@openclaw/feishu 2026.9.3 → 2026.9.5

package/node_modules/zod/v4/core/core.cjs

@@ -4,32 +4,88 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.globalConfig = exports.$ZodEncodeError = exports.$ZodAsyncError = exports.$brand = exports.NEVER = void 0;
 exports.$constructor = $constructor;
 exports.config = config;
+const util_js_1 = require("./util.cjs");
 /** A special constant with type `never` */
 exports.NEVER = Object.freeze({
     status: "aborted",
 });
-function $constructor(name, initializer, params) {
+/* Shared descriptor for installing `_zod`; defineProperty reads it
+ * synchronously, so reusing one object avoids a per-instance allocation. */
+const _zodDesc = { value: undefined, enumerable: false };
+// null where suppressing the capture would be unrecoverable: `parse()` puts the frames back with `captureStackTrace`, so without it the throw would lose its stack. also latched to null once `stackTraceLimit` proves unassignable, which a realm can do at any point by hardening Error
+let _E = "captureStackTrace" in Error ? Error : null;
+// v8 captures a stack trace inside the Error constructor, which dominates a failed parse; costs only the frames, and parse() restores those. the constructor must RUN: Object.create is cheaper and passes instanceof, but Error.isError and util.types.isNativeError check an internal slot
+function newError(Definition) {
+    const E = _E;
+    if (E) {
+        const saved = E.stackTraceLimit;
+        if (typeof saved === "number") {
+            try {
+                E.stackTraceLimit = 0;
+            }
+            catch {
+                _E = null;
+                return new Definition();
+            }
+            try {
+                return new Definition();
+            }
+            finally {
+                E.stackTraceLimit = saved;
+            }
+        }
+    }
+    return new Definition();
+}
+function $constructor(name, initializer, 
+/** This trait's members, installed once on every prototype that composes it. They cannot be declared in the initializer above: that runs per instance, and the prototype is shared. */
+proto, params) {
+    // Prototype for this constructor's `_zod` internals. Lazily-derived fields (`values`, `pattern`, `optin`, …) install here once rather than as an accessor on every instance.
+    const zodProto = {};
+    // Assigning the fields in the constructor body is what gives instances in-object slots; building the object literally and reparenting it costs a second allocation and a generic property copy.
+    function Internals(def) {
+        this.def = def;
+        this.constr = _;
+        this.traits = new Set();
+    }
+    Internals.prototype = zodProto;
+    const protoMembers = proto;
+    // One trait's members land on every prototype whose chain composes it, so the answer is per prototype rather than per trait.
+    const initialized = protoMembers && new WeakSet();
     function init(inst, def) {
         if (!inst._zod) {
-            Object.defineProperty(inst, "_zod", {
-                value: {
-                    def,
-                    constr: _,
-                    traits: new Set(),
-                },
-                enumerable: false,
-            });
+            _zodDesc.value = new Internals(def);
+            try {
+                Object.defineProperty(inst, "_zod", _zodDesc);
+            }
+            finally {
+                // Cleared even on throw, so the shared descriptor never leaks one instance's internals into the next.
+                _zodDesc.value = undefined;
+            }
         }
         if (inst._zod.traits.has(name)) {
             return;
         }
         inst._zod.traits.add(name);
         initializer(inst, def);
-        // support prototype modifications
+        if (initialized) {
+            // `super(def)` from a user subclass gives `this` a prototype the subclass owns, and installing there would overwrite whatever the subclass declared. `constr` built the instance, so its prototype is the one below the subclass's that should carry the members. A receiver whose chain never reaches that prototype installs on its own, which for a plain object handed straight to `init` means `Object.prototype` — unchanged from before.
+            const own = Object.getPrototypeOf(inst);
+            const ctorProto = inst._zod.constr.prototype;
+            let up = own;
+            while (up && up !== ctorProto)
+                up = Object.getPrototypeOf(up);
+            const target = up ?? own;
+            if (!initialized.has(target)) {
+                initialized.add(target);
+                (0, util_js_1.members)(target, protoMembers);
+            }
+        }
+        // support prototype modifications; for-in avoids the array allocation of Object.keys on the (usually empty) prototype
         const proto = _.prototype;
-        const keys = Object.keys(proto);
-        for (let i = 0; i < keys.length; i++) {
-            const k = keys[i];
+        for (const k in proto) {
+            if (!Object.prototype.hasOwnProperty.call(proto, k))
+                continue;
             if (!(k in inst)) {
                 inst[k] = proto[k].bind(inst);
             }
@@ -41,13 +97,20 @@ function $constructor(name, initializer, params) {
     }
     Object.defineProperty(Definition, "name", { value: name });
     function _(def) {
-        var _a;
-        const inst = params?.Parent ? new Definition() : this;
+        const inst = params?.Parent ? newError(Definition) : this;
         init(inst, def);
-        (_a = inst._zod).deferred ?? (_a.deferred = []);
-        for (const fn of inst._zod.deferred) {
-            fn();
+        const deferred = inst._zod.deferred;
+        if (deferred) {
+            for (const fn of deferred) {
+                fn();
+            }
+            // Released: initializers run once, and the list would otherwise be retained for the schema's lifetime.
+            inst._zod.deferred = undefined;
         }
+        // Global post-processor hook. Internal: installed by `import "zod/compile"` to enable AOT compilation for every constructed schema. Runs last, once the instance is fully built, because it hands the instance to compile(). The post-processor is expected to be reentrancy-guarded by its own implementation.
+        const pp = globalThis.__zod_globalConfig?.postProcessor;
+        if (pp)
+            pp(inst);
         return inst;
     }
     Object.defineProperty(_, "init", { value: init });

