@suveren/gateway 0.39.0 → 0.41.0

package/node_modules/zod/src/v4/classic/tests/index.test.ts

@@ -247,7 +247,7 @@ test("z.tuple", () => {
   const b = z.tuple([z.string(), z.number(), z.optional(z.string())], z.boolean());
   type b = z.output<typeof b>;
 
-  expectTypeOf<b>().toEqualTypeOf<[string, number, string?, ...boolean[]]>();
+  expectTypeOf<b>().toEqualTypeOf<[string, number, (string | undefined)?, ...boolean[]]>();
   const datas = [
     ["hello", 123],
     ["hello", 123, "world"],
@@ -265,7 +265,7 @@ test("z.tuple", () => {
   const cArgs = [z.string(), z.number(), z.optional(z.string())] as const;
   const c = z.tuple(cArgs, z.boolean());
   type c = z.output<typeof c>;
-  expectTypeOf<c>().toEqualTypeOf<[string, number, string?, ...boolean[]]>();
+  expectTypeOf<c>().toEqualTypeOf<[string, number, (string | undefined)?, ...boolean[]]>();
   // type c = z.output<typeof c>;
 });
 
@@ -302,6 +302,29 @@ test("z.record", () => {
   const d = z.record(z.enum(["a", "b"]).or(z.never()), z.string());
   type d = z.output<typeof d>;
   expectTypeOf<d>().toEqualTypeOf<Record<"a" | "b", string>>();
+
+  // literal union keys
+  const e = z.record(z.union([z.literal("a"), z.literal(0)]), z.string());
+  type e = z.output<typeof e>;
+  expectTypeOf<e>().toEqualTypeOf<Record<"a" | 0, string>>();
+  expect(z.parse(e, { a: "hello", 0: "world" })).toEqual({
+    a: "hello",
+    0: "world",
+  });
+
+  // TypeScript enum keys
+  enum Enum {
+    A = 0,
+    B = "hi",
+  }
+
+  const f = z.record(z.enum(Enum), z.string());
+  type f = z.output<typeof f>;
+  expectTypeOf<f>().toEqualTypeOf<Record<Enum, string>>();
+  expect(z.parse(f, { [Enum.A]: "hello", [Enum.B]: "world" })).toEqual({
+    [Enum.A]: "hello",
+    [Enum.B]: "world",
+  });
 });
 
 test("z.map", () => {
@@ -630,8 +653,7 @@ test("z.custom check", () => {
 });
 
 test("z.check", () => {
-  // this is a more flexible version of z.custom that accepts an arbitrary _parse logic
-  // the function should return base.$ZodResult
+  // this is a more flexible version of z.custom that accepts an arbitrary _parse logic the function should return base.$ZodResult
   const a = z.any().check(
     z.check<string>((ctx) => {
       if (typeof ctx.value === "string") return;
@@ -653,6 +675,47 @@ test("z.check", () => {
   });
 });
 
+test("z.with (alias for z.check)", () => {
+  // .with() should work exactly the same as .check()
+  const a = z.any().with(
+    z.check<string>((ctx) => {
+      if (typeof ctx.value === "string") return;
+      ctx.issues.push({
+        code: "custom",
+        origin: "custom",
+        message: "Expected a string",
+        input: ctx.value,
+      });
+    })
+  );
+  expect(z.safeParse(a, "hello")).toMatchObject({
+    success: true,
+    data: "hello",
+  });
+  expect(z.safeParse(a, 123)).toMatchObject({
+    success: false,
+    error: { issues: [{ code: "custom", message: "Expected a string" }] },
+  });
+
+  // Test with refine
+  const b = z.string().with(z.refine((val) => val.length > 3, "Must be longer than 3"));
+  expect(z.safeParse(b, "hello").success).toBe(true);
+  expect(z.safeParse(b, "hi").success).toBe(false);
+
+  // Test with function
+  const c = z.string().with(({ value, issues }) => {
+    if (value.length <= 3) {
+      issues.push({
+        code: "custom",
+        input: value,
+        message: "Must be longer than 3",
+      });
+    }
+  });
+  expect(z.safeParse(c, "hello").success).toBe(true);
+  expect(z.safeParse(c, "hi").success).toBe(false);
+});
+
 test("z.instanceof", () => {
   class A {}
 
