chore(deps): zod 4 runtime dependency for the 0.7.0 release (floor ^4.4.3)

[willwashburn]

Summary

Supports AgentWorkforce/cloud#4080, which moves the cloud monorepo to a single zod 4 version.

main already moved the source to zod 4 in #35, but the latest published release (0.6.1) still depends on zod 3. Downstream repos are switching to agent-trajectories@^0.7.0, so this should be released as 0.7.0.

Why the floor is ^4.4.3

The zod range in package.json stays ^4.4.3, so cloud can pin zod 4.4.3. zod 4.5.0+ roughly doubles zod/v4/core (about +50 KB gzip). The cloud Cloudflare Worker bundles zod about five times, so ≥4.5 pushes the Worker past its 10 MiB limit. A ^4.6.5 floor would force that onto consumers. An earlier commit in this PR raised the floor to ^4.6.5; the follow-up commit sets it back.

What changed vs main

• package.json: no net change ("zod": "^4.4.3").
• package-lock.json: the dev lock now resolves zod 4.6.5, which is what npm picked. Consumers resolve their own version within ^4.4.3, so cloud's 4.4.3 pin satisfies it.
• The code is already written for zod 4:
  • no zod/v3 imports
  • no errorMap, required_error or invalid_type_error
  • no ZodError.errors (the validation.errors in src/storage/file.ts is the repo's own result field, and it reads .issues)
  • it uses z.iso.datetime() and z.url()
  • there are no z.record calls

Runtime dependency tree

$ npm ls zod --all --omit=dev
agent-trajectories@0.6.1
`-- zod@4.6.5

@agent-relay/sdk (left at ^4.0.4, dev-only)

The root @agent-relay/sdk is only a devDependency. It's used only by the workflows/*.ts agent-relay scripts, which are not built, typechecked or published. Its @agent-relay/config@4.0.4 pulls in zod 3.25.76, but only in the dev tree, so nothing that consumers install includes it.

I couldn't bump it to ^12.2.2. Every release from 8.0.0 on dropped the @agent-relay/sdk/workflows export that those scripts import, and every version that still has that export depends on a zod-3 @agent-relay/config. trail-viewer/server (a private app, not published) has "@agent-relay/sdk": "*".

How to release 0.7.0

The version is set by the Publish Package workflow (.github/workflows/publish.yml), so this PR leaves the version and CHANGELOG alone. The workflow bumps the version, generates the changelog, commits, tags and publishes. After merging:

1. Actions → Publish Package → Run workflow on main.
2. Set version to minor (0.6.1 → 0.7.0), or set custom_version to 0.7.0. Keep tag latest and dry_run false. You can do a dry run first if you like.
3. Check: npm view agent-trajectories@0.7.0 dependencies.zod should print ^4.4.3.

Test plan

• npm run build
• npm run typecheck
• npm run lint
• npm run test:run: 14 files, 257 tests passed
• npm ls zod --all --omit=dev shows only zod 4

🤖 Generated with Claude Code

https://claude.ai/code/session_015pwJbZ21p1TB7MRHXdYjG3

---

Note

Low Risk
Patch-level dependency bump within zod 4 with no application code changes; dev-only tooling may still resolve older zod via @agent-relay/sdk.

Overview
Aligns agent-trajectories with the cloud monorepo’s single zod 4.6.5 line by raising the published runtime floor from ^4.4.3 to ^4.6.5 and refreshing package-lock.json (resolved zod 4.4.3 → 4.6.5). The lockfile also drops an extraneous flag on a bundled is-unicode-supported entry under @clack/prompts.

No source changes are required—the library already targets zod 4 APIs. Consumers should treat this as a 0.7.0 release so downstream repos can depend on zod 4.6.5 without pulling 4.4.x.

^{Reviewed by Cursor Bugbot for commit d13ee5f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T18:11:42.668848Z	0a9e601	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: d3595f22-3723-4abe-a0fe-d9d050c08984

📥 Commits

Reviewing files that changed from the base of the PR and between 2ec99c4 and 0a9e601.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The package manifest updates the Zod dependency range from ^4.4.3 to ^4.6.5.

Changes

Zod dependency update

Layer / File(s)	Summary
Update the Zod version range package.json	The declared Zod dependency range changes from ^4.4.3 to ^4.6.5.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: claude

Merge Risk: ⚪ Minimal · up to 0a9e6

The update resolves Zod to 4.6.5 without an established production compatibility issue, so the PR is mergeable subject to normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to 0a9e6

The change affects 1 system.

Changed systems: package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in package.json: Updated the zod dependency version range from ^4.4.3 to ^4.6.5.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the zod runtime dependency change and the intended 0.7.0 release. Its stated floor of ^4.4.3 conflicts with the summarized change to ^4.6.5, but the title remains directly…
Description check	✅ Passed	The description is directly related to the dependency update, zod 4 compatibility, runtime and development dependency scope, testing, and the intended 0.7.0 release.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the package row
And sees the newer range now show
Zod hops ahead by versions two
The manifest records the change anew
Then tucks the file away to chew}

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}