cross-seed 7.0.0-21 → 7.0.0-23

package/node_modules/zod/src/v4/classic/tests/refine.test.ts

@@ -338,6 +338,66 @@ describe("superRefine functionality", () => {
     }
   });
 
+  test("should preserve explicit nullish issue input", () => {
+    const schema = z.string().superRefine((_, ctx) => {
+      ctx.addIssue({ code: "custom", message: "default" });
+      ctx.addIssue({ code: "custom", message: "null", input: null });
+      ctx.addIssue({ code: "custom", message: "undefined", input: undefined });
+    });
+
+    const result = schema.safeParse("sensitive", { reportInput: true });
+    expect(result.success).toEqual(false);
+    if (!result.success) {
+      expect(result.error.issues).toHaveLength(3);
+      expect(result.error.issues[0].input).toEqual("sensitive");
+      expect(result.error.issues[1].input).toEqual(null);
+      expect(result.error.issues[2]).toHaveProperty("input");
+      expect(result.error.issues[2].input).toEqual(undefined);
+    }
+  });
+
+  test("should keep issue input aligned with the issue path", () => {
+    const nested = z.object({ a: z.string().nullable() }).superRefine((val, ctx) => {
+      if (val.a === null) ctx.addIssue({ code: "custom", path: ["a"], input: val.a, message: "no null" });
+    });
+
+    const direct = nested.safeParse({ a: null }, { reportInput: true });
+    expect(direct.success).toEqual(false);
+    if (!direct.success) {
+      expect(direct.error.issues[0].path).toEqual(["a"]);
+      expect(direct.error.issues[0].input).toEqual(null);
+    }
+
+    // Forwarding a nested parse's issues must not overwrite their input with the outer payload.
+    const inner = z.object({ x: z.string() });
+    const forwarding = z.unknown().superRefine((val, ctx) => {
+      const result = inner.safeParse(val, { reportInput: true });
+      if (!result.success) {
+        for (const iss of result.error.issues) {
+          ctx.addIssue({ code: "custom", path: iss.path, input: iss.input, message: iss.message });
+        }
+      }
+    });
+
+    const forwarded = forwarding.safeParse({}, { reportInput: true });
+    expect(forwarded.success).toEqual(false);
+    if (!forwarded.success) {
+      expect(forwarded.error.issues[0].path).toEqual(["x"]);
+      expect(forwarded.error.issues[0]).toHaveProperty("input");
+      expect(forwarded.error.issues[0].input).toEqual(undefined);
+    }
+  });
+
+  test("should surface an explicit undefined input to the error map", () => {
+    const schema = z.object({ a: z.string().optional() }).superRefine((val, ctx) => {
+      if (!val.a) ctx.addIssue({ code: "custom", path: ["a"], input: val.a });
+    });
+
+    const result = schema.safeParse({}, { error: (iss) => (iss.input === undefined ? "Required" : "Invalid") });
+    expect(result.success).toEqual(false);
+    if (!result.success) expect(result.error.issues[0].message).toEqual("Required");
+  });
+
   test("should respect fatal flag in superRefine", () => {
     const schema = z
       .string()
@@ -414,6 +474,69 @@ describe("chained refinements", () => {
     };
     expect(objectSchema.parse(validData)).toEqual(validData);
   });
+
+  test("should run superRefine validation even when base schema validation fails when 'when' is defined and returns true", () => {
+    const baseSchema = z.object({
+      foo: z.number(),
+      bar: z.number(),
+    });
+
+    const schema = baseSchema.superRefine(
+      (data, ctx) => {
+        if (data.foo > 10) {
+          ctx.addIssue({
+            code: "custom",
+            message: "foo must be less than 10",
+          });
+        }
+      },
+      {
+        when: ({ value }) => baseSchema.pick({ foo: true }).safeParse(value).success,
+      }
+    );
+
+    const result = schema.safeParse({
+      foo: 11,
+    });
+    expect(result.success).toEqual(false);
+
+    if (!result.success) {
+      expect(result.error.issues.length).toEqual(2);
+      expect(result.error.issues[0].message).toEqual("Invalid input: expected number, received undefined");
+      expect(result.error.issues[1].message).toEqual("foo must be less than 10");
+    }
+  });
+
+  test("should not run superRefine validation when 'when' is defined and returns false", () => {
+    const baseSchema = z.object({
+      foo: z.number(),
+      bar: z.number(),
+    });
+
+    const schema = baseSchema.superRefine(
+      (data, ctx) => {
+        if (data.foo > 10) {
+          ctx.addIssue({
+            code: "custom",
+            message: "foo must be less than 10",
+          });
+        }
+      },
+      {
+        when: ({ value }) => baseSchema.safeParse(value).success,
+      }
+    );
+
+    const result = schema.safeParse({
+      foo: 11,
+    });
+    expect(result.success).toEqual(false);
+
+    if (!result.success) {
+      expect(result.error.issues.length).toEqual(1);
+      expect(result.error.issues[0].message).toEqual("Invalid input: expected number, received undefined");
+    }
+  });
 });
 
