zod 4.6.3 → 4.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.6.3",
+  "version": "4.6.4",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",

package/src/v4/classic/schemas.ts

@@ -2,6 +2,7 @@ import type { $ZodBigIntFormats } from "../core/checks.js";
 import * as core from "../core/index.js";
 import { util, type $ZodNumberFormats } from "../core/index.js";
 import * as processors from "../core/json-schema-processors.js";
+import * as regexes from "../core/regexes.js";
 import type { StandardSchemaWithJSONProps } from "../core/standard-schema.js";
 import { createStandardJSONSchemaMethod, createToJSONSchemaMethod } from "../core/to-json-schema.js";
 import en from "../locales/en.js";
@@ -770,8 +771,8 @@ export function url(params?: string | core.$ZodURLParams): ZodURL {
 
 export function httpUrl(params?: string | Omit<core.$ZodURLParams, "protocol" | "hostname">): ZodURL {
   return core._url(ZodURL, {
-    protocol: core.regexes.httpProtocol,
-    hostname: core.regexes.domain,
+    protocol: regexes.httpProtocol,
+    hostname: regexes.domain,
     ...util.normalizeParams(params),
   });
 }
@@ -1081,11 +1082,15 @@ export function stringFormat<Format extends string>(
 }
 
 export function hostname(_params?: string | core.$ZodStringFormatParams): ZodCustomStringFormat<"hostname"> {
-  return core._stringFormat(ZodCustomStringFormat, "hostname", core.regexes.hostname, _params) as any;
+  return core._stringFormat(ZodCustomStringFormat, "hostname", regexes.hostname, _params) as any;
 }
 
 export function hex(_params?: string | core.$ZodStringFormatParams): ZodCustomStringFormat<"hex"> {
-  return core._stringFormat(ZodCustomStringFormat, "hex", core.regexes.hex, _params) as any;
+  return core._stringFormat(ZodCustomStringFormat, "hex", regexes.hex, _params) as any;
+}
+
+export function currencyCode(_params?: string | core.$ZodStringFormatParams): ZodCustomStringFormat<"currency_code"> {
+  return core._stringFormat(ZodCustomStringFormat, "currency_code", regexes.currencyCode, _params) as any;
 }
 
 export function hash<Alg extends util.HashAlgorithm, Enc extends util.HashEncoding = "hex">(

package/src/v4/classic/tests/assignability.test.ts

@@ -352,6 +352,7 @@ test("checks", () => {
   const _b: z.core.$ZodCheck = {} as any as z.core.$ZodStringFormatChecks;
   const _c: z.core.$ZodType = {} as any as z.core.$ZodTypes;
   const _d: z.core.$ZodType = {} as any as z.core.$ZodStringFormatTypes;
+  z.currencyCode() satisfies z.core.$ZodStringFormatTypes;
 });
 
 test("assignability to $ZodType", () => {

package/src/v4/classic/tests/instance-footprint.test.ts

@@ -105,6 +105,28 @@ test("deferred initializers are released after construction", () => {
   expect(z.object({ a: z.string() })._zod.deferred).toEqual(undefined);
 });
 
+test("trait initializers run once per instance across repeated entry", () => {
+  const calls: string[] = [];
+  const Base: core.$constructor<any> = core.$constructor<any>("CountedBase", () => calls.push("base"));
+  const Child: core.$constructor<any> = core.$constructor<any>("CountedChild", (inst, def) => {
+    calls.push("child");
+    Base.init(inst, def);
+    Base.init(inst, def);
+  });
+  const constructed = new Child({});
+  Child.init(constructed, {});
+  const direct = Object.create({});
+  Child.init(direct, {});
+  Child.init(direct, {});
+  expect(calls).toEqual(["child", "base", "child", "base"]);
+  for (const inst of [constructed, direct]) {
+    expect([...inst._zod.traits]).toEqual(["CountedChild", "CountedBase"]);
+    expect(inst instanceof Base).toBe(true);
+    expect(inst instanceof Child).toBe(true);
+  }
+  expect(constructed._zod.traits).not.toBe(direct._zod.traits);
+});
+
 test("a trait initializer called directly still installs its members", () => {
   // a direct `init` installs onto the receiver's own prototype, since it is not below the constructor's
   z.string();

