improve zod v3 compat

Author: carderne

packages/core/src/v3/schemas/api.ts

@@ -272,7 +272,7 @@ export type IdempotencyKeyOptionsSchema = z.infer<typeof IdempotencyKeyOptionsSc
 // with PrismaClientValidationError. Accept the intent and stringify here.
 const ConcurrencyKeySchema = z.union([z.string(), z.number()]).transform((value) => String(value));
 
-const ExternalDeploymentId = z.preprocess((value) => {
+const ExternalDeploymentId: z.ZodType<string | undefined> = z.preprocess((value) => {
   if (typeof value !== "string") {
     return value;
   }

packages/core/src/v3/schemas/webhookConfig.ts

@@ -1,7 +1,8 @@
 import { z } from "zod/v4";
+import { discriminatedUnion } from "../utils/zod.js";
 
-// Ingress webhook verification config. Kept in a LEAF module (imports only `z`) so it
-// can be consumed by resources.ts / schemas.ts without dragging in the alert-webhook
+// Ingress webhook verification config. Kept in a LEAF module (imports only `z` and
+// the Zod compatibility helper) so it can be consumed by resources.ts / schemas.ts without dragging in the alert-webhook
 // `Webhook` union in webhooks.ts, which imports api.js (RunStatus). resources.ts is
 // imported by api.ts, so a resources -> webhooks -> api edge would be a module-init cycle.
 
@@ -24,7 +25,7 @@ export type WebhookIdempotencyField = z.infer<typeof WebhookIdempotencyField>;
 // Where a scalar value comes from. Used for the timestamp and for signing-string template vars.
 // "signatureField" reads a field parsed out of the signature header (e.g. Stripe `t`).
 // "url" is the inbound request URL (e.g. Square signs `{url}{body}`). "constant" is a literal.
-export const WebhookValueSource = z.discriminatedUnion("from", [
+export const WebhookValueSource = discriminatedUnion("from", [
   z.object({ from: z.literal("header"), name: z.string() }),
   z.object({ from: z.literal("signatureField"), field: z.string() }),
   z.object({ from: z.literal("body"), path: z.string() }),
@@ -133,7 +134,7 @@ export const WebhookUrlSecretConfig = z.object({
 });
 export type WebhookUrlSecretConfig = z.infer<typeof WebhookUrlSecretConfig>;
 
-export const WebhookVerifierConfig = z.discriminatedUnion("scheme", [
+export const WebhookVerifierConfig = discriminatedUnion("scheme", [
   WebhookHmacConfig,
   WebhookSharedSecretConfig,
   WebhookUrlSecretConfig,
@@ -152,7 +153,7 @@ export const WebhookHandshakeConfig = z.object({
 export type WebhookHandshakeConfig = z.infer<typeof WebhookHandshakeConfig>;
 
 // ── Verifier artifact: data-only tagged union stored on WebhookEndpoint.verifierArtifact ──
-export const WebhookVerifierArtifact = z.discriminatedUnion("kind", [
+export const WebhookVerifierArtifact = discriminatedUnion("kind", [
   z.object({
     kind: z.literal("config"),
     config: WebhookVerifierConfig,
@@ -173,7 +174,7 @@ export type WebhookVerifierArtifact = z.infer<typeof WebhookVerifierArtifact>;
 // session: keyTemplate resolves the externalId, deliverAs selects the mode. "action" (chat.event)
 // carries actionType → the onAction envelope's action.type; "message" (channels) carries connectorId
 // → the run resolves the connector's inbound() mapper and runs a turn.
-export const WebhookRoutingTarget = z.discriminatedUnion("type", [
+export const WebhookRoutingTarget = discriminatedUnion("type", [
   z.object({ type: z.literal("task"), taskId: z.string() }),
   z.object({
     type: z.literal("session"),