typespec-http-zod 0.26.0 → 0.28.0

package/dist/src/statuses.js

@@ -0,0 +1,27 @@
+/**
+ * **The status codes a server can answer with, by class.** A `4XX` range or a `default` response
+ * means "every code in these classes that nothing more specific claims", and a type for such a
+ * result needs those codes spelled out: `number` would admit `999`, and a type that admits a status
+ * no server can send is a type no client can narrow on.
+ *
+ * **One list, owned here, because two server emitters each held a copy.** `typespec-hono` and
+ * `typespec-http-mcp` both typed a ranged or `default` result from their own table, and the contract
+ * types in `requests.gen.ts` need the same one to state a result a backend can hand straight to
+ * either. Three copies of a table that must agree are three tables that will not.
+ *
+ * **Graded outside this package, against Hono's own `http-status.d.ts`,** by the two emitters that
+ * serve through it - an expectation that does not come from the code it grades. A code Hono adds
+ * turns their arm red here first.
+ */
+export const STATUS_CODES = {
+    1: [100, 101, 102, 103],
+    2: [200, 201, 202, 203, 204, 205, 206, 207, 208, 226],
+    3: [300, 301, 302, 303, 304, 305, 306, 307, 308],
+    4: [
+        400, 401, 402, 403, 404, 405, 406, 407, 408, 409, 410, 411, 412, 413, 414, 415, 416, 417, 418,
+        421, 422, 423, 424, 425, 426, 428, 429, 431, 451,
+    ],
+    5: [500, 501, 502, 503, 504, 505, 506, 507, 508, 510, 511],
+};
+/** The codes a response cannot carry a body under, per RFC 9110: 101, 204, 205 and 304. */
+export const CONTENTLESS_STATUS_CODES = [101, 204, 205, 304];

package/dist/src/types.js

@@ -1,6 +1,6 @@
-import { getDiscriminatedUnion, getEncode, isNeverType, resolveEncodedName, } from "@typespec/compiler";
+import { getDiscriminatedUnion, isNeverType, resolveEncodedName, } from "@typespec/compiler";
 import { reportDiagnostic } from "./lib.js";
-import { discriminatedSubtypes, effectiveIndexer, inheritedAndOwnProperties, isOptionalAt, isPayloadProperty, objectKey, refusalTarget, withDeclarationSite, } from "./zod.js";
+import { discriminatedSubtypes, effectiveIndexer, emitsDefault, encodedTypeOf, inheritedAndOwnProperties, isOptionalAt, isPayloadProperty, objectKey, refusalTarget, withDeclarationSite, } from "./zod.js";
 /**
  * TypeSpec type -> plain TypeScript type text.
  *
@@ -12,9 +12,10 @@ import { discriminatedSubtypes, effectiveIndexer, inheritedAndOwnProperties, isO
  * importing the other.
  *
  * **It must agree with `zod.ts` exactly**, because the emitted assertion compares them. Every rule
- * here has a counterpart there: `utcDateTime` is a string on both sides, `?` becomes
- * `?: T | undefined` because `exactOptionalPropertyTypes` is on, and a property the document leaves
- * out of `required` is optional here whether its absence is spelled `?` or covered by a default.
+ * here has a counterpart there: `utcDateTime` is a string on both sides, `?` is `?: T` because
+ * `.exactOptional()` refuses an explicit `undefined` and `?: T | undefined` only where `.default()`
+ * accepts one, and a property the document leaves out of `required` is optional here whether its
+ * absence is spelled `?` or covered by a default.
  *
  * **The assertion pairs this walk against `z.input`, the type the validator ACCEPTS**, and not
  * against `z.infer`, which is what it produces. These types are the floor a producer supplies, and
@@ -72,7 +73,7 @@ function refuse(program, type, why, remedy = "") {
 }
 function scalarToTs(program, scalar) {
     // A scalar declaration can carry the encoding itself - see `scalarToZod`.
