@suveren/gateway 0.39.0 → 0.40.0

package/node_modules/zod/src/v4/classic/tests/intersection.test.ts

@@ -27,17 +27,62 @@ test("object intersection: loose", () => {
   expect(() => C.parse({ a: "foo" })).toThrow();
 });
 
-test("object intersection: strict", () => {
+test("object intersection: strict + strip", () => {
   const A = z.strictObject({ a: z.string() });
   const B = z.object({ b: z.string() });
 
-  const C = z.intersection(A, B); // BaseC.merge(HasID);
+  const C = z.intersection(A, B);
   type C = z.infer<typeof C>;
   expectTypeOf<C>().toEqualTypeOf<{ a: string } & { b: string }>();
-  const data = { a: "foo", b: "foo", c: "extra" };
 
-  const result = C.safeParse(data);
-  expect(result.success).toEqual(false);
+  // Keys recognized by either side should work
+  expect(C.parse({ a: "foo", b: "bar" })).toEqual({ a: "foo", b: "bar" });
+
+  // Extra keys are stripped (follows strip behavior from B)
+  expect(C.parse({ a: "foo", b: "bar", c: "extra" })).toEqual({ a: "foo", b: "bar" });
+});
+
+test("object intersection: strict + strict", () => {
+  const A = z.strictObject({ a: z.string() });
+  const B = z.strictObject({ b: z.string() });
+
+  const C = z.intersection(A, B);
+
+  // Keys recognized by either side should work
+  expect(C.parse({ a: "foo", b: "bar" })).toEqual({ a: "foo", b: "bar" });
+
+  // Keys unrecognized by BOTH sides should error
+  const result = C.safeParse({ a: "foo", b: "bar", c: "extra" });
+  expect(result.error?.issues).toMatchInlineSnapshot(`
+    [
+      {
+        "code": "unrecognized_keys",
+        "keys": [
+          "c",
+        ],
+        "message": "Unrecognized key: "c"",
+        "path": [],
+      },
+    ]
+  `);
+});
+
+test("object intersection strips __proto__ from pass-through operands", () => {
+  const cases = [
+    [
+      z.intersection(z.object({ name: z.string() }), z.unknown()),
+      JSON.parse('{"__proto__":{"isAdmin":true},"name":"alice"}'),
+      { name: "alice" },
+    ],
+    [z.intersection(z.record(z.string(), z.unknown()), z.any()), JSON.parse('{"__proto__":{},"a":1}'), { a: 1 }],
+  ] as const;
+
+  for (const [schema, input, expected] of cases) {
+    const parsed = schema.parse(input);
+    expect(parsed).toEqual(expected);
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+    expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+  }
 });
 
