@openclaw/signal 2026.9.4 → 2026.9.5

package/dist/.setup/transport-url-CAC0JcuI.mjs

@@ -0,0 +1,55 @@
+import { pathToFileURL } from "node:url";
+import { normalizeAccountId, resolveAccountKey } from "openclaw/plugin-sdk/account-resolution";
+import { isIP } from "node:net";
+import path from "node:path";
+//#region extensions/signal/src/account-selection.ts
+function resolveSignalAccountKey(accounts, accountId) {
+	return resolveAccountKey(accounts, normalizeAccountId(accountId), void 0, void 0, { channelId: "signal" });
+}
+function resolveSignalAccountEntry(accounts, accountId) {
+	const key = resolveSignalAccountKey(accounts, accountId);
+	return key === void 0 ? void 0 : accounts?.[key];
+}
+//#endregion
+//#region extensions/signal/src/transport-url.ts
+function normalizeSignalTransportUrl(value) {
+	const trimmed = value.trim();
+	if (!trimmed) throw new Error("Signal transport URL is required");
+	if (/^https?:/i.test(trimmed) && !/^https?:\/\/[^/]/i.test(trimmed)) throw new Error("Signal transport URL has a malformed HTTP scheme");
+	const explicitScheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(trimmed)?.[1]?.toLowerCase();
+	if (explicitScheme && explicitScheme !== "http" && explicitScheme !== "https") throw new Error(`Signal transport URL unsupported protocol: ${explicitScheme}:`);
+	const parsed = new URL(/^https?:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Signal transport URL unsupported protocol: ${parsed.protocol}`);
+	if (parsed.username || parsed.password) throw new Error("Signal transport URL must not include credentials");
+	const pathname = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/+$/, "");
+	return `${parsed.protocol}//${parsed.host}${pathname}`;
+}
+function normalizeSignalTransportHost(host) {
+	const trimmedHost = host.trim();
+	const hasOpeningBracket = trimmedHost.startsWith("[");
+	if (hasOpeningBracket !== trimmedHost.endsWith("]")) throw new Error("Signal transport host has mismatched IPv6 brackets");
+	const normalizedHost = hasOpeningBracket ? trimmedHost.slice(1, -1) : trimmedHost;
+	if (!normalizedHost || /[\s/\\?#@]/.test(normalizedHost)) throw new Error("Signal transport host must be a hostname or IP address");
+	if (isIP(normalizedHost) === 0) {
+		const hostname = normalizedHost.endsWith(".") ? normalizedHost.slice(0, -1) : normalizedHost;
+		const labels = hostname.split(".");
+		if (hostname.length > 253 || labels.some((label) => !label || label.length > 63 || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label))) throw new Error("Signal transport host must be a hostname or IP address");
+	}
+	return normalizedHost;
+}
+function buildSignalTransportHttpUrl(host, port) {
+	const normalizedHost = normalizeSignalTransportHost(host);
+	return normalizeSignalTransportUrl(`http://${normalizedHost.includes(":") ? `[${normalizedHost}]` : normalizedHost}:${port}`);
+}
+/** Validate the opt-in shape without filesystem side effects during config resolution. */
+function assertSignalSocketTransport(transport) {
+	if (transport.socketPath === void 0) return;
+	if (typeof transport.socketPath !== "string" || !/^\/(?!\/)[^\0]+$/.test(transport.socketPath) || transport.socketPath.endsWith("/") || path.posix.normalize(transport.socketPath) !== transport.socketPath || Buffer.byteLength(transport.socketPath, "utf8") > 103) throw new Error("Signal transport.socketPath must be a normalized absolute POSIX socket file path of at most 103 UTF-8 bytes.");
+	if (transport.url !== void 0 || transport.httpHost !== void 0 || transport.httpPort !== void 0) throw new Error("Signal transport.socketPath cannot be combined with url, httpHost, or httpPort.");
+	if (transport.receiveMode === "on-start") throw new Error("Signal socket transport requires receiveMode manual (or omitted).");
+}
+function buildSignalSocketUrl(socketPath) {
+	return `unix://${pathToFileURL(socketPath).pathname}`;
+}
+//#endregion
+export { normalizeSignalTransportUrl as a, normalizeSignalTransportHost as i, buildSignalSocketUrl as n, resolveSignalAccountEntry as o, buildSignalTransportHttpUrl as r, resolveSignalAccountKey as s, assertSignalSocketTransport as t };

