@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/node_modules/zod/v4/classic/from-json-schema.js

@@ -123,12 +123,13 @@ function resolveRef(ref, ctx) {
     throw new Error(`Reference not found: ${ref}`);
 }
 /**
- * Rejects every own key that fails `keySchema`, before `objectSchema` runs. The
- * guard has to see the raw input: an object parse drops `__proto__` and can add
- * keys from a property `default`, so its output is not the set of names the
- * instance actually carried.
+ * Enforces the keywords that constrain an object's own keys — `propertyNames`,
+ * `minProperties`, `maxProperties` — before `objectSchema` runs. The guard has
+ * to see the raw input: an object parse drops `__proto__` and can add keys from
+ * a property `default`, so its output is not the set of names the instance
+ * actually carried.
  */
-function checkPropertyNames(objectSchema, keySchema) {
+function checkObjectGuards(objectSchema, guards) {
     // An identity transform, not z.any(), so `toJSONSchema` reports the object on both the input and the output side of the pipe.
     const guard = z
         .transform((value) => value)
@@ -136,22 +137,209 @@ function checkPropertyNames(objectSchema, keySchema) {
         const value = payload.value;
         if (typeof value !== "object" || value === null || Array.isArray(value))
             return;
-        for (const key of Object.getOwnPropertyNames(value)) {
-            const result = keySchema.safeParse(key);
-            if (result.success)
-                continue;
+        const keys = Object.getOwnPropertyNames(value);
+        if (guards.minProperties !== undefined && keys.length < guards.minProperties) {
             payload.issues.push({
-                code: "invalid_key",
-                origin: "record",
-                issues: result.error.issues,
-                input: key,
-                path: [key],
+                origin: "object",
+                code: "too_small",
+                minimum: guards.minProperties,
+                inclusive: true,
+                message: `Too small: expected object to have >=${guards.minProperties} properties`,
+                input: value,
+                inst: objectSchema,
                 continue: true,
             });
         }
+        if (guards.maxProperties !== undefined && keys.length > guards.maxProperties) {
+            payload.issues.push({
+                origin: "object",
+                code: "too_big",
+                maximum: guards.maxProperties,
+                inclusive: true,
+                message: `Too big: expected object to have <=${guards.maxProperties} properties`,
+                input: value,
+                inst: objectSchema,
+                continue: true,
+            });
+        }
+        if (guards.keySchema) {
+            for (const key of keys) {
+                const result = guards.keySchema.safeParse(key);
+                if (result.success)
+                    continue;
+                payload.issues.push({
+                    code: "invalid_key",
+                    origin: "record",
+                    issues: result.error.issues,
+                    input: key,
+                    path: [key],
+                    continue: true,
+                });
+            }
+        }
     });
     return guard.pipe(objectSchema);
 }
+/**
+ * An injective string for JSON data: two values share a key exactly when `uniqueItems` calls them
+ * equal, so duplicate detection is a Map lookup rather than a pairwise walk. Strings and keys are
+ * length-prefixed so no value can spell another one. `null` means "never equal to anything" — a
+ * cycle or a NaN, neither of which JSON can express.
+ */
+function canonicalKey(value, seen) {
+    if (value === null)
+        return "z";
+    const type = typeof value;
+    if (type !== "object") {
+        if (type === "number" && Number.isNaN(value))
+            return null;
+        const raw = String(value);
+        return `${type[0]}${raw.length}:${raw}`;
+    }
+    if (seen.has(value))
+        return null;
+    seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            const parts = [];
+            for (const item of value) {
+                const key = canonicalKey(item, seen);
+                if (key === null)
+                    return null;
+                parts.push(key);
+            }
+            return `a${parts.length}:[${parts.join(",")}]`;
+        }
+        const keys = Object.keys(value).sort();
+        const parts = [];
+        for (const k of keys) {
+            const key = canonicalKey(value[k], seen);
+            if (key === null)
+                return null;
+            parts.push(`${k.length}:${k}=${key}`);
+        }
+        return `o${parts.length}:{${parts.join(",")}}`;
+    }
+    finally {
+        seen.delete(value);
+    }
+}
+// keywords whose value is a schema or an array of them
+const SCHEMA_KEYWORDS = /*@__PURE__*/ new Set([
+    "items",
+    "prefixItems",
+    "additionalItems",
+    "additionalProperties",
+    "contains",
+    "propertyNames",
+    "not",
+    "if",
+    "then",
+    "else",
+    "allOf",
+    "anyOf",
+    "oneOf",
+    "unevaluatedItems",
+    "unevaluatedProperties",
+    "contentSchema",
+]);
+// keywords whose value maps names to schemas. draft-7 `dependencies` also allows an array of property names, which holds no schema to walk
+const SCHEMA_MAP_KEYWORDS = /*@__PURE__*/ new Set([
