zod 4.6.2 → 4.6.4

package/src/v4/classic/tests/to-json-schema.test.ts

@@ -1,5 +1,5 @@
 import { Validator } from "@seriousme/openapi-schema-validator";
-import { describe, expect, test } from "vitest";
+import { describe, expect, test, vi } from "vitest";
 import * as z from "zod";
 // import * as zCore from "zod/v4/core";
 
@@ -3235,11 +3235,31 @@ test("basic registry", () => {
   `);
 });
 
-test("large registry converts in linear time", () => {
-  const count = 2000;
-  const convert = (withIntersection: boolean) => {
+function countMapScanWork<T>(convert: () => T): { result: T; work: number } {
+  const entries = Map.prototype.entries;
+  const values = Map.prototype.values;
+  let work = 0;
+  const entriesSpy = vi.spyOn(Map.prototype, "entries").mockImplementation(function (this: Map<unknown, unknown>) {
+    work += this.size;
+    return entries.call(this);
+  } as typeof Map.prototype.entries);
+  const valuesSpy = vi.spyOn(Map.prototype, "values").mockImplementation(function (this: Map<unknown, unknown>) {
+    work += this.size;
+    return values.call(this);
+  } as typeof Map.prototype.values);
+  try {
+    return { result: convert(), work };
+  } finally {
+    entriesSpy.mockRestore();
+    valuesSpy.mockRestore();
+  }
+}
+
+test("large registry conversion performs linear map-scan work", () => {
+  const count = 64;
+  const convert = (size: number, withIntersection: boolean) => {
     const registry = z.registry<{ id: string }>();
-    for (let i = 0; i < count; i++) {
+    for (let i = 0; i < size; i++) {
       registry.add(
         z.object({ id: z.string(), name: z.string(), count: z.number(), nested: z.object({ a: z.boolean() }) }),
         { id: `Type${i}` }
@@ -3247,55 +3267,53 @@ test("large registry converts in linear time", () => {
     }
     if (withIntersection) registry.add(z.object({ a: z.string() }).and(z.object({ b: z.string() })), { id: "Inter" });
 
-    const start = performance.now();
-    const { schemas } = z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` });
-    return { schemas, elapsed: performance.now() - start };
+    return countMapScanWork(() => z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` }));
   };
 
-  const plain = convert(false);
-  expect(Object.keys(plain.schemas)).toHaveLength(count);
-  expect(plain.schemas.Type0).toMatchObject({
+  const plain = convert(count, false);
+  const plainDouble = convert(count * 2, false);
+  expect(Object.keys(plain.result.schemas)).toHaveLength(count);
+  expect(plain.result.schemas.Type0).toMatchObject({
     $id: "https://example.com/Type0.json",
     type: "object",
     properties: { nested: { type: "object" } },
   });
-  expect(plain.schemas[`Type${count - 1}`]!.$id).toBe(`https://example.com/Type${count - 1}.json`);
-
-  // The whole-map passes in extractDefs/finalize used to re-run once per registered schema, which made this quadratic: ~9s of CPU at this size before the passes were hoisted, ~50ms after.
-  expect(plain.elapsed).toBeLessThan(5000);
+  expect(plain.result.schemas[`Type${count - 1}`]!.$id).toBe(`https://example.com/Type${count - 1}.json`);
+  expect(plain.work).toBeGreaterThan(0);
+  expect(plainDouble.work).toBeLessThanOrEqual(plain.work * 2);
 
-  // The intersection fold walks the whole map as well, so it has to run inside the same guard. Hoisting it back out costs ~10x at this size. Comparing the two conversions rather than asserting a fixed budget keeps this independent of how fast the machine is.
-  const folded = convert(true);
-  expect(folded.schemas.Inter).toMatchObject({ type: "object", properties: { a: {}, b: {} } });
-  expect(folded.elapsed).toBeLessThan(plain.elapsed * 4 + 100);
+  const folded = convert(count, true);
+  const foldedDouble = convert(count * 2, true);
+  expect(folded.result.schemas.Inter).toMatchObject({ type: "object", properties: { a: {}, b: {} } });
+  expect(folded.work).toBeGreaterThan(0);
+  expect(foldedDouble.work).toBeLessThanOrEqual(folded.work * 2);
 });
 