 describe("type refinement with type guards", () => {

package/node_modules/zod/src/v4/classic/tests/set.test.ts

@@ -83,6 +83,21 @@ test("failing when set is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  expect(
+    z
+      .set(z.string())
+      .max(1)
+      .safeParse(new Set([1, 2])).error!.issues
+  ).toMatchObject([{ code: "too_big" }]);
+});
+
+test("failing when set does not match size() ", () => {
+  expect(justTwo.safeParse(new Set(["one"])).error!.issues[0].message).toEqual(
+    "Too small: expected set to have exactly 2 items"
+  );
+  expect(justTwo.safeParse(new Set(["one", "two", "three"])).error!.issues[0].message).toEqual(
+    "Too big: expected set to have exactly 2 items"
+  );
 });
 
 test("doesn’t throw when an empty set is given", () => {

package/node_modules/zod/src/v4/classic/tests/standard-schema.test.ts

@@ -132,3 +132,22 @@ test("z.toJSONSchema() returns StandardJSONSchemaV1", async () => {
 		}
 	`);
 });
+
+test("a failing validate reports the same issues as safeParse, without a ZodError", async () => {
+  const schema = z.object({ name: z.string().min(3), age: z.number().refine(async (n) => n > 0) });
+  const input = { name: "ab", age: -1 };
+  const result = (await schema["~standard"].validate(input)) as { issues: unknown[] };
+  expect(result.issues).toEqual((await schema.safeParseAsync(input)).error!.issues);
+  expect(result).not.toHaveProperty("error");
+  const sync = z.string().min(3)["~standard"].validate("ab") as { issues: unknown[] };
+  expect(sync.issues).toEqual(z.string().min(3).safeParse("ab").error!.issues);
+});
+
+test("a synchronously throwing check rejects through ~standard instead of throwing", async () => {
+  const schema = z.string().refine(() => {
+    throw new Error("boom");
+  });
+  const result = schema["~standard"].validate("abc");
+  expect(result).toBeInstanceOf(Promise);
+  await expect(result as Promise<unknown>).rejects.toThrow("boom");
+});

package/node_modules/zod/src/v4/classic/tests/string.test.ts

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { expect, test } from "vitest";
+import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
@@ -12,6 +12,63 @@ const includesFromIndex2 = z.string().includes("includes", { position: 2 });
 const startsWith = z.string().startsWith("startsWith");
 const endsWith = z.string().endsWith("endsWith");
 