package/dist/api.js

@@ -1,17 +1,12 @@
-import { i as resolveSignalAccount, n as listSignalAccountIds, r as resolveDefaultSignalAccountId, t as listEnabledSignalAccounts } from "./accounts-DO4HMqaK.js";
-import { n as normalizeSignalMessagingTarget, t as looksLikeSignalTargetId } from "./normalize-l_b99hap.js";
-import { a as normalizeSignalAllowRecipient, c as resolveSignalSender, i as isSignalSenderAllowed, l as looksLikeUuid, n as formatSignalSenderDisplay, o as resolveSignalPeerId, r as formatSignalSenderId, s as resolveSignalRecipient, t as formatSignalPairingIdLine } from "./identity-YXPmgFMu.js";
-import { c as resolveSignalReactionLevel, d as markdownToSignalTextChunks, s as signalMessageActions, t as detectSignalTransport, u as markdownToSignalText } from "./transport-detection-Do2pYMAH.js";
-import { n as sendReactionSignal, t as removeReactionSignal } from "./reaction-runtime-api-CWqDv5-q.js";
-import { a as normalizeSignalAccountInput, d as probeSignalTransport, f as writeSignalAccountTransport, l as signalSetupContract, n as createSignalPluginBase, p as resolveSignalOutboundTarget, r as signalSetupWizard, t as signalPlugin, u as prepareSignalManagedNativeTransport } from "./channel-CyQvEuyA.js";
-import { i as installSignalCli } from "./install-signal-cli-QlEIfWBv.js";
-import { t as monitorSignalProvider } from "./monitor-BiNWxMB3.js";
-import { n as sendReadReceiptSignal, r as sendTypingSignal, t as sendMessageSignal } from "./send-Bz0x0JC1.js";
-import { t as probeSignal } from "./probe-kOJqyjWz.js";
-//#region extensions/signal/src/channel.setup.ts
-const signalSetupPlugin = { ...createSignalPluginBase({
-	setupWizard: signalSetupWizard,
-	setupContract: signalSetupContract
-}) };
-//#endregion
+import { i as resolveSignalAccount, n as listSignalAccountIds, r as resolveDefaultSignalAccountId, t as listEnabledSignalAccounts } from "./.setup/accounts-BV6tDOTc.mjs";
+import { n as normalizeSignalMessagingTarget, t as looksLikeSignalTargetId } from "./.setup/normalize-l_b99hap.mjs";
+import { a as normalizeSignalAllowRecipient, c as resolveSignalSender, i as isSignalSenderAllowed, l as looksLikeUuid, n as formatSignalSenderDisplay, o as resolveSignalPeerId, r as formatSignalSenderId, s as resolveSignalRecipient, t as formatSignalPairingIdLine } from "./.setup/identity-YXPmgFMu.mjs";
+import { c as resolveSignalReactionLevel, d as markdownToSignalTextChunks, s as signalMessageActions, t as detectSignalTransport, u as markdownToSignalText } from "./.setup/transport-detection-CqyR2vG8.mjs";
+import { n as sendReactionSignal, t as removeReactionSignal } from "./.setup/reaction-runtime-api-BnQGHcrB.mjs";
+import { a as normalizeSignalAccountInput, d as probeSignalTransport, f as writeSignalAccountTransport, p as resolveSignalOutboundTarget, t as signalPlugin, u as prepareSignalManagedNativeTransport } from "./.setup/channel-gMpZmqLx.mjs";
+import { t as signalSetupPlugin } from "./.setup/api-DbdeJVQ8.mjs";
+import { r as installSignalCli } from "./.setup/install-signal-cli-bXeTrTyL.mjs";
+import { t as monitorSignalProvider } from "./.setup/monitor-DAMQw1pZ.mjs";
+import { n as sendReadReceiptSignal, r as sendTypingSignal, t as sendMessageSignal } from "./.setup/send-CcetN4rk.mjs";
+import { t as probeSignal } from "./.setup/probe-IKCS9D-z.mjs";
 export { detectSignalTransport, formatSignalPairingIdLine, formatSignalSenderDisplay, formatSignalSenderId, installSignalCli, isSignalSenderAllowed, listEnabledSignalAccounts, listSignalAccountIds, looksLikeSignalTargetId, looksLikeUuid, markdownToSignalText, markdownToSignalTextChunks, monitorSignalProvider, normalizeSignalAccountInput, normalizeSignalAllowRecipient, normalizeSignalMessagingTarget, prepareSignalManagedNativeTransport, probeSignal, probeSignalTransport, removeReactionSignal, resolveDefaultSignalAccountId, resolveSignalAccount, resolveSignalOutboundTarget, resolveSignalPeerId, resolveSignalReactionLevel, resolveSignalRecipient, resolveSignalSender, sendMessageSignal, sendReactionSignal, sendReadReceiptSignal, sendTypingSignal, signalMessageActions, signalPlugin, signalSetupPlugin, writeSignalAccountTransport };

