[lucasbraum]

Pack

zod >=3 <4 → >=4 <5 (verified pack). Closes UPT-26.

ZodError#errors was an alias of .issues and is gone in zod 4 (https://zod.dev/v4/changelog#drops-errors, already in meta.sources). Every typed read of it went to the agent.

Rules

• error-issues (new, breaking, mechanical). It claims the type diff's own finding, removed ZodError#errors. That finding exists only where the checker resolved the member's declaration on the receiver's type, so the rule never matches by name. It covers inferred result.error, SafeParseError['error'], ZodError<T> and local aliases of them.
  • Reads: e.errors[0].message, e?.errors?.length, e!.errors. Only the member name changes, to issues.
  • Destructuring: const { errors } = e becomes const { issues: errors } = e, and { errors: list = [] } becomes { issues: list = [] }. The local names stay as they were.
  • Declined, so they stay with the agent: assignments, delete, ++/--, rest elements, and quoted or computed property names.
• error-members (the untyped-catch path from fix(zod): report formErrors and errors read off untyped catch bindings #127). .errors read off an untyped catch binding is now renamed too, under the same gate as formErrors: the rewrite re-runs detection, so it only edits a read off a binding caught from a zod parse/parseAsync. A JSON.parse try, writes, and instanceof-narrowed bindings are still declined.

Verification

uptide pack test zod

fixtures      8 cases, 20 sites · pass
  fixtures/repos/storefront                    predicted 38, expected 38, false positives 0, false negatives 0
  ugurkocde/AwesomeIntune@dcf38603fd55         predicted 13, expected 15, false positives 0, false negatives 2
  howardyang2009/PATH@bb171417d911             predicted 40, expected 51, false positives 0, false negatives 11
  band-ai/band-sdk-typescript@5d9a66a1dde4     predicted 29, expected 37, false positives 0, false negatives 8

  rule                         precision  recall    tp   fp   fn
  error-issues                        0%     n/a     0    2    0
  error-params                      100%     89%    24    0    3
  generic                            80%     73%    32    8   12
  ...
  overall (sites)                   100%     85%   120    0   21
  breaking (sites)                  100%     74%    59    0   21
PASS zod: verified

Breaking precision stays at 100% and recall is unchanged (59/0/21, the same as main), so verification.json is unchanged.

Decision for you: the error-issues 0% / 2 fp row. These are two AwesomeIntune sites (src/app/api/subscribe/route.ts:23, src/app/api/v1/keys/route.ts:30). They are still true positives at the site level, but the ground truth files them under generic because no rule claimed them when it was written. They are now listed under "reported under another rule". I did not relabel the ground truth, since this PR's own scoring is what motivates the change. If you want the per-rule row to read 100%, relabel those two entries to error-issues in a separate commit.

Fixtures

New case fixtures/error-issues. It has the papermark shape (validation.error.errors[0].message), optional chaining, destructuring with and without a rename, a write marked keep, and an unmarked non-zod form.errors.

Real type diff

I ran check on a scratch repo with zod 3.25.76 installed and the fixture's code. All four typed shapes come back as removed ZodError#errors and are mechanical. The write stays manual, and the non-zod form.errors is not reported.

papermark/papermark @ed19717

This was run locally on a shallow clone with lifecycle scripts off. Nothing was pushed or posted.

• check, main vs this branch: 34 sites move from agent to mechanical (ZodError#errors 34 agent → error-issues 34 by rule). No other group changes.
• I applied all 34 rewrites (25 files; each line changes only errors → issues), installed zod 4.6.5 with --no-save --ignore-scripts, and ran tsc --noEmit. None of the 34 lines has an error.
• tsc still reports 6 ZodError.errors reads in 3 files that check does not report on main either. Example: pages/api/teams/[teamId]/documents/index.ts:412. Those files never import zod themselves; the schema comes from @/lib/zod/..., and the call-site finder only follows a non-distinctive member like errors in importing files. That detection gap predates this PR and is out of scope here.

Suite

pnpm lint, pnpm typecheck and pnpm docs:packs --check pass. The full @uptide/core suite has 3 failures, all test timeouts in fix/assisted.test.ts / pack-test.test.ts, with a different set on each run. Both files pass in isolation (30/30), and origin/main shows the same 3 timeouts in a full run on this machine.

Also: Packs workflow fix (react-router)

The Packs check failed on react-router, not zod, and it has failed on main since 883e587. pack test compares verification.json with the run byte for byte, and the react-router record from #132 had no truePositives/falseNegatives/behavior fields. 5b861d0 re-records it with uptide pack test react-router --write. Status, digest, precision 1, recall 0.875 and fp 0 are unchanged; only the counts are added, and ground truth is untouched.

🤖 Generated with Claude Code