fix: declare transports-http zod dependency

[kang-heewon]

Summary

@croco/transports-http now declares zod as a direct runtime dependency, so the package manifest matches the exported/source ParamResolver type surface instead of relying on transitive resolution through other Croco packages.

Fixes #699

변경 사항

• Added zod to @croco/transports-http dependencies using the same ^3.23.8 range as the REST protocol packages.
• Added a transports-http package manifest regression test for the direct zod dependency.
• Updated the lockfile importer entry and added a patch changeset.

Verification

• pnpm --filter @croco/transports-http exec vitest run src/tests/PackageManifest.spec.ts src/tests/ParamResolver.spec.ts src/tests/FrameworkIntegration.spec.ts (9 tests)
• pnpm build --filter=@croco/transports-http... (10 packages)
• pnpm typecheck --filter=@croco/transports-http (20 tasks)
• pnpm test --filter=@croco/transports-http (16 files, 101 tests)
• pnpm check
• git diff --check --cached
• pnpm exec changeset status --since origin/trunk (patch bump includes @croco/transports-http and fixed dependents)
• pnpm --filter @croco/transports-http pack --pack-destination /tmp/croco-transports-http-pack-smoke and tarball manifest check confirmed dependencies.zod === "^3.23.8"
• pre-push: auto-changeset, full pnpm test (195 tasks), full pnpm typecheck (194 tasks)

Self-review

• Correctness/regression: [transports-http] ParamResolver가 zod 공개 타입을 노출하지만 직접 의존성을 선언하지 않음 #699 acceptance is covered by the manifest regression test, lockfile importer entry, changeset status, and packed tarball manifest check proving the published package carries the direct zod dependency.
• API/security/compatibility/release: no public API signatures, runtime code, exports, or external behavior changed; this only makes an existing type/runtime validation dependency explicit and includes patch release metadata.
• Maintainability/minimality: the diff is limited to the package manifest, lockfile importer, one focused manifest test, and one changeset; no broader entrypoint-smoke matrix or unrelated dependency updates are included.

Risk

Low. The change adds a dependency already used across adjacent protocol packages; package managers may install an explicit zod@3.x for @croco/transports-http instead of relying on transitive workspace resolution.

Summary by CodeRabbit

릴리스 노트

• 버그 수정

  • 클린 설치 환경에서 ParamResolver 관련 기능이 올바르게 작동하도록 런타임 의존성 구성 개선

• 테스트

  • 패키지 의존성 검증 테스트 추가

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: cdfa76e4-e804-4167-8330-a7a2258dcd41

📥 Commits

Reviewing files that changed from the base of the PR and between 2631037 and 3882126.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• .changeset/transports-http-zod-dependency.md
• packages/transports-http/package.json
• packages/transports-http/src/tests/PackageManifest.spec.ts

---

📝 Walkthrough

Walkthrough

@croco/transports-http 패키지의 package.json에 reflect-metadata(0.2.2)와 zod(^3.23.8)를 직접 의존성으로 추가한다. 선언이 올바른지 검증하는 Vitest 테스트 파일과 패치 릴리즈용 changeset 파일도 함께 추가된다.

Changes

zod 직접 의존성 선언 및 검증

Layer / File(s)	Summary
런타임 의존성 선언 및 changeset packages/transports-http/package.json, .changeset/transports-http-zod-dependency.md	dependencies에 reflect-metadata: 0.2.2와 zod: ^3.23.8을 추가하고, 패치 릴리즈를 트리거하는 changeset 파일을 추가한다.
package.json manifest 검증 테스트 packages/transports-http/src/tests/PackageManifest.spec.ts	package.json을 import하여 dependencies.zod가 ^3.23.8로 선언되어 있는지 단일 Vitest 테스트로 검증한다.

예상 코드 리뷰 난이도

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 주요 변경 사항인 zod 의존성 선언을 명확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	PR은 #699의 모든 수용 기준을 충족합니다: zod를 직접 의존성으로 추가하고 패키지 테스트를 구현했습니다.
Out of Scope Changes check	✅ Passed	모든 변경 사항은 zod 의존성 선언이라는 명확한 범위 내에 있으며 API나 런타임 동작을 수정하지 않습니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-699-transports-http-zod

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📊 Benchmark Results

✅ All benchmarks passed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status
CrocoApp benchmarks	1.8μs	-	-	-	⚠️
EventBusConfig.start (10 handlers)	0.8μs	-	9.0μs	-91.0%	✅
EventPublisher.publishNow single event	1.0μs	-	-	-	⚠️
DefaultHandlerResolver.resolve × 10	0.1μs	-	0.2μs	-75.0%	✅
Container.get singleton (cold)	0.5μs	-	0.5μs	+2.2%	✅
Container.register × 50 components	6.6μs	-	8.0μs	-17.8%	✅
Container.validate (50 components)	17.1μs	-	25.0μs	-31.6%	✅
Container.get singleton (warm)	0.2μs	-	0.3μs	-36.3%	✅
TelemetryRuntime benchmarks	1.0μs	-	2.0μs	-50.5%	✅

_{Updated: 2026-06-14T16:47:15.963Z · Commit: 76fb6a9}