@suveren/gateway 0.39.0 → 0.40.0

package/node_modules/zod/README.md

@@ -10,7 +10,7 @@
 <br/>
 
 <p align="center">
-<a href="https://github.com/colinhacks/zod/actions?query=branch%3Amaster"><img src="https://github.com/colinhacks/zod/actions/workflows/test.yml/badge.svg?event=push&branch=master" alt="Zod CI status" /></a>
+<a href="https://github.com/colinhacks/zod/actions?query=branch%3Amain"><img src="https://github.com/colinhacks/zod/actions/workflows/test.yml/badge.svg?event=push&branch=main" alt="Zod CI status" /></a>
 <a href="https://opensource.org/licenses/MIT" rel="nofollow"><img src="https://img.shields.io/github/license/colinhacks/zod" alt="License"></a>
 <a href="https://www.npmjs.com/package/zod" rel="nofollow"><img src="https://img.shields.io/npm/dw/zod.svg" alt="npm"></a>
 <a href="https://discord.gg/KaSRdyX2vc" rel="nofollow"><img src="https://img.shields.io/discord/893487829802418277?label=Discord&logo=discord&logoColor=white" alt="discord server"></a>
@@ -31,23 +31,6 @@
 <br/>
 <br/>
 
-<h2 align="center">Featured sponsor: Jazz</h2>
-
-<div align="center">
-  <a href="https://jazz.tools/?utm_source=zod">
-    <picture width="85%" >
-      <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/garden-co/jazz/938f6767e46cdfded60e50d99bf3b533f4809c68/homepage/homepage/public/Zod%20sponsor%20message.png">
-      <img alt="jazz logo" src="https://raw.githubusercontent.com/garden-co/jazz/938f6767e46cdfded60e50d99bf3b533f4809c68/homepage/homepage/public/Zod%20sponsor%20message.png" width="85%">
-    </picture>
-  </a>
-  <br/>
-  <p><sub>Learn more about <a target="_blank" rel="noopener noreferrer" href="mailto:sponsorship@colinhacks.com">featured sponsorships</a></sub></p>
-</div>
-
-<br/>
-<br/>
-<br/>
-
 ### [Read the docs →](https://zod.dev/api)
 
 <br/>
@@ -58,7 +41,7 @@
 Zod is a TypeScript-first validation library. Define a schema and parse some data with it. You'll get back a strongly typed, validated result.
 
 ```ts
-import * as z from "zod/v4";
+import * as z from "zod";
 
 const User = z.object({
   name: z.string(),
@@ -104,7 +87,7 @@ npm install zod
 Before you can do anything else, you need to define a schema. For the purposes of this guide, we'll use a simple object schema.
 
 ```ts
-import * as z from "zod/v4";
+import * as z from "zod";
 
 const Player = z.object({
   username: z.string(),
@@ -121,7 +104,7 @@ Player.parse({ username: "billie", xp: 100 });
 // => returns { username: "billie", xp: 100 }
 ```
 
-**Note** — If your schema uses certain asynchronous APIs like `async` [refinements](#refine) or [transforms](#transform), you'll need to use the `.parseAsync()` method instead.
+**Note** — If your schema uses certain asynchronous APIs like `async` [refinements](https://zod.dev/api#refinements) or [transforms](https://zod.dev/api#transforms), you'll need to use the `.parseAsync()` method instead.
 
