@openclaw/openshell-sandbox 2026.9.3 → 2026.9.5

package/node_modules/zod/src/v4/core/memoizer.ts

@@ -0,0 +1,284 @@
+import type * as errors from "./errors.js";
+import type { $ZodMemoizer, $ZodType, $ZodTypeDef, ParseContextInternal, ParsePayload } from "./schemas.js";
+import type * as util from "./util.js";
+
+export class $ZodCyclicError extends Error {
+  constructor() {
+    super(`Cannot parse a reference cycle that closes through a transform`);
+    this.name = "ZodCyclicError";
+  }
+}
+
+interface Entry {
+  value: unknown;
+  /** `null` until the node's children are parsed. */
+  issues: errors.$ZodRawIssue[] | null;
+}
+
+interface State {
+  buckets: Map<$ZodType, Map<object, Entry>>;
+  /** Nodes a back-edge resolved to before they finished. */
+  backEdges: Set<object> | undefined;
+}
+
+/** Keyed off the context object every schema in one parse call already shares. */
+const STATE = "~memo";
+type WithState = { [STATE]?: State };
+
+const NO_ISSUES: errors.$ZodRawIssue[] = [];
+
+// Receivers prefix paths in place, so the cache and every hand-out need their own copies.
+function cloneIssues(issues: errors.$ZodRawIssue[]): errors.$ZodRawIssue[] {
+  return issues.map((iss) => (iss.path ? { ...iss, path: iss.path.slice() } : { ...iss }));
+}
+
+const recursive: WeakMap<object, boolean> = /*@__PURE__*/ new WeakMap();
+
+/** Whether this schema's subtree contains a cycle, so one parse can re-enter it. */
+function isRecursive(inst: $ZodType, stack: Set<object>): boolean {
+  const cached = recursive.get(inst);
+  if (cached !== undefined) return cached;
+  // Relative to the walk in progress, so not cached.
+  if (stack.has(inst)) return true;
+  stack.add(inst);
+
+  let result = false;
+  const check = (child: any) => {
+    if (!result && child?._zod && isRecursive(child, stack)) result = true;
+  };
+
+  const def = inst._zod.def as any;
+  const kind = def.type as $ZodTypeDef["type"];
+  switch (kind) {
+    case "object": {
+      // `Reflect.ownKeys` rather than `Object.keys`, so a cycle through a declared symbol key is still seen
+      for (const key of Reflect.ownKeys(def.shape)) check(def.shape[key]);
+      check(def.catchall);
+      break;
+    }
+    case "array":
+      check(def.element);
+      break;
+    case "tuple":
+      for (const el of def.items) check(el);
+      check(def.rest);
+      break;
+    case "record":
+    case "map":
+      check(def.keyType);
+      check(def.valueType);
+      break;
+    case "set":
+      check(def.valueType);
+      break;
+    case "union":
+      for (const el of def.options) check(el);
+      break;
+    case "intersection":
+      check(def.left);
+      check(def.right);
+      break;
+    case "optional":
+    case "nullable":
+    case "default":
+    case "prefault":
+    case "catch":
+    case "readonly":
+    case "nonoptional":
+    case "promise":
+    case "success":
+      check(def.innerType);
+      break;
+    case "pipe":
+      check(def.in);
+      check(def.out);
+      break;
+    case "function":
+      check(def.input);
+      check(def.output);
+      break;
+    // reading `_zod.innerType` resolves the getter once and caches it
+    case "lazy":
+      check((inst as any)._zod.innerType);
+      break;
+    // a leaf by choice: `parts` are regex fragments, not data positions
+    case "template_literal":
+    // leaves
+    case "string":
+    case "number":
+    case "int":
+    case "boolean":
+    case "bigint":
+    case "symbol":
+    case "undefined":
+    case "null":
+    case "void":
+    case "never":
+    case "any":
+    case "unknown":
+    case "date":
+    case "nan":
+    case "enum":
+    case "literal":
+    case "file":
+    case "transform":
+    case "custom":
+      break;
+    default: {
+      // a new built-in kind becomes a compile error here
+      kind satisfies never;
+      // a user-defined kind can still hold children, and only its author knows where, so fall back to scanning the def — skipping accessors, since reading one can run user code
+      for (const key in def) {
+        const desc = Object.getOwnPropertyDescriptor(def, key);
+        if (!desc || desc.get) continue;
+        const value = desc.value;
+        if (!value || typeof value !== "object") continue;
+        if (value._zod) check(value);
+        else if (Array.isArray(value)) for (const el of value) check(el);
+      }
+    }
+  }
+
+  stack.delete(inst);
+  recursive.set(inst, result);
+  return result;
+}
+
+/**
+ * Whether one parse can re-enter this schema, i.e. its subtree contains a cycle.
+ * Exported for `z.compile`, which refuses to compile such a schema: cycle
+ * breaking is driven from here off state keyed on the parse context, and a
+ * generated fast path has no context to key on.
+ */
+export function isRecursiveSchema(inst: $ZodType): boolean {
+  return isRecursive(inst, new Set());
+}
+
+function bucketFor(state: State, inst: $ZodType): Map<object, Entry> {
+  let bucket = state.buckets.get(inst);
+  if (!bucket) {
+    bucket = new Map();
