@suveren/gateway 0.39.0 → 0.41.0

package/node_modules/zod/src/v4/classic/tests/error.test.ts

@@ -1,7 +1,44 @@
-import { inspect } from "node:util";
-import { expect, test } from "vitest";
+import { inspect, types } from "node:util";
+import v8 from "node:v8";
+import vm from "node:vm";
+import { afterEach, describe, expect, test, vi } from "vitest";
 import * as z from "zod/v4";
 
+// Several tests install a global error map. Resetting on the last line of each leaks it into every later test in the file whenever an assertion above that line fails, which turns one real failure into a cascade.
+afterEach(() => {
+  z.config({ customError: undefined });
+});
+
+function getThrownError(fn: () => unknown): unknown {
+  try {
+    fn();
+  } catch (error) {
+    return error;
+  }
+  throw new Error("Expected function to throw");
+}
+
+async function getRejectedError(fn: () => Promise<unknown>): Promise<unknown> {
+  try {
+    await fn();
+  } catch (error) {
+    return error;
+  }
+  throw new Error("Expected function to reject");
+}
+
+function expectFirstStackFrameAtCallsite(error: unknown): void {
+  expect(error).toBeInstanceOf(Error);
+  const stack = (error as Error).stack;
+  expect(stack).toEqual(expect.any(String));
+
+  const firstFrame = stack!.split("\n").find((line) => line.trim().startsWith("at "));
+  expect(firstFrame).toBeDefined();
+  expect(firstFrame).toContain("error.test.ts");
+  expect(firstFrame).not.toContain("core/parse.ts");
+  expect(firstFrame).not.toContain("classic/schemas.ts");
+}
+
 test("error creation", () => {
   const err1 = new z.ZodError([]);
 
@@ -523,7 +560,7 @@ test("z.config customError ", () => {
   // support overrideErrorMap
 
   z.config({ customError: () => ({ message: "override" }) });
-  const result = stringWithCustomError.min(10).safeParse("tooshort");
+  const result = z.string().min(10).safeParse("tooshort");
   expect(result.success).toBe(false);
   expect(result.error).toMatchInlineSnapshot(`
     [ZodError: [
@@ -538,7 +575,40 @@ test("z.config customError ", () => {
     ]]
   `);
   expect(result.error!.issues[0].message).toEqual("override");
-  z.config({ customError: undefined });
+});
+
+test("bound error map covers issues raised by its own checks", () => {
+  const result = stringWithCustomError.min(10).safeParse("tooshort");
+  expect(result.success).toBe(false);
+  expect(result.error!.issues[0].message).toEqual("bound");
+});
+
+test("a check's own error map beats the schema's", () => {
+  const result = stringWithCustomError.min(10, { error: () => "check" }).safeParse("tooshort");
+  expect(result.success).toBe(false);
+  expect(result.error!.issues[0].message).toEqual("check");
+});
+
+test("the schema's error map beats contextual and global for a check issue", () => {
+  z.config({ customError: () => "global" });
+  const result = stringWithCustomError.min(10).safeParse("tooshort", { error: () => "contextual" });
+  expect(result.success).toBe(false);
+  expect(result.error!.issues[0].message).toEqual("bound");
+});
+
+test("a schema map returning undefined defers to the next rung, and runs once", () => {
+  let calls = 0;
+  const deferring = z.string({
+    error: () => {
+      calls++;
+      return undefined;
+    },
+  });
+  z.config({ customError: () => "global" });
+  const result = deferring.min(10).safeParse("tooshort");
+  expect(result.success).toBe(false);
+  expect(result.error!.issues[0].message).toEqual("global");
+  expect(calls).toEqual(1);
 });
 
 // test("invalid and required", () => {
@@ -671,7 +741,7 @@ test("error inheritance", () => {
   expect(e1).toBeInstanceOf(z.core.$ZodError);
   expect(e1).toBeInstanceOf(z.ZodError);
   expect(e1).toBeInstanceOf(z.ZodRealError);
-  // expect(e1).not.toBeInstanceOf(Error);
+  expect(e1).toBeInstanceOf(Error);
 
   try {
     z.string().parse(123);
@@ -679,10 +749,63 @@ test("error inheritance", () => {
     expect(e1).toBeInstanceOf(z.core.$ZodError);
     expect(e2).toBeInstanceOf(z.ZodError);
     expect(e2).toBeInstanceOf(z.ZodRealError);
-    // expect(e2).toBeInstanceOf(Error);
+    expect(e2).toBeInstanceOf(Error);
   }
 });
 
