agent-relay 6.0.2 → 6.0.4

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/object.test.ts

@@ -1,4 +1,4 @@
-import { expect, expectTypeOf, test } from "vitest";
+import { describe, expect, expectTypeOf, test } from "vitest";
 import * as z from "zod/v4";
 import * as core from "zod/v4/core";
 
@@ -232,8 +232,7 @@ test("inferred merged object type with optional properties", async () => {
     .object({ a: z.string(), b: z.string().optional() })
     .merge(z.object({ a: z.string().optional(), b: z.string() }));
   type Merged = z.infer<typeof Merged>;
-  expectTypeOf<Merged>().toEqualTypeOf<{ a?: string; b: string }>();
-  expectTypeOf<Merged>().toEqualTypeOf<{ a?: string; b: string }>();
+  expectTypeOf<Merged>().toEqualTypeOf<{ a?: string | undefined; b: string }>();
 });
 
 test("inferred unioned object type with optional properties", async () => {
@@ -242,7 +241,9 @@ test("inferred unioned object type with optional properties", async () => {
     z.object({ a: z.string().optional(), b: z.string() }),
   ]);
   type Unioned = z.infer<typeof Unioned>;
-  expectTypeOf<Unioned>().toEqualTypeOf<{ a: string; b?: string } | { a?: string; b: string }>();
+  expectTypeOf<Unioned>().toEqualTypeOf<
+    { a: string; b?: string | undefined } | { a?: string | undefined; b: string }
+  >();
 });
 
 test("inferred enum type", async () => {
@@ -279,13 +280,13 @@ test("z.keyof returns enum", () => {
 test("inferred partial object type with optional properties", async () => {
   const Partial = z.object({ a: z.string(), b: z.string().optional() }).partial();
   type Partial = z.infer<typeof Partial>;
-  expectTypeOf<Partial>().toEqualTypeOf<{ a?: string; b?: string }>();
+  expectTypeOf<Partial>().toEqualTypeOf<{ a?: string | undefined; b?: string | undefined }>();
 });
 
 test("inferred picked object type with optional properties", async () => {
   const Picked = z.object({ a: z.string(), b: z.string().optional() }).pick({ b: true });
   type Picked = z.infer<typeof Picked>;
-  expectTypeOf<Picked>().toEqualTypeOf<{ b?: string }>();
+  expectTypeOf<Picked>().toEqualTypeOf<{ b?: string | undefined }>();
 });
 
 test("inferred type for unknown/any keys", () => {
@@ -405,6 +406,36 @@ test("unknownkeys merging", () => {
   expect(c._zod.def.catchall).toBeInstanceOf(core.$ZodNever);
 });
 
+test("merge() throws when receiver has refinements", () => {
+  const a = z
+    .object({
+      password: z.string(),
+      confirmPassword: z.string(),
+    })
+    .refine((data) => data.password === data.confirmPassword);
+
+  const b = z.object({ email: z.string() });
+
+  expect(() => a.merge(b)).toThrow(".merge() cannot be used on object schemas containing refinements");
+});
+
+test("merge() throws when receiver has superRefine", () => {
+  const a = z.object({ x: z.string() }).superRefine(() => {});
+  const b = z.object({ y: z.number() });
+
+  expect(() => a.merge(b)).toThrow(".merge() cannot be used on object schemas containing refinements");
+});
+
+test("merge() preserves refinements on the second schema", () => {
+  const a = z.object({ name: z.string() });
+  const b = z.object({ age: z.number() }).refine((data) => data.age >= 18, { message: "Must be 18+" });
+
+  const merged = a.merge(b);
+
+  expect(merged.parse({ name: "n", age: 21 })).toEqual({ name: "n", age: 21 });
+  expect(() => merged.parse({ name: "n", age: 12 })).toThrow("Must be 18+");
+});
+
 const personToExtend = z.object({
   firstName: z.string(),
   lastName: z.string(),
@@ -638,3 +669,49 @@ test("safeExtend() on object with refinements should not throw", () => {
 