+test("string factory checks", async () => {
+  const schema = z.string({ checks: [z.minLength(1), z.maxLength(3)] as const });
+  const chained = z.string().min(1).max(3);
+  expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<string>();
+  for (const value of ["", "ab", "abcd", 1, undefined]) {
+    expect(z.validate(schema, value)).toBe(z.validate(chained, value));
+    expect(schema.safeParse(value)).toEqual(chained.safeParse(value));
+  }
+  expect(z.toJSONSchema(schema)).toEqual(z.toJSONSchema(chained));
+  expect(schema.minLength).toBe(1);
+  expect(schema.maxLength).toBe(3);
+  expect(schema._zod.parent).toBeUndefined();
+  expect([...schema._zod.traits]).toEqual([...chained._zod.traits]);
+  const extended = schema.max(2);
+  expect(extended._zod.parent).toBe(schema);
+  expect(z.validate(schema, "abc")).toBe(true);
+  expect(z.validate(extended, "abc")).toBe(false);
+  const coerce = z.coerce.string({ checks: [z.minLength(2)] });
+  expect(coerce.parse(12)).toBe("12");
+  expect(z.validate(coerce, 1)).toBe(false);
+  const asyncSchema = z.string({
+    checks: [
+      z.check<string>(async (ctx) => {
+        if (ctx.value !== "ok") ctx.issues.push({ code: "custom", input: ctx.value });
+      }),
+    ],
+  });
+  expect(await asyncSchema.safeParseAsync("ok")).toEqual({ success: true, data: "ok" });
+  expect((await asyncSchema.safeParseAsync("bad")).success).toBe(false);
+  // @ts-expect-error numeric checks cannot validate strings
+  z.string({ checks: [z.gte(1)] });
+});
+
+test("factory checks snapshot caller arrays", () => {
+  for (const factory of [z.string, z.coerce.string]) {
+    for (const initial of [[], [z.minLength(1)]]) {
+      const schema = factory({ checks: initial });
+      let reads = 0;
+      const getterSchema = factory({
+        get checks() {
+          if (++reads > 1) throw new Error("checks read twice");
+          return initial;
+        },
+      });
+      expect(reads).toBe(1);
+      expect(z.validate(getterSchema, "long")).toBe(true);
+      const before = z.toJSONSchema(schema);
+      initial.push(z.minLength(10));
+      expect(schema._zod.def.checks).not.toBe(initial);
+      expect(z.validate(schema, "long")).toBe(true);
+      expect(z.validate(z.compile(schema), "long")).toBe(true);
+      expect(z.toJSONSchema(schema)).toEqual(before);
+      expect(z.validate(schema.check(z.minLength(2)), "long")).toBe(true);
+    }
+  }
+});
+
 test("length checks", () => {
   minFive.parse("12345");
   minFive.parse("123456");
@@ -217,6 +274,14 @@ test("base64 validations", () => {
     "?QmFzZTY0IGVuY29kaW5nIGlzIGZ1bg==", // Invalid character '?'
     ".MTIzND2Nzg5MC4=", // Invalid character '.'
     "QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo", // Missing padding
+    // Whitespace is not part of canonical base64 (RFC 4648 §3.3) — atob() strips whitespace internally before validating, so the length check alone would accept "123 " etc.
+    "123 ", // bypasses length-mod-4 via trailing whitespace
+    "SGVsbG8gV29ybGQ= ", // trailing space
+    " SGVsbG8gV29ybGQ=", // leading space
+    "SGVsbG8gV29ybGQ=\n", // trailing newline
+    "SGVs bG8gV29ybGQ=", // internal space
+    "SGVs\nbG8gV29ybGQ=", // internal newline
+    "SGVs\tbG8gV29ybGQ=", // internal tab
   ];
 
   for (const str of invalidBase64Strings) {
@@ -256,6 +321,7 @@ test("base64url validations", () => {
 
   const invalidBase64URLStrings = [
     "w7/Dv8O+w74K", // Has + and / characters (is base64)
+    "A", // Invalid length (1 mod 4 carries no whole byte)
     "12345", // Invalid length (not a multiple of 4 characters when adding allowed number of padding characters)
     "12345===", // Not padded correctly
     "!UGF0aWVuY2UgaXMgdGhlIGtleSB0byBzdWNjZXNz", // Invalid character '!'
@@ -283,6 +349,18 @@ test("big base64 and base64url", () => {
   z.base64().parse(bigbase64);
   const bigbase64url = randomBytes(1024 * 1024 * 10).toString("base64url");
   z.base64url().parse(bigbase64url);
+
+  // template literals compose def.pattern and test it on every parse; the quantified block forms overflowed the regex stack here
+  expect(z.templateLiteral(["id-", z.base64()]).safeParse(`id-${bigbase64}`).success).toBe(true);
+  expect(z.templateLiteral(["id-", z.base64url()]).safeParse(`id-${bigbase64url}`).success).toBe(true);
+});
+
+test("template literal composes base64 without alternation leaks", () => {
+  // the ^$| alternation in regexes.base64 used to leak: "AAAA" matched with the prefix dropped and "id-AAAA" was rejected
+  const tl = z.templateLiteral(["id-", z.base64()]);
+  expect(tl.safeParse("id-AAAA").success).toBe(true);
+  expect(tl.safeParse("id-").success).toBe(true);
+  expect(tl.safeParse("AAAA").success).toBe(false);
 });
 
 function makeJwt(header: object, payload: object) {
@@ -376,6 +454,44 @@ test("url trims whitespace", () => {
   expect(url.parse("https://example.com/path")).toBe("https://example.com/path");
 });
 
