zod 4.6.2 → 4.6.4

package/src/v4/core/schemas.ts

@@ -96,8 +96,7 @@ export interface $ZodTypeDef {
     | "promise"
     | "lazy"
     | "function"
-    | "custom"
-    | "properties";
+    | "custom";
   error?: errors.$ZodErrorMap<never> | undefined;
   checks?: checks.$ZodCheck<never>[];
 }
@@ -523,10 +522,30 @@ export interface $ZodURL extends $ZodType {
 
 /** The `://` guard rejected the input before the URL constructor saw it. */
 export const URL_BAD_FORMAT = 1;
-/** The URL constructor rejected the input. */
+/** The URL parser rejected the input. */
 export const URL_UNPARSEABLE = 2;
 
-/** Parses a URL for `$ZodURL`, applying the one guard the URL constructor cannot express. Returns the parsed URL, or a code naming the stage that rejected it — the runtime needs that distinction to pick an issue note, and compiled code only needs to know it is not a URL. */
+export function canParseURL(input: string): boolean {
+  try {
+    if (typeof URL !== "undefined" && typeof URL.canParse === "function") return URL.canParse(input);
+    new URL(input);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function validateURL(
+  trimmed: string,
+  def: Pick<$ZodURLDef, "protocol" | "hostname" | "normalize">
+): URL | true | typeof URL_BAD_FORMAT | typeof URL_UNPARSEABLE {
+  if (!("normalize" in def) && !("hostname" in def) && !("protocol" in def)) {
+    return canParseURL(trimmed) || URL_UNPARSEABLE;
+  }
+  return parseURLObject(trimmed, def);
+}
+
+/** Parses a URL while preserving the non-normalizing HTTP guard. */
 export function parseURLObject(
   trimmed: string,
   def: Pick<$ZodURLDef, "protocol" | "normalize">
@@ -537,6 +556,10 @@ export function parseURLObject(
   }
 
   try {
+    if (typeof URL !== "undefined") {
+      const URLStatic = URL as typeof URL & { parse?: (input: string) => URL | null };
+      if (typeof URLStatic.parse === "function") return URLStatic.parse(trimmed) ?? URL_UNPARSEABLE;
+    }
     // @ts-ignore
     return new URL(trimmed);
   } catch {
@@ -567,7 +590,7 @@ export const $ZodURL: core.$constructor<$ZodURL> = /*@__PURE__*/ core.$construct
     try {
       // Trim whitespace from input
       const trimmed = payload.value.trim();
-      const url = parseURLObject(trimmed, def);
+      const url = validateURL(trimmed, def);
 
       if (url === URL_BAD_FORMAT) {
         payload.issues.push({
@@ -592,6 +615,11 @@ export const $ZodURL: core.$constructor<$ZodURL> = /*@__PURE__*/ core.$construct
         return;
       }
 
+      if (url === true) {
+        payload.value = stripTabAndNewline(trimmed);
+        return;
+      }
+
       if (def.hostname && !urlHostnameOk(url, def.hostname)) {
         payload.issues.push({
           code: "invalid_format",
@@ -886,13 +914,7 @@ const ipv6Alphabet = /^[0-9a-fA-F:.]+$/;
 
 export function isValidIPv6(value: string): boolean {
   if (!ipv6Alphabet.test(value)) return false;
-  try {
-    // @ts-ignore
-    new URL(`http://[${value}]`);
-    return true;
-  } catch {
-    return false;
-  }
+  return canParseURL(`http://[${value}]`);
 }
 
 export const $ZodIPv6: core.$constructor<$ZodIPv6> = /*@__PURE__*/ core.$constructor("$ZodIPv6", (inst, def): void => {
@@ -5096,101 +5118,6 @@ function handleRefineResult(result: unknown, payload: ParsePayload, input: unkno
   }
 }
 