-test("a registry of records with numeric keys converts in linear time", () => {
-  const count = 2000;
-  const convert = (key: (i: number) => z.core.$ZodType) => {
+test("a registry of records with numeric keys performs linear map-scan work", () => {
+  const count = 64;
+  const convert = (size: number, key: (i: number) => z.core.$ZodType) => {
     const registry = z.registry<{ id: string }>();
-    for (let i = 0; i < count; i++) {
+    for (let i = 0; i < size; i++) {
       registry.add(z.object({ m: z.record(key(i) as z.core.$ZodRecordKey, z.boolean()) }), { id: `Type${i}` });
     }
-    const start = performance.now();
-    const { schemas } = z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` });
-    return { schemas, elapsed: performance.now() - start };
+    return countMapScanWork(() => z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` }));
   };
 
-  const string = convert(() => z.string());
-  const numeric = convert(() => z.number());
-  expect(numeric.schemas.Type0).toMatchObject({
+  const numeric = convert(count, () => z.number());
+  const numericDouble = convert(count * 2, () => z.number());
+  expect(numeric.result.schemas.Type0).toMatchObject({
     properties: { m: { propertyNames: { type: "string", pattern: "^-?\\d+(?:\\.\\d+)?$" } } },
   });
+  expect(numeric.work).toBeGreaterThan(0);
+  expect(numericDouble.work).toBeLessThanOrEqual(numeric.work * 2);
 
-  // The rewrite has to find every carrier the flatten copied `propertyNames` onto, which means a pass over the whole seen map. Running that once per record rather than once per conversion cost ~10x at this size. A string key needs no rewrite at all, so comparing against it keeps this independent of how fast the machine is.
-  expect(numeric.elapsed).toBeLessThan(string.elapsed * 2 + 50);
-
-  // An extracted key resolves through a map built once per conversion rather than a search per reference. There is no stable timing control for that — extraction has its own $defs cost, which swamps the difference — so this only pins the shape.
-  const extracted = convert((i) => z.number().meta({ id: `Key${i}` }));
-  expect(extracted.schemas.Type0).toMatchObject({
+  const extracted = convert(count, (i) => z.number().meta({ id: `Key${i}` }));
+  const extractedDouble = convert(count * 2, (i) => z.number().meta({ id: `Key${i}` }));
+  expect(extracted.result.schemas.Type0).toMatchObject({
     properties: { m: { propertyNames: { type: "string", pattern: "^-?\\d+(?:\\.\\d+)?$" } } },
   });
+  expect(extracted.work).toBeGreaterThan(0);
+  expect(extractedDouble.work).toBeLessThanOrEqual(extracted.work * 2);
 });
 
 test("registry extracts unregistered subschemas into __shared", () => {
@@ -3849,6 +3867,31 @@ test("input JSON schema resolves requiredness past transform and catch wrappers"
   expect(required(z.object({ a: z.transform((v: unknown) => String(v)).pipe(z.string()) }))).toEqual(["a"]);
 });
 