 test("deep intersection", () => {
@@ -169,3 +214,121 @@ test("invalid deep merge of object and array combination", async () => {
     `[Error: Unmergable intersection. Error path: ["students",0,"name"]]`
   );
 });
+
+// A record's key schema says which keys that record GOVERNS; it is not a predicate
+// every key in the result must satisfy. TypeScript works the same way: in
+// `{name: string} & Record<`S_${string}`, string>` the index signature constrains
+// only the keys matching it, so `name` is fine. So a key one side does not govern
+// is reconciled against the other side, exactly as unrecognized_keys already is.
+test("a record's key schema governs only its own keys inside an intersection", () => {
+  const Obj = z.object({ name: z.string() });
+  const value = { name: "a", S_a: "s" };
+
+  // Every key-schema flavor behaves the same: `name` belongs to the object side.
+  expect(z.intersection(Obj, z.record(z.string().regex(/^S_/), z.string())).parse(value)).toEqual(value);
+  expect(z.intersection(Obj, z.record(z.templateLiteral(["S_", z.string()]), z.string())).parse(value)).toEqual(value);
+  expect(z.intersection(Obj, z.partialRecord(z.enum(["p1", "p2"]), z.string())).parse({ name: "a", p1: "x" })).toEqual({
+    name: "a",
+    p1: "x",
+  });
+  expect(z.intersection(Obj, z.record(z.enum(["p1"]), z.string())).parse({ name: "a", p1: "x" })).toEqual({
+    name: "a",
+    p1: "x",
+  });
+
+  // A key the record DOES govern still has its value validated across the intersection.
+  const governed = z.intersection(z.object({ S_x: z.number() }), z.record(z.string().regex(/^S_/), z.string()));
+  expect(governed.safeParse({ S_x: 1 }).success).toBe(false);
+
+  // A key NEITHER side governs is still rejected.
+  const strict = z.intersection(z.strictObject({ name: z.string() }), z.record(z.string().regex(/^S_/), z.string()));
+  expect(strict.parse(value)).toEqual(value);
+  expect(strict.safeParse({ ...value, evil: "q" }).success).toBe(false);
+
+  // Standalone, a record still rejects a key it does not govern.
+  expect(z.record(z.string().regex(/^S_/), z.string()).safeParse({ S_a: "s", bad: "x" }).success).toBe(false);
+});
+
+test("partialRecord reports an out-of-set key as unrecognized, not invalid", () => {
+  const enumKeys = z.partialRecord(z.enum(["a", "b"]), z.string()).safeParse({ a: "x", zzz: "q" });
+  expect(enumKeys.success).toBe(false);
+  expect(enumKeys.error!.issues[0].code).toBe("unrecognized_keys");
+
+  // A regex key schema still reports the failure as an invalid key.
+  const regexKeys = z.record(z.string().regex(/^S_/), z.string()).safeParse({ S_a: "x", zzz: "q" });
+  expect(regexKeys.success).toBe(false);
+  expect(regexKeys.error!.issues[0].code).toBe("invalid_key");
+});
+
+test("intersection operands run their own checks, refinements and transforms", () => {
+  let checks = 0;
+  const failing = z.intersection(
+    z.strictObject({ x: z.string() }).check(() => {
+      checks++;
+    }),
+    z.strictObject({ a: z.string() }).superRefine((_data, ctx) => {
+      checks++;
+      ctx.addIssue({ code: "custom", message: "boom" });
+    })
+  );
+  expect(failing.safeParse({ x: "test", a: "hello" })).toMatchObject({
+    success: false,
+    error: { issues: [{ code: "custom", message: "boom" }] },
+  });
+  expect(checks).toBe(2);
+
+  const transformed = z.intersection(
+    z.strictObject({ x: z.string() }).transform((v) => ({ ...v, x: v.x.toUpperCase() })),
+    z.strictObject({ a: z.string() }).transform((v) => ({ ...v, seen: true }))
+  );
+  expect(transformed.parse({ x: "test", a: "hello" })).toEqual({ x: "TEST", a: "hello", seen: true });
+});
+
+test("intersection operands apply defaults, including through a nested intersection", () => {
+  const inner = z.intersection(
+    z.strictObject({ x: z.string().default("X default"), y: z.number() }),
+    z.strictObject({ z: z.boolean() })
+  );
+  const schema = z.intersection(inner, z.strictObject({ a: z.string() }));
+  expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<{ x: string; y: number } & { z: boolean } & { a: string }>();
+
+  expect(schema.parse({ y: 34, z: true, a: "hello" })).toEqual({ x: "X default", y: 34, z: true, a: "hello" });
+});
+
+test("a record operand runs its own refinements inside an intersection", () => {
+  let calls = 0;
+  const schema = z
+    .record(z.enum(["p1", "p2"]), z.string())
+    .superRefine((_data, ctx) => {
+      calls++;
+      ctx.addIssue({ code: "custom", message: "record refined" });
+    })
+    .and(z.strictObject({ name: z.string() }));
+
+  expect(schema.safeParse({ p1: "a", p2: "b", name: "n" })).toMatchObject({
+    success: false,
+    error: { issues: [{ code: "custom", message: "record refined" }] },
+  });
+  expect(calls).toBe(1);
+});
+
+test("a strict object nested under an operand keeps its strictness", () => {
+  const schema = z.intersection(
+    z.object({ inner: z.strictObject({ a: z.string() }) }),
+    z.object({ other: z.string() })
+  );
+
+  expect(schema.parse({ inner: { a: "x" }, other: "y" })).toEqual({ inner: { a: "x" }, other: "y" });
+  expect(schema.safeParse({ inner: { a: "x", extra: 1 }, other: "y" })).toMatchObject({
+    success: false,
+    error: { issues: [{ code: "unrecognized_keys", keys: ["extra"], path: ["inner"] }] },
+  });
+});
+
+test("a strict object composes with a refined object", () => {
+  const A = z.object({ key1: z.boolean() }).strict();
+  const B = z.object({ key2: z.boolean() }).refine(({ key2 }) => key2, "key2 must be true");
+
+  expect(A.and(B).parse({ key1: true, key2: true })).toEqual({ key1: true, key2: true });
+  expect(A.and(B).safeParse({ key1: true, key2: false }).success).toBe(false);
+});

