@classytic/party 0.1.0 → 0.2.0

package/dist/maintenance.d.ts

@@ -0,0 +1,165 @@
+import "@classytic/primitives/address";
+import "@classytic/primitives/person";
+import "@classytic/primitives/reference";
+//#region src/domain/enums.d.ts
+/** Channel kind for a contact point. Drives normalization + dedup keys. */
+declare const CONTACT_POINT_TYPES: readonly ['email', 'phone'];
+type ContactPointType = (typeof CONTACT_POINT_TYPES)[number];
+//#endregion
+//#region src/domain/value-objects.d.ts
+/**
+ * A reachable identity channel. `value` is what the user typed; `key` is the
+ * normalized dedup form (`email:ada@x.com`, `phone:+8801...`). Structurally a
+ * normalized, verifiable superset of primitives' flat `ContactInfo` (§P5) — the
+ * kernel dedups on `key` but never mangles the display `value`.
+ */
+interface ContactPoint {
+  type: ContactPointType;
+  /**
+   * The CANONICAL form — a lowercased email, or an E.164 phone. Identity is the
+   * normalized value only; this is also what a notification transport should
+   * dial or mail, so a stored local spelling is a second bug waiting behind the
+   * dedup one.
+   */
+  value: string;
+  /** Normalized dedup key — the `identityKeys` index entry. */
+  key: string;
+  /**
+   * What the operator actually TYPED, kept only when it differs from `value`.
+   * Support-facing provenance ("the till shows 01712345678, the invoice shows
+   * +8801712345678 — same number"). Never an identity signal: it is not keyed,
+   * not indexed and not matched on.
+   */
+  input?: string;
+  isPrimary: boolean;
+  verified: boolean;
+}
+//#endregion
+//#region src/maintenance/phone-identity-repair.d.ts
+/** The slice of a party this survey reads. Structural, so a raw lean doc fits. */
+interface PartyIdentityRow {
+  _id: unknown;
+  displayName?: string;
+  kind?: string;
+  status?: string;
+  roles?: string[];
+  identityKeys?: string[];
+  contactPoints?: ContactPoint[];
+  createdAt?: Date;
+}
+/** One party's phone key, as stored and as it should be. */
+interface PhoneKeyFinding {
+  partyId: string;
+  displayName: string;
+  status: string;
+  createdAt?: Date | undefined;
+  /** The key currently in `identityKeys` (`phone:+01309000993`). */
+  storedKey: string;
+  /** The key it should be (`phone:+8801309000993`), or `null` when unreadable. */
+  canonicalKey: string | null;
+  /** Why it could not be read — present only when `canonicalKey` is null. */
+  reason?: string;
+}
+/** Two or more parties that are one human. The only case needing a decision. */
+interface PhoneCollisionGroup {
+  canonicalKey: string;
+  parties: PhoneKeyFinding[];
+  /**
+   * Fields on which the group DISAGREES. An empty list means the rows are
+   * consistent and the merge is uncontroversial; `displayName` disagreeing is
+   * normal (a nickname), `kind` disagreeing is a red flag worth a human look.
+   */
+  conflicts: string[];
+  /**
+   * Per-party facet counts, when a host supplied a counter. A group with
+   * entitlements/cards/loyalty on MORE THAN ONE side is the expensive kind: the
+   * merge has to reconcile real balances, not just names.
+   */
+  attachments?: Record<string, Record<string, number>>;
+  /** True when at least two parties in the group carry a non-zero facet count. */
+  attachmentsOnBothSides?: boolean;
+}
+interface PhoneRepairReport {
+  /** ISO 3166-1 alpha-2 region the survey interpreted local numbers in. */
+  defaultRegion: string | undefined;
+  scannedParties: number;
+  partiesWithPhone: number;
+  phoneKeys: number;
+  /** Already E.164 — no action. */
+  canonical: number;
+  /** Wrong key, no competitor: a safe mechanical rewrite. */
+  rekey: PhoneKeyFinding[];
+  /** THE corruption: one human, several parties. Needs a human decision. */
+  collisions: PhoneCollisionGroup[];
+  /** Distinct parties that would collapse if every collision were merged. */
+  partiesInCollisions: number;
+  /** How many parties disappear if every collision group is merged to one. */
+  partiesCollapsed: number;
+  /** Unreadable keys — reported, never rewritten. */
+  unparseable: PhoneKeyFinding[];
+}
+/** Optional host port: how many facet rows point at each party. */
+type AttachmentCounter = (partyIds: string[]) => Promise<Record<string, Record<string, number>>>;
+/**
+ * PURE. Turn a page of party rows into the repair plan. No I/O, no writes —
+ * unit-testable against fixtures, which is how the counts in an operator's
+ * report can be trusted.