+test("parse errors capture the caller stack frame", async () => {
+  const schema = z.string();
+  const parse = schema.parse;
+  const parseAsync = schema.parseAsync;
+
+  expectFirstStackFrameAtCallsite(getThrownError(() => schema.parse(123)));
+  expectFirstStackFrameAtCallsite(getThrownError(() => parse(123)));
+  expectFirstStackFrameAtCallsite(getThrownError(() => z.parse(schema, 123)));
+
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => schema.parseAsync(123)));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => parseAsync(123)));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => z.parseAsync(schema, 123)));
+});
+
+test("codec errors capture the caller stack frame", async () => {
+  const schema = z.string();
+  const encode = schema.encode;
+  const decode = schema.decode;
+  const encodeAsync = schema.encodeAsync;
+  const decodeAsync = schema.decodeAsync;
+
+  expectFirstStackFrameAtCallsite(getThrownError(() => schema.encode(123 as any)));
+  expectFirstStackFrameAtCallsite(getThrownError(() => encode(123 as any)));
+  expectFirstStackFrameAtCallsite(getThrownError(() => z.encode(schema, 123 as any)));
+
+  expectFirstStackFrameAtCallsite(getThrownError(() => schema.decode(123 as any)));
+  expectFirstStackFrameAtCallsite(getThrownError(() => decode(123 as any)));
+  expectFirstStackFrameAtCallsite(getThrownError(() => z.decode(schema, 123 as any)));
+
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => schema.encodeAsync(123 as any)));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => encodeAsync(123 as any)));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => z.encodeAsync(schema, 123 as any)));
+
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => schema.decodeAsync(123 as any)));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => decodeAsync(123 as any)));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => z.decodeAsync(schema, 123 as any)));
+});
+
+test("async errors that fail after suspending capture the caller stack frame", async () => {
+  // `Error.captureStackTrace` is skip-until-seen: when it cannot find its callee it discards every frame, not just the ones above. An async wrapper that returns its inner promise without awaiting has already left the async chain by the time the rejection is built, so its callee is unfindable and the stack comes back empty. Only a schema that actually suspends reaches that path — the sync cases above run straight through to their first await and pass either way.
+  const refined = z.string().refine(async () => false, "nope");
+  const codec = z.codec(z.string(), z.number(), {
+    decode: async (value) => value as never,
+    encode: async (value) => value as never,
+  });
+
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => refined.parseAsync("x")));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => codec.decodeAsync("x")));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => z.decodeAsync(codec, "x")));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => codec.encodeAsync(5)));
+  expectFirstStackFrameAtCallsite(await getRejectedError(() => z.encodeAsync(codec, 5)));
+});
+
 test("error serialization", () => {
   try {
     z.string().parse(123);
@@ -709,3 +832,277 @@ test("error serialization", () => {
     `);
   }
 });
+
+test("message is lazy but stays own and enumerable", () => {
+  const err = z.object({ a: z.string() }).safeParse({ a: 1 }).error!;
+
+  expect(Object.keys(err)).toEqual(["name", "message"]);
+  expect(Object.keys({ ...err })).toEqual(["name", "message"]);
+  expect(JSON.parse(JSON.stringify(err)).message).toEqual(err.message);
+  expect(Object.getOwnPropertyDescriptor(err, "message")!.enumerable).toBe(true);
+  expect(Object.getOwnPropertyDescriptor(err, "issues")!.enumerable).toBe(false);
+
+  // computed once, then stable against later mutation of `.issues`
+  const computed = err.message;
+  err.issues.push({ code: "custom", message: "later", path: [], input: undefined });
+  expect(err.message).toEqual(computed);
+
+  // assignment wins over the computed value, and `toString` follows it
+  err.message = "overwritten";
+  expect(err.message).toEqual("overwritten");
+  expect(err.toString()).toEqual("overwritten");
+
+  // a second error computes its own message
+  expect(z.string().safeParse(1).error!.message).not.toEqual(computed);
+});
+
+test("error helpers survive detaching", () => {
+  const err = z.object({ a: z.string() }).safeParse({ a: 1 }).error!;
+  const { format, flatten } = err;
+  const stringify = err.toString;
+
+  expect(format().a?._errors).toEqual(["Invalid input: expected string, received number"]);
+  expect(flatten().fieldErrors.a).toEqual(["Invalid input: expected string, received number"]);
+  expect(stringify()).toEqual(err.message);
+  expect(err.isEmpty).toBe(false);
+  expect(new z.ZodError([]).isEmpty).toBe(true);
+
+  // addIssue refreshes a message that was already materialized
+  const empty = new z.ZodError([]);
+  expect(empty.message).toEqual("[]");
+  empty.addIssue({ code: "custom", message: "added", path: [], input: undefined });
+  expect(empty.message).toContain("added");
