From 18452222d3855d4d027dbc1775a30001f74949a2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Apr 2026 01:13:21 +0000
Subject: [PATCH 1/2] chore(deps): bump zod from 3.25.76 to 4.3.6

Bumps [zod](https://github.com/colinhacks/zod) from 3.25.76 to 4.3.6.
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](https://github.com/colinhacks/zod/compare/v3.25.76...v4.3.6)

---
updated-dependencies:
- dependency-name: zod
  dependency-version: 4.3.6
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 32f9193..ea1b355 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,7 @@
         "commander": "^12.0.0",
         "pino": "^10.3.1",
         "yaml": "^2.4.0",
-        "zod": "^3.23.0"
+        "zod": "^4.3.6"
       },
       "bin": {
         "mcp-contract-kit": "dist/src/cli.js"
@@ -4534,9 +4534,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
+      "version": "4.3.6",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
+      "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/package.json b/package.json
index b43b508..b824a94 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
     "commander": "^12.0.0",
     "pino": "^10.3.1",
     "yaml": "^2.4.0",
-    "zod": "^3.23.0"
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@types/cli-progress": "^3.11.5",

From 5ca5080aacbbecd7f9daaae2d1bf0eb191c7b0cf Mon Sep 17 00:00:00 2001
From: reaatech <138725666+reaatech@users.noreply.github.com>
Date: Tue, 28 Apr 2026 18:20:09 -0700
Subject: [PATCH 2/2] fix: update z.record() calls for zod 4 API change

---
 src/types/schemas.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/types/schemas.ts b/src/types/schemas.ts
index 16b278f..7139d31 100644
--- a/src/types/schemas.ts
+++ b/src/types/schemas.ts
@@ -42,7 +42,7 @@ export const MCPRequestSchema = z.object({
   jsonrpc: z.literal('2.0'),
   method: z.string().min(1),
   id: z.union([z.string(), z.number()]),
-  params: z.record(z.unknown()).optional(),
+  params: z.record(z.string(), z.unknown()).optional(),
 });
 
 /**
@@ -82,7 +82,7 @@ export const ToolDefinitionSchema = z.object({
       'Tool name must start with lowercase letter and contain only lowercase letters, numbers, underscores, and hyphens',
     ),
   description: z.string().min(1, 'description is required'),
-  inputSchema: z.record(z.unknown()),
+  inputSchema: z.record(z.string(), z.unknown()),
 });
 
 /** Type inference */
@@ -98,7 +98,7 @@ export const AgentRequestContractSchema = z.object({
   raw_input: z.string().min(1, 'raw_input is required'),
   display_name: z.string().optional(),
   intent_summary: z.string().optional(),
-  entities: z.record(z.unknown()).optional(),
+  entities: z.record(z.string(), z.unknown()).optional(),
   turn_history: z
     .array(
       z.object({
@@ -107,7 +107,7 @@ export const AgentRequestContractSchema = z.object({
       }),
     )
     .optional(),
-  workflow_state: z.record(z.unknown()).optional(),
+  workflow_state: z.record(z.string(), z.unknown()).optional(),
 });
 
 /** Type inference */
@@ -119,7 +119,7 @@ export type AgentRequestContract = z.infer<typeof AgentRequestContractSchema>;
 export const AgentResponseContractSchema = z.object({
   content: z.string().min(1, 'content must be a non-empty string'),
   workflow_complete: z.boolean(),
-  workflow_state: z.record(z.unknown()).optional(),
+  workflow_state: z.record(z.string(), z.unknown()).optional(),
   isError: z.boolean().optional(),
   errorMessage: z.string().optional(),
 });