datetime(args: {
   offset?: boolean;
   local?: boolean;
 }): RegExp {
-  const time = timeSource({ precision: args.precision });
   const opts = ["Z"];
-  if (args.local) opts.push("");
-  if (args.offset) opts.push(`([+-]\\d{2}:\\d{2})`);
-  const timeRegex = `${time}(?:${opts.join("|")})`;
+  // if (args.offset) opts.push(`([+-]\\d{2}:\\d{2})`);
+  if (args.offset) opts.push(`([+-](?:[01]\\d|2[0-3]):[0-5]\\d)`);
+
+  // RFC 3339 mandates seconds wherever the time carries a `Z` or an offset, so only the unqualified form `local` adds may omit them
+  const qualified = `${timeSource({ precision: args.precision, seconds: true })}(?:${opts.join("|")})`;
+  const timeRegex = args.local ? `${qualified}|${timeSource({ precision: args.precision })}` : qualified;
 
   return new RegExp(`^${dateSource}T(?:${timeRegex})$`);
 }
 
+// the unbounded form of `string()` as a literal, so every plain string shares one instance instead of building its own
+export const anyString: RegExp = /^[\s\S]{0,}$/;
+
 export const string = (params?: { minimum?: number | undefined; maximum?: number | undefined }): RegExp => {
   const regex = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
   return new RegExp(`^${regex}$`);
 };
 
-export const bigint: RegExp = /^\d+n?$/;
-export const integer: RegExp = /^\d+$/;
-export const number: RegExp = /^-?\d+(?:\.\d+)?/i;
-export const boolean: RegExp = /true|false/i;
-const _null: RegExp = /null/i;
+export const bigint: RegExp = /^-?\d+n?$/;
+export const integer: RegExp = /^-?\d+$/;
+export const number: RegExp = /^-?\d+(?:\.\d+)?$/;
+export const boolean: RegExp = /^(?:true|false)$/i;
+const _null: RegExp = /^null$/i;
 export { _null as null };
-const _undefined: RegExp = /undefined/i;
+const _undefined: RegExp = /^undefined$/i;
 export { _undefined as undefined };
 
 // regex for string with no uppercase letters
 export const lowercase: RegExp = /^[^A-Z]*$/;
 // regex for string with no lowercase letters
 export const uppercase: RegExp = /^[^a-z]*$/;
+
+// regex for hexadecimal strings (any length)
+export const hex: RegExp = /^[0-9a-fA-F]*$/;
+
+// Hash regexes for different algorithms and encodings
+
+// Helper function to create base64 regex with exact length and padding
+function fixedBase64(bodyLength: number, padding: "" | "=" | "=="): RegExp {
+  return new RegExp(`^[A-Za-z0-9+/]{${bodyLength}}${padding}$`);
+}
+
+// Helper function to create base64url regex with exact length (no padding)
+function fixedBase64url(length: number): RegExp {
+  return new RegExp(`^[A-Za-z0-9_-]{${length}}$`);
+}
+
+// MD5 (16 bytes): base64 = 24 chars total (22 + "==")
+export const md5_hex: RegExp = /^[0-9a-fA-F]{32}$/;
+export const md5_base64: RegExp = /*@__PURE__*/ fixedBase64(22, "==");
+export const md5_base64url: RegExp = /*@__PURE__*/ fixedBase64url(22);
+
+// SHA1 (20 bytes): base64 = 28 chars total (27 + "=")
+export const sha1_hex: RegExp = /^[0-9a-fA-F]{40}$/;
+export const sha1_base64: RegExp = /*@__PURE__*/ fixedBase64(27, "=");
+export const sha1_base64url: RegExp = /*@__PURE__*/ fixedBase64url(27);
+
+// SHA256 (32 bytes): base64 = 44 chars total (43 + "=")
+export const sha256_hex: RegExp = /^[0-9a-fA-F]{64}$/;
+export const sha256_base64: RegExp = /*@__PURE__*/ fixedBase64(43, "=");
+export const sha256_base64url: RegExp = /*@__PURE__*/ fixedBase64url(43);
+
+// SHA384 (48 bytes): base64 = 64 chars total (no padding)
+export const sha384_hex: RegExp = /^[0-9a-fA-F]{96}$/;
+export const sha384_base64: RegExp = /*@__PURE__*/ fixedBase64(64, "");
+export const sha384_base64url: RegExp = /*@__PURE__*/ fixedBase64url(64);
+
+// SHA512 (64 bytes): base64 = 88 chars total (86 + "==")
+export const sha512_hex: RegExp = /^[0-9a-fA-F]{128}$/;
+export const sha512_base64: RegExp = /*@__PURE__*/ fixedBase64(86, "==");
+export const sha512_base64url: RegExp = /*@__PURE__*/ fixedBase64url(86);