package/node_modules/zod/src/v4/classic/tests/issue-schema.test.ts

@@ -0,0 +1,215 @@
+import { afterEach, expect, test } from "vitest";
+import * as z from "zod/v4";
+
+afterEach(() => {
+  z.config({ customError: undefined });
+});
+
+/** Error maps run on the first read of `error`, so a test that only observes them reads it. */
+const fail = (r: { error?: unknown }) => r.error;
+
+/** Collects the owning schema's registered metadata for every issue an error map sees. */
+function captureMeta(): { seen: (z.core.GlobalMeta | undefined)[] } {
+  const seen: (z.core.GlobalMeta | undefined)[] = [];
+  z.config({
+    customError: (issue) => {
+      seen.push(issue.schema && z.globalRegistry.get(issue.schema));
+      return undefined;
+    },
+  });
+  return { seen };
+}
+
+test("check-originated issues expose the owning schema", () => {
+  const { seen } = captureMeta();
+
+  fail(z.object({ name: z.string().min(5).meta({ title: "Name" }) }).safeParse({ name: "ab" }));
+  fail(z.string().max(2).meta({ title: "Max" }).safeParse("abc"));
+  fail(z.email().meta({ title: "Email" }).safeParse("nope"));
+  fail(z.number().multipleOf(3).meta({ title: "Multiple" }).safeParse(4));
+  fail(z.array(z.string()).min(2).meta({ title: "Array" }).safeParse([]));
+
+  expect(seen).toEqual([
+    { title: "Name" },
+    { title: "Max" },
+    { title: "Email" },
+    { title: "Multiple" },
+    { title: "Array" },
+  ]);
+});
+
+test("schema-originated issues expose the owning schema", () => {
+  const { seen } = captureMeta();
+
+  fail(z.object({ name: z.string().min(5).meta({ title: "Name" }) }).safeParse({ name: 123 }));
+  fail(z.email().meta({ title: "Email" }).safeParse(123));
+
+  expect(seen).toEqual([{ title: "Name" }, { title: "Email" }]);
+});
+
+test("refinements attribute to the refined schema, not the internal check schema", () => {
+  const { seen } = captureMeta();
+
+  fail(
+    z
+      .string()
+      .refine(() => false)
+      .meta({ title: "Refine" })
+      .safeParse("abc")
+  );
+  fail(
+    z
+      .string()
+      .superRefine((_, ctx) => ctx.addIssue({ code: "custom", message: "" }))
+      .meta({ title: "SuperRefine" })
+      .safeParse("abc")
+  );
+
+  expect(seen).toEqual([{ title: "Refine" }, { title: "SuperRefine" }]);
+});
+
+test("the innermost schema owns the issue", () => {
+  const { seen } = captureMeta();
+
+  fail(
+    z
+      .array(z.string().min(5).meta({ title: "Element" }))
+      .meta({ title: "Array" })
+      .safeParse(["ab"])
+  );
+  fail(
+    z
+      .string()
+      .pipe(z.string().min(5).meta({ title: "Target" }))
+      .meta({ title: "Pipe" })
+      .safeParse("ab")
+  );
+  fail(
+    z
+      .looseObject({})
+      .check(z.property("a", z.string().meta({ title: "Property" })))
+      .meta({ title: "Object" })
+      .safeParse({ a: 1 })
+  );
+
+  expect(seen).toEqual([{ title: "Element" }, { title: "Target" }, { title: "Property" }]);
+});
+
+test("issues carrying no usable `inst` still get the owning schema", () => {
+  const { seen } = captureMeta();
+
+  // A hand-pushed issue may carry no inst at all, and ctx.addIssue(string) puts the check's def — not a Zod object — on inst.
+  fail(
+    z
+      .string()
