@openclaw/irc 2026.9.4 → 2026.9.6

package/assets/activity.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M9 3 5 21M19 3l-4 18M3 8h18M2 16h18" />
+</svg>

package/dist/{channel-ChjrDzIi.js → .setup/channel-hBHc-p9Z.mjs}

@@ -1,6 +1,6 @@
-import { t as IrcChannelConfigSchema } from "./config-schema-Cy9tItsu.js";
-import { t as getIrcRuntime } from "./runtime-xy-FcjJC.js";
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-D_DC3YWj.js";
+import { t as IrcChannelConfigSchema } from "./config-schema-Cy9tItsu.mjs";
+import { t as getIrcRuntime } from "./runtime-xy-FcjJC.mjs";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-D_DC3YWj.mjs";
 import { createAccountListHelpers, describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { formatNormalizedAllowFromEntries } from "openclaw/plugin-sdk/allow-from";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
@@ -202,7 +202,7 @@ const collectIrcMutableAllowlistWarnings = createDangerousNameMatchingMutableAll
 });
 //#endregion
 //#region extensions/irc/src/gateway.ts
-const loadIrcChannelRuntime$1 = createLazyRuntimeModule(() => import("./channel-runtime-BC6bx1Xm.js"));
+const loadIrcChannelRuntime$1 = createLazyRuntimeModule(() => import("./channel-runtime-2EUgbrxg.mjs"));
 async function startIrcGatewayAccount(ctx) {
 	const account = ctx.account;
 	const statusSink = createAccountStatusSink({
@@ -609,13 +609,13 @@ async function connectIrcClient(options) {
 		if (!target.startsWith("#") && !target.startsWith("&")) throw new Error(`IRC JOIN target must be a channel: ${channel}`);
 		sendRaw(`JOIN ${target}`);
 	};
-	const sendPrivmsg = (target, text) => {
+	const sendPrivmsg = (target, text, replyTo) => {
 		const normalizedTarget = sanitizeIrcTarget(target);
 		const cleaned = sanitizeIrcOutboundText(text);
-		if (!cleaned) return;
+		if (!cleaned) throw new Error("Message must be non-empty for IRC sends");
 		const lineOverheadBytes = Buffer.byteLength(`PRIVMSG ${normalizedTarget} :\r\n`, "utf8");
 		const maxChunkBytes = IRC_MAX_LINE_BYTES - lineOverheadBytes;
-		let remaining = cleaned;
+		let remaining = replyTo ? sanitizeIrcOutboundText(`${text}\n\n[reply:${replyTo}]`) : cleaned;
 		while (remaining.length > 0) {
 			const chunk = takeIrcPrivmsgChunk(remaining, messageChunkMaxChars, maxChunkBytes).trim();
 			sendRaw(`PRIVMSG ${normalizedTarget} :${chunk}`);
@@ -852,7 +852,7 @@ async function sendIrcMessages(to, text, opts, planMessages = (preparedText) =>
 			await opts.onPlatformSendDispatch?.();
 			opts.abortSignal?.throwIfAborted();
 			if (!client.isReady()) throw new Error("IRC connection closed before send");
-			client.sendPrivmsg(target, message.replyTo ? `${message.text}\n\n[reply:${message.replyTo}]` : message.text);
+			client.sendPrivmsg(target, message.text, message.replyTo);
 			recordIrcOutboundActivity(account.accountId);
 			const messageId = makeIrcMessageId();
 			const result = {
@@ -1544,7 +1544,7 @@ const meta = {
 	systemImage: "number",
 	markdownCapable: true
 };
-const loadIrcChannelRuntime = createLazyRuntimeModule(() => import("./channel-runtime-BC6bx1Xm.js"));
+const loadIrcChannelRuntime = createLazyRuntimeModule(() => import("./channel-runtime-2EUgbrxg.mjs"));
 function normalizePairingTarget(raw) {
 	const normalized = normalizeIrcAllowEntry(raw);
 	if (!normalized) return "";
@@ -1613,7 +1613,7 @@ const collectIrcGroupPolicyWarnings = createAllowlistProviderOpenWarningCollecto
 const collectIrcOpenGroupFindings = createConditionalWarningCollector.findings({
 	collectWarnings: collectIrcGroupPolicyWarnings,
 	checkId: "channels.irc.groups.open",
-	severity: "critical",
+	severity: "warn",
 	title: "IRC security warning"
 });
 const collectIrcSecurityWarnings = (params) => [

