@suveren/gateway 0.39.0 → 0.40.0

package/node_modules/zod/src/v4/classic/tests/recursive-types.test.ts

@@ -1,6 +1,51 @@
 import { expect, expectTypeOf, test } from "vitest";
 import { z } from "zod/v4";
 
+test("recursive object schema type aliases", () => {
+  type ObjectField = z.ZodObject<{ [k: string]: ObjectField }>;
+  type MixedField = z.ZodString | z.ZodObject<{ [k: string]: MixedField }>;
+  expectTypeOf<ObjectField>().toExtend<z.ZodType>();
+  expectTypeOf<MixedField>().toExtend<z.ZodType>();
+
+  type ObjectValue = { [k: string]: ObjectValue };
+  type MixedValue = string | { [k: string]: MixedValue };
+  expectTypeOf<z.input<ObjectField>>().toEqualTypeOf<ObjectValue>();
+  expectTypeOf<z.output<ObjectField>>().toEqualTypeOf<ObjectValue>();
+  expectTypeOf<z.input<MixedField>>().toEqualTypeOf<MixedValue>();
+  expectTypeOf<z.output<MixedField>>().toEqualTypeOf<MixedValue>();
+
+  const schema: MixedField = z.object({ name: z.string(), nested: z.object({ name: z.string() }) });
+  expect(schema.parse({ name: "a", nested: { name: "b", extra: true } })).toEqual({
+    name: "a",
+    nested: { name: "b" },
+  });
+  expect(schema.safeParse({ name: "a", nested: { name: 123 } }).success).toBe(false);
+
+  type CoreField = z.core.$ZodString<string> | z.core.$ZodObject<{ [k: string]: CoreField }>;
+  expectTypeOf<z.input<CoreField>>().toEqualTypeOf<MixedValue>();
+  expectTypeOf<z.output<CoreField>>().toEqualTypeOf<MixedValue>();
+});
+
+test("recursive object aliases preserve distinct input and output", () => {
+  type Field = z.ZodPipe<z.ZodString, z.ZodTransform<number, string>> | z.ZodObject<{ [k: string]: Field }>;
+  type Input = string | { [k: string]: Input };
+  type Output = number | { [k: string]: Output };
+  expectTypeOf<z.input<Field>>().toEqualTypeOf<Input>();
+  expectTypeOf<z.output<Field>>().toEqualTypeOf<Output>();
+  const schema: Field = z.object({ nested: z.object({ length: z.string().transform((s) => s.length) }) });
+  expect(schema.parse({ nested: { length: "abc" } })).toEqual({ nested: { length: 3 } });
+  expect(schema.safeParse({ nested: { length: 3 } }).success).toBe(false);
+});
+
+test("indexed object inference preserves string keys", () => {
+  type Indexed = z.ZodObject<Record<string, z.ZodString>>;
+  type Recursive = z.ZodObject<Record<string, Recursive>>;
+  expectTypeOf<keyof z.input<Indexed>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.output<Indexed>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.input<Recursive>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.output<Recursive>>().toEqualTypeOf<string>();
+});
+
 test("recursion with z.lazy", () => {
   const data = {
     name: "I",
@@ -135,6 +180,10 @@ test("pick and omit with getter", () => {
   }
   expectTypeOf<Category>().toEqualTypeOf<_Category>();
 
+  // Shape should not surface `readonly` modifiers from getter-defined keys. object/strictObject/looseObject all pass shape through util.Writeable<T>.
+  type Shape = (typeof Category)["shape"];
+  expectTypeOf<Shape>().toEqualTypeOf<{ name: z.ZodString; subcategories: z.ZodArray<typeof Category> }>();
+
   const PickedCategory = Category.pick({ name: true });
   const OmittedCategory = Category.omit({ subcategories: true });
 
@@ -148,6 +197,50 @@ test("pick and omit with getter", () => {
   expect(() => OmittedCategory.parse({ name: "test", subcategories: [] })).toThrow();
 });
 
