@openclaw/lobster 2026.7.2-beta.3 → 2026.7.2-beta.5

package/node_modules/fast-uri/index.js

@@ -202,6 +202,10 @@ function serialize (cmpts, opts) {
 
 const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u
 
+// Captures the authority component (between "//" and the next "/", "?" or "#"),
+// with or without a scheme prefix, for the literal-backslash rejection below.
+const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
+
 /**
  * @param {import('./types/index').URIComponent} parsed
  * @param {RegExpMatchArray} matches
@@ -248,6 +252,19 @@ function parseWithStatus (uri, opts) {
     }
   }
 
+  // A literal backslash (U+005C) is not a valid RFC 3986 URI character and is
+  // not an authority delimiter. Reject it in the authority rather than
+  // rewriting it: normalizing "\" -> "/" (WHATWG error recovery) could silently
+  // change the resource identified by an otherwise-invalid input, and lets "\"
+  // act as a host delimiter here while Node's native URL parses a different
+  // host (SSRF / redirect / origin-allowlist bypass). Percent-encoded %5C is
+  // untouched and remains valid encoded data.
+  const authorityMatch = uri.match(AUTHORITY_PREFIX)
+  if (authorityMatch !== null && authorityMatch[1].indexOf('\\') !== -1) {
+    parsed.error = 'URI authority must not contain a literal backslash.'
+    malformedAuthorityOrPort = true
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {
@@ -305,7 +322,7 @@ function parseWithStatus (uri, opts) {
       if (parsed.host && (options.domainHost || (schemeHandler && schemeHandler.domainHost)) && isIP === false && nonSimpleDomain(parsed.host)) {
         // convert Unicode IDN -> ASCII IDN
         try {
-          parsed.host = URL.domainToASCII(parsed.host.toLowerCase())
+          parsed.host = new URL('http://' + parsed.host).hostname
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e
         }

package/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "3.1.2",
+  "version": "3.1.4",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/node_modules/fast-uri/test/security.test.js

@@ -131,3 +131,93 @@ test('normalize does not double-decode %2540 into a live @', (t) => {
   t.plan(1)
   t.notEqual(parsed.host, 'trusted.com@evil.com', 'http://trusted.com%2540evil.com/')
 })
+
+test('parse canonicalises IDN / Unicode hosts to their ASCII form', (t) => {
+  const cases = [
+    {
+      input: 'http://127。0。0。1/',
+      expectedHost: '127.0.0.1',
+      description: 'full-width ideographic stops as octet separators'
+    },
+    {
+      input: 'http://ｅxample.com/',
+      expectedHost: 'example.com',
+      description: 'fullwidth e as first letter'
+    },
+    {
+      input: 'http://納豆.example.org/',
+      expectedHost: 'xn--99zt52a.example.org',
+      description: 'CJK label requiring punycode'
+    }
+  ]
+
+  t.plan(cases.length * 2)
+
+  cases.forEach(({ input, expectedHost, description }) => {
+    const parsed = fastURI.parse(input)
+    t.notOk(parsed.error, `parse should not set error: ${description}`)
+    t.equal(parsed.host, expectedHost, `host canonicalised to ASCII: ${description}`)
+  })
+})
+
+test('parse rejects a literal backslash in the authority as malformed (RFC 3986)', (t) => {
+  // Regression for the host-confusion bypass: a literal "\" is invalid RFC 3986
+  // syntax and must be flagged malformed, not silently rewritten. Otherwise "\"
+  // acts as a host delimiter here while Node's native URL parses a different
+  // host, defeating a host-based SSRF/redirect/origin allowlist.
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://169.254.169.254\\@trusted.example.com',
+    'http://127.0.0.1\\@public.example.com',
+    'https://attacker.com\\@api.internal',
+    'http://a\\@b',
+    'ws://evil.com\\@allowed.com/chat',
+    'wss://evil.com\\@allowed.com/chat',
+    'http://evil.com\\%40allowed.com',
+    '//evil.com\\@allowed.com'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a literal-backslash URI into a different valid URL', (t) => {
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://attacker.com\\@api.internal'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('parse leaves percent-encoded %5C untouched as encoded data (not rejected)', (t) => {
+  // Only the literal "\" byte is rejected; %5C stays valid encoded data and
+  // does not diverge from the native URL parser, so it must not be flagged.
+  const input = 'http://evil.com%5C@allowed.com'
+  const parsed = fastURI.parse(input)
+
+  t.plan(2)
+  t.notOk(parsed.error, '%5C is valid encoded data, not malformed')
+  t.equal(parsed.host, new URL(input).hostname, '%5C host matches native URL (no divergence)')
+})
+
+test('parse does not reject a literal backslash in the query or fragment', (t) => {
+  // The rejection is scoped to the authority/path (the host-confusion surface);
+  // a backslash after "?"/"#" is normalized as encoded data as before.
+  const parsed = fastURI.parse('http://host.example.com/?x=\\y#z\\w')
+
+  t.plan(2)
+  t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
+  t.equal(parsed.host, 'host.example.com', 'host parsed normally')
+})

