@openclaw/nostr 2026.9.5 → 2026.9.7

package/dist/.setup/{config-schema-CkYd8ACn.mjs → config-schema-B3uU2qBS.mjs}

@@ -1,5 +1,3 @@
-import { collectStatusIssuesFromLastError, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
-import { DEFAULT_ACCOUNT_ID, buildChannelConfigSchema, formatPairingApproveHint } from "openclaw/plugin-sdk/channel-plugin-common";
 import { AllowFromListSchema, DmPolicySchema, MarkdownConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
 import { buildSecretInputSchema } from "openclaw/plugin-sdk/secret-input";
 import { z } from "zod";
@@ -61,4 +59,4 @@ const NostrConfigSchema = z.object({
 	profile: NostrProfileSchema.optional()
 });
 //#endregion
-export { collectStatusIssuesFromLastError as a, buildChannelConfigSchema as i, NostrProfileSchema as n, createDefaultChannelRuntimeState as o, DEFAULT_ACCOUNT_ID as r, formatPairingApproveHint as s, NostrConfigSchema as t };
+export { NostrProfileSchema as n, NostrConfigSchema as t };

package/dist/.setup/setup-plugin-api-BhRAS2I1.mjs

@@ -0,0 +1,2 @@
+import { t as nostrSetupPlugin } from "./setup-plugin-api-Ci0XxWqb.mjs";
+export { nostrSetupPlugin };

package/dist/.setup/{setup-plugin-api-B7qtJE84.mjs → setup-plugin-api-Ci0XxWqb.mjs}

@@ -1,6 +1,7 @@
-import { i as buildChannelConfigSchema, t as NostrConfigSchema } from "./config-schema-CkYd8ACn.mjs";
+import { t as NostrConfigSchema } from "./config-schema-B3uU2qBS.mjs";
 import { i as createNostrSetupStatus, l as DEFAULT_RELAYS, n as createNostrSetupAdapter, o as hasConfiguredNostrPrivateKey, r as createNostrSetupContract, s as resolveNostrPrivateKey } from "./setup-adapter-KJ_iGKiG.mjs";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
+import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-plugin-common";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { createDelegatedSetupWizardProxy } from "openclaw/plugin-sdk/setup-runtime";
 //#region extensions/nostr/src/channel.setup.ts