+});
+
+test("an error is a real Error, minus the captured frames", () => {
+  const err = z.string().safeParse(123).error!;
+
+  // suppressing the capture, not skipping the constructor, keeps every brand check working
+  expect(err).toBeInstanceOf(Error);
+  expect(types.isNativeError(err)).toBe(true);
+  expect(Object.prototype.toString.call(err)).toBe("[object Error]");
+  expect(structuredClone(err)).toBeInstanceOf(Error);
+
+  // only a returned error loses its frames; the throwing paths restore them
+  expect(err.stack!.startsWith("ZodError: [")).toBe(true);
+  expect(err.stack!).toContain("invalid_type");
+  expect(err.stack!.split("\n").some((line) => line.trim().startsWith("at "))).toBe(false);
+
+  // the borrowed global is given back unchanged, including a caller's own value
+  const ambient = Error.stackTraceLimit;
+  z.string().safeParse(123);
+  expect(Error.stackTraceLimit).toBe(ambient);
+  Error.stackTraceLimit = ambient + 3;
+  try {
+    z.string().safeParse(123);
+    expect(Error.stackTraceLimit).toBe(ambient + 3);
+  } finally {
+    Error.stackTraceLimit = ambient;
+  }
+});
+
+test("an engine without captureStackTrace keeps the frames on a thrown error", async () => {
+  // suppressing the capture is only safe where `parse()` can put the frames back; Safari 11.1 through 17.1 has `stackTraceLimit` but not `captureStackTrace`, and suppressing there would strip the throw's stack
+  const desc = Object.getOwnPropertyDescriptor(Error, "captureStackTrace")!;
+  vi.resetModules();
+  delete (Error as { captureStackTrace?: unknown }).captureStackTrace;
+
+  let thrown: unknown;
+  try {
+    const fresh = await import("zod/v4");
+    function callSite() {
+      fresh.string().parse(1);
+    }
+    try {
+      callSite();
+    } catch (err) {
+      thrown = err;
+    }
+  } finally {
+    Object.defineProperty(Error, "captureStackTrace", desc);
+  }
+
+  expect(thrown).toBeInstanceOf(Error);
+  expect((thrown as Error).stack).toContain("callSite");
+});
+
+test("a realm that hardens Error after import degrades instead of throwing", async () => {
+  // lockdown() runs after zod's module graph evaluates, so the latch fires in a throwaway instance rather than the one this file uses
+  vi.resetModules();
+  const fresh = await import("zod/v4");
+  const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit")!;
+  Object.defineProperty(Error, "stackTraceLimit", { value: 10, writable: false, configurable: true });
+
+  try {
+    for (const err of [fresh.string().safeParse(1).error!, fresh.string().safeParse(2).error!]) {
+      expect(err).toBeInstanceOf(Error);
+      expect(err.issues).toHaveLength(1);
+    }
+    expect(Error.stackTraceLimit).toBe(10);
+  } finally {
+    Object.defineProperty(Error, "stackTraceLimit", desc);
+  }
+});
+
+test("an engine with no stackTraceLimit is never written to", () => {
+  // off v8 the property is absent and SES deletes it before hardening; an accessor makes the write observable where a data property would not
+  const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit")!;
+  let writes = 0;
+  Object.defineProperty(Error, "stackTraceLimit", {
+    get: () => undefined,
+    set: () => {
+      writes++;
+    },
+    configurable: true,
+  });
+
+  try {
+    const err = z.string().safeParse(123).error!;
+    expect(err).toBeInstanceOf(z.ZodError);
+    expect(types.isNativeError(err)).toBe(true);
+    expect(err.issues).toHaveLength(1);
+    expect(writes).toBe(0);
+  } finally {
+    Object.defineProperty(Error, "stackTraceLimit", desc);
+  }
+});
+
+test("error initializer never installs onto an intrinsic prototype", () => {
+  // `init` accepts any object; a foreign one must not leak accessors onto the prototype it happens to inherit from.
+  z.core.$ZodError.init({} as any, []);
+  z.ZodError.init({} as any, []);
+  z.core.$ZodError.init(new Error() as any, []);
+
+  expect(Object.getOwnPropertyDescriptor(Object.prototype, "toString")!.get).toBeUndefined();
+  expect(Object.getOwnPropertyDescriptor(Error.prototype, "toString")!.get).toBeUndefined();
+  expect(Object.getOwnPropertyNames(Object.prototype)).not.toContain("format");
+  expect({}.toString()).toEqual("[object Object]");
+  expect(String(new Error("boom"))).toEqual("Error: boom");
+});
+
+describe("safeParse builds the error on first read", () => {
+  class CountingError {
+    static constructed = 0;
+    constructor(public issues: unknown[]) {
+      CountingError.constructed++;
+    }
+  }
+
+  test("constructs once, on read", () => {
+    CountingError.constructed = 0;
+    const result = z.core._safeParse(CountingError as any)(z.string(), 1) as any;
+    expect(result.success).toBe(false);
+    expect(CountingError.constructed).toBe(0);
+    const err = result.error;
+    expect(CountingError.constructed).toBe(1);
+    expect(result.error).toBe(err);
+    expect(CountingError.constructed).toBe(1);
+    expect(err.issues[0].code).toBe("invalid_type");
+  });
+
+  test("async variant", async () => {
+    CountingError.constructed = 0;
+    const result = (await z.core._safeParseAsync(CountingError as any)(z.string(), 1)) as any;
