cross-seed 7.0.0-21 → 7.0.0-23

package/node_modules/zod/src/v4/classic/tests/readonly.test.ts

@@ -50,74 +50,6 @@ test("flat inference", () => {
   expectTypeOf<typeof readonlyPromise._output>().toEqualTypeOf<Promise<string>>();
 });
 
-// test("deep inference", () => {
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[0]>>().toEqualTypeOf<string>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[1]>>().toEqualTypeOf<number>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[2]>>().toEqualTypeOf<number>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[3]>>().toEqualTypeOf<bigint>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[4]>>().toEqualTypeOf<boolean>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[5]>>().toEqualTypeOf<Date>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[6]>>().toEqualTypeOf<undefined>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[7]>>().toEqualTypeOf<null>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[8]>>().toEqualTypeOf<any>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[9]>
-//   >().toEqualTypeOf<Readonly<unknown>>();
-//   expectTypeOf<z.infer<(typeof deepReadonlySchemas_0)[10]>>().toEqualTypeOf<void>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[11]>
-//   >().toEqualTypeOf<(args_0: string, args_1: number, ...args_2: unknown[]) => unknown>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[12]>
-//   >().toEqualTypeOf<readonly string[]>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[13]>
-//   >().toEqualTypeOf<readonly [string, number]>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[14]>
-//   >().toEqualTypeOf<ReadonlyMap<string, Date>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[15]>
-//   >().toEqualTypeOf<ReadonlySet<Promise<string>>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[16]>
-//   >().toEqualTypeOf<Readonly<Record<string, string>>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[17]>
-//   >().toEqualTypeOf<Readonly<Record<string, number>>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[18]>
-//   >().toEqualTypeOf<{ readonly a: string; readonly 1: number }>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[19]>
-//   >().toEqualTypeOf<Readonly<testEnum>>();
-//   expectTypeOf<
-//     z.infer<(typeof deepReadonlySchemas_0)[20]>
-//   >().toEqualTypeOf<Promise<string>>();
-
-//   expectTypeOf<
-//     z.infer<typeof crazyDeepReadonlySchema>
-//   >().toEqualTypeOf<ReadonlyMap<
-//     ReadonlySet<readonly [string, number]>,
-//     {
-//       readonly a: {
-//         readonly [x: string]: readonly any[];
-//       };
-//       readonly b: {
-//         readonly c: {
-//           readonly d: {
-//             readonly e: {
-//               readonly f: {
-//                 readonly g?: {};
-//               };
-//             };
-//           };
-//         };
-//       };
-//     }
-//   >>();
-// });
-
 test("object freezing", async () => {
   expect(Object.isFrozen(z.array(z.string()).readonly().parse(["a"]))).toBe(true);
   expect(Object.isFrozen(z.tuple([z.string(), z.number()]).readonly().parse(["a", 1]))).toBe(true);

package/node_modules/zod/src/v4/classic/tests/record.test.ts

@@ -76,6 +76,37 @@ test("enum exhaustiveness", () => {
   `);
 });
 
