PNI Software Health Diagnostic Report

Zod v4.6.7 (packages/zod) — Comprehensive Static AST, Architecture, Hermetic Node 22 Container Runtime, and Supply-Chain Security Evaluation (pni501, Run wf-0c77a8df).

00_cover_1
PNI501 Overall Software Health Scorecard — Zod v4.6.7 (91/100, Grade S)
Source Code 
from drawlib.canvas import save, setup
from drawlib.icons import phosphor
from drawlib.smartarts import KpiCards, Panel
from drawlib.styles import Styles

setup(width=146, height=56, dpi=150)

panel = Panel(
    "PNI501 Diagnostic Scorecard — Zod v4.6.7",
    "Workflow: pni501 (wf-0c77a8df)  |  2026-11-10",
    style=Styles.Neutral,
    header_style=Styles.PrimaryFlat,
    text_style=Styles.WhiteBold.patch(text_size=12.0),
    description_style=Styles.White.patch(text_size=10.0),
    icon=phosphor.shield_check,
    icon_style=Styles.WhiteBold,
    header_variant="filled",
    header_height=9.5,
)
panel.draw((3.0, 3.0), width=140.0, height=50.0)
inner_xy, inner_w, inner_h = panel.get_content_box(
    (3.0, 3.0),
    width=140.0,
    height=50.0,
    padding=(3.5, 3.0),
)

kpis = KpiCards(
    style=Styles.White,
    metric_style=Styles.DarkBold.patch(text_size=15.0),
    text_style=Styles.DarkBold.patch(text_size=11.0),
    description_style=Styles.Muted.patch(text_size=9.5),
    accent_style=Styles.SecondaryNeutral,
    accent_position="top_bar",
    metric_layout="top_stack",
    spacing=3.5,
)
kpis.add(
    "91 / 100",
    "Overall Health (Grade S)",
    "Top-Tier Library Posture",
    style=Styles.PrimaryNeutral,
    metric_style=Styles.PrimaryBold.patch(text_size=15.5),
    accent_style=Styles.PrimaryFlat,
)
kpis.add(
    "typescript",
    "Target Language",
    "112 Files / 16,733 LOC",
)
kpis.add(
    "10 / 14",
    "Rule Pass Rate",
    "0 FAIL / 4 WARN / 10 PASS",
    metric_style=Styles.PrimaryBold.patch(text_size=15.0),
    accent_style=Styles.PrimaryFlat,
)
kpis.add(
    "7 Total",
    "Consolidated Findings",
    "1 HIGH / 2 MED / 4 LOW",
    accent_style=Styles.WarningFlat,
)
kpis.draw(inner_xy, width=inner_w, height=inner_h, columns=4)

save()

Evaluation Metadata & Audit Scope

Attribute Value Notes
Project zod (.) Zod v4.6.7 TypeScript-first schema validation, codec & JSON Schema library
Language typescript TypeScript 5.5+ dual ESM/CJS package (zshy, "type": "module", has_type_marker = true)
Workflow pni501 15-Step End-to-End Engineering, Architecture, Runtime & Security Diagnostic Audit
Run ID wf-0c77a8df Deterministic AST, container runtime (node:22-bookworm-slim), and Trivy SCA verification
Evaluated At 2026-11-10T10:37:46.970743+00:00 Hermetic evaluation snapshot
Overall Score & Grade 91/100 (Grade S) Weighted composite across 7 engineering dimensions and 6 specialized audit steps
Rule Pass Rate 10/14 rules passed 0 failed, 4 warnings (common/maintainability, common/security_vulnerability, typescript/code_quality, typescript/typing), 10 passed
Production Scope packages/zod/src/** 112 production TypeScript source files (16,733 LOC, 405 types/classes, 531 functions) and 137 Vitest suites (2,156 static AST test blocks; 2,272 executed runtime tests)

7-Dimension & 6-Step Score Summary

Dimension / Audit Step Score Grade Status Summary
Architecture (common/architecture) 95/100 S Clean 3-tier layered core (v4/core, v4/classic, v4/mini, v4/locales), zero upward layer violations
Testing (typescript_test_audit / container_runtime_audit) 95/100 S 2,272 / 2,272 offline Vitest unit tests passed (99.8s), 83.0% line coverage, 66.1% branch coverage
Dependencies (repo_structure_audit / library_hygiene_audit) 94/100 S Zero runtime dependencies (dependencies: []), deterministic pnpm-lock.yaml, explicit sideEffects & exports
Documentation (common/documentation) 90/100 S Complete governance docs (README.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md) + 4 Diátaxis portals
Typing (typescript/typing) 88/100 A 83.4% explicit type annotation coverage, ~standard v1 compliance; 4 unscoped @ts-ignore comments in util.ts
Security (security_vulnerability_audit) 86/100 A Zero runtime package CVEs, zero CWE injection sinks, ReDoS-hardened regexes; 32 docs-workspace lockfile advisories
Code Quality (typescript/code_quality / common/maintainability) 85/100 A Zero excessive-parameter functions; high cognitive complexity in from-json-schema.ts (584) and compile.ts (76)

1. Executive Summary

Zod v4.6.7 achieves an overall PNI501 engineering health score of 91/100 (Grade S) with 10/14 audit rules passing (0 failed, 4 warnings). Its 3-tier TypeScript architecture (packages/zod/src/v4/core, v4/classic, v4/mini, and v4/locales across 112 source files and 16,733 LOC) cleanly separates the $constructor prototype trait engine, hybrid sync/async ParsePayload validator, Doc JIT compiler, WeakMap-backed $ZodRegistry, and JSON Schema generator from the dual zod and zod/mini facades. Hermetic Node 22 container verification executed 2,272 / 2,272 Vitest unit tests with a 100% pass rate under --network=none and 83.0% V8 statement coverage (7,197 / 8,672 statements). While the published zod npm package has zero runtime dependencies (dependencies = []) and zero CWE code sinks, primary engineering improvement opportunities include decomposing high-complexity JSON Schema and JIT codegen dispatchers (from-json-schema.ts:convertBaseSchema cognitive=584, compile.ts:generateCheck cognitive=76), expanding inline TSDoc coverage (7.4%), and updating packages/docs workspace dependencies in the monorepo pnpm-lock.yaml.

01_executive_summary_1
7-Dimension Engineering Health Radar — Zod v4.6.7 (Overall 91/100, Grade S)
Source Code 
from drawlib.canvas import save, setup
from drawlib.charts.radar import RadarChart
from drawlib.smartarts import KpiCards, Panel
from drawlib.styles import Styles

setup(width=146, height=74, dpi=150)

radar = RadarChart(
    categories=[
        "Architecture (95)",
        "Code Quality (85)",
        "Typing (88)",
        "Testing (95)",
        "Dependencies (94)",
        "Security (86)",
        "Documentation (90)",
    ],
    axis_line_style=Styles.MutedDashed,
    axis_text_style=Styles.DarkBold.patch(text_size=10.0),
    grid_style=Styles.MutedThin,
    value_text_style=Styles.PrimaryBold.patch(text_size=9.5),
    radius=19.5,
    min_value=0.0,
    max_value=100.0,
    levels=5,
    grid_shape="polygon",
    title="7-Axis Engineering Health Balance",
    title_style=Styles.DarkBold.patch(text_size=12.5),
    value_format="{:.0f}",
)
radar.add_series(
    "Zod v4.6.7 Score",
    [95.0, 85.0, 88.0, 95.0, 94.0, 86.0, 90.0],
    style=Styles.PrimaryFlat,
    fill_alpha=0.28,
)
radar.add_series(
    "Grade S Target (90)",
    [90.0, 90.0, 90.0, 90.0, 90.0, 90.0, 90.0],
    style=Styles.SecondaryNeutral,
    fill_alpha=0.10,
    line_style="dashed",
    point_shape="none",
)
radar.draw(xy=(17.0, 11.0))
radar.draw_legend(
    xy=(16.0, 4.0),
    text_style=Styles.Dark.patch(text_size=10.0),
    orientation="horizontal",
)

panel = Panel(
    "Lowest-Scoring Steps",
    "Sorted Ascending",
    style=Styles.Neutral,
    header_style=Styles.SecondaryNeutral,
    text_style=Styles.DarkBold.patch(text_size=11.0),
    description_style=Styles.Muted.patch(text_size=9.5),
    header_variant="filled",
    header_height=8.5,
)
panel.draw((86.0, 6.0), width=57.0, height=62.0)
p_xy, p_w, p_h = panel.get_content_box((86.0, 6.0), width=57.0, height=62.0, padding=(3.0, 2.5))

step_kpis = KpiCards(
    style=Styles.White,
    metric_style=Styles.DarkBold.patch(text_size=13.5),
    text_style=Styles.DarkBold.patch(text_size=10.5),
    description_style=Styles.Muted.patch(text_size=9.5),
    accent_style=Styles.WarningFlat,
    accent_position="left_pill",
    metric_layout="left_column",
    metric_width_ratio=0.30,
    spacing=2.5,
)
step_kpis.add(
    "82 (A)",
    "security_vulnerability",
    "0 Zod CVEs; 32 docs lockfile CVEs",
    accent_style=Styles.WarningFlat,
)
step_kpis.add(
    "84 (A)",
    "typescript_ast_audit",
    "83.4% typing; 2 complex dispatchers",
    accent_style=Styles.WarningFlat,
)
step_kpis.add(
    "93 (S)",
    "container_runtime_audit",
    "2,272/2,272 tests; 83.0% line cov",
    metric_style=Styles.PrimaryBold.patch(text_size=13.5),
    accent_style=Styles.PrimaryFlat,
)
step_kpis.draw(p_xy, width=p_w, height=p_h, columns=1)

save()

Headline Health KPIs, Architectural Strengths & Top Risks

The diagnostic evaluation combines static TypeScript AST analysis (112 files, 16,733 LOC), repository and library hygiene checks, containerized Node 22 test and coverage execution (--network=none), and Trivy supply-chain scanning.