package/dist/.setup/channel-plugin-api-BVh8x-TZ.mjs

@@ -0,0 +1,3 @@
+import { t as ircPlugin } from "./channel-hBHc-p9Z.mjs";
+import "../channel-plugin-api.js";
+export { ircPlugin };

package/dist/{channel-runtime-BC6bx1Xm.js → .setup/channel-runtime-2EUgbrxg.mjs}

@@ -1,6 +1,6 @@
-import { a as resolveIrcGroupRequireMention, c as connectIrcClient, d as sanitizeIrcAssistantText, f as createIrcIngressSubject, h as normalizeIrcAllowEntry, i as resolveIrcGroupMatch, l as parseIrcLine, m as isChannelTarget, o as sendMessageIrc, p as ircIngressIdentity, s as buildIrcConnectOptions, u as parseIrcPrefix, y as resolveIrcAccount } from "./channel-ChjrDzIi.js";
-import { t as getIrcRuntime } from "./runtime-xy-FcjJC.js";
-import { channelIngressRoutes, createChannelIngressResolver } from "openclaw/plugin-sdk/channel-ingress-runtime";
+import { a as resolveIrcGroupRequireMention, c as connectIrcClient, d as sanitizeIrcAssistantText, f as createIrcIngressSubject, h as normalizeIrcAllowEntry, i as resolveIrcGroupMatch, l as parseIrcLine, m as isChannelTarget, o as sendMessageIrc, p as ircIngressIdentity, s as buildIrcConnectOptions, u as parseIrcPrefix, y as resolveIrcAccount } from "./channel-hBHc-p9Z.mjs";
+import { t as getIrcRuntime } from "./runtime-xy-FcjJC.mjs";
+import { channelIngressRoutes } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { bindIngressLifecycleToReplyOptions, createChannelIngressError, createChannelIngressMonitor, resolveChannelStreamingBlockEnabled } from "openclaw/plugin-sdk/channel-outbound";
 import { randomUUID } from "node:crypto";
@@ -132,7 +132,7 @@ async function handleIrcInbound(params) {
 			id: peerId
 		}
 	});
-	const access = await createChannelIngressResolver({
+	const access = await core.channel.inbound.ingress.createResolver({
 		channelId: CHANNEL_ID,
 		accountId: account.accountId,
 		identity: ircIngressIdentity,

package/dist/.setup/secret-contract-api-ClCcrDAz.mjs

@@ -0,0 +1,3 @@
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-D_DC3YWj.mjs";
+import "../secret-contract-api.js";
+export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/api.js

@@ -1,3 +1,3 @@
-import { _ as listIrcAccountIds, g as listEnabledIrcAccounts, n as ircSetupWizard, r as ircSetupAdapter, t as ircPlugin, v as resolveDefaultIrcAccountId, y as resolveIrcAccount } from "./channel-ChjrDzIi.js";
-import { n as setIrcRuntime } from "./runtime-xy-FcjJC.js";
+import { _ as listIrcAccountIds, g as listEnabledIrcAccounts, n as ircSetupWizard, r as ircSetupAdapter, t as ircPlugin, v as resolveDefaultIrcAccountId, y as resolveIrcAccount } from "./.setup/channel-hBHc-p9Z.mjs";
+import { n as setIrcRuntime } from "./.setup/runtime-xy-FcjJC.mjs";
 export { ircPlugin, ircSetupAdapter, ircSetupWizard, listEnabledIrcAccounts, listIrcAccountIds, resolveDefaultIrcAccountId, resolveIrcAccount, setIrcRuntime };

package/dist/channel-config-api.js

@@ -1,2 +1,2 @@
-import { t as IrcChannelConfigSchema } from "./config-schema-Cy9tItsu.js";
+import { t as IrcChannelConfigSchema } from "./.setup/config-schema-Cy9tItsu.mjs";
 export { IrcChannelConfigSchema };

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as ircPlugin } from "./channel-ChjrDzIi.js";
+import { t as ircPlugin } from "./.setup/channel-hBHc-p9Z.mjs";
 export { ircPlugin };

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { n as setIrcRuntime } from "./runtime-xy-FcjJC.js";
+import { n as setIrcRuntime } from "./.setup/runtime-xy-FcjJC.mjs";
 export { setIrcRuntime };

package/dist/secret-contract-api.js

@@ -1,2 +1,2 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-D_DC3YWj.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./.setup/secret-contract-D_DC3YWj.mjs";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/setup-entry.js

