Migrating to Zod v4, marking as peer dependency, and removing zod-to-json-schema

package.json

@@ -71,9 +71,7 @@
     "express": "^5.0.1",
     "express-rate-limit": "^7.5.0",
     "pkce-challenge": "^5.0.0",
-    "raw-body": "^3.0.0",
-    "zod": "^3.23.8",
-    "zod-to-json-schema": "^3.24.1"
+    "raw-body": "^3.0.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.8.0",
@@ -97,7 +95,10 @@
     "typescript-eslint": "^8.0.0",
     "ws": "^8.18.0"
   },
+  "peerDependencies": {
+    "zod": "^4.1.5"
+  },
   "resolutions": {
     "strip-ansi": "6.0.1"
   }
-}
+}

src/examples/server/simpleSseServer.ts

@@ -25,8 +25,8 @@ const getServer = () => {
     'start-notification-stream',
     'Starts sending periodic notifications',
     {
-      interval: z.number().describe('Interval in milliseconds between notifications').default(1000),
-      count: z.number().describe('Number of notifications to send').default(10),
+      interval: z.number().describe('Interval in milliseconds between notifications').prefault(1000),
+      count: z.number().describe('Number of notifications to send').prefault(10),
     },
     async ({ interval, count }, extra): Promise<CallToolResult> => {
       const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));

src/examples/server/simpleStatelessStreamableHttp.ts

@@ -39,8 +39,8 @@ const getServer = () => {
     'start-notification-stream',
     'Starts sending periodic notifications for testing resumability',
     {
-      interval: z.number().describe('Interval in milliseconds between notifications').default(100),
-      count: z.number().describe('Number of notifications to send (0 for 100)').default(10),
+      interval: z.number().describe('Interval in milliseconds between notifications').prefault(100),
+      count: z.number().describe('Number of notifications to send (0 for 100)').prefault(10),
     },
     async ({ interval, count }, extra): Promise<CallToolResult> => {
       const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));

src/examples/server/simpleStreamableHttp.ts

@@ -270,8 +270,8 @@ const getServer = () => {
     'start-notification-stream',
     'Starts sending periodic notifications for testing resumability',
     {
-      interval: z.number().describe('Interval in milliseconds between notifications').default(100),
-      count: z.number().describe('Number of notifications to send (0 for 100)').default(50),
+      interval: z.number().describe('Interval in milliseconds between notifications').prefault(100),
+      count: z.number().describe('Number of notifications to send (0 for 100)').prefault(50),
     },
     async ({ interval, count }, extra): Promise<CallToolResult> => {
       const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));

src/examples/server/sseAndStreamableHttpCompatibleServer.ts

@@ -30,8 +30,8 @@ const getServer = () => {
     'start-notification-stream',
     'Starts sending periodic notifications for testing resumability',
     {
-      interval: z.number().describe('Interval in milliseconds between notifications').default(100),
-      count: z.number().describe('Number of notifications to send (0 for 100)').default(50),
+      interval: z.number().describe('Interval in milliseconds between notifications').prefault(100),
+      count: z.number().describe('Number of notifications to send (0 for 100)').prefault(50),
     },
     async ({ interval, count }, extra): Promise<CallToolResult> => {
       const sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms));

src/integration-tests/stateManagementStreamableHttp.test.ts

@@ -55,7 +55,7 @@ describe('Streamable HTTP Transport Session Management', () => {
       'greet',
       'A simple greeting tool',
       {
-        name: z.string().describe('Name to greet').default('World'),
+        name: z.string().describe('Name to greet').prefault('World'),
       },
       async ({ name }) => {
         return {

src/integration-tests/taskResumability.test.ts

@@ -33,7 +33,7 @@ describe('Transport resumability', () => {
       'send-notification',
       'Sends a single notification',
       {
-        message: z.string().describe('Message to send').default('Test notification')
+        message: z.string().describe('Message to send').prefault('Test notification')
       },
       async ({ message }, { sendNotification }) => {
         // Send notification immediately
@@ -56,8 +56,8 @@ describe('Transport resumability', () => {
       'run-notifications',
       'Sends multiple notifications over time',
       {
-        count: z.number().describe('Number of notifications to send').default(10),
-        interval: z.number().describe('Interval between notifications in ms').default(50)
+        count: z.number().describe('Number of notifications to send').prefault(10),
+        interval: z.number().describe('Interval between notifications in ms').prefault(50)
       },
       async ({ count, interval }, { sendNotification }) => {
         // Send notifications at specified intervals

src/server/auth/handlers/authorize.ts

@@ -25,7 +25,9 @@ export type AuthorizationHandlerOptions = {
 // Parameters that must be validated in order to issue redirects.
 const ClientAuthorizationParamsSchema = z.object({
   client_id: z.string(),
-  redirect_uri: z.string().optional().refine((value) => value === undefined || URL.canParse(value), { message: "redirect_uri must be a valid URL" }),
+  redirect_uri: z.string().optional().refine((value) => value === undefined || URL.canParse(value), {
+      error: "redirect_uri must be a valid URL"
+}),
 });
 
