fix(client): take zod as a peer dependency

docs/migrating-to-1-0.mdx

@@ -165,8 +165,13 @@ Every validator moves, including the historic aliases (`EventSchemas`, the
 `*InputPartSchema` names, `OptionalMetadataSchema`) and the capability
 schemas. `@ag-ui/client` no longer re-exports them either — it re-exports
 core's main entry, and they are not on it. `@ag-ui/client` itself still
-depends on zod, because its enforcement stage validates with it; nothing
-changes in how you install the client.
+needs zod, because its enforcement stage validates with it. It takes zod as a
+peer dependency (as do `@ag-ui/encoder` and `@ag-ui/proto`), so install zod
+alongside it:
+
+```bash
+npm install @ag-ui/client zod
+```
 
 ### Unknown material no longer reaches your code
 

sdks/typescript/packages/client/README.md

@@ -7,11 +7,15 @@ Client SDK for connecting to **Agent-User Interaction (AG-UI) Protocol** servers
 ## Installation
 
 ```bash
-npm install @ag-ui/client
-pnpm add @ag-ui/client
-yarn add @ag-ui/client
+npm install @ag-ui/client zod
+pnpm add @ag-ui/client zod
+yarn add @ag-ui/client zod
 ```
 
+zod (3.25.18+ or 4.x) is a peer dependency. The client's enforcement stage
+validates every event with the schemas on `@ag-ui/core/schemas`, using the zod
+your application installs rather than a bundled copy.
+
 ## Features
 
 - 🔗 **HTTP connectivity** – `HttpAgent` for direct server connections with SSE/protobuf support

sdks/typescript/packages/client/package.json

@@ -44,8 +44,10 @@
     "fast-json-patch": "^3.1.1",
     "rxjs": "7.8.1",
     "untruncate-json": "^0.0.1",
-    "uuid": "^11.1.0",
-    "zod": "^3.25.76"
+    "uuid": "^11.1.0"
+  },
+  "peerDependencies": {
+    "zod": "^3.25.18 || ^4.0.0"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.17.4",
@@ -56,7 +58,8 @@
     "publint": "^0.3.12",
     "tsdown": "^0.20.1",
     "typescript": "^5.3.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.0.18",
+    "zod": "^3.25.76"
   },
   "exports": {
     ".": {

sdks/typescript/packages/core/scripts/verify-zod-matrix.mjs

@@ -100,10 +100,10 @@ try {
         .pop(),
     );
   const tarball = pack(PACKAGE_DIR);
-  // The client cell: core is an optional peer, but @ag-ui/client pins its own zod, so an
-  // application on a different zod holds TWO copies — client's enforcement then introspects
-  // schemas built by the copy it did not resolve. That is where a core-only matrix is blind
-  // (zod@3.25.18 next to client's 3.25.76 once keyed every event schema under "undefined").
+  // The client cell: @ag-ui/client, encoder and proto take zod as a peer, so the client's
+  // enforcement must run on whichever supported zod the application installed — and must
+  // not drag in a second copy of its own. A core-only matrix is blind here (zod@3.25.18
+  // once keyed every event schema under "undefined" in the client's enforcement).
   const SIBLINGS = ["proto", "encoder", "client"];
   const siblingTarballs = Object.fromEntries(
     SIBLINGS.map((name) => [name, pack(join(PACKAGE_DIR, "..", name))]),
@@ -127,8 +127,7 @@ try {
               zod: zodVersion,
             },
             // No override: the point of the cell is the layout npm actually
-            // produces — client's pinned zod nested beside the consumer's — so
-            // two copies coexist whenever they differ.
+            // produces, which must hold exactly the consumer's zod.
           },
           null,
           2,
@@ -146,6 +145,21 @@ try {
       if (!installed.startsWith(zodVersion.replace(/[^0-9.].*$/, ""))) {
         throw new Error(`expected zod ${zodVersion}, got ${installed}`);
       }
+      // The peer guarantee: every package resolves the consumer's zod, so an application
+      // that pins a patched zod gets no older copy nested beneath @ag-ui/*.
+      for (const name of ["core", ...SIBLINGS]) {
+        const resolved = execFileSync(
+          "node",
+          [
+            "-p",
+            `require(require.resolve("zod/package.json", { paths: [require.resolve("@ag-ui/${name}/package.json")] })).version`,
+          ],
+          { cwd: consumer, encoding: "utf8" },
+        ).trim();
+        if (resolved !== installed) {
+          throw new Error(`@ag-ui/${name} resolved zod ${resolved}, not the consumer's ${installed}`);
+        }
+      }
       console.log(`\n== zod@${installed} ==`);
       run("node", ["smoke.cjs"], consumer);
       run("node", ["smoke.mjs"], consumer);