   expect(() => schema.safeExtend({ b: z.string() })).not.toThrow();
 });
+
+// __proto__ in input must not replace the prototype of the parsed object via
+// the assignment setter on the result {}.
+// https://github.com/colinhacks/zod/security/advisories/GHSA-r34p-xfmx-58wv
+// https://github.com/colinhacks/zod/security/advisories/GHSA-84jv-fqfx-wxhr
+describe("__proto__ in object catchall paths", () => {
+  const protoInput = () => JSON.parse('{"__proto__":{"isAdmin":true},"name":"alice"}');
+
+  test("looseObject drops __proto__ and preserves Object.prototype", () => {
+    const schema = z.looseObject({ name: z.string() });
+    const parsed = schema.parse(protoInput());
+    expect(Object.keys(parsed)).toEqual(["name"]);
+    expect((parsed as any).isAdmin).toBeUndefined();
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  });
+
+  test("passthrough drops __proto__", () => {
+    const schema = z.object({ name: z.string() }).passthrough();
+    const parsed = schema.parse(protoInput());
+    expect((parsed as any).isAdmin).toBeUndefined();
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  });
+
+  test("catchall(unknown) drops __proto__", () => {
+    const schema = z.object({ name: z.string() }).catchall(z.unknown());
+    const parsed = schema.parse(protoInput());
+    expect((parsed as any).isAdmin).toBeUndefined();
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  });
+
+  test("safeParseAsync + jitless drops __proto__", async () => {
+    const schema = z.looseObject({ name: z.string() });
+    const result = await schema.safeParseAsync(protoInput(), { jitless: true } as any);
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect((result.data as any).isAdmin).toBeUndefined();
+      expect(Object.getPrototypeOf(result.data)).toBe(Object.prototype);
+    }
+  });
+
+  test("strict does not surface __proto__ as unrecognized", () => {
+    const schema = z.object({ name: z.string() }).strict();
+    const result = schema.safeParse(protoInput());
+    expect(result.success).toBe(true);
+  });
+});

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/optional.test.ts

@@ -40,15 +40,15 @@ test("optionality", () => {
 
   // z.undefined should NOT be optional
   const f = z.undefined();
-  expect(f._zod.optin).toEqual("optional");
-  expect(f._zod.optout).toEqual("optional");
+  expect(f._zod.optin).toEqual(undefined);
+  expect(f._zod.optout).toEqual(undefined);
   expectTypeOf<typeof f._zod.optin>().toEqualTypeOf<"optional" | undefined>();
   expectTypeOf<typeof f._zod.optout>().toEqualTypeOf<"optional" | undefined>();
 
   // z.union should be optional if any of the types are optional
   const g = z.union([z.string(), z.undefined()]);
-  expect(g._zod.optin).toEqual("optional");
-  expect(g._zod.optout).toEqual("optional");
+  expect(g._zod.optin).toEqual(undefined);
+  expect(g._zod.optout).toEqual(undefined);
   expectTypeOf<typeof g._zod.optin>().toEqualTypeOf<"optional" | undefined>();
   expectTypeOf<typeof g._zod.optout>().toEqualTypeOf<"optional" | undefined>();
 
@@ -135,6 +135,52 @@ test("optional prop with pipe", () => {
   schema.parse({}, { jitless: true });
 });
 