01_executive_summary_2
Executive Health KPIs, Key Architectural Strengths, and Prioritized Risks
Source Code 
from drawlib.canvas import save, setup
from drawlib.icons import phosphor
from drawlib.smartarts import CardList, KpiCards, Panel
from drawlib.styles import Styles

setup(width=146, height=84, dpi=150)

top_kpis = KpiCards(
    style=Styles.Neutral,
    metric_style=Styles.PrimaryBold.patch(text_size=14.0),
    text_style=Styles.DarkBold.patch(text_size=10.5),
    description_style=Styles.Muted.patch(text_size=9.5),
    accent_style=Styles.PrimaryFlat,
    accent_position="top_bar",
    metric_layout="top_stack",
    spacing=3.0,
)
top_kpis.add("2,272 / 2,272", "Offline Unit Tests", "100% pass (--network=none, 99.8s)")
top_kpis.add("83.0% Line", "Measured V8 Coverage", "7,197 / 8,672 stmts (66.1% branch)")
top_kpis.add(
    "0 Runtime",
    "Published npm Deps",
    "dependencies: [] in packages/zod",
    style=Styles.PrimaryNeutral,
)
top_kpis.add(
    "1H / 2M / 4L",
    "Findings Breakdown",
    "32 docs lockfile CVEs; 0 CWE sinks",
    metric_style=Styles.DarkBold.patch(text_size=13.5),
    accent_style=Styles.WarningFlat,
)
top_kpis.draw((3.0, 58.0), width=140.0, height=23.0, columns=4)

left_panel = Panel(
    "Key Architectural Strengths",
    "4 Verified Pillars",
    style=Styles.Neutral,
    header_style=Styles.PrimaryFlat,
    text_style=Styles.WhiteBold.patch(text_size=11.0),
    description_style=Styles.White.patch(text_size=9.5),
    icon=phosphor.check_circle,
    icon_style=Styles.WhiteBold,
    header_variant="filled",
    header_height=8.0,
)
left_panel.draw((3.0, 3.0), width=68.5, height=52.0)
l_xy, l_w, l_h = left_panel.get_content_box((3.0, 3.0), width=68.5, height=52.0, padding=(2.5, 2.0))

strengths = CardList(
    style=Styles.White,
    text_style=Styles.DarkBold.patch(text_size=10.0),
    description_style=Styles.Muted.patch(text_size=9.5),
    badge_shape="rounded_rect",
    badge_style=Styles.PrimaryNeutral,
    badge_text_style=Styles.PrimaryBold.patch(text_size=9.5),
    direction="vertical",
    spacing=1.8,
)
strengths.add(
    "Zero Runtime Dependencies",
    "dependencies: [] in packages/zod/package.json",
    badge_text="S1",
    badge_style=Styles.PrimaryFlat,
    badge_text_style=Styles.WhiteBold.patch(text_size=9.5),
)
strengths.add(
    "Deterministic Lockfile (v9.0)",
    "Pins vitest@4.1.5, typescript@~5.5.4, biome@^1.9.4",
    badge_text="S2",
)
strengths.add(
    "Modern ESM-First Subpaths",
    "Exports ., ./mini, ./v4/core, ./locales, ./compile",
    badge_text="S3",
)
strengths.add(
    "Complete Repo Governance",
    "README, CONTRIBUTING, SECURITY, LICENSE-ZOD",
    badge_text="S4",
)
strengths.draw(l_xy, width=l_w, height=l_h)

right_panel = Panel(
    "Top Engineering Risks",
    "3 Action Targets",
    style=Styles.Neutral,
    header_style=Styles.SecondaryNeutral,
    text_style=Styles.DarkBold.patch(text_size=11.0),
    description_style=Styles.Muted.patch(text_size=9.5),
    icon=phosphor.warning_circle,
    icon_style=Styles.DarkBold,
    header_variant="filled",
    header_height=8.0,
)
right_panel.draw((74.5, 3.0), width=68.5, height=52.0)
r_xy, r_w, r_h = right_panel.get_content_box((74.5, 3.0), width=68.5, height=52.0, padding=(2.5, 2.0))

risks = CardList(
    style=Styles.White,
    text_style=Styles.DarkBold.patch(text_size=10.0),
    description_style=Styles.Muted.patch(text_size=9.5),
    badge_shape="rounded_rect",
    badge_style=Styles.WarningFlat,
    badge_text_style=Styles.DarkBold.patch(text_size=9.5),
    direction="vertical",
    spacing=2.2,
)
risks.add(
    "Docs Workspace Lockfile Advisories",
    "pnpm-lock.yaml: next@15.5.25 & form-data@4.0.2",
    badge_text="HIGH",
    badge_style=Styles.DangerFlat,
    badge_text_style=Styles.WhiteBold.patch(text_size=9.5),
)
risks.add(
    "from-json-schema.ts Complexity",
    "convertBaseSchema: 417 lines (cognitive=584)",
    badge_text="MED",
)
risks.add(
    "compile.ts Codegen Dispatchers",
    "generateCheck (cognitive=76) & needsValue types",
    badge_text="MED",
)
risks.draw(r_xy, width=r_w, height=r_h)

save()

Pre-Sorted Executive Audit Metrics

Metric Category Measured Value Diagnostic Detail
Overall Health 91/100 (Grade S) 10/14 rules passed (0 FAIL, 4 WARN, 10 PASS)
7-Axis Radar Series 95 / 85 / 88 / 95 / 94 / 86 / 90 architecture=95, code_quality=85, typing=88, testing=95, dependencies=94, security=86, documentation=90
Findings by Severity 7 consolidated findings {'high': 1, 'medium': 2, 'low': 4} (0 CRITICAL, 0 INFO)
Lowest-Scoring Audit Steps 82(A), 84(A), 93(S) security_vulnerability_audit=82(A), typescript_ast_audit=84(A), container_runtime_audit=93(S)
Container Runtime Verification status=passed build=passed (47.55s), tests=2272/2272 (passed, 99.8s), line_cov=83.0% (66.1% branch), smoke=passed (library)
Security & Supply-Chain status=failed (monorepo lockfile) app_cves=32 (CRITICAL=2, HIGH=17, MEDIUM=12, LOW=1 in packages/docs), misconfigs=0, secrets=1 (benchmark JWT fixture)

Key Strengths

Top Risks

2. Architecture & Source Code Structure

Zod v4.6.7 (runtime=['library']) is a zero-dependency, TypeScript-first schema declaration, runtime validation, bidirectional codec, and JSON Schema synthesis library with static type inference (TypeScript 5.5+, ECMAScript Modules (ESM) & CommonJS Dual Package (zshy), Vitest 4.1.5, Biome 1.9.4, Standard Schema v1 (~standard)). The codebase implements a 3-Tier Layered Core + Dual Facade Pattern across 112 TypeScript source files (16,733 LOC): v4/core provides the foundational AST and $constructor trait engine, v4/classic and v4/mini provide ergonomic public facades, and v4/locales supplies 49 internationalized error packs. Layer boundaries are strictly respected: v4/core has zero upward imports to v4/classic, v4/mini, or v4/locales, while v4/classic and v4/mini operate as independent siblings sharing v4/core and the default en locale.

02_architecture_and_structure_1
Zod v4.6.7 Source Directory Tree & Core Module Inventory (112 Files, 16,733 LOC)
Source Code 
from drawlib.canvas import save, setup
from drawlib.icons import phosphor
from drawlib.smartarts import Panel, Table, TreeNode
from drawlib.styles import Colors, Styles

setup(width=146, height=78, dpi=150)

left_panel = Panel(
    "Source Tree (packages/zod/src)",
    style=Styles.Neutral,
    header_style=Styles.PrimaryFlat,
    text_style=Styles.WhiteBold.patch(text_size=11.0),
    icon=phosphor.folder_open,
    icon_style=Styles.WhiteBold,
    header_variant="filled",
    header_height=8.0,
)
left_panel.draw((3.0, 3.0), width=52.0, height=72.0)

TreeNode.register_drawing_item(
    name="dir_icon",
    location="before",
    padding_width=3.8,
    function=phosphor.folder,
    style=Styles.Primary.patch(icon_color=Colors.Primary),
    args={"width": 2.6},
)
TreeNode.register_drawing_item(
    name="ts_icon",
    location="before",
    padding_width=3.8,
    function=phosphor.file_code,
    style=Styles.Dark.patch(icon_color=Colors.Dark),
    args={"width": 2.6},
)

root = TreeNode(
    "packages/zod/src/",
    text_style=Styles.DarkBold.patch(text_size=9.5),
    line_style=Styles.Muted.patch(line_width=1.0),
    line_horizontal_margin=2.2,
    line_horizontal_length=2.2,
    line_vertical_margin=3.6,
    children=[
        TreeNode("index.ts & compile.ts").set_drawing_item("ts_icon"),
        TreeNode(
            "v4/core/ (Foundation)",
            children=[
                TreeNode("core.ts (156 LOC)").set_drawing_item("ts_icon"),
                TreeNode("schemas.ts (4,026 LOC)").set_drawing_item("ts_icon"),
                TreeNode("compile.ts (1,889 LOC)").set_drawing_item("ts_icon"),
                TreeNode("api.ts (1,466 LOC)").set_drawing_item("ts_icon"),
                TreeNode("util.ts (1,043 LOC)").set_drawing_item("ts_icon"),
                TreeNode("json-schema-*.ts (936 LOC)").set_drawing_item("ts_icon"),
                TreeNode("errors.ts & parse.ts (649 LOC)").set_drawing_item("ts_icon"),
            ],
        ).set_drawing_item("dir_icon"),
        TreeNode(
            "v4/classic/ (Method Facade)",
            children=[
                TreeNode("schemas.ts & checks.ts").set_drawing_item("ts_icon"),
                TreeNode("from-json-schema.ts (750 LOC)").set_drawing_item("ts_icon"),
                TreeNode("compat.ts & coerce.ts (74 LOC)").set_drawing_item("ts_icon"),
            ],
        ).set_drawing_item("dir_icon"),
        TreeNode("v4/mini/ (Functional Facade)").set_drawing_item("dir_icon"),
        TreeNode("v4/locales/ (49 i18n Packs)").set_drawing_item("dir_icon"),
    ],
).set_drawing_item("dir_icon")
root.draw(xy=(6.0, 63.0))

table = Table(
    cell_style=Styles.White,
    text_style=Styles.Dark.patch(text_size=9.5),
    header_cell_style=Styles.PrimaryFlat,
    header_text_style=Styles.WhiteBold.patch(text_size=10.0),
    border_style=Styles.MutedThin,
)
table.set_style_cell_evenodd(
    even_color=Colors.Light,
    even_text_style=Styles.Dark.patch(text_size=9.5),
    odd_color=Colors.White,
    odd_text_style=Styles.Dark.patch(text_size=9.5),
)
table.set_style_cell_header(
    background_color=Styles.PrimaryFlat.shape_fill_color,
    text_style=Styles.WhiteBold.patch(text_size=10.0),
)

inv_data = [
    ["Module Path (src/...)", "LOC", "Key Exported Types & Callables"],
    ["v4/core/schemas.ts", "4,026", "ZodType, ZodObject, ZodUnion, ZodCodec"],
    ["v4/core/compile.ts", "1,889", "compile, compileFn, withParser"],
    ["v4/core/api.ts", "1,466", "RefinementCtx, _any, _array, _bigint"],
    ["v4/core/util.ts", "1,043", "clone, defineLazy, cached, SafeParse"],
    ["v4/core/json-schema-processors.ts", "762", "aggregateChecks, arrayProcessor"],
    ["v4/classic/from-json-schema.ts", "750", "fromJSONSchema, convertBaseSchema"],
    ["v4/core/errors.ts", "398", "ZodError, flattenError, treeifyError"],
    ["v4/core/memoizer.ts & parse.ts", "509", "memoizer, _parse, _encode, _decode"],
    ["v4/core/core.ts & doc.ts", "200", "$constructor, config, Doc.compile"],
]
table.draw_flexible(
    xy=(58.0, 75.0),
    column_widths=[36.0, 9.0, 40.0],
    row_heights=[7.2] * 10,
    data=inv_data,
    align="top_left",
)

save()

4-Layer Dependency Graph & Thermal Hotspot Risk Overlay

The UML component dependency diagram below overlays the exact PNI501 module_hotspots.risk_score values across the 4 architectural layers (Entrypoints & Subpath Exports, Facade Layer (Classic & Mini), Localization Layer (49 Locales), and Core Engine Layer (zod/v4/core)).

