fix(core): keep composed schemas on Zod 4

Author: carderne

packages/core/src/v3/schemas/reports.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 // Shared contract for `GET /api/v1/reports/:key`: the period grammar and the `format=json` body.
 // The view model is semantic, not a UI tree: reasons are codes the renderer resolves to prose.

packages/core/src/v3/schemas/scheduleWindow.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 export const MAX_ABSOLUTE_SCHEDULE_WINDOW_SECONDS = 24 * 60 * 60;
 

packages/core/src/v3/schemas/schemaCompositionCompatibility.test.ts

@@ -0,0 +1,74 @@
+import { build } from "esbuild";
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const require = createRequire(import.meta.url);
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
+
+describe("schema composition compatibility", () => {
+  it("parses Zod 4 parent schemas when the root Zod export resolves to Zod 3", async () => {
+    const result = await build({
+      stdin: {
+        contents: `
+          import { ScheduleMetadata, WebhookMetadata } from "./src/v3/schemas/schemas.ts";
+          import { WebhookResource } from "./src/v3/schemas/resources.ts";
+
+          const verifierArtifact = {
+            kind: "preset",
+            preset: "stripe",
+            config: { scheme: "shared-secret", placement: "header" },
+          };
+          const routingTarget = { type: "task", taskId: "my-task" };
+
+          export const parsed = {
+            schedule: ScheduleMetadata.parse({
+              cron: "0 0 * * *",
+              timezone: "UTC",
+              window: "10%",
+            }),
+            metadata: WebhookMetadata.parse({
+              id: "my-webhook",
+              source: "stripe",
+              verifierArtifact,
+              routingTarget,
+            }),
+            resource: WebhookResource.parse({
+              id: "my-webhook",
+              filePath: "src/trigger.ts",
+              source: "stripe",
+              verifierArtifact,
+              routingTarget,
+            }),
+          };
+        `,
+        loader: "ts",
+        resolveDir: packageRoot,
+      },
+      bundle: true,
+      format: "esm",
+      platform: "node",
+      target: "node20",
+      write: false,
+      plugins: [
+        {
+          name: "resolve-root-zod-to-v3",
+          setup(build) {
+            build.onResolve({ filter: /^zod$/ }, () => ({ path: require.resolve("zod/v3") }));
+          },
+        },
+      ],
+    });
+
+    const bundledModule = await import(
+      `data:text/javascript;base64,${Buffer.from(result.outputFiles[0].text).toString("base64")}`
+    );
+
+    expect(bundledModule.parsed).toMatchObject({
+      schedule: { window: "10%" },
+      metadata: { id: "my-webhook" },
+      resource: { id: "my-webhook" },
+    });
+  });
+});

packages/core/src/v3/schemas/webhookApi.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 // Reuse the source-side enum (provider | integrator | either) rather than redefining it.
 import { WebhookSecretProvisioning } from "./webhookConfig.js";
 

packages/core/src/v3/schemas/webhookConfig.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 // Ingress webhook verification config. Kept in a LEAF module (imports only `z`) so it
 // can be consumed by resources.ts / schemas.ts without dragging in the alert-webhook

packages/core/src/v3/schemas/webhookFilter.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 // Webhook delivery filter: server-side predicate gating routing. LEAF module (imports only `z`).