+    state.buckets.set(inst, bucket);
+  }
+  return bucket;
+}
+
+// Set immediately before delegating to core and cleared immediately after, so `alloc` registers only for a visit this module is driving.
+let handoff: Map<object, Entry> | undefined;
+
+// Allocated but unfinished entries. `alloc` and the matching pop both happen in the synchronous part of a parse, so they nest even when children are async, and one stack serves every schema.
+const open: Entry[] = [];
+
+const memo: $ZodMemoizer = {
+  alloc(_inst, payload, empty) {
+    const bucket = handoff;
+    if (!bucket) return empty;
+    handoff = undefined;
+    const entry: Entry = { value: empty, issues: null };
+    bucket.set(payload.value as object, entry);
+    open.push(entry);
+    return empty;
+  },
+
+  guard(inst) {
+    inst._zod.deferred ??= [];
+    inst._zod.deferred.push(() => {
+      const base = inst._zod.parse;
+      const wrapped = (payload: ParsePayload, ctx: ParseContextInternal): util.MaybeAsync<ParsePayload> => {
+        // The value is a placeholder a back-edge is still waiting on, so the cycle closes through this transform. Its output can't exist in time to bind.
+        if (ctx.direction !== "backward" && isBackEdge(ctx, payload.value)) throw new $ZodCyclicError();
+        return base(payload, ctx);
+      };
+      inst._zod.parse = wrapped;
+      if (inst._zod.run === base) inst._zod.run = wrapped;
+    });
+  },
+
+  attach(inst) {
+    let isRecursiveInst: boolean | undefined;
+    // `bucket` memoized for one parse; a recursive schema is re-entered many times and its bucket never changes
+    let lastCtx: object | undefined;
+    let lastBucket: Map<object, Entry> | undefined;
+
+    // Wraps `parse` in a deferred so it sees the container's final parse. Core's own deferred copies `parse` into `run` when there are no checks, and it ran first, so `run` is patched to match; with checks, `run` reads `parse` dynamically.
+    inst._zod.deferred ??= [];
+    inst._zod.deferred.push(() => {
+      const base = inst._zod.parse;
+
+      const wrapped = (payload: ParsePayload, ctx: ParseContextInternal): util.MaybeAsync<ParsePayload> => {
+        if (isRecursiveInst === undefined) {
+          isRecursiveInst = isRecursive(inst, new Set());
+          if (!isRecursiveInst) {
+            // Nothing here can ever fire, so take it back out.
+            inst._zod.parse = base;
+            if (inst._zod.run === wrapped) inst._zod.run = base;
+            return base(payload, ctx);
+          }
+        }
+
+        const input = payload.value;
+        if (input === null || typeof input !== "object") return base(payload, ctx);
+
+        let state = (ctx as WithState)[STATE];
+        if (!state) {
+          state = { buckets: new Map(), backEdges: undefined };
+          (ctx as WithState)[STATE] = state;
+        }
+
+        let bucket: Map<object, Entry>;
+        if (lastCtx === ctx) {
+          bucket = lastBucket!;
+        } else {
+          bucket = bucketFor(state, inst);
+          lastCtx = ctx;
+          lastBucket = bucket;
+        }
+
+        const hit = bucket.get(input);
+        if (hit) {
+          payload.value = hit.value;
+          if (hit.issues) {
+            if (hit.issues.length) payload.issues.push(...cloneIssues(hit.issues));
+          } else {
+            // Still being parsed: its own checks cover it, so skip them here.
+            payload.memo = true;
+            state.backEdges ??= new Set();
+            state.backEdges.add(hit.value as object);
+          }
+          return payload;
+        }
+
+        handoff = bucket;
+        const depth = open.length;
+        const result = base(payload, ctx);
+        handoff = undefined;
+        // A container that rejected its input outright allocated nothing.
+        const entry = open.length > depth ? open.pop()! : undefined;
+
+        // Both paths written out so the sync one allocates no closure. It runs once per node, and capturing here cost more than everything else combined.
+        if (result instanceof Promise) {
+          return result.then((r) => {
+            if (entry) entry.issues = r.issues.length ? cloneIssues(r.issues) : NO_ISSUES;
+            return r;
+          });
+        }
+        if (entry) entry.issues = result.issues.length ? cloneIssues(result.issues) : NO_ISSUES;
+        return result;
+      };
+
+      inst._zod.parse = wrapped;
+      if (inst._zod.run === base) inst._zod.run = wrapped;
+    });
+  },
+};
+
+/** The memoizer that gives containers cycle support. `zod` installs it by default; `zod/mini` opts in with `config({ memoizer: memoizer() })`. */
+export function memoizer(): $ZodMemoizer {
+  return memo;
+}
+
+/** Whether this value is a node a back-edge resolved to before it finished. */
+export function isBackEdge(ctx: object, value: unknown): boolean {
+  const backEdges = (ctx as WithState)[STATE]?.backEdges;
+  return backEdges !== undefined && value !== null && typeof value === "object" && backEdges.has(value);
+}

