Modernise zod idioms to v4

Replace the deprecated v3 string-method forms with the top-level
validator helpers zod 4 prefers:

- z.string().url()      → z.url()      (3 sites)
- z.string().uuid()     → z.uuid()     (5 sites)
- z.string().datetime() → z.iso.datetime() (9 sites)

Also swap the ZodIssueCode.custom compat-shim reference in
demo-bot.server.ts's superRefine for the bare string literal "custom",
which is v4's idiomatic form. No runtime change.

All 147 tests still pass.

The `parsed.error.issues.map(i => ({field, message}))` pattern in the
five journal API route handlers stays as-is — the fields we read are
unchanged in v4, and zod's new error helpers (z.treeifyError,
z.prettifyError) produce different shapes that would change our
public API error contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/api/src/activities.ts

@@ -2,24 +2,24 @@ import { z } from "zod";
 
 /** Activity summary for list views */
 export const ActivitySummarySchema = z.object({
-  id: z.string().uuid(),
+  id: z.uuid(),
   name: z.string(),
   description: z.string(),
-  routeId: z.string().uuid().nullable(),
+  routeId: z.uuid().nullable(),
   routeName: z.string().nullable(),
   distance: z.number().nullable(),
   duration: z.number().nullable(),
   elevationGain: z.number().nullable(),
   elevationLoss: z.number().nullable(),
-  startedAt: z.string().datetime().nullable(),
+  startedAt: z.iso.datetime().nullable(),
   geojson: z.string().nullable(),
-  createdAt: z.string().datetime(),
+  createdAt: z.iso.datetime(),
 });
 
 /** Full activity detail */
 export const ActivityDetailSchema = ActivitySummarySchema.extend({
   gpx: z.string().nullable(),
-  photos: z.array(z.string().url()),
+  photos: z.array(z.url()),
 });
 
 /** Paginated activity list response */
@@ -33,8 +33,8 @@ export const CreateActivityRequestSchema = z.object({
   name: z.string().min(1).max(200),
   description: z.string().max(5000).default(""),
   gpx: z.string().optional(),
-  routeId: z.string().uuid().optional(),
-  startedAt: z.string().datetime().optional(),
+  routeId: z.uuid().optional(),
+  startedAt: z.iso.datetime().optional(),
   duration: z.number().optional(),
   distance: z.number().optional(),
 });

packages/api/src/auth.ts

@@ -20,8 +20,8 @@ export const TokenResponseSchema = z.object({
 export const DeviceSchema = z.object({
   id: z.string(),
   deviceName: z.string().nullable(),
-  lastActiveAt: z.string().datetime(),
-  createdAt: z.string().datetime(),
+  lastActiveAt: z.iso.datetime(),
+  createdAt: z.iso.datetime(),
   isCurrent: z.boolean(),
 });
 

packages/api/src/discovery.ts

@@ -3,8 +3,8 @@ import { z } from "zod";
 export const DiscoveryResponseSchema = z.object({
   apiVersion: z.string(),
   instanceName: z.string(),
-  apiBaseUrl: z.string().url(),
-  tileUrl: z.string().url().optional(),
+  apiBaseUrl: z.url(),
+  tileUrl: z.url().optional(),
 });
 
 export type DiscoveryResponse = z.infer<typeof DiscoveryResponseSchema>;

packages/api/src/routes.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 
 /** Route summary for list views */
 export const RouteSummarySchema = z.object({
-  id: z.string().uuid(),
+  id: z.uuid(),
   name: z.string(),
   description: z.string(),
   distance: z.number().nullable(),
@@ -11,15 +11,15 @@ export const RouteSummarySchema = z.object({
   routingProfile: z.string().nullable(),
   dayBreaks: z.array(z.number()),
   geojson: z.string().nullable(),
-  createdAt: z.string().datetime(),
-  updatedAt: z.string().datetime(),
+  createdAt: z.iso.datetime(),
+  updatedAt: z.iso.datetime(),
 });
 
 /** Route version info */
 export const RouteVersionSchema = z.object({
   version: z.number(),
   changeDescription: z.string().nullable(),
-  createdAt: z.string().datetime(),
+  createdAt: z.iso.datetime(),
 });
 
 /** Full route detail */

packages/api/src/uploads.ts

@@ -4,13 +4,13 @@ export const PresignedUploadRequestSchema = z.object({
   filename: z.string(),
   contentType: z.string(),
   resourceType: z.enum(["route", "activity"]),
-  resourceId: z.string().uuid(),
+  resourceId: z.uuid(),
 });
 
 export const PresignedUploadResponseSchema = z.object({
-  uploadUrl: z.string().url(),
+  uploadUrl: z.url(),
   storageKey: z.string(),
-  expiresAt: z.string().datetime(),
+  expiresAt: z.iso.datetime(),
 });
 
 export type PresignedUploadRequest = z.infer<typeof PresignedUploadRequestSchema>;