zod 4.5.4 → 4.6.0

package/src/v4/core/compile.ts

@@ -9,6 +9,7 @@ import {
   isValidBase64URL,
   isValidCIDRv6,
   isValidCreditCard,
+  isValidIBAN,
   isValidIPv6,
   isValidJWT,
   mergeValues,
@@ -17,11 +18,12 @@ import {
   urlHostnameOk,
   urlProtocolOk,
 } from "./schemas.js";
-import type { ParseContextInternal, ParsePayload, SomeType } from "./schemas.js";
+import type { $ZodProperties, $ZodPropertiesDef, ParseContextInternal, ParsePayload, SomeType } from "./schemas.js";
 import * as util from "./util.js";
 
-/** Sentinel value returned by the compiled fast path when validation fails. Internal. */
+/** @internal Sentinel the compiled fast path returns when validation fails. */
 export const INVALID: unique symbol = Symbol.for("zod.compile.invalid");
+/** @internal */
 export type INVALID = typeof INVALID;
 
 // Set on the parse ctx when a compiled wrapper falls back to the runtime, so nested compiled wrappers skip their fast paths for the rest of that parse.
@@ -33,7 +35,11 @@ interface CompileFnOptions {
   assertOnly?: boolean | undefined;
 }
 
-type CompiledFn<T> = ((input: unknown) => T | INVALID) & { code?: string | undefined };
+type CompiledFn<T> = ((input: unknown) => T | INVALID) & {
+  code?: string | undefined;
+  /** False when this function's INVALID does not strictly mean "the runtime would reject". */
+  definite?: boolean | undefined;
+};
 
 /** Raised when the schema contains async refinements or transforms. Surfaces only under `compile(schema, { strict: true })`. */
 export class ZodCompileAsyncError extends Error {
@@ -64,6 +70,8 @@ interface CompileContext {
   constants: Map<string, unknown>;
   constantCounter: number;
   varCounter: number;
+  /** Cleared when a construct can return INVALID for something the interpreter throws on, so `validate` keeps its fallback. */
+  definite: boolean;
 }
 