+test("optional-in value type", () => {
+  const defaulted = z.record(z.enum(["Tuna", "Salmon"]), z.string().default("unknown"));
+  expectTypeOf<z.input<typeof defaulted>>().toEqualTypeOf<Partial<Record<"Tuna" | "Salmon", string | undefined>>>();
+  expectTypeOf<z.output<typeof defaulted>>().toEqualTypeOf<Record<"Tuna" | "Salmon", string>>();
+  expect(defaulted.parse({ Tuna: "asdf" })).toEqual({ Tuna: "asdf", Salmon: "unknown" });
+
+  const prefaulted = z.record(z.enum(["Tuna", "Salmon"]), z.string().prefault("unknown"));
+  expectTypeOf<z.input<typeof prefaulted>>().toEqualTypeOf<Partial<Record<"Tuna" | "Salmon", string | undefined>>>();
+  expect(prefaulted.parse({ Tuna: "asdf" })).toEqual({ Tuna: "asdf", Salmon: "unknown" });
+
+  const optional = z.record(z.enum(["Tuna", "Salmon"]), z.string().optional());
+  expectTypeOf<z.input<typeof optional>>().toEqualTypeOf<Partial<Record<"Tuna" | "Salmon", string | undefined>>>();
+  // toStrictEqual, not toEqual: an exhaustive record assigns every key, and toEqual cannot tell an absent key from one holding undefined.
+  expect(optional.parse({ Tuna: "asdf" })).toStrictEqual({ Tuna: "asdf", Salmon: undefined });
+
+  // A value that needs a slot keeps the key required, and a non-enumerable key stays an index signature either way.
+  const required = z.record(z.enum(["Tuna", "Salmon"]), z.string());
+  expectTypeOf<z.input<typeof required>>().toEqualTypeOf<Record<"Tuna" | "Salmon", string>>();
+  const indexed = z.record(z.string(), z.string().default("unknown"));
+  expectTypeOf<z.input<typeof indexed>>().toEqualTypeOf<Record<string, string | undefined>>();
+
+  // A catch and a preprocess pipe declare no static optin, so the key stays required even where the parser can fill it. The static predicate and the one the JSON Schema emitter uses resolve these differently, and the two have to keep agreeing.
+  const caught = z.record(z.enum(["Tuna", "Salmon"]), z.string().catch("unknown"));
+  expectTypeOf<z.input<typeof caught>>().toEqualTypeOf<Record<"Tuna" | "Salmon", string>>();
+  const preprocessed = z.record(
+    z.enum(["Tuna", "Salmon"]),
+    z.preprocess((v) => v, z.string())
+  );
+  expectTypeOf<z.input<typeof preprocessed>>().toEqualTypeOf<Record<"Tuna" | "Salmon", unknown>>();
+});
+
 test("typescript enum exhaustiveness", () => {
   enum BigFish {
     Tuna = 0,
@@ -272,6 +303,67 @@ test("union exhaustiveness", () => {
   `);
 });
 
+test("applies transforms on the key schema (#5296)", () => {
+  const single = z.record(
+    z.literal("a").transform(() => "b" as const),
+    z.string()
+  );
+  expect(single.parse({ a: "John" })).toEqual({ b: "John" });
+
+  const multi = z.record(
+    z.literal(["a", "b"]).transform((k) => k.toUpperCase()),
+    z.number()
+  );
+  expect(multi.parse({ a: 1, b: 2 })).toEqual({ A: 1, B: 2 });
+
+  // required-key semantics still hold when the keyType has a known value set
+  expect(multi.safeParse({ a: 1 }).success).toBe(false);
+
+  const en = z.record(
+    z.enum(["a", "b"]).transform((k) => k.toUpperCase()),
+    z.number()
+  );
+  expect(en.parse({ a: 1, b: 2 })).toEqual({ A: 1, B: 2 });
+
+  // matches partialRecord, which already applied transforms
+  const part = z.partialRecord(
+    z.literal("a").transform(() => "b" as const),
+    z.string()
+  );
+  expect(part.parse({ a: "John" })).toEqual({ b: "John" });
+});
+
+test("surfaces key schema refinement failures as invalid_key", () => {
+  // refine rejects "b" but it's still in the literal's value set
+  const schema = z.record(
+    z.literal(["a", "b"]).refine((k) => k === "a", { message: "only 'a' is allowed" }),
+    z.string()
+  );
+
+  expect(schema.safeParse({ a: "ok", b: "nope" })).toMatchInlineSnapshot(`
+    {
+      "error": [ZodError: [
+      {
+        "code": "invalid_key",
+        "origin": "record",
+        "issues": [
+          {
+            "code": "custom",
+            "path": [],
+            "message": "only 'a' is allowed"
+          }
+        ],
+        "path": [
+          "b"
+        ],
+        "message": "Invalid key in record"
+      }
+    ]],
+      "success": false,
+    }
+  `);
+});
+
 test("string record parse - pass", () => {
   const schema = z.record(z.string(), z.boolean());
   schema.parse({
@@ -341,6 +433,44 @@ test("is not vulnerable to prototype pollution", async () => {
   }
 });
 
