chore(deps)(deps): bump zod from 3.24.2 to 4.4.3

packages/cli/package.json

@@ -48,7 +48,7 @@
 		"pg": "8.20.0",
 		"picocolors": "^1.1.1",
 		"posthog-node": "^5.33.5",
-		"zod": "^4.3.6"
+		"zod": "^4.4.3"
 	},
 	"peerDependencies": {
 		"@cipherstash/stack": ">=0.6.0"

packages/migrate/package.json

@@ -42,7 +42,7 @@
     "lint": "biome check ."
   },
   "dependencies": {
-    "zod": "^3.24.2"
+    "zod": "^4.4.3"
   },
   "peerDependencies": {
     "@cipherstash/stack": ">=0.6.0",

packages/migrate/src/manifest.ts

@@ -69,7 +69,7 @@ const ManifestColumnSchema = z.object({
 const ManifestSchema = z.object({
   version: z.literal(1).default(1),
   /** Map of table name → array of column intents for that table. */
-  tables: z.record(z.array(ManifestColumnSchema)),
+  tables: z.record(z.string(), z.array(ManifestColumnSchema)),
 })
 
 export type Manifest = z.infer<typeof ManifestSchema>

packages/protect/package.json

@@ -73,7 +73,7 @@
 		"@cipherstash/schema": "workspace:*",
 		"@stricli/core": "^1.2.6",
 		"dotenv": "17.4.2",
-		"zod": "^3.24.2"
+		"zod": "^4.4.3"
 	},
 	"optionalDependencies": {
 		"@rollup/rollup-linux-x64-gnu": "4.60.3"

packages/schema/package.json

@@ -41,7 +41,7 @@
 		"vitest": "catalog:repo"
 	},
 	"dependencies": {
-		"zod": "^3.24.2"
+		"zod": "^4.4.3"
 	},
 	"publishConfig": {
 		"access": "public"

packages/schema/src/index.ts

@@ -78,18 +78,24 @@ const indexesSchema = z
   })
   .default({})
 
+// `.prefault` (not `.default`) because the default `{}` is an *input* value
+// that must be parsed to fill in `cast_as` and `indexes` defaults. In zod 4
+// `.default` takes an already-parsed output value and skips parsing.
 const columnSchema = z
   .object({
     cast_as: castAsEnum,
     indexes: indexesSchema,
   })
-  .default({})
+  .prefault({})
 
-const tableSchema = z.record(columnSchema).default({})
+const tableSchema = z.record(z.string(), columnSchema).default({})
 
-const tablesSchema = z.record(tableSchema).default({})
+const tablesSchema = z.record(z.string(), tableSchema).default({})
 
-export const encryptConfigSchema = z.object({
+// Annotated as ZodType<EncryptConfig> so the emitted .d.ts exposes a shallow
+// type. The fully-inferred zod 4 type for this triply-nested record is too
+// deep for consumers to instantiate, which degrades `tables` to `unknown`.
+export const encryptConfigSchema: z.ZodType<EncryptConfig> = z.object({
   v: z.number(),
   tables: tablesSchema,
 })
@@ -127,7 +133,10 @@ export type ProtectTableColumn = {
             }
       }
 }
-export type EncryptConfig = z.infer<typeof encryptConfigSchema>
+export type EncryptConfig = {
+  v: number
+  tables: Record<string, Record<string, ColumnSchema>>
+}
 
 // ------------------------
 // Interface definitions

packages/stack/package.json

@@ -206,7 +206,7 @@
 		"@cipherstash/protect-ffi": "0.21.4",
 		"evlog": "1.9.0",
 		"uuid": "14.0.0",
-		"zod": "3.24.2"
+		"zod": "4.4.3"
 	},
 	"peerDependencies": {
 		"@supabase/supabase-js": ">=2",

packages/stack/src/schema/index.ts

@@ -128,19 +128,25 @@ const indexesSchema = z
   })
   .default({})
 
+// `.prefault` (not `.default`) because the default `{}` is an *input* value
+// that must be parsed to fill in `cast_as` and `indexes` defaults. In zod 4
+// `.default` takes an already-parsed output value and skips parsing.
 const columnSchema = z
   .object({
     cast_as: castAsEnum,
     indexes: indexesSchema,
   })
-  .default({})
+  .prefault({})
 
-const tableSchema = z.record(columnSchema).default({})
+const tableSchema = z.record(z.string(), columnSchema).default({})
 
-const tablesSchema = z.record(tableSchema).default({})
+const tablesSchema = z.record(z.string(), tableSchema).default({})
 
+// Annotated as ZodType<EncryptConfig> so the emitted .d.ts exposes a shallow
+// type. The fully-inferred zod 4 type for this triply-nested record is too
+// deep for consumers to instantiate, which degrades `tables` to `unknown`.
 /** @internal */
-export const encryptConfigSchema = z.object({
+export const encryptConfigSchema: z.ZodType<EncryptConfig> = z.object({
   v: z.number(),
   tables: tablesSchema,
 })
@@ -183,7 +189,10 @@ export type EncryptedTableColumn = {
             }
       }
 }
-export type EncryptConfig = z.infer<typeof encryptConfigSchema>
+export type EncryptConfig = {
+  v: number
+  tables: Record<string, Record<string, ColumnSchema>>
+}
 
 // ------------------------
 // Interface definitions

packages/wizard/package.json

@@ -31,7 +31,7 @@
 		"pg": "8.20.0",
 		"picocolors": "^1.1.1",
 		"posthog-node": "^5.33.5",
-		"zod": "^4.3.6"
+		"zod": "^4.4.3"
 	},
 	"devDependencies": {
 		"@types/pg": "^8.20.0",