package/dist/api.js

@@ -1,11 +1,12 @@
 import { s as resolveNostrAccount } from "./.setup/setup-surface-Dx8QxWSP.mjs";
 import { getPluginRuntimeGatewayRequestScope } from "./runtime-api.js";
-import { n as NostrProfileSchema } from "./.setup/config-schema-CkYd8ACn.mjs";
-import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./.setup/channel-ByGdjtr3.mjs";
+import { n as NostrProfileSchema } from "./.setup/config-schema-B3uU2qBS.mjs";
+import { a as getNostrRuntime, i as contentToProfile, n as nostrPlugin, o as setNostrRuntime, r as publishNostrProfile, t as getNostrProfileState } from "./.setup/channel-D2d-FP8G.mjs";
+import { getPluginRuntimeGatewayRequestScope as getPluginRuntimeGatewayRequestScope$1 } from "openclaw/plugin-sdk/plugin-runtime";
 import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, readStringValue } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { z } from "zod";
 import { SimplePool } from "nostr-tools";
-import { createFixedWindowRateLimiter as createFixedWindowRateLimiter$1 } from "openclaw/plugin-sdk/webhook-ingress";
+import { createFixedWindowRateLimiter } from "openclaw/plugin-sdk/webhook-ingress";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { isBlockedHostnameOrIp, isLoopbackHost } from "openclaw/plugin-sdk/ssrf-runtime";
 import { readJsonBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-request-guards";
@@ -50,17 +51,7 @@ function validateUrlSafety(urlStr) {
 }
 //#endregion
 //#region extensions/nostr/src/nostr-profile-import.ts
-/**
-* Nostr Profile Import
-*
-* Fetches and verifies kind:0 profile events from relays.
-* Used to import existing profiles before editing.
-*/
 const DEFAULT_TIMEOUT_MS = 5e3;
-/**
-* Sanitize URLs in an imported profile to prevent SSRF attacks.
-* Removes any URLs that don't pass SSRF validation.
-*/
 function sanitizeProfileUrls(profile) {
 	const result = { ...profile };
 	for (const field of [
@@ -75,14 +66,7 @@ function sanitizeProfileUrls(profile) {
 	}
 	return result;
 }
-/**
-* Fetch the latest kind:0 profile event for a pubkey from relays.
-*
-* - Queries all relays in parallel
-* - Takes the event with the highest created_at
-* - Verifies the event signature
-* - Parses and returns the profile
-*/
+/** Import the latest verified kind:0 profile across the configured relays. */
 async function importProfileFromRelays(opts) {
 	const { pubkey, relays } = opts;
 	const timeoutMs = resolveTimerTimeoutMs(opts.timeoutMs, DEFAULT_TIMEOUT_MS);
@@ -179,13 +163,7 @@ async function importProfileFromRelays(opts) {
 		pool.close(relays);
 	}
 }
-/**
-* Merge imported profile with local profile.
-*
-* Strategy:
-* - For each field, prefer local if set, otherwise use imported
-* - This preserves user customizations while filling in missing data
-*/
+/** Preserve local customizations while filling missing fields from the imported profile. */
 function mergeProfiles(local, imported) {
 	if (!imported) return local ?? {};
 	if (!local) return imported;
@@ -202,18 +180,12 @@ function mergeProfiles(local, imported) {
 }
 //#endregion
 //#region extensions/nostr/src/nostr-profile-http.ts
-const profileRateLimiter = createFixedWindowRateLimiter$1({
+const profileRateLimiter = createFixedWindowRateLimiter({
 	windowMs: 6e4,
 	maxRequests: 5,
 	maxTrackedKeys: 2048
 });
-function checkRateLimit(accountId) {
-	return !profileRateLimiter.isRateLimited(accountId);
-}
 const publishLocks = new KeyedAsyncQueue();
-async function withPublishLock(accountId, fn) {
-	return await publishLocks.enqueue(accountId, fn);
-}
 const nip05FormatSchema = z.string().regex(/^[a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,}$/i, "Invalid NIP-05 format (user@domain.com)").optional();
 const lud16FormatSchema = z.string().regex(/^[a-z0-9._-]+@[a-z0-9.-]+\.[a-z]{2,}$/i, "Invalid Lightning address format").optional();