+ */
+declare function planPhoneIdentityRepair(rows: readonly PartyIdentityRow[], options?: {
+  defaultRegion?: string | undefined;
+}): PhoneRepairReport;
+/**
+ * Attach per-party facet counts to every collision group, via a host-supplied
+ * counter. Optional because only the HOST knows what a "card" or an
+ * "entitlement" is — the identity kernel must not learn.
+ */
+declare function withAttachmentCounts(report: PhoneRepairReport, count: AttachmentCounter): Promise<PhoneRepairReport>;
+/**
+ * The filter + projection the survey needs, as DATA.
+ *
+ * Exported rather than embedded in a query builder because a mongoose `Model`
+ * and a raw driver `Collection` have incompatible read APIs (`.select().lean()`
+ * vs `.find(filter, { projection })`), and every host will reach for whichever
+ * it already has open. Two hosts hand-writing "the phone-identity query" is two
+ * chances to diverge on the filter and report different damage from the same
+ * database.
+ *
+ * Deliberately NOT tenant-scoped. A collision IS two rows that should be one;
+ * scanning a branch at a time would see each half separately and find nothing —
+ * the same blindness that let the split happen.
+ *
+ * Deliberately a narrow projection over a plain read: this must be safe to run
+ * against production on a Tuesday afternoon.
+ */
+declare const PHONE_IDENTITY_QUERY: {
+  filter: {
+    readonly identityKeys: {
+      readonly $regex: '^phone:';
+    };
+  };
+  projection: {
+    readonly _id: 1;
+    readonly displayName: 1;
+    readonly kind: 1;
+    readonly status: 1;
+    readonly roles: 1;
+    readonly identityKeys: 1;
+    readonly contactPoints: 1;
+    readonly createdAt: 1;
+  };
+};
+/** How the host hands rows over. Whatever it uses to read, it returns these. */
+type PartyIdentityReader = () => Promise<PartyIdentityRow[]>;
+/**
+ * Read every party carrying a phone identity and plan the repair.
+ *
+ * Takes a READER rather than a model: the kernel states the query
+ * ({@link PHONE_IDENTITY_QUERY}), the host runs it with whatever handle it has.
+ */
+declare function scanPhoneIdentityRepair(read: PartyIdentityReader, options?: {
+  defaultRegion?: string | undefined;
+}): Promise<PhoneRepairReport>;
+/** Human-readable dry-run output. Deterministic — safe to diff between runs. */
+declare function formatPhoneRepairReport(report: PhoneRepairReport): string;
+//#endregion
+export { AttachmentCounter, PHONE_IDENTITY_QUERY, PartyIdentityReader, PartyIdentityRow, PhoneCollisionGroup, PhoneKeyFinding, PhoneRepairReport, formatPhoneRepairReport, planPhoneIdentityRepair, scanPhoneIdentityRepair, withAttachmentCounts };

package/dist/maintenance.js

@@ -0,0 +1,353 @@
+import "@classytic/contact/email";
+import { PhoneFormatError, normalizePhone } from "@classytic/contact/phone";
+//#region src/domain/errors.ts
+/** Base class so hosts can `instanceof PartyError` across every party throwable. */
+var PartyError = class extends Error {
+	status;
+	code;
+	meta;
+	constructor(status, code, message, meta) {
+		super(message);
+		this.name = new.target.name;
+		this.status = status;
+		this.code = code;
+		if (meta !== void 0) this.meta = meta;
+	}
+};
+/**
+* A phone contact point could not be normalized to E.164 — so it cannot become
+* an identity key.
+*
+* This REFUSES rather than degrades, and that is the whole point. The previous
+* behaviour fell back to `+${digits}`, which produced keys like
+* `phone:+01309000993` — neither a national number nor E.164. Two spellings of
+* one member therefore keyed differently and `resolveOrCreate` forked the
+* identity, silently: every screen looked correct and the membership history
+* simply split in two (FAIL LOUD rule 2 — an input we do not understand must
+* fail, not widen).