+test("object required keys preserve shape order and direction", () => {
+  const symbol = Symbol("symbol");
+  const shape: z.ZodRawShape = {
+    10: z.string(),
+    2: z.string().optional(),
+    plain: z.string(),
+    optional: z.string().optional(),
+    defaulted: z.string().default("x"),
+    caught: z.string().catch("x"),
+    [symbol]: z.string(),
+  };
+  Object.defineProperty(shape, "__proto__", { value: z.string(), enumerable: true });
+  Object.defineProperty(shape, "hidden", { value: z.string(), enumerable: false });
+
+  const input = z.toJSONSchema(z.object(shape), { io: "input", unrepresentable: "any" });
+  const output = z.toJSONSchema(z.object(shape), { io: "output", unrepresentable: "any" });
+
+  expect(Object.keys(input.properties!)).toEqual(["2", "10", "plain", "optional", "defaulted", "caught", "__proto__"]);
+  expect(input.required).toEqual(["10", "plain", "caught", "__proto__"]);
+  expect(output.required).toEqual(["10", "plain", "defaulted", "caught", "__proto__"]);
+  expect(Object.prototype.hasOwnProperty.call(input.properties!, "__proto__")).toBe(true);
+  expect(input.properties).not.toHaveProperty("hidden");
+  expect(Object.getOwnPropertySymbols(input.properties!)).toEqual([]);
+});
+
 test("strip output-side examples from input JSON schema for codec", () => {
   const codec = z
     .codec(z.string(), z.number(), { decode: (s) => Number(s), encode: (n) => String(n) })
@@ -4679,3 +4722,12 @@ describe("intersection folding declines", () => {
     expect(allOf(schema)).toHaveLength(3);
   });
 });
+
+test("currency code", () => {
+  expect(z.toJSONSchema(z.currencyCode())).toEqual({
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "string",
+    format: "currency_code",
+    pattern: z.regexes.currencyCode.source,
+  });
+});

package/src/v4/core/api.ts

@@ -58,16 +58,20 @@ export type CheckTypeParams<
 > = Params<T, NonNullable<T["_zod"]["isst"] | T["_zod"]["issc"]>, "type" | "checks" | "error" | "check" | AlsoOmit>;
 
 // String
-export type $ZodStringParams = TypeParams<schemas.$ZodString<string>, "coerce">;
+export type $ZodStringParams = TypeParams<schemas.$ZodString<string>, "coerce"> & {
+  checks?: readonly checks.$ZodCheck<string>[];
+};
+
+function snapshotChecks<T extends { checks?: readonly checks.$ZodCheck<never>[] }>(def: T) {
+  if (def.checks) def.checks = [...def.checks];
+  return def as T & { checks?: NonNullable<T["checks"]>[number][] };
+}
 // @__NO_SIDE_EFFECTS__
 export function _string<T extends schemas.$ZodString>(
   Class: util.SchemaClass<T>,
   params?: string | $ZodStringParams
 ): T {
-  return new Class({
-    type: "string",
-    ...util.normalizeParams(params),
-  });
+  return new Class(snapshotChecks({ type: "string" as const, ...util.normalizeParams(params) }));
 }
 
 // @__NO_SIDE_EFFECTS__
@@ -75,11 +79,7 @@ export function _coercedString<T extends schemas.$ZodString>(
   Class: util.SchemaClass<T>,
   params?: string | $ZodStringParams
 ): T {
-  return new Class({
-    type: "string",
-    coerce: true,
-    ...util.normalizeParams(params),
-  });
+  return new Class(snapshotChecks({ type: "string" as const, coerce: true, ...util.normalizeParams(params) }));
 }
 
 export type $ZodStringFormatParams = CheckTypeParams<
@@ -608,7 +608,9 @@ export function _isoDuration<T extends schemas.$ZodISODuration>(
 }
 
 // Number
-export type $ZodNumberParams = TypeParams<schemas.$ZodNumber<number>, "coerce">;
+export type $ZodNumberParams = TypeParams<schemas.$ZodNumber<number>, "coerce"> & {
+  checks?: readonly checks.$ZodCheck<number>[];
+};
 export type $ZodNumberFormatParams = CheckTypeParams<schemas.$ZodNumberFormat, "format" | "coerce">;
 export type $ZodCheckNumberFormatParams = CheckParams<checks.$ZodCheckNumberFormat, "format" | "when">;
 // @__NO_SIDE_EFFECTS__
@@ -616,11 +618,7 @@ export function _number<T extends schemas.$ZodNumber>(
   Class: util.SchemaClass<T>,
   params?: string | $ZodNumberParams
 ): T {
-  return new Class({
-    type: "number",
-    checks: [],
-    ...util.normalizeParams(params),
-  });
+  return new Class(snapshotChecks({ type: "number" as const, checks: [], ...util.normalizeParams(params) }));
 }
 
