feat!: migrate to zod 4 (BREAKING — peer dep ^4.4.3)

[Changsik00]

Summary

zod 3 → 4 migration. Public API and runtime semantics preserved; consumer migration is mechanical (schema-definition syntax only).

Why

Required to allow @env-kit/node-settings to be wrapped from a zod 4 monorepo (e.g., service-foundry ADR-0002 + ADR-0010 — see spec-x-auth-foundation-prep).

Internal changes

• _def.typeName → _def.type (lower-cased values)
• ZodEnum / ZodNativeEnum unified under `enum`
• ZodEffects / ZodPipeline → `pipe` (with `in` / `out`)
• `_def.defaultValue` is a direct value (zod 3 was a thunk)
• `ZodError.errors` → `ZodError.issues`
• ZodError path stringified (zod 4 may emit numeric segments)

Verification

• ✅ node_modules/.bin/tsc --noEmit — 0 errors
• ✅ vitest run — 294/294 pass
• ✅ tsc -b tsconfig.build.json — dist builds clean

Migration guide for consumers

Bump zod to ^4.4.3. Schema syntax adjustments at consumer sites only (out of this library's surface):

// zod 3
z.string().email()
z.string().uuid()

// zod 4
z.email()
z.uuid()

ZodError.errors consumers must rename to .issues.

Test plan

• All existing tests pass under zod 4.4.3
• typecheck clean
• build succeeds
• (manual) npm publish + consumer (service-foundry) verifies

🤖 Generated with Claude Code