@@ -1,13 +1,14 @@
 import { defineBundledChannelSetupEntry } from "openclaw/plugin-sdk/channel-entry-contract";
+import { fileURLToPath } from "node:url";
 //#region extensions/irc/setup-entry.ts
 var setup_entry_default = defineBundledChannelSetupEntry({
 	importMetaUrl: import.meta.url,
 	plugin: {
-		specifier: "./channel-plugin-api.js",
+		specifier: fileURLToPath(new URL(".setup/channel-plugin-api-BVh8x-TZ.mjs", import.meta.url).href),
 		exportName: "ircPlugin"
 	},
 	secrets: {
-		specifier: "./secret-contract-api.js",
+		specifier: fileURLToPath(new URL(".setup/secret-contract-api-ClCcrDAz.mjs", import.meta.url).href),
 		exportName: "channelSecrets"
 	}
 });

package/node_modules/zod/README.md

@@ -113,6 +113,33 @@ await schema.parseAsync("hello");
 // => "hello"
 ```
 
+### AOT compilation
+
+For hot validation paths, `z.compile(schema)` returns a schema clone with an ahead-of-time compiled fast path. Valid inputs take the compiled path; invalid inputs fall back to the regular parser so error reporting stays identical.
+
+Across a 55-schema benchmark the median speedup is **2.4x**, and it scales with how much work the schema does per parse: a large array of objects is ~9x, a 20-key object ~9x, a nested object ~4.5x, while a bare `z.string()` gains nothing — compilation removes per-node dispatch and allocation, and a single `typeof` has none to remove.
+
+```ts
+const CompiledPlayer = z.compile(Player);
+
+CompiledPlayer.parse({ username: "billie", xp: 100 });
+```
+
+To enable compilation globally for schemas constructed after import:
+
+```ts
+import "zod/compile"; // place before modules that define schemas
+```
+
+Things to know:
+
+- Compilation uses `new Function`. Global mode is automatically disabled when `z.config({ jitless: true })` is set (e.g. CSP environments); calling `z.compile()` directly is an explicit opt-in.
+- Schemas with async refinements or transforms can't be compiled, and neither can a few other constructs. That is not an error: `z.compile()` hands the schema back unchanged and it keeps using the regular parser, exactly as global mode leaves it. Pass `{ strict: true }` to throw `ZodCompileAsyncError` / `ZodCompileUnsupportedError` instead.
+- On invalid input, refinements and transforms may run twice (fast path, then fallback).
+- Deriving a new schema from a compiled one (`.refine()`, `.extend()`, etc.) returns an uncompiled schema — compile the final schema.
+
+See [`compile` docs](https://zod.dev/compile) for details.
+
 ### Handling errors
 
 When validation fails, the `.parse()` method will throw a `ZodError` instance with granular information about the validation issues.
@@ -128,13 +155,13 @@ try {
         expected: 'string',
         code: 'invalid_type',
         path: [ 'username' ],
-        message: 'Invalid input: expected string'
+        message: 'Invalid input: expected string, received number'
       },
       {
         expected: 'number',
         code: 'invalid_type',
         path: [ 'xp' ],
-        message: 'Invalid input: expected number'
+        message: 'Invalid input: expected number, received string'
       }
     ] */
   }

package/node_modules/zod/compile.cjs

@@ -0,0 +1,96 @@
+"use strict";
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const compile_js_1 = require("./v4/core/compile.cjs");
+const core = __importStar(require("./v4/core/index.cjs"));
+let compiling = false;
+core.globalConfig.postProcessor = (inst) => {
+    if (compiling)
+        return;
+    const originalRun = inst._zod?.run;
+    if (typeof originalRun !== "function")
+        return;
+    const shim = (payload, ctx) => {
+        // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+        if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+            return originalRun(payload, ctx);
+        }
+        compiling = true;
+        try {
+            // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+            if (core.globalConfig.jitless) {
+                inst._zod.run = originalRun;
+                return originalRun(payload, ctx);
+            }
+            // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+            const compiled = (0, compile_js_1.compile)(inst, { strict: true });
+            // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+            inst._zod.run = compiled._zod.run;
+            inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+            inst._zod.bag.validator = compiled._zod.bag.validator;
+        }
+        catch {
+            // Permanent fallback for unsupported schemas.
+            inst._zod.run = originalRun;
+        }
+        finally {
+            compiling = false;
+        }
+        return inst._zod.run(payload, ctx);
+    };
+    // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+    shim.__originalRun = originalRun;
