chore(deps): move zod to 4.6.4 and raise the runtime zod peer floor to ^4.6.4

.changeset/refresh-scaffold-consumers.md

@@ -2,4 +2,4 @@
 "create-agent-bundle": patch
 ---
 
-Update the `minimal`, `mcp-server`, and `cli-tool` templates to `@types/node` 26.5.1, update the routed templates to React 19.3.0, and move the `mcp-server` template to `@types/react` 19.3.0 while preserving the `zod` 4.5.4 runtime peer floor. (#808)
+Update the `minimal`, `mcp-server`, and `cli-tool` templates to `@types/node` 26.5.1, update the routed templates to React 19.3.0, and move the `mcp-server` template to `@types/react` 19.3.0. (#808)

.changeset/zod-4-6-4-floor.md

@@ -0,0 +1,7 @@
+---
+"@agent-bundle/runtime": minor
+"agent-bundle": patch
+"create-agent-bundle": patch
+---
+
+Raise the `@agent-bundle/runtime` `zod` peer floor from `^4.5.4` to `^4.6.4`: projects on `zod@4.5.x` or earlier must upgrade their direct `zod` dependency before installing the runtime, or npm rejects the required peer with `ERESOLVE`. `agent-bundle` now compiles its bundled schemas with `zod` 4.6.4, and the `cli-tool` and `mcp-server` scaffold templates pin `zod@4.6.4` to satisfy the new peer. (#842)

examples/audiobook-curator/package.json

@@ -29,6 +29,6 @@
     "@types/react": "19.3.0",
     "agent-bundle": "workspace:*",
     "react": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }

examples/host-test/package.json

@@ -27,6 +27,6 @@
     "@types/react": "19.3.0",
     "agent-bundle": "workspace:*",
     "react": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }

examples/mcp-app/package.json

@@ -21,6 +21,6 @@
     "agent-bundle": "workspace:*",
     "playwright": "1.63.0",
     "react": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }

examples/rsc-agent-runtime/package.json

@@ -24,7 +24,7 @@
     "react": "19.3.0",
     "react-dom": "19.3.0",
     "react-server-dom-rspack": "0.1.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   },
   "devDependencies": {
     "@rsbuild/core": "2.2.5",

examples/worktree-proximity/package.json

@@ -27,6 +27,6 @@
     "@types/react": "19.3.0",
     "agent-bundle": "workspace:*",
     "react": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }

packages/agent-bundle/package.json

@@ -139,7 +139,7 @@
     "effect-rstest": "https://pkg.pr.new/ScriptedAlchemy/effect-rstest@e5f8d5f",
     "react": "19.3.0",
     "typescript-5": "npm:typescript@5.9.3",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   },
   "peerDependencies": {
     "@agent-bundle/runtime": ">=0.0.0 <1",

packages/agent-bundle/tests/check-declaration-imports.test.ts

@@ -18,7 +18,7 @@ import { removeTree } from './support/remove-tree.ts';
 const manifest: DeclarationManifest = {
   name: 'fixture-package',
   dependencies: { effect: '4.0.0', '@modelcontextprotocol/client': '2.0.0' },
-  devDependencies: { zod: '4.5.4', 'typescript-5': 'npm:typescript@5.9.3', '@types/node': '26.4.0' },
+  devDependencies: { zod: '4.6.4', 'typescript-5': 'npm:typescript@5.9.3', '@types/node': '26.4.0' },
   exports: {
     '.': { types: './dist/index.d.ts', import: './dist/index.js' },
     './routes': { types: './dist/routes/public.d.ts', import: './dist/routes.js' },
@@ -172,7 +172,7 @@ describe('declarationImportViolations', () => {
     const report = declarationImportViolations({
       manifest: {
         name: 'agent-bundle',
-        devDependencies: { zod: '4.5.4' },
+        devDependencies: { zod: '4.6.4' },
         exports: { './app': { types: './dist/app.d.ts', import: './dist/app.js' } },
       },
       packedPaths: ['dist/app.d.ts', 'dist/app.js'],
@@ -410,7 +410,7 @@ describe('the packed-declaration gate', () => {
     type: 'module',
     exports: { '.': { types: './dist/index.d.ts', import: './dist/index.js' }, './package.json': './package.json' },
     dependencies: { effect: '4.0.0' },
-    devDependencies: { zod: '4.5.4' },
+    devDependencies: { zod: '4.6.4' },
   };
   const badFiles = {
     'package.json': `${JSON.stringify(badManifest, null, 2)}\n`,
@@ -445,7 +445,7 @@ describe('the packed-declaration gate', () => {
   });
 