+test("url returns the string the parser validated", () => {
+  // The URL parser deletes ASCII tab, LF and CR instead of failing, so `new URL()` reports on a string that is not the one it was given. The host is the consequential case: this validated example.com and used to hand back a URL naming a different host.
+  expect(z.url().parse("https://exa\nmple.com")).toBe("https://example.com");
+  expect(z.url().parse("https://exa\tmple.com")).toBe("https://example.com");
+  expect(z.url().parse("https://exa\rmple.com")).toBe("https://example.com");
+  expect(z.httpUrl().parse("https://exa\nmple.com")).toBe("https://example.com");
+  expect(z.url({ hostname: /^a\.com$/ }).parse("https://a\n.com")).toBe("https://a.com");
+  expect(z.url().parse("https://example.com/a\nb?c=\td#e")).toBe("https://example.com/ab?c=d#e");
+
+  // Nothing that parsed before stops parsing, and normalize still wins where it applies.
+  expect(z.url().parse("https://example.com/path")).toBe("https://example.com/path");
+  expect(z.url({ normalize: true }).parse("https://exa\nmple.com")).toBe("https://example.com/");
+});
+
+test("ipv6 and cidrv6 reject anything outside the address alphabet", () => {
+  // `new URL("http://[...]")` parses an authority rather than an address, so a delimiter re-splits it and the parser validates something else entirely.
+  expect(z.ipv6().safeParse("::@1\\").success).toBe(false); // used to validate against the host 0.0.0.1
+  expect(z.ipv6().safeParse("::]/1").success).toBe(false);
+  expect(z.ipv6().safeParse("@[::1").success).toBe(false);
+  expect(z.cidrv6().safeParse("::@1\\/64").success).toBe(false);
+
+  for (const c of ["\t", "\n", "\r"]) {
+    expect(z.ipv6().safeParse(`2001:db8::${c}1`).success).toBe(false);
+    expect(z.ipv6().safeParse(`::1${c}`).success).toBe(false);
+    expect(z.cidrv6().safeParse(`::1${c}/64`).success).toBe(false);
+  }
+
+  // A rejection has to surface as an issue, not just success: false.
+  const result = z.ipv6().safeParse("::1\n");
+  expect(result.success).toBe(false);
+  expect(result.error!.issues[0]).toMatchObject({ code: "invalid_format", format: "ipv6" });
+
+  expect(z.ipv6().parse("2001:db8::1")).toBe("2001:db8::1");
+  expect(z.ipv6().parse("::ffff:192.0.2.1")).toBe("::ffff:192.0.2.1");
+  expect(z.ipv6().parse("2001:DB8::1")).toBe("2001:DB8::1");
+  expect(z.cidrv6().parse("::ffff:192.0.2.1/96")).toBe("::ffff:192.0.2.1/96");
+});
+
 test("url normalize flag", () => {
   const normalizeUrl = z.url({ normalize: true });
   const preserveUrl = z.url(); // normalize: false/undefined by default
@@ -420,7 +536,7 @@ test("httpurl", () => {
   const httpUrl = z.url({
     protocol: /^https?$/,
     hostname: z.regexes.domain,
-    // /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/
+    // /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/
   });
 