02_architecture_and_structure_2
4-Layer Component Dependency Graph & Module Hotspot Risk Overlay (risk_score 0.22–0.44)
Source Code 
from drawlib.canvas import save, setup
from drawlib.charts.heatmap import HeatmapOverlay
from drawlib.diagrams.class_diagram import ClassDiagram, ClassNode
from drawlib.fonts import FontRoboto, FontSourceCode
from drawlib.styles import Styles

setup(width=146, height=88, dpi=150)

cd = ClassDiagram(
    node_style=Styles.Neutral.patch(text_font=FontSourceCode.ROBOTO_MONO, text_size=9.5),
    header_style=Styles.PrimaryNeutral.patch(text_font=FontRoboto.ROBOTO_BOLD, text_size=10.0),
    edge_style=Styles.DarkBold,
    edge_text_style=Styles.Dark.patch(text_size=9.5),
    title="4-Layer Architecture & Thermal Hotspot Risk Overlay (PNI501)",
    title_style=Styles.DarkBold.patch(text_size=12.5),
)

classic_node = cd.add(
    ClassNode("v4/classic/from-json-schema.ts", stereotype="Facade Layer", width=40.0)
    .add_method("fromJSONSchema", "schema", "ZodType")
    .add_method("convertBaseSchema", "750 LOC", "risk=0.27"),
    xy=(26.0, 66.0),
)
mini_node = cd.add(
    ClassNode("v4/mini & Entrypoints", stereotype="Facade / Exports", width=38.0)
    .add_attribute("subpaths", "., ./mini, ./compile")
    .add_method("ZodMiniType", "def", "tree-shakable"),
    xy=(73.0, 66.0),
)
locales_node = cd.add(
    ClassNode("v4/locales/ckb.ts & fa.ts", stereotype="49 Locales", width=38.0)
    .add_attribute("ckb.ts", "132 LOC (risk=0.28)")
    .add_attribute("fa.ts", "125 LOC (risk=0.22)"),
    xy=(120.0, 66.0),
)

compile_node = cd.add(
    ClassNode("v4/core/compile.ts & memoizer.ts", stereotype="Core JIT Engine", width=40.0)
    .add_attribute("compile.ts", "1889 LOC (risk=0.27)")
    .add_attribute("memoizer.ts", "258 LOC (risk=0.26)")
    .add_method("generateCheck", "Doc", "Function"),
    xy=(26.0, 29.0),
)
core_node = cd.add(
    ClassNode(
        "v4/core/core.ts & schemas.ts",
        stereotype="Core AST Engine",
        width=38.0,
        header_style=Styles.SecondaryNeutral.patch(text_font=FontRoboto.ROBOTO_BOLD, text_size=10.0),
    )
    .add_attribute("core.ts", "156 LOC (risk=0.26)")
    .add_attribute("schemas.ts", "4026 LOC ($ZodType)")
    .add_method("$constructor", "name, init", "Trait"),
    xy=(73.0, 29.0),
)
util_node = cd.add(
    ClassNode("v4/core/util.ts", stereotype="Core Utilities", width=38.0)
    .add_attribute("util.ts", "1043 LOC (risk=0.44)")
    .add_attribute("ignores", "4x @ts-ignore")
    .add_method("defineLazy", "obj, key, fn", "void"),
    xy=(120.0, 29.0),
)

cd.connect(classic_node, core_node, "dependency", directed=True, start_side="bottom", end_side="top")
cd.connect(mini_node, core_node, "dependency", directed=True, start_side="bottom", end_side="top")
cd.connect(locales_node, util_node, "dependency", directed=True, start_side="bottom", end_side="top")
cd.connect(compile_node, core_node, "dependency", directed=True, start_side="right", end_side="left")
cd.connect(core_node, util_node, "dependency", directed=True, start_side="right", end_side="left")
cd.draw(xy=(0.0, 0.0))

overlay = HeatmapOverlay(
    styles=[Styles.PrimaryNeutral, Styles.WarningFlat, Styles.DangerFlat],
    mode="smooth",
    min_value=0.0,
    max_value=0.50,
    max_alpha=0.45,
    show_contour_lines=False,
)
overlay.add_spot(util_node, value=0.44, radius=18.0)
overlay.add_spot(locales_node, value=0.28, radius=15.0)
overlay.add_spot(compile_node, value=0.27, radius=16.0)
overlay.add_spot(classic_node, value=0.27, radius=16.0)
overlay.add_spot(core_node, value=0.26, radius=14.0)
overlay.draw(xy=(0.0, 0.0))
overlay.draw_colorbar(
    xy=(45.0, 5.0),
    text_style=Styles.Dark.patch(text_size=9.5),
    length=55.0,
    thickness=2.2,
    label="PNI501 Module Hotspot Risk Score (0.00 - 0.50)",
)

save()

Core Runtime Execution Flows

Zod v4.6.7 exposes 5 primary package entrypoints (packages/zod/src/index.ts, packages/zod/src/mini/index.ts, packages/zod/src/v4/core/index.ts, packages/zod/src/locales/index.ts, and packages/zod/src/compile.ts) driving 4 core runtime pipelines:

02_architecture_and_structure_3
Core Execution Pipelines: $constructor Trait Init, ParsePayload Validation, Doc JIT Compilation & JSONSchemaGenerator
Source Code 
from drawlib.canvas import save, setup
from drawlib.icons import phosphor
from drawlib.smartarts import Roadmap
from drawlib.styles import Styles

setup(width=146, height=64, dpi=150)

rm = Roadmap(
    style=Styles.Neutral,
    text_style=Styles.DarkBold.patch(text_size=10.5),
    description_style=Styles.Muted.patch(text_size=9.5),
    spine_style=Styles.PrimaryBold,
    badge_style=Styles.PrimaryNeutral,
    badge_text_style=Styles.PrimaryBold.patch(text_size=10.0),
    icon_style=Styles.PrimaryBold,
    direction="horizontal",
    alternating=True,
    spacing=2.5,
)
rm.add(
    "1. $constructor Trait Init",
    "Allocates _zod bag (def, traits),\nattaches ~standard & clone()",
    badge_text="F1",
    icon=phosphor.cube,
    badge_style=Styles.PrimaryFlat,
    badge_text_style=Styles.WhiteBold.patch(text_size=10.0),
)
rm.add(
    "2. ParsePayload Pipeline",
    "_parse/_encode runs _zod.run\n& sequential $ZodCheck array",
    badge_text="F2",
    icon=phosphor.arrows_left_right,
)
rm.add(
    "3. Doc JIT Codegen",
    "Emits JS via JSON.stringify\ninto new Function() + fallback",
    badge_text="F3",
    icon=phosphor.lightning,
    badge_style=Styles.PrimaryFlat,
    badge_text_style=Styles.WhiteBold.patch(text_size=10.0),
)
rm.add(
    "4. JSON Schema Synthesis",
    "JSONSchemaGenerator & Registry\nemit Draft-2020-12 / OpenAPI",
    badge_text="F4",
    icon=phosphor.brackets_curly,
)
rm.draw(xy=(4.0, 5.0), width=138.0, height=54.0)

save()

Layered Architecture & Boundary Specification

Layer Name Source Paths Allowed Dependencies Architectural Responsibility
Entrypoints & Subpath Exports packages/zod/src/index.ts, mini/index.ts, locales/index.ts, compile.ts, v4/index.ts, v4-mini/index.ts Facade Layer, Localization Layer, Core Engine Layer Public package entrypoints re-exporting classic (zod), mini (zod/mini), locales (zod/locales), and JIT compiler (zod/compile) subpaths.
Facade Layer (Classic & Mini) packages/zod/src/v4/classic, packages/zod/src/v4/mini Localization Layer, Core Engine Layer Ergonomic public API surfaces: v4/classic provides method-chained ZodType wrappers, fromJSONSchema, and v3 compatibility aliases; v4/mini provides tree-shakable functional ZodMiniType wrappers and check functions.
Localization Layer (49 Locales) packages/zod/src/v4/locales Core Engine Layer Language-specific $ZodErrorMap implementations (en, ja, de, fr, zh-CN, etc.) translating $ZodRawIssue codes into localized diagnostic messages.
Core Engine Layer (zod/v4/core) packages/zod/src/v4/core [] (Zero upward dependencies) Foundational $constructor trait system, $ZodType & $ZodCheck AST definitions, ParsePayload sync/async validation engine, Doc & compileSchema JIT compiler, $ZodRegistry metadata store, and JSONSchemaGenerator.