package/src/v4/classic/tests/number.test.ts

@@ -2,6 +2,45 @@ import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
+test("number factory checks", () => {
+  const schema = z.number({ checks: [z.gte(1), z.lte(3)] as const });
+  const chained = z.number().min(1).max(3);
+  expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<number>();
+  for (const value of [0, 1, 3, 4, Number.NaN, "2", undefined]) {
+    expect(z.validate(schema, value)).toBe(z.validate(chained, value));
+    expect(schema.safeParse(value)).toEqual(chained.safeParse(value));
+  }
+  expect(z.toJSONSchema(schema)).toEqual(z.toJSONSchema(chained));
+  expect(schema.minValue).toBe(1);
+  expect(schema.maxValue).toBe(3);
+  expect(z.coerce.number({ checks: [z.gte(1)] }).parse("2")).toBe(2);
+  const overwritten = z.number({ checks: [z.overwrite<number>((value) => value + 1), z.gte(2)] });
+  expect(overwritten.parse(1)).toBe(2);
+  expect(z.validate(overwritten, 0)).toBe(false);
+  // @ts-expect-error length checks cannot validate numbers
+  z.number({ checks: [z.minLength(1)] });
+});
+
+test("number factory checks snapshot caller arrays", () => {
+  for (const factory of [z.number, z.coerce.number]) {
+    const checks = [z.gte(1)];
+    const schema = factory({ checks });
+    let reads = 0;
+    factory({
+      get checks() {
+        if (++reads > 1) throw new Error("checks read twice");
+        return checks;
+      },
+    });
+    expect(reads).toBe(1);
+    const before = z.toJSONSchema(schema);
+    checks.push(z.gte(10));
+    expect(z.validate(schema, 3)).toBe(true);
+    expect(z.validate(z.compile(schema), 3)).toBe(true);
+    expect(z.toJSONSchema(schema)).toEqual(before);
+  }
+});
+
 test("z.number() basic validation", () => {
   const schema = z.number();
   expect(schema.parse(1234)).toEqual(1234);

package/src/v4/classic/tests/string.test.ts

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { expect, test } from "vitest";
+import { expect, expectTypeOf, test } from "vitest";
 
 import * as z from "zod/v4";
 
@@ -12,6 +12,63 @@ const includesFromIndex2 = z.string().includes("includes", { position: 2 });
 const startsWith = z.string().startsWith("startsWith");
 const endsWith = z.string().endsWith("endsWith");
 
