@amboras-dev/capability-kit 0.2.1 → 0.3.1

package/README.md

@@ -6,8 +6,9 @@ merchant action: id, zod input/output, policy and agent text. The kit checks it
 once, converts money at one boundary, answers errors in one shape and emits a
 hashed manifest the other repo re-checks on load. CommonJS + ESM + types; Node >= 20 and
 browsers. One runtime dependency, `@amboras-dev/money` (the storage rule, conversion
-and money view; the kit pins its exact version), and the `zod` peer (`^3.25.76 || ^4.0.0`,
-imported only as `zod/v4`; zod 3.25.0 ships without `dist/` and cannot load `zod/v4`).
+and money view; the kit pins its exact version), and the `zod` peer (`^3.25.76 || ^4.6.6`,
+imported only as `zod/v4`; zod 3.25.0 ships without `dist/` and cannot load `zod/v4`;
+the 4.x floor is 4.6.6, the first release patched for GHSA-mrhx-c7xc-m3w5, which has no 3.x fix).
 
 ```ts
 import { defineCapability, money, toStorageAmount, moneyView, emitManifest, parseManifest } from '@amboras-dev/capability-kit'
@@ -136,8 +137,8 @@ count, or a count that is not a non-negative integer.
   loose objects, so a field added by a newer kit passes through and stays covered
   by the hash. The hash proves integrity, not origin: trust comes from reading the
   committed file.
-- **zod 3.25 and 4.x.** The suite runs three times: on zod 4.3.6, on zod 4.0.0
-  (`vitest.zod40.config.ts`) and on zod 3.25.76's `zod/v4`
+- **zod 3.25 and 4.x.** The suite runs three times: on zod 4.6.7, on zod 4.6.6
+  (`vitest.zod46.config.ts`, the 4.x floor) and on zod 3.25.76's `zod/v4`
   (`vitest.zod3.config.ts`); types are checked against all three. A manifest
   emitted on 3.25 (`test-fixtures/manifest.zod-3.25.json`) parses on every line,
   and each line's hash is pinned. zod 3.25's
@@ -152,8 +153,8 @@ count, or a count that is not a non-negative integer.
 ## Testing
 
 ```bash
-pnpm test        # vitest + 100% coverage on zod 4.3.6, then the same suite on 3.25.76 and 4.0.0
-pnpm typecheck   # src (no Node types), tests, and src+tests against zod 3.25 and 4.0 types
+pnpm test        # vitest + 100% coverage on zod 4.6.7, then the same suite on 3.25.76 and 4.6.6
+pnpm typecheck   # src (no Node types), tests, and src+tests against zod 3.25 and 4.6.6 types
 # regenerate the 3.25 manifest fixture after a deliberate change:
 UPDATE_FIXTURES=1 npx vitest run --config vitest.zod3.config.ts src/manifest-cross-zod.test.ts
 ```

package/dist/index.cjs

@@ -2,7 +2,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let zod_v4 = require("zod/v4");
 let _amboras_dev_money = require("@amboras-dev/money");
 let _amboras_dev_money_ai = require("@amboras-dev/money/ai");
-//#region src/canonical-json.ts
+// src/canonical-json.ts
 function serialize(value, seen) {
 	if (value !== null && typeof value === "object" && typeof value.toJSON === "function") value = value.toJSON();
 	if (value === null) return "null";
@@ -35,8 +35,7 @@ function serialize(value, seen) {
 function canonicalJson(v) {
 	return serialize(v, /* @__PURE__ */ new Set()) ?? "null";
 }
-//#endregion
-//#region src/errors.ts
+// src/errors.ts
 const STATUS = {
 	invalid_input: 400,
 	forbidden: 403,
@@ -165,8 +164,7 @@ function fromZodError(err, options = {}) {
 		issues
 	});
 }
-//#endregion
-//#region src/ids.ts
+// src/ids.ts
 const AREAS = [
 	"promotions",
 	"catalog",
@@ -197,8 +195,7 @@ function areaOf(id) {
 function isRole(value) {
 	return value === "owner" || value === "manager" || value === "staff";
 }
-//#endregion
-//#region src/money.ts
+// src/money.ts
 /**
 * A bad amount or currency code. It is an `invalid_input` CapabilityError, so an
 * adapter that maps CapabilityError answers 400 with the rule (and the field,
@@ -354,8 +351,7 @@ function moneyView(minor, currency) {
 		throw toCapabilityMoneyError(error);
 	}
 }
-//#endregion
-//#region src/json-schema.ts
+// src/json-schema.ts
 /**
 * The exact conversion every manifest uses. Throws for types JSON Schema cannot
 * express. Every money() field gets its marker back, and its unit sentence when
@@ -433,8 +429,7 @@ function omitFields(schema, fields) {
 	}
 	return copy;
 }
-//#endregion
-//#region src/guards.ts
+// src/guards.ts
 /**
 * Tenant and actor ids come from the call context, never from input. A name is