package/dist/channel-config-api.js

@@ -1,2 +1,2 @@
-import { t as SignalChannelConfigSchema } from "./config-schema-DfEbpMVQ.js";
+import { t as SignalChannelConfigSchema } from "./.setup/config-schema-aQwwMGUj.mjs";
 export { SignalChannelConfigSchema };

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as signalPlugin } from "./channel-CyQvEuyA.js";
+import { t as signalPlugin } from "./.setup/channel-gMpZmqLx.mjs";
 export { signalPlugin };

package/dist/contract-api.js

@@ -1,4 +1,4 @@
-import { n as normalizeSignalMessagingTarget, r as normalizeSignalReactionRecipient, t as looksLikeSignalTargetId } from "./normalize-l_b99hap.js";
-import { i as isSignalSenderAllowed } from "./identity-YXPmgFMu.js";
-import { a as installSignalCliFromRelease, i as installSignalCli, n as downloadToFile, o as looksLikeArchive, r as extractSignalCliArchive, s as pickAsset, t as MAX_SIGNAL_CLI_EXTRACTED_BYTES } from "./install-signal-cli-QlEIfWBv.js";
-export { MAX_SIGNAL_CLI_EXTRACTED_BYTES, downloadToFile, extractSignalCliArchive, installSignalCli, installSignalCliFromRelease, isSignalSenderAllowed, looksLikeArchive, looksLikeSignalTargetId, normalizeSignalMessagingTarget, normalizeSignalReactionRecipient, pickAsset };
+import { n as normalizeSignalMessagingTarget, r as normalizeSignalReactionRecipient, t as looksLikeSignalTargetId } from "./.setup/normalize-l_b99hap.mjs";
+import { i as isSignalSenderAllowed } from "./.setup/identity-YXPmgFMu.mjs";
+import { a as looksLikeArchive, i as installSignalCliFromRelease, n as extractSignalCliArchive, o as pickAsset, r as installSignalCli, t as downloadToFile } from "./.setup/install-signal-cli-bXeTrTyL.mjs";
+export { downloadToFile, extractSignalCliArchive, installSignalCli, installSignalCliFromRelease, isSignalSenderAllowed, looksLikeArchive, looksLikeSignalTargetId, normalizeSignalMessagingTarget, normalizeSignalReactionRecipient, pickAsset };

package/dist/doctor-contract-api.js

@@ -1,2 +1,2 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-api-D0SnglP4.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./.setup/doctor-contract-api-Rbq_sRTI.mjs";
 export { legacyConfigRules, normalizeCompatibilityConfig };

package/dist/reaction-runtime-api.js

@@ -1,2 +1,2 @@
-import { n as sendReactionSignal, t as removeReactionSignal } from "./reaction-runtime-api-CWqDv5-q.js";
+import { n as sendReactionSignal, t as removeReactionSignal } from "./.setup/reaction-runtime-api-BnQGHcrB.mjs";
 export { removeReactionSignal, sendReactionSignal };