 const ProfileUpdateSchema = NostrProfileSchema.extend({
@@ -228,14 +200,13 @@ const PROFILE_URL_FIELDS = [
 ];
 function normalizeProfileUpdateUrlInputs(value) {
 	if (!isRecord(value)) return value;
-	const record = value;
 	let normalized;
 	for (const field of PROFILE_URL_FIELDS) {
-		const input = record[field];
+		const input = value[field];
 		if (typeof input !== "string") continue;
 		const next = normalizeNostrProfileUrlForRuntime(input);
 		if (next !== input) {
-			normalized ??= { ...record };
+			normalized ??= { ...value };
 			normalized[field] = next;
 		}
 	}
@@ -243,12 +214,11 @@ function normalizeProfileUpdateUrlInputs(value) {
 }
 function restoreProfileUpdateUrlInputs(profile, value) {
 	if (!isRecord(value)) return profile;
-	const record = value;
 	return {
 		...profile,
-		...typeof record.picture === "string" ? { picture: record.picture } : {},
-		...typeof record.banner === "string" ? { banner: record.banner } : {},
-		...typeof record.website === "string" ? { website: record.website } : {}
+		...typeof value.picture === "string" ? { picture: value.picture } : {},
+		...typeof value.banner === "string" ? { banner: value.banner } : {},
+		...typeof value.website === "string" ? { website: value.website } : {}
 	};
 }
 function sendJson(res, status, body) {
@@ -264,8 +234,7 @@ async function readJsonBody(req, maxBytes = 65536, timeoutMs = 3e4) {
 	});
 	if (result.ok) return result.value;
 	if (result.code === "PAYLOAD_TOO_LARGE") throw new Error("Request body too large");
-	if (result.code === "REQUEST_BODY_TIMEOUT") throw new Error(requestBodyErrorToText("REQUEST_BODY_TIMEOUT"));
-	if (result.code === "CONNECTION_CLOSED") throw new Error(requestBodyErrorToText("CONNECTION_CLOSED"));
+	if (result.code === "REQUEST_BODY_TIMEOUT" || result.code === "CONNECTION_CLOSED") throw new Error(requestBodyErrorToText(result.code));
 	throw new Error(result.code === "INVALID_JSON" ? "Invalid JSON" : result.error);
 }
 function parseAccountIdFromPath(pathname) {
@@ -361,7 +330,7 @@ function enforceLoopbackMutationGuards(ctx, req, res) {
 	return true;
 }
 function enforceGatewayMutationScope(ctx, accountId, res) {
-	const runtimeScopes = getPluginRuntimeGatewayRequestScope()?.client?.connect?.scopes;
+	const runtimeScopes = getPluginRuntimeGatewayRequestScope$1()?.client?.connect?.scopes;
 	if ((Array.isArray(runtimeScopes) ? runtimeScopes : []).includes(PROFILE_MUTATION_SCOPE)) return true;
 	ctx.log?.warn?.(`[${accountId}] Rejected profile mutation missing ${PROFILE_MUTATION_SCOPE}`);
 	sendJson(res, 403, {
@@ -380,8 +349,10 @@ function createNostrProfileHttpHandler(ctx) {
 		if (!(url.pathname.endsWith("/profile") || isImport)) return false;
 		try {
 			if (req.method === "GET" && !isImport) return await handleGetProfile(accountId, ctx, res);
-			if (req.method === "PUT" && !isImport) return await handleUpdateProfile(accountId, ctx, req, res);
-			if (req.method === "POST" && isImport) return await handleImportProfile(accountId, ctx, req, res);
+			if (req.method === "PUT" && !isImport || req.method === "POST" && isImport) {
+				if (!enforceGatewayMutationScope(ctx, accountId, res) || !enforceLoopbackMutationGuards(ctx, req, res)) return true;
+				return await (isImport ? handleImportProfile : handleUpdateProfile)(accountId, ctx, req, res);
+			}
 			sendJson(res, 405, {
 				ok: false,
 				error: "Method not allowed"
@@ -409,9 +380,7 @@ async function handleGetProfile(accountId, ctx, res) {
 	return true;
 }
 async function handleUpdateProfile(accountId, ctx, req, res) {
-	if (!enforceGatewayMutationScope(ctx, accountId, res)) return true;
-	if (!enforceLoopbackMutationGuards(ctx, req, res)) return true;
-	if (!checkRateLimit(accountId)) {
+	if (profileRateLimiter.isRateLimited(accountId)) {
 		sendJson(res, 429, {
 			ok: false,
 			error: "Rate limit exceeded (5 requests/minute)"