 * refused when, lower-cased with separators removed, it ends in one of these
@@ -587,8 +582,7 @@ function checkEntry(entry) {
 	if (typeof entry.agent.description !== "string" || entry.agent.description.trim() === "") fail(id, "agent.description is required");
 	if (entry.agent.toolName !== void 0 && !TOOL_NAME.test(entry.agent.toolName)) fail(id, `agent.toolName must match ${TOOL_NAME}`);
 }
-//#endregion
-//#region src/define.ts
+// src/define.ts
 function convert(schema, io, id) {
 	try {
 		return toJsonSchema(schema, io);
@@ -638,8 +632,7 @@ function defineCapability(def) {
 		agent: freezeCopy(def.agent)
 	});
 }
-//#endregion
-//#region src/sha256.ts
+// src/sha256.ts
 const K = new Uint32Array([
 	1116352408,
 	1899447441,
@@ -782,8 +775,7 @@ function sha256Hex(text) {
 	for (const word of h) hex += word.toString(16).padStart(8, "0");
 	return hex;
 }
-//#endregion
-//#region src/idempotency.ts
+// src/idempotency.ts
 /**
 * 8–100 of `A-Z a-z 0-9 . _ : -`. The underscore is there because the
 * orchestrator's key is `cap.{runId}.{toolCallId}` and model tool call ids
@@ -801,8 +793,7 @@ function requestFingerprint(id, input) {
 		input
 	}));
 }
-//#endregion
-//#region src/manifest.ts
+// src/manifest.ts
 const hashOf = (capabilities) => sha256Hex(canonicalJson(capabilities));
 /** Plain JSON with keys sorted at every level, so the committed file is stable text. */
 const sortedJson = (value) => JSON.parse(canonicalJson(value));
@@ -926,8 +917,7 @@ function parseManifest(json) {
 	if (actual !== manifest.hash) throw new CapabilityManifestError(`Capability manifest hash mismatch: header ${manifest.hash}, content ${actual}`);
 	return manifest;
 }
-//#endregion
-//#region src/policy.ts
+// src/policy.ts
 function roleCheck(policy, ctx) {
 	const { actor } = ctx;
 	if (actor.kind === "internal") return null;
@@ -1014,14 +1004,23 @@ function confirmationRequired(policy, records) {
 	if (typeof records !== "number" || !Number.isInteger(records) || records < 0) return true;
 	return records >= confirm.when.recordsAtLeast;
 }
-//#endregion
 exports.AREAS = AREAS;
 exports.CapabilityDefinitionError = CapabilityDefinitionError;
 exports.CapabilityError = CapabilityError;
 exports.CapabilityManifestError = CapabilityManifestError;
 exports.IDEMPOTENCY_KEY_PATTERN = IDEMPOTENCY_KEY_PATTERN;
-exports.MONEY_META_KEY = _amboras_dev_money_ai.MONEY_META_KEY;
-exports.MONEY_UNIT_SENTENCE = _amboras_dev_money_ai.MONEY_UNIT_SENTENCE;
+Object.defineProperty(exports, "MONEY_META_KEY", {
+	enumerable: true,
+	get: function() {
+		return _amboras_dev_money_ai.MONEY_META_KEY;
+	}
+});
+Object.defineProperty(exports, "MONEY_UNIT_SENTENCE", {
+	enumerable: true,
+	get: function() {
+		return _amboras_dev_money_ai.MONEY_UNIT_SENTENCE;
+	}
+});
 exports.MoneyError = MoneyError;
 exports.ROLE_RANK = ROLE_RANK;
 exports.areaOf = areaOf;

package/dist/index.d.cts

@@ -1,10 +1,7 @@
 import { z } from "zod/v4";
 import { MONEY_META_KEY, MONEY_UNIT_SENTENCE } from "@amboras-dev/money/ai";
-//#region src/canonical-json.d.ts
 /** Sorted keys, no whitespace. Throws on BigInt and circular values; `undefined` at the top serializes as `null`. */
 export declare function canonicalJson(v: unknown): string;
-//#endregion
-//#region src/ids.d.ts
 export declare const AREAS: readonly ["promotions", "catalog", "inventory", "setup", "content", "orders", "payments", "domains", "publish"];
 type Area = (typeof AREAS)[number];
 /** `<area>.<verb>` or `<area>.<entity>.<verb>`: lowercase segments of `a-z` and `_`. */
@@ -16,8 +13,6 @@ export declare const ROLE_RANK: Readonly<Record<Role, number>>;
 export declare function isCapabilityId(value: unknown): value is CapabilityId;
 /** The area an id belongs to (`promotions.create` → `promotions`). */
 export declare function areaOf(id: CapabilityId): Area;
-//#endregion
-//#region src/context.d.ts
 type Actor = {
   kind: 'member';
   profileId: string;
@@ -34,8 +29,6 @@ interface CapabilityCallContext {
   surface: Surface;
   runId?: string;
 }
-//#endregion
-//#region src/json-schema.d.ts
 type JsonSchema = {
   [key: string]: unknown;
 };
@@ -44,8 +37,6 @@ type JsonSchema = {
  * dropped from `required`. Adapters build the model-facing input with this.