package/dist/runtime-api.js

@@ -1,12 +1,12 @@
-import { i as resolveSignalAccount, n as listSignalAccountIds, r as resolveDefaultSignalAccountId, t as listEnabledSignalAccounts } from "./accounts-DO4HMqaK.js";
-import { n as normalizeSignalMessagingTarget, t as looksLikeSignalTargetId } from "./normalize-l_b99hap.js";
-import { a as setSignalRuntime, c as resolveSignalReactionLevel, s as signalMessageActions } from "./transport-detection-Do2pYMAH.js";
-import { n as sendReactionSignal, t as removeReactionSignal } from "./reaction-runtime-api-CWqDv5-q.js";
-import { n as SignalConfigSchema } from "./config-schema-DfEbpMVQ.js";
-import { i as installSignalCli } from "./install-signal-cli-QlEIfWBv.js";
-import { t as monitorSignalProvider } from "./monitor-BiNWxMB3.js";
-import { t as sendMessageSignal } from "./send-Bz0x0JC1.js";
-import { t as probeSignal } from "./probe-kOJqyjWz.js";
+import { i as resolveSignalAccount, n as listSignalAccountIds, r as resolveDefaultSignalAccountId, t as listEnabledSignalAccounts } from "./.setup/accounts-BV6tDOTc.mjs";
+import { n as normalizeSignalMessagingTarget, t as looksLikeSignalTargetId } from "./.setup/normalize-l_b99hap.mjs";
+import { a as setSignalRuntime, c as resolveSignalReactionLevel, s as signalMessageActions } from "./.setup/transport-detection-CqyR2vG8.mjs";
+import { n as sendReactionSignal, t as removeReactionSignal } from "./.setup/reaction-runtime-api-BnQGHcrB.mjs";
+import { n as SignalConfigSchema } from "./.setup/config-schema-aQwwMGUj.mjs";
+import { r as installSignalCli } from "./.setup/install-signal-cli-bXeTrTyL.mjs";
+import { t as monitorSignalProvider } from "./.setup/monitor-DAMQw1pZ.mjs";
+import { t as sendMessageSignal } from "./.setup/send-CcetN4rk.mjs";
+import { t as probeSignal } from "./.setup/probe-IKCS9D-z.mjs";
 import { resolveChannelMediaMaxBytes } from "openclaw/plugin-sdk/account-helpers";
 import { PAIRING_APPROVED_MESSAGE } from "openclaw/plugin-sdk/channel-status";
 import { buildBaseAccountStatusSnapshot, buildBaseChannelStatusSummary, collectStatusIssuesFromLastError, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";

package/dist/setup-entry.js

@@ -1,9 +1,10 @@
 import { defineBundledChannelSetupEntry } from "openclaw/plugin-sdk/channel-entry-contract";
+import { fileURLToPath } from "node:url";
 //#region extensions/signal/setup-entry.ts
 var setup_entry_default = defineBundledChannelSetupEntry({
 	importMetaUrl: import.meta.url,
 	plugin: {
-		specifier: "./api.js",
+		specifier: fileURLToPath(new URL(".setup/api-Cu01dJRP.mjs", import.meta.url).href),
 		exportName: "signalSetupPlugin"
 	}
 });