package/node_modules/zod/src/v4/core/parse.ts

@@ -4,27 +4,36 @@ import type * as schemas from "./schemas.js";
 import * as util from "./util.js";
 
 export type $ZodErrorClass = { new (issues: errors.$ZodIssue[]): errors.$ZodError };
+type $ParseParams = { callee?: util.AnyFunc; Err?: $ZodErrorClass | undefined };
+
+// Always both keys, so the `_params` read site in `_parse` sees one object shape rather than two.
+function finalizeParams(callee: util.AnyFunc, params: $ParseParams | undefined): $ParseParams {
+  return { callee: params?.callee ?? callee, Err: params?.Err };
+}
 
 ///////////        METHODS       ///////////
 export type $Parse = <T extends schemas.$ZodType>(
   schema: T,
   value: unknown,
   _ctx?: schemas.ParseContext<errors.$ZodIssue>,
-  _params?: { callee?: util.AnyFunc; Err?: $ZodErrorClass }
+  _params?: $ParseParams
 ) => core.output<T>;
 
-export const _parse: (_Err: $ZodErrorClass) => $Parse = (_Err) => (schema, value, _ctx, _params) => {
-  const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: false } : { async: false };
-  const result = schema._zod.run({ value, issues: [] }, ctx);
-  if (result instanceof Promise) {
-    throw new core.$ZodAsyncError();
-  }
-  if (result.issues.length) {
-    const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
-    util.captureStackTrace(e, _params?.callee);
-    throw e;
-  }
-  return result.value as core.output<typeof schema>;
+export const _parse: (_Err: $ZodErrorClass) => $Parse = (_Err) => {
+  const fn: $Parse = (schema, value, _ctx, _params) => {
+    const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: false } : { async: false };
+    const result = schema._zod.run({ value, issues: [] }, ctx);
+    if (result instanceof Promise) {
+      throw new core.$ZodAsyncError();
+    }
+    if (result.issues.length) {
+      const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
+      util.captureStackTrace(e, _params?.callee ?? fn);
+      throw e;
+    }
+    return result.value as core.output<typeof schema>;
+  };
+  return fn;
 };
 