  */
 export declare function omitFields(schema: JsonSchema, fields: readonly string[]): JsonSchema;
-//#endregion
-//#region src/policy-types.d.ts
 interface CapabilityPolicy {
   minRole: Role;
   planFeature?: string;
@@ -63,8 +54,6 @@ interface CapabilityPolicy {
     perMinute: number;
   };
 }
-//#endregion
-//#region src/define.d.ts
 interface CapabilityAgentSpec {
   /** What it does and when to use it, written for the model. */
   description: string;
@@ -107,8 +96,6 @@ interface CapabilityDefinition<I = unknown, O = unknown, Ctx = unknown> {
  * minRole, confirm threshold, rate limit or toolName.
  */
 export declare function defineCapability<I, O, Ctx = unknown>(def: CapabilityDefinition<I, O, Ctx>): Readonly<CapabilityDefinition<I, O, Ctx>>;
-//#endregion
-//#region src/errors.d.ts
 type CapabilityErrorCode = 'invalid_input' | 'forbidden' | 'not_found' | 'conflict' | 'confirmation_required' | 'rate_limited' | 'idempotency_conflict' | 'unavailable' | 'internal';
 interface CapabilityErrorBody {
   code: CapabilityErrorCode;
@@ -158,8 +145,6 @@ interface FromZodErrorOptions {
  * `options.renamed` for steering removed field names.
  */
 export declare function fromZodError(err: z.ZodError, options?: FromZodErrorOptions): CapabilityError;
-//#endregion
-//#region src/idempotency.d.ts
 /**
  * 8–100 of `A-Z a-z 0-9 . _ : -`. The underscore is there because the
  * orchestrator's key is `cap.{runId}.{toolCallId}` and model tool call ids
@@ -170,8 +155,6 @@ export declare const IDEMPOTENCY_KEY_PATTERN: RegExp;
 export declare function requiresIdempotencyKey(policy: Pick<CapabilityPolicy, 'effect' | 'idempotent'>): boolean;
 /** sha256 hex of canonicalJson({ id, input }): same key + different fingerprint = a different request. */
 export declare function requestFingerprint(id: CapabilityId, input: unknown): string;
-//#endregion
-//#region src/manifest.d.ts
 interface ManifestEntry {
   id: CapabilityId;
   version: number;
@@ -209,8 +192,6 @@ export declare function emitManifest(defs: readonly AnyCapabilityDefinition[], s
  * the file is read (the committed copy), not from the hash.
  */
 export declare function parseManifest(json: unknown): CapabilityManifest;
-//#endregion
-//#region src/money.d.ts
 /**
  * A bad amount or currency code. It is an `invalid_input` CapabilityError, so an
  * adapter that maps CapabilityError answers 400 with the rule (and the field,
@@ -286,8 +267,6 @@ export declare const moneyViewSchema: z.ZodType<MoneyView>;
  * unknown code throws `currency_invalid`.
  */
 export declare function moneyView(minor: number, currency: string): MoneyView;
-//#endregion
-//#region src/policy.d.ts
 /** Phase 1 adapters pass observe/observe. */
 interface PolicyEnforcement {
   role: 'enforce' | 'observe';
@@ -310,5 +289,4 @@ export declare function evaluatePolicy(policy: CapabilityPolicy, ctx: Capability
  * is not a non-negative integer, requires confirmation (the adapter could not count).