+test("key schema cannot normalize an input key into __proto__", async () => {
+  const value = z.object({ a: z.string() });
+  const payload = { a: "evil" };
+  const wire = (key: string) => JSON.parse(JSON.stringify({ [key]: payload }));
+
+  const cases = [
+    [z.record(z.string().toLowerCase(), value), wire("__PROTO__")],
+    [z.record(z.string().trim(), value), wire(" __proto__ ")],
+    [z.record(z.string().normalize("NFKC"), value), wire("＿＿ｐｒｏｔｏ＿＿")],
+    [
+      z.record(
+        z.string().transform((s) => s.slice(2)),
+        value
+      ),
+      wire("x:__proto__"),
+    ],
+  ] as const;
+
+  for (const [schema, data] of cases) {
+    const result = schema.parse(data);
+    expect(Object.getPrototypeOf(result)).toBe(Object.prototype);
+    expect(Object.keys(result)).toEqual([]);
+    expect((result as any).a).toBeUndefined();
+
+    expect(Object.getPrototypeOf(await schema.parseAsync(data))).toBe(Object.prototype);
+  }
+
+  // an async value schema takes the promise write path
+  const asyncValue = z.record(
+    z.string().toLowerCase(),
+    value.refine(async () => true)
+  );
+  expect(Object.getPrototypeOf(await asyncValue.parseAsync(wire("__PROTO__")))).toBe(Object.prototype);
+
+  // ordinary normalization still lands as an own key
+  expect(z.record(z.string().toLowerCase(), value).parse({ KEY: payload })).toEqual({ key: payload });
+});
+
 test("dont remove undefined values", () => {
   const result1 = z.record(z.string(), z.any()).parse({ foo: undefined });
 
@@ -462,24 +592,12 @@ test("partialRecord with z.literal([key, ...])", () => {
     {
       "error": [ZodError: [
       {
-        "code": "invalid_key",
-        "origin": "record",
-        "issues": [
-          {
-            "code": "invalid_value",
-            "values": [
-              "id",
-              "name",
-              "email"
-            ],
-            "path": [],
-            "message": "Invalid option: expected one of \\"id\\"|\\"name\\"|\\"email\\""
-          }
-        ],
-        "path": [
+        "code": "unrecognized_keys",
+        "keys": [
           "foo"
         ],
-        "message": "Invalid key in record"
+        "path": [],
+        "message": "Unrecognized key: \\"foo\\""
       }
     ]],
       "success": false,
@@ -532,6 +650,45 @@ test("looseRecord passes through non-matching keys", () => {
   expect(schema.parse({ other: "value" })).toEqual({ other: "value" });
 });
 