   httpUrl.parse("https://example.com");
@@ -454,6 +570,22 @@ test("httpurl", () => {
   ).toThrow();
   expect(() => httpUrl.parse("http://asdf.c")).toThrow();
   expect(() => httpUrl.parse("mailto:asdf@lckj.com")).toThrow();
+  // total host length over the RFC 1035 limit of 253 chars (built from valid-length labels)
+  const longHost = `${`${"a".repeat(50)}.`.repeat(5)}com`; // 5 * 51 + 3 = 258 chars
+  expect(longHost.length).toBeGreaterThan(253);
+  expect(() => httpUrl.parse(`http://${longHost}`)).toThrow();
+  // TLD over the 63-char label limit
+  expect(() => httpUrl.parse(`http://example.${"a".repeat(64)}`)).toThrow();
+  // a host at exactly the 253-char limit is still accepted, one char more is not
+  const maxHost = `${`${"a".repeat(61)}.`.repeat(4)}aaaaa`; // 4 * 62 + 5 = 253 chars
+  httpUrl.parse(`http://${maxHost}`);
+  expect(() => httpUrl.parse(`http://${maxHost}a`)).toThrow();
+  // missing // after protocol
+  expect(() => httpUrl.parse("http:example.com")).toThrow();
+  expect(() => httpUrl.parse("https:example.com")).toThrow();
+  // missing one /
+  expect(() => httpUrl.parse("https:/www.google.com")).toThrow();
+  expect(() => httpUrl.parse("http:/example.com")).toThrow();
 });
 
 test("url error overrides", () => {
@@ -477,6 +609,7 @@ test("url error overrides", () => {
 test("emoji validations", () => {
   const emoji = z.string().emoji();
 
+  emoji.parse("🦰🦱🦲🦳"); // both Extended_Pictographic and Emoji_Component
   emoji.parse("👋👋👋👋");
   emoji.parse("🍺👩‍🚀🫡");
   emoji.parse("💚💙💜💛❤️");
@@ -489,6 +622,18 @@ test("emoji validations", () => {
   expect(() => emoji.parse("😀 is an emoji")).toThrow();
   expect(() => emoji.parse("😀stuff")).toThrow();
   expect(() => emoji.parse("stuff😀")).toThrow();
+
+  emoji.parse("1\u{FE0F}\u{20E3}"); // keycap sequences stay valid
+  emoji.parse("#\u{FE0F}\u{20E3}");
+
+  // `\p{Emoji_Component}` alone covers ASCII digits, "#", "*", ZWJ, variation selectors and skin tone modifiers; none is an emoji without a base, so a component-only string is not one either
+  expect(() => emoji.parse("123")).toThrow();
+  expect(() => emoji.parse("#")).toThrow();
+  expect(() => emoji.parse("*")).toThrow();
+  expect(() => emoji.parse("\u{200D}")).toThrow();
+  expect(() => emoji.parse("\u{FE0F}")).toThrow();
+  expect(() => emoji.parse("\u{1F3FD}")).toThrow();
+  expect(() => emoji.parse("1\u{FE0F}")).toThrow();
 });
 
 test("nanoid", () => {
@@ -598,6 +743,26 @@ test("bad guid", () => {
   }
 });
 
+test("nanoid custom length", () => {
+  const nanoid64 = z.nanoid({ length: 64 });
+  nanoid64.parse("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_");
+  expect(nanoid64.safeParse("lfNZluvAxMkf7Q8C5H-QS")).toMatchObject({ success: false });
+
+  // the deprecated method and the default length both still work
+  expect(z.string().nanoid({ length: 10 }).safeParse("IRFa-VaY2b")).toMatchObject({ success: true });
+  expect(z.nanoid().safeParse("lfNZluvAxMkf7Q8C5H-QS")).toMatchObject({ success: true });
+
+  expect(z.nanoid({ length: 64, error: "custom error" }).safeParse("abc").error!.issues[0].message).toEqual(
+    "custom error"
+  );
+});
+
+test("nanoid rejects a length that is not a positive integer", () => {
+  expect(() => z.nanoid({ length: 0 })).toThrow("Invalid nanoid length: 0");
+  expect(() => z.nanoid({ length: -1 })).toThrow("Invalid nanoid length: -1");
+  expect(() => z.nanoid({ length: 1.5 })).toThrow("Invalid nanoid length: 1.5");
+});
+
 test("cuid", () => {
   const cuid = z.string().cuid();
   cuid.parse("ckopqwooh000001la8mbi2im9");
@@ -611,12 +776,26 @@ test("cuid", () => {
         "origin": "string",
         "code": "invalid_format",
         "format": "cuid",
-        "pattern": "/^[cC][^\\\\s-]{8,}$/",
+        "pattern": "/^[cC][0-9a-z]{6,}$/",
         "path": [],
         "message": "Invalid cuid"
       }
     ]]
   `);
+
+  // Strings containing non-base36 characters that the old denylist regex
+  // (/^[cC][^\s-]{8,}$/) accepted. The new regex restricts the body to
+  // [0-9a-z], matching the actual CUID v1 base36 format. See #3621.
+  const previouslyAcceptedNonCuids = [
+    "cly63t164000245zw008pggon';select1;", // SQLi-shaped (no whitespace, no hyphen)
+    "c<script>alert(1)</script>aaaaaa", // XSS-shaped
+    "c{};alert(1)//", // bracket / curly chars
+    "C0123_45678", // underscore is not base36
+    "cAAAAAAAAA", // uppercase letters in body are not base36 (CUIDs are lowercase)
+  ];
+  for (const s of previouslyAcceptedNonCuids) {
+    expect(cuid.safeParse(s).success).toBe(false);
+  }
 });
 