+*
+* `meta` names the offending value and the region it was interpreted in, so an
+* operator can fix the data instead of guessing which field a 400 refers to.
+*/
+var PartyPhoneFormatError = class extends PartyError {
+	constructor(value, defaultRegion, detail) {
+		super(400, "party.phone_invalid", `Phone ${JSON.stringify(value)} is not a valid ${defaultRegion ?? "E.164"} number (${detail}). Identity requires an E.164 phone; supply a dialable number or configure the deployment region (\`defaultPhoneRegion\`) so national formats can be interpreted. It is NOT stored as typed — a raw spelling used as an identity key is how one person becomes several parties.`, {
+			value,
+			...defaultRegion !== void 0 ? { defaultRegion } : {},
+			detail
+		});
+	}
+};
+//#endregion
+//#region src/domain/normalize.ts
+/**
+* Canonical E.164 form of a phone number, for dedup AND for storage.
+*
+* Delegates to `@classytic/contact`, then re-throws its refusal as party's own
+* `PartyPhoneFormatError` (400 / `party.phone_invalid`) so arc serializes it
+* natively. There is no fallback at either layer: the old `+${digits}`
+* degradation is precisely what split one member into several parties, and it
+* did so without erroring.
+*
+* NOT exported from this kernel's public surface. A consumer that wants to
+* normalize a phone imports `@classytic/contact/phone` directly — one rule,
+* one name. What party owns is `buildContactPoints`, the single point every
+* identity write crosses.
+*/
+function normalizePhone$1(raw, options = {}) {
+	const defaultRegion = options.defaultRegion;
+	try {
+		return normalizePhone(raw, { ...defaultRegion !== void 0 ? { defaultRegion } : {} });
+	} catch (err) {
+		if (err instanceof PhoneFormatError) throw new PartyPhoneFormatError(err.input, defaultRegion, err.detail ?? err.code);
+		throw err;
+	}
+}
+//#endregion
+//#region src/maintenance/phone-identity-repair.ts
+/**
+* Phone-identity repair — the READ-ONLY survey of damage already in the
+* database.
+*
+* Fixing the seam stops NEW splits. It does not heal the ones already written:
+* a member who is two parties today stays two parties, and every facet keyed on
+* `partyId` (entitlements, cards, loyalty, membership history, AR) stays split
+* with them. This module answers "how bad is it, and which rows need a human?"
+*
+* ## Nothing here writes. On purpose.
+*
+* Merging identities is DESTRUCTIVE and irreversible in practice: `merge` turns
+* the loser into a terminal redirect, and if two rows that are genuinely two
+* people were collapsed, no undo restores the facets that followed. An
+* automated merge would also be a self-fulfilling audit — the run that decides
+* and the run that verifies would be the same code.
+*
+* So this produces a REPORT and stops. A human reads it and either calls
+* `PartyRepository.merge(loser, survivor, ctx)` per group or fixes the data.
+*
+* ## Three outcomes, deliberately distinguished
+*
+*   - **canonical** — the stored key already IS the E.164 form. Nothing to do.
+*   - **rekey** — the key is wrong (a local spelling, or the old `+${digits}`
+*     mangling) but no OTHER party owns the corrected key. Mechanical and safe:
+*     one party, one key, rewritten.
+*   - **collision** — the corrected key is owned by two or more parties. This is
+*     the actual corruption, and it is the only case that needs a decision.
+*
+* A fourth, `unparseable`, is reported rather than guessed at: a key we cannot
+* interpret must not be rewritten into a plausible-looking one (FAIL LOUD rule
+* 2). Reporting it costs an operator one look; guessing costs them a merged
+* stranger.
+*/
+const PHONE_PREFIX = "phone:";
+/**
+* Recover the canonical E.164 form from what was stored.
+*
+* The ladder matters, and its ORDER is the whole correctness argument:
+*
+*   1. **Strict E.164, no region.** A correctly-keyed row — including a FOREIGN
+*      number — must be preserved exactly. Re-reading `+14155550182` through a
+*      `BD` region would turn a California number into a Bangladeshi one.