@@ -438,32 +407,14 @@ async function handleUpdateProfile(accountId, ctx, req, res) {
 		return true;
 	}
 	const profile = restoreProfileUpdateUrlInputs(parseResult.data, body);
-	if (profile.picture) {
-		const pictureCheck = validateUrlSafety(profile.picture);
-		if (!pictureCheck.ok) {
-			sendJson(res, 400, {
-				ok: false,
-				error: `picture: ${pictureCheck.error}`
-			});
-			return true;
-		}
-	}
-	if (profile.banner) {
-		const bannerCheck = validateUrlSafety(profile.banner);
-		if (!bannerCheck.ok) {
-			sendJson(res, 400, {
-				ok: false,
-				error: `banner: ${bannerCheck.error}`
-			});
-			return true;
-		}
-	}
-	if (profile.website) {
-		const websiteCheck = validateUrlSafety(profile.website);
-		if (!websiteCheck.ok) {
+	for (const field of PROFILE_URL_FIELDS) {
+		const url = profile[field];
+		if (!url) continue;
+		const check = validateUrlSafety(url);
+		if (!check.ok) {
 			sendJson(res, 400, {
 				ok: false,
-				error: `website: ${websiteCheck.error}`
+				error: `${field}: ${check.error}`
 			});
 			return true;
 		}
@@ -473,12 +424,12 @@ async function handleUpdateProfile(accountId, ctx, req, res) {
 		...profile
 	};
 	try {
-		const result = await withPublishLock(accountId, async () => {
-			await getPluginRuntimeGatewayRequestScope()?.revalidate?.();
+		const result = await publishLocks.enqueue(accountId, async () => {
+			await getPluginRuntimeGatewayRequestScope$1()?.revalidate?.();
 			return await publishNostrProfile(accountId, mergedProfile);
 		});
 		if (result.successes.length > 0) {
-			await getPluginRuntimeGatewayRequestScope()?.revalidate?.();
+			await getPluginRuntimeGatewayRequestScope$1()?.revalidate?.();
 			await ctx.updateConfigProfile(accountId, mergedProfile);
 			ctx.log?.info(`[${accountId}] Profile published to ${result.successes.length} relay(s)`);
 		} else ctx.log?.warn(`[${accountId}] Profile publish failed on all relays`);
@@ -501,8 +452,6 @@ async function handleUpdateProfile(accountId, ctx, req, res) {
 	return true;
 }
 async function handleImportProfile(accountId, ctx, req, res) {
-	if (!enforceGatewayMutationScope(ctx, accountId, res)) return true;
-	if (!enforceLoopbackMutationGuards(ctx, req, res)) return true;
 	const accountInfo = ctx.getAccountInfo(accountId);
 	if (!accountInfo) {
 		sendJson(res, 404, {
@@ -524,7 +473,7 @@ async function handleImportProfile(accountId, ctx, req, res) {
 		const body = await readJsonBody(req);
 		if (typeof body === "object" && body !== null) autoMerge = body.autoMerge === true;
 	} catch {}
-	await getPluginRuntimeGatewayRequestScope()?.revalidate?.();
+	await getPluginRuntimeGatewayRequestScope$1()?.revalidate?.();
 	ctx.log?.info(`[${accountId}] Importing profile for ${pubkey.slice(0, 8)}...`);
 	const result = await importProfileFromRelays({
 		pubkey,
@@ -539,26 +488,18 @@ async function handleImportProfile(accountId, ctx, req, res) {
 		});
 		return true;
 	}
+	let merged;
 	if (autoMerge && result.profile) {
-		await getPluginRuntimeGatewayRequestScope()?.revalidate?.();
-		const merged = mergeProfiles(ctx.getConfigProfile(accountId), result.profile);
+		await getPluginRuntimeGatewayRequestScope$1()?.revalidate?.();
+		merged = mergeProfiles(ctx.getConfigProfile(accountId), result.profile);
 		await ctx.updateConfigProfile(accountId, merged);
 		ctx.log?.info(`[${accountId}] Profile imported and merged`);
-		sendJson(res, 200, {
-			ok: true,
-			imported: result.profile,
-			merged,
-			saved: true,
-			event: result.event,
-			sourceRelay: result.sourceRelay,
-			relaysQueried: result.relaysQueried
-		});
-		return true;
 	}
 	sendJson(res, 200, {
 		ok: true,
 		imported: result.profile,
-		saved: false,
+		...merged ? { merged } : {},
+		saved: merged !== void 0,
 		event: result.event,
 		sourceRelay: result.sourceRelay,
 		relaysQueried: result.relaysQueried