+test("looseRecord with closed key schema passes through unrecognized keys", () => {
+  const enumSchema = z.looseRecord(z.enum(["foo", "bar"]), z.any());
+  expect(enumSchema.parse({ foo: 123, bar: {}, baz: null })).toEqual({
+    foo: 123,
+    bar: {},
+    baz: null,
+  });
+
+  const literalSchema = z.looseRecord(z.literal(["foo", "bar"]), z.any());
+  expect(literalSchema.parse({ foo: 123, bar: {}, baz: null })).toEqual({
+    foo: 123,
+    bar: {},
+    baz: null,
+  });
+
+  // Recognized keys are still validated
+  const validated = z.looseRecord(z.enum(["foo", "bar"]), z.string());
+  expect(validated.parse({ foo: "ok", bar: "ok", baz: 123 })).toEqual({
+    foo: "ok",
+    bar: "ok",
+    baz: 123,
+  });
+  expect(() => validated.parse({ foo: 123 })).toThrow();
+});
+
+test("record with closed key schema still rejects unrecognized keys", () => {
+  const schema = z.record(z.enum(["foo", "bar"]), z.any());
+  expect(schema.safeParse({ foo: 123, bar: {}, baz: null }).success).toBe(false);
+});
+
+// __proto__ in input must not replace the prototype of the parsed object via the assignment setter on the result {}. https://github.com/colinhacks/zod/security/advisories/GHSA-r34p-xfmx-58wv
+test("looseRecord with closed key schema drops __proto__", () => {
+  const schema = z.looseRecord(z.enum(["foo", "bar"]), z.any());
+  const parsed = schema.parse(JSON.parse('{"foo":1,"bar":2,"__proto__":{"isAdmin":true}}'));
+  expect(Object.keys(parsed)).toEqual(["foo", "bar"]);
+  expect((parsed as any).isAdmin).toBeUndefined();
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+});
+
 test("intersection of loose records", () => {
   const schema = z.intersection(
     z.object({ name: z.string() }).passthrough(),
@@ -630,3 +787,99 @@ test("numeric string keys", () => {
   );
   expect(transformedSchema.parse({ 5: "five", 10: "ten" })).toEqual({ 10: "five", 20: "ten" });
 });
+
+test("v3-compat single-arg form: z.record(valueType)", () => {
+  // single arg should default keyType to z.string() and use the arg as valueType
+  const schema = (z.record as any)(z.number());
+  expect(schema.keyType._zod.def.type).toEqual("string");
+  expect(schema.valueType._zod.def.type).toEqual("number");
+
+  expect(schema.parse({ a: 1, b: 2 })).toEqual({ a: 1, b: 2 });
+  expect(schema.safeParse({ a: "x" }).success).toBe(false);
+
+  // params still flow through in the single-arg form
+  const withMessage = (z.record as any)(z.number(), "must be a number record");
+  expect(withMessage.keyType._zod.def.type).toEqual("string");
+  expect(withMessage.valueType._zod.def.type).toEqual("number");
+
+  // toJSONSchema should produce a well-formed schema (regression: previously produced additionalProperties from undefined valueType, crashing process())
+  const json = z.toJSONSchema(schema);
+  expect(json).toMatchObject({
+    type: "object",
+    propertyNames: { type: "string" },
+    additionalProperties: { type: "number" },
+  });
+});
+
+test("__proto__ in a finite key set is stripped", () => {
+  const data = JSON.parse('{"__proto__":{"a":"declared"},"b":{"a":"good"}}');
+
+  for (const schema of [
+    z.record(z.enum(["__proto__", "b"]), z.object({ a: z.string() })),
+    z.record(z.literal(["__proto__", "b"]), z.object({ a: z.string() })),
+  ]) {
+    const parsed: any = schema.parse(data);
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+    expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+    expect(Object.keys(parsed)).toEqual(["b"]);
+    expect(parsed.a).toBeUndefined();
+  }
+
+  expect(({} as any).a).toBeUndefined();
+});
+
+test("a raw __proto__ input key stays skipped in loose mode", () => {
+  const parsed: any = z.looseRecord(z.iso.datetime(), z.unknown()).parse(JSON.parse('{"__proto__":{"a":1}}'));
+
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+});
+
+test("partialRecord strips a declared __proto__ key", () => {
+  const schema = z.partialRecord(z.enum(["__proto__", "b"]), z.string());
+  const parsed: any = schema.parse(Object.fromEntries([["__proto__", "declared"]]));
+
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+  expect(parsed).toEqual({});
+  expect(schema.parse({})).toEqual({});
+  expect(schema.safeParse({ other: "x" }).success).toBe(false);
+});
+
+test("partialRecord strips a declared __proto__ key in loose mode", () => {
+  const key = z.enum(["__proto__"]).refine(() => false);
+  const schema = z.partialRecord(key, z.unknown(), { mode: "loose" });
+  const value = { marker: true };
+  const parsed: any = schema.parse(Object.fromEntries([["__proto__", value]]));
+
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+  expect(parsed).toEqual({});
+  expect(parsed.marker).toBeUndefined();
+});
+
+test("partial is internal to partialRecord", () => {
+  // @ts-expect-error partial is not a public record parameter
+  z.record(z.enum(["a"]), z.string(), { partial: true });
+
+  const schema = z.partialRecord(z.enum(["a"]), z.string(), { partial: false } as any);
+  expect(schema.parse({})).toEqual({});
+});
+
+test("partialRecord strips a declared __proto__ key before transforms", () => {
+  const schema = z.partialRecord(
+    z.literal("__proto__").transform(() => "safe" as const),
+    z.string()
+  );
+
+  expect(schema.parse(Object.fromEntries([["__proto__", "value"]]))).toEqual({});
+});
+
+test("a finite __proto__ key is ignored whether present or missing", () => {
+  const schema = z.record(z.enum(["__proto__"]), z.string());
+  const parsed: any = schema.parse({});
+
+  expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+  expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+  expect(schema.parse(Object.fromEntries([["__proto__", 123]]))).toEqual({});
+});