 // @__NO_SIDE_EFFECTS__
@@ -628,12 +626,9 @@ export function _coercedNumber<T extends schemas.$ZodNumber>(
   Class: util.SchemaClass<T>,
   params?: string | $ZodNumberParams
 ): T {
-  return new Class({
-    type: "number",
-    coerce: true,
-    checks: [],
-    ...util.normalizeParams(params),
-  });
+  return new Class(
+    snapshotChecks({ type: "number" as const, coerce: true, checks: [], ...util.normalizeParams(params) })
+  );
 }
 
 // @__NO_SIDE_EFFECTS__
@@ -1144,16 +1139,13 @@ export function _property<K extends string, T extends schemas.$ZodType>(
   });
 }
 
-// `when` is omitted: it gates a check inside the run loop, so it means nothing when this is parsed as a schema, and honoring it in one role only would diverge silently
-export type $ZodPropertiesParams = CheckTypeParams<schemas.$ZodProperties, "shape" | "when">;
+export type $ZodCheckPropertiesParams = CheckParams<checks.$ZodCheckProperties, "shape" | "when">;
 // @__NO_SIDE_EFFECTS__
 export function _properties<Shape extends schemas.$ZodShape>(
-  Class: util.SchemaClass<schemas.$ZodProperties>,
   shape: Shape,
-  params?: string | $ZodPropertiesParams
-): schemas.$ZodProperties<Shape> {
-  return new Class({
-    type: "properties",
+  params?: string | $ZodCheckPropertiesParams
+): checks.$ZodCheckProperties<Shape> {
+  return new checks.$ZodCheckProperties({
     check: "properties",
     shape,
     ...util.normalizeParams(params),

package/src/v4/core/checks.ts

@@ -1000,7 +1000,7 @@ export const $ZodCheckEndsWith: core.$constructor<$ZodCheckEndsWith> = /*@__PURE
 function handleCheckPropertyResult(
   result: schemas.ParsePayload<unknown>,
   payload: schemas.ParsePayload<unknown>,
-  property: string
+  property: string | symbol
 ) {
   if (result.issues.length) {
     payload.issues.push(...util.prefixIssues(property, result.issues));
@@ -1045,6 +1045,66 @@ export const $ZodCheckProperty: core.$constructor<$ZodCheckProperty> = /*@__PURE
   }
 );
 
+/////////////////////////////////////
+/////    $ZodCheckProperties    /////
+/////////////////////////////////////
+export interface $ZodCheckPropertiesDef<Shape extends schemas.$ZodShape = schemas.$ZodShape> extends $ZodCheckDef {
+  check: "properties";
+  shape: Shape;
+}
+
+// typed over the input side, since each child's result is discarded; a literal widens to its primitive so spreading over a `string` property still type-checks (#6520)
+export type $ZodCheckPropertiesInput<Shape extends schemas.$ZodShape = schemas.$ZodShape> = {
+  -readonly [k in keyof Shape]: util.Widen<core.input<Shape[k]>>;
+};
+
+export interface $ZodCheckPropertiesInternals<Shape extends schemas.$ZodShape = schemas.$ZodShape>
+  extends $ZodCheckInternals<$ZodCheckPropertiesInput<Shape>> {
+  def: $ZodCheckPropertiesDef<Shape>;
+  issc: errors.$ZodIssue;
+}
+
+export interface $ZodCheckProperties<Shape extends schemas.$ZodShape = schemas.$ZodShape>
+  extends $ZodCheck<$ZodCheckPropertiesInput<Shape>> {
+  _zod: $ZodCheckPropertiesInternals<Shape>;
+  // yields the check itself, so `.check(...z.properties(shape))` spread call sites keep working
+  [Symbol.iterator](): Iterator<this>;
+}
+
+export const $ZodCheckProperties: core.$constructor<$ZodCheckProperties> = /*@__PURE__*/ core.$constructor(
+  "$ZodCheckProperties",
+  (inst, def) => {
+    $ZodCheck.init(inst, def);
+    util.hide(inst, Symbol.iterator, function* () {
+      yield inst;
+    });
+
+    // key and schema snapshotted together: reading one live and the other cached lets a later mutation of the caller's shape object pair a stale key with a missing schema
+    let entries!: [string | symbol, schemas.$ZodType][];
+    inst._zod.check = (payload) => {
+      // the base schema already typed the value, so only a nullish one is rejected here: the properties read on a primitive too, matching z.property() on a string's length
+      if (payload.value == null) {
+        payload.issues.push({ expected: "object", code: "invalid_type", input: payload.value, inst });
+        return undefined;
+      }
+      entries ??= Reflect.ownKeys(def.shape).map((key) => [key, (def.shape as any)[key] as schemas.$ZodType]);
+      const input = payload.value as any;
+      let proms: Promise<any>[] | undefined;
+      for (const [key, schema] of entries) {
+        const result = schema._zod.run({ value: input[key], issues: [] }, {});
+        if (result instanceof Promise) {
+          proms ??= [];
+          proms.push(result.then((result) => handleCheckPropertyResult(result, payload, key)));
+        } else {
+          handleCheckPropertyResult(result, payload, key);
+        }
+      }
+      if (proms) return Promise.all(proms).then(() => undefined);
+      return undefined;
+    };
+  }
+);
+
 ///////////////////////////////////
 /////    $ZodCheckMimeType    /////
 ///////////////////////////////////