package/node_modules/zod/v4/core/core.d.cts

@@ -1,6 +1,6 @@
 import type * as errors from "./errors.cjs";
 import type * as schemas from "./schemas.cjs";
-import type { Class } from "./util.cjs";
+import type { Class, ProtoOf } from "./util.cjs";
 type ZodTrait = {
     _zod: {
         def: any;
@@ -11,11 +11,14 @@ export interface $constructor<T extends ZodTrait, D = T["_zod"]["def"]> {
     new (def: D): T;
     init(inst: T, def: D): asserts inst is T;
 }
+export interface $constructorParams {
+    Parent?: typeof Class;
+}
 /** A special constant with type `never` */
 export declare const NEVER: never;
-export declare function $constructor<T extends ZodTrait, D = T["_zod"]["def"]>(name: string, initializer: (inst: T, def: D) => void, params?: {
-    Parent?: typeof Class;
-}): $constructor<T, D>;
+export declare function $constructor<T extends ZodTrait, D = T["_zod"]["def"]>(name: string, initializer: (inst: T, def: D) => void, 
+/** This trait's members, installed once on every prototype that composes it. They cannot be declared in the initializer above: that runs per instance, and the prototype is shared. */
+proto?: ProtoOf<T>, params?: $constructorParams): $constructor<T, D>;
 export declare const $brand: unique symbol;
 export type $brand<T extends string | number | symbol = string | number | symbol> = {
     [$brand]: {
@@ -65,6 +68,15 @@ export interface $ZodConfig {
     localeError?: errors.$ZodErrorMap | undefined;
     /** Disable JIT schema compilation. Useful in environments that disallow `eval`. */
     jitless?: boolean | undefined;
+    /** Enables parsing input that contains reference cycles. Read when a schema is constructed. */
+    memoizer?: schemas.$ZodMemoizer | undefined;
+    /**
+     * Internal: post-processor invoked on every freshly-constructed schema
+     * instance, after init and deferred fns run. Set by `import "zod/compile"`
+     * to install AOT compilation. Not part of the public API.
+     * @internal
+     */
+    postProcessor?: ((inst: any) => void) | undefined;
 }
 export declare const globalConfig: $ZodConfig;
 export declare function config(newConfig?: Partial<$ZodConfig>): $ZodConfig;