+      .check((payload) => {
+        payload.issues.push({ code: "custom", input: payload.value });
+      })
+      .meta({ title: "Bare" })
+      .safeParse("abc")
+  );
+  const shorthand = z
+    .string()
+    .superRefine((_, ctx) => ctx.addIssue("bad stuff"))
+    .meta({ title: "Shorthand" })
+    .safeParse("abc");
+
+  expect(seen).toEqual([{ title: "Bare" }]);
+  expect(shorthand.error!.issues[0].message).toEqual("bad stuff");
+});
+
+test("async checks expose the owning schema", async () => {
+  const { seen } = captureMeta();
+
+  fail(
+    await z
+      .string()
+      .refine(async () => false)
+      .meta({ title: "Async" })
+      .safeParseAsync("abc")
+  );
+
+  expect(seen).toEqual([{ title: "Async" }]);
+});
+
+test("the owning schema is the clone `.meta()` registered, not the pre-metadata schema", () => {
+  const bare = z.string().min(5);
+  const labeled = bare.meta({ title: "Labeled" });
+  const seen: unknown[] = [];
+  z.config({
+    customError: (issue) => {
+      seen.push(issue.schema === labeled);
+      return undefined;
+    },
+  });
+
+  fail(labeled.safeParse("ab"));
+
+  expect(seen).toEqual([true]);
+});
+
+test("`inst` keeps its meaning and `schema` stays off the finalized issue", () => {
+  const insts: string[] = [];
+  z.config({
+    customError: (issue) => {
+      insts.push(issue.inst!.constructor.name);
+      return undefined;
+    },
+  });
+
+  const tooSmall = z.string().min(5).safeParse("ab").error!;
+  const wrongType = z.string().safeParse(123).error!;
+
+  expect(insts).toEqual(["$ZodCheckMinLength", "ZodString"]);
+  expect(Object.keys(tooSmall.issues[0])).not.toContain("schema");
+  expect(Object.keys(wrongType.issues[0])).not.toContain("schema");
+});
+
+test("every error map kind receives the owning schema", () => {
+  const seen: Record<string, z.core.GlobalMeta | undefined> = {};
+  const capture = (key: string) => (issue: { schema?: z.core.$ZodType | undefined }) => {
+    seen[key] = issue.schema && z.globalRegistry.get(issue.schema);
+    return undefined;
+  };
+
+  fail(
+    z
+      .string()
+      .min(5, { error: capture("check") })
+      .meta({ title: "Check" })
+      .safeParse("ab")
+  );
+
+  // A schema-bound map is only consulted for issues the schema itself raised, so this one needs a type error.
+  fail(
+    z
+      .string({ error: capture("schema") })
+      .meta({ title: "Schema" })
+      .safeParse(123)
+  );
+
+  fail(
+    z
+      .string()
+      .min(5)
+      .meta({ title: "Parse" })
+      .safeParse("ab", { error: capture("parse") })
+  );
+
+  z.config({ customError: capture("customError") });
+  fail(z.string().min(5).meta({ title: "Custom" }).safeParse("ab"));
+
+  // localeError carries the default English locale, so it is restored rather than cleared.
+  const localeError = z.config().localeError;
+  z.config({ customError: undefined, localeError: capture("localeError") });
+  fail(z.string().min(5).meta({ title: "Locale" }).safeParse("ab"));
+  z.config({ localeError });
+
+  expect(seen).toEqual({
+    check: { title: "Check" },
+    schema: { title: "Schema" },
+    parse: { title: "Parse" },
+    customError: { title: "Custom" },
+    localeError: { title: "Locale" },
+  });
+});

