[mldangelo-oai]

Summary

SDK schema modules import Zod through the CLI framework, which unnecessarily initializes Incur when loading the SDK. Import Zod directly from the SDK's existing dependency.

Changes

Switch the Zod imports in finding import, Cloud publication, and host protocol modules to zod. Schemas and dependency versions stay unchanged.

Testing

• Existing finding-import, Cloud publication, and Node host-protocol tests: 58 passed.
• pnpm run types, pnpm run format, pnpm run build:ci, and pnpm run build: passed.
• Built SDK import trace: no Incur modules initialized; the direct dependency resolves to the same Zod package as Incur.
• Both full SDK suites (seeds 12345 and 1187573209): each had 4,899 passed, 65 skipped, 11 failed. All failures stop at Git-root discovery because of a pre-existing invalid Git marker above the local checkout. The affected files are unchanged from the base, and all 11 cases pass on Linux, macOS, and Windows in this PR's CI run.
• pnpm pack, pnpm run check:package <archive>, and pnpm run test:package <archive>: passed, including installed SDK imports, NodeNext types, CLI lifecycle, hosted protocol, and Deep worker/restart smoke checks.

Risk and rollout

Low-risk dependency cleanup with no public API, CLI, schema, or dependency-version changes. The lockfile resolves both import paths to Zod 4.6.5.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T04:09:27.927704Z	1fcccbb	PR opened
🔒 Security Review	✅ Completed 2026-10-19T04:10:27.571898Z	1fcccbb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.