+test("string factory checks", async () => {
+  const schema = z.string({ checks: [z.minLength(1), z.maxLength(3)] as const });
+  const chained = z.string().min(1).max(3);
+  expectTypeOf<z.output<typeof schema>>().toEqualTypeOf<string>();
+  for (const value of ["", "ab", "abcd", 1, undefined]) {
+    expect(z.validate(schema, value)).toBe(z.validate(chained, value));
+    expect(schema.safeParse(value)).toEqual(chained.safeParse(value));
+  }
+  expect(z.toJSONSchema(schema)).toEqual(z.toJSONSchema(chained));
+  expect(schema.minLength).toBe(1);
+  expect(schema.maxLength).toBe(3);
+  expect(schema._zod.parent).toBeUndefined();
+  expect([...schema._zod.traits]).toEqual([...chained._zod.traits]);
+  const extended = schema.max(2);
+  expect(extended._zod.parent).toBe(schema);
+  expect(z.validate(schema, "abc")).toBe(true);
+  expect(z.validate(extended, "abc")).toBe(false);
+  const coerce = z.coerce.string({ checks: [z.minLength(2)] });
+  expect(coerce.parse(12)).toBe("12");
+  expect(z.validate(coerce, 1)).toBe(false);
+  const asyncSchema = z.string({
+    checks: [
+      z.check<string>(async (ctx) => {
+        if (ctx.value !== "ok") ctx.issues.push({ code: "custom", input: ctx.value });
+      }),
+    ],
+  });
+  expect(await asyncSchema.safeParseAsync("ok")).toEqual({ success: true, data: "ok" });
+  expect((await asyncSchema.safeParseAsync("bad")).success).toBe(false);
+  // @ts-expect-error numeric checks cannot validate strings
+  z.string({ checks: [z.gte(1)] });
+});
+
+test("factory checks snapshot caller arrays", () => {
+  for (const factory of [z.string, z.coerce.string]) {
+    for (const initial of [[], [z.minLength(1)]]) {
+      const schema = factory({ checks: initial });
+      let reads = 0;
+      const getterSchema = factory({
+        get checks() {
+          if (++reads > 1) throw new Error("checks read twice");
+          return initial;
+        },
+      });
+      expect(reads).toBe(1);
+      expect(z.validate(getterSchema, "long")).toBe(true);
+      const before = z.toJSONSchema(schema);
+      initial.push(z.minLength(10));
+      expect(schema._zod.def.checks).not.toBe(initial);
+      expect(z.validate(schema, "long")).toBe(true);
+      expect(z.validate(z.compile(schema), "long")).toBe(true);
+      expect(z.toJSONSchema(schema)).toEqual(before);
+      expect(z.validate(schema.check(z.minLength(2)), "long")).toBe(true);
+    }
+  }
+});
+
 test("length checks", () => {
   minFive.parse("12345");
   minFive.parse("123456");
@@ -1289,6 +1346,18 @@ test("hostname", () => {
   expect(() => hostname.parse("example..com")).toThrow();
 });
 
+test("currency code", () => {
+  const currency = z.currencyCode();
+  for (const code of ["USD", "EUR", "XXX", "XCG", "XAD"]) expect(currency.parse(code)).toBe(code);
+  for (const input of ["", "usd", "US", "USDX", " USD", "ANG", "BGN"])
+    expect(currency.safeParse(input).success).toBe(false);
+  expect(currency.safeParse("usd").error!.issues[0]).toMatchObject({
+    code: "invalid_format",
+    format: "currency_code",
+    message: "Invalid currency code",
+  });
+});
+
 test("hash validation", () => {
   // MD5 tests
   const md5hex = z.hash("md5");

package/src/v4/classic/tests/to-json-schema.test.ts

@@ -1,5 +1,5 @@
 import { Validator } from "@seriousme/openapi-schema-validator";
-import { describe, expect, test } from "vitest";
+import { describe, expect, test, vi } from "vitest";
 import * as z from "zod";
 // import * as zCore from "zod/v4/core";
 
@@ -3235,11 +3235,31 @@ test("basic registry", () => {
   `);
 });
 
-test("large registry converts in linear time", () => {
-  const count = 2000;
-  const convert = (withIntersection: boolean) => {
+function countMapScanWork<T>(convert: () => T): { result: T; work: number } {
+  const entries = Map.prototype.entries;
+  const values = Map.prototype.values;
+  let work = 0;
+  const entriesSpy = vi.spyOn(Map.prototype, "entries").mockImplementation(function (this: Map<unknown, unknown>) {
+    work += this.size;
+    return entries.call(this);
+  } as typeof Map.prototype.entries);
+  const valuesSpy = vi.spyOn(Map.prototype, "values").mockImplementation(function (this: Map<unknown, unknown>) {
+    work += this.size;
+    return values.call(this);
+  } as typeof Map.prototype.values);
+  try {
+    return { result: convert(), work };
+  } finally {
+    entriesSpy.mockRestore();
+    valuesSpy.mockRestore();
+  }
+}
+
+test("large registry conversion performs linear map-scan work", () => {
+  const count = 64;
+  const convert = (size: number, withIntersection: boolean) => {
     const registry = z.registry<{ id: string }>();
-    for (let i = 0; i < count; i++) {
+    for (let i = 0; i < size; i++) {
       registry.add(
         z.object({ id: z.string(), name: z.string(), count: z.number(), nested: z.object({ a: z.boolean() }) }),
         { id: `Type${i}` }
@@ -3247,55 +3267,53 @@ test("large registry converts in linear time", () => {
     }
     if (withIntersection) registry.add(z.object({ a: z.string() }).and(z.object({ b: z.string() })), { id: "Inter" });
 