 // Union of all check types we support in AOT compilation
@@ -81,6 +89,7 @@ type SupportedCheck =
   | checks.$ZodCheckLengthEquals
   | checks.$ZodCheckStringFormat
   | checks.$ZodCheckProperty
+  | $ZodProperties
   | checks.$ZodCheckMimeType
   | checks.$ZodCheckOverwrite
   | { _zod: { def: { check: "custom"; fn?: (value: unknown) => boolean }; check?: (payload: unknown) => unknown } };
@@ -90,9 +99,9 @@ type SupportedCheck =
  * dropped. A schema the flag cannot express reuses the parser, which still answers correctly — it
  * just builds a value nothing reads.
  */
-function compileValidator(schema: SomeType, parser: (input: unknown) => unknown): (input: unknown) => unknown {
+function compileValidator(schema: SomeType, parser: CompiledFn<unknown>): CompiledFn<unknown> {
   try {
-    return compileFn(schema, { assertOnly: true }) as (input: unknown) => unknown;
+    return compileFn(schema, { assertOnly: true }) as CompiledFn<unknown>;
   } catch {
     return parser;
   }
@@ -117,53 +126,9 @@ export interface CompileOptions {
 export function compile<T extends SomeType>(schema: T, options?: CompileOptions): T {
   try {
     const parser = compileFn(schema);
-    const clone = util.clone(schema as any) as T;
-
-    // Capture the source-of-truth runtime eagerly. If schema._zod.run is itself a shim installed by global-mode (`__originalRun` set), unwrap past it. Otherwise capturing the live property lazily would let a later self- replacement of schema._zod.run feed our wrapper back into itself.
-    const liveRun = schema._zod.run as ((p: ParsePayload, c: ParseContextInternal) => any) & {
-      __originalRun?: (p: ParsePayload, c: ParseContextInternal) => any;
-    };
-    const originalRun = liveRun.__originalRun ?? liveRun;
-
-    // Delegate to the *original* schema's run on bypass/fallback (not the
-    // clone's). The original closed over its own `inst` at construction time;
-    // issue payloads use that reference to derive things like the class name
-    // for `z.instanceof(Test)`. Calling the clone's freshly-initialized run
-    // would push issues with `inst === clone`, producing diverging error
-    // messages from the original schema.
-    const wrapped = (payload: ParsePayload, ctx: ParseContextInternal): any => {
-      if (
-        ctx?.async ||
-        ctx?.direction === "backward" ||
-        ctx?.skipChecks ||
-        (ctx as Record<symbol, unknown> | undefined)?.[FALLBACK_FLAG]
-      ) {
-        return originalRun(payload, ctx);
-      }
-
-      // A memoized back-edge: only the runtime can close a reference cycle, and a transform on one must raise $ZodCyclicError from its own parse.
-      if (ctx && isBackEdge(ctx, payload.value)) {
-        return originalRun(payload, ctx);
-      }
-
-      const out = parser(payload.value);
-      if (out !== INVALID) {
-        payload.value = out;
-        return payload;
-      }
-      // Mark this parse as runtime-driven: under global mode every nested schema carries its own compiled wrapper, and without the flag the parent's runtime fallback re-enters each child's fast path, running user callbacks a third time on invalid input.
-      if (ctx) (ctx as Record<symbol, unknown>)[FALLBACK_FLAG] = true;
-      return originalRun(payload, ctx);
-    };
-    // Let later compiles of (or through) this run unwrap to the true runtime — both the global shim and repeated z.compile calls rely on this. The bag also carries the parser and the validator, so the standalone validate can skip the payload and wrapper on the happy path.
-    (wrapped as { __originalRun?: typeof originalRun }).__originalRun = originalRun;
-    clone._zod.bag.fallbackRun = originalRun;
-    clone._zod.bag.validator = compileValidator(schema, parser as (input: unknown) => unknown);
-    clone._zod.run = wrapped;
-
-    // The fast parse/safeParse closures fall back through the source schema's methods. If the source is shim- or wrapper-managed, those methods route into a compiled run and would execute user callbacks a third time on invalid input — the plain method → wrapper path is exactly 2x, so skip.
-    if (!liveRun.__originalRun) installCompiledUserMethods(clone, schema, parser);
-
+    const clone = withParser(schema, parser);
+    // withParser leaves the parser as its own validator; the generated assert-only variant is better when we have one
+    clone._zod.bag.validator = compileValidator(schema, parser as CompiledFn<unknown>);
     return clone;
   } catch (err) {
     if (options?.strict) throw err;
@@ -172,6 +137,68 @@ export function compile<T extends SomeType>(schema: T, options?: CompileOptions)
   }
 }
 