package/node_modules/typebox/build/compile/validator.d.mts

@@ -1,14 +1,11 @@
 import { type TLocalizedValidationError } from '../error/index.mjs';
 import { type StaticDecode, type StaticEncode, type TProperties, type TSchema } from '../type/index.mjs';
-import { BuildResult, EvaluateResult } from '../schema/index.mjs';
 export declare class Validator<Context extends TProperties = TProperties, Type extends TSchema = TSchema, Encode extends unknown = StaticEncode<Type, Context>, Decode extends unknown = StaticDecode<Type, Context>> {
     private readonly hasCodec;
     private readonly buildResult;
     private readonly evaluateResult;
-    /** Constructs a Validator with the given Context and Type. */
+    /** Constructs a Validator. */
     constructor(context: Context, type: Type);
-    /** Constructs a Validator with the given arguments. */
-    constructor(hasCodec: boolean, buildResult: BuildResult, evaluateResult: EvaluateResult);
     /** Returns true if this Validator is using JIT acceleration. */
     IsAccelerated(): boolean;
     /** Returns the Context for this validator. */

package/node_modules/typebox/build/guard/guard.d.mts

@@ -61,5 +61,5 @@ export declare function Keys(value: Record<PropertyKey, unknown>): string[];
 export declare function Symbols(value: Record<PropertyKey, unknown>): symbol[];
 /** Returns the property values for the given object via `Object.values()` */
 export declare function Values(value: Record<PropertyKey, unknown>): unknown[];
-/** Tests values for deep equality */
+/** Returns true if left and right values are structurally equal */
 export declare function IsDeepEqual(left: unknown, right: unknown): boolean;

package/node_modules/typebox/build/guard/guard.mjs

@@ -1,3 +1,4 @@
+// deno-fmt-ignore-file
 import * as String from './string.mjs';
 // --------------------------------------------------------------------------
 // Guards
@@ -203,7 +204,9 @@ function DeepEqualArray(left, right) {
     return IsArray(right) && IsEqual(left.length, right.length) &&
         left.every((_, index) => IsDeepEqual(left[index], right[index]));
 }
-/** Tests values for deep equality */
+/** Returns true if left and right values are structurally equal */
 export function IsDeepEqual(left, right) {
-    return (IsArray(left) ? DeepEqualArray(left, right) : IsObject(left) ? DeepEqualObject(left, right) : IsEqual(left, right));
+    return (IsArray(left) ? DeepEqualArray(left, right) :
+        IsObject(left) ? DeepEqualObject(left, right) :
+            IsEqual(left, right));
 }

package/node_modules/typebox/build/guard/string.mjs

@@ -5,6 +5,18 @@ function IsBetween(value, min, max) {
     return value >= min && value <= max;
 }
 // --------------------------------------------------------------------------
+// IsZeroWidthJoiner
+// --------------------------------------------------------------------------
+function IsZeroWidthJoiner(value) {
+    return (value === 0x200D);
+}
+// --------------------------------------------------------------------------
+// IsHighSurrogate
+// --------------------------------------------------------------------------
+function IsHighSurrogate(value) {
+    return IsBetween(value, 0xD800, 0xDBFF);
+}
+// --------------------------------------------------------------------------
 // IsRegionalIndicator
 // --------------------------------------------------------------------------
 function IsRegionalIndicator(value) {
@@ -72,10 +84,10 @@ function NextGraphemeClusterIndex(value, clusterStart) {
 // IsGraphemeCodePoint
 // --------------------------------------------------------------------------
 function IsGraphemeCodePoint(value) {
-    return (IsBetween(value, 0xD800, 0xDBFF) || // High surrogate
-        IsBetween(value, 0x0300, 0x036F) || // Combining diacritical marks
-        (value === 0x200D) // Zero-width joiner
-    );
+    return (IsHighSurrogate(value) ||
+        IsCombiningMark(value) ||
+        IsVariationSelector(value) ||
+        IsZeroWidthJoiner(value));
 }
 // --------------------------------------------------------------------------
 // GraphemeCount