 export const parse: $Parse = /* @__PURE__*/ _parse(errors.$ZodRealError);
@@ -33,19 +42,22 @@ export type $ParseAsync = <T extends schemas.$ZodType>(
   schema: T,
   value: unknown,
   _ctx?: schemas.ParseContext<errors.$ZodIssue>,
-  _params?: { callee?: util.AnyFunc; Err?: $ZodErrorClass }
+  _params?: $ParseParams
 ) => Promise<core.output<T>>;
 
-export const _parseAsync: (_Err: $ZodErrorClass) => $ParseAsync = (_Err) => async (schema, value, _ctx, params) => {
-  const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: true } : { async: true };
-  let result = schema._zod.run({ value, issues: [] }, ctx);
-  if (result instanceof Promise) result = await result;
-  if (result.issues.length) {
-    const e = new (params?.Err ?? _Err)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
-    util.captureStackTrace(e, params?.callee);
-    throw e;
-  }
-  return result.value as core.output<typeof schema>;
+export const _parseAsync: (_Err: $ZodErrorClass) => $ParseAsync = (_Err) => {
+  const fn: $ParseAsync = async (schema, value, _ctx, params) => {
+    const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: true } : { async: true };
+    let result = schema._zod.run({ value, issues: [] }, ctx);
+    if (result instanceof Promise) result = await result;
+    if (result.issues.length) {
+      const e = new (params?.Err ?? _Err)(result.issues.map((iss) => util.finalizeIssue(iss, ctx, core.config())));
+      util.captureStackTrace(e, params?.callee ?? fn);
+      throw e;
+    }
+    return result.value as core.output<typeof schema>;
+  };
+  return fn;
 };
 
 export const parseAsync: $ParseAsync = /* @__PURE__*/ _parseAsync(errors.$ZodRealError);
@@ -93,16 +105,82 @@ export const _safeParseAsync: (_Err: $ZodErrorClass) => $SafeParseAsync = (_Err)
 
 export const safeParseAsync: $SafeParseAsync = /* @__PURE__*/ _safeParseAsync(errors.$ZodRealError);
 
+// registry mirrors of the compiler's sentinels, so this module never imports the compiler
+const COMPILE_INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
+const COMPILE_FALLBACK = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
+
+interface CompiledBag {
+  validator?: (input: unknown) => unknown;
+  fallbackRun?: (payload: schemas.ParsePayload, ctx: schemas.ParseContextInternal) => unknown;
+}
+
+export type $Validate = <T extends schemas.$ZodType>(
+  schema: T,
+  value: unknown,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+) => value is core.input<T>;
+
+// Deliberately tiny, because v8 will not inline a body carrying the fallback's object literals and throw. Everything that is not the compiled happy path lives in validateFallback, and that split is worth ~35% on a compiled schema.
+export const validate: $Validate = ((
+  schema: schemas.$ZodType,
+  value: unknown,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+): boolean => {
+  const validator = (schema._zod.bag as CompiledBag).validator;
+  if (validator !== undefined && validator(value) !== COMPILE_INVALID) return true;
+  return validateFallback(schema, value, _ctx);
+}) as $Validate;
+
+function validateFallback(
+  schema: schemas.$ZodType,
+  value: unknown,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+): boolean {
+  const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: false } : { async: false };
+  const fallbackRun = (schema._zod.bag as CompiledBag).fallbackRun;
+  let result: unknown;
+  if (fallbackRun) {
+    // skip nested fast paths on the fallback, so user callbacks keep the at-most-twice bound
+    (ctx as Record<symbol, unknown>)[COMPILE_FALLBACK] = true;
+    result = fallbackRun({ value, issues: [] }, ctx);
+  } else {
+    result = schema._zod.run({ value, issues: [] }, ctx);
+  }
+  if (result instanceof Promise) {
+    throw new core.$ZodAsyncError();
+  }
+  return (result as schemas.ParsePayload).issues.length === 0;
+}
+
+export type $ValidateAsync = <T extends schemas.$ZodType>(
+  schema: T,
+  value: unknown,
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+) => Promise<boolean>;
+
+// no fast path: the compiler keeps async parses on the runtime, because a promise-returning callback that is not declared async compiles to a throw
+export const validateAsync: $ValidateAsync = async (schema, value, _ctx) => {
+  const ctx: schemas.ParseContextInternal = _ctx ? { ..._ctx, async: true } : { async: true };
+  let result: unknown = schema._zod.run({ value, issues: [] }, ctx);
+  if (result instanceof Promise) result = await result;
+  return (result as schemas.ParsePayload).issues.length === 0;
+};
+
 // Codec functions
 export type $Encode = <T extends schemas.$ZodType>(
   schema: T,
   value: core.output<T>,
-  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>,
+  _params?: $ParseParams
 ) => core.input<T>;
 