+test("object absent keys require optin optional", () => {
+  const valueUndefined = z.object({
+    value: z.undefined(),
+    union: z.union([z.string(), z.undefined()]),
+  });
+
+  expect(valueUndefined.safeParse({}).error!.issues).toMatchInlineSnapshot(`
+    [
+      {
+        "code": "invalid_type",
+        "expected": "nonoptional",
+        "message": "Invalid input: expected nonoptional, received undefined",
+        "path": [
+          "value",
+        ],
+      },
+      {
+        "code": "invalid_type",
+        "expected": "nonoptional",
+        "message": "Invalid input: expected nonoptional, received undefined",
+        "path": [
+          "union",
+        ],
+      },
+    ]
+  `);
+  expect(valueUndefined.safeParse({}, { jitless: true }).success).toEqual(false);
+  expect(valueUndefined.parse({ value: undefined, union: undefined })).toEqual({
+    value: undefined,
+    union: undefined,
+  });
+
+  const optionalOutOnly = z.object({
+    value: z
+      .string()
+      .transform((val) => (Math.random() ? val : undefined))
+      .pipe(z.string().optional()),
+  });
+  expect(optionalOutOnly.safeParse({}).success).toEqual(false);
+  expect(optionalOutOnly.safeParse({}, { jitless: true }).success).toEqual(false);
+
+  const defaulted = z.object({ value: z.string().default("fallback") });
+  expect(defaulted.parse({})).toEqual({ value: "fallback" });
+  expect(defaulted.parse({}, { jitless: true })).toEqual({ value: "fallback" });
+});
+
 // exactOptional tests
 test(".exactOptional()", () => {
   const schema = z.string().exactOptional();
@@ -221,3 +267,67 @@ test("exactOptional vs optional comparison", () => {
   // exactOptional() rejects explicit undefined
   expect(exactOptionalSchema.safeParse({ a: undefined }).success).toEqual(false);
 });
+
+// Defensive inference coverage: every schema that propagates `optout` participates
+// in object-key optionality inference. If anyone ever changes the set of values that
+// `optout` can take (or how OptionalOutSchema matches them), these assertions must
+// continue to hold or downstream `z.infer<typeof obj>` types silently flip required keys.
+test("object key optionality through optout propagation", () => {
+  const direct = z.object({ k: z.string().optional() });
+  expectTypeOf<z.infer<typeof direct>>().toEqualTypeOf<{ k?: string | undefined }>();
+
+  const exact = z.object({ k: z.string().exactOptional() });
+  expectTypeOf<z.infer<typeof exact>>().toEqualTypeOf<{ k?: string }>();
+
+  // nullable() preserves the inner type's optout
+  const nullableOpt = z.object({ k: z.string().optional().nullable() });
+  expectTypeOf<z.infer<typeof nullableOpt>>().toEqualTypeOf<{ k?: string | null | undefined }>();
+
+  // optional() wrapping nullable() — still optional out
+  const optNullable = z.object({ k: z.string().nullable().optional() });
+  expectTypeOf<z.infer<typeof optNullable>>().toEqualTypeOf<{ k?: string | null | undefined }>();
+
+  // union containing an optional member must mark the key as optional
+  const unionWithOpt = z.object({ k: z.union([z.string(), z.string().optional()]) });
+  expectTypeOf<z.infer<typeof unionWithOpt>>().toEqualTypeOf<{ k?: string | undefined }>();
+
+  // pipe ending in optional()
+  const pipedToOpt = z.object({
+    k: z
+      .string()
+      .transform((v) => (Math.random() ? v : undefined))
+      .pipe(z.string().optional()),
+  });
+  expectTypeOf<z.output<typeof pipedToOpt>>().toEqualTypeOf<{ k?: string | undefined }>();
+
+  // mixed shape pinning required vs optional keys end-to-end
+  const mixed = z.object({
+    req: z.string(),
+    opt: z.string().optional(),
+    exact: z.string().exactOptional(),
+    def: z.string().default("x"),
+    nullableOpt: z.string().optional().nullable(),
+  });
+  expectTypeOf<z.output<typeof mixed>>().toEqualTypeOf<{
+    req: string;
+    opt?: string | undefined;
+    exact?: string;
+    def: string;
+    nullableOpt?: string | null | undefined;
+  }>();
+});
+
+// Defensive: tuple optional-tail inference also reads optout. The PR that introduced
+// `"includeUndefined"` had to update TupleOutputTypeWithOptionals; pin the result so
+// any future flag change has to keep this contract.
+test("tuple tail optionality through optout propagation", () => {
+  const trailingOptional = z.tuple([z.string(), z.number().optional()]);
+  expectTypeOf<z.output<typeof trailingOptional>>().toEqualTypeOf<[string, (number | undefined)?]>();
+
+  const trailingExact = z.tuple([z.string(), z.number().exactOptional()]);
+  expectTypeOf<z.output<typeof trailingExact>>().toEqualTypeOf<[string, number?]>();
+
+  // Interior optional must NOT make the tail optional
+  const interiorOptional = z.tuple([z.string(), z.number().optional(), z.string()]);
+  expectTypeOf<z.output<typeof interiorOptional>>().toEqualTypeOf<[string, number | undefined, string]>();
+});