-////////////////////////////////////////
-////////////////////////////////////////
-//////////                    //////////
-//////////  $ZodProperties    //////////
-//////////                    //////////
-////////////////////////////////////////
-////////////////////////////////////////
-export interface $ZodPropertiesDef<Shape extends $ZodShape = $ZodShape> extends $ZodTypeDef, checks.$ZodCheckDef {
-  type: "properties";
-  check: "properties";
-  shape: Shape;
-}
-
-// both sides infer the INPUT type: the shape is asserted and its results discarded, so a default, catch or transform inside it would make an output-typed inference a lie. The check side widens a literal to its primitive, so spreading over a `string` property still type-checks (#6520).
-export interface $ZodPropertiesInternals<Shape extends $ZodShape = $ZodShape>
-  extends $ZodTypeInternals<$InferObjectInput<Shape, {}>, $InferObjectInput<Shape, {}>>,
-    checks.$ZodCheckInternals<{ -readonly [k in keyof Shape]: util.Widen<core.input<Shape[k]>> }> {
-  def: $ZodPropertiesDef<Shape>;
-  isst: errors.$ZodIssueInvalidType;
-  issc: errors.$ZodIssue;
-}
-
-export interface $ZodProperties<Shape extends $ZodShape = $ZodShape> extends $ZodType {
-  _zod: $ZodPropertiesInternals<Shape>;
-  // yields the schema itself, so pre-4.6 `.check(...z.properties(shape))` spread call sites keep working
-  [Symbol.iterator](): Iterator<this>;
-}
-
-// asserts in place: the child result's value is discarded, matching z.property(), because a nested object or array schema rebuilds its output even when nothing transformed
-function handlePropertiesResult(result: ParsePayload, payload: ParsePayload, key: string | symbol): void {
-  if (result.issues.length) {
-    payload.issues.push(...util.prefixIssues(key, result.issues));
-  }
-}
-
-export const $ZodProperties: core.$constructor<$ZodProperties> = /*@__PURE__*/ core.$constructor(
-  "$ZodProperties",
-  (inst, def) => {
-    // $ZodType.init prepends an instance that already carries the $ZodCheck trait to its own `checks`, which would run the shape a second time and cost the parse context. Initializing the check trait after it keeps the schema role in `parse`, where the context arrives.
-    $ZodType.init(inst, def);
-    checks.$ZodCheck.init(inst, def);
-
-    const memo = core.globalConfig.memoizer;
-    memo?.attach(inst);
-
-    // key and schema snapshotted together: reading one live and the other cached lets a later mutation of the caller's shape object pair a stale key with a missing schema
-    let entries!: [string | symbol, $ZodType][];
-    const runShape = (payload: ParsePayload, ctx: ParseContextInternal): util.MaybeAsync<void> => {
-      entries ??= Reflect.ownKeys(def.shape).map((key) => [key, (def.shape as any)[key] as $ZodType]);
-      const input = payload.value as any;
-      let proms: Promise<any>[] | undefined;
-      for (const [key, schema] of entries) {
-        const result = schema._zod.run({ value: input[key], issues: [] }, ctx);
-        if (result instanceof Promise) {
-          proms ??= [];
-          proms.push(result.then((result) => handlePropertiesResult(result, payload, key)));
-        } else {
-          handlePropertiesResult(result, payload, key);
-        }
-      }
-      if (proms) return Promise.all(proms).then(() => undefined);
-      return undefined;
-    };
-
-    inst._zod.parse = (payload, ctx) => {
-      const input = payload.value;
-      // as a schema this is the type gate, and it infers an object shape, so a primitive is a type error. A function passes: its properties read like any other object's, and z.instanceof allows one.
-      if (input === null || (typeof input !== "object" && typeof input !== "function")) {
-        payload.issues.push({ expected: "object", code: "invalid_type", input, inst });
-        return payload;
-      }
-      // both sides declare the shape's input type, so the assertion runs forward in either direction; encoding the children backward would reject the very type this schema claims to take
-      if (ctx.direction === "backward") ctx = { ...ctx, direction: "forward" };
-      // the input is its own output here, so it registers as its own memo entry: a cycle re-entering this node hits the bucket instead of recursing forever
-      if (memo) memo.alloc(inst, payload, input, ctx);
-      const result = runShape(payload, ctx);
-      return result instanceof Promise ? result.then(() => payload) : payload;
-    };
-
-    // as a check the base schema already typed the value, so this only asserts the properties — which read on a primitive too, matching z.property() on a string's length. It gets no context of its own, so a cycle through a spread schema is not tracked.
-    inst._zod.check = (payload) => {
-      if (payload.value == null) {
-        payload.issues.push({ expected: "object", code: "invalid_type", input: payload.value, inst });
-        return undefined;
-      }
-      return runShape(payload, {});
-    };
-  },
-  {
-    *[Symbol.iterator]() {
-      yield this;
-    },
-  }
-);
-
 export type $ZodTypes =
   | $ZodString
   | $ZodNumber
@@ -5223,7 +5150,6 @@ export type $ZodTypes =
   | $ZodPrefault
   | $ZodTemplateLiteral
   | $ZodCustom
-  | $ZodProperties
   | $ZodTransform
   | $ZodNonOptional
   | $ZodReadonly
@@ -5262,4 +5188,5 @@ export type $ZodStringFormatTypes =
   | $ZodJWT
   | $ZodCustomStringFormat<"hex">
   | $ZodCustomStringFormat<util.HashFormat>
-  | $ZodCustomStringFormat<"hostname">;
+  | $ZodCustomStringFormat<"hostname">
+  | $ZodCustomStringFormat<"currency_code">;