-export const _encode: (_Err: $ZodErrorClass) => $Encode = (_Err) => (schema, value, _ctx) => {
-  const ctx = _ctx ? { ..._ctx, direction: "backward" as const } : { direction: "backward" as const };
-  return _parse(_Err)(schema, value, ctx as any) as any;
+export const _encode: (_Err: $ZodErrorClass) => $Encode = (_Err) => {
+  const parse = _parse(_Err);
+  const fn: $Encode = (schema, value, _ctx, _params) => {
+    const ctx = _ctx ? { ..._ctx, direction: "backward" as const } : { direction: "backward" as const };
+    return parse(schema, value, ctx as any, finalizeParams(fn, _params)) as any;
+  };
+  return fn;
 };
 
 export const encode: $Encode = /* @__PURE__*/ _encode(errors.$ZodRealError);
@@ -110,11 +188,16 @@ export const encode: $Encode = /* @__PURE__*/ _encode(errors.$ZodRealError);
 export type $Decode = <T extends schemas.$ZodType>(
   schema: T,
   value: core.input<T>,
-  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>,
+  _params?: $ParseParams
 ) => core.output<T>;
 
-export const _decode: (_Err: $ZodErrorClass) => $Decode = (_Err) => (schema, value, _ctx) => {
-  return _parse(_Err)(schema, value, _ctx);
+export const _decode: (_Err: $ZodErrorClass) => $Decode = (_Err) => {
+  const parse = _parse(_Err);
+  const fn: $Decode = (schema, value, _ctx, _params) => {
+    return parse(schema, value, _ctx, finalizeParams(fn, _params));
+  };
+  return fn;
 };
 
 export const decode: $Decode = /* @__PURE__*/ _decode(errors.$ZodRealError);
@@ -122,12 +205,17 @@ export const decode: $Decode = /* @__PURE__*/ _decode(errors.$ZodRealError);
 export type $EncodeAsync = <T extends schemas.$ZodType>(
   schema: T,
   value: core.output<T>,
-  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>,
+  _params?: $ParseParams
 ) => Promise<core.input<T>>;
 
-export const _encodeAsync: (_Err: $ZodErrorClass) => $EncodeAsync = (_Err) => async (schema, value, _ctx) => {
-  const ctx = _ctx ? { ..._ctx, direction: "backward" as const } : { direction: "backward" as const };
-  return _parseAsync(_Err)(schema, value, ctx as any) as any;
+export const _encodeAsync: (_Err: $ZodErrorClass) => $EncodeAsync = (_Err) => {
+  const parseAsync = _parseAsync(_Err);
+  const fn: $EncodeAsync = async (schema, value, _ctx, _params) => {
+    const ctx = _ctx ? { ..._ctx, direction: "backward" as const } : { direction: "backward" as const };
+    return (await parseAsync(schema, value, ctx as any, finalizeParams(fn, _params))) as any;
+  };
+  return fn;
 };
 