 ```ts
 const schema = z.string().refine(async (val) => val.length <= 8);
@@ -130,6 +113,33 @@ await schema.parseAsync("hello");
 // => "hello"
 ```
 
+### AOT compilation
+
+For hot validation paths, `z.compile(schema)` returns a schema clone with an ahead-of-time compiled fast path. Valid inputs take the compiled path; invalid inputs fall back to the regular parser so error reporting stays identical.
+
+Across a 55-schema benchmark the median speedup is **2.4x**, and it scales with how much work the schema does per parse: a large array of objects is ~9x, a 20-key object ~9x, a nested object ~4.5x, while a bare `z.string()` gains nothing — compilation removes per-node dispatch and allocation, and a single `typeof` has none to remove.
+
+```ts
+const CompiledPlayer = z.compile(Player);
+
+CompiledPlayer.parse({ username: "billie", xp: 100 });
+```
+
+To enable compilation globally for schemas constructed after import:
+
+```ts
+import "zod/compile"; // place before modules that define schemas
+```
+
+Things to know:
+
+- Compilation uses `new Function`. Global mode is automatically disabled when `z.config({ jitless: true })` is set (e.g. CSP environments); calling `z.compile()` directly is an explicit opt-in.
+- Schemas with async refinements or transforms can't be compiled, and neither can a few other constructs. That is not an error: `z.compile()` hands the schema back unchanged and it keeps using the regular parser, exactly as global mode leaves it. Pass `{ strict: true }` to throw `ZodCompileAsyncError` / `ZodCompileUnsupportedError` instead.
+- On invalid input, refinements and transforms may run twice (fast path, then fallback).
+- Deriving a new schema from a compiled one (`.refine()`, `.extend()`, etc.) returns an uncompiled schema — compile the final schema.
+
+See [`compile` docs](https://zod.dev/compile) for details.
+
 ### Handling errors
 
 When validation fails, the `.parse()` method will throw a `ZodError` instance with granular information about the validation issues.
@@ -145,13 +155,13 @@ try {
         expected: 'string',
         code: 'invalid_type',
         path: [ 'username' ],
-        message: 'Invalid input: expected string'
+        message: 'Invalid input: expected string, received number'
       },
       {
         expected: 'number',
         code: 'invalid_type',
         path: [ 'xp' ],
-        message: 'Invalid input: expected number'
+        message: 'Invalid input: expected number, received string'
       }
     ] */
   }
@@ -169,7 +179,7 @@ if (!result.success) {
 }
 ```
 