-    const encoded = getEncode(program, scalar)?.type;
+    const encoded = encodedTypeOf(program, scalar);
     if (encoded !== undefined && encoded !== scalar)
         return scalarToTs(program, encoded);
     let current = scalar;
@@ -261,9 +262,14 @@ function modelToTs(program, model) {
  * annotation claims is by construction the type this walk renders for the same property.
  */
 export function propertyTypeToTs(program, property) {
-    // `@encode` changes the wire TYPE, resolved exactly as `zod.ts` resolves it - a property encoded as
-    // a string on one side and an array on the other fails the emitted assertion, and deserves to.
-    const encoded = getEncode(program, property)?.type;
+    /**
+     * **`@encode` changes the wire TYPE, and `encodedTypeOf` is the one rule for when it does.** This
+     * read `getEncode(...).type` directly, so it missed the exception the Zod walk makes: an array
+     * encoding on a QUERY parameter is a style of flattening, not a type, and the validator splits it
+     * back into the declared list. So `WireInputs` said `colors: string` for a pipe-delimited query
+     * whose handler is given `string[]` - two walks of one property, one of them knowing a rule.
+     */
+    const encoded = encodedTypeOf(program, property);
     return typeToTs(program, encoded ?? property.type);
 }
 export function propertyToTs(program, property, wireName) {
@@ -297,21 +303,28 @@ export function propertyToTs(program, property, wireName) {
      * `.default(...)` for it - so the two walks agree without either one restating the rule.
      */
     /**
-     * **`?: T | undefined`, and dropping the `| undefined` was tried in `0.19.0` and reverted.**
+     * **`?: T`, and `?: T | undefined` only where the validator emits `.default(...)`. The contract
+     * type is the validator's INPUT, `z.input`, at every property.**
+     *
+     * `.exactOptional()` refuses `{ note: undefined }` and `.default(v)` accepts it, so those are the
+     * two answers; {@link emitsDefault} says which one this property got. `wire-contract.gen.ts`
+     * compares the two walks with nothing widened, so a disagreement here does not compile.
      *
-     * It looks wrong - JSON has no `undefined`, so a wire type saying `?: T` reads more honest, and
-     * it would make this walk agree with `z.infer<...>` on the schemas side. **Measured, it
-     * breaks the most ordinary handler there is.** `createWidget: (ctx, input) => ok(input)` - return
-     * what you were given - stopped compiling, because what a handler RECEIVES carries
-     * `?: T | undefined` and what it would then have to SUPPLY did not.
+     * **This was `?: T | undefined` for every optional, kept deliberately on three reasons that were
+     * each measured false** once `0.24.0` moved the validator to `.exactOptional()`:
      *
-     * That is the difference from the index signature and from `readonly`, which look like the same
-     * class and are not: removing those two makes MORE values assignable, and removing this one makes
-     * fewer. `{ retiredOn: undefined }` serialises to `{}`, identical to omitting the key, so
-     * permitting it costs the wire nothing and refusing it costs every producer a conditional spread.
+     * - the echo handler `(ctx, input) => ok(input)` broke without it, because what a handler
+     *   received carried `| undefined`. What it receives is `z.infer` of `.exactOptional()` now,
+     *   `?: T`, and the echo compiles;
+     * - `{ note: undefined }` serialises identically to omitting the key. A server checks a body
+     *   before it serialises it: a value typed by `WireOutputs` reached `servedBody` and answered
+     *   500 for a body whose bytes were valid, and across a service binding it is never serialised;
+     * - refusing it costs a producer a conditional spread. That spread infers `{ note?: string }` on
+     *   TypeScript 5.9 and 7.0 and assigns to the exact type, and it is what a producer under
+     *   `exactOptionalPropertyTypes` writes for the handler's own return type anyway.
      *
-     * The two emitted surfaces differ here on purpose, exactly as they do on openness:
-     * `schemas.gen.ts` exports the narrow received view, this walk emits the permissive floor.
