fix(types): declare record output and input as members, not base type arguments - #6645

… arguments (#6645)

microsoft/TypeScript#64372 stops base type arguments from reading the members of the interface being declared, so z.json(), whose record branch refers back to the JSON schema, reported TS5115 and inferred a record input of any.

the record internals fix from this branch landed separately in #6645, which matches the change Anders suggested in microsoft/TypeScript#64372; this keeps the regression test.

Fixes #6637

Co-Authored-By: Claude Opus 5.5 <[email protected]>

A workspace package's exports name its source, so a package that imports a
migrated package reads its .vibe source, and tsc cannot. One checker serves
every package: vibelang is TypeScript 7's checker on plain TypeScript and
also reads .vibe files, each with its own package's VibeLang settings.

- Typecheck runs `vibelang -p <tsconfig> --noEmit` or `vibelang -b
  <tsconfig>` with the arguments it gave tsc. The `compiler` attribute, which
  kept a second path, is gone from Typecheck and from
  BuildAndCheckTypeScriptPackage, whose default `sources`, `tests` and
  `testSources` globs name .vibe files beside .ts ones.
- Every package `check` and `typecheck` script runs vibelang, including the
  three packages added since (secrets, repo-view, terminal-frame); the root
  devDependency provides it.
- Markdown.CodeBlocks compiles fenced blocks with `vibelang --ignoreConfig`
  (TypeScript 7 refuses command-line files beside a tsconfig.json, TS5112),
  and the site's typecheck test runs vibelang.
- Code TypeScript 7 rejects is fixed so it compiles under 7 and 5.9:
  repo-targets names `types: ["node"]`, platform-node's expect thunks are
  annotated, flow's ts-expect-error case is one line, ScriptedModel's stream
  is typed, .smithers/flows' evaluateAll branches share a type, rpc's
  recursive getter is annotated, and apps/app's WebSocket frames and
  HelpBubble selectors type-check under TypeScript 7's lib.dom.
- zod 4.6.7 in the five packages that pin zod. zod 4.5.0 to 4.6.5 fail
  TypeScript 7.1 with TS5115 ("Instantiations of the following types appear
  infinitely circular") at packages/rpc/src/FactoryProjection.ts, which broke
  every package that imports @smthrs/rpc. The cause is microsoft/TypeScript
  #64605; zod fixed its declarations in colinhacks/zod#6645 (4.6.6). 4.6.7
  was published on 2026-10-12.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

<h3>Snyk has created this PR to upgrade zod from 4.6.6 to 4.6.7.</h3>

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

<hr/>

- The recommended version is **1 version** ahead of your current version.

- The recommended version was released **21 days ago**.

#### Breaking Change Risk

![Merge Risk: Low](https://img.shields.io/badge/Merge%20Risk%3A%20Low-006400?style=for-the-badge)

> **Notice:** This assessment is enhanced by AI.

