fix: zod4 compatibility with server package

packages/runtime/package.json

@@ -112,15 +112,6 @@
         "uuid": "^9.0.0",
         "zod-validation-error": "catalog:"
     },
-    "peerDependencies": {
-        "@prisma/client": "5.0.0 - 6.15.x",
-        "zod": "catalog:"
-    },
-    "author": {
-        "name": "ZenStack Team"
-    },
-    "homepage": "https://zenstack.dev",
-    "license": "MIT",
     "devDependencies": {
         "@types/bcryptjs": "^2.4.2",
         "@types/pluralize": "^0.0.29",
@@ -129,6 +120,16 @@
         "@types/uuid": "^8.3.4",
         "decimal.js-light": "^2.5.1",
         "superjson": "^1.13.0",
-        "uuid": "^9.0.0"
-    }
+        "uuid": "^9.0.0",
+        "zod": "^4.0.0"
+    },
+    "peerDependencies": {
+        "@prisma/client": "5.0.0 - 6.15.x",
+        "zod": "catalog:"
+    },
+    "author": {
+        "name": "ZenStack Team"
+    },
+    "homepage": "https://zenstack.dev",
+    "license": "MIT"
 }

packages/runtime/src/enhancements/node/policy/handler.ts

@@ -1262,7 +1262,7 @@ export class PolicyProxyHandler<DbClient extends DbClientContract> implements Pr
             {}
         );
 
-        const validatedData = this.policyUtils.validateZodSchema(model, 'update', literalData, false, (err) => {
+        const validatedData: any = this.policyUtils.validateZodSchema(model, 'update', literalData, false, (err) => {
             throw this.policyUtils.deniedByPolicy(
                 model,
                 'update',

packages/runtime/src/zod-utils.ts

@@ -121,5 +121,14 @@ function countUnrecognizedKeys(issues: Z.ZodIssue[]) {
 }
 
 function unwrapLazy<T extends Z.ZodSchema>(z: typeof Z, schema: T | Z.ZodLazy<T>): T {
-    return schema instanceof z.ZodLazy ? schema.schema : schema;
+    if (!(schema instanceof z.ZodLazy)) {
+        return schema;
+    }
+    if ('unwrap' in schema && typeof schema.unwrap === 'function') {
+        return schema.unwrap();
+    } else if ('schema' in schema) {
+        return schema.schema as T;
+    } else {
+        throw new Error('Unable to determine how to unwrap a lazy schema with this zod version.');
+    }
 }

packages/server/package.json

@@ -31,7 +31,6 @@
         "superjson": "^1.13.0",
         "ts-japi": "^1.10.1",
         "url-pattern": "^1.0.3",
-        "zod-validation-error": "catalog:",
         "decimal.js": "^10.4.2"
     },
     "peerDependencies": {
@@ -57,7 +56,8 @@
         "next": "14.2.4",
         "nuxt": "^3.7.4",
         "reflect-metadata": "^0.2.2",
-        "supertest": "^6.3.3"
+        "supertest": "^6.3.3",
+        "zod": "^4.0.0"
     },
     "exports": {
         "./package.json": "./package.json",

packages/server/src/api/rest/index.ts

@@ -201,6 +201,7 @@ class RequestHandler extends APIHandlerBase {
                 attributes: z.object({}).passthrough().optional(),
                 relationships: z
                     .record(
+                        z.string(),
                         z.object({
                             data: z.union([
                                 z.object({ type: z.string(), id: z.union([z.string(), z.number()]) }),
@@ -1973,7 +1974,7 @@ class RequestHandler extends APIHandlerBase {
         detail?: string,
         status?: number,
         reason?: string,
-        zodErrors?: ZodError
+        zodErrors?: ZodError<any>
     ) {
         const error: any = {
             status: status ?? this.errors[code].status,

packages/server/src/api/rpc/index.ts

@@ -7,10 +7,9 @@ import {
     isPrismaClientUnknownRequestError,
     isPrismaClientValidationError,
 } from '@zenstackhq/runtime';
-import { upperCaseFirst } from '@zenstackhq/runtime/local-helpers';
+import { upperCaseFirst, getZodErrorMessage } from '@zenstackhq/runtime/local-helpers';
 import SuperJSON from 'superjson';
 import { ZodError } from 'zod';
-import { fromZodError } from 'zod-validation-error/v3';
 import { Response } from '../../types';
 import { APIHandlerBase, RequestContext } from '../base';
 import { logError, registerCustomSerializers } from '../utils';
@@ -202,7 +201,8 @@ class RequestHandler extends APIHandlerBase {
         }
     }
 
-    private makeError(message: string, reason?: string, zodErrors?: ZodError) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    private makeError(message: string, reason?: string, zodErrors?: ZodError<any>) {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const error: any = { message, reason };
         if (reason === CrudFailureReason.ACCESS_POLICY_VIOLATION || reason === CrudFailureReason.RESULT_NOT_READABLE) {
@@ -251,7 +251,7 @@ class RequestHandler extends APIHandlerBase {
             } else {
                 return {
                     data: undefined,
-                    error: fromZodError(parseResult.error).message,
+                    error: getZodErrorMessage(parseResult.error),
                     zodErrors: parseResult.error,
                 };
             }