+     * Two consumers reported the disagreement independently - one carried a `Loosen<T>` to compare the
+     * two surfaces - and openapi-typescript, `hc` and `z.infer` all spell an optional `?: T`.
      */
     /**
      * **Optional AT THIS POSITION, not merely optional in the declaration.** A PATCH body's properties
@@ -319,9 +332,9 @@ export function propertyToTs(program, property, wireName) {
      * what `propertyToZod` has always consulted. This walk read `property.optional` alone, so an
      * update contract demanded every field while the validator beside it accepted any subset.
      */
-    return property.optional || isOptionalAt(program, property)
-        ? `${key}?: ${value} | undefined;`
-        : `${key}: ${value};`;
+    if (!(property.optional || isOptionalAt(program, property)))
+        return `${key}: ${value};`;
+    return emitsDefault(program, property) ? `${key}?: ${value} | undefined;` : `${key}?: ${value};`;
 }
 /** Installed by the registry so a named model is declared once and referenced everywhere else. */
 let resolveRef = () => undefined;

package/dist/src/uri-template.d.ts

@@ -103,4 +103,4 @@ export declare function explodedQueryCall(spec: {
  * gathers those keys back under the parameter's name before the query object is validated: a model
  * takes exactly its declared properties, a record every key no other query parameter claims.
  */
-export declare const EXPLODED_QUERY_SOURCE = "\n/** RFC 6570 form expansion of an exploded record or model, gathered back under its parameter. */\nfunction explodedQuery(\n\traw: unknown,\n\tspec: {\n\t\treadonly name: string;\n\t\treadonly others: readonly string[];\n\t\treadonly keys: readonly string[] | null;\n\t\treadonly numbers: readonly string[];\n\t\treadonly booleans: readonly string[];\n\t\treadonly values: \"number\" | \"boolean\" | \"\";\n\t},\n): unknown {\n\tif (raw === null || typeof raw !== \"object\" || Array.isArray(raw) || spec.name in raw) return raw;\n\tconst gathered: Record<string, unknown> = {};\n\tconst rest: Record<string, unknown> = {};\n\tfor (const [key, value] of Object.entries(raw)) {\n\t\tconst own = spec.keys === null ? !spec.others.includes(key) : spec.keys.includes(key);\n\t\tif (!own) {\n\t\t\trest[key] = value;\n\t\t\tcontinue;\n\t\t}\n\t\tconst kind = spec.values !== \"\" ? spec.values : spec.numbers.includes(key) ? \"number\" : spec.booleans.includes(key) ? \"boolean\" : \"\";\n\t\tgathered[key] =\n\t\t\ttypeof value !== \"string\"\n\t\t\t\t? value\n\t\t\t\t: kind === \"number\" && value.trim() !== \"\" && Number.isFinite(Number(value))\n\t\t\t\t\t? Number(value)\n\t\t\t\t\t: kind === \"boolean\" && (value === \"true\" || value === \"false\")\n\t\t\t\t\t\t? value === \"true\"\n\t\t\t\t\t\t: value;\n\t}\n\treturn Object.keys(gathered).length === 0 ? raw : { ...rest, [spec.name]: gathered };\n}\n";
+export declare const EXPLODED_QUERY_SOURCE = "\n/** RFC 6570 form expansion of an exploded record or model, gathered back under its parameter. */\nfunction explodedQuery(\n\traw: unknown,\n\tspec: {\n\t\treadonly name: string;\n\t\treadonly others: readonly string[];\n\t\treadonly keys: readonly string[] | null;\n\t\treadonly numbers: readonly string[];\n\t\treadonly booleans: readonly string[];\n\t\treadonly values: \"number\" | \"boolean\" | \"\";\n\t},\n): unknown {\n\tif (raw === null || typeof raw !== \"object\" || Array.isArray(raw)) return raw;\n\tconst gathered: Record<string, unknown> = {};\n\tconst rest: Record<string, unknown> = {};\n\tfor (const [key, value] of Object.entries(raw)) {\n\t\t// Already gathered only where an OBJECT sits under the name: a query value from the wire is a\n\t\t// string or a list of them, and `{ param: 0 }` expands to `?param=0`.