package/node_modules/typebox/build/schema/engine/_functions.mjs

@@ -1,47 +1,66 @@
 // deno-fmt-ignore-file
-import * as Schema from '../types/index.mjs';
 import { Hashing } from '../../system/hashing/index.mjs';
 import { EmitGuard as E } from '../../guard/index.mjs';
 import { BuildSchema } from './schema.mjs';
-const functions = new Map();
+const index = [0];
+const names = new Map;
+const funcs = new Map();
+// ------------------------------------------------------------------
+// CreateName
+// ------------------------------------------------------------------
+function NextName() {
+    return Hashing.Hash(index[0]++);
+}
+function CreateName(schema, href) {
+    if (!names.has(schema))
+        names.set(schema, new Map());
+    const hrefs = names.get(schema);
+    if (hrefs.has(href))
+        return hrefs.get(href);
+    const name = NextName();
+    hrefs.set(href, name);
+    return name;
+}
 // ------------------------------------------------------------------
 // CreateCallExpression
 // ------------------------------------------------------------------
-function CreateCallExpression(context, _schema, hash, value) {
+function CreateCallExpression(context, _schema, name, value) {
     return context.UseUnevaluated()
-        ? E.Call(`check_${hash}`, ['context', value])
-        : E.Call(`check_${hash}`, [value]);
+        ? E.Call(`check_${name}`, ['context', value])
+        : E.Call(`check_${name}`, [value]);
 }
 // ------------------------------------------------------------------
 // CreateFunctionExpression
 // ------------------------------------------------------------------
-function CreateFunctionExpression(stack, context, schema, hash) {
+function CreateFunctionExpression(stack, context, schema, name) {
     const expression = BuildSchema(stack, context, schema, 'value');
     return context.UseUnevaluated()
-        ? E.ConstDeclaration(`check_${hash}`, E.ArrowFunction(['context', 'value'], expression))
-        : E.ConstDeclaration(`check_${hash}`, E.ArrowFunction(['value'], expression));
+        ? E.ConstDeclaration(`check_${name}`, E.ArrowFunction(['context', 'value'], expression))
+        : E.ConstDeclaration(`check_${name}`, E.ArrowFunction(['value'], expression));
 }
 // ------------------------------------------------------------------
 // ResetFunctions
 // ------------------------------------------------------------------
 export function ResetFunctions() {
-    functions.clear();
+    index[0] = 0;
+    names.clear();
+    funcs.clear();
 }
 // ------------------------------------------------------------------
 // GetFunctions
 // ------------------------------------------------------------------
 export function GetFunctions() {
-    return [...functions.values()];
+    return [...funcs.values()];
 }
 // ------------------------------------------------------------------
 // CreateFunction
 // ------------------------------------------------------------------
 export function CreateFunction(stack, context, schema, value) {
-    const hash = Schema.IsSchemaObject(schema) ? Hashing.Hash({ __baseURL: stack.BaseURL().href, ...schema }) : Hashing.Hash(schema);
-    const call = CreateCallExpression(context, schema, hash, value);
-    if (functions.has(hash))
+    const name = CreateName(schema, stack.BaseURL().href);
+    const call = CreateCallExpression(context, schema, name, value);
+    if (funcs.has(name))
         return call;
-    functions.set(hash, '');
-    functions.set(hash, CreateFunctionExpression(stack, context, schema, hash));
+    funcs.set(name, '');
+    funcs.set(name, CreateFunctionExpression(stack, context, schema, name));
     return call;
 }