package/src/v4/core/tests/compile-differential.test.ts

@@ -677,6 +677,41 @@ test("url options match the runtime across the whole option matrix", () => {
   for (const schema of schemas) differential(schema, inputs);
 });
 
+test("assert-only URL generation skips unused output without skipping chained transforms", () => {
+  const sanitized = "https://example.com";
+  const withNewline = "https://exa\nmple.com";
+  differential(z.url().length(sanitized.length), [sanitized, withNewline, "https://example.com/long"]);
+  differential(z.string().url().length(sanitized.length), [sanitized, withNewline, "https://example.com/long"]);
+
+  const URLStatic = URL as typeof URL & { parse: (input: string) => URL | null };
+  const descriptor = Object.getOwnPropertyDescriptor(URLStatic, "parse")!;
+  const marker = new Error("href read");
+  Object.defineProperty(URLStatic, "parse", {
+    configurable: true,
+    value: () =>
+      Object.create(URL.prototype, {
+        href: {
+          get() {
+            throw marker;
+          },
+        },
+      }) as URL,
+  });
+  try {
+    const schema = z.url({ normalize: true });
+    const parser = compileFn(schema);
+    const validator = compileFn(schema, { assertOnly: true });
+    expect(validator("https://example.com")).toBe(true);
+    expect(z.validate(compile(z.url({ normalize: true })), "https://example.com")).toBe(true);
+    expect(z.validate(compile(z.object({ url: z.url({ normalize: true }) })), { url: "https://example.com" })).toBe(
+      true
+    );
+    expect(() => parser("https://example.com")).toThrow(marker);
+  } finally {
+    Object.defineProperty(URLStatic, "parse", descriptor);
+  }
+});
+
 test("empty strict object compiles", () => {
   // With no keys the unknown-key condition is empty, and `if () return INVALID;` is a syntax error the single top-level `new Function` rejects — too late for compileChild to island, so the whole tree lost its fast path.
   differential(z.strictObject({}), [{}, { a: 1 }, Object.create({ inherited: 1 })]);

package/src/v4/core/tests/compile.test.ts

@@ -1787,6 +1787,183 @@ test("compiled records walk own enumerable keys without Reflect.ownKeys", () =>
   expect(compile(plain).parse(revealing())).toStrictEqual({ a: 1, b: 2 });
 });
 