+    inst._zod.run = shim;
+};
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/compile.d.cts

@@ -0,0 +1 @@
+export {};

package/node_modules/zod/compile.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/zod/compile.js

@@ -0,0 +1,52 @@
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+import { compile } from "./v4/core/compile.js";
+import * as core from "./v4/core/index.js";
+let compiling = false;
+core.globalConfig.postProcessor = (inst) => {
+    if (compiling)
+        return;
+    const originalRun = inst._zod?.run;
+    if (typeof originalRun !== "function")
+        return;
+    const shim = (payload, ctx) => {
+        // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+        if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+            return originalRun(payload, ctx);
+        }
+        compiling = true;
+        try {
+            // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+            if (core.globalConfig.jitless) {
+                inst._zod.run = originalRun;
+                return originalRun(payload, ctx);
+            }
+            // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+            const compiled = compile(inst, { strict: true });
+            // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+            inst._zod.run = compiled._zod.run;
+            inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+            inst._zod.bag.validator = compiled._zod.bag.validator;
+        }
+        catch {
+            // Permanent fallback for unsupported schemas.
+            inst._zod.run = originalRun;
+        }
+        finally {
+            compiling = false;
+        }
+        return inst._zod.run(payload, ctx);
+    };
+    // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+    shim.__originalRun = originalRun;
+    inst._zod.run = shim;
+};

package/node_modules/zod/index.cjs

@@ -26,8 +26,27 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.z = void 0;
+exports.default = exports.z = void 0;
 const z = __importStar(require("./v4/classic/external.cjs"));
 exports.z = z;
-__exportStar(require("./v4/classic/external.cjs"), exports);
 exports.default = z;
+__exportStar(require("./v4/classic/external.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/index.d.cts

@@ -1,4 +1,3 @@
 import * as z from "./v4/classic/external.cjs";
 export * from "./v4/classic/external.cjs";
-export { z };
-export default z;
+export { z, z as default };

package/node_modules/zod/index.d.ts

@@ -1,4 +1,3 @@
 import * as z from "./v4/classic/external.js";
 export * from "./v4/classic/external.js";
-export { z };
-export default z;
+export { z, z as default };

package/node_modules/zod/index.js

@@ -1,4 +1,7 @@
 import * as z from "./v4/classic/external.js";
 export * from "./v4/classic/external.js";
-export { z };
-export default z;
+// Aliasing the binding, instead of `export default z`, keeps the default export a
+// re-export of `z` rather than a fresh namespace value. Rollup and Webpack can then
+// shake `import z from "zod"` as they already shake `import { z } from "zod"` — without
+// this they pull in every locale. See #6050.
+export { z, z as default };

package/node_modules/zod/locales/index.cjs

@@ -15,3 +15,22 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("../v4/locales/index.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/mini/index.cjs

@@ -30,3 +30,22 @@ exports.z = void 0;
 const z = __importStar(require("../v4/mini/external.cjs"));
 exports.z = z;
 __exportStar(require("../v4/mini/external.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.4.3",
+  "version": "4.6.5",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",
@@ -10,7 +10,11 @@
   "llmsFull": "https://zod.dev/llms-full.txt",
   "mcpServer": "https://mcp.inkeep.com/zod/mcp",
   "funding": "https://github.com/sponsors/colinhacks",
-  "sideEffects": false,
+  "sideEffects": [
+    "./compile.js",
+    "./compile.cjs",
+    "./src/compile.ts"
+  ],
   "files": [
     "src",
     "**/*.js",
@@ -36,6 +40,7 @@
       "./package.json": "./package.json",
       ".": "./src/index.ts",
       "./mini": "./src/mini/index.ts",
+      "./compile": "./src/compile.ts",
       "./locales": "./src/locales/index.ts",
       "./v3": "./src/v3/index.ts",
       "./v4": "./src/v4/index.ts",
@@ -47,7 +52,8 @@
     },
     "conditions": {
       "@zod/source": "src"
-    }
+    },
+    "sealCjsExports": true
   },
   "exports": {
     "./package.json": "./package.json",
@@ -63,6 +69,12 @@
       "import": "./mini/index.js",
       "require": "./mini/index.cjs"
     },
+    "./compile": {
+      "@zod/source": "./src/compile.ts",
+      "types": "./compile.d.cts",
+      "import": "./compile.js",
+      "require": "./compile.cjs"