Pre-Sorted Module Hotspots (HeatmapOverlay Risk Scores, Descending)

Module Path LOC Hotspot Risk Score Findings Count Triggered Rules
packages/zod/src/v4/core/util.ts 1,043 0.44 {'low': 1} ['typescript/typing'] (4 unscoped @ts-ignore directives)
packages/zod/src/v4/locales/ckb.ts 132 0.28 {'low': 1} ['common/runtime_verification'] (42.5% line / 28.3% branch coverage)
pnpm-lock.yaml 0 0.28 {'high': 1} ['common/security_vulnerability'] (packages/docs workspace CVEs)
packages/zod/src/v4/core/compile.ts 1,889 0.27 {'medium': 1} ['common/maintainability'] (generateCheck cognitive=76)
packages/zod/src/v4/classic/from-json-schema.ts 750 0.27 {'medium': 1} ['common/maintainability'] (convertBaseSchema cognitive=584)
packages/zod/src/v4/core/memoizer.ts 258 0.26 0 []
packages/zod/src/v4/core/core.ts 156 0.26 0 []
packages/zod/src/v4/locales/fa.ts 125 0.22 0 []

State Management, Error Propagation & Concurrency Model

3. Recommended Remediation Roadmap

Although Zod v4.6.7 achieves a 91/100 (Grade S) engineering health score with zero P0 emergency blockers and zero runtime dependencies in packages/zod/package.json, PNI501 synthesizes 5 prioritized remediation actions (2 P1 high-value structural/lockfile actions and 3 P2 type-safety, manifest, and localization test polish actions) to address all 4 [WARN] rules (common/maintainability, common/security_vulnerability, typescript/code_quality, typescript/typing).

03_remediation_roadmap_1
Phased Remediation Timeline (P0 Zero Blockers -> P1 High-Value Refactoring & Lockfile Hygiene -> P2 Type & Locale Polish)
Source Code 
from drawlib.canvas import save, setup
from drawlib.icons import phosphor
from drawlib.smartarts import Panel, Roadmap
from drawlib.styles import Styles

setup(width=146, height=76, dpi=150)

panel = Panel(
    "Prioritized Engineering Remediation Roadmap (P0 -> P1 -> P2)",
    "5 Concrete Actions Targeting 97+/100 Score",
    style=Styles.Neutral,
    header_style=Styles.PrimaryFlat,
    text_style=Styles.WhiteBold.patch(text_size=11.5),
    description_style=Styles.White.patch(text_size=9.5),
    icon=phosphor.flag_checkered,
    icon_style=Styles.WhiteBold,
    header_variant="filled",
    header_height=8.5,
)
panel.draw((3.0, 3.0), width=140.0, height=70.0)
inner_xy, inner_w, inner_h = panel.get_content_box((3.0, 3.0), width=140.0, height=70.0, padding=(3.5, 2.5))

rm = Roadmap(
    style=Styles.White,
    text_style=Styles.DarkBold.patch(text_size=10.5),
    description_style=Styles.Muted.patch(text_size=9.5),
    spine_style=Styles.PrimaryBold,
    badge_style=Styles.PrimaryNeutral,
    badge_text_style=Styles.PrimaryBold.patch(text_size=9.5),
    icon_style=Styles.PrimaryBold,
    direction="vertical",
    curve_bend=0.0,
    card_shape="rounded_rect",
    spacing=2.0,
)
rm.add(
    "[P1] Decompose convertBaseSchema & compile.ts Dispatchers",
    "Split from-json-schema.ts (cognitive=584) & generateCheck (cognitive=76) into per-kind handlers",
    badge_text="P1-1",
    icon=phosphor.scissors,
    badge_style=Styles.WarningFlat,
    badge_text_style=Styles.DarkBold.patch(text_size=9.5),
)
rm.add(
    "[P1] Bump Monorepo Docs Workspace Packages in pnpm-lock.yaml",
    "Upgrade next >=15.5.28, form-data >=4.0.4, sharp >=0.35.5, postcss >=8.5.23 in docs lockfile",
    badge_text="P1-2",
    icon=phosphor.shield_check,
    badge_style=Styles.WarningFlat,
    badge_text_style=Styles.DarkBold.patch(text_size=9.5),
)
rm.add(
    "[P2] Replace @ts-ignore with @ts-expect-error & Annotate Helpers",
    "Convert 4 @ts-ignore in util.ts, type needsValue: boolean in compile.ts, expand TSDoc",
    badge_text="P2-1",
    icon=phosphor.code,
)
rm.add(
    "[P2] Declare engines.node Constraint & Dependabot Automation",
    "Add engines.node >=18.0.0 in packages/zod/package.json and .github/dependabot.yml",
    badge_text="P2-2",
    icon=phosphor.gear,
)
rm.add(
    "[P2] Expand Parameterized Issue-Code Coverage Across 49 Locales",
    "Extend parity.test.ts to exercise all $ZodIssueCode branches across v4/locales/*.ts",
    badge_text="P2-3",
    icon=phosphor.globe_hemisphere_east,
    badge_style=Styles.PrimaryFlat,
    badge_text_style=Styles.WhiteBold.patch(text_size=9.5),
)
rm.draw(inner_xy, width=inner_w, height=inner_h)

save()

Action Plan Traceability Matrix

Each action item below is traced directly to its target files, expected engineering impact, and the PNI501 rule IDs and CVE advisories it resolves:

03_remediation_roadmap_2
Action Plan Traceability Matrix — Priority, Target Files, Expected Impact & Rule/CVE Traceability
Source Code 
from drawlib.canvas import save, setup
from drawlib.smartarts import Table
from drawlib.styles import Colors, Styles

setup(width=146, height=68, dpi=150)

table = Table(
    cell_style=Styles.White,
    text_style=Styles.Dark.patch(text_size=9.5),
    header_cell_style=Styles.PrimaryFlat,
    header_text_style=Styles.WhiteBold.patch(text_size=10.0),
    border_style=Styles.MutedThin,
)
table.set_style_cell_evenodd(
    even_color=Colors.Light,
    even_text_style=Styles.Dark.patch(text_size=9.5),
    odd_color=Colors.White,
    odd_text_style=Styles.Dark.patch(text_size=9.5),
)
table.set_style_cell_header(
    background_color=Styles.PrimaryFlat.shape_fill_color,
    text_style=Styles.WhiteBold.patch(text_size=10.0),
)
table.set_style_cell(
    background_color=Styles.WarningNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[1, 2],
    columns=[0],
)
table.set_style_cell(
    background_color=Styles.PrimaryNeutral.shape_fill_color,
    text_style=Styles.PrimaryBold.patch(text_size=9.5),
    rows=[3, 4, 5],
    columns=[0],
)

matrix_data = [
    ["Pri", "Action Title & Target Scope", "Expected Engineering Impact", "Related Rules / CVEs"],
    [
        "P1",
        "Decompose convertBaseSchema &\ncompile.ts dispatchers\n(from-json-schema.ts, compile.ts)",
        "Reduces max cognitive complexity\nbelow 25; simplifies keyword\nand JIT check unit testing",
        "common/\nmaintainability,\ntypescript/\ncode_quality",
    ],
    [
        "P1",
        "Bump monorepo docs packages\nin pnpm-lock.yaml\n(next, form-data, sharp, postcss)",
        "Eliminates all 2 CRITICAL and\n17 HIGH Trivy SCA advisories\nin monorepo lockfile",
        "common/\nsecurity_vulnerability,\nCVE-2025-7783,\nGHSA-2464-fhr4-w9xw",
    ],
    [
        "P2",
        "Replace @ts-ignore with\n@ts-expect-error & TSDoc\n(util.ts, compile.ts, coerce.ts)",
        "Prevents stale suppressions;\nimproves IDE hover docs for\nlibrary consumers",
        "typescript/\ntyping,\ntypescript/\ncode_quality",
    ],
    [
        "P2",
        "Declare engines.node >=18.0.0\n& Dependabot configuration\n(packages/zod/package.json)",
        "Explicit Node runtime version\nenforcement & automated CVE\nPRs for devDependencies",
        "typescript/\ndependencies,\ncommon/\nsupply_chain",
    ],
    [
        "P2",
        "Expand parameterized issue-code\nbranch coverage across 49 locales\n(locales/parity.test.ts)",
        "Raises per-locale line coverage\nfrom ~45% to >95% and overall\nbranch coverage above 75%",
        "common/\nruntime_verification,\ntypescript/\ntesting",
    ],
]
table.draw_flexible(
    xy=(3.0, 65.0),
    column_widths=[10.0, 46.0, 44.0, 40.0],
    row_heights=[8.0, 10.5, 10.5, 10.5, 10.5, 10.5],
    data=matrix_data,
    align="top_left",
)

save()

Detailed Remediation Specifications (Pre-Sorted P0 -> P1 -> P2)

  1. [P1] Decompose from-json-schema.ts:convertBaseSchema and compile.ts dispatchers (Maintainability & Complexity, related_rules=['common/maintainability', 'typescript/code_quality']):
    • Action: Refactor convertBaseSchema (cognitive=584, 417 lines, 100 branches) in packages/zod/src/v4/classic/from-json-schema.ts and generateCheck (cognitive=76, 151 lines, 39 branches) in packages/zod/src/v4/core/compile.ts into modular per-kind processor functions (convertStringSchema, convertNumberSchema, convertObjectSchema, convertArraySchema, convertCombinatorSchema) mirroring json-schema-processors.ts.
    • Expected Impact: Reduces maximum function cognitive complexity below 25 and simplifies unit testing of individual JSON Schema keywords and JIT check emitters.
  2. [P1] Bump monorepo docs workspace packages in pnpm-lock.yaml (Workspace Lockfile Hygiene, related_rules=['common/security_vulnerability', 'common/supply_chain', 'CVE-2025-7783', 'GHSA-2464-fhr4-w9xw']):
    • Action: Update next to >=15.5.28, form-data to >=4.0.4, sharp to >=0.35.5, and postcss to >=8.5.23 in pnpm-lock.yaml for the packages/docs workspace.
    • Expected Impact: Eliminates all 2 CRITICAL and 17 HIGH Trivy SCA advisories in the monorepo lockfile.
  3. [P2] Replace @ts-ignore with @ts-expect-error and annotate internal compiler helpers (Strict Type Safety & TSDoc, related_rules=['typescript/typing', 'typescript/code_quality']):
    • Action: Replace the 4 // @ts-ignore directives in packages/zod/src/v4/core/util.ts (lines 194, 523, 620, 997) with // @ts-expect-error, add needsValue: boolean annotations in packages/zod/src/v4/core/compile.ts (lines 332, 783, 958, 1110), and expand TSDoc coverage across v4/classic exports (coerce.ts, compat.ts).
    • Expected Impact: Prevents stale type suppressions and improves IDE hover documentation for library consumers.
  4. [P2] Declare explicit engines.node constraint and Dependabot configuration (Supply Chain & Manifest Metadata, related_rules=['typescript/dependencies', 'common/supply_chain']):
    • Action: Declare "engines": {"node": ">=18.0.0"} in packages/zod/package.json and add .github/dependabot.yml for devDependencies.
    • Expected Impact: Explicit runtime version enforcement for consumers and automated CVE pull requests for workspace devDependencies.
  5. [P2] Expand parameterized issue-code branch coverage across all 49 locales (Test Coverage & Localization, related_rules=['common/runtime_verification', 'typescript/testing']):
    • Action: Update packages/zod/src/v4/core/tests/locales/parity.test.ts to trigger every $ZodIssueCode branch (invalid_type, too_big, too_small, invalid_format, not_multiple_of, unrecognized_keys) for each locale in packages/zod/src/v4/locales/.
    • Expected Impact: Raises per-locale line coverage from ~45% to >95% and overall branch coverage above 75%.