  */
 export declare function confirmationRequired(policy: Pick<CapabilityPolicy, 'confirm'>, records?: number): boolean;
-//#endregion
 export { type Actor, type AnyCapabilityDefinition, type Area, type CapabilityAgentSpec, type CapabilityCallContext, type CapabilityDefinition, type CapabilityErrorBody, type CapabilityErrorCode, type CapabilityErrorInit, type CapabilityId, type CapabilityManifest, type CapabilityPolicy, type FromZodErrorOptions, type JsonSchema, MONEY_META_KEY, MONEY_UNIT_SENTENCE, type ManifestEntry, type MoneyCurrency, type MoneyOptions, type MoneyView, type PolicyDecision, type PolicyEnforcement, type Role, type Surface };

package/dist/index.d.ts

@@ -1,10 +1,7 @@
 import { z } from "zod/v4";
 import { MONEY_META_KEY, MONEY_UNIT_SENTENCE } from "@amboras-dev/money/ai";
-//#region src/canonical-json.d.ts
 /** Sorted keys, no whitespace. Throws on BigInt and circular values; `undefined` at the top serializes as `null`. */
 export declare function canonicalJson(v: unknown): string;
-//#endregion
-//#region src/ids.d.ts
 export declare const AREAS: readonly ["promotions", "catalog", "inventory", "setup", "content", "orders", "payments", "domains", "publish"];
 type Area = (typeof AREAS)[number];
 /** `<area>.<verb>` or `<area>.<entity>.<verb>`: lowercase segments of `a-z` and `_`. */
@@ -16,8 +13,6 @@ export declare const ROLE_RANK: Readonly<Record<Role, number>>;
 export declare function isCapabilityId(value: unknown): value is CapabilityId;
 /** The area an id belongs to (`promotions.create` → `promotions`). */
 export declare function areaOf(id: CapabilityId): Area;
-//#endregion
-//#region src/context.d.ts
 type Actor = {
   kind: 'member';
   profileId: string;
@@ -34,8 +29,6 @@ interface CapabilityCallContext {
   surface: Surface;
   runId?: string;
 }
-//#endregion
-//#region src/json-schema.d.ts
 type JsonSchema = {
   [key: string]: unknown;
 };
@@ -44,8 +37,6 @@ type JsonSchema = {
  * dropped from `required`. Adapters build the model-facing input with this.
  */
 export declare function omitFields(schema: JsonSchema, fields: readonly string[]): JsonSchema;
-//#endregion
-//#region src/policy-types.d.ts
 interface CapabilityPolicy {
   minRole: Role;
   planFeature?: string;
@@ -63,8 +54,6 @@ interface CapabilityPolicy {
     perMinute: number;
   };
 }
-//#endregion
-//#region src/define.d.ts
 interface CapabilityAgentSpec {
   /** What it does and when to use it, written for the model. */
   description: string;
@@ -107,8 +96,6 @@ interface CapabilityDefinition<I = unknown, O = unknown, Ctx = unknown> {
  * minRole, confirm threshold, rate limit or toolName.
  */
 export declare function defineCapability<I, O, Ctx = unknown>(def: CapabilityDefinition<I, O, Ctx>): Readonly<CapabilityDefinition<I, O, Ctx>>;
-//#endregion
-//#region src/errors.d.ts
 type CapabilityErrorCode = 'invalid_input' | 'forbidden' | 'not_found' | 'conflict' | 'confirmation_required' | 'rate_limited' | 'idempotency_conflict' | 'unavailable' | 'internal';
 interface CapabilityErrorBody {
   code: CapabilityErrorCode;
@@ -158,8 +145,6 @@ interface FromZodErrorOptions {
  * `options.renamed` for steering removed field names.
  */
 export declare function fromZodError(err: z.ZodError, options?: FromZodErrorOptions): CapabilityError;
-//#endregion
-//#region src/idempotency.d.ts
 /**
  * 8–100 of `A-Z a-z 0-9 . _ : -`. The underscore is there because the
  * orchestrator's key is `cap.{runId}.{toolCallId}` and model tool call ids
@@ -170,8 +155,6 @@ export declare const IDEMPOTENCY_KEY_PATTERN: RegExp;
 export declare function requiresIdempotencyKey(policy: Pick<CapabilityPolicy, 'effect' | 'idempotent'>): boolean;
 /** sha256 hex of canonicalJson({ id, input }): same key + different fingerprint = a different request. */
 export declare function requestFingerprint(id: CapabilityId, input: unknown): string;
-//#endregion
-//#region src/manifest.d.ts
 interface ManifestEntry {
   id: CapabilityId;
   version: number;
@@ -209,8 +192,6 @@ export declare function emitManifest(defs: readonly AnyCapabilityDefinition[], s
  * the file is read (the committed copy), not from the hash.