package/node_modules/zod/README.md

@@ -113,6 +113,33 @@ await schema.parseAsync("hello");
 // => "hello"
 ```
 
+### AOT compilation
+
+For hot validation paths, `z.compile(schema)` returns a schema clone with an ahead-of-time compiled fast path. Valid inputs take the compiled path; invalid inputs fall back to the regular parser so error reporting stays identical.
+
+Across a 55-schema benchmark the median speedup is **2.4x**, and it scales with how much work the schema does per parse: a large array of objects is ~9x, a 20-key object ~9x, a nested object ~4.5x, while a bare `z.string()` gains nothing — compilation removes per-node dispatch and allocation, and a single `typeof` has none to remove.
+
+```ts
+const CompiledPlayer = z.compile(Player);
+
+CompiledPlayer.parse({ username: "billie", xp: 100 });
+```
+
+To enable compilation globally for schemas constructed after import:
+
+```ts
+import "zod/compile"; // place before modules that define schemas
+```
+
+Things to know:
+
+- Compilation uses `new Function`. Global mode is automatically disabled when `z.config({ jitless: true })` is set (e.g. CSP environments); calling `z.compile()` directly is an explicit opt-in.
+- Schemas with async refinements or transforms can't be compiled, and neither can a few other constructs. That is not an error: `z.compile()` hands the schema back unchanged and it keeps using the regular parser, exactly as global mode leaves it. Pass `{ strict: true }` to throw `ZodCompileAsyncError` / `ZodCompileUnsupportedError` instead.
+- On invalid input, refinements and transforms may run twice (fast path, then fallback).
+- Deriving a new schema from a compiled one (`.refine()`, `.extend()`, etc.) returns an uncompiled schema — compile the final schema.
+
+See [`compile` docs](https://zod.dev/compile) for details.
+
 ### Handling errors
 
 When validation fails, the `.parse()` method will throw a `ZodError` instance with granular information about the validation issues.

package/node_modules/zod/compile.cjs

@@ -0,0 +1,77 @@
+"use strict";
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const compile_js_1 = require("./v4/core/compile.cjs");
+const core = __importStar(require("./v4/core/index.cjs"));
+let compiling = false;
+core.globalConfig.postProcessor = (inst) => {
+    if (compiling)
+        return;
+    const originalRun = inst._zod?.run;
+    if (typeof originalRun !== "function")
+        return;
+    const shim = (payload, ctx) => {
+        // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+        if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+            return originalRun(payload, ctx);
+        }
+        compiling = true;
+        try {
+            // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+            if (core.globalConfig.jitless) {
+                inst._zod.run = originalRun;
+                return originalRun(payload, ctx);
+            }
+            // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+            const compiled = (0, compile_js_1.compile)(inst, { strict: true });
+            // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+            inst._zod.run = compiled._zod.run;
+            inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+            inst._zod.bag.validator = compiled._zod.bag.validator;
+        }
+        catch {
+            // Permanent fallback for unsupported schemas.
+            inst._zod.run = originalRun;
+        }
+        finally {
+            compiling = false;
+        }
+        return inst._zod.run(payload, ctx);
+    };
+    // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+    shim.__originalRun = originalRun;
+    inst._zod.run = shim;
+};

package/node_modules/zod/compile.d.cts

@@ -0,0 +1 @@
+export {};

package/node_modules/zod/compile.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/zod/compile.js

@@ -0,0 +1,52 @@
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+import { compile } from "./v4/core/compile.js";
+import * as core from "./v4/core/index.js";
+let compiling = false;
+core.globalConfig.postProcessor = (inst) => {
+    if (compiling)
+        return;
+    const originalRun = inst._zod?.run;
+    if (typeof originalRun !== "function")
+        return;
+    const shim = (payload, ctx) => {
+        // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+        if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+            return originalRun(payload, ctx);
+        }
+        compiling = true;
+        try {
+            // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+            if (core.globalConfig.jitless) {
+                inst._zod.run = originalRun;
+                return originalRun(payload, ctx);
+            }
+            // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+            const compiled = compile(inst, { strict: true });
+            // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+            inst._zod.run = compiled._zod.run;
+            inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+            inst._zod.bag.validator = compiled._zod.bag.validator;
+        }
+        catch {
+            // Permanent fallback for unsupported schemas.
+            inst._zod.run = originalRun;
+        }
+        finally {
+            compiling = false;
+        }
+        return inst._zod.run(payload, ctx);
+    };
+    // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+    shim.__originalRun = originalRun;