-    const start = performance.now();
-    const { schemas } = z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` });
-    return { schemas, elapsed: performance.now() - start };
+    return countMapScanWork(() => z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` }));
   };
 
-  const plain = convert(false);
-  expect(Object.keys(plain.schemas)).toHaveLength(count);
-  expect(plain.schemas.Type0).toMatchObject({
+  const plain = convert(count, false);
+  const plainDouble = convert(count * 2, false);
+  expect(Object.keys(plain.result.schemas)).toHaveLength(count);
+  expect(plain.result.schemas.Type0).toMatchObject({
     $id: "https://example.com/Type0.json",
     type: "object",
     properties: { nested: { type: "object" } },
   });
-  expect(plain.schemas[`Type${count - 1}`]!.$id).toBe(`https://example.com/Type${count - 1}.json`);
-
-  // The whole-map passes in extractDefs/finalize used to re-run once per registered schema, which made this quadratic: ~9s of CPU at this size before the passes were hoisted, ~50ms after.
-  expect(plain.elapsed).toBeLessThan(5000);
+  expect(plain.result.schemas[`Type${count - 1}`]!.$id).toBe(`https://example.com/Type${count - 1}.json`);
+  expect(plain.work).toBeGreaterThan(0);
+  expect(plainDouble.work).toBeLessThanOrEqual(plain.work * 2);
 
-  // The intersection fold walks the whole map as well, so it has to run inside the same guard. Hoisting it back out costs ~10x at this size. Comparing the two conversions rather than asserting a fixed budget keeps this independent of how fast the machine is.
-  const folded = convert(true);
-  expect(folded.schemas.Inter).toMatchObject({ type: "object", properties: { a: {}, b: {} } });
-  expect(folded.elapsed).toBeLessThan(plain.elapsed * 4 + 100);
+  const folded = convert(count, true);
+  const foldedDouble = convert(count * 2, true);
+  expect(folded.result.schemas.Inter).toMatchObject({ type: "object", properties: { a: {}, b: {} } });
+  expect(folded.work).toBeGreaterThan(0);
+  expect(foldedDouble.work).toBeLessThanOrEqual(folded.work * 2);
 });
 
-test("a registry of records with numeric keys converts in linear time", () => {
-  const count = 2000;
-  const convert = (key: (i: number) => z.core.$ZodType) => {
+test("a registry of records with numeric keys performs linear map-scan work", () => {
+  const count = 64;
+  const convert = (size: number, key: (i: number) => z.core.$ZodType) => {
     const registry = z.registry<{ id: string }>();
-    for (let i = 0; i < count; i++) {
+    for (let i = 0; i < size; i++) {
       registry.add(z.object({ m: z.record(key(i) as z.core.$ZodRecordKey, z.boolean()) }), { id: `Type${i}` });
     }
-    const start = performance.now();
-    const { schemas } = z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` });
-    return { schemas, elapsed: performance.now() - start };
+    return countMapScanWork(() => z.toJSONSchema(registry, { uri: (id) => `https://example.com/${id}.json` }));
   };
 