\n\t\tif (key === spec.name && value !== null && typeof value === \"object\" && !Array.isArray(value)) return raw;\n\t\tconst own = spec.keys === null ? !spec.others.includes(key) : spec.keys.includes(key);\n\t\tif (!own) {\n\t\t\trest[key] = value;\n\t\t\tcontinue;\n\t\t}\n\t\tconst kind = spec.values !== \"\" ? spec.values : spec.numbers.includes(key) ? \"number\" : spec.booleans.includes(key) ? \"boolean\" : \"\";\n\t\tgathered[key] =\n\t\t\ttypeof value !== \"string\"\n\t\t\t\t? value\n\t\t\t\t: kind === \"number\" && value.trim() !== \"\" && Number.isFinite(Number(value))\n\t\t\t\t\t? Number(value)\n\t\t\t\t\t: kind === \"boolean\" && (value === \"true\" || value === \"false\")\n\t\t\t\t\t\t? value === \"true\"\n\t\t\t\t\t\t: value;\n\t}\n\treturn Object.keys(gathered).length === 0 ? raw : { ...rest, [spec.name]: gathered };\n}\n";

package/dist/src/uri-template.js

@@ -230,10 +230,13 @@ function explodedQuery(
 		readonly values: "number" | "boolean" | "";
 	},
 ): unknown {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw) || spec.name in raw) return raw;
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
 	const gathered: Record<string, unknown> = {};
 	const rest: Record<string, unknown> = {};
 	for (const [key, value] of Object.entries(raw)) {
+		// Already gathered only where an OBJECT sits under the name: a query value from the wire is a
+		// string or a list of them, and \`{ param: 0 }\` expands to \`?param=0\`.
+		if (key === spec.name && value !== null && typeof value === "object" && !Array.isArray(value)) return raw;
 		const own = spec.keys === null ? !spec.others.includes(key) : spec.keys.includes(key);
 		if (!own) {
 			rest[key] = value;

package/dist/src/zod.d.ts

@@ -1,5 +1,15 @@
-import { type Enum, type Model, type ModelProperty, type Program, type Type } from "@typespec/compiler";
+import { type Enum, type Model, type ModelProperty, type Program, type Scalar, type Type } from "@typespec/compiler";
 import { Visibility } from "@typespec/http";
+/**
+ * What a walk returns after reporting a refusal.
+ *
+ * **Reporting does not unwind, which is the point.** A throw abandoned the compile at the first
+ * unrepresentable construct; reporting lets the walk carry on and name every one of them in a single
+ * run. The walk still has to return a `string`, and `z.never()` is the honest placeholder: valid
+ * Zod, rejects everything, and unreachable in practice because the error diagnostic has already
+ * failed the compile that would have written it.
+ */
+export declare const UNREPRESENTABLE = "z.never()";
 export declare function withDeferredAnnotator<T>(annotator: (property: ModelProperty) => string | undefined, run: () => T): T;
 export declare function withSealedObjects<T>(sealed: boolean, run: () => T): T;
 export declare function withVisibility<T>(program: Program, next: Visibility, run: () => T): T;
@@ -98,23 +108,6 @@ export declare function effectiveIndexer(model: Model): Model["indexer"];
  * for a real subtype - the same rule that decides whether a base may be sealed.
  */
 export declare function discriminatedSubtypes(program: Program, model: Model): readonly Model[];
-/**
- * **What JSON kind a value of this type arrives as, for a parameter carried in text.**
- *
- * A path, query or header value is always a string on the wire, so a numeric or boolean parameter has
- * to be decoded before the document's schema runs. Deciding WHICH decoder applies used to be done by
- * inspecting the emitted Zod - `declared.startsWith("z.number()")` - which is a string about a string
- * and fails silently the moment the expression is spelled any other way.