package/node_modules/typebox/build/type/action/readonly_object.d.mts

@@ -9,3 +9,8 @@ export declare function ReadonlyObjectDeferred<Type extends TSchema>(type: Type,
 export type TReadonlyObject<Type extends TSchema> = (TReadonlyObjectAction<Type>);
 /** This type is an alias for TypeScript's `Readonly<T>` utility type. It will make all properties of a TObject readonly or marks an TArray or TTuple as immutable `readonly T[]`. */
 export declare function ReadonlyObject<Type extends TSchema>(type: Type, options?: TSchemaOptions): TReadonlyObject<Type>;
+/**
+ * This type has been renamed to ReadonlyObject.
+ * @deprecated
+*/
+export declare const ReadonlyType: typeof ReadonlyObject;

package/node_modules/typebox/build/type/action/readonly_object.mjs

@@ -9,3 +9,11 @@ export function ReadonlyObjectDeferred(type, options = {}) {
 export function ReadonlyObject(type, options = {}) {
     return ReadonlyObjectAction(type, options);
 }
+// ------------------------------------------------------------------
+// Alias
+// ------------------------------------------------------------------
+/**
+ * This type has been renamed to ReadonlyObject.
+ * @deprecated
+*/
+export const ReadonlyType = ReadonlyObject;

package/node_modules/typebox/build/typebox.d.mts

@@ -19,7 +19,7 @@ export { Omit, type TOmit, type TOmitDeferred } from './type/action/omit.mjs';
 export { Parameters, type TParameters, type TParametersDeferred } from './type/action/parameters.mjs';
 export { Partial, type TPartial, type TPartialDeferred } from './type/action/partial.mjs';
 export { Pick, type TPick, type TPickDeferred } from './type/action/pick.mjs';
-export { ReadonlyObject, type TReadonlyObject, type TReadonlyObjectDeferred } from './type/action/readonly_object.mjs';
+export { ReadonlyObject, ReadonlyType, type TReadonlyObject, type TReadonlyObjectDeferred } from './type/action/readonly_object.mjs';
 export { Required, type TRequired, type TRequiredDeferred } from './type/action/required.mjs';
 export { ReturnType, type TReturnType, type TReturnTypeDeferred } from './type/action/return_type.mjs';
 export { type TUncapitalize, type TUncapitalizeDeferred, Uncapitalize } from './type/action/uncapitalize.mjs';

package/node_modules/typebox/build/typebox.mjs

@@ -31,7 +31,7 @@ export { Omit } from './type/action/omit.mjs';
 export { Parameters } from './type/action/parameters.mjs';
 export { Partial } from './type/action/partial.mjs';
 export { Pick } from './type/action/pick.mjs';
-export { ReadonlyObject } from './type/action/readonly_object.mjs';
+export { ReadonlyObject, ReadonlyType } from './type/action/readonly_object.mjs';
 export { Required } from './type/action/required.mjs';
 export { ReturnType } from './type/action/return_type.mjs';
 export { Uncapitalize } from './type/action/uncapitalize.mjs';

package/node_modules/typebox/package.json

@@ -1,7 +1,7 @@
 {
   "name": "typebox",
   "description": "Json Schema Type Builder with Static Type Resolution for TypeScript",
-  "version": "1.3.3",
+  "version": "1.3.6",
   "keywords": [
     "typescript",
     "jsonschema"

package/node_modules/typebox/readme.md

@@ -111,27 +111,24 @@ type User = Type.Static<typeof User>              // type User = {
 