-**Note** — If your schema uses certain asynchronous APIs like `async` [refinements](#refine) or [transforms](#transform), you'll need to use the `.safeParseAsync()` method instead.
+**Note** — If your schema uses certain asynchronous APIs like `async` [refinements](https://zod.dev/api#refinements) or [transforms](https://zod.dev/api#transforms), you'll need to use the `.safeParseAsync()` method instead.
 
 ```ts
 const schema = z.string().refine(async (val) => val.length <= 8);

package/node_modules/zod/compile.cjs

@@ -0,0 +1,96 @@
+"use strict";
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const compile_js_1 = require("./v4/core/compile.cjs");
+const core = __importStar(require("./v4/core/index.cjs"));
+let compiling = false;
+core.globalConfig.postProcessor = (inst) => {
+    if (compiling)
+        return;
+    const originalRun = inst._zod?.run;
+    if (typeof originalRun !== "function")
+        return;
+    const shim = (payload, ctx) => {
+        // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+        if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+            return originalRun(payload, ctx);
+        }
+        compiling = true;
+        try {
+            // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+            if (core.globalConfig.jitless) {
+                inst._zod.run = originalRun;
+                return originalRun(payload, ctx);
+            }
+            // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+            const compiled = (0, compile_js_1.compile)(inst, { strict: true });
+            // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+            inst._zod.run = compiled._zod.run;
+            inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+            inst._zod.bag.validator = compiled._zod.bag.validator;
+        }
+        catch {
+            // Permanent fallback for unsupported schemas.
+            inst._zod.run = originalRun;
+        }
+        finally {
+            compiling = false;
+        }
+        return inst._zod.run(payload, ctx);
+    };
+    // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+    shim.__originalRun = originalRun;
+    inst._zod.run = shim;
+};
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/compile.d.cts

@@ -0,0 +1 @@
+export {};

package/node_modules/zod/compile.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/zod/compile.js

@@ -0,0 +1,52 @@
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+import { compile } from "./v4/core/compile.js";
+import * as core from "./v4/core/index.js";
+let compiling = false;
+core.globalConfig.postProcessor = (inst) => {
+    if (compiling)
+        return;
+    const originalRun = inst._zod?.run;
+    if (typeof originalRun !== "function")
+        return;
+    const shim = (payload, ctx) => {
+        // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+        if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+            return originalRun(payload, ctx);
+        }
+        compiling = true;
+        try {
+            // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+            if (core.globalConfig.jitless) {
+                inst._zod.run = originalRun;
+                return originalRun(payload, ctx);
+            }
+            // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+            const compiled = compile(inst, { strict: true });
+            // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+            inst._zod.run = compiled._zod.run;
+            inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+            inst._zod.bag.validator = compiled._zod.bag.validator;
+        }
+        catch {
+            // Permanent fallback for unsupported schemas.
+            inst._zod.run = originalRun;
+        }
+        finally {
+            compiling = false;
+        }
+        return inst._zod.run(payload, ctx);
+    };
+    // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+    shim.__originalRun = originalRun;
+    inst._zod.run = shim;
+};

package/node_modules/zod/index.cjs

@@ -26,8 +26,27 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.z = void 0;
-const z = __importStar(require("./v3/external.cjs"));
+exports.default = exports.z = void 0;
+const z = __importStar(require("./v4/classic/external.cjs"));
 exports.z = z;
-__exportStar(require("./v3/external.cjs"), exports);
 exports.default = z;
+__exportStar(require("./v4/classic/external.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/index.d.cts

@@ -1,4 +1,3 @@
-import * as z from "./v3/external.cjs";
-export * from "./v3/external.cjs";
-export { z };
-export default z;
+import * as z from "./v4/classic/external.cjs";
+export * from "./v4/classic/external.cjs";
+export { z, z as default };

package/node_modules/zod/index.d.ts

@@ -1,4 +1,3 @@
-import * as z from "./v3/external.js";
-export * from "./v3/external.js";
-export { z };
-export default z;
+import * as z from "./v4/classic/external.js";