-  const string = convert(() => z.string());
-  const numeric = convert(() => z.number());
-  expect(numeric.schemas.Type0).toMatchObject({
+  const numeric = convert(count, () => z.number());
+  const numericDouble = convert(count * 2, () => z.number());
+  expect(numeric.result.schemas.Type0).toMatchObject({
     properties: { m: { propertyNames: { type: "string", pattern: "^-?\\d+(?:\\.\\d+)?$" } } },
   });
+  expect(numeric.work).toBeGreaterThan(0);
+  expect(numericDouble.work).toBeLessThanOrEqual(numeric.work * 2);
 
-  // The rewrite has to find every carrier the flatten copied `propertyNames` onto, which means a pass over the whole seen map. Running that once per record rather than once per conversion cost ~10x at this size. A string key needs no rewrite at all, so comparing against it keeps this independent of how fast the machine is.
-  expect(numeric.elapsed).toBeLessThan(string.elapsed * 2 + 50);
-
-  // An extracted key resolves through a map built once per conversion rather than a search per reference. There is no stable timing control for that — extraction has its own $defs cost, which swamps the difference — so this only pins the shape.
-  const extracted = convert((i) => z.number().meta({ id: `Key${i}` }));
-  expect(extracted.schemas.Type0).toMatchObject({
+  const extracted = convert(count, (i) => z.number().meta({ id: `Key${i}` }));
+  const extractedDouble = convert(count * 2, (i) => z.number().meta({ id: `Key${i}` }));
+  expect(extracted.result.schemas.Type0).toMatchObject({
     properties: { m: { propertyNames: { type: "string", pattern: "^-?\\d+(?:\\.\\d+)?$" } } },
   });
+  expect(extracted.work).toBeGreaterThan(0);
+  expect(extractedDouble.work).toBeLessThanOrEqual(extracted.work * 2);
 });
 
 test("registry extracts unregistered subschemas into __shared", () => {
@@ -3849,6 +3867,31 @@ test("input JSON schema resolves requiredness past transform and catch wrappers"
   expect(required(z.object({ a: z.transform((v: unknown) => String(v)).pipe(z.string()) }))).toEqual(["a"]);
 });
 
+test("object required keys preserve shape order and direction", () => {
+  const symbol = Symbol("symbol");
+  const shape: z.ZodRawShape = {
+    10: z.string(),
+    2: z.string().optional(),
+    plain: z.string(),
+    optional: z.string().optional(),
+    defaulted: z.string().default("x"),
+    caught: z.string().catch("x"),
+    [symbol]: z.string(),
+  };
+  Object.defineProperty(shape, "__proto__", { value: z.string(), enumerable: true });
+  Object.defineProperty(shape, "hidden", { value: z.string(), enumerable: false });
+
+  const input = z.toJSONSchema(z.object(shape), { io: "input", unrepresentable: "any" });
+  const output = z.toJSONSchema(z.object(shape), { io: "output", unrepresentable: "any" });
+
+  expect(Object.keys(input.properties!)).toEqual(["2", "10", "plain", "optional", "defaulted", "caught", "__proto__"]);
+  expect(input.required).toEqual(["10", "plain", "caught", "__proto__"]);
+  expect(output.required).toEqual(["10", "plain", "defaulted", "caught", "__proto__"]);
+  expect(Object.prototype.hasOwnProperty.call(input.properties!, "__proto__")).toBe(true);
+  expect(input.properties).not.toHaveProperty("hidden");
+  expect(Object.getOwnPropertySymbols(input.properties!)).toEqual([]);
+});
+
 test("strip output-side examples from input JSON schema for codec", () => {
   const codec = z
     .codec(z.string(), z.number(), { decode: (s) => Number(s), encode: (n) => String(n) })
@@ -4679,3 +4722,12 @@ describe("intersection folding declines", () => {
     expect(allOf(schema)).toHaveLength(3);
   });
 });
+
+test("currency code", () => {
+  expect(z.toJSONSchema(z.currencyCode())).toEqual({
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "string",
+    format: "currency_code",
+    pattern: z.regexes.currencyCode.source,
+  });
+});

package/src/v4/core/api.ts

@@ -58,16 +58,20 @@ export type CheckTypeParams<
 > = Params<T, NonNullable<T["_zod"]["isst"] | T["_zod"]["issc"]>, "type" | "checks" | "error" | "check" | AlsoOmit>;
 