- *
- * It did. `@query size: 10 | 25 | 50` emits `z.union([z.literal(10), ...])`, which starts with
- * neither, so no decoder was wrapped around it and the validator required the NUMBER 25 from a wire
- * that can only deliver `"25"`. Measured: `?size=25` rejected, `size: 25` accepted. Every conformant
- * caller got a 400, and no document comparison could see it, because both sides agree the parameter
- * is a number - the disagreement is with the wire.
- *
- * Reading the TYPE answers the question the emitted text was standing in for. `SCALARS` remains the
- * single list of what becomes a number, so this cannot drift from what `scalarToZod` emits.
- */
 export declare function wireKindOf(program: Program, type: Type): "number" | "boolean" | undefined;
 /**
  * A name as an object key - quoted when it is not a legal JavaScript identifier.
@@ -150,7 +143,21 @@ export declare function objectKey(name: string): string;
  * comment indented differently from the member it documents is the tell that a generator wrote it.
  */
 export declare function jsDocComment(text: string | undefined, indent: string): string;
+export declare function encodedTypeOf(program: Program, target: ModelProperty | Scalar): Scalar | undefined;
 export declare function propertyToZod(program: Program, property: ModelProperty): string;
+/**
+ * **Whether `propertyToZod` emits `.default(...)` for this property, which is exactly whether its
+ * INPUT admits an explicit `undefined`.**
+ *
+ * `.exactOptional()` refuses `{ p: undefined }`; `.default(v)` accepts it and fills `v`. The contract
+ * types in `requests.gen.ts` state the input, so they have to know which of the two this emitted -
+ * and asking this function rather than restating its rule is what keeps the two walks agreeing.
+ * A default on a REQUIRED property emits neither (`default-on-required-property`), and one whose
+ * value cannot be rendered emits no `.default()` (`unsupported-default`); both fall out here.
+ *
+ * Pure: it reports nothing, so the type walk can ask it without duplicating a diagnostic.
+ */
+export declare function emitsDefault(program: Program, property: ModelProperty): boolean;
 export declare function withRefResolver<T>(resolver: (type: Type) => string | undefined, run: () => T): T;
 /** Called by the registry when it hands out the identifier of a declaration that is still open. */
 export declare function noteBackEdge(): void;

package/dist/src/zod.js

@@ -11,7 +11,7 @@ import { reportDiagnostic } from "./lib.js";
  * Zod, rejects everything, and unreachable in practice because the error diagnostic has already
  * failed the compile that would have written it.
  */
-const UNREPRESENTABLE = "z.never()";
+export const UNREPRESENTABLE = "z.never()";
 /**
  * **Installed by the registry, which is the only place that knows what a declared type is CALLED.**
  *
@@ -339,16 +339,36 @@ const SCALARS = {
     string: "z.string()",
     boolean: "z.boolean()",
     bytes: "z.string()",
-    int8: "z.number().int()",
-    int16: "z.number().int()",
-    int32: "z.number().int()",
-    int64: "z.number().int()",
-    safeint: "z.number().int()",
-    uint8: "z.number().int()",
-    uint16: "z.number().int()",
-    uint32: "z.number().int()",
-    uint64: "z.number().int()",
-    integer: "z.number().int()",
+    /**
+     * **A declared WIDTH is a claim about the value too, and ten of them used to share one check.**
+     *
+     * Every integer scalar emitted `z.number().int()`, which is "an integer within the safe range" and
+     * nothing more. Measured at the wire on `workerd`, against a document publishing the widths below:
+     * a `uint8` accepted `-5` and `100000`, an `int32` accepted `3000000000` and `-3000000000`.