+    },
     "./locales": {
       "@zod/source": "./src/locales/index.ts",
       "types": "./locales/index.d.cts",
@@ -126,10 +138,10 @@
   },
   "scripts": {
     "clean": "git clean -xdf . -e node_modules",
-    "build": "zshy --project tsconfig.build.json",
-    "postbuild": "tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .",
-    "test:watch": "pnpm vitest",
-    "test": "pnpm vitest run",
-    "prepublishOnly": "tsx ../../scripts/check-versions.ts"
+    "build": "nub exec --node zshy --project tsconfig.build.json",
+    "postbuild": "nub ../../scripts/write-stub-package-jsons.ts && nub exec --node biome check --write .",
+    "test:watch": "nub exec --node vitest",
+    "test": "nub exec --node vitest run",
+    "prepublishOnly": "nub ../../scripts/check-versions.ts"
   }
 }

package/node_modules/zod/src/compile.ts

@@ -0,0 +1,56 @@
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+
+import { compile } from "./v4/core/compile.js";
+import * as core from "./v4/core/index.js";
+
+let compiling = false;
+
+core.globalConfig.postProcessor = (inst: any) => {
+  if (compiling) return;
+  const originalRun = inst._zod?.run;
+  if (typeof originalRun !== "function") return;
+
+  const shim = (payload: any, ctx: any): any => {
+    // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+    if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+      return originalRun(payload, ctx);
+    }
+
+    compiling = true;
+    try {
+      // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+      if (core.globalConfig.jitless) {
+        inst._zod.run = originalRun;
+        return originalRun(payload, ctx);
+      }
+      // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+      const compiled = compile(inst, { strict: true });
+      // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+      inst._zod.run = compiled._zod.run;
+      inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+      inst._zod.bag.validator = compiled._zod.bag.validator;
+    } catch {
+      // Permanent fallback for unsupported schemas.
+      inst._zod.run = originalRun;
+    } finally {
+      compiling = false;
+    }
+
+    return inst._zod.run(payload, ctx);
+  };
+
+  // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+  (shim as any).__originalRun = originalRun;
+
+  inst._zod.run = shim;
+};

package/node_modules/zod/src/index.ts

@@ -1,4 +1,7 @@
 import * as z from "./v4/classic/external.js";
 export * from "./v4/classic/external.js";
-export { z };
-export default z;
+// Aliasing the binding, instead of `export default z`, keeps the default export a
+// re-export of `z` rather than a fresh namespace value. Rollup and Webpack can then
+// shake `import z from "zod"` as they already shake `import { z } from "zod"` — without
+// this they pull in every locale. See #6050.
+export { z, z as default };

package/node_modules/zod/src/v3/ZodError.ts

@@ -238,21 +238,31 @@ export class ZodError<T = any> extends Error {
             const el = issue.path[i]!;
             const terminal = i === issue.path.length - 1;
 
-            if (!terminal) {
-              curr[el] = curr[el] || { _errors: [] };
-              // if (typeof el === "string") {
-              //   curr[el] = curr[el] || { _errors: [] };
-              // } else if (typeof el === "number") {
-              //   const errorArray: any = [];
-              //   errorArray._errors = [];
-              //   curr[el] = curr[el] || errorArray;
-              // }
-            } else {
-              curr[el] = curr[el] || { _errors: [] };
-              curr[el]._errors.push(mapper(issue));
+            // `_errors` is reserved by this legacy format, so merge a matching path segment into the current node instead of treating its array as a child.
+            if (el === "_errors") {
+              if (terminal) curr._errors.push(mapper(issue));
+              i++;
+              continue;
+            }
+
+            // Create `el` as an own data property. A segment naming an inherited member ("toString", "constructor") would otherwise read through to the prototype, and assigning "__proto__" would hit the setter and walk into Object.prototype.
+            if (!Object.prototype.hasOwnProperty.call(curr, el)) {
+              if (el === "__proto__") {
+                Object.defineProperty(curr, el, {
+                  value: { _errors: [] },
+                  writable: true,
+                  enumerable: true,
+                  configurable: true,
+                });
+              } else {
+                curr[el] = { _errors: [] };
+              }
             }
 
             curr = curr[el];
+            if (terminal) {
+              curr._errors.push(mapper(issue));
+            }
             i++;
           }
         }