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/partial.test.ts

@@ -156,7 +156,33 @@ test("catch/prefault/default", () => {
     f: z.string().prefault("prefault value"),
   });
 
-  expect(mySchema.parse({})).toMatchInlineSnapshot(`
+  expect(mySchema.safeParse({}).error!.issues).toMatchInlineSnapshot(`
+    [
+      {
+        "code": "invalid_type",
+        "expected": "nonoptional",
+        "message": "Invalid input: expected nonoptional, received undefined",
+        "path": [
+          "d",
+        ],
+      },
+    ]
+  `);
+
+  expect(mySchema.safeParse({}, { jitless: true }).error!.issues).toMatchInlineSnapshot(`
+    [
+      {
+        "code": "invalid_type",
+        "expected": "nonoptional",
+        "message": "Invalid input: expected nonoptional, received undefined",
+        "path": [
+          "d",
+        ],
+      },
+    ]
+  `);
+
+  expect(mySchema.parse({ d: undefined })).toMatchInlineSnapshot(`
     {
       "b": "default value",
       "c": "prefault value",
@@ -166,7 +192,7 @@ test("catch/prefault/default", () => {
     }
   `);
 
-  expect(mySchema.parse({}, { jitless: true })).toMatchInlineSnapshot(`
+  expect(mySchema.parse({ d: undefined }, { jitless: true })).toMatchInlineSnapshot(`
     {
       "b": "default value",
       "c": "prefault value",

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/prefault.test.ts

@@ -41,7 +41,7 @@ test("object schema with prefault should return shallow clone", () => {
     .object({
       a: z.string(),
     })
-    .default({ a: "x" });
+    .prefault({ a: "x" });
   const result1 = schema.parse(undefined);
   const result2 = schema.parse(undefined);
   expect(result1).not.toBe(result2);

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/record.test.ts

@@ -272,6 +272,67 @@ test("union exhaustiveness", () => {
   `);
 });
 
+test("applies transforms on the key schema (#5296)", () => {
+  const single = z.record(
+    z.literal("a").transform(() => "b" as const),
+    z.string()
+  );
+  expect(single.parse({ a: "John" })).toEqual({ b: "John" });
+
+  const multi = z.record(
+    z.literal(["a", "b"]).transform((k) => k.toUpperCase()),
+    z.number()
+  );
+  expect(multi.parse({ a: 1, b: 2 })).toEqual({ A: 1, B: 2 });
+
+  // required-key semantics still hold when the keyType has a known value set
+  expect(multi.safeParse({ a: 1 }).success).toBe(false);
+
+  const en = z.record(
+    z.enum(["a", "b"]).transform((k) => k.toUpperCase()),
+    z.number()
+  );
+  expect(en.parse({ a: 1, b: 2 })).toEqual({ A: 1, B: 2 });
+
+  // matches partialRecord, which already applied transforms
+  const part = z.partialRecord(
+    z.literal("a").transform(() => "b" as const),
+    z.string()
+  );
+  expect(part.parse({ a: "John" })).toEqual({ b: "John" });
+});
+
+test("surfaces key schema refinement failures as invalid_key", () => {
+  // refine rejects "b" but it's still in the literal's value set
+  const schema = z.record(
+    z.literal(["a", "b"]).refine((k) => k === "a", { message: "only 'a' is allowed" }),
+    z.string()
+  );
+
+  expect(schema.safeParse({ a: "ok", b: "nope" })).toMatchInlineSnapshot(`
+    {
+      "error": [ZodError: [
+      {
+        "code": "invalid_key",
+        "origin": "record",
+        "issues": [
+          {
+            "code": "custom",
+            "path": [],
+            "message": "only 'a' is allowed"
+          }
+        ],
+        "path": [
+          "b"
+        ],
+        "message": "Invalid key in record"
+      }
+    ]],
+      "success": false,
+    }
+  `);
+});
+
 test("string record parse - pass", () => {
   const schema = z.record(z.string(), z.boolean());
   schema.parse({
@@ -630,3 +691,27 @@ test("numeric string keys", () => {
   );
   expect(transformedSchema.parse({ 5: "five", 10: "ten" })).toEqual({ 10: "five", 20: "ten" });
 });
+
+test("v3-compat single-arg form: z.record(valueType)", () => {
+  // single arg should default keyType to z.string() and use the arg as valueType
+  const schema = (z.record as any)(z.number());
+  expect(schema.keyType._zod.def.type).toEqual("string");
+  expect(schema.valueType._zod.def.type).toEqual("number");
+
+  expect(schema.parse({ a: 1, b: 2 })).toEqual({ a: 1, b: 2 });
+  expect(schema.safeParse({ a: "x" }).success).toBe(false);
+
+  // params still flow through in the single-arg form
+  const withMessage = (z.record as any)(z.number(), "must be a number record");
+  expect(withMessage.keyType._zod.def.type).toEqual("string");
+  expect(withMessage.valueType._zod.def.type).toEqual("number");
+
+  // toJSONSchema should produce a well-formed schema (regression: previously produced
+  // additionalProperties from undefined valueType, crashing process())
+  const json = z.toJSONSchema(schema);
+  expect(json).toMatchObject({
+    type: "object",
+    propertyNames: { type: "string" },
+    additionalProperties: { type: "number" },
+  });
+});