  */
 export declare function parseManifest(json: unknown): CapabilityManifest;
-//#endregion
-//#region src/money.d.ts
 /**
  * A bad amount or currency code. It is an `invalid_input` CapabilityError, so an
  * adapter that maps CapabilityError answers 400 with the rule (and the field,
@@ -286,8 +267,6 @@ export declare const moneyViewSchema: z.ZodType<MoneyView>;
  * unknown code throws `currency_invalid`.
  */
 export declare function moneyView(minor: number, currency: string): MoneyView;
-//#endregion
-//#region src/policy.d.ts
 /** Phase 1 adapters pass observe/observe. */
 interface PolicyEnforcement {
   role: 'enforce' | 'observe';
@@ -310,5 +289,4 @@ export declare function evaluatePolicy(policy: CapabilityPolicy, ctx: Capability
  * is not a non-negative integer, requires confirmation (the adapter could not count).
  */
 export declare function confirmationRequired(policy: Pick<CapabilityPolicy, 'confirm'>, records?: number): boolean;
-//#endregion
 export { type Actor, type AnyCapabilityDefinition, type Area, type CapabilityAgentSpec, type CapabilityCallContext, type CapabilityDefinition, type CapabilityErrorBody, type CapabilityErrorCode, type CapabilityErrorInit, type CapabilityId, type CapabilityManifest, type CapabilityPolicy, type FromZodErrorOptions, type JsonSchema, MONEY_META_KEY, MONEY_UNIT_SENTENCE, type ManifestEntry, type MoneyCurrency, type MoneyOptions, type MoneyView, type PolicyDecision, type PolicyEnforcement, type Role, type Surface };

package/dist/index.js

@@ -1,7 +1,7 @@
 import { z } from "zod/v4";
 import { currencyCode, fromMajor, money as money$1, storageDigits, storageScale as storageScale$1, toMajorNumber } from "@amboras-dev/money";
 import { MONEY_META_KEY, MONEY_UNIT_SENTENCE, moneyView as moneyView$1 } from "@amboras-dev/money/ai";
-//#region src/canonical-json.ts
+// src/canonical-json.ts
 function serialize(value, seen) {
 	if (value !== null && typeof value === "object" && typeof value.toJSON === "function") value = value.toJSON();
 	if (value === null) return "null";
@@ -34,8 +34,7 @@ function serialize(value, seen) {
 function canonicalJson(v) {
 	return serialize(v, /* @__PURE__ */ new Set()) ?? "null";
 }
-//#endregion
-//#region src/errors.ts
+// src/errors.ts
 const STATUS = {
 	invalid_input: 400,
 	forbidden: 403,
@@ -164,8 +163,7 @@ function fromZodError(err, options = {}) {
 		issues
 	});
 }
-//#endregion
-//#region src/ids.ts
+// src/ids.ts
 const AREAS = [
 	"promotions",
 	"catalog",
@@ -196,8 +194,7 @@ function areaOf(id) {
 function isRole(value) {
 	return value === "owner" || value === "manager" || value === "staff";
 }
-//#endregion
-//#region src/money.ts
+// src/money.ts
 /**
 * A bad amount or currency code. It is an `invalid_input` CapabilityError, so an
 * adapter that maps CapabilityError answers 400 with the rule (and the field,
@@ -353,8 +350,7 @@ function moneyView(minor, currency) {
 		throw toCapabilityMoneyError(error);
 	}
 }
-//#endregion
-//#region src/json-schema.ts
+// src/json-schema.ts
 /**
 * The exact conversion every manifest uses. Throws for types JSON Schema cannot
 * express. Every money() field gets its marker back, and its unit sentence when
@@ -432,8 +428,7 @@ function omitFields(schema, fields) {
 	}
 	return copy;
 }
-//#endregion
-//#region src/guards.ts
+// src/guards.ts
 /**
 * Tenant and actor ids come from the call context, never from input. A name is
 * refused when, lower-cased with separators removed, it ends in one of these
@@ -586,8 +581,7 @@ function checkEntry(entry) {
 	if (typeof entry.agent.description !== "string" || entry.agent.description.trim() === "") fail(id, "agent.description is required");
 	if (entry.agent.toolName !== void 0 && !TOOL_NAME.test(entry.agent.toolName)) fail(id, `agent.toolName must match ${TOOL_NAME}`);