@@ -672,6 +735,26 @@ test("z.refine", () => {
   expect(() => z.parse(a, "hi")).toThrow();
 });
 
+test("z.superRefine preserves explicit nullish issue input", () => {
+  const schema = z.string().check(
+    z.superRefine((_, ctx) => {
+      ctx.addIssue({ code: "custom", message: "default" });
+      ctx.addIssue({ code: "custom", message: "null", input: null });
+      ctx.addIssue({ code: "custom", message: "undefined", input: undefined });
+    })
+  );
+
+  const result = z.safeParse(schema, "sensitive", { reportInput: true });
+  expect(result.success).toEqual(false);
+  if (!result.success) {
+    expect(result.error.issues).toHaveLength(3);
+    expect(result.error.issues[0].input).toEqual("sensitive");
+    expect(result.error.issues[1].input).toEqual(null);
+    expect(result.error.issues[2]).toHaveProperty("input");
+    expect(result.error.issues[2].input).toEqual(undefined);
+  }
+});
+
 // test("z.superRefine", () => {
 //   const a = z.number([
 //     z.superRefine((val, ctx) => {
@@ -749,7 +832,7 @@ test("z.json", () => {
 test("z.promise", async () => {
   const a = z.promise(z.string());
   type a = z.output<typeof a>;
-  expectTypeOf<a>().toEqualTypeOf<string>();
+  expectTypeOf<a>().toEqualTypeOf<Promise<string>>();
 
   expect(await z.safeParseAsync(a, Promise.resolve("hello"))).toMatchObject({
     success: true,
@@ -786,6 +869,37 @@ test("isPlainObject", () => {
   expect(z.core.util.isPlainObject("string")).toEqual(false);
   expect(z.core.util.isPlainObject(123)).toEqual(false);
   expect(z.core.util.isPlainObject(Symbol())).toEqual(false);
+  expect(z.core.util.isPlainObject({ constructor: "string" })).toEqual(true);
+  expect(z.core.util.isPlainObject({ constructor: 123 })).toEqual(true);
+  expect(z.core.util.isPlainObject({ constructor: null })).toEqual(true);
+  expect(z.core.util.isPlainObject({ constructor: undefined })).toEqual(true);
+  expect(z.core.util.isPlainObject({ constructor: true })).toEqual(true);
+  expect(z.core.util.isPlainObject({ constructor: {} })).toEqual(true);
+  expect(z.core.util.isPlainObject({ constructor: [] })).toEqual(true);
+});
+
+test("shallowClone with constructor field", () => {
+  const objWithConstructor = { constructor: "string", key: "value" };
+  const cloned = z.core.util.shallowClone(objWithConstructor);
+
+  expect(cloned).toEqual(objWithConstructor);
+  expect(cloned).not.toBe(objWithConstructor);
+  expect(cloned.constructor).toBe("string");
+  expect(cloned.key).toBe("value");
+
+  const testCases = [
+    { constructor: 123, data: "test" },
+    { constructor: null, data: "test" },
+    { constructor: true, data: "test" },
+    { constructor: {}, data: "test" },
+    { constructor: [], data: "test" },
+  ];
+
+  for (const testCase of testCases) {
+    const clonedCase = z.core.util.shallowClone(testCase);
+    expect(clonedCase).toEqual(testCase);
+    expect(clonedCase).not.toBe(testCase);
+  }
 });
 