+    "properties",
+    "patternProperties",
+    "dependentSchemas",
+    "dependencies",
+    "$defs",
+    "definitions",
+]);
+/**
+ * True when a subschema holds a `$ref` anywhere a schema can appear. Only those positions are
+ * walked: `$ref` under `default` or an `x-` annotation is instance data with an ordinary key, and
+ * reading it as a reference would drop a constraint that resolves perfectly well.
+ */
+function containsRef(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    if (Array.isArray(value))
+        return value.some(containsRef);
+    if (typeof value.$ref === "string")
+        return true;
+    return Object.entries(value).some(([key, sub]) => {
+        if (SCHEMA_KEYWORDS.has(key))
+            return containsRef(sub);
+        if (!SCHEMA_MAP_KEYWORDS.has(key) || typeof sub !== "object" || sub === null)
+            return false;
+        return Object.values(sub).some(containsRef);
+    });
+}
+function plural(n) {
+    return n === 1 ? "element" : "elements";
+}
+/**
+ * Enforces `uniqueItems` and the `contains` family before `arraySchema` runs, for the same reason
+ * `checkObjectGuards` runs pre-pipe: an item parse can apply a nested `default`, so the parsed
+ * array is not the instance the keywords are defined over. A guard issue aborts the pipe, so
+ * `minItems`/`maxItems` are not also reported on the same parse — instance correctness is worth
+ * more than co-reporting two issues.
+ */
+function checkArrayGuards(arraySchema, guards) {
+    // An identity transform, not z.any(), so `toJSONSchema` reports the array on both the input and the output side of the pipe.
+    const guard = z
+        .transform((value) => value)
+        .check((payload) => {
+        const items = payload.value;
+        if (!Array.isArray(items))
+            return;
+        if (guards.uniqueItems === true) {
+            const firstSeen = new Map();
+            for (let i = 0; i < items.length; i++) {
+                const key = canonicalKey(items[i], new Set());
+                if (key === null)
+                    continue;
+                const first = firstSeen.get(key);
+                if (first === undefined) {
+                    firstSeen.set(key, i);
+                    continue;
+                }
+                payload.issues.push({
+                    code: "custom",
+                    message: `Array items must be unique: element at index ${i} duplicates the one at index ${first}`,
+                    input: items,
+                    path: [i],
+                    continue: true,
+                });
+            }
+        }
+        if (guards.containsSchema) {
+            const minContains = guards.minContains ?? 1;
+            // one past the ceiling already proves the failure, and nothing above it changes the verdict
+            const ceiling = guards.maxContains !== undefined ? guards.maxContains + 1 : Number.POSITIVE_INFINITY;
+            let matches = 0;
+            for (const item of items) {
+                if (guards.containsSchema.safeParse(item).success && ++matches >= ceiling)
+                    break;
+            }
+            if (matches < minContains) {
+                // the scan ran to the end, so this count is exact
+                payload.issues.push({
+                    code: "custom",
+                    message: `Array must contain at least ${minContains} matching ${plural(minContains)}; found ${matches}`,
+                    input: items,
+                    continue: true,
+                });
+            }
+            if (guards.maxContains !== undefined && matches > guards.maxContains) {
+                payload.issues.push({
+                    code: "custom",
+                    message: `Array must contain at most ${guards.maxContains} matching ${plural(guards.maxContains)}`,
+                    input: items,
+                    continue: true,
+                });
+            }
+        }
+    });
+    return guard.pipe(arraySchema);
+}
 function getTupleRest(restSchema, ctx) {
     if (restSchema === false) {
         return undefined;
@@ -316,6 +504,9 @@ function convertBaseSchema(schema, ctx) {
                 else if (format === "credit_card") {
                     stringSchema = stringSchema.check(z.creditCard());
                 }
+                else if (format === "iban") {
+                    stringSchema = stringSchema.check(z.iban());
+                }
                 else if (format === "jwt") {
                     stringSchema = stringSchema.check(z.jwt());
                 }
@@ -483,17 +674,23 @@ function convertBaseSchema(schema, ctx) {
                 }
             }
             // propertyNames constrains key *names* only, and says nothing about which keys are required or how their values validate. Layering it on top of the result keeps properties/patternProperties/additionalProperties composing underneath. `true` allows every name, so it needs no guard.
-            if (schema.propertyNames !== undefined && schema.propertyNames !== true) {
-                // Keys are always strings, so a propertyNames subschema that omits `type` still constrains them — without this it would convert to z.any().
-                const keyJSONSchema = typeof schema.propertyNames === "object" && schema.propertyNames.type === undefined
-                    ? { type: "string", ...schema.propertyNames }