 // String
-export type $ZodStringParams = TypeParams<schemas.$ZodString<string>, "coerce">;
+export type $ZodStringParams = TypeParams<schemas.$ZodString<string>, "coerce"> & {
+  checks?: readonly checks.$ZodCheck<string>[];
+};
+
+function snapshotChecks<T extends { checks?: readonly checks.$ZodCheck<never>[] }>(def: T) {
+  if (def.checks) def.checks = [...def.checks];
+  return def as T & { checks?: NonNullable<T["checks"]>[number][] };
+}
 // @__NO_SIDE_EFFECTS__
 export function _string<T extends schemas.$ZodString>(
   Class: util.SchemaClass<T>,
   params?: string | $ZodStringParams
 ): T {
-  return new Class({
-    type: "string",
-    ...util.normalizeParams(params),
-  });
+  return new Class(snapshotChecks({ type: "string" as const, ...util.normalizeParams(params) }));
 }
 
 // @__NO_SIDE_EFFECTS__
@@ -75,11 +79,7 @@ export function _coercedString<T extends schemas.$ZodString>(
   Class: util.SchemaClass<T>,
   params?: string | $ZodStringParams
 ): T {
-  return new Class({
-    type: "string",
-    coerce: true,
-    ...util.normalizeParams(params),
-  });
+  return new Class(snapshotChecks({ type: "string" as const, coerce: true, ...util.normalizeParams(params) }));
 }
 
 export type $ZodStringFormatParams = CheckTypeParams<
@@ -608,7 +608,9 @@ export function _isoDuration<T extends schemas.$ZodISODuration>(
 }
 
 // Number
-export type $ZodNumberParams = TypeParams<schemas.$ZodNumber<number>, "coerce">;
+export type $ZodNumberParams = TypeParams<schemas.$ZodNumber<number>, "coerce"> & {
+  checks?: readonly checks.$ZodCheck<number>[];
+};
 export type $ZodNumberFormatParams = CheckTypeParams<schemas.$ZodNumberFormat, "format" | "coerce">;
 export type $ZodCheckNumberFormatParams = CheckParams<checks.$ZodCheckNumberFormat, "format" | "when">;
 // @__NO_SIDE_EFFECTS__
@@ -616,11 +618,7 @@ export function _number<T extends schemas.$ZodNumber>(
   Class: util.SchemaClass<T>,
   params?: string | $ZodNumberParams
 ): T {
-  return new Class({
-    type: "number",
-    checks: [],
-    ...util.normalizeParams(params),
-  });
+  return new Class(snapshotChecks({ type: "number" as const, checks: [], ...util.normalizeParams(params) }));
 }
 
 // @__NO_SIDE_EFFECTS__
@@ -628,12 +626,9 @@ export function _coercedNumber<T extends schemas.$ZodNumber>(
   Class: util.SchemaClass<T>,
   params?: string | $ZodNumberParams
 ): T {
-  return new Class({
-    type: "number",
-    coerce: true,
-    checks: [],
-    ...util.normalizeParams(params),
-  });
+  return new Class(
+    snapshotChecks({ type: "number" as const, coerce: true, checks: [], ...util.normalizeParams(params) })
+  );
 }
 
 // @__NO_SIDE_EFFECTS__

package/src/v4/core/compile.ts

@@ -13,10 +13,10 @@ import {
   isValidIPv6,
   isValidJWT,
   mergeValues,
-  parseURLObject,
   stripTabAndNewline,
   urlHostnameOk,
   urlProtocolOk,
+  validateURL,
 } from "./schemas.js";
 import type { ParseContextInternal, ParsePayload, SomeType } from "./schemas.js";
 import * as util from "./util.js";
@@ -772,7 +772,21 @@ const PATTERN_IS_COMPLETE: Set<string> = new Set([
 ]);
 