+/**
+ * Install an already-generated parser as a schema's fast path. Returns a clone; the original is
+ * unchanged.
+ *
+ * The parser takes the input and returns the parsed value, or `INVALID` to hand the parse to the
+ * runtime. It must be synchronous and forward-direction, and it must build fresh output rather than
+ * return its input — Zod cannot check either, and a wrong *success* is returned to the caller as-is.
+ *
+ * `compile()` is the ordinary entry point. This is for a build-time or native compiler that produces
+ * a parser where `new Function` is unavailable.
+ */
+export function withParser<T extends SomeType>(schema: T, parser: (input: unknown) => core.output<T> | INVALID): T {
+  // generated code never receives the parse context, so only the runtime can close a reference cycle; compileFn refuses these too
+  if (isRecursiveSchema(schema as any)) {
+    throw new ZodCompileUnsupportedError("a schema whose subtree contains a reference cycle");
+  }
+  const clone = util.clone(schema as any) as T;
+
+  // Capture the source-of-truth runtime eagerly. If schema._zod.run is itself a shim installed by global-mode (`__originalRun` set), unwrap past it. Otherwise capturing the live property lazily would let a later self- replacement of schema._zod.run feed our wrapper back into itself.
+  const liveRun = schema._zod.run as ((p: ParsePayload, c: ParseContextInternal) => any) & {
+    __originalRun?: (p: ParsePayload, c: ParseContextInternal) => any;
+  };
+  const originalRun = liveRun.__originalRun ?? liveRun;
+
+  // Delegate to the *original* schema's run on bypass/fallback, not the clone's. The original closed over its own `inst` at construction time, and issue payloads use that reference to derive things like the class name for `z.instanceof(Test)`; calling the clone's freshly-initialized run would push issues with `inst === clone` and diverge from the original schema's error messages.
+  const wrapped = (payload: ParsePayload, ctx: ParseContextInternal): any => {
+    if (
+      ctx?.async ||
+      ctx?.direction === "backward" ||
+      ctx?.skipChecks ||
+      (ctx as Record<symbol, unknown> | undefined)?.[FALLBACK_FLAG]
+    ) {
+      return originalRun(payload, ctx);
+    }
+
+    // A memoized back-edge: only the runtime can close a reference cycle, and a transform on one must raise $ZodCyclicError from its own parse.
+    if (ctx && isBackEdge(ctx, payload.value)) {
+      return originalRun(payload, ctx);
+    }
+
+    const out = parser(payload.value);
+    if (out !== INVALID) {
+      payload.value = out;
+      return payload;
+    }
+    // Mark this parse as runtime-driven: under global mode every nested schema carries its own compiled wrapper, and without the flag the parent's runtime fallback re-enters each child's fast path, running user callbacks a third time on invalid input.
+    if (ctx) (ctx as Record<symbol, unknown>)[FALLBACK_FLAG] = true;
+    return originalRun(payload, ctx);
+  };
+  // Let later compiles of (or through) this run unwrap to the true runtime — both the global shim and repeated z.compile calls rely on this. The bag also carries the parser and the validator, so the standalone validate can skip the payload and wrapper on the happy path.
+  (wrapped as { __originalRun?: typeof originalRun }).__originalRun = originalRun;
+  clone._zod.bag.fallbackRun = originalRun;
+  // a supplied parser answers `validate` too: one implementation means parse and validate cannot disagree, and its undefined `definite` keeps the runtime re-parse on every rejection
+  clone._zod.bag.validator = parser as CompiledFn<unknown>;
+  clone._zod.run = wrapped;
+
+  // The fast parse/safeParse closures fall back through the source schema's methods. If the source is shim- or wrapper-managed, those methods route into a compiled run and would execute user callbacks a third time on invalid input — the plain method → wrapper path is exactly 2x, so skip.
+  if (!liveRun.__originalRun) installCompiledUserMethods(clone, schema, parser as CompiledFn<core.output<T>>);
+
+  return clone;
+}
+
 function installCompiledUserMethods<T extends SomeType>(
   target: T,
   source: T,
@@ -204,9 +231,8 @@ function installCompiledUserMethods<T extends SomeType>(
 }
 
 /**
- * Generate the standalone compiled function: a parser by default, a validator under
- * `assertOnly`. Returns either the parsed value, `true` where nothing reads the output,
- * or the `INVALID` sentinel. Internal — consumers should use `compile()`.
+ * @internal Generate the standalone compiled function: a parser by default, a validator under
+ * `assertOnly`. Returns the parsed value, `true` where nothing reads the output, or `INVALID`. Consumers use `compile()`.
  */
 export function compileFn<T extends SomeType>(schema: T, options?: CompileFnOptions): CompiledFn<core.output<T>> {
   // Cycle-breaking is keyed on the parse context, which generated code never receives. `shape` can be a getter that throws (z.pick() with an unrecognized mask key), so treat "can't tell" as recursive.
@@ -222,6 +248,7 @@ export function compileFn<T extends SomeType>(schema: T, options?: CompileFnOpti
     constants: new Map(),
     constantCounter: 0,
     varCounter: 0,
+    definite: true,
   };
 
   const doc = new Doc(["input"]);
@@ -253,6 +280,7 @@ export function compileFn<T extends SomeType>(schema: T, options?: CompileFnOpti
   if (options?.debug) {
     fn.code = fullCode;
   }
+  fn.definite = ctx.definite;
   return fn;
 }
 