+test("shape stays writeable through extend/safeExtend/partial/required", () => {
+  const Base = z.object({ name: z.string() });
+
+  const Extended = Base.extend({
+    get sub() {
+      return z.array(Extended);
+    },
+  });
+  type ExtendedShape = (typeof Extended)["shape"];
+  expectTypeOf<ExtendedShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    sub: z.ZodArray<typeof Extended>;
+  }>();
+
+  const SafeExt = Base.safeExtend({ extra: z.string() } as const);
+  type SafeExtShape = (typeof SafeExt)["shape"];
+  expectTypeOf<SafeExtShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    extra: z.ZodString;
+  }>();
+
+  const FromConst = Base.extend({ a: z.string(), b: z.number() } as const);
+  type FromConstShape = (typeof FromConst)["shape"];
+  expectTypeOf<FromConstShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    a: z.ZodString;
+    b: z.ZodNumber;
+  }>();
+
+  const PartialExtended = Extended.partial();
+  type PartialShape = (typeof PartialExtended)["shape"];
+  expectTypeOf<PartialShape>().toEqualTypeOf<{
+    name: z.ZodOptional<z.ZodString>;
+    sub: z.ZodOptional<z.ZodArray<typeof Extended>>;
+  }>();
+
+  const RequiredExtended = Extended.required();
+  type RequiredShape = (typeof RequiredExtended)["shape"];
+  expectTypeOf<RequiredShape>().toEqualTypeOf<{
+    name: z.ZodNonOptional<z.ZodString>;
+    sub: z.ZodNonOptional<z.ZodArray<typeof Extended>>;
+  }>();
+});
+
 test("deferred self-recursion", () => {
   const Feature = z.object({
     title: z.string(),
@@ -260,6 +353,127 @@ test("mutual recursion with meta", () => {
   expectTypeOf<B>().toEqualTypeOf<_B>();
 });
 
+test("intersection with recursive types", () => {
+  const A = z.discriminatedUnion("type", [
+    z.object({
+      type: z.literal("CONTAINER"),
+    }),
+    z.object({
+      type: z.literal("SCREEN"),
+      config: z.object({ x: z.number(), y: z.number() }),
+    }),
+  ]);
+  // type A = z.infer<typeof A>;
+
+  const B = z.object({
+    get children() {
+      return z.array(C).optional();
+    },
+  });
+  // type B = z.infer<typeof B>;
+
+  const C = z.intersection(A, B);
+  type C = z.infer<typeof C>;
+
+  type _C = (
+    | {
+        type: "CONTAINER";
+      }
+    | {
+        type: "SCREEN";
+        config: {
+          x: number;
+          y: number;
+        };
+      }
+  ) & {
+    children?: _C[] | undefined;
+  };
+  expectTypeOf<C>().toEqualTypeOf<_C>();
+});
+
+test("object utilities with recursive types", () => {
+  const NodeBase = z.object({
+    id: z.string(),
+    name: z.string(),
+    get children() {
+      return z.array(Node).optional();
+    },
+  });
+
+  // Test extend with new keys (extend throws when overwriting existing keys)
+  const NodeOne = NodeBase.extend({
+    name: z.literal("nodeOne"),
+    get children() {
+      return z.array(Node);
+    },
+  });
+
+  const NodeTwo = NodeBase.extend({
+    name: z.literal("nodeTwo"),
+    get children() {
+      return z.array(Node);
+    },
+  });
+
+  // Test pick
+  const PickedNode = NodeBase.pick({ id: true, name: true });
+
+  // Test omit
+  const OmittedNode = NodeBase.omit({ children: true });
+
+  // Test merge
+  const ExtraProps = {
+    metadata: z.string(),
+    get parent() {
+      return Node.optional();
+    },
+  };
+  const MergedNode = NodeBase.extend(ExtraProps);
+
+  // Test partial
+  const PartialNode = NodeBase.partial();
+  const PartialMaskedNode = NodeBase.partial({ name: true });
+
+  // Test required (assuming NodeBase has optional fields)
+  const OptionalNodeBase = z.object({
+    id: z.string().optional(),
+    name: z.string().optional(),
+    get children() {
+      return z.array(Node).optional();
+    },
+  });
+  const RequiredNode = OptionalNodeBase.required();
+  const RequiredMaskedNode = OptionalNodeBase.required({ id: true });
+
+  const Node = z.union([
+    NodeOne,
+    NodeTwo,
+    PickedNode,
+    OmittedNode,
+    MergedNode,
+    PartialNode,
+    PartialMaskedNode,
+    RequiredNode,
+    RequiredMaskedNode,
+  ]);
+});
+
+test("tuple with recursive types", () => {
+  const TaskListNodeSchema = z.strictObject({
+    type: z.literal("taskList"),
+    get content() {
+      return z.array(z.tuple([TaskListNodeSchema, z.union([TaskListNodeSchema])])).min(1);
+    },
+  });
+  type TaskListNodeSchema = z.infer<typeof TaskListNodeSchema>;
+  type _TaskListNodeSchema = {
+    type: "taskList";
+    content: [_TaskListNodeSchema, _TaskListNodeSchema][];
+  };
+  expectTypeOf<TaskListNodeSchema>().toEqualTypeOf<_TaskListNodeSchema>();
+});
+
 test("recursion compatibility", () => {
   // array
   const A = z.object({
@@ -325,7 +539,69 @@ test("recursion compatibility", () => {
   });
 });
 
