feat: update to zod v4

[matejchalk]

Updates to Zod 4. This required several changes to our Zod code (see full migration guide if interested):

• Descriptions in options parameter (e.g. z.string({ description: '...' }) or z.object(..., { description: '...' })) are no longer supported, requires additional method call. Used schema.describe('...') (syntax sugar for schema.meta({ description: '...' }), which is itself syntax sugar for z.globalRegistry.add(schema, { description: '...' }) - see metadata in Zod 4).
• The second parameter for refine has been dropped, i.e. .refine(validatorFn, messageFn) no longer works. Seems that error messages can only be set statically via .refine, so I refactored these validations to use the more flexible .check(ctx => ...) method. To reduce verbosity, I've created some helper functions that serve our purposes (see checks.ts and checks.unit.test.ts).
• There was a major breaking change to z.function - it no longer returns a Zod schema, but a function factory. I created a helper function to convert it to a schema, and added metadata so zod2md can recognize the function signature (see function.ts and function.unit.test.ts).
• Contents of Zod errors have changed, had to update a few test assertions.
• Replaced zod-validation-error package with new prettifyError function provided by zod.
• Recursive schemas can be implemented with getters, which removes need for z.lazy for our tree schemas. I had to keep the type annotations in the end, as inferring children type only worked correctly in VSCode, but tsc in our build inferred Record<string, unknown>, leading to build errors in utils and core.
• For z.record, both key and value schemas are now required (keys were implicitly z.string() in v3). Also, enum keys are now exhaustive to match TypeScript behaviour, so z.partialRecord is used where keys are supposed to be optional.

Also updated zod2md, were I recently added support for zod@4.

• Add support for zod/v4 and zod/v4-mini matejchalk/zod2md#18

A few of the Zod methods we're using are now deprecated in v4. I'll refactor those in a follow-up PR.

[github-actions]

Code PushUp

🤨 Code PushUp report has both improvements and regressions – compared current commit cbd31d7 with previous commit ed01057.

🕵️ See full comparison in Code PushUp portal 🔍

🏷️ Categories

🏷️ Category	⭐ Previous score	⭐ Current score	🔄 Score change
Security	🔴 44	🔴 0
Performance	🔴 43	🔴 47
Updates	🟡 74	🟡 77
Code coverage	🟢 90	🟢 90
Documentation	🔴 23	🔴 23
Accessibility	🟢 92	🟢 92	–
Best Practices	🟢 100	🟢 100	–
SEO	🟡 61	🟡 61	–
Type Safety	🟢 100	🟢 100	–
Bug prevention	🟢 100	🟢 100	–
Miscellaneous	🟢 100	🟢 100	–
Code style	🟢 100	🟢 100	–

👍 3 groups improved, 👎 2 groups regressed, 👍 4 audits improved, 👎 6 audits regressed, 14 audits changed without impacting score

🗃️ Groups

🔌 Plugin	🗃️ Group	⭐ Previous score	⭐ Current score	🔄 Score change
JS Packages	NPM audit	🔴 44	🔴 0
Lighthouse	Performance	🔴 43	🔴 47
JS Packages	NPM outdated dependencies	🟡 74	🟡 77
Code coverage	Code coverage metrics	🟢 90	🟢 90
JSDoc coverage	Documentation coverage	🔴 23	🔴 23

16 other groups are unchanged.

🛡️ Audits

🔌 Plugin	🛡️ Audit	📏 Previous value	📏 Current value	🔄 Value change
JS Packages	Vulnerabilities for NPM prod dependencies.	🟨 8 vulnerabilities (4 high, 4 low)	🟥 9 vulnerabilities (1 critical, 2 high, 6 low)
Lighthouse	Largest Contentful Paint	🟥 4.4 s	🟨 3.7 s
JS Packages	Outdated NPM prod dependencies.	🟨 17 outdated package versions (6 major, 7 minor, 4 patch)	🟨 17 outdated package versions (5 major, 6 minor, 6 patch)
Lighthouse	First Contentful Paint	🟥 3.1 s	🟥 3.2 s
Lighthouse	Time to Interactive	🟥 14.2 s	🟥 16.0 s
Lighthouse	Speed Index	🟥 6.7 s	🟥 6.9 s
JSDoc coverage	Functions coverage	🟥 496 undocumented functions	🟥 483 undocumented functions
Code coverage	Function coverage	🟩 93.3 %	🟩 93.1 %
Code coverage	Branch coverage	🟨 85.9 %	🟨 85.8 %
JSDoc coverage	Types coverage	🟥 230 undocumented types	🟥 229 undocumented types
Lighthouse	Avoids enormous network payloads	🟩 Total size was 2,031 KiB	🟩 Total size was 1,997 KiB
Lighthouse	Metrics	🟩 100%	🟩 100%
Lighthouse	JavaScript execution time	🟥 7.0 s	🟥 8.7 s
Lighthouse	Server Backend Latencies	🟩 1,550 ms	🟩 190 ms
Lighthouse	Minimizes main-thread work	🟥 18.3 s	🟥 17.4 s
Lighthouse	Total Blocking Time	🟥 4,050 ms	🟥 4,340 ms
Lighthouse	Max Potential First Input Delay	🟥 1,830 ms	🟥 2,020 ms
Lighthouse	Uses efficient cache policy on static assets	🟨 31 resources found	🟨 31 resources found
Lighthouse	Initial server response time was short	🟩 Root document took 400 ms	🟩 Root document took 420 ms
Lighthouse	Network Round Trip Times	🟩 30 ms	🟩 20 ms
Lighthouse	Avoids an excessive DOM size	🟥 2,271 elements	🟥 2,266 elements
JS Packages	Vulnerabilities for NPM dev dependencies.	🟥 31 vulnerabilities (8 critical, 9 high, 10 moderate, 4 low)	🟥 30 vulnerabilities (8 critical, 9 high, 9 moderate, 4 low)
JS Packages	Outdated NPM dev dependencies.	🟨 56 outdated package versions (29 major, 23 minor, 4 patch)	🟨 55 outdated package versions (29 major, 22 minor, 4 patch)
Code coverage	Line coverage	🟨 86.8 %	🟨 86.8 %

581 other audits are unchanged.

[vmasek]

Thanks for this refactor, I was looking forward to it since the Zod 4 announcement 🚀