+export * from "./v4/classic/external.js";
+export { z, z as default };

package/node_modules/zod/index.js

@@ -1,4 +1,7 @@
-import * as z from "./v3/external.js";
-export * from "./v3/external.js";
-export { z };
-export default z;
+import * as z from "./v4/classic/external.js";
+export * from "./v4/classic/external.js";
+// Aliasing the binding, instead of `export default z`, keeps the default export a
+// re-export of `z` rather than a fresh namespace value. Rollup and Webpack can then
+// shake `import z from "zod"` as they already shake `import { z } from "zod"` — without
+// this they pull in every locale. See #6050.
+export { z, z as default };

package/node_modules/zod/locales/index.cjs

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../v4/locales/index.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/locales/index.d.cts

@@ -0,0 +1 @@
+export * from "../v4/locales/index.cjs";

package/node_modules/zod/locales/index.d.ts

@@ -0,0 +1 @@
+export * from "../v4/locales/index.js";

package/node_modules/zod/locales/index.js

@@ -0,0 +1 @@
+export * from "../v4/locales/index.js";

package/node_modules/zod/locales/package.json

@@ -0,0 +1,7 @@
+{ 
+  "type": "module",
+  "main": "./index.cjs",
+  "module": "./index.js",
+  "types": "./index.d.cts",
+  "sideEffects": false
+}

package/node_modules/zod/mini/index.cjs

@@ -0,0 +1,51 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.z = void 0;
+const z = __importStar(require("../v4/mini/external.cjs"));
+exports.z = z;
+__exportStar(require("../v4/mini/external.cjs"), exports);
+
+// seal-cjs-exports
+(function () {
+  var keys = Object.getOwnPropertyNames(exports);
+  for (var i = 0; i < keys.length; i++) {
+    var desc = Object.getOwnPropertyDescriptor(exports, keys[i]);
+    if (!desc || !desc.get || !desc.configurable) continue;
+    var value;
+    try {
+      value = desc.get();
+    } catch (e) {
+      continue;
+    }
+    // a circular require may not have settled this one yet, so leave it live
+    if (value === undefined) continue;
+    Object.defineProperty(exports, keys[i], { value: value, writable: false, enumerable: desc.enumerable, configurable: false });
+  }
+  Object.freeze(exports);
+})();

package/node_modules/zod/mini/index.d.cts

@@ -0,0 +1,3 @@
+import * as z from "../v4/mini/external.cjs";
+export * from "../v4/mini/external.cjs";
+export { z };

package/node_modules/zod/mini/index.d.ts

@@ -0,0 +1,3 @@
+import * as z from "../v4/mini/external.js";
+export * from "../v4/mini/external.js";
+export { z };

package/node_modules/zod/mini/index.js

@@ -0,0 +1,3 @@
+import * as z from "../v4/mini/external.js";
+export * from "../v4/mini/external.js";
+export { z };

package/node_modules/zod/mini/package.json

@@ -0,0 +1,7 @@
+{ 
+  "type": "module",
+  "main": "./index.cjs",
+  "module": "./index.js",
+  "types": "./index.d.cts",
+  "sideEffects": false
+}

package/node_modules/zod/package.json

@@ -1,9 +1,20 @@
 {
   "name": "zod",
-  "version": "3.25.76",
+  "version": "4.6.7",
   "type": "module",
+  "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",
   "description": "TypeScript-first schema declaration and validation library with static type inference",
+  "homepage": "https://zod.dev",
+  "llms": "https://zod.dev/llms.txt",
+  "llmsFull": "https://zod.dev/llms-full.txt",
+  "mcpServer": "https://mcp.inkeep.com/zod/mcp",
+  "funding": "https://github.com/sponsors/colinhacks",
+  "sideEffects": [
+    "./compile.js",
+    "./compile.cjs",
+    "./src/compile.ts"
+  ],
   "files": [
     "src",
     "**/*.js",
@@ -11,10 +22,9 @@
     "**/*.cjs",
     "**/*.d.ts",
     "**/*.d.mts",
-    "**/*.d.cts"
+    "**/*.d.cts",
+    "**/package.json"
   ],
-  "funding": "https://github.com/sponsors/colinhacks",
-  "homepage": "https://zod.dev",
   "keywords": [
     "typescript",
     "schema",
@@ -22,8 +32,6 @@
     "type",
     "inference"
   ],
-  "license": "MIT",
-  "sideEffects": false,
   "main": "./index.cjs",
   "types": "./index.d.cts",
   "module": "./index.js",
@@ -31,6 +39,9 @@
     "exports": {
       "./package.json": "./package.json",
       ".": "./src/index.ts",
+      "./mini": "./src/mini/index.ts",
+      "./compile": "./src/compile.ts",
+      "./locales": "./src/locales/index.ts",
       "./v3": "./src/v3/index.ts",
       "./v4": "./src/v4/index.ts",
       "./v4-mini": "./src/v4-mini/index.ts",
@@ -39,9 +50,10 @@
       "./v4/locales": "./src/v4/locales/index.ts",
       "./v4/locales/*": "./src/v4/locales/*"
     },
-    "sourceDialects": [
-      "@zod/source"
-    ]
+    "conditions": {
+      "@zod/source": "src"
+    },
+    "sealCjsExports": true
   },
   "exports": {
     "./package.json": "./package.json",
@@ -51,6 +63,24 @@
       "import": "./index.js",
       "require": "./index.cjs"
     },
+    "./mini": {
+      "@zod/source": "./src/mini/index.ts",
+      "types": "./mini/index.d.cts",
+      "import": "./mini/index.js",