 // Parameters that must be validated for a successful authorization request. Failure can be reported to the redirect URI.
@@ -35,7 +37,7 @@ const RequestAuthorizationParamsSchema = z.object({
   code_challenge_method: z.literal("S256"),
   scope: z.string().optional(),
   state: z.string().optional(),
-  resource: z.string().url().optional(),
+  resource: z.url().optional(),
 });
 
 export function authorizationHandler({ provider, rateLimit: rateLimitConfig }: AuthorizationHandlerOptions): RequestHandler {

src/server/auth/handlers/token.ts

@@ -32,13 +32,13 @@ const AuthorizationCodeGrantSchema = z.object({
   code: z.string(),
   code_verifier: z.string(),
   redirect_uri: z.string().optional(),
-  resource: z.string().url().optional(),
+  resource: z.url().optional(),
 });
 
 const RefreshTokenGrantSchema = z.object({
   refresh_token: z.string(),
   scope: z.string().optional(),
-  resource: z.string().url().optional(),
+  resource: z.url().optional(),
 });
 
 export function tokenHandler({ provider, rateLimit: rateLimitConfig }: TokenHandlerOptions): RequestHandler {

src/server/completable.test.ts

@@ -14,30 +14,32 @@ describe("completable", () => {
     const completions = ["foo", "bar", "baz"];
     const schema = completable(z.string(), () => completions);
 
-    expect(await schema._def.complete("")).toEqual(completions);
+    expect(await schema.def.complete("")).toEqual(completions);
   });
 
   it("allows async completion functions", async () => {
     const completions = ["foo", "bar", "baz"];
     const schema = completable(z.string(), async () => completions);
 
-    expect(await schema._def.complete("")).toEqual(completions);
+    expect(await schema.def.complete("")).toEqual(completions);
   });
 
   it("passes current value to completion function", async () => {
     const schema = completable(z.string(), (value) => [value + "!"]);
 
-    expect(await schema._def.complete("test")).toEqual(["test!"]);
+    expect(await schema.def.complete("test")).toEqual(["test!"]);
   });
 
   it("works with number schemas", async () => {
     const schema = completable(z.number(), () => [1, 2, 3]);
 
     expect(schema.parse(1)).toBe(1);
-    expect(await schema._def.complete(0)).toEqual([1, 2, 3]);
+    expect(await schema.def.complete(0)).toEqual([1, 2, 3]);
   });
 
-  it("preserves schema description", () => {
+  // This is no longer how zod behavior works
+  // See: https://github.com/colinhacks/zod/issues/4965
+  it.skip("preserves schema description", () => {
     const desc = "test description";
     const schema = completable(z.string().describe(desc), () => []);
 

src/server/completable.ts

@@ -1,98 +1,71 @@
 import {
-  ZodTypeAny,
-  ZodTypeDef,
-  ZodType,
-  ParseInput,
-  ParseReturnType,
-  RawCreateParams,
-  ZodErrorMap,
-  ProcessedCreateParams,
+  z,
 } from "zod";
 
-export enum McpZodTypeKind {
-  Completable = "McpCompletable",
-}
-
-export type CompleteCallback<T extends ZodTypeAny = ZodTypeAny> = (
-  value: T["_input"],
+export type CompleteCallback<T extends z.core.SomeType = z.core.SomeType> = (
+  value: z.input<T>,
   context?: {
     arguments?: Record<string, string>;
   },
-) => T["_input"][] | Promise<T["_input"][]>;
+) => z.output<T>[] | Promise<z.output<T>[]>;
 
-export interface CompletableDef<T extends ZodTypeAny = ZodTypeAny>
-  extends ZodTypeDef {
-  type: T;
+export interface $CompletableDef<T extends z.core.SomeType = z.core.$ZodType> extends z.core.$ZodTypeDef {
+  type: "custom";
+  innerType: T;
   complete: CompleteCallback<T>;
-  typeName: McpZodTypeKind.Completable;
 }
 