package/node_modules/zod/src/v4/core/registries.ts

@@ -1,9 +1,9 @@
 import type * as core from "./core.js";
 import type { $ZodType } from "./schemas.js";
 
-export const $output: unique symbol = Symbol("ZodOutput");
+export const $output: unique symbol = /*@__PURE__*/ Symbol("ZodOutput");
 export type $output = typeof $output;
-export const $input: unique symbol = Symbol("ZodInput");
+export const $input: unique symbol = /*@__PURE__*/ Symbol("ZodInput");
 export type $input = typeof $input;
 
 export type $replace<Meta, S extends $ZodType> = Meta extends $output
@@ -23,11 +23,11 @@ export type $replace<Meta, S extends $ZodType> = Meta extends $output
           ? { [K in keyof Meta]: $replace<Meta[K], S> }
           : Meta;
 
-type MetadataType = Record<string, unknown> | undefined;
+type MetadataType = object | undefined;
 export class $ZodRegistry<Meta extends MetadataType = MetadataType, Schema extends $ZodType = $ZodType> {
   _meta!: Meta;
   _schema!: Schema;
-  _map: Map<Schema, $replace<Meta, Schema>> = new Map();
+  _map: WeakMap<Schema, $replace<Meta, Schema>> = new WeakMap();
   _idmap: Map<string, Schema> = new Map();
 
   add<S extends Schema>(
@@ -37,16 +37,13 @@ export class $ZodRegistry<Meta extends MetadataType = MetadataType, Schema exten
     const meta: any = _meta[0];
     this._map.set(schema, meta!);
     if (meta && typeof meta === "object" && "id" in meta) {
-      if (this._idmap.has(meta.id!)) {
-        throw new Error(`ID ${meta.id} already exists in the registry`);
-      }
       this._idmap.set(meta.id!, schema);
     }
     return this as any;
   }
 
   clear(): this {
-    this._map = new Map();
+    this._map = new WeakMap();
     this._idmap = new Map();
     return this;
   }
@@ -68,7 +65,8 @@ export class $ZodRegistry<Meta extends MetadataType = MetadataType, Schema exten
     if (p) {
       const pm: any = { ...(this.get(p) ?? {}) };
       delete pm.id; // do not inherit id
-      return { ...pm, ...this._map.get(schema) } as any;
+      const f = { ...pm, ...this._map.get(schema) } as any;
+      return Object.keys(f).length ? f : undefined;
     }
     return this._map.get(schema) as any;
   }
@@ -93,4 +91,15 @@ export function registry<T extends MetadataType = MetadataType, S extends $ZodTy
   return new $ZodRegistry<T, S>();
 }
 
-export const globalRegistry: $ZodRegistry<GlobalMeta> = /*@__PURE__*/ registry<GlobalMeta>();
+interface GlobalThisWithRegistry {
+  /**
+   * The globalRegistry instance shared across both CommonJS and ESM builds.
+   * By attaching the registry to `globalThis`, this property ensures a single, deduplicated instance
+   * is used regardless of whether the package is loaded via `require` (CJS) or `import` (ESM).
+   * This prevents dual package hazards and keeps registry state consistent.
+   */
+  __zod_globalRegistry?: $ZodRegistry<GlobalMeta>;
+}
+
+(globalThis as GlobalThisWithRegistry).__zod_globalRegistry ??= registry<GlobalMeta>();
+export const globalRegistry: $ZodRegistry<GlobalMeta> = (globalThis as GlobalThisWithRegistry).__zod_globalRegistry!;