 export const encodeAsync: $EncodeAsync = /* @__PURE__*/ _encodeAsync(errors.$ZodRealError);
@@ -135,11 +223,16 @@ export const encodeAsync: $EncodeAsync = /* @__PURE__*/ _encodeAsync(errors.$Zod
 export type $DecodeAsync = <T extends schemas.$ZodType>(
   schema: T,
   value: core.input<T>,
-  _ctx?: schemas.ParseContext<errors.$ZodIssue>
+  _ctx?: schemas.ParseContext<errors.$ZodIssue>,
+  _params?: $ParseParams
 ) => Promise<core.output<T>>;
 
-export const _decodeAsync: (_Err: $ZodErrorClass) => $DecodeAsync = (_Err) => async (schema, value, _ctx) => {
-  return _parseAsync(_Err)(schema, value, _ctx);
+export const _decodeAsync: (_Err: $ZodErrorClass) => $DecodeAsync = (_Err) => {
+  const parseAsync = _parseAsync(_Err);
+  const fn: $DecodeAsync = async (schema, value, _ctx, _params) => {
+    return await parseAsync(schema, value, _ctx, finalizeParams(fn, _params));
+  };
+  return fn;
 };
 
 export const decodeAsync: $DecodeAsync = /* @__PURE__*/ _decodeAsync(errors.$ZodRealError);

package/node_modules/zod/src/v4/core/regexes.ts

@@ -7,10 +7,13 @@ import * as util from "./util.js";
  */
 export const cuid: RegExp = /^[cC][0-9a-z]{6,}$/;
 export const cuid2: RegExp = /^[0-9a-z]+$/;
-export const ulid: RegExp = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;
+export const ulid: RegExp = /^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/;
 export const xid: RegExp = /^[0-9a-vA-V]{20}$/;
 export const ksuid: RegExp = /^[A-Za-z0-9]{27}$/;
 export const nanoid: RegExp = /^[a-zA-Z0-9_-]{21}$/;
+export function nanoidOfLength(length: number): RegExp {
+  return new RegExp(`^[a-zA-Z0-9_-]{${length}}$`);
+}
 
 /** ISO 8601-1 duration regex. Does not support the 8601-2 extensions like negative durations or fractional/negative components. */
 export const duration: RegExp =
@@ -57,7 +60,8 @@ export const browserEmail: RegExp =
   /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
 // from https://thekevinscott.com/emojis-in-javascript/#writing-a-regular-expression
 
-const _emoji: string = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`;
+// Single character class, not an alternation: the two properties overlap (U+1F9B0-U+1F9B3), so `(A|B)+` backtracks exponentially on a failed match.
+const _emoji: string = `^[\\p{Extended_Pictographic}\\p{Emoji_Component}]+$`;
 export function emoji(): RegExp {
   return new RegExp(_emoji, "u");
 }
@@ -73,7 +77,7 @@ export const mac = (delimiter?: string): RegExp => {
 export const cidrv4: RegExp =
   /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
 export const cidrv6: RegExp =
-  /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
+  /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 
 // https://stackoverflow.com/questions/7860392/determine-if-string-is-in-base64-using-javascript
 export const base64: RegExp = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
@@ -84,19 +88,28 @@ export const base64url: RegExp = /^[A-Za-z0-9_-]*$/;
 export const hostname: RegExp =
   /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 
-export const domain: RegExp = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
+export const domain: RegExp = /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/;
 
 export const httpProtocol: RegExp = /^https?$/;
 
-// https://blog.stevenlevithan.com/archives/validate-phone-number#r4-3 (regex sans spaces)
-// E.164: leading digit must be 1-9; total digits (excluding '+') between 7-15
+// https://blog.stevenlevithan.com/archives/validate-phone-number#r4-3 (regex sans spaces) E.164: leading digit must be 1-9; total digits (excluding '+') between 7-15
 export const e164: RegExp = /^\+[1-9]\d{6,14}$/;
 