 test("def typing", () => {
@@ -827,3 +941,18 @@ test("def typing", () => {
   z.string().catch("fallback").def.type satisfies "catch";
   z.file().def.type satisfies "file";
 });
+
+test("runtime type property exists and returns correct values", () => {
+  const stringSchema = z.string();
+  expect(stringSchema.type).toBe("string");
+});
+
+test("type narrowing works with type property", () => {
+  type ArrayOrRecord = z.ZodArray<z.ZodString> | z.ZodRecord<z.ZodString, z.ZodAny>;
+  const arraySchema = z.array(z.string()) as ArrayOrRecord;
+
+  if (arraySchema.type === "array") {
+    expectTypeOf(arraySchema).toEqualTypeOf<z.ZodArray<z.ZodString>>();
+    expect(arraySchema.element).toBeDefined();
+  }
+});

package/node_modules/zod/src/v4/classic/tests/instance-footprint.test.ts

@@ -0,0 +1,319 @@
+import { expect, test } from "vitest";
+
+import * as zm from "zod/mini";
+import * as z from "zod/v4";
+import * as core from "zod/v4/core";
+
+// V8 sizes an instance's property backing store in steps, and schema instances get no in-object slots (their constructor assigns nothing itself): 12 own properties cost 128 bytes, 13 cost 848, 21 cost 1616. Methods therefore live on the prototype and materialize per instance on first read. These bounds are what keeps a schema graph small; crossing one silently multiplies its memory by 6x.
+const MAX_OWN_PROPS = 12;
+
+test("schema instances stay under V8's property-count step", () => {
+  const cases: Array<[string, object]> = [
+    ["string", z.string()],
+    ["number", z.number()],
+    ["bigint", z.bigint()],
+    ["boolean", z.boolean()],
+    ["date", z.date()],
+    ["enum", z.enum(["a", "b"])],
+    ["array", z.array(z.string())],
+    ["object", z.object({ a: z.string() })],
+    ["record", z.record(z.string(), z.string())],
+    ["map", z.map(z.string(), z.string())],
+    ["set", z.set(z.string())],
+    ["union", z.union([z.string(), z.number()])],
+    ["optional", z.string().optional()],
+    ["pipe", z.string().pipe(z.string())],
+    ["email", z.email()],
+    ["mini string", zm.string()],
+    ["mini object", zm.object({ a: zm.string() })],
+  ];
+
+  const over = cases
+    .map(([name, schema]) => [name, Reflect.ownKeys(schema).length] as const)
+    .filter(([, count]) => count > MAX_OWN_PROPS);
+
+  expect(over).toEqual([]);
+});
+
+test("prototype-installed members survive detaching", () => {
+  const schema = z.string();
+  const { parse, safeParse, spa } = schema;
+
+  expect(parse("hi")).toEqual("hi");
+  expect(safeParse("hi").success).toEqual(true);
+  expect(["a", "b"].map((v) => parse(v))).toEqual(["a", "b"]);
+  expect(spa).toBe(schema.safeParseAsync);
+
+  const email = schema.email;
+  expect(email().safeParse("a@b.co").success).toEqual(true);
+});
+
+test("prototype-installed members can be overwritten per instance", () => {
+  const schema: any = z.string();
+  schema.parse = () => "overridden";
+
+  expect(schema.parse("anything")).toEqual("overridden");
+  expect(z.string().parse("untouched")).toEqual("untouched");
+});
+
+test("~standard is lazy but complete", () => {
+  const schema = z.string();
+
+  expect(Object.prototype.hasOwnProperty.call(schema, "~standard")).toEqual(false);
+  expect(schema["~standard"].vendor).toEqual("zod");
+  expect(schema["~standard"].version).toEqual(1);
+  expect(schema["~standard"].validate("hi")).toEqual({ value: "hi" });
+  expect((schema["~standard"] as any).jsonSchema.input()).toMatchObject({ type: "string" });
+  // Reading it caches on the instance, so the getter runs once.
+  expect(Object.prototype.hasOwnProperty.call(schema, "~standard")).toEqual(true);