package/node_modules/zod/src/v4/classic/tests/recursive-types.test.ts

@@ -1,6 +1,51 @@
 import { expect, expectTypeOf, test } from "vitest";
 import { z } from "zod/v4";
 
+test("recursive object schema type aliases", () => {
+  type ObjectField = z.ZodObject<{ [k: string]: ObjectField }>;
+  type MixedField = z.ZodString | z.ZodObject<{ [k: string]: MixedField }>;
+  expectTypeOf<ObjectField>().toExtend<z.ZodType>();
+  expectTypeOf<MixedField>().toExtend<z.ZodType>();
+
+  type ObjectValue = { [k: string]: ObjectValue };
+  type MixedValue = string | { [k: string]: MixedValue };
+  expectTypeOf<z.input<ObjectField>>().toEqualTypeOf<ObjectValue>();
+  expectTypeOf<z.output<ObjectField>>().toEqualTypeOf<ObjectValue>();
+  expectTypeOf<z.input<MixedField>>().toEqualTypeOf<MixedValue>();
+  expectTypeOf<z.output<MixedField>>().toEqualTypeOf<MixedValue>();
+
+  const schema: MixedField = z.object({ name: z.string(), nested: z.object({ name: z.string() }) });
+  expect(schema.parse({ name: "a", nested: { name: "b", extra: true } })).toEqual({
+    name: "a",
+    nested: { name: "b" },
+  });
+  expect(schema.safeParse({ name: "a", nested: { name: 123 } }).success).toBe(false);
+
+  type CoreField = z.core.$ZodString<string> | z.core.$ZodObject<{ [k: string]: CoreField }>;
+  expectTypeOf<z.input<CoreField>>().toEqualTypeOf<MixedValue>();
+  expectTypeOf<z.output<CoreField>>().toEqualTypeOf<MixedValue>();
+});
+
+test("recursive object aliases preserve distinct input and output", () => {
+  type Field = z.ZodPipe<z.ZodString, z.ZodTransform<number, string>> | z.ZodObject<{ [k: string]: Field }>;
+  type Input = string | { [k: string]: Input };
+  type Output = number | { [k: string]: Output };
+  expectTypeOf<z.input<Field>>().toEqualTypeOf<Input>();
+  expectTypeOf<z.output<Field>>().toEqualTypeOf<Output>();
+  const schema: Field = z.object({ nested: z.object({ length: z.string().transform((s) => s.length) }) });
+  expect(schema.parse({ nested: { length: "abc" } })).toEqual({ nested: { length: 3 } });
+  expect(schema.safeParse({ nested: { length: 3 } }).success).toBe(false);
+});
+
+test("indexed object inference preserves string keys", () => {
+  type Indexed = z.ZodObject<Record<string, z.ZodString>>;
+  type Recursive = z.ZodObject<Record<string, Recursive>>;
+  expectTypeOf<keyof z.input<Indexed>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.output<Indexed>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.input<Recursive>>().toEqualTypeOf<string>();
+  expectTypeOf<keyof z.output<Recursive>>().toEqualTypeOf<string>();
+});
+
 test("recursion with z.lazy", () => {
   const data = {
     name: "I",
@@ -135,6 +180,10 @@ test("pick and omit with getter", () => {
   }
   expectTypeOf<Category>().toEqualTypeOf<_Category>();
 