+test("validate honors custom checks composed with format traits", () => {
+  const postProcessor = z.core.globalConfig.postProcessor;
+  z.core.globalConfig.postProcessor = undefined;
+  try {
+    const CustomEmail = z.core.$constructor<z.core.$ZodEmail>("CustomEmail", (inst, def) => {
+      inst._zod.check = (payload) => {
+        if (payload.value !== "custom") payload.issues.push({ code: "custom", input: payload.value });
+      };
+      z.core.$ZodEmail.init(inst, def);
+    });
+    const schema = new CustomEmail({ type: "string", format: "email", check: "string_format" });
+    for (const [input, valid] of [
+      ["custom", true],
+      ["test@example.com", false],
+      [42, false],
+    ] as const) {
+      expect(z.safeParse(schema, input).success).toBe(valid);
+      expect(z.validate(schema, input)).toBe(valid);
+    }
+  } finally {
+    z.core.globalConfig.postProcessor = postProcessor;
+  }
+});
+
+test("validate honors standalone format checks", () => {
+  const cases = [
+    [z.iso.datetime(), "2021-01-01T00:00:00Z"],
+    [z.iso.date(), "2021-01-01"],
+    [z.iso.time(), "00:00:00"],
+    [z.iso.duration(), "P1Y2M3DT4H5M6S"],
+    [z.email(), "test@example.com"],
+    [z.uuid(), "20354d7a-e4fe-47af-8ff6-187bca92f3f9"],
+    [z.ipv4(), "192.168.0.1"],
+  ] as const;
+
+  for (const [schema, valid] of cases) {
+    expect(schema._zod.traits.has("$ZodStringFormat")).toBe(true);
+    expect(schema instanceof z.core.$ZodStringFormat).toBe(true);
+    expect(z.validate(schema, valid)).toBe(true);
+    expect(z.validate(schema, "invalid")).toBe(false);
+    expect(z.validate(schema, 1)).toBe(false);
+  }
+
+  const source = z.email();
+  const refined = source.refine((value) => value.startsWith("x"));
+  const asyncRefined = source.refine(async () => true);
+  const coercedDef = Object.assign(Object.create({ coerce: true }), source._zod.def);
+  const coerced = source.clone(coercedDef);
+  const checkedDef = Object.assign(Object.create({ checks: refined._zod.def.checks }), source._zod.def);
+  const inheritedChecked = source.clone(checkedDef);
+  expect(z.validate(refined, "test@example.com")).toBe(false);
+  expect(z.validate(refined, "x@example.com")).toBe(true);
+  expect(z.validate(inheritedChecked, "test@example.com")).toBe(false);
+  expect(() => z.validate(asyncRefined, "test@example.com")).toThrow($ZodAsyncError);
+  expect(z.validate(coerced, { toString: () => "test@example.com" })).toBe(true);
+});
+
+test("runtime validate preserves contexts, getters, errors, and regex state", () => {
+  const postProcessor = z.core.globalConfig.postProcessor;
+  z.core.globalConfig.postProcessor = undefined;
+  try {
+    const source = z.email();
+    expect(z.validate(source, "invalid", { skipChecks: true } as any)).toBe(true);
+
+    let whenReads = 0;
+    const whenProto = Object.defineProperty({}, "when", {
+      enumerable: true,
+      get() {
+        whenReads++;
+        return () => false;
+      },
+    });
+    const whenDef = Object.assign(Object.create(whenProto), source._zod.def);
+    const gated = source.clone(whenDef as typeof source._zod.def);
+    expect(whenReads).toBe(0);
+    expect(z.validate(gated, "invalid")).toBe(true);
+    expect(whenReads).toBeGreaterThan(0);
+
+    let errorReads = 0;
+    const errorDef = Object.defineProperties({}, Object.getOwnPropertyDescriptors(source._zod.def));
+    Object.defineProperty(errorDef, "error", {
+      enumerable: true,
+      get() {
+        errorReads++;
+        return () => "custom";
+      },
+    });
+    const customError = source.clone(errorDef as typeof source._zod.def);
+    expect(z.validate(customError, "invalid")).toBe(false);
+    expect(errorReads).toBe(0);
+    const result = customError.safeParse("invalid");
+    expect(errorReads).toBe(0);
+    if (result.success) expect.unreachable();
+    expect(result.error.issues[0]?.message).toBe("custom");
+    expect(errorReads).toBeGreaterThan(0);
+
+    const pattern = /^a$/g;
+    const cloned = source.clone({ ...source._zod.def, pattern });
+    for (let i = 0; i < 3; i++) expect(z.validate(cloned, "a")).toBe(true);
+    expect(z.validate(cloned, "b")).toBe(false);
+    expect(pattern.lastIndex).toBe(0);
+    const replacement = /^b$/g;
+    cloned._zod.def.pattern = replacement;
+    expect(z.validate(cloned, "a")).toBe(false);
+    expect(z.validate(cloned, "b")).toBe(true);
+  } finally {
+    z.core.globalConfig.postProcessor = postProcessor;
+  }
+});
+
+test("validate preserves live pattern accessor reads", () => {
+  const postProcessor = z.core.globalConfig.postProcessor;
+  z.core.globalConfig.postProcessor = undefined;
+  try {
+    const schema = z.email();
+    let reads = 0;
+    Object.defineProperty(schema.def, "pattern", {
+      get: () => (++reads % 2 === 1 ? /^a$/ : /^b$/),
+    });
+    expect(schema.safeParse("b").success).toBe(true);
+    expect(reads).toBe(2);
+    reads = 0;
+    expect(z.validate(schema, "b")).toBe(true);
+    expect(reads).toBe(2);
+  } finally {
+    z.core.globalConfig.postProcessor = postProcessor;
+  }
+});
+
+test.each(["when", "coerce"] as const)("runtime validate honors live %s options", (option) => {
+  const postProcessor = z.core.globalConfig.postProcessor;
+  z.core.globalConfig.postProcessor = undefined;
+  try {
+    for (const inherited of [false, true]) {
+      const schema = z.email();
+      const input = option === "when" ? "invalid" : { toString: () => "test@example.com" };
+      expect(z.validate(schema, input)).toBe(false);
+
+      const target = inherited ? Object.create(Object.getPrototypeOf(schema.def)) : schema.def;
+      let reads = 0;
+      Object.defineProperty(target, option, {
+        get() {
+          reads++;
+          return option === "when" ? () => false : true;
+        },
+      });
+      if (inherited) Object.setPrototypeOf(schema.def, target);
+      expect(reads).toBe(0);
+      expect(z.validate(schema, input)).toBe(true);
+      expect(reads).toBeGreaterThan(0);
+      expect(schema.safeParse(input).success).toBe(true);
+    }
+  } finally {
+    z.core.globalConfig.postProcessor = postProcessor;
+  }
+});
+
+test("validate uses compiled validators and runtime fallbacks", () => {
+  const compiled = compile(z.email());
+  expect((compiled._zod.bag as { validator?: unknown }).validator).toBeTypeOf("function");
+  expect(z.validate(compiled, "test@example.com")).toBe(true);
+  expect(z.validate(compiled, "invalid")).toBe(false);
+  expect(z.validate(compiled, "invalid", { skipChecks: true } as any)).toBe(true);
+
+  const source = z.email();
+  const installed = withParser(source, () => INVALID);
+  const bag = installed._zod.bag as { fallbackRun: typeof source._zod.run };
+  const originalRun = bag.fallbackRun;
+  let fallbackRuns = 0;
+  bag.fallbackRun = (payload, ctx) => {
+    fallbackRuns++;
+    return originalRun(payload, ctx);
+  };
+  expect(z.validate(installed, "invalid")).toBe(false);
+  expect(fallbackRuns).toBeGreaterThan(0);
+});
+
 // withParser: a parser Zod did not generate, installed on the same wrapper compile() uses.
 