 ## Script
 
-[Documentation](https://sinclairzx81.github.io/typebox/#/docs/script/overview) | [Example 1](https://www.typescriptlang.org/play/?target=99&module=7#code/JYWwDg9gTgLgBAFQJ5gKZwGZQiOByGFVAIwgA88AoSgehrgFonmXW32POv3b7k0AdAGUAxlGBgYACjwC5eAJS9G3VWvXdqdOADkAhiFQBnMHpGpKIiADsj8ALJ6YACzgBeREWFiJ0gAaUcHCEaHAAaqgiMNAATO5wAN5wZABccNYAriDEqFAANHBIaZnZuXAAvoHBROGR0VAAzPEAogBuegA2GU6oADwRUbFwAGSJcABexVk5UBUAfFUh6AP1ACwt7V09-XXQTaNJAO5TpbPlC35KygAiqGjWACao1vD6hiZmFla28En2xq5yvF+KhvOJJFIknIBI4XBUCn4gosahFYKgyPEElUgpAjMAYMAbGkVtBVnlseloCBOsTdo1yUEghlWrTBlAYlVKkElnAAOKoHCoGBQJCYimtXIE8xGWlosgAbQAugzGcBHsBpScZkrOcjQrDcsBOmLGXADMRgM8YKy1iqgg9gBgMBkjKgbaS7XATJEMh09FB3VBVrruTV-kZXB4saaAOYCwzCop8+NCkWe6kwQ00uAG8SdXWXLT0ABKGReoHQxdQGA6dUJ1ko4ecAjA2DQsEtRgEccFiZbbclnYEEo70oE+NQIC7rYg7YJxhbEDxBJs-dng4XZEbALXc6HPYTIt3G67I6lC4nU+PHYX1ipnWv867W6bj-3Kb7M73C7PGovmavL8TwEZk303bcIzArsMyzDooIEB0nRdUEgJvZ8IObVCnwEGC8zgrCh3NS0Xngl8dwIhdcKNfCBzQgRvREX1-VIos4CEGAnA1OAAElrAwXJnnMShnWsKJ6zgKBnieKApHeZw0hBYQOKlXolggDAcwBOYFESKo5O7D8j1-aV5QABkVRdl3rAQtyCfSD1TJBh0HEzzIEO8oGpODbLgezDKc4zjDMizQJ8-SqIfRDnVdGy9J3CK4KIq1Yrs+Kejw+i0EYv0oFi8ogA) | [Example 2](https://www.typescriptlang.org/play/?target=99&module=7#code/JYWwDg9gTgLgBAFQJ5gKZwGZQiOByGFVAIwgA88AoSgehrgFonmXW32POv3b7k0AdACpejbuImTu1OnAByAQxCoAzmAUBjVJQB2S1eq1wAsgpgALOAG9KcOKjKRYcDRB0r4ANVQaY0AExwALyIRAIA8sQAVj4wABRWcGQAXKGCcgCuIMSoUHEAlAA0cEip-KgCmdm5BXAAvvm29o7Q8K7uXrHQAMzBaRUAogBuCgA2GWaoceUCAJI6MLkqsXEA2t6+AcUzkTG+CXAAXmVhVTl5+fX5ALr5jXYOTm1uHnAbflAALH0zw2MTi2mYXmiygy326y6UG62zCuxWiQA7id0llzrUGrdGnUZPQACKoNA6AAmqAW8n0ak02nar28sAcPzh0QRTUgKmAMGAblSpgsAne0E+hSaOmgIDGvLM5gFUJhTQyQyl-MFUH8lAalFp8AA4qgcKgYFAkEzBPD9jY7ENclytCoURUAIJQKAKJBxemLMhFJrAEnAO0OgTO13umZnGp3DWNbUmSZQYBjU0Vc3xS1wJTEYBkmDKmWq4VNYnADAYDLLPOyzZfEV2NQ+DKjBRQSsF6Nal7wYyqSwhHYsi1NADm+uURtKcD1BvHtbgEtBidGytyi-bogAShkFqB0OvUBhRrFuTpKN2VDKwNg0LBsyoBCPp8aBJeINeuaoBNab3aBJzUCA7xfN9b2fCAOS5NxnyvG0QLIU8eyg18YI-B8xyfIDkLvL9bQ-P8AMQ4CPzFKAJVGAjMIEOCzwvaCbxQ0dDXQ2j3ywmCfzwwDmJAxVyLou8qIQjC+IEecVzGXiWIEYtS3LCohMkgTzwkkDRITcT5JAzNswWZSP0UmikOE1TF10u96w0Rtm1MyjcTgABlGAzADOB5gwXIyS0Sgyx0XxjzgKAyVJPJlHPIMHKcjQAB5CDQCAMBMHsAD5LnTEKZVQxikE-NjVFWAAGa5QPA48bLsNL7wY8dsu-XKCoEYjSNKucEIyqrsIDWrCp4uCyoQ4zxOkstlia8r+rIrScxGvr4xM8zLKgGy6iAA) | [Challenge](test/typescript/readme.md)
-