+     *
+     * The differential oracle cannot see it. JSON Schema 2020-12 treats `format` as an annotation, so
+     * Ajv on the published document answers VALID for all of those and agrees with the server while
+     * both are wrong. Ajv says so out loud: `unknown format "uint8" ignored`.
+     *
+     * Zod 4 has the named formats for the two widths that have them, and they emit better JSON Schema
+     * than a bare bound would. The rest take explicit bounds.
+     *
+     * **`int64` and `uint64` keep the safe-integer ceiling, and that is a limit rather than a
+     * choice.** `JSON.parse` has already lost a value above 2^53 before any validator runs, so the
+     * alternatives are to refuse it or to accept a number that is not the one the caller sent.
+     * Refusing is the honest one. `z.int64()` exists but is a `bigint`, which a JSON body cannot
+     * carry. What changes here is only that `uint64` stops accepting negatives.
+     */
+    int8: "z.int().min(-128).max(127)",
+    int16: "z.int().min(-32768).max(32767)",
+    int32: "z.int32()",
+    int64: "z.int()",
+    safeint: "z.int()",
+    uint8: "z.int().min(0).max(255)",
+    uint16: "z.int().min(0).max(65535)",
+    uint32: "z.uint32()",
+    uint64: "z.int().min(0)",
+    integer: "z.int()",
     float: "z.number()",
     float32: "z.number()",
     float64: "z.number()",
@@ -859,8 +879,25 @@ function modelToZod(program, model) {
  * is a number - the disagreement is with the wire.
  *
  * Reading the TYPE answers the question the emitted text was standing in for. `SCALARS` remains the
- * single list of what becomes a number, so this cannot drift from what `scalarToZod` emits.
+ * single list of what becomes a number.
+ *
+ * **It still inspects the emitted expression to decide WHICH kind, and that did drift once more.**
+ * The test was `startsWith("z.number()")`, and giving each integer width its declared bounds spelled
+ * nine of them `z.int(`, `z.int32(` and `z.uint32(` instead. Every one silently lost its wire
+ * decoder: 22 arms went red at once, which is the only reason it was not shipped. The prefixes live
+ * in one named constant now.
+ *
+ * **That claim named a `scalars.test.ts` which did not exist, and nothing graded the list.**
+ * Measured: dropping `z.uint32(` from it, and separately `z.int(`, left all 468 arms in this
+ * package green, because no fixture had ever declared an integer width as a PARAMETER - the only
+ * place the decoder is attached. `test/widths/` now declares all ten as query parameters and sends
+ * each as text, so a spelling this list forgets fails here rather than at a consumer.
  */
+/**
+ * Every emitted expression that denotes a JSON number. Named once, because `SCALARS` and this list
+ * have to agree and nothing about the two being in the same file makes them.
+ */
+const NUMERIC_EXPRESSIONS = ["z.number()", "z.int(", "z.int32(", "z.uint32("];
 export function wireKindOf(program, type) {
     if (type.kind === "Scalar") {
         const encoded = encodedTypeOf(program, type);
@@ -870,7 +907,7 @@ export function wireKindOf(program, type) {
             const mapped = SCALARS[current.name];
             if (mapped === undefined)
                 continue;
-            if (mapped.startsWith("z.number()"))
+            if (NUMERIC_EXPRESSIONS.some((prefix) => mapped.startsWith(prefix)))
                 return "number";
             if (mapped === "z.boolean()")
                 return "boolean";
@@ -1026,7 +1063,7 @@ const PARAMETER_STYLE_ENCODINGS = new Set([
     "ArrayEncoding.commaDelimited",
     "ArrayEncoding.newlineDelimited",
 ]);
-function encodedTypeOf(program, target) {
+export function encodedTypeOf(program, target) {
     const encoded = getEncode(program, target);
     if (encoded === undefined)
         return undefined;
@@ -1172,6 +1209,24 @@ function renderValue(value) {
     }
     return undefined;
 }
+/**
+ * **Whether `propertyToZod` emits `.default(...)` for this property, which is exactly whether its
+ * INPUT admits an explicit `undefined`.**
+ *
+ * `.exactOptional()` refuses `{ p: undefined }`; `.default(v)` accepts it and fills `v`. The contract
+ * types in `requests.gen.ts` state the input, so they have to know which of the two this emitted -
+ * and asking this function rather than restating its rule is what keeps the two walks agreeing.