package/src/v4/core/compile.ts

@@ -13,12 +13,12 @@ import {
   isValidIPv6,
   isValidJWT,
   mergeValues,
-  parseURLObject,
   stripTabAndNewline,
   urlHostnameOk,
   urlProtocolOk,
+  validateURL,
 } from "./schemas.js";
-import type { $ZodProperties, $ZodPropertiesDef, ParseContextInternal, ParsePayload, SomeType } from "./schemas.js";
+import type { ParseContextInternal, ParsePayload, SomeType } from "./schemas.js";
 import * as util from "./util.js";
 
 /** @internal Sentinel the compiled fast path returns when validation fails. */
@@ -89,7 +89,7 @@ type SupportedCheck =
   | checks.$ZodCheckLengthEquals
   | checks.$ZodCheckStringFormat
   | checks.$ZodCheckProperty
-  | $ZodProperties
+  | checks.$ZodCheckProperties
   | checks.$ZodCheckMimeType
   | checks.$ZodCheckOverwrite
   | { _zod: { def: { check: "custom"; fn?: (value: unknown) => boolean }; check?: (payload: unknown) => unknown } };
@@ -455,7 +455,7 @@ function generateChecks(doc: Doc, ctx: CompileContext, schema: SomeType, accesso
         generatePropertyCheck(doc, ctx, def, currentAccessor);
         break;
       case "properties":
-        generatePropertiesChecks(doc, ctx, def, currentAccessor, false);
+        generatePropertiesChecks(doc, ctx, def, currentAccessor);
         break;
       case "overwrite": {
         // Overwrite transforms the value - create new variable for transformed result
@@ -616,20 +616,15 @@ function generateMimeTypeCheck(
 function generatePropertiesChecks(
   doc: Doc,
   ctx: CompileContext,
-  def: $ZodPropertiesDef,
-  accessor: string,
-  schemaRole: boolean
+  def: checks.$ZodCheckPropertiesDef,
+  accessor: string
 ): void {
-  // a custom `when` gates the assertion at runtime; inside a union a wrongly-run branch is absorbed as a branch failure rather than falling back, so refuse at codegen the way the check role does
+  // a custom `when` gates the assertion at runtime; inside a union a wrongly-run branch is absorbed as a branch failure rather than falling back, so refuse at codegen
   if (def.when) {
     throw new ZodCompileUnsupportedError(`check with a custom "when" condition`);
   }
-  // matches the runtime gate for whichever role this is: a schema rejects a primitive outright, a check only a nullish value
-  doc.write(
-    schemaRole
-      ? `if (${accessor} === null || (typeof ${accessor} !== "object" && typeof ${accessor} !== "function")) return INVALID;`
-      : `if (${accessor} == null) return INVALID;`
-  );
+  // matches the runtime gate: the base schema already typed the value, so only a nullish one is rejected
+  doc.write(`if (${accessor} == null) return INVALID;`);
   const shape = def.shape as Record<string | symbol, SomeType>;
   for (const key of Reflect.ownKeys(shape)) {
     // a symbol has no source literal, so it is hoisted as a constant
@@ -777,7 +772,21 @@ const PATTERN_IS_COMPLETE: Set<string> = new Set([
 ]);
 