+*   2. **The raw value as typed, through the region.** `01309000993` is what the
+*      operator entered and the most faithful signal we have.
+*   3. **The key's digits, through the region.** Recovers the `+${digits}`
+*      mangling (`phone:+01309000993` → `01309000993` → `+8801309000993`) when
+*      the contact point's value is missing or equally mangled.
+*
+* Anything past that is unreadable and is REPORTED, not repaired.
+*/
+function recoverCanonical(storedKey, rawValue, defaultRegion) {
+	const stored = storedKey.slice(6);
+	const candidates = [{
+		input: stored,
+		region: void 0
+	}];
+	if (rawValue) candidates.push({
+		input: rawValue,
+		region: defaultRegion
+	});
+	candidates.push({
+		input: stored.replace(/\D/g, ""),
+		region: defaultRegion
+	});
+	let lastReason = "no candidate parsed";
+	for (const candidate of candidates) {
+		if (!candidate.input) continue;
+		try {
+			return { key: `${PHONE_PREFIX}${normalizePhone$1(candidate.input, { defaultRegion: candidate.region })}` };
+		} catch (err) {
+			lastReason = err instanceof Error ? err.message : String(err);
+		}
+	}
+	return { reason: lastReason };
+}
+/** Fields whose disagreement inside a collision group is worth surfacing. */
+function conflictsIn(rows) {
+	const conflicts = [];
+	const distinct = (pick) => new Set(rows.map(pick).filter((v) => Boolean(v))).size;
+	if (distinct((r) => r.displayName?.trim().toLowerCase()) > 1) conflicts.push("displayName");
+	if (distinct((r) => r.kind) > 1) conflicts.push("kind");
+	if (distinct((r) => r.status) > 1) conflicts.push("status");
+	const emails = /* @__PURE__ */ new Set();
+	for (const row of rows) for (const key of row.identityKeys ?? []) if (key.startsWith("email:")) emails.add(key);
+	if (emails.size > 1) conflicts.push("email");
+	return conflicts;
+}
+/**
+* PURE. Turn a page of party rows into the repair plan. No I/O, no writes —
+* unit-testable against fixtures, which is how the counts in an operator's
+* report can be trusted.
+*/
+function planPhoneIdentityRepair(rows, options = {}) {
+	const defaultRegion = options.defaultRegion;
+	const byCanonical = /* @__PURE__ */ new Map();
+	const unparseable = [];
+	let partiesWithPhone = 0;
+	let phoneKeys = 0;
+	let canonical = 0;
+	for (const row of rows) {
+		const keys = (row.identityKeys ?? []).filter((k) => k.startsWith(PHONE_PREFIX));
+		if (keys.length === 0) continue;
+		partiesWithPhone += 1;
+		for (const storedKey of keys) {
+			phoneKeys += 1;
+			const rawValue = (row.contactPoints ?? []).find((c) => c.type === "phone" && c.key === storedKey)?.value;
+			const recovered = recoverCanonical(storedKey, rawValue, defaultRegion);
+			const base = {
+				partyId: String(row._id),
+				displayName: row.displayName ?? "(unnamed)",
+				status: row.status ?? "active",
+				createdAt: row.createdAt,
+				storedKey,
+				canonicalKey: null
+			};
+			if ("reason" in recovered) {
+				unparseable.push({
+					...base,
+					reason: recovered.reason
+				});
+				continue;
+			}
+			if (recovered.key === storedKey) canonical += 1;
+			const finding = {
+				...base,
+				canonicalKey: recovered.key
+			};
+			const bucket = byCanonical.get(recovered.key);
+			if (bucket) bucket.push({
+				finding,
+				row
+			});
+			else byCanonical.set(recovered.key, [{
+				finding,
+				row
+			}]);
+		}
+	}
+	const rekey = [];
+	const collisions = [];
+	const collidingParties = /* @__PURE__ */ new Set();
+	for (const [canonicalKey, entries] of byCanonical) {
+		const parties = /* @__PURE__ */ new Map();
+		for (const entry of entries) parties.set(entry.finding.partyId, entry);
+		if (parties.size > 1) {
+			const members = [...parties.values()];
+			for (const id of parties.keys()) collidingParties.add(id);
+			collisions.push({
+				canonicalKey,
+				parties: members.map((m) => m.finding),
+				conflicts: conflictsIn(members.map((m) => m.row))
+			});
+			continue;
+		}
+		for (const entry of entries) if (entry.finding.storedKey !== canonicalKey) rekey.push(entry.finding);
+	}
+	collisions.sort((a, b) => a.canonicalKey.localeCompare(b.canonicalKey));
+	rekey.sort((a, b) => a.storedKey.localeCompare(b.storedKey));
+	unparseable.sort((a, b) => a.storedKey.localeCompare(b.storedKey));
+	return {
+		defaultRegion,
+		scannedParties: rows.length,
+		partiesWithPhone,
+		phoneKeys,
+		canonical,
+		rekey,
+		collisions,
+		partiesInCollisions: collidingParties.size,
+		partiesCollapsed: collisions.reduce((n, g) => n + (g.parties.length - 1), 0),
+		unparseable
+	};
+}
+/**
+* Attach per-party facet counts to every collision group, via a host-supplied
+* counter. Optional because only the HOST knows what a "card" or an
+* "entitlement" is — the identity kernel must not learn.