4. Audit Standards, Rule Compliance & Findings

PNI501 evaluated Zod v4.6.7 across 6 specialized audit steps and 14 engineering & security rules. All 6 audit steps achieved Grade A or Grade S (82/100 to 96/100), with 10 rules passing ([PASS]), 4 rules issuing non-blocking warnings ([WARN]), and 0 rules failing ([FAIL]). Across the entire repository, 7 consolidated location findings (1 HIGH, 2 MEDIUM, 4 LOW) were identified, alongside 1 documented design waiver (DS-0026) in pni.toml.

04_standards_and_findings_1
Executed Audit Step Scores (Weakest-First BarChart) & Warning Rule Highlights
Source Code 
from drawlib.canvas import save, setup
from drawlib.charts.bar import BarChart
from drawlib.smartarts import Table
from drawlib.styles import Colors, Styles

setup(width=146, height=68, dpi=150)

chart = BarChart(
    axis_line_style=Styles.MutedDashed,
    categories=[
        "security_vuln",
        "ts_ast_audit",
        "container_rt",
        "lib_hygiene",
        "ts_test_audit",
        "repo_struct",
    ],
    width=66.0,
    height=48.0,
    orientation="horizontal",
    bar_width_ratio=0.62,
    bar_r=0.8,
    title="Audit Step Scores (Weakest -> Strongest)",
    title_style=Styles.DarkBold.patch(text_size=11.5),
    axis_text_style=Styles.Dark.patch(text_size=9.5),
    grid_style=Styles.MutedThin,
    value_text_style=Styles.DarkBold.patch(text_size=9.5),
    value_format="{:.0f}",
)
chart.add_series(
    "Step Score (/100)",
    [82.0, 84.0, 93.0, 94.0, 95.0, 96.0],
    style=Styles.PrimaryFlat,
)
chart.configure_x_axis(min_value=0.0, max_value=105.0, tick_step=20.0)
chart.draw(xy=(4.0, 8.0))

table = Table(
    cell_style=Styles.White,
    text_style=Styles.Dark.patch(text_size=9.5),
    header_cell_style=Styles.PrimaryFlat,
    header_text_style=Styles.WhiteBold.patch(text_size=10.0),
    border_style=Styles.MutedThin,
)
table.set_style_cell_evenodd(
    even_color=Colors.Light,
    even_text_style=Styles.Dark.patch(text_size=9.5),
    odd_color=Colors.White,
    odd_text_style=Styles.Dark.patch(text_size=9.5),
)
table.set_style_cell_header(
    background_color=Styles.PrimaryFlat.shape_fill_color,
    text_style=Styles.WhiteBold.patch(text_size=10.0),
)
table.set_style_cell(
    background_color=Styles.WarningNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[1, 2, 3, 4],
    columns=[0],
)
table.set_style_cell(
    background_color=Styles.SuccessNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[5],
    columns=[0],
)

warn_summary = [
    ["Status", "Rule ID", "Key Diagnostic Observation"],
    ["WARN", "common/\nmaintainability", "convertBaseSchema (cog=584)\n& generateCheck (cog=76)"],
    ["WARN", "common/\nsecurity_vulnerability", "0 Zod CVEs; 32 docs lockfile\nCVEs in pnpm-lock.yaml"],
    ["WARN", "typescript/\ncode_quality", "7.4% TSDoc coverage;\n115 namespace imports"],
    ["WARN", "typescript/\ntyping", "83.4% type coverage;\n4 @ts-ignore in util.ts"],
    ["PASS", "10 Core Rules\n(0 FAIL)", "architecture, testing, security,\nsupply_chain, runtime_verif..."],
]
table.draw_flexible(
    xy=(76.0, 62.0),
    column_widths=[12.0, 26.0, 29.0],
    row_heights=[7.5, 9.5, 9.5, 9.5, 9.5, 9.5],
    data=warn_summary,
    align="top_left",
)

save()

Full Rule Compliance Matrix (FAIL -> WARN -> PASS)

The visual matrix and detailed table below present all 14 evaluated rules sorted strictly in FAIL -> WARN -> PASS order:

04_standards_and_findings_2
Complete 14-Rule Compliance Matrix (Pre-Sorted FAIL -> WARN -> PASS)
Source Code 
from drawlib.canvas import save, setup
from drawlib.smartarts import Table
from drawlib.styles import Colors, Styles

setup(width=146, height=106, dpi=150)

table = Table(
    cell_style=Styles.White,
    text_style=Styles.Dark.patch(text_size=9.5),
    header_cell_style=Styles.PrimaryFlat,
    header_text_style=Styles.WhiteBold.patch(text_size=10.0),
    border_style=Styles.MutedThin,
)
table.set_style_cell_evenodd(
    even_color=Colors.Light,
    even_text_style=Styles.Dark.patch(text_size=9.5),
    odd_color=Colors.White,
    odd_text_style=Styles.Dark.patch(text_size=9.5),
)
table.set_style_cell_header(
    background_color=Styles.PrimaryFlat.shape_fill_color,
    text_style=Styles.WhiteBold.patch(text_size=10.0),
)
table.set_style_cell(
    background_color=Styles.WarningNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[1, 2, 3, 4],
    columns=[0],
)
table.set_style_cell(
    background_color=Styles.SuccessNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[5, 6, 7, 8, 9, 10, 11, 12, 13, 14],
    columns=[0],
)

rule_rows = [
    ["Status", "Rule ID", "Audit Step", "Compliance Evidence Summary"],
    ["[WARN]", "common/\nmaintainability", "typescript_ast_audit", "convertBaseSchema (cog=584) & generateCheck (cog=76)"],
    ["[WARN]", "common/\nsecurity_vulnerability", "security_vulnerability_audit", "0 Zod deps/sinks; 2 CRIT & 17 HIGH docs CVEs in lockfile"],
    ["[WARN]", "typescript/\ncode_quality", "typescript_ast_audit", "7.4% TSDoc (593 missing); 115 import * as; 1 CSP catch"],
    ["[WARN]", "typescript/\ntyping", "typescript_ast_audit", "83.4% type safety (88 missing); 4 @ts-ignore in util.ts"],
    ["[PASS]", "common/\narchitecture", "typescript_ast_audit", "112 modules in v4/core, classic, mini, locales; 8 type cycles"],
    ["[PASS]", "common/\ndocumentation", "repo_structure_audit", "README.md (102 lines, 7 headings) + 4 Diataxis portals"],
    ["[PASS]", "common/\ngit_workflow", "repo_structure_audit", ".gitignore excludes node_modules, .drawlib, .pni/cache"],
    ["[PASS]", "common/\nlibrary_guidelines", "library_hygiene_audit", "Explicit exports, types, jsr.json, sideEffects; 0 logs"],
    ["[PASS]", "common/\nproduction_readiness", "container_runtime_audit", "Stateless ParsePayload, 0 network I/O, ZodAsyncError guard"],
    ["[PASS]", "common/\nruntime_verification", "container_runtime_audit", "Build 47.55s; 2,272/2,272 tests passed; 83.0% line cov"],
    ["[PASS]", "common/\nsecurity", "repo_structure_audit", "0 hardcoded secrets, SECURITY.md, ReDoS-hardened regexes"],
    ["[PASS]", "common/\nsupply_chain", "repo_structure_audit", "0 runtime deps, pnpm-lock.yaml, non-root USER pni (10001)"],
    ["[PASS]", "typescript/\ndependencies", "repo_structure_audit", "ESM type: module, devDependencies isolated, lockfile v9.0"],
    ["[PASS]", "typescript/\ntesting", "typescript_test_audit", "137 Vitest suites (2,156 AST tests), isolate: true"],
]
table.draw_flexible(
    xy=(3.0, 103.0),
    column_widths=[12.0, 38.0, 28.0, 62.0],
    row_heights=[6.6] * 15,
    data=rule_rows,
    align="top_left",
)

save()

Consolidated Location Findings Evidence Table (CRITICAL -> INFO)

All 7 findings across the workflow are consolidated by file:line below in strict CRITICAL -> HIGH -> MEDIUM -> LOW -> INFO severity order:

04_standards_and_findings_3
Consolidated Location Findings Index (7 Locations, Pre-Sorted HIGH -> MEDIUM -> LOW)
Source Code 
from drawlib.canvas import save, setup
from drawlib.smartarts import Table
from drawlib.styles import Colors, Styles

setup(width=146, height=82, dpi=150)

table = Table(
    cell_style=Styles.White,
    text_style=Styles.Dark.patch(text_size=9.5),
    header_cell_style=Styles.PrimaryFlat,
    header_text_style=Styles.WhiteBold.patch(text_size=10.0),
    border_style=Styles.MutedThin,
)
table.set_style_cell_evenodd(
    even_color=Colors.Light,
    even_text_style=Styles.Dark.patch(text_size=9.5),
    odd_color=Colors.White,
    odd_text_style=Styles.Dark.patch(text_size=9.5),
)
table.set_style_cell_header(
    background_color=Styles.PrimaryFlat.shape_fill_color,
    text_style=Styles.WhiteBold.patch(text_size=10.0),
)
table.set_style_cell(
    background_color=Styles.DangerNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[1],
    columns=[0],
)
table.set_style_cell(
    background_color=Styles.WarningNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[2, 3],
    columns=[0],
)
table.set_style_cell(
    background_color=Styles.PrimaryNeutral.shape_fill_color,
    text_style=Styles.PrimaryBold.patch(text_size=9.5),
    rows=[4, 5, 6, 7],
    columns=[0],
)