+ * A default on a REQUIRED property emits neither (`default-on-required-property`), and one whose
+ * value cannot be rendered emits no `.default()` (`unsupported-default`); both fall out here.
+ *
+ * Pure: it reports nothing, so the type walk can ask it without duplicating a diagnostic.
+ */
+export function emitsDefault(program, property) {
+    const optional = property.optional || isOptionalAt(program, property);
+    return (optional &&
+        property.defaultValue !== undefined &&
+        renderValue(property.defaultValue) !== undefined);
+}
 /** A property's declared default, as a JS literal, or `undefined` when it has none. */
 function defaultOf(program, property) {
     const value = property.defaultValue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "typespec-http-zod",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "TypeSpec emitter and library: turn an HTTP service definition into Zod validators and framework-free contract types that agree, keyword for keyword, with the OpenAPI document @typespec/openapi3 publishes from the same source.",
   "keywords": [
     "codegen",
@@ -42,19 +42,22 @@
     "access": "public",
     "provenance": true
   },
+  "dependencies": {
+    "redos-detector": "^6.1.4"
+  },
   "devDependencies": {
     "@types/node": "^26.5.1",
-    "@typespec/compiler": "1.16.0",
-    "@typespec/events": "0.86.0",
-    "@typespec/http": "1.16.0",
-    "@typespec/http-specs": "0.1.0-alpha.41",
-    "@typespec/openapi": "1.16.0",
-    "@typespec/openapi3": "1.16.0",
-    "@typespec/rest": "0.86.0",
-    "@typespec/sse": "0.86.0",
-    "@typespec/streams": "0.86.0",
-    "@typespec/versioning": "0.86.0",
-    "@typespec/xml": "0.86.0",
+    "@typespec/compiler": "1.17.0",
+    "@typespec/events": "0.87.0",
+    "@typespec/http": "1.17.0",
+    "@typespec/http-specs": "0.1.0-alpha.44",
+    "@typespec/openapi": "1.17.0",
+    "@typespec/openapi3": "1.17.0",
+    "@typespec/rest": "0.87.0",
+    "@typespec/sse": "0.87.0",
+    "@typespec/streams": "0.87.0",
+    "@typespec/versioning": "0.87.0",
+    "@typespec/xml": "0.87.0",
     "ajv": "^8.20.0",
     "oxfmt": "^0.67.0",
     "oxlint": "^1.82.0",
@@ -62,14 +65,14 @@
     "typespec-http-zod": "link:.",
     "vitest": "^5.0.0",
     "yaml": "^2.9.1",
-    "zod": "^4.5.2"
+    "zod": "^4.6.5"
   },
   "peerDependencies": {
     "@typespec/compiler": "^1.15.0",
     "@typespec/http": "^1.15.0",
     "@typespec/openapi": "^1.15.0",
-    "@typespec/streams": "^0.85.0 || ^0.86.0",
-    "@typespec/versioning": "^0.85.0 || ^0.86.0",
+    "@typespec/streams": "^0.85.0 || ^0.86.0 || ^0.87.0",
+    "@typespec/versioning": "^0.85.0 || ^0.86.0 || ^0.87.0",
     "zod": "^4.5.0"
   },
   "peerDependenciesMeta": {
@@ -85,7 +88,7 @@
   },
   "tspMain": "lib/main.tsp",
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "node --eval \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.build.json",
     "test": "tsc -p tsconfig.build.json && vitest run",
     "typecheck": "tsc -p tsconfig.json",
     "lint": "oxlint src/ test/",