@@ -266,6 +294,12 @@ function addConstant(ctx: CompileContext, value: unknown): string {
   return name;
 }
 
+/** Hoists a user-supplied callback. Anything the schema's author wrote can throw, and generated code can reject an earlier sibling before ever reaching it, so this clears `definite` — a rejection is then no longer proof that the interpreter would have rejected rather than thrown. */
+function addUserConstant(ctx: CompileContext, fn: unknown): string {
+  ctx.definite = false;
+  return addConstant(ctx, fn);
+}
+
 function newVar(ctx: CompileContext): string {
   return `v${ctx.varCounter++}`;
 }
@@ -322,6 +356,8 @@ function compileChild(
 }
 
 function emitRuntimeIsland(doc: Doc, ctx: CompileContext, schema: SomeType, accessor: string): string {
+  // an islanded child answers INVALID for an async run too, which the interpreter throws for
+  ctx.definite = false;
   const schemaConst = addConstant(ctx, schema);
   const runConst = addConstant(ctx, runtimeRun);
   const outVar = newVar(ctx);
@@ -418,6 +454,9 @@ function generateChecks(doc: Doc, ctx: CompileContext, schema: SomeType, accesso
       case "property":
         generatePropertyCheck(doc, ctx, def, currentAccessor);
         break;
+      case "properties":
+        generatePropertiesChecks(doc, ctx, def, currentAccessor, false);
+        break;
       case "overwrite": {
         // Overwrite transforms the value - create new variable for transformed result
         const newAccessor = newVar(ctx);
@@ -573,6 +612,35 @@ function generateMimeTypeCheck(
   }
 }
 
+// asserts each named property in place; children compile assert-only because z.properties never rebuilds its input
+function generatePropertiesChecks(
+  doc: Doc,
+  ctx: CompileContext,
+  def: $ZodPropertiesDef,
+  accessor: string,
+  schemaRole: boolean
+): void {
+  // a custom `when` gates the assertion at runtime; inside a union a wrongly-run branch is absorbed as a branch failure rather than falling back, so refuse at codegen the way the check role does
+  if (def.when) {
+    throw new ZodCompileUnsupportedError(`check with a custom "when" condition`);
+  }
+  // matches the runtime gate for whichever role this is: a schema rejects a primitive outright, a check only a nullish value
+  doc.write(
+    schemaRole
+      ? `if (${accessor} === null || (typeof ${accessor} !== "object" && typeof ${accessor} !== "function")) return INVALID;`
+      : `if (${accessor} == null) return INVALID;`
+  );
+  const shape = def.shape as Record<string | symbol, SomeType>;
+  for (const key of Reflect.ownKeys(shape)) {
+    // a symbol has no source literal, so it is hoisted as a constant
+    const keyExpr = typeof key === "symbol" ? addConstant(ctx, key) : util.esc(key);
+    // cache the property read so a getter runs exactly once, matching the runtime
+    const inputVar = newVar(ctx);
+    doc.write(`const ${inputVar} = ${accessor}[${keyExpr}];`);
+    compileChild(doc, ctx, shape[key]!, inputVar, false);
+  }
+}
+
 function generatePropertyCheck(
   doc: Doc,
   ctx: CompileContext,
@@ -626,7 +694,7 @@ function generateCustomRefineCheck(doc: Doc, ctx: CompileContext, check: CustomC
     if (isAsyncFunction(def.fn)) {
       throw new ZodCompileAsyncError("z.compile: async .refine() predicates are not supported");
     }
-    const fnConst = addConstant(ctx, def.fn);
+    const fnConst = addUserConstant(ctx, def.fn);
     const throwAsyncConst = addConstant(ctx, throwAsync);
     const resVar = newVar(ctx);
     doc.write(`const ${resVar} = ${fnConst}(${accessor});`);
@@ -653,7 +721,7 @@ function generateCustomRefineCheck(doc: Doc, ctx: CompileContext, check: CustomC
       if (result instanceof Promise) throwAsync();
       return fakePayload.issues.length === 0 ? fakePayload.value : INVALID;
     };
-    const helperConst = addConstant(ctx, helperFn);
+    const helperConst = addUserConstant(ctx, helperFn);
     const outVar = newVar(ctx);
     doc.write(`const ${outVar} = ${helperConst}(${accessor});`);
     doc.write(`if (${outVar} === INVALID) return INVALID;`);
@@ -743,6 +811,11 @@ function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFor
     doc.write(`if (!${validator}(${accessor})) return INVALID;`);
     return accessor;
   }
+  if (fmt === "iban") {
+    const validator = addConstant(ctx, isValidIBAN);
+    doc.write(`if (!${validator}(${accessor})) return INVALID;`);
+    return accessor;
+  }
   const formatDef = def as unknown as { normalize?: boolean; hostname?: unknown; protocol?: unknown };
   if (
     fmt === "url" ||
@@ -861,6 +934,7 @@ type SupportedSchemaType =
   | "lazy"
   | "pipe"
   | "custom"
+  | "properties"
   | "transform"
   | "catch";
 