findings_data = [
    ["Sev", "Location (file)", "Rule Tag", "Evidence & Recommended Fix"],
    [
        "HIGH",
        "pnpm-lock.yaml",
        "common/\nsecurity_vulnerability",
        "CVE-2025-7783 (form-data@4.0.2), GHSA-2464-fhr4-w9xw\n(next@15.5.25) -> Upgrade docs deps in pnpm-lock.yaml",
    ],
    [
        "MED",
        "v4/classic/\nfrom-json-schema.ts",
        "common/\nmaintainability",
        "convertBaseSchema: 417 lines, 100 branches, cog=584\n-> Split into per-type convert*Schema handlers",
    ],
    [
        "MED",
        "v4/core/compile.ts",
        "common/\nmaintainability",
        "generateCheck: 151 lines, cog=76; generateObjectCheck:\ncog=39 -> Keyed dispatch table & needsValue: boolean",
    ],
    [
        "LOW",
        "packages/zod/\npackage.json",
        "typescript/\ndependencies",
        "Missing engines.node & dependabot.yml -> Add\nengines.node >=18.0.0 & .github/dependabot.yml",
    ],
    [
        "LOW",
        "v4/classic/coerce.ts",
        "typescript/\ncode_quality",
        "TSDoc coverage 7.4% (593 missing, 24 stubs in compat.ts)\n-> Add TSDoc summaries to classic/mini factories",
    ],
    [
        "LOW",
        "v4/core/util.ts",
        "typescript/\ntyping",
        "4 unscoped // @ts-ignore at lines 194, 523, 620, 997\n-> Replace with // @ts-expect-error <rationale>",
    ],
    [
        "LOW",
        "v4/locales/ckb.ts",
        "common/\nruntime_verification",
        "Lowest coverage: ckb.ts (42.5% line), fa.ts (46.5%)\n-> Extend parity.test.ts across all 49 locales",
    ],
]
table.draw_flexible(
    xy=(3.0, 79.0),
    column_widths=[10.0, 28.0, 38.0, 64.0],
    row_heights=[7.5, 9.8, 9.8, 9.8, 9.8, 9.8, 9.8, 9.8],
    data=findings_data,
    align="top_left",
)

save()

Detailed Audit Step Evaluations (Weakest -> Strongest)

  1. security_vulnerability_audit: 82/100 (Grade A) [pass=2, warn=1, fail=0] — The published zod library (packages/zod/package.json) has zero runtime dependencies (dependencies = []), zero dangerous CWE code sinks (dangerous_sinks = 0), zero container misconfigurations (misconfigurations = 0), and ReDoS-hardened validation regexes (packages/zod/src/v4/core/regexes.ts). Static Trivy SCA scanning of the upstream monorepo pnpm-lock.yaml identified 32 workspace dependency advisories (2 CRITICAL, 17 HIGH, 12 MEDIUM, 1 LOW) originating from the packages/docs Next.js website workspace (next@15.5.25, form-data@4.0.2, sharp@0.34.5, postcss@8.4.31), plus a synthetic dummy JWT benchmark fixture in packages/bench/compile-helper-scope.ts:7.
  2. typescript_ast_audit: 84/100 (Grade A) [pass=3, warn=3, fail=0] — Zod v4.6.7 (112 source files, 16,733 LOC, 405 types/interfaces, 531 functions) demonstrates a clean 3-tier architecture separating v4/core, v4/classic, v4/mini, and v4/locales. Type safety coverage is 83.4% with zero hardcoded secrets or external CWE injection sinks. Primary improvement areas are high cognitive complexity in from-json-schema.ts:convertBaseSchema (cognitive=584) and compile.ts:generateCheck (cognitive=76), low inline TSDoc coverage (7.4%), 4 unscoped @ts-ignore directives in v4/core/util.ts, and 1 barrel circular dependency inside v4/core.
  3. container_runtime_audit: 93/100 (Grade S) [pass=2, warn=0, fail=0] — Containerized runtime verification (run_check) passed across all 4 verification gates inside an isolated node:22-bookworm-slim container (USER pni, uid 10001): (1) clean image build in 47.55s, (2) 2,272 / 2,272 unit tests passed with zero failures/errors under --network=none in 99.8s, (3) V8 measured line coverage of 83.0% (7,197 / 8,672 statements) and branch coverage of 66.1%, and (4) library startup smoke check exited 0. Lowest-covered modules are leaf i18n locale dictionaries (ckb.ts 42.5%, fa.ts 46.5%, ps.ts 46.5%).
  4. library_hygiene_audit: 94/100 (Grade S) [pass=3, warn=0, fail=0] — Zero runtime dependencies, explicit exports map in packages/zod/package.json covering 11 subpaths (., ./mini, ./v4/core, ./locales, ./compile, ./v3), explicit "sideEffects": ["./compile.js", "./compile.cjs", "./src/compile.ts"] declaration enabling bundler tree-shaking, zero process.exit or unstructured console logging in library code, and complete Standard Schema v1 (~standard) interoperability.
  5. typescript_test_audit: 95/100 (Grade S) [pass=1, warn=0, fail=0] — 137 Vitest test files (exceeding the 112 production source files) and 2,156 AST test cases across v4/core/tests, v4/classic/tests, and v4/mini/tests covering runtime validation, async refinements, cyclic objects, ReDoS vectors (redos.test.ts), differential JIT compilation (compile-differential.test.ts, compile-generative.test.ts), JSON Schema round-tripping, and static type inference (expectTypeOf).
  6. repo_structure_audit: 96/100 (Grade S) [pass=5, warn=0, fail=0] — Exemplary repository governance, zero-dependency supply-chain purity, committed pnpm-lock.yaml, strict TypeScript compiler configuration (.configs/tsconfig.base.json, tsconfig.json, packages/zod/tsconfig.json), dual ESM/CJS exports with custom @zod/source condition, and complete governance documentation (README.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, LICENSE, LICENSE-ZOD).

Configured Scope & Accepted Design Waivers (pni.toml, Total = 1)

Waiver Rule ID Scope Pattern Matched Findings Documented Engineering Rationale
DS-0026 [.pni/dockerfiles/**] 0 Hermetic batch test container exits upon Vitest completion; daemon HEALTHCHECK is not applicable.

5. Deep Dive: Code Quality, Testing & Runtime

This chapter examines Zod v4.6.7's static TypeScript AST quality (total_files=112, total_loc=16733, total_functions=531, type_safety_coverage_pct=83.4%, docstring_coverage_pct=7.4%, import_hygiene_coverage_pct=18.5%), Software Improvement Group (SIG) maintainability metrics (complex_functions_count=100, excessive_parameters_count=0, global_state_usages_count=5, circular_dependencies_count=1), 12-Factor operational readiness (missing_io_timeouts_count=0, scattered_env_access_count=0, unstructured_logging_count=0), and hermetic Node 22 containerized runtime verification (2,272 / 2,272 tests passed under --network=none, 83.0% V8 line coverage, 66.1% branch coverage).

05_code_and_runtime_analysis_1
Module × Quality Dimension Fitness Matrix (HeatmapChart Across Key Core, Classic & Locale Modules)
Source Code 
from drawlib.canvas import save, setup
from drawlib.charts.heatmap import HeatmapChart
from drawlib.styles import Styles

setup(width=146, height=74, dpi=150)

chart = HeatmapChart(
    styles=[Styles.SecondaryNeutral, Styles.PrimaryNeutral, Styles.PrimaryFlat],
    x_categories=[
        "Type Safety",
        "Maintainability",
        "Line Cov",
        "Branch Cov",
        "Param Hygiene",
        "Overall Fit",
    ],
    axis_line_style=Styles.Muted,
    axis_text_style=Styles.DarkBold.patch(text_size=9.5),
    value_text_style=Styles.DarkBold.patch(text_size=9.5),
    width=108.0,
    height=46.0,
    cell_gap=0.8,
    cell_r=0.5,
    title="Module x Quality Dimension Fitness Matrix (%)",
    title_style=Styles.DarkBold.patch(text_size=12.5),
    value_format="{:.0f}%",
)
chart.add_row("v4/core/schemas.ts", [92.0, 86.0, 94.0, 82.0, 100.0, 91.0])
chart.add_row("v4/core/parse.ts", [96.0, 95.0, 96.0, 88.0, 100.0, 95.0])
chart.add_row("v4/core/compile.ts", [78.0, 68.0, 89.0, 74.0, 100.0, 82.0])
chart.add_row("v4/core/util.ts", [76.0, 84.0, 88.0, 75.0, 100.0, 85.0])
chart.add_row("from-json-schema.ts", [82.0, 58.0, 86.0, 71.0, 100.0, 79.0])
chart.add_row("v4/locales/ckb.ts", [95.0, 94.0, 42.5, 28.3, 100.0, 72.0])

chart.draw(xy=(28.0, 20.0))
chart.draw_colorbar(
    xy=(48.0, 6.0),
    text_style=Styles.Dark.patch(text_size=9.5),
    length=55.0,
    thickness=2.2,
    label="Normalized Dimension Fitness Score (%)",
)

save()

Containerized Runtime Verification & Lowest-Covered Modules

Containerized verification (run_check) executed inside a hermetic node:22-bookworm-slim container (USER pni, uid 10001, .pni/dockerfiles/root/Dockerfile) and passed all 4 verification gates:

  1. Harness Image Build: status=passed in 47.55s.
  2. Offline Unit Tests (--network=none): status=passed, 2,272 / 2,272 passed (0 failed, 0 errors, 0 skipped) in 99.8s.
  3. Measured V8 Coverage (istanbul-summary): 83.0% line coverage (7,197 / 8,672 statements) and 66.1% branch coverage.
  4. Startup Smoke Check (library): status=passed (Zod v4 library import and core schema validation smoke test exited 0).
05_code_and_runtime_analysis_2
Hermetic Container Runtime Gates & Measured V8 Coverage (Overall vs Lowest-Covered Locale Modules)
Source Code 
from drawlib.canvas import save, setup
from drawlib.charts.bar import BarChart
from drawlib.smartarts import KpiCards
from drawlib.styles import Styles

setup(width=146, height=82, dpi=150)

gates = KpiCards(
    style=Styles.Neutral,
    metric_style=Styles.PrimaryBold.patch(text_size=13.5),
    text_style=Styles.DarkBold.patch(text_size=10.0),
    description_style=Styles.Muted.patch(text_size=9.5),
    accent_style=Styles.PrimaryFlat,
    accent_position="top_bar",
    metric_layout="top_stack",
    spacing=3.0,
)
gates.add("PASSED (47.55s)", "1. Container Build", "node:22-bookworm-slim (uid 10001)")
gates.add("2,272 / 2,272", "2. Offline Vitest", "100% pass (--network=none, 99.8s)")
gates.add(
    "83.0% / 66.1%",
    "3. V8 Line / Branch",
    "7,197 / 8,672 statements covered",
    style=Styles.PrimaryNeutral,
)
gates.add("EXIT 0 (PASS)", "4. Smoke Verification", "Zod v4 import & schema parse")
gates.draw((3.0, 56.0), width=140.0, height=23.0, columns=4)