package/node_modules/zod/v4/core/core.d.ts

@@ -1,6 +1,6 @@
 import type * as errors from "./errors.js";
 import type * as schemas from "./schemas.js";
-import type { Class } from "./util.js";
+import type { Class, ProtoOf } from "./util.js";
 type ZodTrait = {
     _zod: {
         def: any;
@@ -11,11 +11,14 @@ export interface $constructor<T extends ZodTrait, D = T["_zod"]["def"]> {
     new (def: D): T;
     init(inst: T, def: D): asserts inst is T;
 }
+export interface $constructorParams {
+    Parent?: typeof Class;
+}
 /** A special constant with type `never` */
 export declare const NEVER: never;
-export declare function $constructor<T extends ZodTrait, D = T["_zod"]["def"]>(name: string, initializer: (inst: T, def: D) => void, params?: {
-    Parent?: typeof Class;
-}): $constructor<T, D>;
+export declare function $constructor<T extends ZodTrait, D = T["_zod"]["def"]>(name: string, initializer: (inst: T, def: D) => void, 
+/** This trait's members, installed once on every prototype that composes it. They cannot be declared in the initializer above: that runs per instance, and the prototype is shared. */
+proto?: ProtoOf<T>, params?: $constructorParams): $constructor<T, D>;
 export declare const $brand: unique symbol;
 export type $brand<T extends string | number | symbol = string | number | symbol> = {
     [$brand]: {
@@ -65,6 +68,15 @@ export interface $ZodConfig {
     localeError?: errors.$ZodErrorMap | undefined;
     /** Disable JIT schema compilation. Useful in environments that disallow `eval`. */
     jitless?: boolean | undefined;
+    /** Enables parsing input that contains reference cycles. Read when a schema is constructed. */
+    memoizer?: schemas.$ZodMemoizer | undefined;
+    /**
+     * Internal: post-processor invoked on every freshly-constructed schema
+     * instance, after init and deferred fns run. Set by `import "zod/compile"`
+     * to install AOT compilation. Not part of the public API.
+     * @internal
+     */
+    postProcessor?: ((inst: any) => void) | undefined;
 }
 export declare const globalConfig: $ZodConfig;
 export declare function config(newConfig?: Partial<$ZodConfig>): $ZodConfig;