<details>
<summary><b>Release notes</b></summary>
<br/>
  <details>
    <summary>Package name: <b>zod</b></summary>
    <ul>
      <li>
        <b>4.6.7</b> - <a href="https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.7">2026-10-12</a></br><h2>Commits:</h2>
<ul>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/b500a2ee95134f81d74da7911d7378dd2853d042/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/b500a2ee95134f81d74da7911d7378dd2853d042"><tt>b500a2e</tt></a> 4.6.7</li>
</ul>
      </li>
      <li>
        <b>4.6.6</b> - <a href="https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.6">2026-10-11</a></br><blockquote>
<p>Six malicious commits pushed to <code>main</code> on September 21 with a compromised git credential were reverted the same day in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5532697020" data-permission-text="Title is private" data-url="colinhacks/zod#6620" data-hovercard-type="pull_request" data-hovercard-url="/colinhacks/zod/pull/6620/hovercard" href="https://redirect.github.com/colinhacks/zod/pull/6620">#6620</a> and have since been removed from the history of <code>main</code>. None were ever published to npm. The npm provenance for 4.6.6 names <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/284243fb0d6532665afdc9239188773bb624f73c/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/284243fb0d6532665afdc9239188773bb624f73c"><tt>284243f</tt></a>, the pre-rewrite copy of <a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1"><tt>9c21983</tt></a> with identical contents.</p>
</blockquote>
<h2>Commits:</h2>
<ul>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/0cd3af5e9f50ad11bbcd4407a46a21b8848ba574/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/0cd3af5e9f50ad11bbcd4407a46a21b8848ba574"><tt>0cd3af5</tt></a> docs: load the en locale directly in Zod Mini</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/9d5e60f162997b764b40d45aa02481888db50dea/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/9d5e60f162997b764b40d45aa02481888db50dea"><tt>9d5e60f</tt></a> docs: import locales from zod/locales, not z.locales</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/34a626f307871ecbb0123947559328dc52ed5e3e/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/34a626f307871ecbb0123947559328dc52ed5e3e"><tt>34a626f</tt></a> docs: tighten the z.locales tree-shaking note</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/74304ce5b5796b5edb9a88ceb8e170b6ea3e82df/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/74304ce5b5796b5edb9a88ceb8e170b6ea3e82df"><tt>74304ce</tt></a> release: stage npm versions instead of publishing them (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5535952118" data-permission-text="Title is private" data-url="colinhacks/zod#6622" data-hovercard-type="pull_request" data-hovercard-url="/colinhacks/zod/pull/6622/hovercard" href="https://redirect.github.com/colinhacks/zod/pull/6622">#6622</a>)</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/b2ef983e0711ff6517d6020b021071e2e5653efa/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/b2ef983e0711ff6517d6020b021071e2e5653efa"><tt>b2ef983</tt></a> docs: add Code for Japan to bronze sponsors</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/8fb2faf0584828a6a027d8279db36f6f52784462/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/8fb2faf0584828a6a027d8279db36f6f52784462"><tt>8fb2faf</tt></a> docs: crop the Code for Japan logo and list it first in bronze</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/bacad518c41610d654658172d325874bf0ee6290/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/bacad518c41610d654658172d325874bf0ee6290"><tt>bacad51</tt></a> docs: square the Code for Japan logo to match the other bronze tiles</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/c42596bd1c87e941d7241d10e012c5c196adcc10/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/c42596bd1c87e941d7241d10e012c5c196adcc10"><tt>c42596b</tt></a> release: hold the run on the release-approval environment until the staged versions are approved (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5650176933" data-permission-text="Title is private" data-url="colinhacks/zod#6638" data-hovercard-type="pull_request" data-hovercard-url="/colinhacks/zod/pull/6638/hovercard" href="https://redirect.github.com/colinhacks/zod/pull/6638">#6638</a>)</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/a2ba4a67986a3e6b2b131be30084a2f460d9ea67/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/a2ba4a67986a3e6b2b131be30084a2f460d9ea67"><tt>a2ba4a6</tt></a> fix(types): declare record output and input as members, not base type arguments (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5681347415" data-permission-text="Title is private" data-url="colinhacks/zod#6645" data-hovercard-type="pull_request" data-hovercard-url="/colinhacks/zod/pull/6645/hovercard" href="https://redirect.github.com/colinhacks/zod/pull/6645">#6645</a>)</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"><tt>a0ebf97</tt></a> fix(v4): check array, set and map size bounds before parsing elements (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5748245663" data-permission-text="Title is private" data-url="colinhacks/zod#6652" data-hovercard-type="pull_request" data-hovercard-url="/colinhacks/zod/pull/6652/hovercard" href="https://redirect.github.com/colinhacks/zod/pull/6652">#6652</a>)</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/529f78dd9431b07f49647fee3aa0819b3f8b66b7/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/529f78dd9431b07f49647fee3aa0819b3f8b66b7"><tt>529f78d</tt></a> 4.6.6</li>
<li><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1/hovercard" href="https://redirect.github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1"><tt>9c21983</tt></a> ci: stage at verbose so a failed OIDC token exchange says why</li>
</ul>
      </li>
    </ul>
    from <a href="https://redirect.github.com/colinhacks/zod/releases">zod GitHub release notes</a>
  </details>
</details>

---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - This PR was automatically created by Snyk using the credentials of a real user.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._

**For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6ImZha2Uta2V5IiwiYW5vbnltb3VzSWQiOiI2NmUwMjczOC0yYTBhLTRiMzMtOWE0ZS02NmU5YWUyMTYzZmEiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjY2ZTAyNzM4LTJhMGEtNGIzMy05YTRlLTY2ZTlhZTIxNjNmYSJ9fQ==" width="0" height="0"/>

> - 🧐 [View latest project report](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1a72459-d983-4446-8d5e-73739c13b5ba?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template)
> - 🛠 [Adjust upgrade PR settings](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1a72459-d983-4446-8d5e-73739c13b5ba/settings/integration?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr)
> - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1a72459-d983-4446-8d5e-73739c13b5ba/settings/integration?pkg&#x3D;zod&amp;utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;upgrade-pr#auto-dep-upgrades)

[//]: # 'snyk:metadata:{"breakingChangeRiskLevel":"low","FF_showPullRequestBreakingChanges":true,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"zod","from":"4.6.6","to":"4.6.7"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"66e02738-2a0a-4b33-9a4e-66e9ae2163fa","prPublicId":"66e02738-2a0a-4b33-9a4e-66e9ae2163fa","packageManager":"npm","priorityScoreList":[],"projectPublicId":"e1a72459-d983-4446-8d5e-73739c13b5ba","projectUrl":"https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/e1a72459-d983-4446-8d5e-73739c13b5ba?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":1,"publishedDate":"2026-10-12T16:29:37.778Z"},"vulns":[]}'