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { n as nostrPlugin } from "./.setup/channel-ByGdjtr3.mjs";
+import { n as nostrPlugin } from "./.setup/channel-D2d-FP8G.mjs";
 export { nostrPlugin };

package/dist/doctor-contract-api.js

@@ -1,143 +1,31 @@
-import { t as normalizeNostrStateAccountId } from "./.setup/state-account-id-CvBZ9s6P.mjs";
-import { asFiniteNumber } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { extractErrorCode } from "openclaw/plugin-sdk/error-runtime";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { archiveLegacyStateSource } from "openclaw/plugin-sdk/runtime-doctor-migrations";
 //#region extensions/nostr/doctor-contract-api.ts
-const BUS_STATE_NAMESPACE = "bus-state";
-const PROFILE_STATE_NAMESPACE = "profile-state";
-const MAX_NOSTR_STATE_ENTRIES = 256;
-function parseBusState(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	const parsed = value;
-	if (parsed.version !== 1 && parsed.version !== 2) return null;
-	return {
-		version: 2,
-		lastProcessedAt: asFiniteNumber(parsed.lastProcessedAt) ?? null,
-		gatewayStartedAt: asFiniteNumber(parsed.gatewayStartedAt) ?? null,
-		recentEventIds: parsed.version === 2 && Array.isArray(parsed.recentEventIds) ? parsed.recentEventIds.filter((entry) => typeof entry === "string") : []
-	};
-}
-function parseProfileState(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	const parsed = value;
-	if (parsed.version !== 1) return null;
-	const rawResults = parsed.lastPublishResults;
-	const lastPublishResults = {};
-	if (rawResults && typeof rawResults === "object" && !Array.isArray(rawResults)) {
-		for (const [relay, result] of Object.entries(rawResults)) if (result === "ok" || result === "failed" || result === "timeout") lastPublishResults[relay] = result;
-	}
-	return {
-		version: 1,
-		lastPublishedAt: asFiniteNumber(parsed.lastPublishedAt) ?? null,
-		lastPublishedEventId: typeof parsed.lastPublishedEventId === "string" ? parsed.lastPublishedEventId : null,
-		lastPublishResults: rawResults === null || Object.keys(lastPublishResults).length === 0 ? null : lastPublishResults
-	};
-}
-async function readJsonFile(filePath) {
-	return JSON.parse(await fs.readFile(filePath, "utf8"));
-}
-async function listLegacyFiles(params) {
-	const dir = path.join(params.stateDir, "nostr");
-	let entries;
-	try {
-		entries = await fs.readdir(dir, { withFileTypes: true });
-	} catch {
-		return [];
-	}
-	const suffix = ".json";
-	const files = [];
-	for (const entry of entries) {
-		if (!entry.isFile() || !entry.name.startsWith(params.prefix) || !entry.name.endsWith(suffix)) continue;
-		const rawAccountId = entry.name.slice(params.prefix.length, -5);
-		const accountId = normalizeNostrStateAccountId(rawAccountId);
-		const filePath = path.join(dir, entry.name);
+function retiredNostrStateMigration(namespace, label) {
+	const warning = `${label} JSON imports were retired. Upgrade to OpenClaw 2026.9.5 and run openclaw doctor --fix before upgrading to the latest version. Legacy files were left untouched.`;
+	const hasLegacyState = async (stateDir) => {
 		try {
-			const value = params.parse(await readJsonFile(filePath));
-			if (value) files.push({
-				accountId,
-				filePath,
-				value
-			});
-		} catch {}
-	}
-	return files;
-}
-async function ensureStoreCapacity(params) {
-	const existingKeys = new Set((await params.store.entries()).map((entry) => entry.key));
-	const missingKeys = new Set(params.files.map((file) => file.accountId).filter((key) => !existingKeys.has(key)));
-	if (missingKeys.size > params.maxEntries - existingKeys.size) {
-		params.warnings.push(`Skipped migrating ${params.label} because plugin state has room for ${params.maxEntries - existingKeys.size} of ${missingKeys.size} missing entries; left legacy sources in place`);
-		return null;
-	}
-	return existingKeys;
-}
-function createNostrStateMigration(options) {
+			return (await fs.readdir(path.join(stateDir, "nostr"))).some((name) => name.startsWith(`${namespace}-`) && name.endsWith(".json"));
+		} catch (error) {
+			if (extractErrorCode(error) === "ENOENT") return false;
+			throw error;
+		}
+	};
 	return {
-		id: `nostr-${options.namespace}-json-to-plugin-state`,
-		label: options.label,
-		async detectLegacyState(params) {
-			const files = await listLegacyFiles({
-				stateDir: params.stateDir,
-				prefix: `${options.namespace}-`,
-				parse: options.parse
-			});
-			if (files.length === 0) return null;
-			return { preview: [`- ${options.label}: ${files.length} ${files.length === 1 ? "account" : "accounts"} -> plugin state (${options.namespace})`] };
+		id: `nostr-${namespace}-json-to-plugin-state`,
+		label,
+		async detectLegacyState({ stateDir }) {
+			return await hasLegacyState(stateDir) ? { preview: [warning] } : null;
 		},
-		async migrateLegacyState(params) {
-			const changes = [];
-			const warnings = [];
-			const files = await listLegacyFiles({
-				stateDir: params.stateDir,
-				prefix: `${options.namespace}-`,
-				parse: options.parse
-			});
-			const store = params.context.openPluginStateKeyedStore({
-				namespace: options.namespace,
-				maxEntries: MAX_NOSTR_STATE_ENTRIES
-			});
-			const existingKeys = await ensureStoreCapacity({
-				files,
-				store,
-				maxEntries: MAX_NOSTR_STATE_ENTRIES,
-				label: options.label,
-				warnings
-			});
-			if (!existingKeys) return {
-				changes,
-				warnings
-			};
-			let imported = 0;
-			for (const file of files) {
-				if (!existingKeys.has(file.accountId)) {
-					await store.register(file.accountId, file.value);
-					existingKeys.add(file.accountId);
-					imported++;
-				}
-				await archiveLegacyStateSource({
-					filePath: file.filePath,
-					label: options.label,
-					changes,
-					warnings
-				});
-			}
-			if (imported > 0) changes.unshift(`Migrated ${imported} Nostr ${options.namespace} ${imported === 1 ? "entry" : "entries"} -> plugin state`);
+		async migrateLegacyState({ stateDir }) {
 			return {
-				changes,
-				warnings
+				changes: [],
+				warnings: await hasLegacyState(stateDir) ? [warning] : []
 			};
 		}
 	};
 }
-const stateMigrations = [createNostrStateMigration({
-	namespace: BUS_STATE_NAMESPACE,
-	label: "Nostr bus state",
-	parse: parseBusState
-}), createNostrStateMigration({
-	namespace: PROFILE_STATE_NAMESPACE,
-	label: "Nostr profile state",
-	parse: parseProfileState
-})];
+const stateMigrations = [retiredNostrStateMigration("bus-state", "Nostr bus state"), retiredNostrStateMigration("profile-state", "Nostr profile state")];
 //#endregion
 export { stateMigrations };