+    expect(CountingError.constructed).toBe(0);
+    expect(result.error).toBeInstanceOf(CountingError);
+    expect(CountingError.constructed).toBe(1);
+  });
+
+  test("result stays plain data", () => {
+    const result = z.string().safeParse(1);
+    expect(Object.keys(result)).toEqual(["success", "error"]);
+    expect(result).toEqual({ success: false, error: expect.any(z.ZodError) });
+    expect(structuredClone(result).error).toBeInstanceOf(Error);
+    const replaced = new z.ZodError([]);
+    (result as any).error = replaced;
+    expect(result.error).toBe(replaced);
+  });
+
+  test("reading the error releases the parsed input", async () => {
+    // es2020 is the target, and its lib predates WeakRef
+    type Weak<T extends object> = { deref(): T | undefined };
+    const { WeakRef: Weak } = globalThis as unknown as { WeakRef: new <T extends object>(target: T) => Weak<T> };
+    // vitest carries no --expose-gc, so reach the collector the way node's own tests do
+    v8.setFlagsFromString("--expose-gc");
+    const gc = vm.runInNewContext("gc") as () => void;
+
+    const schema = z.string();
+    const refs: Weak<object>[] = [];
+    const results: unknown[] = [];
+    for (let i = 0; i < 50; i++) {
+      const input = { i, blob: new Array(500).fill(i) };
+      refs.push(new Weak(input));
+      const result = schema.safeParse(input);
+      // half read the error, half replace it without ever reading; both have to release
+      if (i % 2) void result.error;
+      else (result as { error: z.core.$ZodError }).error = new z.ZodError([]);
+      results.push(result);
+    }
+    // the collector decides when it runs, so give it several passes; a retained input never clears no matter how many it gets
+    const live = () => refs.filter((ref) => ref.deref() !== undefined).length;
+    for (let attempt = 0; attempt < 10 && live() > 1; attempt++) {
+      // the loop's last input stays on the stack until a macrotask boundary
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      gc();
+    }
+    expect(live()).toBeLessThanOrEqual(1);
+    expect(results).toHaveLength(50);
+  });
+
+  test("no reader frames leak into the error, however late it is read", async () => {
+    const result = z.string().safeParse(12) as { error: z.core.$ZodError };
+
+    // the constructor runs at THIS read: a macrotask later and twenty frames deeper than the parse
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    const readDeep = <T>(n: number, make: () => T): T => (n ? readDeep(n - 1, make) : make());
+    const error = readDeep(20, () => result.error) as unknown as Error;
+
+    // control: a plain Error at that same depth does carry the frames, so the assertions below discriminate rather than pass vacuously
+    const control = readDeep(20, () => new Error("control"));
+    expect(control.stack!.split("\n").some((line) => line.trim().startsWith("at "))).toBe(true);
+    expect(control.stack!).toContain("readDeep");
+
+    expect(error.stack!.startsWith("ZodError: [")).toBe(true);
+    expect(error.stack!.split("\n").some((line) => line.trim().startsWith("at "))).toBe(false);
+    expect(error.stack!).not.toContain("readDeep");
+  });
+
+  test("a lazy build gives back the caller's stackTraceLimit, not the parse-time one", () => {
+    const result = z.string().safeParse(12) as { error: z.core.$ZodError };
+    const ambient = Error.stackTraceLimit;
+    // changed between the parse and the read, so restoring a value captured at parse time would clobber it
+    Error.stackTraceLimit = ambient + 7;
+    try {
+      void result.error;
+      expect(Error.stackTraceLimit).toBe(ambient + 7);
+    } finally {
+      Error.stackTraceLimit = ambient;
+    }
+  });
+});
+
+test("a finalized issue copies the raw issue's own keys only", () => {
+  const proto = { inherited: true };
+  const schema = z.string().check((ctx) => {
+    const raw = Object.create(proto);
+    Object.assign(raw, { code: "custom", message: "own", input: ctx.value, extra: 1 });
+    ctx.issues.push(raw);
+  });
+  const issue = schema.safeParse("x").error!.issues[0];
+  expect(issue).toStrictEqual({ code: "custom", message: "own", path: [], extra: 1 });
+  expect("inherited" in issue).toBe(false);
+  // own symbol-keyed fields are not copied either; nothing in zod produces one and the walk stays a string-key walk
+  const sym = Symbol("meta");
+  const symbolic = z.string().check((ctx) => {
+    ctx.issues.push({ code: "custom", message: "sym", input: ctx.value, [sym]: 1 } as never);
+  });
+  expect(Object.getOwnPropertySymbols(symbolic.safeParse("x").error!.issues[0])).toEqual([]);
+  // an own __proto__ key, as JSON.parse produces, neither swaps the prototype nor survives
+  const parsed = z.string().check((ctx) => {
+    ctx.issues.push(JSON.parse('{"code":"custom","message":"json","__proto__":{"polluted":true}}'));
+  });
+  const fromJson = parsed.safeParse("x").error!.issues[0];
+  expect(Object.getPrototypeOf(fromJson)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(fromJson, "__proto__")).toBe(false);
+  expect("polluted" in fromJson).toBe(false);
+});