 // tags its output so a test fails loudly if the runtime ran instead of the supplied parser

package/src/v4/core/tests/url-no-canparse.test.ts

@@ -1,31 +1,133 @@
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 
-// schemas.ts resolves URL.canParse on first use, not at module load. Resetting the module registry gives the re-imported copy a fresh, unresolved `urlCanParseImpl`, so deleting URL.canParse before the first parse still selects the inline fallback branch (URL.canParse may be undefined on older runtimes).
-describe("z.url() with URL.canParse absent", () => {
-  const original = URL.canParse;
+const URLDescriptor = Object.getOwnPropertyDescriptor(globalThis, "URL")!;
+const NativeURL = globalThis.URL;
+const canParseDescriptor = Object.getOwnPropertyDescriptor(NativeURL, "canParse")!;
+const parseDescriptor = Object.getOwnPropertyDescriptor(NativeURL, "parse")!;
 
+function restoreURL() {
+  Object.defineProperty(globalThis, "URL", URLDescriptor);
+  Object.defineProperty(NativeURL, "canParse", canParseDescriptor);
+  Object.defineProperty(NativeURL, "parse", parseDescriptor);
+}
+
+describe("URL parser fallbacks", () => {
   beforeEach(() => {
+    restoreURL();
     vi.resetModules();
-    // @ts-expect-error force the fallback branch (URL.canParse may be undefined on older runtimes)
-    delete URL.canParse;
   });
 