   it('passes the same pack once the import is declared, and lets --strict fail internal declarations', async () => {
-    const goodManifest = { ...badManifest, name: 'good-fixture', dependencies: { effect: '4.0.0', zod: '4.5.4' }, devDependencies: {} };
+    const goodManifest = { ...badManifest, name: 'good-fixture', dependencies: { effect: '4.0.0', zod: '4.6.4' }, devDependencies: {} };
     const root = await writeFixturePack({
       ...badFiles,
       'package.json': `${JSON.stringify(goodManifest, null, 2)}\n`,

packages/agent-bundle/tests/dev-workbench-packaging.test.ts

@@ -132,7 +132,7 @@ it('packages both react-server render children and renders a route invocation fr
       markdownStream.tarball,
       'react@19.2.8',
       'react-dom@19.2.8',
-      'zod@4.5.4',
+      'zod@4.6.4',
     ], { cwd: consumer, env: installedEnvironment() });
     await mkdir(join(project, 'src', 'mcp', 'status', 'tools'), { recursive: true });
     await Promise.all([

packages/agent-bundle/tests/function-authoring-build.test.ts

@@ -13,7 +13,7 @@ it('runs compiled function events, explicit JSX views, and CLI metadata and JSON
   try {
     await symlink(join(process.cwd(), 'examples/audiobook-curator/node_modules'), join(root, 'node_modules'), 'dir');
     const files = {
-      'package.json': JSON.stringify({ name: 'function-authoring', type: 'module', version: '1.0.0', dependencies: { '@agent-bundle/runtime': 'workspace:*', react: '19.2.8', zod: '4.5.4' } }),
+      'package.json': JSON.stringify({ name: 'function-authoring', type: 'module', version: '1.0.0', dependencies: { '@agent-bundle/runtime': 'workspace:*', react: '19.2.8', zod: '4.6.4' } }),
       'agent-bundle.config.ts': `import { defineConfig } from 'agent-bundle/config'; export default defineConfig({ plugin: { name: 'function-authoring' }, targets: ['claude'] });`,
       'src/providers/unused.ts': `throw new Error('unused provider evaluated'); export default () => 'unused';`,
       'src/providers/policy.ts': `export default () => 'Writes disabled';`,
@@ -157,7 +157,7 @@ it('mounts identities, state, notices, and provider observations in a compiled l
   try {
     await symlink(join(process.cwd(), 'examples/audiobook-curator/node_modules'), join(root, 'node_modules'), 'dir');
     const files = {
-      'package.json': JSON.stringify({ name: 'event-context', type: 'module', version: '1.0.0', dependencies: { '@agent-bundle/runtime': 'workspace:*', zod: '4.5.4' } }),
+      'package.json': JSON.stringify({ name: 'event-context', type: 'module', version: '1.0.0', dependencies: { '@agent-bundle/runtime': 'workspace:*', zod: '4.6.4' } }),
       'agent-bundle.config.ts': `import { defineConfig } from 'agent-bundle/config'; export default defineConfig({ plugin: { name: 'event-context' }, targets: ['claude'] });`,
       'src/state.ts': `import { defineState } from '@agent-bundle/runtime/state'; import { z } from 'zod';
 export default defineState({ id: 'event-context/state', lifetime: 'workspace-durable', initial: { count: 7 }, schema: z.object({ count: z.number() }), events: { tick: z.object({}) }, reduce: (state) => state });`,