-TypeBox includes a syntax engine that can transform TypeScript declarations into JSON Schema. The engine is a full syntactic frontend to Type.* and supports many advanced type-level constructs such as Conditional, Mapped, Indexed, Infer, Generics, Distributed types and more. This feature is implemented symmetrically at runtime and statically via TypeScript Template Literal types. 
-
-Syntax highlighting is available via the [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=sinclairzx81.typebox-script)
+[Documentation](https://sinclairzx81.github.io/typebox/#/docs/script/overview) | [Example 1](https://www.typescriptlang.org/play/?target=99&module=7#code/JYWwDg9gTgLgBAFQJ5gKZwGZQiOByGFVAIwgA88AoSgehrgFkIATAVwBtVKBjCAOwDO8BgEMYACzgBeREQB0AZW5RgYGAAoABpThxCaOADVU3GNABM0uAG84ZAFxw+rEMVRQANHCSPnr93AAvjp6REYmZlAAzFa2Dk4ubp7evonuXgBeqf5QQSH66Mam0AAssXbZSV4+CTmZlelwAO4NucGaAJTUdHAAIqhofMyofMIsHFy8gvC2DKgCkoFWyGiKyqoaohJemrr5YcawqGSxIbqQAsAwwPyORZElHmdO0CAi7HcR0FFPurqsADdPsUoOYQsFdAU4ABxVA4VAwKBIU5-OAA9zXbjzT5HMgAbQAur8-sAhsAsQJWoTwfsDFt3MB3ii-iJXMARjBgQ9ibpmMAMBhWAJUFzSjy4AI0NwOCIoKKoCUaZCwnMFszdABzOEgBFIxyw+GIpDit4wBnvRz0lTvGmdbr0ABKrFGoHQDtQGE4phufEoqvEcjA2DQsHZAjkWsNSMDwYxYbk6NDFLkV1QIHDQYgIeu80DEEu134MazcdzZD98wDmez8cjOqNxZrucTmNzqfTjdL4b4r3endDZYrC37OfDdd1SBH8Zb5LbZo71a7ckBU8H-tX4dN5vYG7kfIFQtQu-L68XA83Ym3u9ZxHZo2PQ6rsfPci31p3Z9HcklJhlUAftD0AoMBiOScAAJJ8Bg7gjFilCCnw3r8HAUAjMMUDqDqCyOCsR7AaB3AADwFBAGCMJWAB8HQ2CEWEBuODYzhSeIAAwEnmBY+nI5a6HREbahOCZxsxbFyD2UBvDuPFwHxDHRkx8ysexK7SXxb6Mju+6CsK3G0ZWr6Xu+cg3neMC6bx+nqX2P7Suwsq6YEQA) | [Example 2](https://www.typescriptlang.org/play/?target=99&module=7#code/JYWwDg9gTgLgBAFQJ5gKZwGZQiOByGFVAIwgA88AoSgehrgFkIATAVwBtVKA7AQxFQBnMLwDG6BrxgALOAG9KcOKjKRYcURG6D4ANVSiY0AExwAvIiIA6APLEAVgZgAKOXDIAuS2isA5ViDEqFDOAJQANHBIXsg+-oHBYXAAvqGKyqrQ8Jraek7QAMzm3qi2Dk6u7jHW8UEhEVHVcQF1YZEAXk2ltYmhKWlKKmrZWjpw+obQACzFsaV2joaVniV+Lb2R0as99R1dawm7cADu+ztJqZTJ1HRwACKoaNzMqNzwTGyclDlj+rAqs2sCwqCiUkEEwBgwC0XkkMisEyMUCm4XS3GgIF47FhUmkCPyUAKqKUrAAbjj4YiTFc0j94ABxVA4VAwKBIQE+YFLUFwUnBKHiQT7ACCUCgvCQzj+MBUEXSwGewEFIrFEuccwOrVCaUudMYUmCwCxHPm5W56X4xGArxgFLxVORxLgzGAGAwrEEqDt+MmjvSwgMHF4UG9DqmNO+o3eQlkFg1XJcPIA5kyBKytozmemnZiZVAjdj9XmCxHaPQAEqsN6gdDl1AYTiGaHcSgMGNWMDYNCwa2CKwprNsjtd-m9qx8nuCqyQ1AgPudiDdqFCDsQCFQrTDxejldkVvthdLscDtNDw87vsTgUrmdzrdHlfoqCY9j3i9WPdtwR4889lcnlkzxHP9L1HKdb3nYDlz7Mk3xAj992-ODoKsXNDSxZCxxdN0PVKX8UM-A8oLHND8ww-Cx0ta03kw3dEJ-YiV1IgtaL7ANRCDKBWIQss4AAZRgKQlTgABJbgMGCV5xEod1uCbLQ4CgV4XhCARv32AShNEAAeQg0AgDBGBjAA+PoeTUvEAPTccwKEABtAAGABdVd12bBClAs-tU0ApAbMneznKsJ8Xw8uAvKsocryVQKXNgvdPPbZiMOw91PTCrzktfKibQypKDTI192M4hDkiAA) | [Challenge](test/typescript/readme.md)
 