package/node_modules/zod/v4/core/core.js

@@ -1,30 +1,86 @@
 var _a;
+import { members as installMembers } from "./util.js";
 /** A special constant with type `never` */
 export const NEVER = /*@__PURE__*/ Object.freeze({
     status: "aborted",
 });
-export /*@__NO_SIDE_EFFECTS__*/ function $constructor(name, initializer, params) {
+/* Shared descriptor for installing `_zod`; defineProperty reads it
+ * synchronously, so reusing one object avoids a per-instance allocation. */
+const _zodDesc = { value: undefined, enumerable: false };
+// null where suppressing the capture would be unrecoverable: `parse()` puts the frames back with `captureStackTrace`, so without it the throw would lose its stack. also latched to null once `stackTraceLimit` proves unassignable, which a realm can do at any point by hardening Error
+let _E = "captureStackTrace" in Error ? Error : null;
+// v8 captures a stack trace inside the Error constructor, which dominates a failed parse; costs only the frames, and parse() restores those. the constructor must RUN: Object.create is cheaper and passes instanceof, but Error.isError and util.types.isNativeError check an internal slot
+function newError(Definition) {
+    const E = _E;
+    if (E) {
+        const saved = E.stackTraceLimit;
+        if (typeof saved === "number") {
+            try {
+                E.stackTraceLimit = 0;
+            }
+            catch {
+                _E = null;
+                return new Definition();
+            }
+            try {
+                return new Definition();
+            }
+            finally {
+                E.stackTraceLimit = saved;
+            }
+        }
+    }
+    return new Definition();
+}
+export /*@__NO_SIDE_EFFECTS__*/ function $constructor(name, initializer, 
+/** This trait's members, installed once on every prototype that composes it. They cannot be declared in the initializer above: that runs per instance, and the prototype is shared. */
+proto, params) {
+    // Prototype for this constructor's `_zod` internals. Lazily-derived fields (`values`, `pattern`, `optin`, …) install here once rather than as an accessor on every instance.
+    const zodProto = {};
+    // Assigning the fields in the constructor body is what gives instances in-object slots; building the object literally and reparenting it costs a second allocation and a generic property copy.
+    function Internals(def) {
+        this.def = def;
+        this.constr = _;
+        this.traits = new Set();
+    }
+    Internals.prototype = zodProto;
+    const protoMembers = proto;
+    // One trait's members land on every prototype whose chain composes it, so the answer is per prototype rather than per trait.
+    const initialized = protoMembers && new WeakSet();
     function init(inst, def) {
         if (!inst._zod) {
-            Object.defineProperty(inst, "_zod", {
-                value: {
-                    def,
-                    constr: _,
-                    traits: new Set(),
-                },
-                enumerable: false,
-            });
+            _zodDesc.value = new Internals(def);
+            try {
+                Object.defineProperty(inst, "_zod", _zodDesc);
+            }
+            finally {
+                // Cleared even on throw, so the shared descriptor never leaks one instance's internals into the next.
+                _zodDesc.value = undefined;
+            }
         }
         if (inst._zod.traits.has(name)) {
             return;
         }
         inst._zod.traits.add(name);
         initializer(inst, def);
-        // support prototype modifications
+        if (initialized) {
+            // `super(def)` from a user subclass gives `this` a prototype the subclass owns, and installing there would overwrite whatever the subclass declared. `constr` built the instance, so its prototype is the one below the subclass's that should carry the members. A receiver whose chain never reaches that prototype installs on its own, which for a plain object handed straight to `init` means `Object.prototype` — unchanged from before.
+            const own = Object.getPrototypeOf(inst);
+            const ctorProto = inst._zod.constr.prototype;
+            let up = own;
+            while (up && up !== ctorProto)
+                up = Object.getPrototypeOf(up);
+            const target = up ?? own;
+            if (!initialized.has(target)) {
+                initialized.add(target);
+                installMembers(target, protoMembers);
+            }
+        }
+        // support prototype modifications; for-in avoids the array allocation of Object.keys on the (usually empty) prototype
         const proto = _.prototype;
-        const keys = Object.keys(proto);
-        for (let i = 0; i < keys.length; i++) {
-            const k = keys[i];
+        for (const k in proto) {
+            if (!Object.prototype.hasOwnProperty.call(proto, k))
+                continue;
             if (!(k in inst)) {
                 inst[k] = proto[k].bind(inst);
             }
@@ -36,13 +92,20 @@ export /*@__NO_SIDE_EFFECTS__*/ function $constructor(name, initializer, params)
     }
     Object.defineProperty(Definition, "name", { value: name });
     function _(def) {
-        var _a;
-        const inst = params?.Parent ? new Definition() : this;
+        const inst = params?.Parent ? newError(Definition) : this;
         init(inst, def);
-        (_a = inst._zod).deferred ?? (_a.deferred = []);
-        for (const fn of inst._zod.deferred) {
-            fn();
+        const deferred = inst._zod.deferred;
+        if (deferred) {
+            for (const fn of deferred) {
+                fn();
+            }
+            // Released: initializers run once, and the list would otherwise be retained for the schema's lifetime.
+            inst._zod.deferred = undefined;
         }
+        // Global post-processor hook. Internal: installed by `import "zod/compile"` to enable AOT compilation for every constructed schema. Runs last, once the instance is fully built, because it hands the instance to compile(). The post-processor is expected to be reentrancy-guarded by its own implementation.
+        const pp = globalThis.__zod_globalConfig?.postProcessor;
+        if (pp)
+            pp(inst);
         return inst;
     }
     Object.defineProperty(_, "init", { value: init });
@@ -57,7 +120,7 @@ export /*@__NO_SIDE_EFFECTS__*/ function $constructor(name, initializer, params)
     return _;
 }
 //////////////////////////////   UTILITIES   ///////////////////////////////////////
-export const $brand = Symbol("zod_brand");
+export const $brand = /*@__PURE__*/ Symbol("zod_brand");
 export class $ZodAsyncError extends Error {
     constructor() {
         super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);