 // Returns the accessor holding the (possibly normalized) value after the check — url/normalize formats produce a new value like overwrite does. Never assigns to the incoming accessor: it may be a `const` or a property expression on user input.
-function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFormatDef, accessor: string): string {
+function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFormatDef, accessor: string): string;
+function generateStringFormatCheck(
+  doc: Doc,
+  ctx: CompileContext,
+  def: StringFormatDef,
+  accessor: string,
+  needsValue: boolean
+): string | null;
+function generateStringFormatCheck(
+  doc: Doc,
+  ctx: CompileContext,
+  def: StringFormatDef,
+  accessor: string,
+  needsValue = true
+): string | null {
   // Some string formats do runtime validation beyond their advertised pattern. For cheap pure utility checks, hoist the runtime function and call it so the fast path stays correct without cloning the utility logic into codegen.
   const fmt = def.format;
   if (fmt === "base64") {
@@ -825,7 +834,7 @@ function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFor
     formatDef.protocol !== undefined
   ) {
     // Same three predicates the runtime calls, in the same order, so there is no second URL implementation to drift. Which options exist is known now, so the calls the runtime makes conditionally are emitted conditionally instead.
-    const parseConst = addConstant(ctx, parseURLObject);
+    const parseConst = addConstant(ctx, validateURL);
     const defConst = addConstant(ctx, def);
     const trimVar = newVar(ctx);
     const urlVar = newVar(ctx);
@@ -840,6 +849,7 @@ function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFor
       const protocolConst = addConstant(ctx, urlProtocolOk);
       doc.write(`if (!${protocolConst}(${urlVar}, ${defConst}.protocol)) return INVALID;`);
     }
+    if (!needsValue) return null;
     const outputVar = newVar(ctx);
     const outputExpr = formatDef.normalize ? `${urlVar}.href` : `${addConstant(ctx, stripTabAndNewline)}(${trimVar})`;
     doc.write(`const ${outputVar} = ${outputExpr};`);
@@ -934,7 +944,6 @@ type SupportedSchemaType =
   | "lazy"
   | "pipe"
   | "custom"
-  | "properties"
   | "transform"
   | "catch";
 
@@ -967,7 +976,7 @@ function generateCheck(
 
   switch (type) {
     case "string":
-      typeAccessor = generateStringCheck(doc, ctx, schema, accessor);
+      typeAccessor = generateStringCheck(doc, ctx, schema, accessor, buildsValue);
       break;
     case "number":
       typeAccessor = generateNumberCheck(doc, schema, accessor);
@@ -1079,10 +1088,6 @@ function generateCheck(
     case "custom":
       typeAccessor = generateCustomCheck(doc, ctx, schema, accessor);
       break;
-    case "properties":
-      generatePropertiesChecks(doc, ctx, (schema as $ZodProperties)._zod.def, accessor, true);
-      typeAccessor = accessor;
-      break;
     case "transform":
       typeAccessor = generateTransformCheck(doc, ctx, schema, accessor);
       break;
@@ -1102,13 +1107,19 @@ function generateCheck(
   return generateChecks(doc, ctx, schema, typeAccessor);
 }
 
-function generateStringCheck(doc: Doc, ctx: CompileContext, schema: SomeType, accessor: string): string {
+function generateStringCheck(
+  doc: Doc,
+  ctx: CompileContext,
+  schema: SomeType,
+  accessor: string,
+  needsValue = true
+): string | null {
   doc.write(`if (typeof ${accessor} !== "string") return INVALID;`);
 