-  afterEach(() => {
-    URL.canParse = original;
+  afterEach(restoreURL);
+
+  test("uses the boolean and object APIs on modern runtimes", async () => {
+    const canParse = vi.spyOn(NativeURL, "canParse");
+    const URLStatic = NativeURL as typeof URL & { parse: (input: string) => URL | null };
+    const parse = vi.spyOn(URLStatic, "parse");
+    const z = await import("../../index.js");
+
+    expect(z.validate(z.url(), "https://example.com")).toBe(true);
+    expect(canParse).toHaveBeenCalledOnce();
+    expect(parse).not.toHaveBeenCalled();
+
+    canParse.mockClear();
+    expect(z.validate(z.url({ normalize: true }), "https://example.com")).toBe(true);
+    expect(parse).toHaveBeenCalledOnce();
+    expect(canParse).not.toHaveBeenCalled();
+
+    parse.mockClear();
+    expect(z.validate(z.ipv6(), "2001:db8::1")).toBe(true);
+    expect(canParse).toHaveBeenCalledOnce();
+    expect(parse).not.toHaveBeenCalled();
   });
 
-  test("z.url() validates correctly without URL.canParse (runtime)", async () => {
-    expect(URL.canParse).toBeUndefined();
+  test("URL fast-path selection preserves live option getter reads", async () => {
     const z = await import("../../index.js");
-    expect(z.url().safeParse("https://example.com").success).toBe(true);
-    expect(z.url().safeParse("not a url").success).toBe(false);
+    const postProcessor = z.core.globalConfig.postProcessor;
+    z.core.globalConfig.postProcessor = undefined;
+    try {
+      for (const inherited of [false, true]) {
+        const schema = z.url();
+        const target = inherited ? Object.create(Object.getPrototypeOf(schema.def)) : schema.def;
+        let reads = 0;
+        Object.defineProperty(target, "hostname", {
+          get: () => (++reads === 1 ? /^example\.com$/ : undefined),
+        });
+        if (inherited) Object.setPrototypeOf(schema.def, target);
+        expect(z.validate(schema, "https://example.com")).toBe(false);
+        expect(reads).toBe(2);
+        reads = 0;
+        expect(schema.safeParse("https://example.com").success).toBe(false);
+        expect(reads).toBe(2);
+      }
+    } finally {
+      z.core.globalConfig.postProcessor = postProcessor;
+    }
+  });
+
+  test("the exported object parser still returns a URL", async () => {
+    const { parseURLObject } = await import("../schemas.js");
+    const result = parseURLObject("https://example.com", {});
+    expect(result).toBeInstanceOf(NativeURL);
+    if (typeof result === "number") expect.unreachable();
+    expect(result.hostname).toBe("example.com");
+    expect(parseURLObject("invalid", {})).toBe(2);
   });
 
-  test("z.url() validates correctly without URL.canParse (compiled)", async () => {
-    expect(URL.canParse).toBeUndefined();
+  test("falls back when URL.canParse is absent", async () => {
+    Reflect.deleteProperty(NativeURL, "canParse");
     const z = await import("../../index.js");
-    const compiled = z.compile(z.url());
-    expect(compiled.safeParse("https://example.com").success).toBe(true);
-    expect(compiled.safeParse("not a url").success).toBe(false);
+    const cases = [
+      [z.url(), "https://example.com", "not a url"],
+      [z.ipv6(), "2001:db8::1", "not-an-ip"],
+      [z.cidrv6(), "2001:db8::/32", "not-an-ip/32"],
+    ] as const;
+
+    for (const [schema, valid, invalid] of cases) {
+      for (const subject of [schema, z.compile(schema)]) {
+        expect(z.validate(subject, valid)).toBe(true);
+        expect(z.validate(subject, invalid)).toBe(false);
+        expect(subject.safeParse(valid).success).toBe(true);
+        expect(subject.safeParse(invalid).success).toBe(false);
+      }
+    }
+  });
+
+  test("falls back when URL.parse is absent", async () => {
+    Reflect.deleteProperty(NativeURL, "parse");
+    const z = await import("../../index.js");
+    const cases = [
+      [z.url({ normalize: true }), "https://example.com", "not a url"],
+      [z.url({ hostname: /^example\.com$/ }), "https://example.com", "https://other.com"],
+      [z.httpUrl(), "https://example.com", "mailto:a@example.com"],
+    ] as const;
+
+    for (const [schema, valid, invalid] of cases) {
+      for (const subject of [schema, z.compile(schema)]) {
+        expect(z.validate(subject, valid)).toBe(true);
+        expect(z.validate(subject, invalid)).toBe(false);
+        expect(subject.safeParse(valid).success).toBe(true);
+        expect(subject.safeParse(invalid).success).toBe(false);
+      }
+    }
+  });
+
+  test("rejects without a global URL constructor", async () => {
+    const z = await import("../../index.js");
+    const cases = [
+      [z.url(), "https://example.com"],
+      [z.url({ normalize: true }), "https://example.com"],
+      [z.ipv6(), "2001:db8::1"],
+      [z.cidrv6(), "2001:db8::/32"],
+    ] as const;
+    const subjects = cases.flatMap(([schema, input]) => [
+      [schema, input] as const,
+      [z.compile(schema), input] as const,
+    ]);
+    Object.defineProperty(globalThis, "URL", { configurable: true, value: undefined });
+
+    for (const [schema, input] of subjects) {
+      expect(z.validate(schema, input)).toBe(false);
+      expect(schema.safeParse(input).success).toBe(false);
+    }
   });
 });