+TypeBox includes a runtime scripting engine that can transform TypeScript definitions into JSON Schema. The engine is implemented symmetrically at runtime and inside TypeScript's type system. It supports many programmable type-level constructs such as Conditional, Mapped, Indexed, Generic, Distributive Conditional, and more. The engine is designed for TypeScript 7 but is supported in TypeScript 5 and above.
 
 ### Example
 
-The following uses Script to parse TypeScript declarations into JSON Schema. 
+Syntax highlighting is available via the [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=sinclairzx81.typebox-script)
 
 ```typescript
 // Module
 const Math = Type.Script(`
   type Vector2 = { x: number, y: number }
-  type Vector3 = Evaluate<Vector2 & { z: number }>
-  type Vector4 = Evaluate<Vector3 & { w: number }>
+  type Vector3 = { x: number, y: number, z: number }
+  type Vector4 = { x: number, y: number, z: number, w: number }
 `)
 
 // Dependent Module
-const { Mesh } = Type.Script({ ...Math }, `  
+const { Mesh } = Type.Script(Math, `  
   type Vertex = {
     position: Vector4,
     normal: Vector3,
@@ -298,29 +295,29 @@ The following table shows compile performance for various JSON Schema structures
 ┌──────────────────────┬─────────────┬─────────────┐
 │ Compile              │ TB1X        │ AJV8        │
 ├──────────────────────┼─────────────┼─────────────┤
-│ Boolean              │ 29.2K ops/s │  7.1K ops/s │
-│ Number               │ 34.5K ops/s │  7.6K ops/s │
-│ String               │ 48.9K ops/s │  8.7K ops/s │
-│ Null                 │ 39.6K ops/s │  7.6K ops/s │
-│ Literal_String       │ 46.8K ops/s │  6.8K ops/s │
-│ Literal_Number       │ 48.3K ops/s │  7.4K ops/s │
-│ Literal_Boolean      │ 48.8K ops/s │  7.3K ops/s │
-│ Pattern              │ 32.5K ops/s │  6.1K ops/s │
-│ Object_Open          │  6.6K ops/s │  1.4K ops/s │
-│ Object_Close         │  7.6K ops/s │    1K ops/s │
-│ Object_Vector3       │ 20.8K ops/s │  2.8K ops/s │
-│ Object_Basis3        │  7.5K ops/s │    1K ops/s │
-│ Intersect_And        │   23K ops/s │  3.9K ops/s │
-│ Intersect_Structural │  8.7K ops/s │  1.2K ops/s │
-│ Union_Or             │ 17.9K ops/s │  3.4K ops/s │
-│ Union_Structural     │ 11.3K ops/s │  2.1K ops/s │
-│ Tuple_Values         │  9.6K ops/s │  2.1K ops/s │
-│ Tuple_Objects        │  2.1K ops/s │   350 ops/s │
-│ Array_Numbers_4      │ 33.6K ops/s │  4.2K ops/s │
-│ Array_Numbers_8      │   39K ops/s │  3.7K ops/s │
-│ Array_Numbers_16     │ 29.6K ops/s │  3.8K ops/s │
-│ Array_Objects_Open   │  7.7K ops/s │   833 ops/s │
-│ Array_Objects_Close  │  7.6K ops/s │   860 ops/s │
+│ Boolean              │ 39.7K ops/s │  6.8K ops/s │
+│ Number               │ 86.2K ops/s │  7.5K ops/s │
+│ String               │ 82.6K ops/s │  8.2K ops/s │
+│ Null                 │   62K ops/s │  7.3K ops/s │
+│ Literal_String       │ 72.1K ops/s │  5.7K ops/s │
+│ Literal_Number       │ 72.7K ops/s │  6.9K ops/s │
+│ Literal_Boolean      │ 80.9K ops/s │    7K ops/s │
+│ Pattern              │ 38.7K ops/s │  5.7K ops/s │
+│ Object_Open          │ 16.3K ops/s │  1.3K ops/s │
+│ Object_Close         │ 15.7K ops/s │   952 ops/s │
+│ Object_Vector3       │ 40.2K ops/s │  3.2K ops/s │
+│ Object_Basis3        │ 16.1K ops/s │   834 ops/s │
