fix(ai-sdk): upgrade to zod v4 and pin ai to 7.0.41

[brianstrauch]

Problem

The ai-sdk sample fails on a fresh install. Its .npmrc sets package-lock=false, so npm install floats every dependency to the newest in-range version. That surfaces two independent regressions.

Bug A — TS2589 at compile time

typescript floats ^5.6.3 → 5.9.3, and TS 5.9 exceeds the instantiation depth limit on zod 3's types via the AI SDK v7 tool() helper:

src/workflows.ts(31,19): error TS2589: Type instantiation is excessively deep and possibly infinite.

Some users see an out-of-memory crash in tsc instead — that's the same problem, just dying before it can report the error. It is not caused by the ai version:

typescript	zod	result
5.9.3	3.25.76	❌ TS2589
5.7.3 (old lockfile)	3.25.76	✅
5.9.3	4.4.3	✅

Bug B — workflow tasks fail at runtime

Hidden behind Bug A; fixing zod alone exposes it. ai floats 7.0.36 → 7.0.55, pulling @ai-sdk/provider-utils >= 5.0.15, which added an unguarded module-scope call:

var initialGlobalFetch = globalThis.fetch;
var initialGlobalFetchIsNodeDefault = isNodeDefaultFetch(initialGlobalFetch);

function isNodeDefaultFetch(fetch) {
  const source = Function.prototype.toString.call(fetch); // throws when fetch is undefined

Workflows are deterministic and have no fetch, so importing ai inside the sandbox throws at import time and every workflow task fails:

TypeError: Function.prototype.toString requires that 'this' be a Function
    at isNodeDefaultFetch (safe-node-fetch.ts:135:45)
    at importWorkflows (workflows-autogenerated-entrypoint.cjs:13:9)

Bisected to exactly @ai-sdk/provider-utils@5.0.15, first pulled in by ai@7.0.42.

Fix

• zod → ^4.0.0 (resolves Bug A)
• ai → pinned 7.0.41, the last release depending on provider-utils 5.0.14 (resolves Bug B)

@ai-sdk/mcp still resolves a 5.0.23 copy into the tree, but it is never evaluated in the sandbox, so it does not need pinning.

Testing

All five samples (haiku, tools, mcp, middleware, stream) pass against a local dev server, via both pnpm and a fresh npm install, with zero worker errors. Build verified clean on both TS 5.7.3 and TS 5.9.3.

Follow-ups (not in this PR)

• The ai pin is a stopgap. Bug B needs an upstream guard (typeof fetch !== 'function') in @ai-sdk/provider-utils; an issue for vercel/ai is drafted but not yet filed.
• package-lock=false in ai-sdk/.npmrc is the root enabler — npm users get none of the reproducibility the committed pnpm-lock.yaml provides, so the sample can break again at any time from an unrelated upstream release.

🤖 Generated with Claude Code