package/node_modules/zod/src/v4/classic/tests/jitless-allows-eval.test.ts

@@ -0,0 +1,39 @@
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+import * as core from "zod/v4/core";
+
+const { allowsEval } = core.util;
+
+// Regression test for the CSP feature-probe issue (#4461, #5414):
+// `allowsEval` used to always invoke `new Function("")` even when the
+// user had opted into `z.config({ jitless: true })`, producing a
+// `securitypolicyviolation` report on strict-CSP pages (no 'unsafe-eval')
+// that Chrome DevTools surfaces as an Issue.
+//
+// The fix: when `globalConfig.jitless` is true, `allowsEval.value` returns `false` without triggering the probe. This test lives in its own file because vitest isolates ESM graphs per file, so the cached `allowsEval.value` is fresh and is never accessed before the config mutation below.
+
+test("globalConfig.jitless=true short-circuits the allowsEval probe", () => {
+  // Set BEFORE first access to allowsEval.value — the getter is memoised via `cached()`, so the contract is "configure at app entry".
+  z.config({ jitless: true });
+
+  // Sanity: config is wired
+  expect(core.globalConfig.jitless).toBe(true);
+
+  // Spy: if the probe were still attempted, `new Function("")` would be called. Swap the global `Function` constructor with a throwing stub and verify the stub is NEVER invoked.
+  const origFunction = globalThis.Function;
+  let probeAttempted = false;
+  // @ts-expect-error assigning a stub to the Function global for the test
+  globalThis.Function = function StubFunction(..._args: unknown[]): never {
+    probeAttempted = true;
+    throw new Error("allowsEval probe should have been skipped under jitless=true");
+  };
+
+  try {
+    expect(allowsEval.value).toBe(false);
+    expect(probeAttempted).toBe(false);
+  } finally {
+    globalThis.Function = origFunction;
+    // Restore config so other test files in the same worker see default
+    delete core.globalConfig.jitless;
+  }
+});

package/node_modules/zod/src/v4/classic/tests/json.test.ts

@@ -1,7 +1,8 @@
-import { test } from "vitest";
-// import * as z from "zod/v4";
+import { expect, test } from "vitest";
 
-test(() => {});
+test("placeholder test", () => {
+  expect(2).toBe(2);
+});
 // test("overload types", () => {
 //   const schema = z.string().json();
 //   util.assertEqual<typeof schema, z.ZodString>(true);

package/node_modules/zod/src/v4/classic/tests/lazy.test.ts

@@ -42,7 +42,7 @@ test("opt passthrough", () => {
   expect(z.lazy(() => z.string().optional())._zod.optin).toEqual("optional");
   expect(z.lazy(() => z.string().optional())._zod.optout).toEqual("optional");
 
-  expect(z.lazy(() => z.string().default("asdf"))._zod.optin).toEqual("optional");
+  expect(z.lazy(() => z.string().default("asdf"))._zod.optin).toEqual("defaulted");
   expect(z.lazy(() => z.string().default("asdf"))._zod.optout).toEqual(undefined);
 });
 
@@ -225,3 +225,38 @@ test("lazy initialization", () => {
     subcategories: z.lazy(() => categorySchema.array()),
   });
 });
+
+test("derived internals resolve on self-referential lazy", () => {
+  const optional: any = z.lazy(() => optional.optional());
+  const pipe: any = z.lazy(() => z.pipe(z.string(), pipe));
+
+  expect(optional._zod.optin).toEqual("optional");
+  expect(optional._zod.optout).toEqual("optional");
+  expect(pipe._zod.optin).toEqual(undefined);
+  expect(pipe._zod.optout).toEqual(undefined);
+});
+
+test("a cycle-broken internal is not memoized", () => {
+  const lazyRef: any = z.lazy(() => Rec);
+  const Rec: any = z.union([z.string().optional(), lazyRef]);
+
+  // Reading the outer node first resolves `lazyRef`'s own `optin` through the cycle.
+  expect(Rec._zod.optin).toEqual("optional");
+  expect(lazyRef._zod.optin).toEqual("optional");
+  expect(z.object({ x: Rec, y: lazyRef }).safeParse({ x: "a" }).success).toEqual(true);
+});
+
+test("an internal computed without a cycle break is memoized", () => {
+  // `undefined` is the legitimate answer here and still has to cache: these getters are read per parse, so recomputing them is a parse-path cost.
+  const union = z.union([z.string(), z.number()]);
+  expect(union._zod.optin).toEqual(undefined);
+  expect(Object.getOwnPropertyNames(union._zod)).toContain("optin");
+});
+
+// A compute that throws must memoize nothing, or the second read answers undefined for a schema whose internals were never derived.
+test("a throwing lazy internal throws on every read", () => {
+  const schema = z.discriminatedUnion("type", [z.string() as any]) as any;
+  for (let i = 0; i < 3; i++) {
+    expect(() => schema._zod.propValues).toThrow();
+  }
+});