 }
-//#endregion
-//#region src/define.ts
+// src/define.ts
 function convert(schema, io, id) {
 	try {
 		return toJsonSchema(schema, io);
@@ -637,8 +631,7 @@ function defineCapability(def) {
 		agent: freezeCopy(def.agent)
 	});
 }
-//#endregion
-//#region src/sha256.ts
+// src/sha256.ts
 const K = new Uint32Array([
 	1116352408,
 	1899447441,
@@ -781,8 +774,7 @@ function sha256Hex(text) {
 	for (const word of h) hex += word.toString(16).padStart(8, "0");
 	return hex;
 }
-//#endregion
-//#region src/idempotency.ts
+// src/idempotency.ts
 /**
 * 8–100 of `A-Z a-z 0-9 . _ : -`. The underscore is there because the
 * orchestrator's key is `cap.{runId}.{toolCallId}` and model tool call ids
@@ -800,8 +792,7 @@ function requestFingerprint(id, input) {
 		input
 	}));
 }
-//#endregion
-//#region src/manifest.ts
+// src/manifest.ts
 const hashOf = (capabilities) => sha256Hex(canonicalJson(capabilities));
 /** Plain JSON with keys sorted at every level, so the committed file is stable text. */
 const sortedJson = (value) => JSON.parse(canonicalJson(value));
@@ -925,8 +916,7 @@ function parseManifest(json) {
 	if (actual !== manifest.hash) throw new CapabilityManifestError(`Capability manifest hash mismatch: header ${manifest.hash}, content ${actual}`);
 	return manifest;
 }
-//#endregion
-//#region src/policy.ts
+// src/policy.ts
 function roleCheck(policy, ctx) {
 	const { actor } = ctx;
 	if (actor.kind === "internal") return null;
@@ -1013,5 +1003,4 @@ function confirmationRequired(policy, records) {
 	if (typeof records !== "number" || !Number.isInteger(records) || records < 0) return true;
 	return records >= confirm.when.recordsAtLeast;
 }
-//#endregion
 export { AREAS, CapabilityDefinitionError, CapabilityError, CapabilityManifestError, IDEMPOTENCY_KEY_PATTERN, MONEY_META_KEY, MONEY_UNIT_SENTENCE, MoneyError, ROLE_RANK, areaOf, canonicalJson, confirmationRequired, defineCapability, emitManifest, evaluatePolicy, fractionDigits, fromStorageAmount, fromZodError, httpStatusFor, isCapabilityId, money, moneyView, moneyViewSchema, omitFields, parseManifest, requestFingerprint, requiresIdempotencyKey, storageScale, toStorageAmount };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amboras-dev/capability-kit",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Capability contract for Amboras: defineCapability, major-unit money (on @amboras-dev/money), the shared error contract, pure policy evaluation, idempotency helpers and a deterministic manifest. Peer dependency on zod.",
   "license": "UNLICENSED",
   "repository": {
@@ -36,25 +36,26 @@
     "access": "public"
   },
   "dependencies": {
-    "@amboras-dev/money": "0.2.0"
+    "@amboras-dev/money": "0.4.0"
   },
   "peerDependencies": {
-    "zod": "^3.25.76 || ^4.0.0"
+    "zod": "^3.25.76 || ^4.6.6"
   },
   "devDependencies": {
     "@types/node": "22.20.5",
-    "@vitest/coverage-v8": "3.2.7",
+    "@vitest/coverage-v8": "5.0.5",
     "fast-check": "4.3.0",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "vitest": "3.2.7",
-    "zod": "4.3.6",
+    "vite": "8.3.5",
+    "vitest": "5.0.5",
+    "zod": "4.6.7",
     "zod3": "npm:zod@3.25.76",
-    "zod40": "npm:zod@4.0.0"
+    "zod46": "npm:zod@4.6.6"
   },
   "scripts": {
     "build": "tsdown",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json && tsc --noEmit -p tsconfig.zod3.json && tsc --noEmit -p tsconfig.zod40.json",
-    "test": "vitest run --coverage && vitest run --config vitest.zod3.config.ts && vitest run --config vitest.zod40.config.ts"
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json && tsc --noEmit -p tsconfig.zod3.json && tsc --noEmit -p tsconfig.zod46.json",
+    "test": "vitest run --coverage && vitest run --config vitest.zod3.config.ts && vitest run --config vitest.zod46.config.ts"
   }
 }