chart = BarChart(
    axis_line_style=Styles.MutedDashed,
    categories=[
        "ckb.ts",
        "fa.ts",
        "ps.ts",
        "bn.ts",
        "gu.ts",
        "kn.ts",
        "pl.ts",
        "sl.ts",
        "Zod Total",
    ],
    width=128.0,
    height=38.0,
    orientation="vertical",
    bar_mode="group",
    bar_width_ratio=0.72,
    bar_r=0.6,
    title="Measured Line vs Branch Coverage: Lowest-Covered Locale Packs vs Overall Suite (%)",
    title_style=Styles.DarkBold.patch(text_size=11.5),
    axis_text_style=Styles.Dark.patch(text_size=9.5),
    grid_style=Styles.MutedThin,
    value_text_style=Styles.DarkBold.patch(text_size=9.5),
    value_format="{:.1f}",
)
chart.add_series(
    "Line Coverage (%)",
    [42.5, 46.5, 46.5, 47.5, 47.5, 47.5, 47.5, 47.5, 83.0],
    style=Styles.PrimaryFlat,
)
chart.add_series(
    "Branch Coverage (%)",
    [28.3, 29.8, 29.8, 28.0, 28.0, 28.0, 32.1, 29.8, 66.1],
    style=Styles.SecondaryNeutral,
)
chart.configure_y_axis(min_value=0.0, max_value=100.0, tick_step=25.0, unit="%")
chart.draw(xy=(10.0, 10.0))
chart.draw_legend(
    xy=(42.0, 3.5),
    text_style=Styles.Dark.patch(text_size=9.5),
    orientation="horizontal",
)

save()

Function Cognitive Complexity Hotspots & Type Hygiene

While 0 functions exhibit excessive parameter lists (excessive_parameters_count=0) because Zod schema factories accept structured SchemaParams options objects, 100 functions exceed length or branching thresholds, led by convertBaseSchema in packages/zod/src/v4/classic/from-json-schema.ts and generateCheck in packages/zod/src/v4/core/compile.ts:

05_code_and_runtime_analysis_3
Top Function Cognitive Complexity & Line Length Hotspots (from-json-schema.ts & compile.ts)
Source Code 
from drawlib.canvas import save, setup
from drawlib.charts.bar import BarChart
from drawlib.styles import Styles

setup(width=146, height=64, dpi=150)

chart = BarChart(
    axis_line_style=Styles.MutedDashed,
    categories=[
        "convertBase\nSchema",
        "generate\nCheck",
        "generate\nChecks",
        "convert\nSchema",
        "generateObject\nCheck",
        "generateString\nFormatCheck",
    ],
    width=126.0,
    height=42.0,
    orientation="vertical",
    bar_mode="group",
    bar_width_ratio=0.68,
    bar_r=0.8,
    title="Top Dispatcher Functions: Cognitive Complexity vs Line Length",
    title_style=Styles.DarkBold.patch(text_size=12.0),
    axis_text_style=Styles.Dark.patch(text_size=9.5),
    grid_style=Styles.MutedThin,
    value_text_style=Styles.DarkBold.patch(text_size=9.5),
    value_format="{:.0f}",
)
chart.add_series(
    "Cognitive Complexity",
    [584.0, 76.0, 55.0, 54.0, 39.0, 32.0],
    style=Styles.WarningFlat,
)
chart.add_series(
    "Function Length (LOC)",
    [417.0, 151.0, 97.0, 106.0, 155.0, 126.0],
    style=Styles.PrimaryFlat,
)
chart.configure_y_axis(min_value=0.0, max_value=640.0, tick_step=160.0)
chart.draw(xy=(12.0, 11.0))
chart.draw_legend(
    xy=(40.0, 4.0),
    text_style=Styles.Dark.patch(text_size=9.5),
    orientation="horizontal",
)

save()

Static Quality, Maintainability & Operational Readiness Summary

Metric Category Metric Key Measured Value Diagnostic Interpretation
Codebase & Static Quality total_files / total_loc / total_functions 112 / 16,733 / 531 Compact, high-cohesion TypeScript codebase (405 classes/types)
Codebase & Static Quality type_safety_coverage_pct 83.4% 88 missing explicit parameter/return annotations; 4 unscoped @ts-ignore in util.ts
Codebase & Static Quality docstring_coverage_pct 7.4% 593 missing TSDoc comments; 24 empty stub comments in v4/classic/compat.ts
Codebase & Static Quality import_hygiene_coverage_pct 18.5% 115 import * as namespace imports across v4/classic and v4/mini barrels
Codebase & Static Quality module_test_coverage_pct 28.1% (AST) / 83.0% (V8) 137 Vitest suites (2,156 AST test blocks; 2,272 dynamic tests executed)
SIG Maintainability complex_functions_count 100 Led by from-json-schema.ts:convertBaseSchema (584) and compile.ts:generateCheck (76)
SIG Maintainability excessive_parameters_count 0 All schema and check factories use structured Params options objects
SIG Maintainability global_state_usages_count 5 _E (core.ts:27), handoff (memoizer.ts:210), installing/broke (util.ts), compiling (compile.ts)
SIG Maintainability circular_dependencies_count 1 (8 type-only) 8 cycles use zero-cost import type; 1 barrel cycle in v4/core/index.ts
SIG Maintainability bug_risk_idioms_count 1 Intentional CSP feature-detection catch block in v4/core/compile.ts:242 (compileFn)
Operational Readiness missing_io_timeouts_count 0 Pure in-memory validation library with zero network/socket I/O
Operational Readiness scattered_env_access_count 0 Zero process.env reads inside library code
Operational Readiness unstructured_logging_count 0 Enforced by scripts/fail-on-console.ts in Vitest setup

Lowest-Covered Modules (Measured V8 Line & Branch Coverage, Ascending)

Module Path Measured Line Coverage Measured Branch Coverage Covered / Total Statements Missing Lines
packages/zod/src/v4/locales/ckb.ts 42.5% 28.3% 17 / 40 []
packages/zod/src/v4/locales/fa.ts 46.5% 29.8% 20 / 43 []
packages/zod/src/v4/locales/ps.ts 46.5% 29.8% 20 / 43 []
packages/zod/src/v4/locales/bn.ts 47.5% 28.0% 19 / 40 []
packages/zod/src/v4/locales/gu.ts 47.5% 28.0% 19 / 40 []
packages/zod/src/v4/locales/kn.ts 47.5% 28.0% 19 / 40 []
packages/zod/src/v4/locales/pl.ts 47.5% 32.1% 19 / 40 []
packages/zod/src/v4/locales/sl.ts 47.5% 29.8% 19 / 40 []

6. Deep Dive: Security, Supply Chain & API Surface

The published zod npm package (packages/zod/package.json) maintains a zero-dependency runtime footprint (dependencies: []), zero dangerous injection CWE sinks (dangerous_sinks=0), zero container OS base-image vulnerabilities (os_vuln_counts=0), zero IaC misconfigurations (misconfigurations=0), and ReDoS-hardened regular expressions (packages/zod/src/v4/core/regexes.ts, verified by redos.test.ts). However, static Trivy SCA scanning (ghcr.io/aquasecurity/trivy:0.69.3) of the root monorepo pnpm-lock.yaml identified 32 workspace advisories (2 CRITICAL, 17 HIGH, 12 MEDIUM, 1 LOW) isolated to the packages/docs Next.js documentation site (next@15.5.25, form-data@4.0.2, sharp@0.34.5, postcss@8.4.31), plus 1 synthetic JWT benchmark fixture (packages/bench/compile-helper-scope.ts:7) and 1 low-severity non-cryptographic PRNG note (CWE-338 Math.random() in packages/zod/src/v4/core/util.ts:491).

06_security_and_supply_chain_1
Supply-Chain & Container Vulnerability Breakdown: Published zod Package (0 CVEs) vs Monorepo Docs Lockfile (32 CVEs)
Source Code 
from drawlib.canvas import save, setup
from drawlib.charts.bar import BarChart
from drawlib.smartarts import Table
from drawlib.styles import Colors, Styles

setup(width=146, height=74, dpi=150)

chart = BarChart(
    axis_line_style=Styles.MutedDashed,
    categories=[
        "zod npm\nPkg",
        "Container\nOS",
        "IaC\nConfig",
        "Docs\nLockfile",
    ],
    width=58.0,
    height=46.0,
    orientation="vertical",
    bar_mode="group",
    bar_width_ratio=0.72,
    bar_r=0.6,
    title="Trivy Findings by Scope & Severity",
    title_style=Styles.DarkBold.patch(text_size=11.0),
    axis_text_style=Styles.Dark.patch(text_size=9.5),
    grid_style=Styles.MutedThin,
    value_text_style=Styles.DarkBold.patch(text_size=9.5),
    value_format="{:.0f}",
)
chart.add_series("CRITICAL", [0.0, 0.0, 0.0, 2.0], style=Styles.DangerFlat)
chart.add_series("HIGH", [0.0, 0.0, 0.0, 17.0], style=Styles.WarningFlat)
chart.add_series("MED + LOW", [0.0, 0.0, 0.0, 13.0], style=Styles.SecondaryNeutral)
chart.configure_y_axis(min_value=0.0, max_value=20.0, tick_step=5.0)
chart.draw(xy=(6.0, 15.0))
chart.draw_legend(
    xy=(6.0, 5.0),
    text_style=Styles.Dark.patch(text_size=9.5),
    orientation="horizontal",
)

table = Table(
    cell_style=Styles.White,
    text_style=Styles.Dark.patch(text_size=9.5),
    header_cell_style=Styles.PrimaryFlat,
    header_text_style=Styles.WhiteBold.patch(text_size=9.5),
    border_style=Styles.MutedThin,
)
table.set_style_cell_evenodd(
    even_color=Colors.Light,
    even_text_style=Styles.Dark.patch(text_size=9.5),
    odd_color=Colors.White,
    odd_text_style=Styles.Dark.patch(text_size=9.5),
)
table.set_style_cell_header(
    background_color=Styles.PrimaryFlat.shape_fill_color,
    text_style=Styles.WhiteBold.patch(text_size=9.5),
)
table.set_style_cell(
    background_color=Styles.DangerNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[1, 2],
    columns=[0],
)
table.set_style_cell(
    background_color=Styles.WarningNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[3, 4, 5, 6],
    columns=[0],
)

cve_summary = [
    ["Sev", "Workspace Package", "Version Fix", "Primary Advisory"],
    ["CRIT", "form-data (pnpm)", "4.0.2 -> 4.0.4", "CVE-2025-7783"],
    ["CRIT", "next (pnpm)", "15.5.25 -> 15.5.28", "GHSA-2464-fhr4-w9xw"],
    ["HIGH", "postcss (pnpm)", "8.4.31 -> 8.5.18", "CVE-2026-45623"],
    ["HIGH", "js-yaml (pnpm)", "3.14.1 -> 3.15.2", "CVE-2026-59869"],
    ["HIGH", "image-size (pnpm)", "2.0.2 -> 2.0.3", "CVE-2025-71329"],
    ["HIGH", "nanoid / picomatch", "3.3.11 / 2.3.1", "CVE-2026-67213"],
]
table.draw_flexible(
    xy=(70.0, 68.0),
    column_widths=[10.0, 22.0, 20.0, 21.0],
    row_heights=[8.0] * 7,
    data=cve_summary,
    align="top_left",
)

save()