+    inst._zod.run = shim;
+};

package/node_modules/zod/index.cjs

@@ -26,8 +26,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.z = void 0;
+exports.default = exports.z = void 0;
 const z = __importStar(require("./v4/classic/external.cjs"));
 exports.z = z;
-__exportStar(require("./v4/classic/external.cjs"), exports);
 exports.default = z;
+__exportStar(require("./v4/classic/external.cjs"), exports);

package/node_modules/zod/index.d.cts

@@ -1,4 +1,3 @@
 import * as z from "./v4/classic/external.cjs";
 export * from "./v4/classic/external.cjs";
-export { z };
-export default z;
+export { z, z as default };

package/node_modules/zod/index.d.ts

@@ -1,4 +1,3 @@
 import * as z from "./v4/classic/external.js";
 export * from "./v4/classic/external.js";
-export { z };
-export default z;
+export { z, z as default };

package/node_modules/zod/index.js

@@ -1,4 +1,7 @@
 import * as z from "./v4/classic/external.js";
 export * from "./v4/classic/external.js";
-export { z };
-export default z;
+// Aliasing the binding, instead of `export default z`, keeps the default export a
+// re-export of `z` rather than a fresh namespace value. Rollup and Webpack can then
+// shake `import z from "zod"` as they already shake `import { z } from "zod"` — without
+// this they pull in every locale. See #6050.
+export { z, z as default };

package/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.4.3",
+  "version": "4.5.4",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",
@@ -10,7 +10,11 @@
   "llmsFull": "https://zod.dev/llms-full.txt",
   "mcpServer": "https://mcp.inkeep.com/zod/mcp",
   "funding": "https://github.com/sponsors/colinhacks",
-  "sideEffects": false,
+  "sideEffects": [
+    "./compile.js",
+    "./compile.cjs",
+    "./src/compile.ts"
+  ],
   "files": [
     "src",
     "**/*.js",
@@ -36,6 +40,7 @@
       "./package.json": "./package.json",
       ".": "./src/index.ts",
       "./mini": "./src/mini/index.ts",
+      "./compile": "./src/compile.ts",
       "./locales": "./src/locales/index.ts",
       "./v3": "./src/v3/index.ts",
       "./v4": "./src/v4/index.ts",
@@ -63,6 +68,12 @@
       "import": "./mini/index.js",
       "require": "./mini/index.cjs"
     },
+    "./compile": {
+      "@zod/source": "./src/compile.ts",
+      "types": "./compile.d.cts",
+      "import": "./compile.js",
+      "require": "./compile.cjs"
+    },
     "./locales": {
       "@zod/source": "./src/locales/index.ts",
       "types": "./locales/index.d.cts",

package/node_modules/zod/src/compile.ts

@@ -0,0 +1,56 @@
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+
+import { compile } from "./v4/core/compile.js";
+import * as core from "./v4/core/index.js";
+
+let compiling = false;
+
+core.globalConfig.postProcessor = (inst: any) => {
+  if (compiling) return;
+  const originalRun = inst._zod?.run;
+  if (typeof originalRun !== "function") return;
+
+  const shim = (payload: any, ctx: any): any => {
+    // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+    if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+      return originalRun(payload, ctx);
+    }
+
+    compiling = true;
+    try {
+      // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+      if (core.globalConfig.jitless) {
+        inst._zod.run = originalRun;
+        return originalRun(payload, ctx);
+      }
+      // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+      const compiled = compile(inst, { strict: true });
+      // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+      inst._zod.run = compiled._zod.run;
+      inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+      inst._zod.bag.validator = compiled._zod.bag.validator;
+    } catch {
+      // Permanent fallback for unsupported schemas.
+      inst._zod.run = originalRun;
+    } finally {
+      compiling = false;
+    }
+
+    return inst._zod.run(payload, ctx);
+  };
+
+  // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+  (shim as any).__originalRun = originalRun;
+
+  inst._zod.run = shim;
+};

package/node_modules/zod/src/index.ts

@@ -1,4 +1,7 @@
 import * as z from "./v4/classic/external.js";
 export * from "./v4/classic/external.js";
-export { z };
-export default z;
+// Aliasing the binding, instead of `export default z`, keeps the default export a
+// re-export of `z` rather than a fresh namespace value. Rollup and Webpack can then
+// shake `import z from "zod"` as they already shake `import { z } from "zod"` — without
+// this they pull in every locale. See #6050.
+export { z, z as default };

package/node_modules/zod/src/v3/ZodError.ts

@@ -238,21 +238,31 @@ export class ZodError<T = any> extends Error {
             const el = issue.path[i]!;
             const terminal = i === issue.path.length - 1;
 
-            if (!terminal) {
-              curr[el] = curr[el] || { _errors: [] };
-              // if (typeof el === "string") {
-              //   curr[el] = curr[el] || { _errors: [] };
-              // } else if (typeof el === "number") {
-              //   const errorArray: any = [];
-              //   errorArray._errors = [];
-              //   curr[el] = curr[el] || errorArray;
-              // }
-            } else {
-              curr[el] = curr[el] || { _errors: [] };
-              curr[el]._errors.push(mapper(issue));
+            // `_errors` is reserved by this legacy format, so merge a matching path segment into the current node instead of treating its array as a child.