packages/agent-bundle/tests/packed-readonly-state-root.test.ts

@@ -94,7 +94,7 @@ it('serves a state-writing tool from a read-only installed artifact without writ
       markdownStream.tarball,
       'react@19.2.8',
       'react-dom@19.2.8',
-      'zod@4.5.4',
+      'zod@4.6.4',
     ], { cwd: project, env: installedEnvironment() });
     const cli = join(project, 'node_modules', '.bin', 'agent-bundle');
     await execFile(cli, ['build', '--root', project, '--output', artifact], {

packages/agent-bundle/tests/packed-stdio-projection.test.ts

@@ -98,7 +98,7 @@ it.each([
       markdownStream.tarball,
       'react@19.2.8',
       'react-dom@19.2.8',
-      'zod@4.5.4',
+      'zod@4.6.4',
     ], { cwd: project, env: installedEnvironment() });
 
     // The fixture selects `claude`, the only target whose capabilities cover

packages/agent-bundle/tests/packed-web-command.test.ts

@@ -105,7 +105,7 @@ beforeAll(async () => {
     markdownStream.tarball,
     'react@19.2.8',
     'react-dom@19.2.8',
-    'zod@4.5.4',
+    'zod@4.6.4',
   ], { cwd: project, env: installedEnvironment() });
   const cli = join(project, 'node_modules', '.bin', 'agent-bundle');
   await execFile(cli, ['build', '--root', project, '--output', artifact], {

packages/agent-bundle/tests/prepack.test.ts

@@ -267,7 +267,7 @@ it('reports package, model, host, and provenance version disagreement as AB7013'
 
 it('reports installed dependencies a consumer never needs as AB7014, per field', () => withPackageDocument(
   (document) => {
-    document.dependencies = { zod: '4.5.4', effect: '4.0.0' };
+    document.dependencies = { zod: '4.6.4', effect: '4.0.0' };
     document.peerDependencies = { react: '19.2.8', 'optional-host': '^1.0.0' };
     document.peerDependenciesMeta = { 'optional-host': { optional: true } };
     document.devDependencies = { 'agent-bundle': 'workspace:*' };
@@ -644,7 +644,7 @@ it('surfaces a warning when the only finding is an unresolvable optional depende
 
 it('accepts a dependency that only packed declaration files reference, including @types for a type directive', () => withPackageDocument(
   (document) => {
-    document.dependencies = { zod: '^4.5.4', '@types/node': '^22.0.0', 'driver-package': '^1.0.0', 'never-loaded': '^1.0.0' };
+    document.dependencies = { zod: '^4.6.4', '@types/node': '^22.0.0', 'driver-package': '^1.0.0', 'never-loaded': '^1.0.0' };
     document.imports = { '#driver': { node: 'driver-package/node', default: 'driver-package' } };
   },
   async () => {

packages/agent-bundle/tests/route-invocation-dev-server.test.ts

@@ -125,7 +125,7 @@ it('invokes compiled tool and event routes through the foreground server', { tim
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/aliased.ts': "export const ALIAS_VALUE = 'aliased';\n",
       'src/cli/greet.tsx': [
         "import { Agent } from '@agent-bundle/runtime';",
@@ -1604,7 +1604,7 @@ it('enforces compiled handler, MCP schemas, and operator env across production s
   const project = await createProjectFixture({
     config: "export default { plugin: { name: 'route-parity' }, targets: ['claude'] };\n",
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/events/tool/before.ts': "export default () => ({ outcome: 'deny', reason: 'blocked' });\n",
       'src/events/tool/before.view.tsx': [
         "export default async function BeforeTool() { throw new Error('handler handler ran'); }",
@@ -1747,7 +1747,7 @@ it('publishes invocation routes only after a successful initial or recovered bui
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/mcp/status/tools/report.tsx': [
       "import { defineTool } from 'agent-bundle/routes';",
       "import { Agent } from '@agent-bundle/runtime';",
@@ -1915,7 +1915,7 @@ it('bounds the render history a compiled child produces by count and bytes acros
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       // One Suspense boundary per cell settles per macrotask, so the stream
       // grows one `replace` snapshot at a time; `gate` names a file the last
       // boundary waits for, or `none`.