@@ -1005,6 +1079,10 @@ function generateCheck(
     case "custom":
       typeAccessor = generateCustomCheck(doc, ctx, schema, accessor);
       break;
+    case "properties":
+      generatePropertiesChecks(doc, ctx, (schema as $ZodProperties)._zod.def, accessor, true);
+      typeAccessor = accessor;
+      break;
     case "transform":
       typeAccessor = generateTransformCheck(doc, ctx, schema, accessor);
       break;
@@ -1833,6 +1911,8 @@ function literalEquality(ctx: CompileContext, accessor: string, value: unknown):
 
 function generateIntersectionCheck(doc: Doc, ctx: CompileContext, schema: SomeType, accessor: string): string {
   const def = schema._zod.def as unknown as { left: SomeType; right: SomeType };
+  // An unmergeable merge, and a child failing before the merge is even reached, both return INVALID for a case the interpreter answers with a throw.
+  ctx.definite = false;
   const leftOutput = compileChild(doc, ctx, def.left, accessor);
   const rightOutput = compileChild(doc, ctx, def.right, accessor);
 
@@ -1912,15 +1992,15 @@ function generateRecordCheck(doc: Doc, ctx: CompileContext, schema: SomeType, ac
     // The runtime runs it against each own enumerable key and writes the value
     // under the key it produced, so compile it once and call it per key.
     const isLoose = (def as { mode?: string }).mode === "loose";
-    const keyFast = addConstant(ctx, compileFn(def.keyType));
+    // the key compiles in its own context, so carry its verdict out: a key schema that can answer INVALID undecidably makes this validator undecidable too
+    const keyFn = compileFn(def.keyType);
+    if (keyFn.definite === false) ctx.definite = false;
+    const keyFast = addConstant(ctx, keyFn);
     const numericConst = addConstant(ctx, regexes.number);
-    const propIsEnumerableConst = addConstant(ctx, Object.prototype.propertyIsEnumerable);
     const outKeyVar = newVar(ctx);
 