sdks/typescript/packages/encoder/README.md

@@ -7,11 +7,15 @@ Event encoding utilities for the **Agent-User Interaction (AG-UI) Protocol**.
 ## Installation
 
 ```bash
-npm install @ag-ui/encoder
-pnpm add @ag-ui/encoder
-yarn add @ag-ui/encoder
+npm install @ag-ui/encoder zod
+pnpm add @ag-ui/encoder zod
+yarn add @ag-ui/encoder zod
 ```
 
+zod (3.25.18+ or 4.x) is a peer dependency. Protobuf encoding validates each
+event with the schemas on `@ag-ui/core/schemas`, using the zod your application
+installs rather than a bundled copy.
+
 ## Features
 
 - 🎯 **Content negotiation** – Automatic format selection based on `Accept` headers

sdks/typescript/packages/encoder/package.json

@@ -34,14 +34,18 @@
     "@ag-ui/core": "workspace:*",
     "@ag-ui/proto": "workspace:*"
   },
+  "peerDependencies": {
+    "zod": "^3.25.18 || ^4.0.0"
+  },
   "devDependencies": {
     "@vitest/coverage-istanbul": "^4.0.18",
     "eslint": "^9.37.0",
     "publint": "^0.3.12",
     "@arethetypeswrong/cli": "^0.17.4",
     "vitest": "^4.0.18",
     "tsdown": "^0.20.1",
-    "typescript": "^5.8.2"
+    "typescript": "^5.8.2",
+    "zod": "^3.25.76"
   },
   "exports": {
     ".": {

sdks/typescript/packages/proto/README.md

@@ -7,11 +7,15 @@ Protocol Buffer encoding/decoding for **Agent-User Interaction (AG-UI) Protocol*
 ## Installation
 
 ```bash
-npm install @ag-ui/proto
-pnpm add @ag-ui/proto
-yarn add @ag-ui/proto
+npm install @ag-ui/proto zod
+pnpm add @ag-ui/proto zod
+yarn add @ag-ui/proto zod
 ```
 
+zod (3.25.18+ or 4.x) is a peer dependency. `encode` validates each event with
+the schemas on `@ag-ui/core/schemas`, using the zod your application installs
+rather than a bundled copy.
+
 ## Features
 
 - ⚡ **High performance** – Binary protobuf encoding for minimal bandwidth usage

sdks/typescript/packages/proto/package.json

@@ -36,10 +36,12 @@
   },
   "dependencies": {
     "@ag-ui/core": "workspace:*",
-    "zod": "^3.25.76",
     "@bufbuild/protobuf": "^2.2.5",
     "@protobuf-ts/protoc": "^2.11.1"
   },
+  "peerDependencies": {
+    "zod": "^3.25.18 || ^4.0.0"
+  },
   "devDependencies": {
     "@vitest/coverage-istanbul": "^4.0.18",
     "eslint": "^9.37.0",
@@ -49,7 +51,8 @@
     "ts-proto": "^2.7.0",
     "tsdown": "^0.20.1",
     "typescript": "^5.8.2",
-    "@types/node": "^20.19.21"
+    "@types/node": "^20.19.21",
+    "zod": "^3.25.76"
   },
   "exports": {
     ".": {