+  // Shape should not surface `readonly` modifiers from getter-defined keys. object/strictObject/looseObject all pass shape through util.Writeable<T>.
+  type Shape = (typeof Category)["shape"];
+  expectTypeOf<Shape>().toEqualTypeOf<{ name: z.ZodString; subcategories: z.ZodArray<typeof Category> }>();
+
   const PickedCategory = Category.pick({ name: true });
   const OmittedCategory = Category.omit({ subcategories: true });
 
@@ -148,6 +197,50 @@ test("pick and omit with getter", () => {
   expect(() => OmittedCategory.parse({ name: "test", subcategories: [] })).toThrow();
 });
 
+test("shape stays writeable through extend/safeExtend/partial/required", () => {
+  const Base = z.object({ name: z.string() });
+
+  const Extended = Base.extend({
+    get sub() {
+      return z.array(Extended);
+    },
+  });
+  type ExtendedShape = (typeof Extended)["shape"];
+  expectTypeOf<ExtendedShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    sub: z.ZodArray<typeof Extended>;
+  }>();
+
+  const SafeExt = Base.safeExtend({ extra: z.string() } as const);
+  type SafeExtShape = (typeof SafeExt)["shape"];
+  expectTypeOf<SafeExtShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    extra: z.ZodString;
+  }>();
+
+  const FromConst = Base.extend({ a: z.string(), b: z.number() } as const);
+  type FromConstShape = (typeof FromConst)["shape"];
+  expectTypeOf<FromConstShape>().toEqualTypeOf<{
+    name: z.ZodString;
+    a: z.ZodString;
+    b: z.ZodNumber;
+  }>();
+
+  const PartialExtended = Extended.partial();
+  type PartialShape = (typeof PartialExtended)["shape"];
+  expectTypeOf<PartialShape>().toEqualTypeOf<{
+    name: z.ZodOptional<z.ZodString>;
+    sub: z.ZodOptional<z.ZodArray<typeof Extended>>;
+  }>();
+
+  const RequiredExtended = Extended.required();
+  type RequiredShape = (typeof RequiredExtended)["shape"];
+  expectTypeOf<RequiredShape>().toEqualTypeOf<{
+    name: z.ZodNonOptional<z.ZodString>;
+    sub: z.ZodNonOptional<z.ZodArray<typeof Extended>>;
+  }>();
+});
+
 test("deferred self-recursion", () => {
   const Feature = z.object({
     title: z.string(),
@@ -508,7 +601,7 @@ test("recursive object with .check()", () => {
   expect(() => Category.parse(invalidData)).toThrow();
 });
 
-// biome-ignore lint: sadf
+// biome-ignore lint/suspicious/noExportsInTest: unexported it trips noUnusedVariables instead
 export type RecursiveA = z.ZodUnion<
   [
     z.ZodObject<{
@@ -580,3 +673,35 @@ test("recursive type with `id` meta", () => {
     },
   });
 });
+
+test("mutual recursion through discriminatedUnion getter", () => {
+  const variantA = z.object({
+    kind: z.literal("a"),
+    get child() {
+      return tree.optional();
+    },
+  });
+
+  const variantB = z.object({
+    kind: z.literal("b"),
+    get sibling() {
+      return tree.optional();
+    },
+  });
+
+  const tree = z.discriminatedUnion("kind", [variantA, variantB]);
+
+  type _Tree = { kind: "a"; child?: _Tree | undefined } | { kind: "b"; sibling?: _Tree | undefined };
+
+  const treeUnion = z.union([variantA, variantB]);
+
+  expectTypeOf<z.input<typeof tree>>().toEqualTypeOf<_Tree>();
+  expectTypeOf<z.input<typeof tree>>().not.toBeAny();
+  expectTypeOf<z.input<typeof tree>>().toEqualTypeOf<z.input<typeof treeUnion>>();
+
+  expect(tree.parse({ kind: "a", child: { kind: "b", sibling: { kind: "a" } } })).toEqual({
+    kind: "a",
+    child: { kind: "b", sibling: { kind: "a" } },
+  });
+  expect(() => tree.parse({ kind: "c" })).toThrow();
+});