 // Returns the accessor holding the (possibly normalized) value after the check — url/normalize formats produce a new value like overwrite does. Never assigns to the incoming accessor: it may be a `const` or a property expression on user input.
-function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFormatDef, accessor: string): string {
+function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFormatDef, accessor: string): string;
+function generateStringFormatCheck(
+  doc: Doc,
+  ctx: CompileContext,
+  def: StringFormatDef,
+  accessor: string,
+  needsValue: boolean
+): string | null;
+function generateStringFormatCheck(
+  doc: Doc,
+  ctx: CompileContext,
+  def: StringFormatDef,
+  accessor: string,
+  needsValue = true
+): string | null {
   // Some string formats do runtime validation beyond their advertised pattern. For cheap pure utility checks, hoist the runtime function and call it so the fast path stays correct without cloning the utility logic into codegen.
   const fmt = def.format;
   if (fmt === "base64") {
@@ -820,7 +834,7 @@ function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFor
     formatDef.protocol !== undefined
   ) {
     // Same three predicates the runtime calls, in the same order, so there is no second URL implementation to drift. Which options exist is known now, so the calls the runtime makes conditionally are emitted conditionally instead.
-    const parseConst = addConstant(ctx, parseURLObject);
+    const parseConst = addConstant(ctx, validateURL);
     const defConst = addConstant(ctx, def);
     const trimVar = newVar(ctx);
     const urlVar = newVar(ctx);
@@ -835,6 +849,7 @@ function generateStringFormatCheck(doc: Doc, ctx: CompileContext, def: StringFor
       const protocolConst = addConstant(ctx, urlProtocolOk);
       doc.write(`if (!${protocolConst}(${urlVar}, ${defConst}.protocol)) return INVALID;`);
     }
+    if (!needsValue) return null;
     const outputVar = newVar(ctx);
     const outputExpr = formatDef.normalize ? `${urlVar}.href` : `${addConstant(ctx, stripTabAndNewline)}(${trimVar})`;
     doc.write(`const ${outputVar} = ${outputExpr};`);
@@ -961,7 +976,7 @@ function generateCheck(
 
   switch (type) {
     case "string":
-      typeAccessor = generateStringCheck(doc, ctx, schema, accessor);
+      typeAccessor = generateStringCheck(doc, ctx, schema, accessor, buildsValue);
       break;
     case "number":
       typeAccessor = generateNumberCheck(doc, schema, accessor);
@@ -1092,13 +1107,19 @@ function generateCheck(
   return generateChecks(doc, ctx, schema, typeAccessor);
 }
 
-function generateStringCheck(doc: Doc, ctx: CompileContext, schema: SomeType, accessor: string): string {
+function generateStringCheck(
+  doc: Doc,
+  ctx: CompileContext,
+  schema: SomeType,
+  accessor: string,
+  needsValue = true
+): string | null {
   doc.write(`if (typeof ${accessor} !== "string") return INVALID;`);
 
   // z.email() carries its format on the def, z.string().email() in def.checks; both route here so the format table has no second copy to drift from.
   const def = schema._zod.def as unknown as StringFormatDef & { format?: string };
   if (def.format === undefined) return accessor;
-  return generateStringFormatCheck(doc, ctx, def, accessor);
+  return generateStringFormatCheck(doc, ctx, def, accessor, needsValue);
 }
 
 function generateNumberCheck(doc: Doc, schema: SomeType, accessor: string): string {

package/src/v4/core/core.ts

@@ -79,9 +79,7 @@ export /*@__NO_SIDE_EFFECTS__*/ function $constructor<T extends ZodTrait, D = T[
         // Cleared even on throw, so the shared descriptor never leaks one instance's internals into the next.
         _zodDesc.value = undefined;
       }
-    }
-
-    if (inst._zod.traits.has(name)) {
+    } else if (inst._zod.traits.has(name)) {
       return;
     }
 

package/src/v4/core/json-schema-processors.ts

@@ -449,20 +449,16 @@ export const objectProcessor: Processor<schemas.$ZodObject> = (schema, ctx, _jso
   }
 