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/recursive-types.test.ts

@@ -135,6 +135,11 @@ test("pick and omit with getter", () => {
   }
   expectTypeOf<Category>().toEqualTypeOf<_Category>();
 
+  // Shape should not surface `readonly` modifiers from getter-defined keys.
+  // object/strictObject/looseObject all pass shape through util.Writeable<T>.
+  type Shape = (typeof Category)["shape"];
+  expectTypeOf<Shape>().toEqualTypeOf<{ name: z.ZodString; subcategories: z.ZodArray<typeof Category> }>();
+
   const PickedCategory = Category.pick({ name: true });
   const OmittedCategory = Category.omit({ subcategories: true });
 
@@ -148,6 +153,50 @@ test("pick and omit with getter", () => {
   expect(() => OmittedCategory.parse({ name: "test", subcategories: [] })).toThrow();
 });
 
+test("shape stays writeable through extend/safeExtend/partial/required", () => {
+  const Base = z.object({ name: z.string() });
+
+  const Extended = Base.extend({
+    get sub() {
+      return z.array(Extended);
+    },
+  });
+  type ExtendedShape = (typeof Extended)["shape"];
+  expectTypeOf<ExtendedShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    sub: z.ZodArray<typeof Extended>;
+  }>();
+
+  const SafeExt = Base.safeExtend({ extra: z.string() } as const);
+  type SafeExtShape = (typeof SafeExt)["shape"];
+  expectTypeOf<SafeExtShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    extra: z.ZodString;
+  }>();
+
+  const FromConst = Base.extend({ a: z.string(), b: z.number() } as const);
+  type FromConstShape = (typeof FromConst)["shape"];
+  expectTypeOf<FromConstShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    a: z.ZodString;
+    b: z.ZodNumber;
+  }>();
+
+  const PartialExtended = Extended.partial();
+  type PartialShape = (typeof PartialExtended)["shape"];
+  expectTypeOf<PartialShape>().toEqualTypeOf<{
+    name: z.ZodOptional<z.ZodString>;
+    sub: z.ZodOptional<z.ZodArray<typeof Extended>>;
+  }>();
+
+  const RequiredExtended = Extended.required();
+  type RequiredShape = (typeof RequiredExtended)["shape"];
+  expectTypeOf<RequiredShape>().toEqualTypeOf<{
+    name: z.ZodNonOptional<z.ZodString>;
+    sub: z.ZodNonOptional<z.ZodArray<typeof Extended>>;
+  }>();
+});
+
 test("deferred self-recursion", () => {
   const Feature = z.object({
     title: z.string(),