+            if (el === "_errors") {
+              if (terminal) curr._errors.push(mapper(issue));
+              i++;
+              continue;
+            }
+
+            // Create `el` as an own data property. A segment naming an inherited member ("toString", "constructor") would otherwise read through to the prototype, and assigning "__proto__" would hit the setter and walk into Object.prototype.
+            if (!Object.prototype.hasOwnProperty.call(curr, el)) {
+              if (el === "__proto__") {
+                Object.defineProperty(curr, el, {
+                  value: { _errors: [] },
+                  writable: true,
+                  enumerable: true,
+                  configurable: true,
+                });
+              } else {
+                curr[el] = { _errors: [] };
+              }
             }
 
             curr = curr[el];
+            if (terminal) {
+              curr._errors.push(mapper(issue));
+            }
             i++;
           }
         }

package/node_modules/zod/src/v3/tests/error.test.ts

@@ -549,3 +549,38 @@ test("when the message is falsy, it is used as is provided", () => {
 //     expect(result.error.issues.length).toEqual(2);
 //   }
 // });
+
+test("format() handles Object.prototype names in the issue path", () => {
+  const result = z
+    .record(z.string(), z.object({ pwn: z.number() }))
+    .safeParse(JSON.parse('{"__proto__": {"pwn": "x"}}'));
+  expect(result.success).toEqual(false);
+  if (!result.success) {
+    // the node must be a real own data property, not the inherited accessor
+    const node = Object.getOwnPropertyDescriptor(result.error.format(), "__proto__")!.value;
+    expect(node.pwn._errors).toHaveLength(1);
+  }
+  expect(({} as any).pwn).toBeUndefined();
+
+  const inherited = z.record(z.string(), z.string()).safeParse(JSON.parse('{"toString": 1}'));
+  expect(inherited.success).toEqual(false);
+  if (!inherited.success) {
+    expect((inherited.error.format() as any).toString._errors).toHaveLength(1);
+  }
+});
+
+test("format() handles an input-derived _errors path", () => {
+  const result = z.object({ parent: z.record(z.string()) }).safeParse({ parent: { _errors: 1 } });
+  expect(result.success).toEqual(false);
+  if (!result.success) {
+    expect(result.error.format().parent?._errors).toEqual(["Expected string, received number"]);
+  }
+
+  const nested = z
+    .object({ parent: z.record(z.object({ child: z.string() })) })
+    .safeParse({ parent: { _errors: { child: 1 } } });
+  expect(nested.success).toEqual(false);
+  if (!nested.success) {
+    expect((nested.error.format() as any).parent.child._errors).toEqual(["Expected string, received number"]);
+  }
+});

package/node_modules/zod/src/v3/tests/intersection.test.ts

@@ -21,6 +21,24 @@ test("object intersection", () => {
   expect(() => z.intersection(BaseTeacher.strict(), HasID).parse({ ...data, extra: 12 })).toThrow();
 });
 
+test("object intersection strips __proto__ from pass-through operands", () => {
+  const cases = [
+    [
+      z.intersection(z.object({ name: z.string() }), z.unknown()),
+      JSON.parse('{"__proto__":{"isAdmin":true},"name":"alice"}'),
+      { name: "alice" },
+    ],
+    [z.intersection(z.record(z.string(), z.unknown()), z.any()), JSON.parse('{"__proto__":{},"a":1}'), { a: 1 }],
+  ] as const;
+
+  for (const [schema, input, expected] of cases) {
+    const parsed = schema.parse(input);
+    expect(parsed).toEqual(expected);
+    expect(Object.getPrototypeOf(parsed)).toBe(Object.prototype);
+    expect(Object.prototype.hasOwnProperty.call(parsed, "__proto__")).toBe(false);
+  }
+});
+
 test("deep intersection", () => {
   const Animal = z.object({
     properties: z.object({

package/node_modules/zod/src/v3/tests/language-server.test.ts

@@ -4,8 +4,7 @@ import { test } from "vitest";
 
 // import { filePath } from "./language-server.source";
 
-// The following tool is helpful for understanding the TypeScript AST associated with these tests:
-// https://ts-ast-viewer.com/ (just copy the contents of language-server.source into the viewer)
+// The following tool is helpful for understanding the TypeScript AST associated with these tests: https://ts-ast-viewer.com/ (just copy the contents of language-server.source into the viewer)
 
 test("", () => {});
 // describe("Executing Go To Definition (and therefore Find Usages and Rename Refactoring) using an IDE works on inferred object properties", () => {

package/node_modules/zod/src/v3/tests/object.test.ts

@@ -122,14 +122,12 @@ test("catchall inference", () => {
 test("catchall overrides strict", () => {
   const o1 = z.object({ first: z.string().optional() }).strict().catchall(z.number());
 
-  // should run fine
-  // setting a catchall overrides the unknownKeys behavior
+  // should run fine setting a catchall overrides the unknownKeys behavior
   o1.parse({
     asdf: 1234,
   });
 
-  // should only run catchall validation
-  // against unknown keys
+  // should only run catchall validation against unknown keys
   o1.parse({
     first: "asdf",
     asdf: 1234,
@@ -144,8 +142,7 @@ test("catchall overrides strict", () => {
     .strict()
     .catchall(z.number());
 
-  // should run fine
-  // setting a catchall overrides the unknownKeys behavior
+  // should run fine setting a catchall overrides the unknownKeys behavior
   o1.parse({
     first: "asdf",
     asdf: 1234,