-    doc.write(`for (const ${kVar} of Reflect.ownKeys(${accessor})) {`);
-    doc.indented((d) => {
-      d.write(`if (${kVar} === "__proto__") continue;`);
-      d.write(`if (!${propIsEnumerableConst}.call(${accessor}, ${kVar})) continue;`);
+    // the body runs once per string key and once per symbol key, since a key schema can accept symbols
+    emitOwnKeys(doc, ctx, accessor, kVar, (d) => {
       d.write(`let ${outKeyVar} = ${keyFast}(${kVar});`);
       // Numeric-string retry, mirroring the runtime: a key the schema rejects as a string is tried again as a number, so z.record(z.number(), …) matches the numeric keys JavaScript stringified on the way in.
       d.write(
@@ -1940,24 +2020,56 @@ function generateRecordCheck(doc: Doc, ctx: CompileContext, schema: SomeType, ac
       const valOutput = compileChild(d, ctx, def.valueType, valueVar);
       d.write(`${outputVar}[${outKeyVar}] = ${valOutput};`);
     });
-    doc.write(`}`);
     return outputVar;
   }
 
-  // Plain z.string() keys: iterate enumerable own keys and validate each value. Runtime uses Reflect.ownKeys so symbol keys participate in validation; matching that here prevents silently accepting objects with enumerable Symbol keys under z.record(z.string(), ...).
-  const propIsEnumerable = addConstant(ctx, Object.prototype.propertyIsEnumerable);
-  doc.write(`for (const ${kVar} of Reflect.ownKeys(${accessor})) {`);
+  // Plain z.string() keys: every own enumerable string key's value is validated, and an own enumerable symbol key fails the string key schema, as it does in the runtime's Reflect.ownKeys walk.
+  emitOwnKeys(
+    doc,
+    ctx,
+    accessor,
+    kVar,
+    (d) => {
+      d.write(`const ${valVar} = ${accessor}[${kVar}];`);
+      const valOutput = compileChild(d, ctx, def.valueType, valVar);
+      d.write(`${outputVar}[${kVar}] = ${valOutput};`);
+    },
+    `return INVALID;`
+  );
+
+  return outputVar;
+}
+
+// Walks the own enumerable keys of a plain object in Reflect.ownKeys order — strings from getOwnPropertyNames, then symbols — instead of Reflect.ownKeys, whose accumulator made that walk 3–6x the cost of the loop it fed. Both snapshots are taken before any value is read and every key is rechecked with propertyIsEnumerable when visited, exactly the runtime's walk, so a getter that adds, deletes, hides or reveals a key mid-walk sees the runtime's verdict; for-in and Object.keys were no faster and each lost a case (for-in enumerates the prototype chain after the own keys, Object.keys drops a key that is non-enumerable at snapshot time). `body` is written once for the string loop and once for the symbol loop unless `onSymbol` replaces the latter.
+function emitOwnKeys(
+  doc: Doc,
+  ctx: CompileContext,
+  accessor: string,
+  kVar: string,
+  body: (d: Doc) => void,
+  onSymbol?: string
+): void {
+  const propIsEnumerableConst = addConstant(ctx, Object.prototype.propertyIsEnumerable);
+  const symsVar = newVar(ctx);
+  const keysVar = newVar(ctx);
+  const iVar = newVar(ctx);
+  doc.write(`const ${symsVar} = Object.getOwnPropertySymbols(${accessor});`);
+  doc.write(`const ${keysVar} = Object.getOwnPropertyNames(${accessor});`);
+  doc.write(`for (let ${iVar} = 0; ${iVar} < ${keysVar}.length; ${iVar}++) {`);
   doc.indented((d) => {
-    d.write(`if (${kVar} === "__proto__") continue;`);
-    d.write(`if (!${propIsEnumerable}.call(${accessor}, ${kVar})) continue;`);
-    d.write(`if (typeof ${kVar} !== "string") return INVALID;`);
-    d.write(`const ${valVar} = ${accessor}[${kVar}];`);
-    const valOutput = compileChild(d, ctx, def.valueType, valVar);
-    d.write(`${outputVar}[${kVar}] = ${valOutput};`);
+    d.write(`const ${kVar} = ${keysVar}[${iVar}];`);
+    d.write(`if (${kVar} === "__proto__" || !${propIsEnumerableConst}.call(${accessor}, ${kVar})) continue;`);
+    body(d);
+  });
+  doc.write(`}`);
+  doc.write(`for (let ${iVar} = 0; ${iVar} < ${symsVar}.length; ${iVar}++) {`);
+  doc.indented((d) => {
+    d.write(`const ${kVar} = ${symsVar}[${iVar}];`);
+    d.write(`if (!${propIsEnumerableConst}.call(${accessor}, ${kVar})) continue;`);
+    if (onSymbol) d.write(onSymbol);
+    else body(d);
   });
   doc.write(`}`);
-
-  return outputVar;
 }
 