package/src/v4/core/to-json-schema.ts

@@ -757,7 +757,7 @@ export function finalize<T extends schemas.$ZodType>(
   }
 }
 
-export function isTransforming(
+function isTransforming(
   _schema: schemas.$ZodType,
   _ctx?: {
     seen: Set<schemas.$ZodType>;

package/src/v4/core/util.ts

@@ -1125,10 +1125,6 @@ export function members(proto: object, table: object): void {
     // a method materializes bound on first read, which is what keeps a detached member working: `const opt = schema.optional; opt()`
     else defineBound(proto, key, desc.value);
   }
-  // for..in sees no symbol keys, so well-known members like Symbol.iterator install here
-  for (const sym of Object.getOwnPropertySymbols(table)) {
-    defineBound(proto, sym, (table as any)[sym]);
-  }
 }
 
 /** Shadows a prototype member with an own value, so a getter that builds from the instance runs once. */

package/src/v4/core/versions.ts

@@ -1,5 +1,5 @@
 export const version = {
   major: 4,
   minor: 6,
-  patch: 2 as number,
+  patch: 4 as number,
 } as const;

package/src/v4/core/visit.ts

@@ -158,17 +158,6 @@ export function visit(schema: schemas.SomeType, fnOrHandlers: VisitFn | VisitHan
         const { _cachedInner, ...rest } = def;
         return clone(s, { ...rest, getter: () => run(original()) });
       }
-      case "properties": {
-        const oldShape = def.shape as Record<string | symbol, AnyZod>;
-        let changed = false;
-        const newShape: Record<string | symbol, AnyZod> = {};
-        for (const k of Reflect.ownKeys(oldShape)) {
-          const mapped = run(oldShape[k]!);
-          if (mapped !== oldShape[k]) changed = true;
-          newShape[k] = mapped;
-        }
-        return changed ? clone(s, { ...def, shape: newShape }) : s;
-      }
       // A leaf by choice: `parts` are regex fragments, not data positions.
       case "template_literal":
       // Leaves.

package/src/v4/locales/ar.ts

@@ -46,6 +46,7 @@ const error: () => errors.$ZodErrorMap = () => {
     json_string: "نَص على هيئة JSON",
     e164: "رقم هاتف بمعيار E.164",
     credit_card: "رقم بطاقة الائتمان",
+    currency_code: "رمز العملة",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "مدخل",

package/src/v4/locales/az.ts

@@ -46,6 +46,7 @@ const error: () => errors.$ZodErrorMap = () => {
     json_string: "JSON string",
     e164: "E.164 number",
     credit_card: "kredit kartı nömrəsi",
+    currency_code: "valyuta kodu",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "input",

package/src/v4/locales/be.ts

@@ -109,6 +109,7 @@ const error: () => errors.$ZodErrorMap = () => {
     json_string: "JSON радок",
     e164: "нумар E.164",
     credit_card: "нумар крэдытнай карты",
+    currency_code: "код валюты",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "увод",

package/src/v4/locales/bg.ts

@@ -46,6 +46,7 @@ const error: () => errors.$ZodErrorMap = () => {
     json_string: "JSON низ",
     e164: "E.164 номер",
     credit_card: "номер на кредитна карта",
+    currency_code: "код на валута",
     iban: "IBAN",
     jwt: "JWT",
     template_literal: "вход",