 test("cuid2", () => {
@@ -653,6 +832,12 @@ test("ulid", () => {
   const caseInsensitive = ulid.safeParse("01arZ3nDeKTsV4RRffQ69G5FAV");
   expect(caseInsensitive.success).toEqual(true);
 
+  // first char is capped at 7: the spec's largest ULID is 7ZZZZZZZZZZZZZZZZZZZZZZZZZ, so 8-9 and every letter overflow 2^48-1
+  expect(ulid.safeParse("7ZZZZZZZZZZZZZZZZZZZZZZZZZ").success).toEqual(true);
+  for (const first of ["8", "9", "A", "Z", "z"]) {
+    expect(ulid.safeParse(`${first}AAAAAAAAAAAAAAAAAAAAAAAAA`).success).toEqual(false);
+  }
+
   expect(result.error!.issues[0].message).toEqual("Invalid ULID");
   expect(result.error).toMatchInlineSnapshot(`
     [ZodError: [
@@ -660,7 +845,7 @@ test("ulid", () => {
         "origin": "string",
         "code": "invalid_format",
         "format": "ulid",
-        "pattern": "/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/",
+        "pattern": "/^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/",
         "path": [],
         "message": "Invalid ULID"
       }
@@ -811,6 +996,66 @@ test("min max getters", () => {
   expect(z.string().maxLength).toEqual(null);
 });
 
+test("boundary cases with zero length", () => {
+  // Test length(0) - only empty string should pass
+  const lengthZero = z.string().length(0);
+  expect(lengthZero.parse("")).toEqual("");
+  expect(() => lengthZero.parse("a")).toThrow();
+
+  // Test min(0) - all strings including empty should pass
+  const minZero = z.string().min(0);
+  expect(minZero.parse("")).toEqual("");
+  expect(minZero.parse("a")).toEqual("a");
+  expect(minZero.parse("hello")).toEqual("hello");
+
+  // Test max(0) - only empty string should pass
+  const maxZero = z.string().max(0);
+  expect(maxZero.parse("")).toEqual("");
+  expect(() => maxZero.parse("a")).toThrow();
+  expect(() => maxZero.parse("hello")).toThrow();
+});
+
+test("length checks count Unicode code points, not UTF-16 code units", () => {
+  // "\u{1F600}" is one code point but two UTF-16 code units
+  const five = "\u{1F600}\u{1F600}\u{1F600}\u{1F600}\u{1F600}";
+  expect(z.string().max(5).safeParse(five).success).toBe(true);
+  expect(
+    z
+      .string()
+      .max(5)
+      .safeParse(five + "\u{1F600}").success
+  ).toBe(false);
+  expect(z.string().min(5).safeParse(five).success).toBe(true);
+  expect(z.string().min(5).safeParse("\u{1F600}\u{1F600}\u{1F600}\u{1F600}").success).toBe(false);
+  expect(z.string().length(5).safeParse(five).success).toBe(true);
+  expect(z.string().length(1).safeParse("\u{1F600}").success).toBe(true);
+  expect(z.string().nonempty().safeParse("\u{1F600}").success).toBe(true);
+
+  // code points, not graphemes: a combining mark and a ZWJ sequence each stay several
+  expect(z.string().length(2).safeParse("e\u0301").success).toBe(true);
+  expect(z.string().length(3).safeParse("\u{1F9D1}\u200D\u{1F37C}").success).toBe(true);
+
+  // an unpaired surrogate is its own code point
+  expect(z.string().length(1).safeParse("\uD83D").success).toBe(true);
+  expect(z.string().length(2).safeParse("\uDE00\uD83D").success).toBe(true);
+
+  // the reported bound is still the declared one
+  expect(
+    z
+      .string()
+      .max(5)
+      .safeParse(five + "\u{1F600}").error!.issues[0]
+  ).toMatchObject({
+    code: "too_big",
+    maximum: 5,
+    origin: "string",
+  });
+
+  // other lengthables keep counting elements
+  expect(z.array(z.string()).max(2).safeParse(["a", "b", "c"]).success).toBe(false);
+  expect(z.array(z.string()).length(2).safeParse(["\u{1F600}", "\u{1F600}"]).success).toBe(true);
+});
+
 test("trim", () => {
   expect(z.string().trim().min(2).parse(" 12 ")).toEqual("12");
 