package/node_modules/zod/v4/core/doc.cjs

@@ -2,11 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Doc = void 0;
 class Doc {
-    constructor(args = []) {
+    constructor(args = [], closed = {}) {
         this.content = [];
         this.indent = 0;
-        if (this)
-            this.args = args;
+        this.args = args;
+        this.closed = closed;
     }
     indented(fn) {
         this.indent += 1;
@@ -29,11 +29,9 @@ class Doc {
     }
     compile() {
         const F = Function;
-        const args = this?.args;
         const content = this?.content ?? [``];
-        const lines = [...content.map((x) => `  ${x}`)];
-        // console.log(lines.join("\n"));
-        return new F(...args, lines.join("\n"));
+        const factory = new F(...Object.keys(this.closed), `return function (${this.args.join(", ")}) {\n${content.join("\n")}\n};`);
+        return factory(...Object.values(this.closed));
     }
 }
 exports.Doc = Doc;

package/node_modules/zod/v4/core/doc.d.cts

@@ -3,9 +3,11 @@ type ModeWriter = (doc: Doc, modes: {
 }) => void;
 export declare class Doc {
     args: string[];
+    /** Bindings the compiled function closes over, by name. */
+    closed: Record<string, unknown>;
     content: string[];
     indent: number;
-    constructor(args?: string[]);
+    constructor(args?: string[], closed?: Record<string, unknown>);
     indented(fn: (doc: Doc) => void): void;
     write(fn: ModeWriter): void;
     write(line: string): void;

package/node_modules/zod/v4/core/doc.d.ts

@@ -3,9 +3,11 @@ type ModeWriter = (doc: Doc, modes: {
 }) => void;
 export declare class Doc {
     args: string[];
+    /** Bindings the compiled function closes over, by name. */
+    closed: Record<string, unknown>;
     content: string[];
     indent: number;
-    constructor(args?: string[]);
+    constructor(args?: string[], closed?: Record<string, unknown>);
     indented(fn: (doc: Doc) => void): void;
     write(fn: ModeWriter): void;
     write(line: string): void;

package/node_modules/zod/v4/core/doc.js

@@ -1,9 +1,9 @@
 export class Doc {
-    constructor(args = []) {
+    constructor(args = [], closed = {}) {
         this.content = [];
         this.indent = 0;
-        if (this)
-            this.args = args;
+        this.args = args;
+        this.closed = closed;
     }
     indented(fn) {
         this.indent += 1;
@@ -26,10 +26,8 @@ export class Doc {
     }
     compile() {
         const F = Function;
-        const args = this?.args;
         const content = this?.content ?? [``];
-        const lines = [...content.map((x) => `  ${x}`)];
-        // console.log(lines.join("\n"));
-        return new F(...args, lines.join("\n"));
+        const factory = new F(...Object.keys(this.closed), `return function (${this.args.join(", ")}) {\n${content.join("\n")}\n};`);
+        return factory(...Object.values(this.closed));
     }
 }