 function literalPropertyKey(ctx: CompileContext, key: string | symbol): string {
@@ -2027,7 +2139,7 @@ function generateTemplateLiteralCheck(doc: Doc, ctx: CompileContext, schema: Som
 function generateLazyCheck(doc: Doc, ctx: CompileContext, schema: SomeType, accessor: string): string {
   // For lazy schemas, we use a cached parser that falls back to runtime Zod parsing This handles recursive schemas correctly by avoiding infinite compilation loops
   const def = schema._zod.def as unknown as { getter: () => SomeType };
-  const getterConst = addConstant(ctx, def.getter);
+  const getterConst = addUserConstant(ctx, def.getter);
   const cacheConst = addConstant(ctx, { parser: null as ((input: unknown) => unknown) | null });
 
   doc.write(`if (!${cacheConst}.parser) {`);
@@ -2060,7 +2172,7 @@ function generatePipeCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acce
   const inputOutput = generateCheck(doc, ctx, def.in, accessor);
 
   if (def.transform) {
-    // Apply transform and validate output. The transform may read its second `payload` argument (codec transforms like z.stringbool() push issues there) so wrap the call in a helper that spoofs a payload. Pushed issues signal INVALID and the wrapper falls back to the runtime.
+    // Apply transform and validate output. The transform may read its second `payload` argument (codec transforms like z.stringbool() push issues there) so wrap the call in a helper that spoofs a payload. Pushed issues signal INVALID and the wrapper falls back to the runtime, and a plain function handing back a promise answers INVALID too — union parity, but not a decidable rejection at the top level.
     if (isAsyncFunction(def.transform)) {
       throw new ZodCompileAsyncError("z.compile: async transforms in pipes are not supported");
     }
@@ -2073,7 +2185,7 @@ function generatePipeCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acce
       if (result instanceof Promise) return INVALID;
       return fakePayload.issues.length === 0 ? result : INVALID;
     };
-    const helperConst = addConstant(ctx, helperFn);
+    const helperConst = addUserConstant(ctx, helperFn);
     const transformedVar = newVar(ctx);
     doc.write(`const ${transformedVar} = ${helperConst}(${inputOutput});`);
     doc.write(`if (${transformedVar} === INVALID) return INVALID;`);
@@ -2101,7 +2213,7 @@ function generateCustomCheck(doc: Doc, ctx: CompileContext, schema: SomeType, ac
       throw new ZodCompileAsyncError("z.compile: async custom predicates are not supported");
     }
     // Custom schema with a predicate function (e.g. z.instanceof). `isAsyncFunction` above is syntactic, so a plain function returning a promise reaches here, and a promise is truthy — it would read as a pass where the interpreter throws.
-    const fnConst = addConstant(ctx, def.fn);
+    const fnConst = addUserConstant(ctx, def.fn);
     const throwAsyncConst = addConstant(ctx, throwAsync);
     const resVar = newVar(ctx);
     doc.write(`const ${resVar} = ${fnConst}(${accessor});`);
@@ -2146,7 +2258,7 @@ function generateCatchCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acc
   doc.write(`})();`);
 
