fix(deps): upgrade zod to v4, prepar e npm publish, fix CI peer-dep conflict

[chrisleekr]

Description

Upgrades Zod from v3 to v4, prepares the package for publishing to npm.js, and fixes a failing CI job caused by a peer dependency conflict between @anthropic-ai/claude-agent-sdk (which requires zod@^4.0.0) and the previously pinned zod@^3.24.4.

Root cause of CI failure

The semantic-release.yml workflow installs semantic-release tools via npm install --no-save. npm v7+'s strict peer-dep resolver detected that @anthropic-ai/claude-agent-sdk@0.2.44 requires zod@^4.0.0 while the project had zod@3.25.76 installed, causing ERESOLVE and aborting the release job.

Before (CI fails)

flowchart TD
    A["bun install (zod@3.25.76)"] --> B["npm install semantic-release"]
    B --> C["ERESOLVE: @anthropic-ai/claude-agent-sdk needs zod@^4.0.0"]
    C --> D["❌ CI job fails"]

Loading

After (CI passes)

flowchart TD
    A["bun install (zod@4.3.6)"] --> B["npm install semantic-release"]
    B --> C["✅ Peer deps satisfied"]
    C --> D["npx semantic-release runs"]

Loading

Changes

zod upgrade to v4

• Bumped "zod": "^3.24.4" → "^4.0.0" in package.json
• Replaced 3 uses of z.ZodIssueCode.custom with the string literal "custom" in src/config.ts — the ZodIssueCode enum is a v3 internal not guaranteed in v4
• Added "overrides": { "zod": "^4.0.0" } to force Bun to deduplicate to a single Zod v4 instance across all nested packages (prevents TypeScript type identity conflicts between zod@3.x and zod@4.x copies)
• Bumped @modelcontextprotocol/sdk min version to ^1.26.0 (current resolved version that explicitly supports zod@^3.25 || ^4.0)

npm publish preparation

• Renamed package from invalid "chrisleekr/github-app-playground" → "@chrisleekr/github-app-playground" (scoped npm name)
• Removed "private": true
• Added "main", "bin", "files", "publishConfig": { "access": "public" } fields
• Added "prepublishOnly": "bun run clean && NODE_ENV=production bun run build" to guarantee a clean production build before publishing
• Added "clean": "rm -rf dist" script
• Created .npmignore to exclude src/, test/, scripts/, .github/ etc. from the tarball

Pre-existing lint fix in src/core/executor.ts

• ESLint's TypeScript plugin could not resolve the message type from the SDK's async generator, causing no-unsafe-member-access and no-unsafe-assignment errors
• Imported SDKResultMessage from the SDK; replaced the ad-hoc inline result type with the SDK's own concrete type
• Added a proper isResultMessage(msg: unknown): msg is SDKResultMessage type guard — operates on unknown, narrows safely, no eslint-disable comments

Related Issues

• Closes the CI failure: https://github.com/chrisleekr/github-app-playground/actions/runs/22136228175/job/63989600308

Testing

• I have tested these changes locally
• I have added/updated tests as needed
• All existing tests pass

108/108 tests pass · 0 TypeScript errors · 0 ESLint errors · npm publish --dry-run succeeds (2.0 MB compressed, 9 files)

[chrisleekr]

🎉 This PR is included in version 1.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