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/refine.test.ts

@@ -414,6 +414,69 @@ describe("chained refinements", () => {
     };
     expect(objectSchema.parse(validData)).toEqual(validData);
   });
+
+  test("should run superRefine validation even when base schema validation fails when 'when' is defined and returns true", () => {
+    const baseSchema = z.object({
+      foo: z.number(),
+      bar: z.number(),
+    });
+
+    const schema = baseSchema.superRefine(
+      (data, ctx) => {
+        if (data.foo > 10) {
+          ctx.addIssue({
+            code: "custom",
+            message: "foo must be less than 10",
+          });
+        }
+      },
+      {
+        when: ({ value }) => baseSchema.pick({ foo: true }).safeParse(value).success,
+      }
+    );
+
+    const result = schema.safeParse({
+      foo: 11,
+    });
+    expect(result.success).toEqual(false);
+
+    if (!result.success) {
+      expect(result.error.issues.length).toEqual(2);
+      expect(result.error.issues[0].message).toEqual("Invalid input: expected number, received undefined");
+      expect(result.error.issues[1].message).toEqual("foo must be less than 10");
+    }
+  });
+
+  test("should not run superRefine validation when 'when' is defined and returns false", () => {
+    const baseSchema = z.object({
+      foo: z.number(),
+      bar: z.number(),
+    });
+
+    const schema = baseSchema.superRefine(
+      (data, ctx) => {
+        if (data.foo > 10) {
+          ctx.addIssue({
+            code: "custom",
+            message: "foo must be less than 10",
+          });
+        }
+      },
+      {
+        when: ({ value }) => baseSchema.safeParse(value).success,
+      }
+    );
+
+    const result = schema.safeParse({
+      foo: 11,
+    });
+    expect(result.success).toEqual(false);
+
+    if (!result.success) {
+      expect(result.error.issues.length).toEqual(1);
+      expect(result.error.issues[0].message).toEqual("Invalid input: expected number, received undefined");
+    }
+  });
 });
 
 describe("type refinement with type guards", () => {

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/string.test.ts

@@ -217,6 +217,16 @@ test("base64 validations", () => {
     "?QmFzZTY0IGVuY29kaW5nIGlzIGZ1bg==", // Invalid character '?'
     ".MTIzND2Nzg5MC4=", // Invalid character '.'
     "QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo", // Missing padding
+    // Whitespace is not part of canonical base64 (RFC 4648 §3.3) — atob() strips
+    // whitespace internally before validating, so the length check alone would
+    // accept "123 " etc.
+    "123 ", // bypasses length-mod-4 via trailing whitespace
+    "SGVsbG8gV29ybGQ= ", // trailing space
+    " SGVsbG8gV29ybGQ=", // leading space
+    "SGVsbG8gV29ybGQ=\n", // trailing newline
+    "SGVs bG8gV29ybGQ=", // internal space
+    "SGVs\nbG8gV29ybGQ=", // internal newline
+    "SGVs\tbG8gV29ybGQ=", // internal tab
   ];
 
   for (const str of invalidBase64Strings) {
@@ -454,6 +464,12 @@ test("httpurl", () => {
   ).toThrow();
   expect(() => httpUrl.parse("http://asdf.c")).toThrow();
   expect(() => httpUrl.parse("mailto:asdf@lckj.com")).toThrow();
+  // missing // after protocol
+  expect(() => httpUrl.parse("http:example.com")).toThrow();
+  expect(() => httpUrl.parse("https:example.com")).toThrow();
+  // missing one /
+  expect(() => httpUrl.parse("https:/www.google.com")).toThrow();
+  expect(() => httpUrl.parse("http:/example.com")).toThrow();
 });
 
 test("url error overrides", () => {
@@ -611,12 +627,26 @@ test("cuid", () => {
         "origin": "string",
         "code": "invalid_format",
         "format": "cuid",
-        "pattern": "/^[cC][^\\\\s-]{8,}$/",
+        "pattern": "/^[cC][0-9a-z]{6,}$/",
         "path": [],
         "message": "Invalid cuid"
       }
     ]]
   `);
+
+  // Strings containing non-base36 characters that the old denylist regex
+  // (/^[cC][^\s-]{8,}$/) accepted. The new regex restricts the body to
+  // [0-9a-z], matching the actual CUID v1 base36 format. See #3621.
+  const previouslyAcceptedNonCuids = [
+    "cly63t164000245zw008pggon';select1;", // SQLi-shaped (no whitespace, no hyphen)
+    "c<script>alert(1)</script>aaaaaa", // XSS-shaped
+    "c{};alert(1)//", // bracket / curly chars
+    "C0123_45678", // underscore is not base36
+    "cAAAAAAAAA", // uppercase letters in body are not base36 (CUIDs are lowercase)
+  ];
+  for (const s of previouslyAcceptedNonCuids) {
+    expect(cuid.safeParse(s).success).toBe(false);
+  }
 });
 