+      "require": "./mini/index.cjs"
+    },
+    "./compile": {
+      "@zod/source": "./src/compile.ts",
+      "types": "./compile.d.cts",
+      "import": "./compile.js",
+      "require": "./compile.cjs"
+    },
+    "./locales": {
+      "@zod/source": "./src/locales/index.ts",
+      "types": "./locales/index.d.cts",
+      "import": "./locales/index.js",
+      "require": "./locales/index.cjs"
+    },
     "./v3": {
       "@zod/source": "./src/v3/index.ts",
       "types": "./v3/index.d.cts",
@@ -108,11 +138,10 @@
   },
   "scripts": {
     "clean": "git clean -xdf . -e node_modules",
-    "build": "zshy --project tsconfig.build.json",
-    "postbuild": "pnpm biome check --write .",
-    "test:watch": "pnpm vitest",
-    "test": "pnpm vitest run",
-    "bump:beta": "pnpm version \"v$(pnpm pkg get version | jq -r)-beta.$(date +%Y%m%dT%H%M%S)\"",
-    "pub:beta": "pnpm bump:beta && pnpm publish --tag next --publish-branch v4 --no-git-checks --dry-run"
+    "build": "nub exec --node zshy --project tsconfig.build.json",
+    "postbuild": "nub ../../scripts/write-stub-package-jsons.ts && nub exec --node biome check --write .",
+    "test:watch": "nub exec --node vitest",
+    "test": "nub exec --node vitest run",
+    "prepublishOnly": "nub ../../scripts/check-versions.ts"
   }
 }

package/node_modules/zod/src/compile.ts

@@ -0,0 +1,56 @@
+// Side-effect-only: installs the post-processor on `globalConfig`. Listed in `package.json`'s `sideEffects`, and nothing else references it, so apps that never import it drop the compiler.
+//
+// Usage:
+//
+//   import "zod/compile";
+//   import * as z from "zod";
+//   // every schema constructed below this is compiled on first parse
+//
+// Module evaluation order matters: schemas constructed in modules that evaluate before this import will not be compiled. Place this import in the app entry point, before any module that constructs schemas at top level.
+//
+// Failure handling: if the compiler refuses a schema (async refinement, unsupported feature, etc.) the shim permanently restores the runtime `_zod.run` for that schema. The schema continues to work via the regular runtime parser — no observable difference to the caller.
+
+import { compile } from "./v4/core/compile.js";
+import * as core from "./v4/core/index.js";
+
+let compiling = false;
+
+core.globalConfig.postProcessor = (inst: any) => {
+  if (compiling) return;
+  const originalRun = inst._zod?.run;
+  if (typeof originalRun !== "function") return;
+
+  const shim = (payload: any, ctx: any): any => {
+    // Bypass the fast path for any non-forward / non-sync / check-skipping call. The runtime owns those contracts.
+    if (ctx?.async || ctx?.direction === "backward" || ctx?.skipChecks) {
+      return originalRun(payload, ctx);
+    }
+
+    compiling = true;
+    try {
+      // Respect the jitless config: it exists precisely so CSP/no-eval environments never reach `new Function`. Global mode must not bypass it (explicit z.compile calls remain an explicit opt-in).
+      if (core.globalConfig.jitless) {
+        inst._zod.run = originalRun;
+        return originalRun(payload, ctx);
+      }
+      // Strict: the shim owns its own fallback below, and a non-strict compile would hand back `inst` — whose run is this shim — and reinstall it on itself.
+      const compiled = compile(inst, { strict: true });
+      // Only the run wrapper. Copying the compiled parse/safeParse closures would make their fallback re-enter this instance and run user callbacks a third time.
+      inst._zod.run = compiled._zod.run;
+      inst._zod.bag.fallbackRun = compiled._zod.bag.fallbackRun;
+      inst._zod.bag.validator = compiled._zod.bag.validator;
+    } catch {
+      // Permanent fallback for unsupported schemas.
+      inst._zod.run = originalRun;
+    } finally {
+      compiling = false;
+    }
+
+    return inst._zod.run(payload, ctx);
+  };
+
+  // Expose the pre-shim runtime so `compile()` invoked elsewhere can unwrap past the shim and capture the source-of-truth runtime. Without this, a user calling `z.compile(s)` after global mode is enabled would capture the shim itself, which would feed the wrapper into itself on fallback.
+  (shim as any).__originalRun = originalRun;
+
+  inst._zod.run = shim;
+};

package/node_modules/zod/src/index.ts

@@ -1,4 +1,7 @@
-import * as z from "./v3/external.js";
-export * from "./v3/external.js";
-export { z };
-export default z;
+import * as z from "./v4/classic/external.js";
+export * from "./v4/classic/external.js";
+// Aliasing the binding, instead of `export default z`, keeps the default export a
+// re-export of `z` rather than a fresh namespace value. Rollup and Webpack can then
+// shake `import z from "zod"` as they already shake `import { z } from "zod"` — without
+// this they pull in every locale. See #6050.
+export { z, z as default };

package/node_modules/zod/src/locales/index.ts

@@ -0,0 +1 @@
+export * from "../v4/locales/index.js";