+*/
+async function withAttachmentCounts(report, count) {
+	const ids = [...new Set(report.collisions.flatMap((g) => g.parties.map((p) => p.partyId)))];
+	if (ids.length === 0) return report;
+	const counts = await count(ids);
+	const collisions = report.collisions.map((group) => {
+		const attachments = {};
+		let sidesWithData = 0;
+		for (const party of group.parties) {
+			const facets = counts[party.partyId] ?? {};
+			attachments[party.partyId] = facets;
+			if (Object.values(facets).some((n) => n > 0)) sidesWithData += 1;
+		}
+		return {
+			...group,
+			attachments,
+			attachmentsOnBothSides: sidesWithData > 1
+		};
+	});
+	return {
+		...report,
+		collisions
+	};
+}
+/**
+* The filter + projection the survey needs, as DATA.
+*
+* Exported rather than embedded in a query builder because a mongoose `Model`
+* and a raw driver `Collection` have incompatible read APIs (`.select().lean()`
+* vs `.find(filter, { projection })`), and every host will reach for whichever
+* it already has open. Two hosts hand-writing "the phone-identity query" is two
+* chances to diverge on the filter and report different damage from the same
+* database.
+*
+* Deliberately NOT tenant-scoped. A collision IS two rows that should be one;
+* scanning a branch at a time would see each half separately and find nothing —
+* the same blindness that let the split happen.
+*
+* Deliberately a narrow projection over a plain read: this must be safe to run
+* against production on a Tuesday afternoon.
+*/
+const PHONE_IDENTITY_QUERY = {
+	filter: { identityKeys: { $regex: "^phone:" } },
+	projection: {
+		_id: 1,
+		displayName: 1,
+		kind: 1,
+		status: 1,
+		roles: 1,
+		identityKeys: 1,
+		contactPoints: 1,
+		createdAt: 1
+	}
+};
+/**
+* Read every party carrying a phone identity and plan the repair.
+*
+* Takes a READER rather than a model: the kernel states the query
+* ({@link PHONE_IDENTITY_QUERY}), the host runs it with whatever handle it has.