+});
+
+test("caching a lazy member preserves its original enumerability", () => {
+  const schema = z.string();
+
+  // Methods were enumerable own properties before they moved to the prototype, so touching one still surfaces it to `Object.keys`.
+  void schema.parse;
+  void schema.optional;
+  expect(Object.keys(schema)).toContain("parse");
+  expect(Object.keys(schema)).toContain("optional");
+
+  // `~standard` never was an own data property, so caching it must not add it to `Object.keys` or to `JSON.stringify` of a schema.
+  void schema["~standard"];
+  expect(Object.keys(schema)).not.toContain("~standard");
+  expect(JSON.stringify(schema)).not.toContain("~standard");
+
+  // An explicit assignment behaves like one, as before.
+  const other: any = z.string();
+  other["~standard"] = { vendor: "x" };
+  expect(Object.keys(other)).toContain("~standard");
+});
+
+test("_def stays read-only", () => {
+  expect(() => {
+    (z.string() as any)._def = {};
+  }).toThrow(TypeError);
+  expect(() => {
+    (z.function({ input: [z.string()], output: z.number() }) as any)._def = {};
+  }).toThrow(TypeError);
+  const schema = z.string();
+  expect(schema._def).toBe(schema._zod.def);
+  expect(z.object({ a: z.string() })._def.type).toEqual("object");
+});
+
+test("deferred initializers are released after construction", () => {
+  expect(z.string()._zod.deferred).toEqual(undefined);
+  expect(z.object({ a: z.string() })._zod.deferred).toEqual(undefined);
+});
+
+test("trait initializers run once per instance across repeated entry", () => {
+  const calls: string[] = [];
+  const Base: core.$constructor<any> = core.$constructor<any>("CountedBase", () => calls.push("base"));
+  const Child: core.$constructor<any> = core.$constructor<any>("CountedChild", (inst, def) => {
+    calls.push("child");
+    Base.init(inst, def);
+    Base.init(inst, def);
+  });
+  const constructed = new Child({});
+  Child.init(constructed, {});
+  const direct = Object.create({});
+  Child.init(direct, {});
+  Child.init(direct, {});
+  expect(calls).toEqual(["child", "base", "child", "base"]);
+  for (const inst of [constructed, direct]) {
+    expect([...inst._zod.traits]).toEqual(["CountedChild", "CountedBase"]);
+    expect(inst instanceof Base).toBe(true);
+    expect(inst instanceof Child).toBe(true);
+  }
+  expect(constructed._zod.traits).not.toBe(direct._zod.traits);
+});
+
+test("a trait initializer called directly still installs its members", () => {
+  // a direct `init` installs onto the receiver's own prototype, since it is not below the constructor's
+  z.string();
+
+  const proto = {};
+  const inst = Object.create(proto) as z.ZodString;
+  z.ZodString.init(inst, { type: "string" });
+
+  expect(typeof inst.email).toBe("function");
+  expect(typeof inst.optional).toBe("function");
+  expect(Object.prototype.hasOwnProperty.call(proto, "email")).toBe(true);
+});
+
+test("a nested init during a repeat construction still installs its members", () => {
+  // the install used to read a module-level flag the outer construction set, so a nested `init` on an unrelated receiver inherited an answer that was not about it
+  const seen: string[] = [];
+
+  // an assertion signature needs the call target explicitly annotated
+  const Nested: core.$constructor<any> = core.$constructor<any>("Nested", () => {}, {
+    tag() {
+      return "nested";
+    },
+  });
+  const Outer = core.$constructor<any>("Outer", (_inst, def) => {
+    if (!def.nest) return;
+    // not a plain `{}`: the install target would resolve to `Object.prototype` and leak `tag` into every object the worker touches