package/node_modules/zod/v4/core/errors.cjs

@@ -31,31 +31,86 @@ exports.toDotPath = toDotPath;
 exports.prettifyError = prettifyError;
 const core_js_1 = require("./core.cjs");
 const util = __importStar(require("./util.cjs"));
+/* Computing the message eagerly is expensive (pretty-printed JSON of all
+ * issues), so defer it until first read. The accessor functions and
+ * descriptors are shared across instances to keep error construction
+ * cheap; the computed message is cached on the internals object. The
+ * setter preserves plain assignment semantics for consumers that
+ * overwrite `message`. */
+function _getMessage() {
+    const internals = this._zod;
+    internals.message ?? (internals.message = JSON.stringify(internals.def, util.jsonStringifyReplacer, 2));
+    return internals.message;
+}
+function _setMessage(value) {
+    this._zod.message = value;
+}
+const _messageDesc = {
+    get: _getMessage,
+    set: _setMessage,
+    enumerable: true,
+    configurable: true,
+};
+const _zodDesc = { value: undefined, enumerable: false };
+const _issuesDesc = { value: undefined, enumerable: false };
+/* Prototypes that already carry the lazy `toString`. Seeded with the
+ * intrinsics so that `init` on a foreign object — it accepts any object —
+ * can never install an accessor onto a prototype we do not own. */
+const _installedToString = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 const initializer = (inst, def) => {
     inst.name = "$ZodError";
-    Object.defineProperty(inst, "_zod", {
-        value: inst._zod,
-        enumerable: false,
-    });
-    Object.defineProperty(inst, "issues", {
-        value: def,
-        enumerable: false,
-    });
-    inst.message = JSON.stringify(def, util.jsonStringifyReplacer, 2);
-    Object.defineProperty(inst, "toString", {
-        value: () => inst.message,
-        enumerable: false,
-    });
+    _zodDesc.value = inst._zod;
+    Object.defineProperty(inst, "_zod", _zodDesc);
+    _issuesDesc.value = def;
+    Object.defineProperty(inst, "issues", _issuesDesc);
+    // Clear the shared slots; a retained `value` pins the last error's issues.
+    _zodDesc.value = undefined;
+    _issuesDesc.value = undefined;
+    Object.defineProperty(inst, "message", _messageDesc);
+    /* `toString` lives as a non-enumerable lazy getter on the shared
+     * prototype; on first access it caches a per-instance closure so
+     * detached usage still works. */
+    const proto = Object.getPrototypeOf(inst);
+    if (!_installedToString.has(proto)) {
+        _installedToString.add(proto);
+        Object.defineProperty(proto, "toString", {
+            configurable: true,
+            enumerable: false,
+            get() {
+                const value = () => this.message;
+                Object.defineProperty(this, "toString", { value, configurable: true, writable: true });
+                return value;
+            },
+            set(value) {
+                Object.defineProperty(this, "toString", { value, configurable: true, writable: true });
+            },
+        });
+    }
 };
 exports.$ZodError = (0, core_js_1.$constructor)("$ZodError", initializer);
-exports.$ZodRealError = (0, core_js_1.$constructor)("$ZodError", initializer, { Parent: Error });
+exports.$ZodRealError = (0, core_js_1.$constructor)("$ZodError", initializer, undefined, {
+    Parent: Error,
+});
+/** Get-or-create `obj[key]` as an own data property. A path segment naming an inherited member
+ * ("toString", "constructor") would otherwise read through to the prototype, and assigning
+ * "__proto__" would hit the setter instead of creating a key. */
+function node(obj, key, make) {
+    if (!Object.prototype.hasOwnProperty.call(obj, key)) {
+        if (key === "__proto__") {
+            Object.defineProperty(obj, key, { value: make(), writable: true, enumerable: true, configurable: true });
+        }
+        else {
+            obj[key] = make();
+        }
+    }
+    return obj[key];
+}
 function flattenError(error, mapper = (issue) => issue.message) {
     const fieldErrors = {};
     const formErrors = [];
     for (const sub of error.issues) {
         if (sub.path.length > 0) {
-            fieldErrors[sub.path[0]] = fieldErrors[sub.path[0]] || [];
-            fieldErrors[sub.path[0]].push(mapper(sub));
+            node(fieldErrors, sub.path[0], () => []).push(mapper(sub));
         }
         else {
             formErrors.push(mapper(sub));
@@ -87,14 +142,32 @@ function formatError(error, mapper = (issue) => issue.message) {
                     while (i < fullpath.length) {
                         const el = fullpath[i];
                         const terminal = i === fullpath.length - 1;
-                        if (!terminal) {
-                            curr[el] = curr[el] || { _errors: [] };
+                        // `_errors` is reserved by this legacy format, so merge a matching path segment into the current node instead of treating its array as a child.
+                        if (el === "_errors") {
+                            if (terminal)
+                                curr._errors.push(mapper(issue));
+                            i++;
+                            continue;
+                        }
+                        // A path element may collide with an inherited property name such as
+                        // "__proto__" or "constructor". Truthiness checks read the prototype
+                        // (so no node is created, then ._errors.push throws), and bracket
+                        // assignment of "__proto__" hits the setter instead of creating an
+                        // own key. Guard the read with hasOwnProperty and create the node
+                        // with defineProperty so any path element becomes a real own key.
+                        if (!Object.prototype.hasOwnProperty.call(curr, el)) {
+                            Object.defineProperty(curr, el, {
+                                value: { _errors: [] },
+                                enumerable: true,
+                                writable: true,
+                                configurable: true,
+                            });
                         }
-                        else {
-                            curr[el] = curr[el] || { _errors: [] };
-                            curr[el]._errors.push(mapper(issue));
+                        const node = curr[el];
+                        if (terminal) {
+                            node._errors.push(mapper(issue));
                         }
-                        curr = curr[el];
+                        curr = node;
                         i++;
                     }
                 }
@@ -107,7 +180,7 @@ function formatError(error, mapper = (issue) => issue.message) {
 function treeifyError(error, mapper = (issue) => issue.message) {
     const result = { errors: [] };
     const processError = (error, path = []) => {
-        var _a, _b;
+        var _a;
         for (const issue of error.issues) {
             if (issue.code === "invalid_union" && issue.errors.length) {
                 // regular union error
@@ -132,12 +205,24 @@ function treeifyError(error, mapper = (issue) => issue.message) {
                     const terminal = i === fullpath.length - 1;
                     if (typeof el === "string") {
                         curr.properties ?? (curr.properties = {});
-                        (_a = curr.properties)[el] ?? (_a[el] = { errors: [] });
+                        // el may collide with an inherited property name ("__proto__",
+                        // "constructor", ...); ??= reads the prototype so the node is never
+                        // created and curr.errors.push throws. Guard with hasOwnProperty and
+                        // create the node with defineProperty so "__proto__" becomes a real
+                        // own key rather than invoking the prototype setter.
+                        if (!Object.prototype.hasOwnProperty.call(curr.properties, el)) {
+                            Object.defineProperty(curr.properties, el, {
+                                value: { errors: [] },
+                                enumerable: true,
+                                writable: true,
+                                configurable: true,
+                            });
+                        }
                         curr = curr.properties[el];
                     }
                     else {
                         curr.items ?? (curr.items = []);
-                        (_b = curr.items)[el] ?? (_b[el] = { errors: [] });
+                        (_a = curr.items)[el] ?? (_a[el] = { errors: [] });
                         curr = curr.items[el];
                     }
                     if (terminal) {

