[robinbowes]

Summary

This moves the kit to zod 4 (^3.25.76 → ^4.6.7) and AG-UI 1.0 (0.0.59 → 1.0.3, exact pins) in one PR, because neither type-checks without the other. AG-UI 1.0's validators are zod 4 schemas, and kitAguiEventSchema is a z.discriminatedUnion over them:

packages/shared/src/ai/agui.ts
  import { EventType, type Interrupt } from '@ag-ui/core'          # main entry: types only in 1.0
  import { …EventSchema, InterruptSchema, … } from '@ag-ui/core/schemas'
  kitAguiEventSchema = z.discriminatedUnion('type', [ …AG-UI schemas ])   # one zod, the host's (AG-UI takes it as a peer)

Behaviour changes:

Change	Why
Protobuf now carries TOOL_CALL_RESULT (PROTO_UNSUPPORTED_EVENTS = [])	@ag-ui/proto@1.0.3 has the message. A new test round-trips the whole event, not just its type.
example-feature's PATCH no longer fills body: ''	zod 4 applies .default() under .partial(), so PATCH { title } would have wiped the body. The update schema is rebuilt without the default. An audit of every .partial() found no other affected schema.
zod-to-json-schema removed; toolInputSchema() uses z.toJSONSchema	That package is zod 3 only. The options are draft-7, input side (so defaulted fields are optional) and lenient on unrepresentable types, the same as before.

Type-level changes:

• ZodTypeDef is gone, so the UI's api-client.ts inferred every response as {} until its signature became z.ZodType<T, unknown>.
• z.record needs a key schema.
• invalid_type_error is now error.
• ZodObject generics changed.
• TOOL_CALL_RESULT.content is string | ContentPart[]. The kit still emits strings, and its readers now narrow.

Plugin API (docs/plugin-api.md, regenerated):

• JobVariant is now ZodObject<{ type: ZodTypeAny } & ZodRawShape>.
• JobTypeOf reads the variant's shape.type.
• Exported schema types print with zod 4's names.

The type test pinning JobTypeOf<Orders> to 'orders.sync' still passes.

Docs: docs/CONCEPTS.md §9's known gaps drop "protobuf drops TOOL_CALL_RESULT" and "@ag-ui/core is 0.0.x", and add that a cancelled run doesn't emit AG-UI 1.0's cancelled RUN_FINISHED outcome.

Left for later:

• Deprecated zod 4 forms (.uuid(), .email(), .passthrough(), .strict()) still work, and no tool reports them. Moving to z.uuid() and the like would be about 200 lines of churn, so it's left for a separate PR.
• The protobuf drop check in createAguiEncoder never fires while the list is empty. I kept it because the contract test compares the list with a real round-trip, so the next upstream gap fails loudly.

Evidence

• Before: with the bumps alone, pnpm typecheck gives 12 errors in shared, then 325 in web (pages inferring {}).
  After: pnpm gate passes on Node 26.13.0: api 638, the other web projects 1807 + 5 skipped (2 new tests), driver 13, cli 58, evals 25.
• The PATCH bug, test first: the new test failed with + "body": "" before the fix and passes after.
• The analytics plugin under zod 4: in a throwaway worktree I reproduced kit.yml's plugins job (plugin add …@3.4.2, db:generate, migrate, GATE_SUITE_DRIVER=neon pnpm gate). Typecheck, build, api 685 and the rest passed. The one failure was local only: my global gitignore hides .claude/, and with the skill files staged it passes.
• The review gate approved with 0 findings.

Merge Danger

Door: two-way

Blast Radius: plugins

Plugins compile against the host's zod, so a plugin with zod 3–only code (ZodTypeDef, single-argument z.record, .partial() over defaults) breaks on a host that takes this. The porting note's steps 27–34 cover the migration, including the .partial() audit.

🤖 Generated with Claude Code