package/node_modules/zod/src/v4/classic/tests/redos.test.ts

@@ -0,0 +1,68 @@
+import { checkSync } from "recheck";
+import { expect, test } from "vitest";
+import * as z from "zod/v4";
+
+const { regexes } = z.core;
+
+/** Every pattern `core/regexes.ts` ships, with the parameterized ones materialized across their argument space. */
+function allPatterns(): [string, RegExp][] {
+  const patterns: [string, RegExp][] = [];
+  for (const [name, value] of Object.entries(regexes)) {
+    if (value instanceof RegExp) patterns.push([name, value]);
+  }
+
+  patterns.push(
+    ["emoji()", regexes.emoji()],
+    ["mac()", regexes.mac()],
+    ["mac('-')", regexes.mac("-")],
+    ["uuid()", regexes.uuid()],
+    ["string()", regexes.string()],
+    ["string({min,max})", regexes.string({ minimum: 1, maximum: 10 })]
+  );
+  for (const version of [1, 2, 3, 4, 5, 6, 7, 8]) patterns.push([`uuid(${version})`, regexes.uuid(version)]);
+  for (const precision of [null, -1, 0, 3, 6]) {
+    patterns.push([`time(${precision})`, regexes.time({ precision })]);
+    for (const local of [false, true]) {
+      for (const offset of [false, true]) {
+        patterns.push([`datetime(${precision},${local},${offset})`, regexes.datetime({ precision, local, offset })]);
+      }
+    }
+  }
+  return patterns;
+}
+
+test("no built-in pattern is ReDoS-vulnerable", () => {
+  const patterns = allPatterns();
+  // Guards against the reflection above silently going empty if the module layout changes.
+  expect(patterns.length).toBeGreaterThan(80);
+
+  const vulnerable: string[] = [];
+  for (const [name, pattern] of patterns) {
+    // Flags are load-bearing. Without "u" the checker reads `\p{...}` as a literal `p{...}` and reports an exponential pattern as safe.
+    const result = checkSync(pattern.source, pattern.flags);
+    // "unknown" means the checker gave up, not that the pattern is vulnerable.
+    if (result.status !== "vulnerable") continue;
+    // The fuzz checker derives "vulnerable" from how long an attack string runs, so CPU contention from parallel test files can flip a safe pattern. Confirm with a budget large enough that only real backtracking can exhaust it.
+    const confirmed = checkSync(pattern.source, pattern.flags, { attackTimeout: 10_000 });
+    if (confirmed.status === "vulnerable") vulnerable.push(`${name}: ${pattern.source}`);
+  }
+  expect(vulnerable).toEqual([]);
+}, 60000);
+
+test("emoji rejects a backtracking payload in linear time", () => {
+  // U+1F9B0-U+1F9B3 are the only code points in both \p{Extended_Pictographic} and \p{Emoji_Component}. A failing match over them used to backtrack exponentially: 26 of them took ~1.9s, and each additional character roughly doubled it.
+  const schema = z.emoji();
+  const payload = `${"🦰".repeat(26)} `;
+
+  // Warm up first, then take the best of three: a cold first call is dominated by JIT and can cost hundreds of times the steady-state match on a loaded machine.
+  expect(schema.safeParse(payload).success).toBe(false);
+  let best = Number.POSITIVE_INFINITY;
+  for (let i = 0; i < 3; i++) {
+    const start = performance.now();
+    schema.safeParse(payload);
+    best = Math.min(best, performance.now() - start);
+  }
+
+  // The linear pattern matches in well under a millisecond, so this budget leaves three orders of magnitude of headroom for CPU contention while still catching the exponential regression.
+  expect(best).toBeLessThan(500);
+});