   const innerConst = addConstant(ctx, def.innerType);
-  const catchConst = addConstant(ctx, def.catchValue);
+  const catchConst = addUserConstant(ctx, def.catchValue);
   const catchHelperConst = addConstant(ctx, runtimeCatch);
   doc.write(`if (${outputVar} === INVALID) {`);
   doc.indented((d) => {
@@ -2177,7 +2289,7 @@ function generateTransformCheck(doc: Doc, ctx: CompileContext, schema: SomeType,
       if (result instanceof Promise) return INVALID;
       return fakePayload.issues.length === 0 ? result : INVALID;
     };
-    const helperConst = addConstant(ctx, helperFn);
+    const helperConst = addUserConstant(ctx, helperFn);
     const outputVar = newVar(ctx);
     doc.write(`const ${outputVar} = ${helperConst}(${accessor});`);
     doc.write(`if (${outputVar} === INVALID) return INVALID;`);

package/src/v4/core/doc.ts

@@ -12,10 +12,14 @@ export class Doc {
     this.closed = closed;
   }
 
+  // the compiler catches a child's throw and keeps writing into this doc, so the indent has to unwind with it
   indented(fn: (doc: Doc) => void) {
     this.indent += 1;
-    fn(this);
-    this.indent -= 1;
+    try {
+      fn(this);
+    } finally {
+      this.indent -= 1;
+    }
   }
 
   write(fn: ModeWriter): void;

package/src/v4/core/errors.ts

@@ -213,7 +213,7 @@ type RawIssue<T extends $ZodIssueBase> = T extends any
 export type $ZodRawIssue<T extends $ZodIssueBase = $ZodIssue> = $ZodInternalIssue<T>;
 
 export interface $ZodErrorMap<T extends $ZodIssueBase = $ZodIssue> {
-  // biome-ignore lint:
+  // biome-ignore lint/style/useShorthandFunctionType: interface form is public API
   (issue: $ZodRawIssue<T>): { message: string } | string | undefined | null;
 }
 
@@ -251,7 +251,6 @@ const _messageDesc: PropertyDescriptor = {
   enumerable: true,
   configurable: true,
 };
-const _zodDesc: PropertyDescriptor = { value: undefined, enumerable: false };
 const _issuesDesc: PropertyDescriptor = { value: undefined, enumerable: false };
 
 /* Prototypes that already carry the lazy `toString`. Seeded with the
@@ -261,12 +260,10 @@ const _installedToString = /* @__PURE__ */ new WeakSet<object>([Object.prototype
 
 const initializer = (inst: $ZodError, def: $ZodIssue[]): void => {
   inst.name = "$ZodError";
-  _zodDesc.value = inst._zod;
-  Object.defineProperty(inst, "_zod", _zodDesc);
+  // `_zod` is already non-enumerable: $constructor's init defined it with this same descriptor
   _issuesDesc.value = def;
   Object.defineProperty(inst, "issues", _issuesDesc);
-  // Clear the shared slots; a retained `value` pins the last error's issues.
-  _zodDesc.value = undefined;
+  // Clear the shared slot; a retained `value` pins the last error's issues.
   _issuesDesc.value = undefined;
   Object.defineProperty(inst, "message", _messageDesc);
 

package/src/v4/core/json-schema-generator.ts

@@ -10,7 +10,7 @@ import {
   extractDefs,
   finalize,
   initializeContext,
-  process,
+  processSchema,
 } from "./to-json-schema.js";
 
 /**
@@ -102,7 +102,7 @@ export class JSONSchemaGenerator {
    * This must be called before emit().
    */
   process(schema: schemas.$ZodType, _params: ProcessParams = { path: [], schemaPath: [] }): JSONSchema.BaseSchema {
-    return process(schema, this.ctx, _params);
+    return processSchema(schema, this.ctx, _params);
   }
 
   /**