-// biome-ignore lint: sadf
+test("recursive object with .check()", () => {
+  const Category = z
+    .object({
+      id: z.string(),
+      name: z.string(),
+      get subcategories() {
+        return z.array(Category).optional();
+      },
+    })
+    .check((ctx) => {
+      // Check for duplicate IDs among direct subcategories
+      if (ctx.value.subcategories) {
+        const siblingIds = new Set<string>();
+        ctx.value.subcategories.forEach((sub, index) => {
+          if (siblingIds.has(sub.id)) {
+            ctx.issues.push({
+              code: "custom",
+              message: `Duplicate sibling ID found: ${sub.id}`,
+              path: ["subcategories", index, "id"],
+              input: ctx.value,
+            });
+          }
+          siblingIds.add(sub.id);
+        });
+      }
+    });
+
+  // Valid - siblings have unique IDs
+  const validData = {
+    id: "electronics",
+    name: "Electronics",
+    subcategories: [
+      {
+        id: "computers",
+        name: "Computers",
+        subcategories: [
+          { id: "laptops", name: "Laptops" },
+          { id: "desktops", name: "Desktops" },
+        ],
+      },
+      {
+        id: "phones",
+        name: "Phones",
+      },
+    ],
+  };
+
+  // Invalid - duplicate sibling IDs
+  const invalidData = {
+    id: "electronics",
+    name: "Electronics",
+    subcategories: [
+      { id: "computers", name: "Computers" },
+      { id: "phones", name: "Phones" },
+      { id: "computers", name: "Computers Again" }, // Duplicate at index 2
+    ],
+  };
+
+  expect(() => Category.parse(validData)).not.toThrow();
+  expect(() => Category.parse(invalidData)).toThrow();
+});
+
+// biome-ignore lint/suspicious/noExportsInTest: unexported it trips noUnusedVariables instead
 export type RecursiveA = z.ZodUnion<
   [
     z.ZodObject<{
@@ -354,3 +630,78 @@ export type RecursiveA = z.ZodUnion<
     }>,
   ]
 >;
+
+test("recursive type with `id` meta", () => {
+  const AType = z.object({
+    type: z.literal("a"),
+    name: z.string(),
+  });
+
+  const BType = z.object({
+    type: z.literal("b"),
+    name: z.string(),
+  });
+
+  const CType = z.object({
+    type: z.literal("c"),
+    name: z.string(),
+  });
+
+  const Schema = z.object({
+    type: z.literal("special").meta({ description: "Type" }),
+    config: z.object({
+      title: z.string().meta({ description: "Title" }),
+      get elements() {
+        return z.array(z.discriminatedUnion("type", [AType, BType, CType])).meta({
+          id: "SpecialElements",
+          title: "SpecialElements",
+          description: "Array of elements",
+        });
+      },
+    }),
+  });
+
+  Schema.parse({
+    type: "special",
+    config: {
+      title: "Special",
+      elements: [
+        { type: "a", name: "John" },
+        { type: "b", name: "Jane" },
+        { type: "c", name: "Jim" },
+      ],
+    },
+  });
+});
+
+test("mutual recursion through discriminatedUnion getter", () => {
+  const variantA = z.object({
+    kind: z.literal("a"),
+    get child() {
+      return tree.optional();
+    },
+  });
+
+  const variantB = z.object({
+    kind: z.literal("b"),
+    get sibling() {
+      return tree.optional();
+    },
+  });
+
+  const tree = z.discriminatedUnion("kind", [variantA, variantB]);
+
+  type _Tree = { kind: "a"; child?: _Tree | undefined } | { kind: "b"; sibling?: _Tree | undefined };
+
+  const treeUnion = z.union([variantA, variantB]);
+
+  expectTypeOf<z.input<typeof tree>>().toEqualTypeOf<_Tree>();
+  expectTypeOf<z.input<typeof tree>>().not.toBeAny();
+  expectTypeOf<z.input<typeof tree>>().toEqualTypeOf<z.input<typeof treeUnion>>();
+
+  expect(tree.parse({ kind: "a", child: { kind: "b", sibling: { kind: "a" } } })).toEqual({
+    kind: "a",
+    child: { kind: "b", sibling: { kind: "a" } },
+  });
+  expect(() => tree.parse({ kind: "c" })).toThrow();
+});