package/dist/setup-entry.js

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 var setup_entry_default = defineBundledChannelSetupEntry({
 	importMetaUrl: import.meta.url,
 	plugin: {
-		specifier: fileURLToPath(new URL(".setup/setup-plugin-api-B7i5rR6T.mjs", import.meta.url).href),
+		specifier: fileURLToPath(new URL(".setup/setup-plugin-api-BhRAS2I1.mjs", import.meta.url).href),
 		exportName: "nostrSetupPlugin"
 	},
 	secrets: {

package/dist/setup-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as nostrSetupPlugin } from "./.setup/setup-plugin-api-B7qtJE84.mjs";
+import { t as nostrSetupPlugin } from "./.setup/setup-plugin-api-Ci0XxWqb.mjs";
 export { nostrSetupPlugin };

package/node_modules/zod/README.md

@@ -155,13 +155,13 @@ try {
         expected: 'string',
         code: 'invalid_type',
         path: [ 'username' ],
-        message: 'Invalid input: expected string'
+        message: 'Invalid input: expected string, received number'
       },
       {
         expected: 'number',
         code: 'invalid_type',
         path: [ 'xp' ],
-        message: 'Invalid input: expected number'
+        message: 'Invalid input: expected number, received string'
       }
     ] */
   }

package/node_modules/zod/compile.cjs

@@ -75,3 +75,22 @@ core.globalConfig.postProcessor = (inst) => {
     shim.__originalRun = originalRun;
     inst._zod.run = shim;
 };
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/index.cjs

@@ -31,3 +31,22 @@ const z = __importStar(require("./v4/classic/external.cjs"));
 exports.z = z;
 exports.default = z;
 __exportStar(require("./v4/classic/external.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/locales/index.cjs

@@ -15,3 +15,22 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("../v4/locales/index.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/mini/index.cjs

@@ -30,3 +30,22 @@ exports.z = void 0;
 const z = __importStar(require("../v4/mini/external.cjs"));
 exports.z = z;
 __exportStar(require("../v4/mini/external.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.5.4",
+  "version": "4.6.5",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",
@@ -52,7 +52,8 @@
     },
     "conditions": {
       "@zod/source": "src"
-    }
+    },
+    "sealCjsExports": true
   },
   "exports": {
     "./package.json": "./package.json",
@@ -137,10 +138,10 @@
   },
   "scripts": {
     "clean": "git clean -xdf . -e node_modules",
-    "build": "zshy --project tsconfig.build.json",
-    "postbuild": "tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .",
-    "test:watch": "pnpm vitest",
-    "test": "pnpm vitest run",
-    "prepublishOnly": "tsx ../../scripts/check-versions.ts"
+    "build": "nub exec --node zshy --project tsconfig.build.json",
+    "postbuild": "nub ../../scripts/write-stub-package-jsons.ts && nub exec --node biome check --write .",
+    "test:watch": "nub exec --node vitest",
+    "test": "nub exec --node vitest run",
+    "prepublishOnly": "nub ../../scripts/check-versions.ts"
   }
 }

package/node_modules/zod/src/v3/helpers/errorUtil.ts

@@ -2,7 +2,7 @@ export namespace errorUtil {
   export type ErrMessage = string | { message?: string | undefined };
   export const errToObj = (message?: ErrMessage): { message?: string | undefined } =>
     typeof message === "string" ? { message } : message || {};
-  // biome-ignore lint:
+  // biome-ignore lint/suspicious/noShadowRestrictedNames: renaming churns 31 v3 call sites
   export const toString = (message?: ErrMessage): string | undefined =>
     typeof message === "string" ? message : message?.message;
 }

package/node_modules/zod/src/v4/classic/external.ts

@@ -26,8 +26,10 @@ export {
   TimePrecision,
   util,
   NEVER,
+  INVALID,
   toZod,
   compile,
+  withParser,
   ZodCompileAsyncError,
   ZodCompileUnsupportedError,
   getDiscriminatedOption,