+*/
+async function scanPhoneIdentityRepair(read, options = {}) {
+	return planPhoneIdentityRepair(await read(), options);
+}
+/** Human-readable dry-run output. Deterministic — safe to diff between runs. */
+function formatPhoneRepairReport(report) {
+	const lines = [];
+	const push = (s = "") => void lines.push(s);
+	push("=== Party phone-identity repair — DRY RUN (nothing was written) ===");
+	push(`region for local numbers : ${report.defaultRegion ?? "(none — E.164 only)"}`);
+	push(`parties scanned          : ${report.scannedParties}`);
+	push(`  with a phone identity  : ${report.partiesWithPhone}`);
+	push(`phone identity keys      : ${report.phoneKeys}`);
+	push(`  already canonical      : ${report.canonical}`);
+	push(`  need a rekey (safe)    : ${report.rekey.length}`);
+	push(`  unreadable (human)     : ${report.unparseable.length}`);
+	push(`COLLISION GROUPS         : ${report.collisions.length}`);
+	push(`  parties involved       : ${report.partiesInCollisions}`);
+	push(`  parties that would go  : ${report.partiesCollapsed}  <- merges required`);
+	push(`  with facets on 2+ sides: ${report.collisions.filter((g) => g.attachmentsOnBothSides).length}`);
+	push();
+	if (report.collisions.length > 0) {
+		push("--- COLLISIONS (one human, several parties) — MERGE IS A HUMAN DECISION ---");
+		for (const group of report.collisions) {
+			const flags = [group.conflicts.length > 0 ? `conflicts: ${group.conflicts.join(",")}` : "no field conflicts", group.attachmentsOnBothSides ? "FACETS ON BOTH SIDES" : ""].filter(Boolean);
+			push(`${group.canonicalKey}  (${group.parties.length} parties; ${flags.join("; ")})`);
+			for (const party of group.parties) {
+				const facets = group.attachments?.[party.partyId];
+				const facetText = facets ? Object.entries(facets).filter(([, n]) => n > 0).map(([k, n]) => `${k}=${n}`).join(" ") : "";
+				push(`    ${party.partyId}  ${party.displayName.padEnd(24)} ${party.status.padEnd(9)} ${party.storedKey.padEnd(24)} ${facetText}`);
+			}
+		}
+		push();
+	}
+	if (report.rekey.length > 0) {
+		push("--- REKEY (one party, wrong key; mechanical) ---");
+		for (const f of report.rekey) push(`    ${f.partyId}  ${f.storedKey}  ->  ${f.canonicalKey}`);
+		push();
+	}
+	if (report.unparseable.length > 0) {
+		push("--- UNREADABLE (reported, never rewritten) ---");
+		for (const f of report.unparseable) push(`    ${f.partyId}  ${f.storedKey}  (${f.reason})`);
+		push();
+	}
+	push("No documents were modified. To act on a collision group, a human calls");
+	push("PartyRepository.merge(loserId, survivorId, ctx) after checking the facets.");
+	return lines.join("\n");
+}
+//#endregion
+export { PHONE_IDENTITY_QUERY, formatPhoneRepairReport, planPhoneIdentityRepair, scanPhoneIdentityRepair, withAttachmentCounts };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classytic/party",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Engine-factory Party / Business-Partner identity kernel — one canonical party (person | company | group) carrying customer/supplier/contact/employee roles, contact points, addresses, B2B hierarchy, tax identity, and 1:many auth-user links. Dedup + merge + resolve. SAP-BP shape (thin identity + domain facets), NOT an Odoo god-object. PACKAGE_RULES compliant; Mongoose + mongokit + arc primitives.",
   "author": "Classytic",
   "license": "MIT",
@@ -21,6 +21,10 @@
       "types": "./dist/events.d.ts",
       "default": "./dist/events.js"
     },
+    "./maintenance": {
+      "types": "./dist/maintenance.d.ts",
+      "default": "./dist/maintenance.js"
+    },
     "./schemas": {
       "types": "./dist/schemas.d.ts",
       "default": "./dist/schemas.js"
@@ -57,20 +61,23 @@
     "mongodb": "7.2.0"
   },
   "peerDependencies": {
-    "@classytic/mongokit": ">=3.20.0",
-    "@classytic/primitives": ">=0.9.1",
-    "@classytic/repo-core": ">=0.9.0",
+    "@classytic/mongokit": ">=3.33.0",
+    "@classytic/contact": ">=0.1.0",
+    "@classytic/primitives": ">=0.23.0",
+    "@classytic/repo-core": ">=0.24.0",
     "mongoose": ">=9.4.1",
     "zod": ">=4.0.0"
   },
   "devDependencies": {
-    "@classytic/mongokit": "^3.20.0",
-    "@classytic/primitives": "^0.9.0",
-    "@classytic/repo-core": "^0.9.0",
+    "@classytic/mongokit": "^3.33.0",
+    "@classytic/contact": ">=0.1.0",
+    "@classytic/primitives": ">=0.23.0",
+    "@classytic/repo-core": ">=0.24.0",
     "@types/node": "^25.5.0",
     "mongodb-memory-server": "^10.1.4",
     "mongoose": "^9.4.1",
-    "tsdown": "^0.22.5",
+    "publint": "^0.3.23",
+    "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
     "vitest": "^3.2.4",
     "zod": "^4.3.6"