 test("cuid2", () => {
@@ -811,6 +841,25 @@ test("min max getters", () => {
   expect(z.string().maxLength).toEqual(null);
 });
 
+test("boundary cases with zero length", () => {
+  // Test length(0) - only empty string should pass
+  const lengthZero = z.string().length(0);
+  expect(lengthZero.parse("")).toEqual("");
+  expect(() => lengthZero.parse("a")).toThrow();
+
+  // Test min(0) - all strings including empty should pass
+  const minZero = z.string().min(0);
+  expect(minZero.parse("")).toEqual("");
+  expect(minZero.parse("a")).toEqual("a");
+  expect(minZero.parse("hello")).toEqual("hello");
+
+  // Test max(0) - only empty string should pass
+  const maxZero = z.string().max(0);
+  expect(maxZero.parse("")).toEqual("");
+  expect(() => maxZero.parse("a")).toThrow();
+  expect(() => maxZero.parse("hello")).toThrow();
+});
+
 test("trim", () => {
   expect(z.string().trim().min(2).parse(" 12 ")).toEqual("12");
 

package/node_modules/@relaycast/sdk/node_modules/zod/src/v4/classic/tests/template-literal.test.ts

@@ -482,7 +482,7 @@ test("template literal parsing - failure - basic cases", () => {
   expect(() => nullishBruh.parse("1null")).toThrow();
   expect(() => nullishBruh.parse("undefined")).toThrow();
   expect(() => cuid.parse("bjld2cyuq0000t3rmniod1foy")).toThrow();
-  expect(() => cuid.parse("cjld2cyu")).toThrow();
+  expect(() => cuid.parse("cjld2")).toThrow();
   expect(() => cuid.parse("cjld2 cyu")).toThrow();
   expect(() => cuid.parse("cjld2cyuq0000t3rmniod1foy ")).toThrow();
   expect(() => cuid.parse("1cjld2cyuq0000t3rmniod1foy")).toThrow();
@@ -555,8 +555,8 @@ test("regexes", () => {
   expect(optionalNumber._zod.pattern.source).toMatchInlineSnapshot(`"^(-?\\d+(?:\\.\\d+)?)?$"`);
   expect(nullishBruh._zod.pattern.source).toMatchInlineSnapshot(`"^(((bruh)|null))?$"`);
   expect(nullishString._zod.pattern.source).toMatchInlineSnapshot(`"^(([\\s\\S]{0,}|null))?$"`);
-  expect(cuid._zod.pattern.source).toMatchInlineSnapshot(`"^[cC][^\\s-]{8,}$"`);
-  expect(cuidZZZ._zod.pattern.source).toMatchInlineSnapshot(`"^[cC][^\\s-]{8,}ZZZ$"`);
+  expect(cuid._zod.pattern.source).toMatchInlineSnapshot(`"^[cC][0-9a-z]{6,}$"`);
+  expect(cuidZZZ._zod.pattern.source).toMatchInlineSnapshot(`"^[cC][0-9a-z]{6,}ZZZ$"`);
   expect(cuid2._zod.pattern.source).toMatchInlineSnapshot(`"^[0-9a-z]+$"`);
   expect(datetime._zod.pattern.source).toMatchInlineSnapshot(
     `"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"`
@@ -717,7 +717,7 @@ test("template literal parsing - failure - issue format", () => {
       {
         "code": "invalid_format",
         "format": "template_literal",
-        "pattern": "^[cC][^\\\\s-]{8,}ZZZ$",
+        "pattern": "^[cC][0-9a-z]{6,}ZZZ$",
         "path": [],
         "message": "Invalid input"
       }