-                    : schema.propertyNames;
-                zodSchema = checkPropertyNames(zodSchema, convertSchema(keyJSONSchema, ctx));
+            const hasKeyGuard = schema.propertyNames !== undefined && schema.propertyNames !== true;
+            const minProperties = typeof schema.minProperties === "number" ? schema.minProperties : undefined;
+            const maxProperties = typeof schema.maxProperties === "number" ? schema.maxProperties : undefined;
+            if (hasKeyGuard || minProperties !== undefined || maxProperties !== undefined) {
+                let keySchema;
+                if (hasKeyGuard) {
+                    // Keys are always strings, so a propertyNames subschema that omits `type` still constrains them — without this it would convert to z.any().
+                    const keyJSONSchema = typeof schema.propertyNames === "object" && schema.propertyNames.type === undefined
+                        ? { type: "string", ...schema.propertyNames }
+                        : schema.propertyNames;
+                    keySchema = convertSchema(keyJSONSchema, ctx);
+                }
+                zodSchema = checkObjectGuards(zodSchema, { keySchema, minProperties, maxProperties });
             }
             break;
         }
         case "array": {
-            // TODO: uniqueItems and contains/minContains/maxContains are not supported
             // Check if this is a tuple (prefixItems or items as array)
             const prefixItems = schema.prefixItems;
             const items = schema.items;
@@ -546,6 +743,15 @@ function convertBaseSchema(schema, ctx) {
                 // No items specified - array of any
                 zodSchema = z.array(z.any());
             }
+            // minContains/maxContains only constrain anything when `contains` itself is present
+            if (schema.uniqueItems === true || schema.contains !== undefined) {
+                zodSchema = checkArrayGuards(zodSchema, {
+                    uniqueItems: schema.uniqueItems === true,
+                    containsSchema: schema.contains !== undefined ? convertSchema(schema.contains, ctx) : undefined,
+                    minContains: typeof schema.minContains === "number" ? schema.minContains : undefined,
+                    maxContains: typeof schema.maxContains === "number" ? schema.maxContains : undefined,
+                });
+            }
             break;
         }
         default:
@@ -613,9 +819,24 @@ function convertSchema(schema, ctx) {
             extraMeta[key] = schema[key];
         }
     }
-    // `propertyNames` is enforced by a key guard, which `toJSONSchema` cannot infer, so the original keyword is carried as metadata to keep the round-trip lossless. Only where it was actually applied: on any other type it is inert, and on a `$ref` the metadata would land on the target every reference shares.
-    if (schema.propertyNames !== undefined && schema.type === "object" && schema.$ref === undefined) {
-        extraMeta.propertyNames = schema.propertyNames;
+    // `propertyNames` and `contains` are enforced by a guard, which `toJSONSchema` cannot infer, so the original keyword is carried as metadata to keep the round-trip lossless. Only where it was actually applied: on any other type it is inert, and on a `$ref` the metadata would land on the target every reference shares. A carried subschema is copied verbatim while the root `$defs` stay behind, so one holding a `$ref` is dropped rather than emitted as a dangling reference.
+    if (schema.type === "object" && schema.$ref === undefined) {
+        if (schema.propertyNames !== undefined && !containsRef(schema.propertyNames)) {
+            extraMeta.propertyNames = schema.propertyNames;
+        }
+        for (const key of ["minProperties", "maxProperties"]) {
+            if (schema[key] !== undefined)
+                extraMeta[key] = schema[key];
+        }
+    }
+    if (schema.type === "array" && schema.$ref === undefined) {
+        if (schema.contains !== undefined && !containsRef(schema.contains)) {
+            extraMeta.contains = schema.contains;
+        }
+        for (const key of ["uniqueItems", "minContains", "maxContains"]) {
+            if (schema[key] !== undefined)
+                extraMeta[key] = schema[key];
+        }
     }
     for (const key of Object.keys(schema)) {
         if (!RECOGNIZED_KEYS.has(key)) {

package/node_modules/zod/v4/classic/in-out.cjs

@@ -61,3 +61,22 @@ function output(schema) {
         prefault: (s, rewritten) => (rewritten ? s._zod.def.innerType : s),
     });
 }
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/v4/classic/index.cjs

@@ -31,3 +31,22 @@ const z = __importStar(require("./external.cjs"));
 exports.z = z;
 exports.default = z;
 __exportStar(require("./external.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/v4/classic/iso.cjs

@@ -47,3 +47,22 @@ function time(params) {
 function duration(params) {
     return core._isoDuration(schemas_js_1.ZodISODuration, params);
 }
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/v4/classic/parse.cjs

@@ -42,3 +42,22 @@ exports.safeEncode = core._safeEncode(errors_js_1.ZodRealError);
 exports.safeDecode = core._safeDecode(errors_js_1.ZodRealError);
 exports.safeEncodeAsync = core._safeEncodeAsync(errors_js_1.ZodRealError);
 exports.safeDecodeAsync = core._safeDecodeAsync(errors_js_1.ZodRealError);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();