[Bccorb]

Summary

The built declarations reference z.ZodPreprocess<B, unknown> (from WebAuthnRegisterStartQuerySchema), but package.json allowed zod: ^4.3.6. zod 4.3.x does not export ZodPreprocess and zod 4.4.x declares it with one type parameter, so a consumer resolving either with skipLibCheck: false failed to type-check this package. This raises the floor to the first zod release whose types accept the emitted .d.ts files, and adds a CI check so the floor cannot drift below the build again.

Related Issue

Closes #95

Changes

• dependencies.zod: ^4.3.6 to ^4.5.0 (lockfile still resolves 4.6.5).
• scripts/check-zod-floor.mjs (npm run test:zod-floor): packs the package, installs it plus the exact floor zod read from package.json into a scratch consumer, and runs tsc with strict: true, skipLibCheck: false under both moduleResolution: bundler and NodeNext. It imports ., ./role and ./role/matching.
• CI runs it after Build on every Node leg.
• Patch changeset.

Bisect

Packed 0.28.0 build (built against zod 4.6.5), consumer with TypeScript 5.9.3, strict: true, skipLibCheck: false. Each stable zod release from 4.3.6 up was installed as the only zod in the tree.

zod	bundler	NodeNext	Error
4.3.6	fail	fail	TS2724 has no exported member named 'ZodPreprocess'
4.4.0	fail	fail	TS2724
4.4.1	fail	fail	TS2724
4.4.2	fail	fail	TS2707 Generic type 'ZodPreprocess<B>' requires between 0 and 1 type arguments
4.4.3	fail	fail	TS2707
4.5.0	pass	pass
4.5.1 to 4.5.4	pass	pass
4.6.0 to 4.6.7	pass	pass

Lowest passing version: 4.5.0.

Before / after

With the old floor (^4.3.6):

zod 4.3.6, moduleResolution bundler: failed
node_modules/@seamless-auth/types/dist/schemas/webauthn/schema.d.ts(12,19): error TS2724: '".../node_modules/zod/v4/classic/external"' has no exported member named 'ZodPreprocess'. Did you mean 'preprocess'?
zod 4.3.6, moduleResolution NodeNext: failed
(same TS2724 errors)
The built declarations do not type-check against zod 4.3.6. Raise the zod floor in package.json.
exit 1

With an intermediate floor of ^4.4.3 (the version from the issue), the same check fails with TS2707.

With the new floor (^4.5.0):

zod 4.5.0, moduleResolution bundler: ok
zod 4.5.0, moduleResolution NodeNext: ok
exit 0

Why zod stays a dependency

Making zod a peer dependency would guarantee a single zod instance when consumers mix their own zod schemas with ours, which matters for type identity. It is not a clear win here: the package exports only schemas (no functions that take a caller's zod schema), the in-repo consumers (seamless-auth-server, seamless-cli) already resolve a single deduped zod 4.6.5, and moving to a peer changes install behavior for every consumer. That is a separate decision, so this PR only raises the floor.

Consumer impact

• No consumer has to change anything (patch)

Consumers already on zod 4.5.0 or later see no change. A consumer pinned to zod 4.4.x or older was already broken under skipLibCheck: false; npm will now install a nested zod 4.5+ for this package unless they upgrade, which they should. seamless-auth-server (pnpm lock at zod 4.6.5 after #216) and seamless-cli (zod ^4.6.5, lock 4.6.5) both satisfy the new floor.

Checklist

• Follows the repo's AGENTS.md and the org REPO-STANDARDS
• Conventional Commit messages; descriptive branch name
• Changeset added (npm run changeset); a change to src/ without one ships nothing
• New or changed schemas have tests, and every exported schema has its inferred type alias (no schema changes)
• All checks pass: npm run typecheck, npm run lint, npm run format:check, npm test (286 passed), npm run build, npm run test:zod-floor
• No AI or assistant attribution anywhere in commits, PR text, or docs
• No em dashes in public-facing text
• Docs updated if behavior or public contracts changed (README already says zod@^4)