AST Dangerous Code Sinks (CWE), JIT Escaping & API Attack Surface

Static CWE taint and sink analysis inspected all 112 TypeScript source files (16,733 LOC) for code injection, ReDoS, prototype pollution, weak cryptography, and unauthenticated HTTP routes:

06_security_and_supply_chain_2
AST Dangerous Code Sinks (CWE), Doc JIT Escaping Guardrails & API Surface Map
Source Code 
from drawlib.canvas import save, setup
from drawlib.icons import phosphor
from drawlib.smartarts import CardList, Panel, Table
from drawlib.styles import Colors, Styles

setup(width=146, height=76, dpi=150)

left_panel = Panel(
    "Security Boundaries",
    "4 Controls",
    style=Styles.Neutral,
    header_style=Styles.PrimaryFlat,
    text_style=Styles.WhiteBold.patch(text_size=11.0),
    description_style=Styles.White.patch(text_size=9.5),
    icon=phosphor.shield_check,
    icon_style=Styles.WhiteBold,
    header_variant="filled",
    header_height=8.0,
)
left_panel.draw((3.0, 3.0), width=61.0, height=70.0)
l_xy, l_w, l_h = left_panel.get_content_box((3.0, 3.0), width=61.0, height=70.0, padding=(2.5, 2.0))

controls = CardList(
    style=Styles.White,
    text_style=Styles.DarkBold.patch(text_size=10.0),
    description_style=Styles.Muted.patch(text_size=9.5),
    badge_shape="rounded_rect",
    badge_style=Styles.PrimaryNeutral,
    badge_text_style=Styles.PrimaryBold.patch(text_size=9.5),
    direction="vertical",
    spacing=2.0,
)
controls.add(
    "Doc.compile() Escaping",
    "Literals escaped via JSON.stringify;\nclosures bound via doc.setContext()",
    badge_text="JIT",
    badge_style=Styles.PrimaryFlat,
    badge_text_style=Styles.WhiteBold.patch(text_size=9.5),
)
controls.add(
    "CSP new Function() Fallback",
    "compileFn catches EvalError under\nCSP and falls back to _zod.run",
    badge_text="CSP",
)
controls.add(
    "ReDoS-Hardened Regexes",
    "Linear-time regexes in regexes.ts\nverified by redos.test.ts",
    badge_text="RGX",
)
controls.add(
    "Zero HTTP Routes (Library)",
    "api_endpoints = 0; pure in-process\nschema validation & JSON Schema",
    badge_text="API",
)
controls.draw(l_xy, width=l_w, height=l_h)

table = Table(
    cell_style=Styles.White,
    text_style=Styles.Dark.patch(text_size=9.5),
    header_cell_style=Styles.PrimaryFlat,
    header_text_style=Styles.WhiteBold.patch(text_size=9.5),
    border_style=Styles.MutedThin,
)
table.set_style_cell_evenodd(
    even_color=Colors.Light,
    even_text_style=Styles.Dark.patch(text_size=9.5),
    odd_color=Colors.White,
    odd_text_style=Styles.Dark.patch(text_size=9.5),
)
table.set_style_cell_header(
    background_color=Styles.PrimaryFlat.shape_fill_color,
    text_style=Styles.WhiteBold.patch(text_size=9.5),
)
table.set_style_cell(
    background_color=Styles.PrimaryNeutral.shape_fill_color,
    text_style=Styles.PrimaryBold.patch(text_size=9.5),
    rows=[1],
    columns=[0],
)
table.set_style_cell(
    background_color=Styles.WarningNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[2],
    columns=[0],
)
table.set_style_cell(
    background_color=Styles.SuccessNeutral.shape_fill_color,
    text_style=Styles.DarkBold.patch(text_size=9.5),
    rows=[3, 4, 5],
    columns=[0],
)

sinks_data = [
    ["Sev", "Category / CWE", "Location", "Assessment & Mitigation"],
    [
        "LOW",
        "CWE-338\nweak_crypto",
        "v4/core/\nutil.ts:491",
        "Math.random() in non-security\nhelper; no auth token usage",
    ],
    [
        "MED",
        "Trivy Secret\njwt-token",
        "packages/bench/\ncompile-helper:7",
        "Synthetic dummy JWT fixture\nfor z.jwt() microbenchmark",
    ],
    [
        "PASS",
        "CWE-94 / 79\nCode & XSS",
        "v4/core/doc.ts\n& compile.ts",
        "0 untrusted eval sinks; keys\nserialized via JSON.stringify()",
    ],
    [
        "PASS",
        "Container IaC\n& OS Image",
        ".pni/dockerfiles/\nroot/Dockerfile",
        "node:22-bookworm-slim, USER pni,\n0 OS CVEs, 0 misconfigurations",
    ],
    [
        "PASS",
        "HTTP API\nEndpoints",
        "packages/zod/\nsrc/**",
        "0 HTTP routes (library profile);\nin-process boundary validator",
    ],
]
table.draw_flexible(
    xy=(67.0, 73.0),
    column_widths=[9.0, 16.0, 19.0, 32.0],
    row_heights=[8.0, 11.2, 11.2, 11.2, 11.2, 11.2],
    data=sinks_data,
    align="top_left",
)

save()

Supply-Chain & Governance Baseline Metrics

Security Dimension Metric Key Value Audit Verification Note
Manifest & Lockfile Hygiene has_lockfile / unpinned_dependencies True / 0 Deterministic pnpm-lock.yaml (lockfileVersion 9.0)
Published Runtime Dependencies dependencies_count (packages/zod) 0 "dependencies": [] — zero third-party runtime packages shipped to npm consumers
Security Disclosure Policy has_security_policy True SECURITY.md documents vulnerability reporting workflow
Automated Dependency Updates has_dependency_automation False Recommended ([P2]): add .github/dependabot.yml for workspace devDependencies
Secret Hygiene committed_secret_files / hardcoded_secrets 0 / 0 Zero production credentials; 1 synthetic benchmark JWT fixture in packages/bench/
Container & Base Image Hardening os_vuln_counts / misconfigurations 0 / 0 node:22-bookworm-slim running as non-root USER pni (uid 10001)
AST Dangerous Sinks (CWE) ast_dangerous_sinks_count 1 ([LOW]) CWE-338 (Math.random() at packages/zod/src/v4/core/util.ts:491)
HTTP API Attack Surface api_endpoints_count 0 Pure TypeScript library (runtime=['library']) with zero network listeners

Complete Pre-Sorted Trivy Application Dependency Advisories (pnpm-lock.yaml, packages/docs Workspace)

Severity Scope Advisory ID Package (pnpm) Installed -> Fixed Version Vulnerability Summary
[CRITICAL] runtime_core CVE-2025-7783 form-data@4.0.2 2.5.4, 3.0.4, 4.0.4 form-data: Unsafe random function in form-data
[CRITICAL] runtime_core GHSA-2464-fhr4-w9xw next@15.5.25 15.5.28, 16.4.1 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
[HIGH] runtime_core CVE-2026-45623 postcss@8.4.31 8.5.12 PostCSS: Information disclosure and denial of service via crafted CSS input
[HIGH] runtime_core CVE-2026-12143 form-data@4.0.2 2.5.6, 3.0.5, 4.0.6 form-data: Form field override via CRLF injection
[HIGH] runtime_core CVE-2025-71329 image-size@2.0.2 2.0.3 image-size: Denial of Service via crafted image buffer with zero-valued size field
[HIGH] runtime_core CVE-2025-71330 image-size@2.0.2 2.0.3 image-size: Denial of Service via crafted ICNS image buffer
[HIGH] runtime_core CVE-2026-59869 js-yaml@3.14.1 3.15.0, 4.3.0 js-yaml: Denial of Service via crafted YAML documents
[HIGH] runtime_core CVE-2026-84375 js-yaml@3.14.1 4.3.2, 3.15.2 js-yaml: Denial of Service vulnerability in YAML parsing
[HIGH] runtime_core GHSA-5p4m-2wfm-xmqj js-yaml@3.14.1 4.3.1, 3.15.1 JS-YAML: Quadratic CPU consumption in !!omap resolution (CVE-2026-59870 fix)
[HIGH] runtime_core CVE-2026-67213 nanoid@3.3.11 3.3.18, 5.1.6 nanoid: Denial of Service via infinite loop in random ID generation
[HIGH] runtime_core CVE-2026-67214 nanoid@3.3.11 3.3.16, 5.1.16 nanoid: Denial of Service via negative size input in non-secure module functions
[HIGH] runtime_core CVE-2026-94482 next@15.5.25 15.5.28, 16.4.1 Next.js: Denial of Service via crafted requests targeting Server Actions
[HIGH] runtime_core CVE-2026-33671 picomatch@2.3.1 4.0.4, 3.0.2, 2.3.2 Picomatch: Regular Expression Denial of Service via crafted extglob patterns
[HIGH] runtime_core CVE-2026-73646 postcss@8.4.31 8.5.18 PostCSS: Information disclosure via path traversal in source map auto-loading
[HIGH] runtime_core CVE-2026-93749 source-map-js@1.2.1 1.2.2 source-map-js: Denial of Service via malformed indexed source maps
[MEDIUM] secret_scan jwt-token packages/bench/compile-helper-scope.ts:7 Benchmark fixture Redacted synthetic JWT fixture: from({ length: 1000 }, () => "***signature")
[LOW] cwe_sast CWE-338 packages/zod/src/v4/core/util.ts:491 Non-crypto helper Math.random() is non-cryptographic — use crypto.randomBytes/crypto.randomUUID if security-sensitive