   // z.email() carries its format on the def, z.string().email() in def.checks; both route here so the format table has no second copy to drift from.
   const def = schema._zod.def as unknown as StringFormatDef & { format?: string };
   if (def.format === undefined) return accessor;
-  return generateStringFormatCheck(doc, ctx, def, accessor);
+  return generateStringFormatCheck(doc, ctx, def, accessor, needsValue);
 }
 
 function generateNumberCheck(doc: Doc, schema: SomeType, accessor: string): string {

package/src/v4/core/core.ts

@@ -79,9 +79,7 @@ export /*@__NO_SIDE_EFFECTS__*/ function $constructor<T extends ZodTrait, D = T[
         // Cleared even on throw, so the shared descriptor never leaks one instance's internals into the next.
         _zodDesc.value = undefined;
       }
-    }
-
-    if (inst._zod.traits.has(name)) {
+    } else if (inst._zod.traits.has(name)) {
       return;
     }
 

package/src/v4/core/json-schema-processors.ts

@@ -16,7 +16,6 @@ import {
   finalize,
   handleUnrepresentable,
   initializeContext,
-  isTransforming,
   processSchema,
 } from "./to-json-schema.js";
 import { BIGINT_FORMAT_RANGES, NUMBER_FORMAT_RANGES, assignProp, getEnumValues } from "./util.js";
@@ -450,20 +449,16 @@ export const objectProcessor: Processor<schemas.$ZodObject> = (schema, ctx, _jso
   }
 
   // required keys
-  const allKeys = new Set(Object.keys(shape));
-  const requiredKeys = new Set(
-    [...allKeys].filter((key) => {
-      const field = def.shape[key]!;
-      if (ctx.io === "input") {
-        return inputOptin(field) === undefined;
-      } else {
-        return field._zod.optout === undefined;
-      }
-    })
-  );
+  const requiredKeys: string[] = [];
+  for (const key of Object.keys(shape)) {
+    const field = def.shape[key]!;
+    if (ctx.io === "input" ? inputOptin(field) === undefined : field._zod.optout === undefined) {
+      requiredKeys.push(key);
+    }
+  }
 
-  if (requiredKeys.size > 0) {
-    json.required = Array.from(requiredKeys);
+  if (requiredKeys.length > 0) {
+    json.required = requiredKeys;
   }
 
   // catchall
@@ -481,54 +476,6 @@ export const objectProcessor: Processor<schemas.$ZodObject> = (schema, ctx, _jso
   }
 };
 
-// asserts named properties in place and passes everything else through, so no additionalProperties constraint is emitted
-export const propertiesProcessor: Processor<schemas.$ZodProperties> = (schema, ctx, _json, params) => {
-  const json = _json as JSONSchema.ObjectSchema;
-  const def = schema._zod.def;
-
-  // dropping a symbol key silently would emit a schema that asserts less than this one does
-  if (
-    Object.getOwnPropertySymbols(def.shape).length &&
-    handleUnrepresentable(schema, ctx, json, params, "Symbol keys cannot be represented in JSON Schema")
-  ) {
-    return;
-  }
-
-  // the parsed value is the input, so an output-mode emission would describe a transformed value this schema never returns
-  if (ctx.io === "output") {
-    for (const key in def.shape) {
-      if (
-        isTransforming(def.shape[key]!) &&
-        handleUnrepresentable(
-          schema,
-          ctx,
-          json,
-          params,
-          `z.properties() returns its input, so the output of a transforming schema at key "${key}" cannot be represented in JSON Schema`
-        )
-      ) {
-        return;
-      }
-    }
-  }
-
-  json.type = "object";
-  json.properties = {};
-  for (const key in def.shape) {
-    assignProp(
-      json.properties,
-      key,
-      processSchema(def.shape[key]!, ctx as any, {
-        ...params,
-        path: [...params.path, "properties", key],
-      })
-    );
-  }
-  // input-side optionality in both modes: the parsed value is the input, so a defaulted key that stays absent must not be required of the output either
-  const required = Object.keys(def.shape).filter((key) => inputOptin(def.shape[key]!) === undefined);
-  if (required.length > 0) json.required = required;
-};
-
 export const unionProcessor: Processor<schemas.$ZodUnion> = (schema, ctx, json, params) => {
   const def = schema._zod.def as schemas.$ZodUnionDef;
   // Exclusive unions (inclusive === false) use oneOf (exactly one match) instead of anyOf (one or more matches). This includes both z.xor() and discriminated unions
@@ -904,7 +851,6 @@ export const allProcessors: Record<string, Processor<any>> = {
   file: fileProcessor,
   success: successProcessor,
   custom: customProcessor,
-  properties: propertiesProcessor,
   function: functionProcessor,
   transform: transformProcessor,
   map: mapProcessor,