+│ Intersect_And        │ 45.7K ops/s │  3.5K ops/s │
+│ Intersect_Structural │   21K ops/s │  1.6K ops/s │
+│ Union_Or             │ 45.1K ops/s │  3.4K ops/s │
+│ Union_Structural     │ 27.6K ops/s │    2K ops/s │
+│ Tuple_Values         │ 14.7K ops/s │    2K ops/s │
+│ Tuple_Objects        │  3.7K ops/s │   380 ops/s │
+│ Array_Numbers_4      │ 73.6K ops/s │  4.3K ops/s │
+│ Array_Numbers_8      │ 50.9K ops/s │  3.8K ops/s │
+│ Array_Numbers_16     │   85K ops/s │  3.9K ops/s │
+│ Array_Objects_Open   │ 18.9K ops/s │   789 ops/s │
+│ Array_Objects_Close  │ 17.9K ops/s │   909 ops/s │
 └──────────────────────┴─────────────┴─────────────┘
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/lobster",
-  "version": "2026.7.2-beta.3",
+  "version": "2026.7.2-beta.5",
   "description": "Lobster workflow tool plugin for typed pipelines and resumable approvals.",
   "repository": {
     "type": "git",
@@ -9,7 +9,7 @@
   "type": "module",
   "dependencies": {
     "@clawdbot/lobster": "2026.6.11",
-    "typebox": "1.3.3"
+    "typebox": "1.3.6"
   },
   "openclaw": {
     "extensions": [
@@ -21,10 +21,10 @@
       "minHostVersion": ">=2026.4.25"
     },
     "compat": {
-      "pluginApi": ">=2026.7.2-beta.3"
+      "pluginApi": ">=2026.7.2-beta.5"
     },
     "build": {
-      "openclawVersion": "2026.7.2-beta.3"
+      "openclawVersion": "2026.7.2-beta.5"
     },
     "release": {
       "publishToClawHub": true,
@@ -37,12 +37,11 @@
   "files": [
     "dist/**",
     "openclaw.plugin.json",
-    "npm-shrinkwrap.json",
     "README.md",
     "SKILL.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.2-beta.3"
+    "openclaw": ">=2026.7.2-beta.5"
   },
   "peerDependenciesMeta": {
     "openclaw": {

package/npm-shrinkwrap.json

@@ -1,108 +0,0 @@
-{
-  "name": "@openclaw/lobster",
-  "version": "2026.7.2-beta.3",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@openclaw/lobster",
-      "version": "2026.7.2-beta.3",
-      "dependencies": {
-        "@clawdbot/lobster": "2026.6.11",
-        "typebox": "1.3.3"
-      }
-    },
-    "node_modules/@clawdbot/lobster": {
-      "version": "2026.6.11",
-      "resolved": "https://registry.npmjs.org/@clawdbot/lobster/-/lobster-2026.6.11.tgz",
-      "integrity": "sha512-zeNyXvDqYajDHxFlMy7wn6TfBUsMOIJgiw0lDn+ltGiQUH/F3w+8SWHCOyMNmzoZfXSQw9uJK44SVCzEkxXsUw==",
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.20.0",
-        "yaml": "^2.9.0"
-      },
-      "bin": {
-        "clawd.invoke": "bin/clawd.invoke.js",
-        "lobster": "bin/lobster.js",
-        "openclaw.invoke": "bin/openclaw.invoke.js"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
-    "node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "license": "MIT"
-    },
-    "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "license": "MIT"
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/typebox": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.3.3.tgz",
-      "integrity": "sha512-URXGUE31PJDQC+PtRMJeLdF4kmmOdFoVPikPCtV2oOIhUpNpppEdIz7W8bH8cFYPYHdDpaRvqwdegMTmHliudg==",
-      "license": "MIT"
-    },
-    "node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
-      "license": "ISC",
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
-    }
-  }
-}