@@ -1005,6 +1250,14 @@ test("CIDR v6 validation", () => {
   expect(cidrV6.safeParse("fe80::/10").success).toBe(true);
   expect(cidrV6.safeParse("::1/128").success).toBe(true);
   expect(cidrV6.safeParse("2001:0db8:85a3::/64").success).toBe(true);
+  expect(cidrV6.safeParse("2001:db8:1::/48").success).toBe(true);
+  expect(cidrV6.safeParse("2001:db8:85a3::8a2e:370:7334/64").success).toBe(true);
+  expect(cidrV6.safeParse("2001:db8:85a3:0:0:8a2e:370:7334/64").success).toBe(true);
+
+  const pattern = new RegExp(z.toJSONSchema(cidrV6).pattern as string);
+  for (const input of ["2001:db8::/32", "2001:db8:1::/48", "2001:0db8:85a3::/64", "fe80::/10", "::/0"]) {
+    expect(pattern.test(input)).toBe(true);
+  }
 
   // Invalid CIDR v6 addresses
   expect(cidrV6.safeParse("2001:db8::").success).toBe(false); // Missing prefix
@@ -1093,6 +1346,18 @@ test("hostname", () => {
   expect(() => hostname.parse("example..com")).toThrow();
 });
 
+test("currency code", () => {
+  const currency = z.currencyCode();
+  for (const code of ["USD", "EUR", "XXX", "XCG", "XAD"]) expect(currency.parse(code)).toBe(code);
+  for (const input of ["", "usd", "US", "USDX", " USD", "ANG", "BGN"])
+    expect(currency.safeParse(input).success).toBe(false);
+  expect(currency.safeParse("usd").error!.issues[0]).toMatchObject({
+    code: "invalid_format",
+    format: "currency_code",
+    message: "Invalid currency code",
+  });
+});
+
 test("hash validation", () => {
   // MD5 tests
   const md5hex = z.hash("md5");

package/node_modules/zod/src/v4/classic/tests/stringbool.test.ts

@@ -104,3 +104,21 @@ test("z.stringbool codec round trip", () => {
   const encodedFalse = z.encode(schema, decodedFalse);
   expect(encodedFalse).toEqual("disabled"); // First element of falsy array
 });
+
+test("z.stringbool exposes truthy/falsy/case via _zod.bag", () => {
+  const a = z.stringbool();
+  expect(a._zod.bag.truthy).toEqual(["true", "1", "yes", "on", "y", "enabled"]);
+  expect(a._zod.bag.falsy).toEqual(["false", "0", "no", "off", "n", "disabled"]);
+  expect(a._zod.bag.case).toEqual("insensitive");
+
+  // values are normalized when case-insensitive
+  const b = z.stringbool({ truthy: ["Y", "yes"], falsy: ["N"] });
+  expect(b._zod.bag.truthy).toEqual(["y", "yes"]);
+  expect(b._zod.bag.falsy).toEqual(["n"]);
+  expect(b._zod.bag.case).toEqual("insensitive");
+
+  const c = z.stringbool({ truthy: ["Y"], falsy: ["N"], case: "sensitive" });
+  expect(c._zod.bag.truthy).toEqual(["Y"]);
+  expect(c._zod.bag.falsy).toEqual(["N"]);
+  expect(c._zod.bag.case).toEqual("sensitive");
+});