+    const plain: any = Object.create({});
+    Nested.init(plain, {});
+    seen.push(typeof plain.tag);
+  });
+
+  new Outer({ nest: false });
+  new Outer({ nest: true });
+
+  expect(seen).toEqual(["function"]);
+});
+
+test("a derived trait's members win over the ones it composes", () => {
+  // Classic installs a richer `~standard` over core's. Trait dedupe is what orders them: core's initializer runs once, at the first `init` that reaches it, so classic's always lands second.
+  expect(typeof (z.string()["~standard"] as any).jsonSchema.input).toBe("function");
+});
+
+test("a live member keeps the descriptor a prototype member had", () => {
+  // An object literal's getter is enumerable; the `defineProperty` it replaced was not. `for..in` over a schema is public surface, and the construction path walks the prototype with it.
+  const proto = Object.getPrototypeOf(z.string());
+  expect(Object.getOwnPropertyDescriptor(proto, "description")?.enumerable).toBe(false);
+  expect(Object.getOwnPropertyDescriptor(proto, "_def")?.enumerable).toBe(false);
+  // a derived member installs like a literal's accessor: not enumerable, still configurable
+  expect(Object.getOwnPropertyDescriptor(proto, "minLength")).toMatchObject({ enumerable: false, configurable: true });
+
+  // the derived metadata members live on the prototype and shadow as own data on first read
+  const schema = z.string();
+  const keys: string[] = [];
+  for (const k in schema) keys.push(k);
+  expect(keys).toEqual(["def", "type"]);
+  expect(schema.minLength).toBe(null);
+  expect(Object.keys(schema)).toContain("minLength");
+});
+
+test("a live member is not cached per instance", () => {
+  const schema = z.string();
+
+  expect(schema.description).toBe(undefined);
+  core.globalRegistry.add(schema, { description: "later" });
+  expect(schema.description).toBe("later");
+  expect(Object.prototype.hasOwnProperty.call(schema, "description")).toBe(false);
+});
+
+test("constructing through a subclass does not strip the base prototype", () => {
+  // `super(def)` gives `this` a prototype of `new.target.prototype`, so a constructor can complete a construction without having built its own prototype.
+  const MyString: new (def: { type: "string" }) => z.ZodString = class extends (z.ZodString as any) {} as any;
+  new MyString({ type: "string" });
+
+  const plain = z.string();
+  expect(plain.parse("x")).toBe("x");
+  expect(typeof plain.email).toBe("function");
+  expect(typeof new MyString({ type: "string" }).email).toBe("function");
+});
+
+test("a subclass's own members survive the install", () => {
+  // The members go on the prototype of the constructor that built the instance, so a subclass's own prototype keeps what it declared. `z.symbol()` is constructed nowhere else here, which puts the subclass before its base — the ordering the install has to get right. Asserted rather than assumed, so warming it elsewhere fails the test instead of hollowing it out.
+  expect(Object.prototype.hasOwnProperty.call((z.ZodSymbol as any).prototype, "parse")).toBe(false);
+  const First = class extends (z.ZodSymbol as any) {
+    parse() {
+      return "PARSE";
+    }
+    optional() {
+      return "OPTIONAL";
+    }
+  } as any;
+  const first = new First({ type: "symbol" });
+  expect(first.parse(Symbol())).toBe("PARSE");
+  expect(first.optional()).toBe("OPTIONAL");
+  const sym = Symbol();
+  expect(z.symbol().parse(sym)).toBe(sym);
+
+  // and the other way round, with the base prototype already built by one of the `z.number()` calls above. Asserted for the same reason: warm it nowhere and this block quietly becomes a second copy of the cold case.