package/node_modules/zod/src/v4/classic/tests/redos.test.ts

@@ -0,0 +1,68 @@
+import { checkSync } from "recheck";
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+
+const { regexes } = z.core;
+
+/** Every pattern `core/regexes.ts` ships, with the parameterized ones materialized across their argument space. */
+function allPatterns(): [string, RegExp][] {
+  const patterns: [string, RegExp][] = [];
+  for (const [name, value] of Object.entries(regexes)) {
+    if (value instanceof RegExp) patterns.push([name, value]);
+  }
+
+  patterns.push(
+    ["emoji()", regexes.emoji()],
+    ["mac()", regexes.mac()],
+    ["mac('-')", regexes.mac("-")],
+    ["uuid()", regexes.uuid()],
+    ["string()", regexes.string()],
+    ["string({min,max})", regexes.string({ minimum: 1, maximum: 10 })]
+  );
+  for (const version of [1, 2, 3, 4, 5, 6, 7, 8]) patterns.push([`uuid(${version})`, regexes.uuid(version)]);
+  for (const precision of [null, -1, 0, 3, 6]) {
+    patterns.push([`time(${precision})`, regexes.time({ precision })]);
+    for (const local of [false, true]) {
+      for (const offset of [false, true]) {
+        patterns.push([`datetime(${precision},${local},${offset})`, regexes.datetime({ precision, local, offset })]);
+      }
+    }
+  }
+  return patterns;
+}
+
+test("no built-in pattern is ReDoS-vulnerable", () => {
+  const patterns = allPatterns();
+  // Guards against the reflection above silently going empty if the module layout changes.
+  expect(patterns.length).toBeGreaterThan(80);
+
+  const vulnerable: string[] = [];
+  for (const [name, pattern] of patterns) {
+    // Flags are load-bearing. Without "u" the checker reads `\p{...}` as a literal `p{...}` and reports an exponential pattern as safe.
+    const result = checkSync(pattern.source, pattern.flags);
+    // "unknown" means the checker gave up, not that the pattern is vulnerable.
+    if (result.status !== "vulnerable") continue;
+    // The fuzz checker derives "vulnerable" from how long an attack string runs, so CPU contention from parallel test files can flip a safe pattern. Confirm with a budget large enough that only real backtracking can exhaust it.
+    const confirmed = checkSync(pattern.source, pattern.flags, { attackTimeout: 10_000 });
+    if (confirmed.status === "vulnerable") vulnerable.push(`${name}: ${pattern.source}`);
+  }
+  expect(vulnerable).toEqual([]);
+}, 60000);
+
+test("emoji rejects a backtracking payload in linear time", () => {
+  // U+1F9B0-U+1F9B3 are the only code points in both \p{Extended_Pictographic} and \p{Emoji_Component}. A failing match over them used to backtrack exponentially: 26 of them took ~1.9s, and each additional character roughly doubled it.
+  const schema = z.emoji();
+  const payload = `${"🦰".repeat(26)} `;
+
+  // Warm up first, then take the best of three: a cold first call is dominated by JIT and can cost hundreds of times the steady-state match on a loaded machine.
+  expect(schema.safeParse(payload).success).toBe(false);
+  let best = Number.POSITIVE_INFINITY;
+  for (let i = 0; i < 3; i++) {
+    const start = performance.now();
+    schema.safeParse(payload);
+    best = Math.min(best, performance.now() - start);
+  }
+
+  // The linear pattern matches in well under a millisecond, so this budget leaves three orders of magnitude of headroom for CPU contention while still catching the exponential regression.
+  expect(best).toBeLessThan(500);
+});