package/node_modules/zod/v4/core/errors.d.cts

@@ -63,6 +63,8 @@ interface $ZodIssueInvalidUnionMultipleMatch extends $ZodIssueBase {
     readonly input?: unknown;
     readonly discriminator?: string | undefined;
     readonly inclusive: false;
+    /** Indices of the options that matched */
+    readonly matches: number[];
 }
 export type $ZodIssueInvalidUnion = $ZodIssueInvalidUnionNoMatch | $ZodIssueInvalidUnionMultipleMatch;
 export interface $ZodIssueInvalidKey<Input = unknown> extends $ZodIssueBase {
@@ -120,6 +122,8 @@ type RawIssue<T extends $ZodIssueBase> = T extends any ? util.Flatten<util.MakeP
     readonly input: unknown;
     /** The schema or check that originated this issue. */
     readonly inst?: $ZodType | $ZodCheck;
+    /** The schema that owns the issue. Equal to `inst` when a schema originated the issue, and the schema the check was attached to when a check did. */
+    readonly schema?: $ZodType | undefined;
     /** If `true`, Zod will continue executing checks/refinements after this issue. */
     readonly continue?: boolean | undefined;
 } & Record<string, unknown>> : never;

package/node_modules/zod/v4/core/errors.d.ts

@@ -63,6 +63,8 @@ interface $ZodIssueInvalidUnionMultipleMatch extends $ZodIssueBase {
     readonly input?: unknown;
     readonly discriminator?: string | undefined;
     readonly inclusive: false;
+    /** Indices of the options that matched */
+    readonly matches: number[];
 }
 export type $ZodIssueInvalidUnion = $ZodIssueInvalidUnionNoMatch | $ZodIssueInvalidUnionMultipleMatch;
 export interface $ZodIssueInvalidKey<Input = unknown> extends $ZodIssueBase {
@@ -120,6 +122,8 @@ type RawIssue<T extends $ZodIssueBase> = T extends any ? util.Flatten<util.MakeP
     readonly input: unknown;
     /** The schema or check that originated this issue. */
     readonly inst?: $ZodType | $ZodCheck;
+    /** The schema that owns the issue. Equal to `inst` when a schema originated the issue, and the schema the check was attached to when a check did. */
+    readonly schema?: $ZodType | undefined;
     /** If `true`, Zod will continue executing checks/refinements after this issue. */
     readonly continue?: boolean | undefined;
 } & Record<string, unknown>> : never;