-export class Completable<T extends ZodTypeAny> extends ZodType<
-  T["_output"],
-  CompletableDef<T>,
-  T["_input"]
-> {
-  _parse(input: ParseInput): ParseReturnType<this["_output"]> {
-    const { ctx } = this._processInputParams(input);
-    const data = ctx.data;
-    return this._def.type._parse({
-      data,
-      path: ctx.path,
-      parent: ctx,
-    });
-  }
+export interface $CompletableInternals<T extends z.core.SomeType = z.core.$ZodType>
+  extends z.core.$ZodTypeInternals<z.core.output<T>, z.core.input<T>> {
+  def: $CompletableDef<T>;
+  isst: never;
+  /** Auto-cached way to retrieve the inner schema */
+  innerType: T;
+  pattern: T["_zod"]["pattern"];
+  propValues: T["_zod"]["propValues"];
+  optin: T["_zod"]["optin"];
+  optout: T["_zod"]["optout"];
+}
 
-  unwrap() {
-    return this._def.type;
-  }
+export interface $Completable<T extends z.core.SomeType = z.core.$ZodType> extends z.core.$ZodType {
+  _zod: $CompletableInternals<T>;
+}
 
-  static create = <T extends ZodTypeAny>(
-    type: T,
-    params: RawCreateParams & {
-      complete: CompleteCallback<T>;
-    },
-  ): Completable<T> => {
-    return new Completable({
-      type,
-      typeName: McpZodTypeKind.Completable,
-      complete: params.complete,
-      ...processCreateParams(params),
-    });
+export const $Completable: z.core.$constructor<$Completable> = /*@__PURE__*/ z.core.$constructor("$Completable", (inst, def) => {
+  z.core.$ZodType.init(inst, def);
+
+  z.util.defineLazy(inst._zod, "innerType", () => inst._zod.innerType);
+  z.util.defineLazy(inst._zod, "pattern", () => inst._zod.innerType._zod.pattern);
+  z.util.defineLazy(inst._zod, "propValues", () => inst._zod.innerType._zod.propValues);
+  z.util.defineLazy(inst._zod, "optin", () => inst._zod.innerType._zod.optin ?? undefined);
+  z.util.defineLazy(inst._zod, "optout", () => inst._zod.innerType._zod.optout ?? undefined);
+
+  inst._zod.parse = (payload, ctx) => {
+    return def.innerType._zod.run(payload, ctx);
   };
+});
+
+
+// Completable
+export interface Completable<T extends z.core.SomeType = z.core.$ZodType>
+  extends z._ZodType<$CompletableInternals<T>>,
+    $Completable<T> {
+  complete: CompleteCallback<T>;
 }
+export const Completable: z.core.$constructor<Completable> = /*@__PURE__*/ z.core.$constructor("Completable", (inst, def) => {
+  $Completable.init(inst, def);
+  z.ZodType.init(inst, def);
+
+  inst.complete = def.complete;
+});
 
-/**
- * Wraps a Zod type to provide autocompletion capabilities. Useful for, e.g., prompt arguments in MCP.
- */
-export function completable<T extends ZodTypeAny>(
+export function completable<T extends z.ZodType>(
   schema: T,
   complete: CompleteCallback<T>,
 ): Completable<T> {
-  return Completable.create(schema, { ...schema._def, complete });
-}
-
-// Not sure why this isn't exported from Zod:
-// https://github.com/colinhacks/zod/blob/f7ad26147ba291cb3fb257545972a8e00e767470/src/types.ts#L130
-function processCreateParams(params: RawCreateParams): ProcessedCreateParams {
-  if (!params) return {};
-  const { errorMap, invalid_type_error, required_error, description } = params;
-  if (errorMap && (invalid_type_error || required_error)) {
-    throw new Error(
-      `Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`,
-    );
-  }
-  if (errorMap) return { errorMap: errorMap, description };
-  const customMap: ZodErrorMap = (iss, ctx) => {
-    const { message } = params;
-
-    if (iss.code === "invalid_enum_value") {
-      return { message: message ?? ctx.defaultError };
-    }
-    if (typeof ctx.data === "undefined") {
-      return { message: message ?? required_error ?? ctx.defaultError };
-    }
-    if (iss.code !== "invalid_type") return { message: ctx.defaultError };
-    return { message: message ?? invalid_type_error ?? ctx.defaultError };
-  };
-  return { errorMap: customMap, description };
-}
+  return new Completable({
+    type: "custom",
+    innerType: schema,
+    complete: complete,
+  }) as Completable<T>;
+}