package/src/v4/core/memoizer.ts

@@ -28,9 +28,9 @@ type WithState = { [STATE]?: State };
 
 const NO_ISSUES: errors.$ZodRawIssue[] = [];
 
-// a value a cycle can close through; callables count, since z.properties asserts on one
+// a value a cycle can close through
 function isRef(value: unknown): value is object {
-  return value !== null && (typeof value === "object" || typeof value === "function");
+  return value !== null && typeof value === "object";
 }
 
 // Receivers prefix paths in place, so the cache and every hand-out need their own copies.
@@ -90,9 +90,6 @@ function isRecursive(inst: $ZodType, stack: Set<object>, resolve: boolean): Answ
       check(def.catchall);
       break;
     }
-    case "properties":
-      merge(shape(def.shape, false));
-      break;
     case "array":
       check(def.element);
       break;

package/src/v4/core/regexes.ts

@@ -98,6 +98,10 @@ export const e164: RegExp = /^\+[1-9]\d{6,14}$/;
 // Credit card shape: 12–19 digits, optionally separated by single spaces or single hyphens. ISO/IEC 7812 caps the PAN at 19 digits; 12 is the shortest issued length (Maestro).
 export const creditCard: RegExp = /^\d(?:[ -]?\d){11,18}$/;
 
+// ISO 4217 alpha codes from the SIX list, regenerated by scripts/update-iso-4217.ts
+export const currencyCode: RegExp =
+  /^(?:AED|AFN|ALL|AMD|AOA|ARS|AUD|AWG|AZN|BAM|BBD|BDT|BHD|BIF|BMD|BND|BOB|BOV|BRL|BSD|BTN|BWP|BYN|BZD|CAD|CDF|CHE|CHF|CHW|CLF|CLP|CNY|COP|COU|CRC|CUP|CVE|CZK|DJF|DKK|DOP|DZD|EGP|ERN|ETB|EUR|FJD|FKP|GBP|GEL|GHS|GIP|GMD|GNF|GTQ|GYD|HKD|HNL|HTG|HUF|IDR|ILS|INR|IQD|IRR|ISK|JMD|JOD|JPY|KES|KGS|KHR|KMF|KPW|KRW|KWD|KYD|KZT|LAK|LBP|LKR|LRD|LSL|LYD|MAD|MDL|MGA|MKD|MMK|MNT|MOP|MRU|MUR|MVR|MWK|MXN|MXV|MYR|MZN|NAD|NGN|NIO|NOK|NPR|NZD|OMR|PAB|PEN|PGK|PHP|PKR|PLN|PYG|QAR|RON|RSD|RUB|RWF|SAR|SBD|SCR|SDG|SEK|SGD|SHP|SLE|SOS|SRD|SSP|STN|SVC|SYP|SZL|THB|TJS|TMT|TND|TOP|TRY|TTD|TWD|TZS|UAH|UGX|USD|USN|UYI|UYU|UYW|UZS|VED|VES|VND|VUV|WST|XAD|XAF|XAG|XAU|XBA|XBB|XBC|XBD|XCD|XCG|XDR|XOF|XPD|XPF|XPT|XSU|XTS|XUA|XXX|YER|ZAR|ZMW|ZWG)$/;
+
 // iban electronic format: 2-letter country, check digits 02-98 (the only values `98 - remainder` can produce), 11-30 bban characters
 export const iban: RegExp = /^[A-Z]{2}(?!00|01|99)\d{2}[A-Z0-9]{11,30}$/;