-// const dateSource = `((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))`;
+// Credit card shape: 12–19 digits, optionally separated by single spaces or single hyphens. ISO/IEC 7812 caps the PAN at 19 digits; 12 is the shortest issued length (Maestro).
+export const creditCard: RegExp = /^\d(?:[ -]?\d){11,18}$/;
+
 const dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
-export const date: RegExp = /*@__PURE__*/ new RegExp(`^${dateSource}$`);
 
-function timeSource(args: { precision?: number | null | undefined }) {
+/** Anchors a pattern source. The interpolation lives here rather than at the call site because
+ * esbuild will not drop a `@__PURE__` call whose own argument interpolates a variable, but it
+ * will drop `anchor(dateSource)`. Keeping it inline pinned `date` into every bundle. */
+function anchor(source: string): RegExp {
+  return new RegExp(`^${source}$`);
+}
+
+export const date: RegExp = /*@__PURE__*/ anchor(dateSource);
+
+function timeSource(args: { precision?: number | null | undefined; seconds?: boolean }) {
   const hhmm = `(?:[01]\\d|2[0-3]):[0-5]\\d`;
   const regex =
     typeof args.precision === "number"
@@ -105,7 +118,9 @@ function timeSource(args: { precision?: number | null | undefined }) {
         : args.precision === 0
           ? `${hhmm}:[0-5]\\d`
           : `${hhmm}:[0-5]\\d\\.\\d{${args.precision}}`
-      : `${hhmm}(?::[0-5]\\d(?:\\.\\d+)?)?`;
+      : args.seconds
+        ? `${hhmm}:[0-5]\\d(?:\\.\\d+)?`
+        : `${hhmm}(?::[0-5]\\d(?:\\.\\d+)?)?`;
   return regex;
 }
 export function time(args: {
@@ -121,12 +136,13 @@ export function datetime(args: {
   offset?: boolean;
   local?: boolean;
 }): RegExp {
-  const time = timeSource({ precision: args.precision });
   const opts = ["Z"];
-  if (args.local) opts.push("");
   // if (args.offset) opts.push(`([+-]\\d{2}:\\d{2})`);
   if (args.offset) opts.push(`([+-](?:[01]\\d|2[0-3]):[0-5]\\d)`);
-  const timeRegex = `${time}(?:${opts.join("|")})`;
+
+  // RFC 3339 mandates seconds wherever the time carries a `Z` or an offset, so only the unqualified form `local` adds may omit them
+  const qualified = `${timeSource({ precision: args.precision, seconds: true })}(?:${opts.join("|")})`;
+  const timeRegex = args.local ? `${qualified}|${timeSource({ precision: args.precision })}` : qualified;
 
   return new RegExp(`^${dateSource}T(?:${timeRegex})$`);
 }
@@ -154,6 +170,7 @@ export const uppercase: RegExp = /^[^a-z]*$/;
 export const hex: RegExp = /^[0-9a-fA-F]*$/;
 
 // Hash regexes for different algorithms and encodings
+
 // Helper function to create base64 regex with exact length and padding
 function fixedBase64(bodyLength: number, padding: "" | "=" | "=="): RegExp {
   return new RegExp(`^[A-Za-z0-9+/]{${bodyLength}}${padding}$`);

package/node_modules/zod/src/v4/core/registries.ts

@@ -1,9 +1,9 @@
 import type * as core from "./core.js";
 import type { $ZodType } from "./schemas.js";
 
-export const $output: unique symbol = Symbol("ZodOutput");
+export const $output: unique symbol = /*@__PURE__*/ Symbol("ZodOutput");
 export type $output = typeof $output;
-export const $input: unique symbol = Symbol("ZodInput");
+export const $input: unique symbol = /*@__PURE__*/ Symbol("ZodInput");
 export type $input = typeof $input;
 
 export type $replace<Meta, S extends $ZodType> = Meta extends $output