package/node_modules/zod/src/v4/classic/tests/file.test.ts

@@ -1,7 +1,6 @@
-// @ts-ignore
 import { File as WebFile } from "@web-std/file";
 
-import { afterEach, beforeEach, expect, test } from "vitest";
+import { afterEach, beforeEach, expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
@@ -27,6 +26,10 @@ test("passing validations", () => {
   expect(() => mimeCheck.parse(new File([""], "test.txt", { type: "text/csv" }))).toThrow();
 });
 
+test("types", () => {
+  expectTypeOf(z.file().parse(new File([], "test.txt"))).toEqualTypeOf(new File([], "test.txt"));
+});
+
 test("failing validations", () => {
   expect(minCheck.safeParse(new File(["1234"], "test.txt"))).toMatchInlineSnapshot(`
     {
@@ -35,8 +38,9 @@ test("failing validations", () => {
         "origin": "file",
         "code": "too_small",
         "minimum": 5,
+        "inclusive": true,
         "path": [],
-        "message": "Too small: expected file to have >5 bytes"
+        "message": "Too small: expected file to have >=5 bytes"
       }
     ]],
       "success": false,
@@ -49,8 +53,9 @@ test("failing validations", () => {
         "origin": "file",
         "code": "too_big",
         "maximum": 8,
+        "inclusive": true,
         "path": [],
-        "message": "Too big: expected file to have <8 bytes"
+        "message": "Too big: expected file to have <=8 bytes"
       }
     ]],
       "success": false,

package/node_modules/zod/src/v4/classic/tests/firstparty.test.ts

@@ -82,6 +82,8 @@ test("first party switch", () => {
       break;
     case "lazy":
       break;
+    case "function":
+      break;
     default:
       expectTypeOf(def).toEqualTypeOf<never>();
   }
@@ -168,6 +170,8 @@ test("$ZodSchemaTypes", () => {
       break;
     case "lazy":
       break;
+    case "function":
+      break;
 
     default:
       expectTypeOf(type).toEqualTypeOf<never>();

package/node_modules/zod/src/v4/classic/tests/fix-json-issue.test.ts

@@ -0,0 +1,26 @@
+import { expect, test } from "vitest";
+import { type infer as _infer, json, nullable, object, pipe, transform } from "../../mini/index.js";
+// biome-ignore lint/correctness/noUnusedImports: This import verifies the type is exported
+import type { _ZodMiniJSONSchema } from "../../mini/schemas.js";
+
+const DataType = object({
+  data: json(),
+});
+type DataType = _infer<typeof DataType>;
+
+// biome-ignore lint/suspicious/noExportsInTest: This export is required to reproduce TS4023
+export const Container = object({
+  contained: pipe(
+    nullable(DataType),
+    transform<DataType | null>(
+      (v) =>
+        v ?? {
+          data: "",
+        }
+    )
+  ),
+});
+
+test("issue reproduction should compile without type errors", () => {
+  expect(Container).toBeDefined();
+});