+  expect(Object.prototype.hasOwnProperty.call((z.ZodNumber as any).prototype, "parse")).toBe(true);
+  const Second = class extends (z.ZodNumber as any) {
+    parse() {
+      return "SECOND";
+    }
+  } as any;
+  expect(new Second({ type: "number" }).parse(1)).toBe("SECOND");
+
+  // two levels deep: neither prototype takes a copy, so the inherited member is one function
+  const Third = class extends (Second as any) {} as any;
+  new Third({ type: "number" });
+  expect(Second.prototype.parse).toBe(Third.prototype.parse);
+});
+
+test("a hand-written getter member accepts assignment", () => {
+  // Every member was an accessor with a setter before they moved onto `proto`, so a getter written by hand needs one too.
+  const schema: any = z.string();
+  schema.spa = () => "SPA";
+  schema.toJSONSchema = () => "JSON";
+  expect(schema.spa()).toBe("SPA");
+  expect(schema.toJSONSchema()).toBe("JSON");
+
+  const mini: any = zm.string();
+  mini.with = () => "WITH";
+  expect(mini.with()).toBe("WITH");
+
+  // a derived metadata member accepts assignment before its first read, as it did as an own property
+  const derived = z.number().min(2);
+  derived.minValue = 99;
+  expect(derived.minValue).toBe(99);
+  expect(Object.keys(derived)).toContain("minValue");
+
+  // and, like every prototype member, recomputes after deletion rather than staying absent
+  delete (derived as any).minValue;
+  expect(derived.minValue).toBe(2);
+});
+
+test("shape is lazy and stays out of Object.keys", () => {
+  const schema = z.object({ a: z.string() });
+
+  expect(Object.prototype.hasOwnProperty.call(schema, "shape")).toEqual(false);
+  expect("shape" in schema).toEqual(true);
+  expect(Object.keys(schema)).not.toContain("shape");
+  expect({ ...schema }).not.toHaveProperty("shape");
+
+  expect(Object.keys(schema.shape)).toEqual(["a"]);
+
+  // Reading caches a non-enumerable own data property. An own accessor here would put every later object schema into V8 dictionary mode.
+  expect(Object.prototype.hasOwnProperty.call(schema, "shape")).toEqual(true);
+  expect(Object.getOwnPropertyDescriptor(schema, "shape")).toMatchObject({
+    writable: true,
+    enumerable: false,
+    configurable: true,
+  });
+  expect(Object.keys(schema)).not.toContain("shape");
+
+  const mini = zm.object({ a: zm.string() });
+  expect(Object.prototype.hasOwnProperty.call(mini, "shape")).toEqual(false);
+  expect(Object.keys(mini.shape)).toEqual(["a"]);
+  expect(Object.keys(mini)).not.toContain("shape");
+});
+
+test("shape accepts repeated assignment and recomputes after deletion", () => {
+  const schema: any = z.object({ a: z.string() });
+
+  schema.shape = { b: z.number() };
+  expect(Object.keys(schema.shape)).toEqual(["b"]);
+  // The cached property stays writable, so a second assignment does not throw in strict mode.
+  schema.shape = { c: z.boolean() };
+  expect(Object.keys(schema.shape)).toEqual(["c"]);
+
+  // Deleting clears the memo rather than removing the property, since the accessor lives on the prototype.
+  delete schema.shape;
+  expect(Object.keys(schema.shape)).toEqual(["a"]);
+});
+
+test("a self-referential shape getter breaks the cycle instead of recursing", () => {
+  const Self: any = z.object({
+    a: z.string(),
+    get b() {
+      return z.array(z.object(Self.shape));
+    },
+  });
+  expect(Object.keys(Self.shape)).toEqual(["a", "b"]);
+
+  const Mini: any = zm.object({
+    a: zm.string(),
+    get b() {
+      return zm.array(zm.object(Mini.shape));
+    },
+  });
+  expect(Object.keys(Mini.shape)).toEqual(["a", "b"]);
+});