package/node_modules/zod/src/v4/classic/tests/literal.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
@@ -90,3 +90,39 @@ test("readonly", () => {
   const a = ["asdf"] as const;
   z.literal(a);
 });
+
+test("literal pattern", () => {
+  expect(z.literal(1.1)._zod.pattern).toMatchInlineSnapshot(`/\\^\\(1\\\\\\.1\\)\\$/`);
+
+  expect(z.templateLiteral([z.literal(1.1)]).safeParse("1.1")).toMatchInlineSnapshot(`
+    {
+      "data": "1.1",
+      "success": true,
+    }
+  `);
+  expect(z.templateLiteral([z.literal(1.1)]).safeParse("1n1")).toMatchInlineSnapshot(`
+    {
+      "error": [ZodError: [
+      {
+        "code": "invalid_format",
+        "format": "template_literal",
+        "pattern": "^(1\\\\.1)$",
+        "path": [],
+        "message": "Invalid input"
+      }
+    ]],
+      "success": false,
+    }
+  `);
+});
+
+test("empty literal matches nothing", () => {
+  const empty = z.literal([]);
+  expectTypeOf<z.infer<typeof empty>>().toEqualTypeOf<never>();
+  expect(empty.safeParse("").success).toEqual(false);
+  expect(empty.safeParse(undefined).success).toEqual(false);
+  expect(z.templateLiteral(["", empty]).safeParse("").success).toEqual(false);
+  expect(z.toJSONSchema(empty)).toMatchObject({ not: {} });
+
+  expect(z.literal("").safeParse("").success).toEqual(true);
+});

package/node_modules/zod/src/v4/classic/tests/locales_ka.test.ts

@@ -0,0 +1,29 @@
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+
+test("Georgian locale uses 'ველი' instead of 'სტრინგი'", () => {
+  // Save original error map to restore later if needed, though tests are usually isolated or we can reset
+  // const originalErrorMap = z.getErrorMap(); // z.getErrorMap might not exist, but let's assume isolation or just set it
+
+  z.setErrorMap(z.locales.ka().localeError);
+
+  // Test 1: Invalid type (Expected string, received number)
+  const stringSchema = z.string();
+  const numberResult = stringSchema.safeParse(123);
+  expect(numberResult.success).toBe(false);
+  if (!numberResult.success) {
+    // Expected: "არასწორი შეყვანა: მოსალოდნელი ველი, მიღებული რიცხვი"
+    expect(numberResult.error.issues[0].message).toBe("არასწორი შეყვანა: მოსალოდნელი ველი, მიღებული რიცხვი");
+  }
+
+  // Test 2: Invalid base64
+  const base64Schema = z.string().base64();
+  const base64Result = base64Schema.safeParse("not base64!");
+  expect(base64Result.success).toBe(false);
+  if (!base64Result.success) {
+    // Expected: "არასწორი base64-კოდირებული ველი"
+    // "არასწორი ${FormatDictionary[_issue.format] ?? issue.format}"
+    // FormatDictionary['base64'] is "base64-კოდირებული ველი"
+    expect(base64Result.error.issues[0].message).toBe("არასწორი base64-კოდირებული ველი");
+  }
+});

package/node_modules/zod/src/v4/classic/tests/locales_ro.test.ts

@@ -0,0 +1,24 @@
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+
+test("Romanian locale uses 'șir' instead of 'string'", () => {
+  z.setErrorMap(z.locales.ro().localeError);
+
+  // Test 1: Invalid type (Expected string, received number)
+  const stringSchema = z.string();
+  const numberResult = stringSchema.safeParse(123);
+  expect(numberResult.success).toBe(false);
+  if (!numberResult.success) {
+    // Expected: "Intrare invalidă: așteptat șir, primit număr"
+    expect(numberResult.error.issues[0].message).toBe("Intrare invalidă: așteptat șir, primit număr");
+  }
+
+  // Test 2: Invalid base64
+  const base64Schema = z.string().base64();
+  const base64Result = base64Schema.safeParse("not base64!");
+  expect(base64Result.success).toBe(false);
+  if (!base64Result.success) {
+    // Expected: "Format invalid: șir codat base64"
+    expect(base64Result.error.issues[0].message).toBe("Format invalid: șir codat base64");
+  }
+});