   // required keys
-  const allKeys = new Set(Object.keys(shape));
-  const requiredKeys = new Set(
-    [...allKeys].filter((key) => {
-      const field = def.shape[key]!;
-      if (ctx.io === "input") {
-        return inputOptin(field) === undefined;
-      } else {
-        return field._zod.optout === undefined;
-      }
-    })
-  );
+  const requiredKeys: string[] = [];
+  for (const key of Object.keys(shape)) {
+    const field = def.shape[key]!;
+    if (ctx.io === "input" ? inputOptin(field) === undefined : field._zod.optout === undefined) {
+      requiredKeys.push(key);
+    }
+  }
 
-  if (requiredKeys.size > 0) {
-    json.required = Array.from(requiredKeys);
+  if (requiredKeys.length > 0) {
+    json.required = requiredKeys;
   }
 
   // catchall

package/src/v4/core/regexes.ts

@@ -98,6 +98,10 @@ export const e164: RegExp = /^\+[1-9]\d{6,14}$/;
 // Credit card shape: 12–19 digits, optionally separated by single spaces or single hyphens. ISO/IEC 7812 caps the PAN at 19 digits; 12 is the shortest issued length (Maestro).
 export const creditCard: RegExp = /^\d(?:[ -]?\d){11,18}$/;
 
+// ISO 4217 alpha codes from the SIX list, regenerated by scripts/update-iso-4217.ts
+export const currencyCode: RegExp =
+  /^(?:AED|AFN|ALL|AMD|AOA|ARS|AUD|AWG|AZN|BAM|BBD|BDT|BHD|BIF|BMD|BND|BOB|BOV|BRL|BSD|BTN|BWP|BYN|BZD|CAD|CDF|CHE|CHF|CHW|CLF|CLP|CNY|COP|COU|CRC|CUP|CVE|CZK|DJF|DKK|DOP|DZD|EGP|ERN|ETB|EUR|FJD|FKP|GBP|GEL|GHS|GIP|GMD|GNF|GTQ|GYD|HKD|HNL|HTG|HUF|IDR|ILS|INR|IQD|IRR|ISK|JMD|JOD|JPY|KES|KGS|KHR|KMF|KPW|KRW|KWD|KYD|KZT|LAK|LBP|LKR|LRD|LSL|LYD|MAD|MDL|MGA|MKD|MMK|MNT|MOP|MRU|MUR|MVR|MWK|MXN|MXV|MYR|MZN|NAD|NGN|NIO|NOK|NPR|NZD|OMR|PAB|PEN|PGK|PHP|PKR|PLN|PYG|QAR|RON|RSD|RUB|RWF|SAR|SBD|SCR|SDG|SEK|SGD|SHP|SLE|SOS|SRD|SSP|STN|SVC|SYP|SZL|THB|TJS|TMT|TND|TOP|TRY|TTD|TWD|TZS|UAH|UGX|USD|USN|UYI|UYU|UYW|UZS|VED|VES|VND|VUV|WST|XAD|XAF|XAG|XAU|XBA|XBB|XBC|XBD|XCD|XCG|XDR|XOF|XPD|XPF|XPT|XSU|XTS|XUA|XXX|YER|ZAR|ZMW|ZWG)$/;
+
 // iban electronic format: 2-letter country, check digits 02-98 (the only values `98 - remainder` can produce), 11-30 bban characters
 export const iban: RegExp = /^[A-Z]{2}(?!00|01|99)\d{2}[A-Z0-9]{11,30}$/;