package/node_modules/zod/src/v4/classic/tests/instanceof.test.ts

@@ -32,3 +32,96 @@ test("instanceof fatal", () => {
   const res = schema.safeParse(null);
   expect(res.success).toBe(false);
 });
+
+test("instanceof respects customError", () => {
+  class Test {
+    name!: string;
+  }
+
+  z.config({
+    customError: () => {
+      return "This is invalid!";
+    },
+  });
+
+  const TestSchema = z.instanceof(Test);
+  const result = TestSchema.safeParse("whatever");
+  expect(result.success).toBe(false);
+  if (!result.success) {
+    const issue = result.error.issues[0];
+    expect(issue.code).toBe("invalid_type");
+    if (issue.code === "invalid_type") {
+      expect(issue.expected).toBe("Test");
+    }
+    expect(issue.message).toBe("This is invalid!");
+  }
+
+  z.config({ customError: undefined });
+});
+
+test("z.properties", () => {
+  const httpsUrl = z.instanceof(URL).check(
+    ...z.properties({
+      protocol: z.literal("https:"),
+      hostname: z.string().regex(z.regexes.domain),
+    })
+  );
+
+  expectTypeOf<URL>().toEqualTypeOf<z.infer<typeof httpsUrl>>();
+  expect(httpsUrl.safeParse(new URL("https://example.com")).success).toBe(true);
+
+  // One check iterates the whole shape, so every failing property reports — unlike the equivalent chain of z.property() calls, which aborts on the first.
+  const both = httpsUrl.safeParse(new URL("http://localhost"));
+  expect(both.error!.issues.map((i) => i.path)).toEqual([["protocol"], ["hostname"]]);
+
+  // A failing base schema yields its own issue and no property issues.
+  for (const input of ["not a url", null]) {
+    const issues = httpsUrl.safeParse(input).error!.issues;
+    expect(issues.map((i) => [i.code, i.path])).toEqual([["custom", []]]);
+  }
+
+  // Not specific to z.instanceof(). A base whose type mismatch aborts implicitly rather than explicitly must still not run the property checks against the rejected value.
+  const obj = z
+    .object({ a: z.string(), b: z.string() })
+    .check(...z.properties({ a: z.literal("x"), b: z.literal("y") }));
+  expect(obj.safeParse({ a: "x", b: "y" }).success).toBe(true);
+  expect(obj.safeParse({ a: "!", b: "!" }).error!.issues.map((i) => i.path)).toEqual([["a"], ["b"]]);
+  for (const input of [null, undefined, 5]) {
+    expect(obj.safeParse(input).error!.issues.map((i) => [i.code, i.path])).toEqual([["invalid_type", []]]);
+  }
+
+  // Known looseness versus the longhand, pinned so it stays deliberate: the check is typed over the whole shape, and `$ZodCheckInternals.check()` is a method, so TypeScript compares it bivariantly and accepts a check type that is a subtype of the target. Naming a key the target lacks therefore compiles here and fails at parse time, where the equivalent chain of `z.property()` calls rejects it outright.
+  z.object({ a: z.string() }).check(...z.properties({ a: z.literal("x"), b: z.literal("y") }));
+  expect(
+    z
+      .object({ a: z.string() })
+      .check(...z.properties({ a: z.string(), b: z.literal("y") }))
+      .safeParse({ a: "ok" })
+      .error!.issues.map((i) => [i.code, i.path])
+  ).toEqual([["invalid_value", ["b"]]]);
+
+  // literal and enum inputs widen to their primitive, so a `string`/`boolean` property accepts them without a cast, while a genuine type mismatch or an unknown key still fails to compile
+  z.instanceof(URL).check(z.property("protocol", z.literal("https:")));
+  z.instanceof(Request).check(...z.properties({ method: z.enum(["POST", "PUT"]), bodyUsed: z.literal(false) }));
+  // @ts-expect-error length is a number
+  z.string().check(z.property("length", z.string()));
+  // @ts-expect-error no such key
+  z.instanceof(URL).check(z.property("nope", z.string()));
+
+  // the check feeds the property value into its schema, so it is typed over the input side rather than the output
+  const stringToLength = z.property(
+    "a",
+    z.string().transform((s) => s.length)
+  );
+  z.object({ a: z.string() }).check(stringToLength);
+  // @ts-expect-error a is a number, the schema takes a string
+  z.object({ a: z.number() }).check(stringToLength);
+
+  // The properties check carries no `when`, so the schema stays on the compiled fast path.
+  const compiled = z.compile(httpsUrl);
+  expect(compiled.safeParse(new URL("https://example.com")).success).toBe(true);
+  expect(compiled.safeParse(new URL("http://localhost")).error!.issues.map((i) => i.path)).toEqual([
+    ["protocol"],
+    ["hostname"],
+  ]);
+});