packages/agent-bundle/tests/trace-dev-server.test.ts

@@ -39,7 +39,7 @@ it('serves replay and live trace entries and lowers build failures', { timeout:
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/events/tool/before.tsx': [
         "import { Agent } from '@agent-bundle/runtime';",
         "import { createElement } from 'react';",

packages/agent-bundle/tests/workbench-surface-dev-server.test.ts

@@ -28,7 +28,7 @@ it('matches the route manifest and lifecycle inventory a real dev server serves'
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/cli/greet.ts': [
         "import { z } from 'zod';",
         '',

packages/create-agent-bundle/templates/cli-tool/package_json

@@ -31,6 +31,6 @@
     "@agent-bundle/runtime": "workspace:*",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }

packages/create-agent-bundle/templates/mcp-server/package_json

@@ -34,6 +34,6 @@
     "@agent-bundle/runtime": "workspace:*",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }

packages/create-agent-bundle/tests/scaffold.test.ts

@@ -267,7 +267,7 @@ layer(NodeServices.layer, { excludeTestServices: true })('scaffold (real filesys
     expect(cliManifest.devDependencies['@agent-bundle/runtime'])
       .toBe(runtimeSpecForFramework(cliTool.frameworkSpec, testPairing));
     expect(cliManifest.devDependencies['react-dom']).toBe('19.3.0');
-    expect(cliManifest.devDependencies['zod']).toBe('4.5.4');
+    expect(cliManifest.devDependencies['zod']).toBe('4.6.4');
 
     const mcpManifest = yield* readJson<{
       readonly devDependencies: Record<string, string>;

packages/rsc-runtime/package.json

@@ -83,7 +83,7 @@
     "@rspack/core": "^2.2.0-0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
-    "zod": "^4.5.4"
+    "zod": "^4.6.4"
   },
   "peerDependenciesMeta": {
     "@rspack/core": {
@@ -108,6 +108,6 @@
     "micromark-extension-gfm": "3.0.0",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }

packages/rsc-runtime/tests/manifest-contract.test.ts

@@ -60,11 +60,11 @@ describe('@agent-bundle/runtime manifest', () => {
     expect(runtimeManifest.dependencies['rsc-markdown-stream']).toBe('workspace:^');
   });
 
-  it('declares zod as a required caret peer at the proven 4.5.4 floor', () => {
-    expect(peers.zod).toBe('^4.5.4');
+  it('declares zod as a required caret peer at the proven 4.6.4 floor', () => {
+    expect(peers.zod).toBe('^4.6.4');
     expect(runtimeManifest.peerDependenciesMeta).not.toHaveProperty('zod');
     expect(runtimeManifest.dependencies).not.toHaveProperty('zod');
-    expect(runtimeManifest.devDependencies.zod).toBe('4.5.4');
+    expect(runtimeManifest.devDependencies.zod).toBe('4.6.4');
   });
 
   it('documents the React contract the manifest declares', async () => {

packages/rsc-runtime/tests/packed-entry-identity.test.ts

@@ -63,7 +63,7 @@ describe.sequential('packed @agent-bundle/runtime entry identity', () => {
         markdownStream.tarball,
         'react@19.2.8',
         'react-dom@19.2.8',
-        'zod@4.5.4',
+        'zod@4.6.4',
       ], { cwd: consumer, env: installedEnvironment() });
 
       const installed = join(consumer, 'node_modules', '@agent-bundle', 'runtime');

packages/workbench/package.json

@@ -24,7 +24,7 @@
     "react-markdown": "10.1.0",
     "remark-gfm": "4.0.1",
     "shiki": "4.4.3",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   },
   "devDependencies": {
     "@rsbuild/core": "2.2.5",

packages/workbench/tests/streaming-render.e2e.test.ts

@@ -40,7 +40,7 @@ e2e('renders a compiled MCP tool\'s Suspense fallback before its gated child rel
       ].join('\n'),
       files: {
         ...gatedRouteFiles,
-        'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module","version":"1.0.0"}\n',
+        'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module","version":"1.0.0"}\n',
       },
       prefix: 'agent-bundle-streaming-render-e2e-',
     }),